Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27-07-2024 07:58
Behavioral task
behavioral1
Sample
ab9f19523644806018117208c62d34f0N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
ab9f19523644806018117208c62d34f0N.exe
-
Size
65KB
-
MD5
ab9f19523644806018117208c62d34f0
-
SHA1
d3bd13d6a4b849476ca8635fd6bf09a9a8a1cd5a
-
SHA256
081d1849ad0eec3a7880e87c53b0900f832d4f0e516752d2556019e3c5823cae
-
SHA512
28f5d8fa4b481b7aeb59efcedc875fbdd9d4c81f70ac98ff204de3656d3be2798c9e661b4e0521c4ff1f92940d3610802694455369cf934e3e42271f0d9bd08e
-
SSDEEP
1536:tvQBeOGtrYS3srx93UBWfwC6Ggnouy8gA2Nr602I:thOmTsF93UYfwC6GIoutgd20T
Malware Config
Signatures
-
Detect Blackmoon payload 50 IoCs
Processes:
resource yara_rule behavioral1/memory/576-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/348-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-89-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2872-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-119-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2008-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/568-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-179-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/952-202-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1844-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/880-228-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2564-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-274-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1728-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1168-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-382-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2900-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1684-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1192-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2156-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-519-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2280-588-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-620-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2768-619-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1480-691-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-818-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-894-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2612-919-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-926-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2928-947-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2068-1051-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2264-1117-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2392-1125-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
