Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27-07-2024 03:51
Static task
static1
Behavioral task
behavioral1
Sample
cb4d4eaac03c13cf23807ed300616f492cd130e726f9b971824da63a56b025ac.exe
Resource
win7-20240704-en
General
-
Target
cb4d4eaac03c13cf23807ed300616f492cd130e726f9b971824da63a56b025ac.exe
-
Size
343KB
-
MD5
fa0bc367e69dbd0a7e2cfe0532dbc113
-
SHA1
3fcf2f6cb76b1a4f6fb90edc5a3fcec1d1c5c56b
-
SHA256
cb4d4eaac03c13cf23807ed300616f492cd130e726f9b971824da63a56b025ac
-
SHA512
32ec6e08efdaac5f45f91459945644d9f827d9fe6107ddd3b12638faefefde245a3cc7958265fb961f41195855f77a55fd9c3c12ce48dec9be67014626181ac8
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAs:l7TcbWXZshJX2VGds
Malware Config
Signatures
-
Detect Blackmoon payload 52 IoCs
Processes:
resource yara_rule behavioral1/memory/2840-0-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2712-20-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2856-16-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2860-36-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2752-45-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2592-48-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2096-63-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/880-66-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/708-81-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1272-91-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2296-100-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2548-107-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2568-119-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2916-117-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1288-155-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/844-196-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2012-204-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2180-217-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon behavioral1/memory/1340-230-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/600-248-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2064-274-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2872-302-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2876-311-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2696-319-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2576-332-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2644-346-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/764-353-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/764-361-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/764-359-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1604-375-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1700-395-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2312-410-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/576-474-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2300-489-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1592-509-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1892-522-0x0000000000430000-0x0000000000458000-memory.dmp family_blackmoon behavioral1/memory/2156-541-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1240-548-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2732-575-0x00000000003A0000-0x00000000003C8000-memory.dmp family_blackmoon