frrlrrr.exepdpvd.exexfrxfrx.exerffflrx.exejvddj.exebbthbh.exedjpdv.exellfrrxr.exevpjpd.exehnbtbb.exejppjj.exerxlxxfr.exedppjd.exejpddj.exenntbnb.exe7bhnnn.exepdpdd.exefxxrlxl.exethnntt.exevjppv.exethbbth.exedjdvp.exelfxfrfr.exe3ntnbh.exevjvvj.exelxlxrff.exetttbnt.exevddjp.exeddpjj.exelrxxxfx.exetbbbbb.exe1dpjv.exerlfrfxl.exe5btbhn.exe3pjpd.exexrllrlx.exebhtttb.exevjpjp.exerfrrlxl.exentnnbb.exexlflrlx.exenhhtbn.exenthbht.exepppdv.exexlxlxff.exehthhtn.exe1jpvj.exellfrlfl.exerrlfxll.exenbbthh.exedvpdd.exejvpvj.exexxrfrxl.exehhtnhh.exe5djvj.exepjvdd.exebhthhb.exettttbh.exe3pvvd.exerrrxlrl.exe1bbtnt.exevvjvd.exepjjjd.exefrxxllx.exepid process 2416 frrlrrr.exe 2512 pdpvd.exe 348 xfrxfrx.exe 2704 rffflrx.exe 2716 jvddj.exe 2764 bbthbh.exe 2924 djpdv.exe 2872 llfrrxr.exe 2724 vpjpd.exe 2668 hnbtbb.exe 2008 jppjj.exe 3004 rxlxxfr.exe 2964 dppjd.exe 2368 jpddj.exe 568 nntbnb.exe 2372 7bhnnn.exe 1500 pdpdd.exe 2792 fxxrlxl.exe 1724 thnntt.exe 3020 vjppv.exe 952 thbbth.exe 1616 djdvp.exe 1844 lfxfrfr.exe 880 3ntnbh.exe 2564 vjvvj.exe 2312 lxlxrff.exe 2536 tttbnt.exe 1096 vddjp.exe 2952 ddpjj.exe 1728 lrxxxfx.exe 1168 tbbbbb.exe 2356 1dpjv.exe 2392 rlfrfxl.exe 2060 5btbhn.exe 2484 3pjpd.exe 776 xrllrlx.exe 2816 bhtttb.exe 2216 vjpjp.exe 2616 rfrrlxl.exe 2728 ntnnbb.exe 2848 xlflrlx.exe 2644 nhhtbn.exe 2872 nthbht.exe 2652 pppdv.exe 2688 xlxlxff.exe 2996 hthhtn.exe 2596 1jpvj.exe 2956 llfrlfl.exe 2900 rrlfxll.exe 1276 nbbthh.exe 1684 dvpdd.exe 1192 jvpvj.exe 1940 xxrfrxl.exe 3068 hhtnhh.exe 2648 5djvj.exe 3056 pjvdd.exe 1724 bhthhb.exe 2156 ttttbh.exe 2272 3pvvd.exe 628 rrrxlrl.exe 1144 1bbtnt.exe 1320 vvjvd.exe 1916 pjjjd.exe 880 frxxllx.exe -
Processes:
resource yara_rule behavioral1/memory/576-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frrlrrr.exe upx behavioral1/memory/2416-10-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pdpvd.exe upx behavioral1/memory/348-28-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xfrxfrx.exe upx behavioral1/memory/2512-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2512-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rffflrx.exe upx behavioral1/memory/348-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvddj.exe upx behavioral1/memory/2704-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2716-49-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\djpdv.exe upx behavioral1/memory/2764-68-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bbthbh.exe upx behavioral1/memory/2764-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2716-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2924-72-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llfrrxr.exe upx C:\vpjpd.exe upx behavioral1/memory/2872-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2512-86-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\hnbtbb.exe upx behavioral1/memory/2008-109-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jppjj.exe upx behavioral1/memory/2668-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-119-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\rxlxxfr.exe upx behavioral1/memory/2008-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3004-128-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dppjd.exe upx behavioral1/memory/2964-130-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpddj.exe upx C:\nntbnb.exe upx behavioral1/memory/568-153-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7bhnnn.exe upx C:\pdpdd.exe upx behavioral1/memory/2372-163-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxxrlxl.exe upx \??\c:\thnntt.exe upx C:\vjppv.exe upx behavioral1/memory/2792-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3020-190-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thbbth.exe upx C:\djdvp.exe upx C:\lfxfrfr.exe upx C:\3ntnbh.exe upx behavioral1/memory/1844-223-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjvvj.exe upx behavioral1/memory/2564-241-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxlxrff.exe upx C:\tttbnt.exe upx C:\vddjp.exe upx C:\ddpjj.exe upx C:\lrxxxfx.exe upx behavioral1/memory/1728-284-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbbbbb.exe upx behavioral1/memory/1168-286-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1dpjv.exe upx behavioral1/memory/1168-295-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2392-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2060-316-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
vddjp.exefrffxfl.exe7ddvv.exelfxrrfx.exe3rfrlxr.exehbnnnt.exejjdvp.exehthhbb.exenthbnb.exerrfffxx.exenthbbn.exebnbtnn.exehhhhhb.exehbbbhh.exe9nthth.exefrxlffl.exetnnnhn.exejjpdd.exexfrxxxl.exefrrllfl.exelrxflrl.exelxxrxrr.exehhnnbt.exebbbhnb.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rfrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhnb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ab9f19523644806018117208c62d34f0N.exefrrlrrr.exepdpvd.exexfrxfrx.exerffflrx.exejvddj.exebbthbh.exedjpdv.exellfrrxr.exevpjpd.exehnbtbb.exejppjj.exerxlxxfr.exedppjd.exejpddj.exenntbnb.exedescription pid process target process PID 576 wrote to memory of 2416 576 ab9f19523644806018117208c62d34f0N.exe frrlrrr.exe PID 576 wrote to memory of 2416 576 ab9f19523644806018117208c62d34f0N.exe frrlrrr.exe PID 576 wrote to memory of 2416 576 ab9f19523644806018117208c62d34f0N.exe frrlrrr.exe PID 576 wrote to memory of 2416 576 ab9f19523644806018117208c62d34f0N.exe frrlrrr.exe PID 2416 wrote to memory of 2512 2416 frrlrrr.exe pdpvd.exe PID 2416 wrote to memory of 2512 2416 frrlrrr.exe pdpvd.exe PID 2416 wrote to memory of 2512 2416 frrlrrr.exe pdpvd.exe PID 2416 wrote to memory of 2512 2416 frrlrrr.exe pdpvd.exe PID 2512 wrote to memory of 348 2512 pdpvd.exe xfrxfrx.exe PID 2512 wrote to memory of 348 2512 pdpvd.exe xfrxfrx.exe PID 2512 wrote to memory of 348 2512 pdpvd.exe xfrxfrx.exe PID 2512 wrote to memory of 348 2512 pdpvd.exe xfrxfrx.exe PID 348 wrote to memory of 2704 348 xfrxfrx.exe rffflrx.exe PID 348 wrote to memory of 2704 348 xfrxfrx.exe rffflrx.exe PID 348 wrote to memory of 2704 348 xfrxfrx.exe rffflrx.exe PID 348 wrote to memory of 2704 348 xfrxfrx.exe rffflrx.exe PID 2704 wrote to memory of 2716 2704 rffflrx.exe jvddj.exe PID 2704 wrote to memory of 2716 2704 rffflrx.exe jvddj.exe PID 2704 wrote to memory of 2716 2704 rffflrx.exe jvddj.exe PID 2704 wrote to memory of 2716 2704 rffflrx.exe jvddj.exe PID 2716 wrote to memory of 2764 2716 jvddj.exe bbthbh.exe