behavioral1/memory/1044-606-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/264-631-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1624-650-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/708-658-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2980-678-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2228-704-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2180-785-0x00000000002E0000-0x0000000000308000-memory.dmp family_blackmoon behavioral1/memory/2016-845-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/3024-858-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/2584-892-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2352-953-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2324-952-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1476-1101-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
fxrrlfl.exedpvpv.exeflrffxx.exerxxrxxf.exedvjpp.exedvjvj.exenbnhhh.exeppdjd.exe1tntbn.exelxrlrll.exedpvjj.exebbnnnh.exelrlxlxx.exejjdvj.exe9ddpd.exe7fxfllx.exedjvjd.exelfxxrlr.exethtnhb.exe7fxrffr.exe9vddj.exebnhhnb.exepjjdv.exe1tnhbh.exe3vvpp.exehtnttn.exejdjjj.exellfrfrl.exe5dvvd.exe5lrfxlf.exe7ddjv.exerffxflx.exe9tnntb.exepvvjj.exenhhbhn.exedjdjj.exeddvjd.exebbbnnb.exevpjpv.exerllxlxx.exebhtthh.exevpjdv.exerxfrxll.exehbnbbh.exelrlrxlx.exebnbhtb.exe1jvdd.exejdppv.exerxlflxl.exe1nbntt.exedvpvd.exexlrxlxf.exexrlxlrf.exehbnbhb.exepdvpv.exexfxxrxf.exexrrrlrl.exebbbnnh.exejddvj.exerfrfrff.exenhbhnb.exejjjjv.exehhtbhb.exe9vppj.exepid process 2856 fxrrlfl.exe 2712 dpvpv.exe 2860 flrffxx.exe 2752 rxxrxxf.exe 2592 dvjpp.exe 2096 dvjvj.exe 880 nbnhhh.exe 708 ppdjd.exe 1272 1tntbn.exe 2296 lxrlrll.exe 2548 dpvjj.exe 2916 bbnnnh.exe 2568 lrlxlxx.exe 660 jjdvj.exe 2544 9ddpd.exe 1288 7fxfllx.exe 2448 djvjd.exe 2132 lfxxrlr.exe 2476 thtnhb.exe 2072 7fxrffr.exe 844 9vddj.exe 2012 bnhhnb.exe 1284 pjjdv.exe 2180 1tnhbh.exe 1340 3vvpp.exe 2404 htnttn.exe 600 jdjjj.exe 1888 llfrfrl.exe 2128 5dvvd.exe 2064 5lrfxlf.exe 1960 7ddjv.exe 316 rffxflx.exe 2852 9tnntb.exe 2872 pvvjj.exe 1584 nhhbhn.exe 2876 djdjj.exe 2696 ddvjd.exe 2608 bbbnnb.exe 2576 vpjpv.exe 2644 rllxlxx.exe 2700 bhtthh.exe 764 vpjdv.exe 1624 rxfrxll.exe 1604 hbnbbh.exe 2144 lrlrxlx.exe 2352 bnbhtb.exe 1700 1jvdd.exe 2988 jdppv.exe 2312 rxlflxl.exe 2952 1nbntt.exe 2472 dvpvd.exe 660 xlrxlxf.exe 856 xrlxlrf.exe 2460 hbnbhb.exe 1956 pdvpv.exe 2136 xfxxrxf.exe 2464 xrrrlrl.exe 1944 bbbnnh.exe 2184 jddvj.exe 576 rfrfrff.exe 2300 nhbhnb.exe 2012 jjjjv.exe 1284 hhtbhb.exe 1592 9vppj.exe -
Processes:
resource yara_rule behavioral1/memory/2840-0-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2856-8-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2712-20-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2856-16-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2860-36-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2752-45-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2592-48-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2096-63-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/880-66-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1272-91-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2296-100-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2548-107-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2568-119-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2916-117-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1288-155-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/844-196-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2012-204-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1340-230-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/600-248-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2064-274-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2876-311-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2696-319-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2576-332-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2644-346-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/764-353-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1604-368-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1604-375-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2352-382-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1700-395-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2312-410-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/576-474-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2300-481-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2300-489-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1592-509-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2156-541-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1240-548-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2904-555-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1044-606-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/708-658-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2352-665-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2980-678-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2228-704-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2460-717-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2136-731-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1256-744-0x0000000000230000-0x0000000000258000-memory.dmp upx behavioral1/memory/2340-826-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1676-870-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2636-885-0x0000000001B50000-0x0000000001B78000-memory.dmp upx behavioral1/memory/2584-892-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2912-912-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2968-939-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1288-984-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2088-1021-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2128-1088-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1476-1101-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
dddpp.exelfrfxrl.exevpdjv.exevjpdp.exe1nnnbt.exejjjjv.exepvvjd.exevvvdp.exe9vvvv.exexxlrfxf.exejdvdp.exelfxrflx.exedjdjj.exe5tbhnt.exefrxfrxr.exettttnh.exenhbhnb.exe7pppv.exedppjj.exefflfxrl.exenbbhhn.exehtbtbn.exetnnnhb.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cb4d4eaac03c13cf23807ed300616f492cd130e726f9b971824da63a56b025ac.exefxrrlfl.exedpvpv.exeflrffxx.exerxxrxxf.exedvjpp.exedvjvj.exenbnhhh.exeppdjd.exe1tntbn.exelxrlrll.exedpvjj.exebbnnnh.exelrlxlxx.exejjdvj.exe9ddpd.exedescription pid process target process PID 2840 wrote to memory of 2856 2840 cb4d4eaac03c13cf23807ed300616f492cd130e726f9b971824da63a56b025ac.exe fxrrlfl.exe PID 2840 wrote to memory of 2856 2840 cb4d4eaac03c13cf23807ed300616f492cd130e726f9b971824da63a56b025ac.exe fxrrlfl.exe PID 2840 wrote to memory of 2856 2840 cb4d4eaac03c13cf23807ed300616f492cd130e726f9b971824da63a56b025ac.exe fxrrlfl.exe PID 2840 wrote to memory of 2856 2840 cb4d4eaac03c13cf23807ed300616f492cd130e726f9b971824da63a56b025ac.exe fxrrlfl.exe PID 2856 wrote to memory of 2712 2856 fxrrlfl.exe dpvpv.exe PID 2856 wrote to memory of 2712 2856 fxrrlfl.exe dpvpv.exe PID 2856 wrote to memory of 2712 2856 fxrrlfl.exe dpvpv.exe PID 2856 wrote to memory of 2712 2856 fxrrlfl.exe dpvpv.exe PID 2712 wrote to memory of 2860 2712 dpvpv.exe flrffxx.exe PID 2712 wrote to memory of 2860 2712 dpvpv.exe flrffxx.exe PID 2712 wrote to memory of 2860 2712 dpvpv.exe flrffxx.exe PID 2712 wrote to memory of 2860 2712 dpvpv.exe flrffxx.exe PID 2860 wrote to memory of 2752 2860 flrffxx.exe rxxrxxf.exe PID 2860 wrote to memory of 2752 2860 flrffxx.exe rxxrxxf.exe PID 2860 wrote to memory of 2752 2860 flrffxx.exe rxxrxxf.exe PID 2860 wrote to memory of 2752 2860 flrffxx.exe rxxrxxf.exe PID 2752 wrote to memory of 2592 2752 rxxrxxf.exe dvjpp.exe PID 2752 wrote to memory of 2592 2752 rxxrxxf.exe dvjpp.exe PID 2752 wrote to memory of 2592 2752 rxxrxxf.exe dvjpp.exe PID 2752 wrote to memory of 2592 2752 rxxrxxf.exe dvjpp.exe PID 2592 wrote to memory of 2096 2592 dvjpp.exe dvjvj.exe PID 2592 wrote to memory of 2096 2592 dvjpp.exe dvjvj.exe PID 2592 wrote to memory of 2096 2592 dvjpp.exe dvjvj.exe PID 2592 wrote to memory of 2096 2592 dvjpp.exe dvjvj.exe PID 2096 wrote to memory of 880 2096 dvjvj.exe nbnhhh.exe PID 2096 wrote to memory of 880 2096 dvjvj.exe nbnhhh.exe PID 2096 wrote to memory of 880 2096 dvjvj.exe nbnhhh.exe PID 2096 wrote to memory of 880 2096 dvjvj.exe nbnhhh.exe PID 880 wrote to memory of 708 880 nbnhhh.exe ppdjd.exe PID 880 wrote to memory of 708 880 nbnhhh.exe ppdjd.exe PID 880 wrote to memory of 708 880 nbnhhh.exe ppdjd.exe PID 880 wrote to memory of 708 880 nbnhhh.exe ppdjd.exe PID 708 wrote to memory of 1272 708 ppdjd.exe 1tntbn.exe PID 708 wrote to memory of 1272 708 ppdjd.exe 1tntbn.exe PID 708 wrote to memory of 1272 708 ppdjd.exe 1tntbn.exe PID 708 wrote to memory of 1272 708 ppdjd.exe 1tntbn.exe PID 1272 wrote to memory of 2296 1272 1tntbn.exe lxrlrll.exe PID 1272 wrote to memory of 2296 1272 1tntbn.exe lxrlrll.exe PID 1272 wrote to memory of 2296 1272 1tntbn.exe lxrlrll.exe PID 1272 wrote to memory of 2296 1272 1tntbn.exe lxrlrll.exe PID 2296 wrote to memory of 2548 2296 lxrlrll.exe dpvjj.exe PID 2296 wrote to memory of 2548 2296 lxrlrll.exe dpvjj.exe PID 2296 wrote to memory of 2548 2296 lxrlrll.exe dpvjj.exe PID 2296 wrote to memory of 2548 2296 lxrlrll.exe dpvjj.exe PID 2548 wrote to memory of 2916 2548 dpvjj.exe bbnnnh.exe PID 2548 wrote to memory of 2916 2548 dpvjj.exe bbnnnh.exe PID 2548 wrote to memory of 2916 2548 dpvjj.exe bbnnnh.exe PID 2548 wrote to memory of 2916 2548 dpvjj.exe bbnnnh.exe PID 2916 wrote to memory of 2568 2916 bbnnnh.exe lrlxlxx.exe PID 2916 wrote to memory of 2568 2916 bbnnnh.exe lrlxlxx.exe PID 2916 wrote to memory of 2568 2916 bbnnnh.exe lrlxlxx.exe PID 2916 wrote to memory of 2568 2916 bbnnnh.exe lrlxlxx.exe PID 2568 wrote to memory of 660 2568 lrlxlxx.exe jjdvj.exe PID 2568 wrote to memory of 660 2568 lrlxlxx.exe jjdvj.exe PID 2568 