PID 2716 wrote to memory of 2764 2716 jvddj.exe bbthbh.exe PID 2716 wrote to memory of 2764 2716 jvddj.exe bbthbh.exe PID 2716 wrote to memory of 2764 2716 jvddj.exe bbthbh.exe PID 2764 wrote to memory of 2924 2764 bbthbh.exe djpdv.exe PID 2764 wrote to memory of 2924 2764 bbthbh.exe djpdv.exe PID 2764 wrote to memory of 2924 2764 bbthbh.exe djpdv.exe PID 2764 wrote to memory of 2924 2764 bbthbh.exe djpdv.exe PID 2924 wrote to memory of 2872 2924 djpdv.exe llfrrxr.exe PID 2924 wrote to memory of 2872 2924 djpdv.exe llfrrxr.exe PID 2924 wrote to memory of 2872 2924 djpdv.exe llfrrxr.exe PID 2924 wrote to memory of 2872 2924 djpdv.exe llfrrxr.exe PID 2872 wrote to memory of 2724 2872 llfrrxr.exe vpjpd.exe PID 2872 wrote to memory of 2724 2872 llfrrxr.exe vpjpd.exe PID 2872 wrote to memory of 2724 2872 llfrrxr.exe vpjpd.exe PID 2872 wrote to memory of 2724 2872 llfrrxr.exe vpjpd.exe PID 2724 wrote to memory of 2668 2724 vpjpd.exe hnbtbb.exe PID 2724 wrote to memory of 2668 2724 vpjpd.exe hnbtbb.exe PID 2724 wrote to memory of 2668 2724 vpjpd.exe hnbtbb.exe PID 2724 wrote to memory of 2668 2724 vpjpd.exe hnbtbb.exe PID 2668 wrote to memory of 2008 2668 hnbtbb.exe jppjj.exe PID 2668 wrote to memory of 2008 2668 hnbtbb.exe jppjj.exe PID 2668 wrote to memory of 2008 2668 hnbtbb.exe jppjj.exe PID 2668 wrote to memory of 2008 2668 hnbtbb.exe jppjj.exe PID 2008 wrote to memory of 3004 2008 jppjj.exe rxlxxfr.exe PID 2008 wrote to memory of 3004 2008 jppjj.exe rxlxxfr.exe PID 2008 wrote to memory of 3004 2008 jppjj.exe rxlxxfr.exe PID 2008 wrote to memory of 3004 2008 jppjj.exe rxlxxfr.exe PID 3004 wrote to memory of 2964 3004 rxlxxfr.exe dppjd.exe PID 3004 wrote to memory of 2964 3004 rxlxxfr.exe dppjd.exe PID 3004 wrote to memory of 2964 3004 rxlxxfr.exe dppjd.exe PID 3004 wrote to memory of 2964 3004 rxlxxfr.exe dppjd.exe PID 2964 wrote to memory of 2368 2964 dppjd.exe jpddj.exe PID 2964 wrote to memory of 2368 2964 dppjd.exe jpddj.exe PID 2964 wrote to memory of 2368 2964 dppjd.exe jpddj.exe PID 2964 wrote to memory of 2368 2964 dppjd.exe jpddj.exe PID 2368 wrote to memory of 568 2368 jpddj.exe nntbnb.exe PID 2368 wrote to memory of 568 2368 jpddj.exe nntbnb.exe PID 2368 wrote to memory of 568 2368 jpddj.exe nntbnb.exe PID 2368 wrote to memory of 568 2368 jpddj.exe nntbnb.exe PID 568 wrote to memory of 2372 568 nntbnb.exe 7bhnnn.exe PID 568 wrote to memory of 2372 568 nntbnb.exe 7bhnnn.exe PID 568 wrote to memory of 2372 568 nntbnb.exe 7bhnnn.exe PID 568 wrote to memory of 2372 568 nntbnb.exe 7bhnnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab9f19523644806018117208c62d34f0N.exe"C:\Users\Admin\AppData\Local\Temp\ab9f19523644806018117208c62d34f0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\frrlrrr.exec:\frrlrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\pdpvd.exec:\pdpvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\xfrxfrx.exec:\xfrxfrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\rffflrx.exec:\rffflrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\jvddj.exec