wrote to memory of 660 2568 lrlxlxx.exe jjdvj.exe PID 2568 wrote to memory of 660 2568 lrlxlxx.exe jjdvj.exe PID 660 wrote to memory of 2544 660 jjdvj.exe 9ddpd.exe PID 660 wrote to memory of 2544 660 jjdvj.exe 9ddpd.exe PID 660 wrote to memory of 2544 660 jjdvj.exe 9ddpd.exe PID 660 wrote to memory of 2544 660 jjdvj.exe 9ddpd.exe PID 2544 wrote to memory of 1288 2544 9ddpd.exe 7fxfllx.exe PID 2544 wrote to memory of 1288 2544 9ddpd.exe 7fxfllx.exe PID 2544 wrote to memory of 1288 2544 9ddpd.exe 7fxfllx.exe PID 2544 wrote to memory of 1288 2544 9ddpd.exe 7fxfllx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb4d4eaac03c13cf23807ed300616f492cd130e726f9b971824da63a56b025ac.exe"C:\Users\Admin\AppData\Local\Temp\cb4d4eaac03c13cf23807ed300616f492cd130e726f9b971824da63a56b025ac.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\fxrrlfl.exec:\fxrrlfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\dpvpv.exec:\dpvpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\flrffxx.exec:\flrffxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\rxxrxxf.exec:\rxxrxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\dvjpp.exec:\dvjpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\dvjvj.exec:\dvjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\nbnhhh.exec:\nbnhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\ppdjd.exec:\ppdjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
\??\c:\1tntbn.exec:\1tntbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\lxrlrll.exec:\lxrlrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\dpvjj.exec:\dpvjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\bbnnnh.exec:\bbnnnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\lrlxlxx.exec:\lrlxlxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\jjdvj.exec:\jjdvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\9ddpd.exec:\9ddpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\7fxfllx.exec:\7fxfllx.exe17⤵
- Executes dropped EXE
PID:1288 -
\??\c:\djvjd.exec:\djvjd.exe18⤵
- Executes dropped EXE
PID:2448 -
\??\c:\lfxxrlr.exec:\lfxxrlr.exe19⤵
- Executes dropped EXE
PID:2132 -
\??\c:\thtnhb.exec:\thtnhb.exe20⤵
- Executes dropped EXE
PID:2476 -
\??\c:\7fxrffr.exec:\7fxrffr.exe21⤵
- Executes dropped EXE
PID:2072 -
\??\c:\9vddj.exec:\9vddj.exe22⤵
- Executes dropped EXE
PID:844 -
\??\c:\bnhhnb.exec:\bnhhnb.exe23⤵
- Executes dropped EXE
PID:2012 -
\??\c:\pjjdv.exec:\pjjdv.exe24⤵
- Executes dropped EXE
PID:1284 -
\??\c:\1tnhbh.exec:\1tnhbh.exe25⤵
- Executes dropped EXE
PID:2180 -
\??\c:\3vvpp.exec:\3vvpp.exe26⤵
- Executes dropped EXE
PID:1340 -
\??\c:\htnttn.exec:\htnttn.exe27⤵
- Executes dropped EXE
PID:2404 -
\??\c:\jdjjj.exec:\jdjjj.exe28⤵
- Executes dropped EXE
PID:600 -
\??\c:\llfrfrl.exec:\llfrfrl.exe29⤵
- Executes dropped EXE
PID:1888 -
\??\c:\5dvvd.exec:\5dvvd.exe30⤵
- Executes dropped EXE
PID:2128 -
\??\c:\5lrfxlf.exec:\5lrfxlf.exe31⤵
- Executes dropped EXE
PID:2064 -
\??\c:\7ddjv.exec:\7ddjv.exe32⤵
- Executes dropped EXE
PID:1960 -
\??\c:\rffxflx.exec:\rffxflx.exe33⤵
- Executes dropped EXE
PID:316 -
\??\c:\9tnntb.exec:\9tnntb.exe34⤵
- Executes dropped EXE
PID:2852 -
\??\c:\pvvjj.exec:\pvvjj.exe35⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nhhbhn.exec:\nhhbhn.exe36⤵
- Executes dropped EXE
PID:1584 -