:\jvddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\bbthbh.exec:\bbthbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\djpdv.exec:\djpdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\llfrrxr.exec:\llfrrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\vpjpd.exec:\vpjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\hnbtbb.exec:\hnbtbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\jppjj.exec:\jppjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\rxlxxfr.exec:\rxlxxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\dppjd.exec:\dppjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\jpddj.exec:\jpddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\nntbnb.exec:\nntbnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\7bhnnn.exec:\7bhnnn.exe17⤵
- Executes dropped EXE
PID:2372 -
\??\c:\pdpdd.exec:\pdpdd.exe18⤵
- Executes dropped EXE
PID:1500 -
\??\c:\fxxrlxl.exec:\fxxrlxl.exe19⤵
- Executes dropped EXE
PID:2792 -
\??\c:\thnntt.exec:\thnntt.exe20⤵
- Executes dropped EXE
PID:1724 -
\??\c:\vjppv.exec:\vjppv.exe21⤵
- Executes dropped EXE
PID:3020 -
\??\c:\thbbth.exec:\thbbth.exe22⤵
- Executes dropped EXE
PID:952 -
\??\c:\djdvp.exec:\djdvp.exe23⤵
- Executes dropped EXE
PID:1616 -
\??\c:\lfxfrfr.exec:\lfxfrfr.exe24⤵
- Executes dropped EXE
PID:1844 -
\??\c:\3ntnbh.exec:\3ntnbh.exe25⤵
- Executes dropped EXE
PID:880 -
\??\c:\vjvvj.exec:\vjvvj.exe26⤵
- Executes dropped EXE
PID:2564 -
\??\c:\lxlxrff.exec:\lxlxrff.exe27⤵
- Executes dropped EXE
PID:2312 -
\??\c:\tttbnt.exec:\tttbnt.exe28⤵
- Executes dropped EXE
PID:2536 -
\??\c:\vddjp.exec:\vddjp.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1096 -
\??\c:\ddpjj.exec:\ddpjj.exe30⤵
- Executes dropped EXE
PID:2952 -
\??\c:\lrxxxfx.exec:\lrxxxfx.exe31⤵
- Executes dropped EXE
PID:1728 -
\??\c:\tbbbbb.exec:\tbbbbb.exe32⤵
- Executes dropped EXE
PID:1168 -
\??\c:\1dpjv.exec:\1dpjv.exe33⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rlfrfxl.exec:\rlfrfxl.exe34⤵
- Executes dropped EXE
PID:2392 -
\??\c:\5btbhn.exec:\5btbhn.exe35⤵
- Executes dropped EXE
PID:2060 -
\??\c:\3pjpd.exec:\3pjpd.exe36⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xrllrlx.exec:\xrllrlx.exe37⤵
- Executes dropped EXE
PID:776 -
\??\c:\bhtttb.exec:\bhtttb.exe38⤵
- Executes dropped EXE
PID:2816 -
\??\c:\vjpjp.exec:\vjpjp.exe39⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rfrrlxl.exec:\rfrrlxl.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\ntnnbb.exec:\ntnnbb.exe41⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xlflrlx.exec:\xlflrlx.exe42⤵
- Executes dropped EXE
PID:2848 -
\??\c:\nhhtbn.exec:\nhhtbn.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nthbht.exec:\nthbht.exe44⤵
- Executes dropped EXE
PID:2872 -
\??\c:\pppdv.exec:\pppdv.exe45⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xlxlxff.exec:\xlxlxff.exe46⤵
- Executes dropped EXE
PID:2688 -
\??\c:\hthhtn.exec:\hthhtn.exe47⤵
- Executes dropped EXE
PID:2996 -
\??\c:\1jpvj.exec:\1jpvj.exe48⤵
- Executes dropped EXE
PID:2596 -
\??\c:\llfrlfl.exec:\llfrlfl.exe49⤵