\??\c:\djdjj.exec:\djdjj.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2876 -
\??\c:\ddvjd.exec:\ddvjd.exe38⤵
- Executes dropped EXE
PID:2696 -
\??\c:\bbbnnb.exec:\bbbnnb.exe39⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vpjpv.exec:\vpjpv.exe40⤵
- Executes dropped EXE
PID:2576 -
\??\c:\rllxlxx.exec:\rllxlxx.exe41⤵
- Executes dropped EXE
PID:2644 -
\??\c:\bhtthh.exec:\bhtthh.exe42⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vpjdv.exec:\vpjdv.exe43⤵
- Executes dropped EXE
PID:764 -
\??\c:\rxfrxll.exec:\rxfrxll.exe44⤵
- Executes dropped EXE
PID:1624 -
\??\c:\hbnbbh.exec:\hbnbbh.exe45⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lrlrxlx.exec:\lrlrxlx.exe46⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bnbhtb.exec:\bnbhtb.exe47⤵
- Executes dropped EXE
PID:2352 -
\??\c:\1jvdd.exec:\1jvdd.exe48⤵
- Executes dropped EXE
PID:1700 -
\??\c:\jdppv.exec:\jdppv.exe49⤵
- Executes dropped EXE
PID:2988 -
\??\c:\rxlflxl.exec:\rxlflxl.exe50⤵
- Executes dropped EXE
PID:2312 -
\??\c:\1nbntt.exec:\1nbntt.exe51⤵
- Executes dropped EXE
PID:2952 -
\??\c:\dvpvd.exec:\dvpvd.exe52⤵
- Executes dropped EXE
PID:2472 -
\??\c:\xlrxlxf.exec:\xlrxlxf.exe53⤵
- Executes dropped EXE
PID:660 -
\??\c:\xrlxlrf.exec:\xrlxlrf.exe54⤵
- Executes dropped EXE
PID:856 -
\??\c:\hbnbhb.exec:\hbnbhb.exe55⤵
- Executes dropped EXE
PID:2460 -
\??\c:\pdvpv.exec:\pdvpv.exe56⤵
- Executes dropped EXE
PID:1956 -
\??\c:\xfxxrxf.exec:\xfxxrxf.exe57⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xrrrlrl.exec:\xrrrlrl.exe58⤵
- Executes dropped EXE
PID:2464 -
\??\c:\bbbnnh.exec:\bbbnnh.exe59⤵
- Executes dropped EXE
PID:1944 -
\??\c:\jddvj.exec:\jddvj.exe60⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rfrfrff.exec:\rfrfrff.exe61⤵
- Executes dropped EXE
PID:576 -
\??\c:\nhbhnb.exec:\nhbhnb.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2300 -
\??\c:\jjjjv.exec:\jjjjv.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2012 -
\??\c:\hhtbhb.exec:\hhtbhb.exe64⤵
- Executes dropped EXE
PID:1284 -
\??\c:\9vppj.exec:\9vppj.exe65⤵
- Executes dropped EXE
PID:1592 -
\??\c:\djvpj.exec:\djvpj.exe66⤵PID:1528
-
\??\c:\5rllrxl.exec:\5rllrxl.exe67⤵PID:1892
-
\??\c:\hhbnnt.exec:\hhbnnt.exe68⤵PID:1776
-
\??\c:\jjjvd.exec:\jjjvd.exe69⤵PID:600
-
\??\c:\rxrxlrl.exec:\rxrxlrl.exe70⤵PID:2156
-
\??\c:\flrflxx.exec:\flrflxx.exe71⤵PID:1240
-
\??\c:\5nbhhn.exec:\5nbhhn.exe72⤵PID:984
-
\??\c:\pjjdd.exec:\pjjdd.exe73⤵PID:2904
-
\??\c:\xxxfllx.exec:\xxxfllx.exe74⤵PID:1324
-
\??\c:\hnnbtn.exec:\hnnbtn.exe75⤵PID:2732
-
\??\c:\dpvdv.exec:\dpvdv.exe76⤵PID:2856
-
\??\c:\jpvvv.exec:\jpvvv.exe77⤵PID:2588
-
\??\c:\xlffrrf.exec:\xlffrrf.exe78⤵PID:1584
-
\??\c:\1tbtbb.exec:\1tbtbb.exe79⤵PID:2956
-
\??\c:\pppdv.exec:\pppdv.exe80⤵PID:2320
-
\??\c:\rxlxfrx.exec:\rxlxfrx.exe81⤵PID:1044
-
\??\c:\btbbtb.exec:\btbbtb.exe82⤵PID:2204
-
\??\c:\ddjjp.exec:\ddjjp.exe83⤵PID:2596
-
\??\c:\9dpjj.exec:\9dpjj.exe84⤵PID:264
-
\??\c:\ffrfrrf.exec:\ffrfrrf.exe85⤵PID:544
-
\??\c:\vpvdp.exec:\vpvdp.exe86⤵PID:1472
-
\??\c:\jpvvj.exec:\jpvvj.exe87⤵PID:1624
-
\??\c:\rrflffx.exec:\rrflffx.exe88⤵PID:708
-
\??\c:\ttntnn.exec:\ttntnn.exe89⤵PID:2528
-
\??\c:\jdjpd.exec:\jdjpd.exe90⤵PID:2352
-
\??\c:\frxxrrf.exec:\frxxrrf.exe91⤵PID:2548
-
\??\c:\bhnhnn.exec:\bhnhnn.exe92⤵PID:2980
-
\??\c:\pdddd.exec:\pdddd.exe93⤵PID:2116
-
\??\c:\dddpd.exec:\dddpd.exe94⤵PID:2348
-