- Executes dropped EXE
PID:2956 -
\??\c:\rrlfxll.exec:\rrlfxll.exe50⤵
- Executes dropped EXE
PID:2900 -
\??\c:\nbbthh.exec:\nbbthh.exe51⤵
- Executes dropped EXE
PID:1276 -
\??\c:\dvpdd.exec:\dvpdd.exe52⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jvpvj.exec:\jvpvj.exe53⤵
- Executes dropped EXE
PID:1192 -
\??\c:\xxrfrxl.exec:\xxrfrxl.exe54⤵
- Executes dropped EXE
PID:1940 -
\??\c:\hhtnhh.exec:\hhtnhh.exe55⤵
- Executes dropped EXE
PID:3068 -
\??\c:\5djvj.exec:\5djvj.exe56⤵
- Executes dropped EXE
PID:2648 -
\??\c:\pjvdd.exec:\pjvdd.exe57⤵
- Executes dropped EXE
PID:3056 -
\??\c:\bhthhb.exec:\bhthhb.exe58⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ttttbh.exec:\ttttbh.exe59⤵
- Executes dropped EXE
PID:2156 -
\??\c:\3pvvd.exec:\3pvvd.exe60⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rrrxlrl.exec:\rrrxlrl.exe61⤵
- Executes dropped EXE
PID:628 -
\??\c:\1bbtnt.exec:\1bbtnt.exe62⤵
- Executes dropped EXE
PID:1144 -
\??\c:\vvjvd.exec:\vvjvd.exe63⤵
- Executes dropped EXE
PID:1320 -
\??\c:\pjjjd.exec:\pjjjd.exe64⤵
- Executes dropped EXE
PID:1916 -
\??\c:\frxxllx.exec:\frxxllx.exe65⤵
- Executes dropped EXE
PID:880 -
\??\c:\ffxfrxl.exec:\ffxfrxl.exe66⤵PID:2208
-
\??\c:\ntnhbb.exec:\ntnhbb.exe67⤵PID:2432
-
\??\c:\ppdjv.exec:\ppdjv.exe68⤵PID:2300
-
\??\c:\frxrrlr.exec:\frxrrlr.exe69⤵PID:2916
-
\??\c:\httthh.exec:\httthh.exe70⤵PID:324
-
\??\c:\dvvjv.exec:\dvvjv.exe71⤵PID:1744
-
\??\c:\vvpvj.exec:\vvpvj.exe72⤵PID:868
-
\??\c:\9xlfxlx.exec:\9xlfxlx.exe73⤵PID:2460
-
\??\c:\tthbth.exec:\tthbth.exe74⤵PID:1168
-
\??\c:\vvdvv.exec:\vvdvv.exe75⤵PID:1312
-
\??\c:\9jpvp.exec:\9jpvp.exe76⤵PID:2396
-
\??\c:\1fxlfrl.exec:\1fxlfrl.exe77⤵PID:1588
-
\??\c:\nhbbtt.exec:\nhbbtt.exe78⤵PID:2280
-
\??\c:\djpvd.exec:\djpvd.exe79⤵PID:2888
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe80⤵PID:2756
-
\??\c:\nhthht.exec:\nhthht.exe81⤵PID:2256
-
\??\c:\bhnnbt.exec:\bhnnbt.exe82⤵PID:2768
-
\??\c:\7djpj.exec:\7djpj.exe83⤵PID:2736
-
\??\c:\lrxffxx.exec:\lrxffxx.exe84⤵PID:2884
-
\??\c:\nntbht.exec:\nntbht.exe85⤵PID:2664
-
\??\c:\pvjjp.exec:\pvjjp.exe86⤵PID:2656
-
\??\c:\dvpdp.exec:\dvpdp.exe87⤵PID:2456
-
\??\c:\lxflrxr.exec:\lxflrxr.exe88⤵PID:2292
-
\??\c:\ttnhht.exec:\ttnhht.exe89⤵PID:2860
-
\??\c:\vppjv.exec:\vppjv.exe90⤵PID:2928
-
\??\c:\rfxlrlx.exec:\rfxlrlx.exe91⤵PID:3008
-
\??\c:\tthbnh.exec:\tthbnh.exe92⤵PID:2964
-
\??\c:\httntn.exec:\httntn.exe93⤵PID:2976
-
\??\c:\djjvd.exec:\djjvd.exe94⤵PID:1480
-
\??\c:\1xlllxf.exec:\1xlllxf.exe95⤵PID:1304
-
\??\c:\5nttbn.exec:\5nttbn.exe96⤵PID:1192
-
\??\c:\jjdpp.exec:\jjdpp.exe97⤵PID:2228
-
\??\c:\xxlxxll.exec:\xxlxxll.exe98⤵PID:3068
-
\??\c:\nhhhbn.exec:\nhhhbn.exe99⤵PID:1288
-
\??\c:\nthttt.exec:\nthttt.exe100⤵PID:3056
-
\??\c:\djjpd.exec:\djjpd.exe101⤵PID:2592
-
\??\c:\flfxrfx.exec:\flfxrfx.exe102⤵PID:2156
-
\??\c:\9xrllxr.exec:\9xrllxr.exe103⤵PID:1592
-
\??\c:\ttbtht.exec:\ttbtht.exe104⤵PID:1524
-
\??\c:\jjjjp.exec:\jjjjp.exe105⤵PID:3012
-
\??\c:\dppdv.exec:\dppdv.exe106⤵PID:1320
-
\??\c:\fxfrxxx.exec:\fxfrxxx.exe107⤵PID:1644
-
\??\c:\ththht.exec:\ththht.exe108⤵PID:880