\??\c:\xrllfrl.exec:\xrllfrl.exe95⤵PID:2228
-
\??\c:\7nhbbn.exec:\7nhbbn.exe96⤵PID:1428
-
\??\c:\ppvpd.exec:\ppvpd.exe97⤵PID:2252
-
\??\c:\rrrrxxf.exec:\rrrrxxf.exe98⤵PID:2460
-
\??\c:\bbtbbh.exec:\bbtbbh.exe99⤵PID:2284
-
\??\c:\jpjvp.exec:\jpjvp.exe100⤵PID:2136
-
\??\c:\llfxxrx.exec:\llfxxrx.exe101⤵PID:1256
-
\??\c:\ntntbh.exec:\ntntbh.exe102⤵PID:344
-
\??\c:\pjpdd.exec:\pjpdd.exe103⤵PID:844
-
\??\c:\dpddp.exec:\dpddp.exe104⤵PID:3004
-
\??\c:\flxflrx.exec:\flxflrx.exe105⤵PID:2300
-
\??\c:\bhbtnn.exec:\bhbtnn.exe106⤵PID:820
-
\??\c:\jddpj.exec:\jddpj.exe107⤵PID:1792
-
\??\c:\rrlrrff.exec:\rrlrrff.exe108⤵PID:2180
-
\??\c:\tbbbbb.exec:\tbbbbb.exe109⤵PID:2008
-
\??\c:\ddpjv.exec:\ddpjv.exe110⤵PID:2268
-
\??\c:\bnbtth.exec:\bnbtth.exe111⤵PID:940
-
\??\c:\vpdjj.exec:\vpdjj.exe112⤵PID:3056
-
\??\c:\jvjjd.exec:\jvjjd.exe113⤵PID:1556
-
\??\c:\lxllrff.exec:\lxllrff.exe114⤵PID:776
-
\??\c:\tbnhnn.exec:\tbnhnn.exe115⤵PID:2340
-
\??\c:\rfrrfxl.exec:\rfrrfxl.exe116⤵PID:1744
-
\??\c:\9tbhbb.exec:\9tbhbb.exe117⤵PID:2016
-
\??\c:\hththb.exec:\hththb.exe118⤵PID:2736
-
\??\c:\xfrrlxr.exec:\xfrrlxr.exe119⤵PID:3024
-
\??\c:\tnbhbh.exec:\tnbhbh.exe120⤵PID:3008
-
\??\c:\jpjvj.exec:\jpjvj.exe121⤵PID:1676
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe122⤵PID:2604
-
\??\c:\jjvdd.exec:\jjvdd.exe123⤵PID:2636
-
\??\c:\lxfffxx.exec:\lxfffxx.exe124⤵PID:2600
-
\??\c:\nthbtb.exec:\nthbtb.exe125⤵PID:2584
-
\??\c:\vjppj.exec:\vjppj.exe126⤵PID:2592
-
\??\c:\llxxxrl.exec:\llxxxrl.exe127⤵PID:2324
-
\??\c:\htnhnh.exec:\htnhnh.exe128⤵PID:2912
-
\??\c:\vddvj.exec:\vddvj.exe129⤵PID:1472
-
\??\c:\rfrlrff.exec:\rfrlrff.exe130⤵PID:2092
-
\??\c:\vvdpj.exec:\vvdpj.exe131⤵PID:2396
-
\??\c:\ttnhbn.exec:\ttnhbn.exe132⤵PID:2968
-
\??\c:\jvdpj.exec:\jvdpj.exe133⤵PID:2352
-
\??\c:\llxxllr.exec:\llxxllr.exe134⤵PID:2812
-
\??\c:\vvjjp.exec:\vvjjp.exe135⤵PID:1092
-
\??\c:\flflxfl.exec:\flflxfl.exe136⤵PID:2116
-
\??\c:\jjvdv.exec:\jjvdv.exe137⤵PID:2568
-
\??\c:\xflrxrf.exec:\xflrxrf.exe138⤵PID:2472
-
\??\c:\nhhhtb.exec:\nhhhtb.exe139⤵PID:1288
-
\??\c:\jdpvd.exec:\jdpvd.exe140⤵PID:2252
-
\??\c:\rfllflx.exec:\rfllflx.exe141⤵PID:1972
-
\??\c:\hthntt.exec:\hthntt.exe142⤵PID:2220
-
\??\c:\nthhbb.exec:\nthhbb.exe143⤵PID:1804
-
\??\c:\jdjjp.exec:\jdjjp.exe144⤵PID:828
-
\??\c:\xxxxxlr.exec:\xxxxxlr.exe145⤵PID:2088
-
\??\c:\9htnnb.exec:\9htnnb.exe146⤵PID:440
-
\??\c:\3jddd.exec:\3jddd.exe147⤵PID:2540
-
\??\c:\vddvv.exec:\vddvv.exe148⤵PID:1748
-
\??\c:\ffrfllr.exec:\ffrfllr.exe149⤵PID:2300
-
\??\c:\htbhbb.exec:\htbhbb.exe150⤵PID:1336
-
\??\c:\vjvdj.exec:\vjvdj.exe151⤵PID:3016
-
\??\c:\vjjjp.exec:\vjjjp.exe152⤵PID:740
-
\??\c:\lfrrlfl.exec:\lfrrlfl.exe153⤵PID:1652
-
\??\c:\hbntnb.exec:\hbntnb.exe154⤵PID:1588
-
\??\c:\jpjpv.exec:\jpjpv.exe155⤵PID:276
-
\??\c:\lrxrrlr.exec:\lrxrrlr.exe156⤵PID:2128
-
\??\c:\tbttnh.exec:\tbttnh.exe157⤵PID:1240
-
\??\c:\ppdjj.exec:\ppdjj.exe158⤵PID:1476
-
\??\c:\5dpjp.exec:\5dpjp.exe159⤵PID:1900
-
\??\c:\1xrxllx.exec:\1xrxllx.exe160⤵PID:1324
-
\??\c:\nhbhbn.exec:\nhbhbn.exe161⤵PID:2704
-
\??\c:\jdjpj.exec:\jdjpj.exe162⤵PID:2120
-
\??\c:\dppjp.exec:\dppjp.exe163⤵PID:3012
-
\??\c:\lfxfffx.exec:\lfxfffx.exe164⤵PID:2668
-
\??\c:\hbntht.exec:\hbntht.exe165⤵PID:1676
-
\??\c:\vpjpd.exec:\vpjpd.exe166⤵PID:2604
-
\??\c:\ddddj.exec:\ddddj.exe167⤵PID:2636
-
\??\c:\xrrffrl.exec:\xrrffrl.exe168⤵PID:2600