-
\??\c:\vvvpd.exec:\vvvpd.exe109⤵PID:860
-
\??\c:\xxlllfl.exec:\xxlllfl.exe110⤵PID:2432
-
\??\c:\rrfxrff.exec:\rrfxrff.exe111⤵PID:2556
-
\??\c:\bnnbnn.exec:\bnnbnn.exe112⤵PID:2916
-
\??\c:\djpvj.exec:\djpvj.exe113⤵PID:1740
-
\??\c:\1lrflll.exec:\1lrflll.exe114⤵PID:1728
-
\??\c:\fflrfrr.exec:\fflrfrr.exe115⤵PID:576
-
\??\c:\bbhbbh.exec:\bbhbbh.exe116⤵PID:1704
-
\??\c:\vjppd.exec:\vjppd.exe117⤵PID:2408
-
\??\c:\llxlrff.exec:\llxlrff.exe118⤵PID:2392
-
\??\c:\xlxxfxf.exec:\xlxxfxf.exe119⤵PID:1944
-
\??\c:\hbbbhh.exec:\hbbbhh.exe120⤵
- System Location Discovery: System Language Discovery
PID:1588 -
\??\c:\vjvvj.exec:\vjvvj.exe121⤵PID:2280
-
\??\c:\lxllrrf.exec:\lxllrrf.exe122⤵PID:2740
-
\??\c:\dpjdj.exec:\dpjdj.exe123⤵PID:608
-
\??\c:\rfllrll.exec:\rfllrll.exe124⤵PID:2260
-
\??\c:\thbbhh.exec:\thbbhh.exe125⤵PID:2768
-
\??\c:\ppdvj.exec:\ppdvj.exe126⤵PID:2752
-
\??\c:\vpvpd.exec:\vpvpd.exe127⤵PID:1636
-
\??\c:\rrflllx.exec:\rrflllx.exe128⤵PID:2664
-
\??\c:\tbhhtn.exec:\tbhhtn.exe129⤵PID:2612
-
\??\c:\jvppp.exec:\jvppp.exe130⤵PID:2456
-
\??\c:\pjppd.exec:\pjppd.exe131⤵PID:2936
-
\??\c:\lxfflll.exec:\lxfflll.exe132⤵PID:1628
-
\??\c:\bbhhhh.exec:\bbhhhh.exe133⤵PID:2928
-
\??\c:\3pdjp.exec:\3pdjp.exe134⤵PID:2096
-
\??\c:\jppjd.exec:\jppjd.exe135⤵PID:1280
-
\??\c:\lxffrlr.exec:\lxffrlr.exe136⤵PID:1476
-
\??\c:\tttnnt.exec:\tttnnt.exe137⤵PID:3040
-
\??\c:\pddvd.exec:\pddvd.exe138⤵PID:2372
-
\??\c:\ppvvj.exec:\ppvvj.exe139⤵PID:1300
-
\??\c:\flxffff.exec:\flxffff.exe140⤵PID:3064
-
\??\c:\xxfrrll.exec:\xxfrrll.exe141⤵PID:1124
-
\??\c:\ntnnht.exec:\ntnnht.exe142⤵PID:1420
-
\??\c:\pddvd.exec:\pddvd.exe143⤵PID:1920
-
\??\c:\xxxlxrl.exec:\xxxlxrl.exe144⤵PID:3028
-
\??\c:\rfxlfrf.exec:\rfxlfrf.exe145⤵PID:2288
-
\??\c:\3dpdv.exec:\3dpdv.exe146⤵PID:2980
-
\??\c:\jjvjj.exec:\jjvjj.exe147⤵PID:1144
-
\??\c:\xlffllr.exec:\xlffllr.exe148⤵PID:612
-
\??\c:\ntbhhb.exec:\ntbhhb.exe149⤵PID:1648
-
\??\c:\dppvd.exec:\dppvd.exe150⤵PID:2068
-
\??\c:\jvjdp.exec:\jvjdp.exe151⤵PID:2192
-
\??\c:\xrllxxf.exec:\xrllxxf.exe152⤵PID:2304
-
\??\c:\nnnbnt.exec:\nnnbnt.exe153⤵PID:2536
-
\??\c:\bbntbb.exec:\bbntbb.exe154⤵PID:316
-
\??\c:\vdddd.exec:\vdddd.exe155⤵PID:888
-
\??\c:\xlllfrx.exec:\xlllfrx.exe156⤵PID:1696
-
\??\c:\lxfllfr.exec:\lxfllfr.exe157⤵PID:868
-
\??\c:\tbbbbn.exec:\tbbbbn.exe158⤵PID:576
-
\??\c:\nnhhbn.exec:\nnhhbn.exe159⤵PID:1736
-
\??\c:\9pdjd.exec:\9pdjd.exe160⤵PID:2264
-
\??\c:\9lfxxll.exec:\9lfxxll.exe161⤵PID:2392
-
\??\c:\hbbhnt.exec:\hbbhnt.exe162⤵PID:2188
-
\??\c:\djvdp.exec:\djvdp.exe163⤵PID:2704
-
\??\c:\rxlffxx.exec:\rxlffxx.exe164⤵PID:2828
-
\??\c:\9lfffrl.exec:\9lfffrl.exe165⤵PID:2864
-
\??\c:\bnttbb.exec:\bnttbb.exe166⤵PID:1856
-
\??\c:\nbhhtt.exec:\nbhhtt.exe167⤵PID:2728
-
\??\c:\pdjdp.exec:\pdjdp.exe168⤵PID:2784
-
\??\c:\1xrrrlr.exec:\1xrrrlr.exe169⤵PID:2848
-
\??\c:\btnnhb.exec:\btnnhb.exe170⤵PID:1636
-
\??\c:\9nhbnh.exec:\9nhbnh.exe171⤵PID:2664
-
\??\c:\pdpjp.exec:\pdpjp.exe172⤵PID:2612
-
\??\c:\1ffxffr.exec:\1ffxffr.exe173⤵PID:2456
-
\??\c:\ffllrrf.exec:\ffllrrf.exe174⤵PID:1792
-