-
\??\c:\nttnhb.exec:\nttnhb.exe169⤵PID:2584
-
\??\c:\9pjvp.exec:\9pjvp.exe170⤵PID:2592
-
\??\c:\frrlrlr.exec:\frrlrlr.exe171⤵PID:2680
-
\??\c:\tbttbb.exec:\tbttbb.exe172⤵PID:1272
-
\??\c:\nnhhbn.exec:\nnhhbn.exe173⤵PID:1796
-
\??\c:\vvpjv.exec:\vvpjv.exe174⤵PID:1120
-
\??\c:\9xfrlxl.exec:\9xfrlxl.exe175⤵PID:1604
-
\??\c:\9lxllrl.exec:\9lxllrl.exe176⤵PID:2112
-
\??\c:\bntbhh.exec:\bntbhh.exe177⤵PID:2564
-
\??\c:\djvvj.exec:\djvvj.exe178⤵PID:2312
-
\??\c:\rflrflr.exec:\rflrflr.exe179⤵PID:1780
-
\??\c:\nnbntn.exec:\nnbntn.exe180⤵PID:1080
-
\??\c:\pvddd.exec:\pvddd.exe181⤵PID:1292
-
\??\c:\fxxflxl.exec:\fxxflxl.exe182⤵PID:1752
-
\??\c:\rfrllll.exec:\rfrllll.exe183⤵PID:3032
-
\??\c:\9hbnht.exec:\9hbnht.exe184⤵PID:3040
-
\??\c:\jppdj.exec:\jppdj.exe185⤵PID:1916
-
\??\c:\fxrrfrl.exec:\fxrrfrl.exe186⤵PID:2124
-
\??\c:\3frfllr.exec:\3frfllr.exe187⤵PID:2220
-
\??\c:\5bttbt.exec:\5bttbt.exe188⤵PID:2184
-
\??\c:\ddvdd.exec:\ddvdd.exe189⤵PID:3048
-
\??\c:\vvpvj.exec:\vvpvj.exe190⤵PID:2280
-
\??\c:\lfxrxll.exec:\lfxrxll.exe191⤵PID:852
-
\??\c:\bhnntb.exec:\bhnntb.exe192⤵PID:1764
-
\??\c:\vddvp.exec:\vddvp.exe193⤵PID:1696
-
\??\c:\ddvpv.exec:\ddvpv.exe194⤵PID:684
-
\??\c:\rfffrfr.exec:\rfffrfr.exe195⤵PID:920
-
\??\c:\hhnbtn.exec:\hhnbtn.exe196⤵PID:2032
-
\??\c:\vdppv.exec:\vdppv.exe197⤵PID:1776
-
\??\c:\jjdjp.exec:\jjdjp.exe198⤵PID:3064
-
\??\c:\5xxxxxf.exec:\5xxxxxf.exe199⤵PID:2384
-
\??\c:\nbtttn.exec:\nbtttn.exe200⤵PID:2344
-
\??\c:\7pdvv.exec:\7pdvv.exe201⤵PID:328
-
\??\c:\ffrrflf.exec:\ffrrflf.exe202⤵PID:2904
-
\??\c:\hnnhtt.exec:\hnnhtt.exe203⤵PID:1960
-
\??\c:\nhhnbt.exec:\nhhnbt.exe204⤵PID:2908
-
\??\c:\vdjpp.exec:\vdjpp.exe205⤵PID:1548
-
\??\c:\rlxfllx.exec:\rlxfllx.exe206⤵PID:2872
-
\??\c:\xlrfxxf.exec:\xlrfxxf.exe207⤵PID:1584
-
\??\c:\ntttbt.exec:\ntttbt.exe208⤵PID:1968
-
\??\c:\jvpjd.exec:\jvpjd.exe209⤵PID:2612
-
\??\c:\vpvjd.exec:\vpvjd.exe210⤵PID:2580
-
\??\c:\flfrffr.exec:\flfrffr.exe211⤵PID:2576
-
\??\c:\btbttn.exec:\btbttn.exe212⤵PID:2216
-
\??\c:\pppdp.exec:\pppdp.exe213⤵PID:2596
-
\??\c:\dvvdv.exec:\dvvdv.exe214⤵PID:2324
-
\??\c:\xlrrllr.exec:\xlrrllr.exe215⤵PID:2676
-
\??\c:\thbbbb.exec:\thbbbb.exe216⤵PID:1788
-
\??\c:\jvddd.exec:\jvddd.exe217⤵PID:708
-
\??\c:\jvddv.exec:\jvddv.exe218⤵PID:2528
-
\??\c:\frfxfxl.exec:\frfxfxl.exe219⤵PID:2800
-
\??\c:\tbnnnh.exec:\tbnnnh.exe220⤵PID:2916
-
\??\c:\rxlxrxf.exec:\rxlxrxf.exe221⤵PID:2168
-
\??\c:\nthnnh.exec:\nthnnh.exe222⤵PID:1468
-
\??\c:\vvvdv.exec:\vvvdv.exe223⤵PID:2804
-
\??\c:\vjdpj.exec:\vjdpj.exe224⤵PID:3028
-
\??\c:\xrrfrxl.exec:\xrrfrxl.exe225⤵PID:1264
-
\??\c:\xxrxflf.exec:\xxrxflf.exe226⤵PID:2228
-
\??\c:\hhtnhh.exec:\hhtnhh.exe227⤵PID:1288
-
\??\c:\dpjjv.exec:\dpjjv.exe228⤵PID:756
-
\??\c:\pvddp.exec:\pvddp.exe229⤵PID:2176
-
\??\c:\xflflxl.exec:\xflflxl.exe230⤵PID:2132
-
\??\c:\bhbbhb.exec:\bhbbhb.exe231⤵PID:1816
-
\??\c:\7pvdj.exec:\7pvdj.exe232⤵PID:1632
-
\??\c:\vdvpd.exec:\vdvpd.exe233⤵PID:1600
-
\??\c:\xxxlxff.exec:\xxxlxff.exe234⤵PID:440
-
\??\c:\nhhnbb.exec:\nhhnbb.exe235⤵PID:2280
-
\??\c:\7btbnb.exec:\7btbnb.exe236⤵PID:1724
-
\??\c:\vjdjp.exec:\vjdjp.exe237⤵PID:1760
-
\??\c:\fxxxrfx.exec:\fxxxrfx.exe238⤵PID:604
-
\??\c:\3fllxlr.exec:\3fllxlr.exe239⤵PID:1592
-
\??\c:\tbbbtn.exec:\tbbbtn.exe240⤵PID:2020
-
\??\c:\dvddv.exec:\dvddv.exe241⤵PID:2032
-
\??\c:\7pvvd.exec:\7pvvd.exe242⤵PID:372