\??\c:\9bbtht.exec:\9bbtht.exe175⤵PID:2912
-
\??\c:\5jpdv.exec:\5jpdv.exe176⤵PID:2940
-
\??\c:\flrfrrf.exec:\flrfrrf.exe177⤵PID:2096
-
\??\c:\1nbnbb.exec:\1nbnbb.exe178⤵PID:1264
-
\??\c:\thtttt.exec:\thtttt.exe179⤵PID:3000
-
\??\c:\3jpjj.exec:\3jpjj.exe180⤵PID:1012
-
\??\c:\dpppp.exec:\dpppp.exe181⤵PID:3060
-
\??\c:\rllxlfr.exec:\rllxlfr.exe182⤵PID:2328
-
\??\c:\thhhbn.exec:\thhhbn.exe183⤵PID:2516
-
\??\c:\3vpjp.exec:\3vpjp.exe184⤵PID:1288
-
\??\c:\frrrrll.exec:\frrrrll.exe185⤵PID:2148
-
\??\c:\xlrrrfl.exec:\xlrrrfl.exe186⤵PID:2452
-
\??\c:\7nnhtt.exec:\7nnhtt.exe187⤵PID:3028
-
\??\c:\djvjd.exec:\djvjd.exe188⤵PID:1976
-
\??\c:\flrlxrr.exec:\flrlxrr.exe189⤵PID:2052
-
\??\c:\xfffrlx.exec:\xfffrlx.exe190⤵PID:1336
-
\??\c:\9tnttn.exec:\9tnttn.exe191⤵PID:612
-
\??\c:\dpjpp.exec:\dpjpp.exe192⤵PID:1252
-
\??\c:\jddpj.exec:\jddpj.exe193⤵PID:1748
-
\??\c:\1llflll.exec:\1llflll.exe194⤵PID:592
-
\??\c:\1flrffr.exec:\1flrffr.exe195⤵PID:1096
-
\??\c:\3bbntt.exec:\3bbntt.exe196⤵PID:864
-
\??\c:\djdjp.exec:\djdjp.exe197⤵PID:316
-
\??\c:\tnnnbb.exec:\tnnnbb.exe198⤵PID:888
-
\??\c:\nnbhbt.exec:\nnbhbt.exe199⤵PID:2460
-
\??\c:\jpppd.exec:\jpppd.exe200⤵PID:1704
-
\??\c:\lrxxfrl.exec:\lrxxfrl.exe201⤵PID:1688
-
\??\c:\9ntbbn.exec:\9ntbbn.exe202⤵PID:2060
-
\??\c:\btbtnt.exec:\btbtnt.exe203⤵PID:1284
-
\??\c:\jvpdp.exec:\jvpdp.exe204⤵PID:2392
-
\??\c:\9fxxllf.exec:\9fxxllf.exe205⤵PID:2820
-
\??\c:\hntbbn.exec:\hntbbn.exe206⤵PID:776
-
\??\c:\dpdpv.exec:\dpdpv.exe207⤵PID:2804
-
\??\c:\ddppd.exec:\ddppd.exe208⤵PID:2852
-
\??\c:\rlfrfll.exec:\rlfrfll.exe209⤵PID:1084
-
\??\c:\7tntbt.exec:\7tntbt.exe210⤵PID:2620
-
\??\c:\ttthhh.exec:\ttthhh.exe211⤵PID:2644
-
\??\c:\jjdpd.exec:\jjdpd.exe212⤵PID:2840
-
\??\c:\xxxlfll.exec:\xxxlfll.exe213⤵PID:1244
-
\??\c:\hbhtnt.exec:\hbhtnt.exe214⤵PID:2712
-
\??\c:\3nttnt.exec:\3nttnt.exe215⤵PID:2996
-
\??\c:\3vddd.exec:\3vddd.exe216⤵PID:2292
-
\??\c:\lrllxxr.exec:\lrllxxr.exe217⤵PID:2936
-
\??\c:\llrflfl.exec:\llrflfl.exe218⤵PID:1628
-
\??\c:\bbbhnb.exec:\bbbhnb.exe219⤵PID:2968
-
\??\c:\jdpjd.exec:\jdpjd.exe220⤵PID:2368
-
\??\c:\llxxrxf.exec:\llxxrxf.exe221⤵PID:616
-
\??\c:\xfxrlll.exec:\xfxrlll.exe222⤵PID:3016
-
\??\c:\tthtbt.exec:\tthtbt.exe223⤵PID:3024
-
\??\c:\9pvvd.exec:\9pvvd.exe224⤵PID:1060
-
\??\c:\3lfrllr.exec:\3lfrllr.exe225⤵PID:3068
-
\??\c:\xffxfrl.exec:\xffxfrl.exe226⤵PID:2792
-
\??\c:\3bhnhh.exec:\3bhnhh.exe227⤵PID:892
-
\??\c:\dppdd.exec:\dppdd.exe228⤵PID:1860
-
\??\c:\vpjvj.exec:\vpjvj.exe229⤵PID:952
-
\??\c:\lxxrrrx.exec:\lxxrrrx.exe230⤵PID:1616
-
\??\c:\3rffxxl.exec:\3rffxxl.exe231⤵PID:1680
-
\??\c:\dvjpd.exec:\dvjpd.exe232⤵PID:3012
-
\??\c:\1xrxlfr.exec:\1xrxlfr.exe233⤵PID:1916
-
\??\c:\xxflflr.exec:\xxflflr.exe234⤵PID:768
-
\??\c:\hhtthh.exec:\hhtthh.exe235⤵PID:1648
-
\??\c:\dpvdj.exec:\dpvdj.exe236⤵PID:1252
-
\??\c:\jvjvj.exec:\jvjvj.exe237⤵PID:2112
-
\??\c:\flrrfxx.exec:\flrrfxx.exe238⤵PID:2304
-
\??\c:\tbnhnh.exec:\tbnhnh.exe239⤵PID:2196
-
\??\c:\pdjjv.exec:\pdjjv.exe240⤵PID:2536
-
\??\c:\vpjvp.exec:\vpjvp.exe241⤵PID:1572
-
\??\c:\flrrfxx.exec:\flrrfxx.exe242⤵PID:2000