Analysis
-
max time kernel
120s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2024 07:58
Behavioral task
behavioral1
Sample
ab9f19523644806018117208c62d34f0N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
ab9f19523644806018117208c62d34f0N.exe
-
Size
65KB
-
MD5
ab9f19523644806018117208c62d34f0
-
SHA1
d3bd13d6a4b849476ca8635fd6bf09a9a8a1cd5a
-
SHA256
081d1849ad0eec3a7880e87c53b0900f832d4f0e516752d2556019e3c5823cae
-
SHA512
28f5d8fa4b481b7aeb59efcedc875fbdd9d4c81f70ac98ff204de3656d3be2798c9e661b4e0521c4ff1f92940d3610802694455369cf934e3e42271f0d9bd08e
-
SSDEEP
1536:tvQBeOGtrYS3srx93UBWfwC6Ggnouy8gA2Nr602I:thOmTsF93UYfwC6GIoutgd20T
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3100-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1360-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3136-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3620-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1772-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4488-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3968-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/720-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3532-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1436-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4516-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3320-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3896-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1360-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2808-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2808-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1384-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/764-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2416-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3068-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3364-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1580-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4752-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5008-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-513-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-527-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3136-531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2712-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1384-567-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-613-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1412-617-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/588-630-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3748-643-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-711-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-741-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2672-826-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2108-918-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4028-1074-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pdpjp.exebnttht.exebtntht.exevvjpv.exetnbhhh.exerlfrxxx.exennhhnn.exethtnnb.exedvpvj.exexxxxxrr.exenntbhb.exejvjjj.exehbhhbn.exedvvdj.exetbtthn.exevpjvj.exerlxfrll.exeppvdj.exebnnbbt.exepjdvd.exerxrfxxr.exettbnnh.exellffffl.exeddddd.exehnhnbb.exefrffflf.exedppvd.exehhhhbt.exejdjjj.exexlrxlrx.exeppdvp.exepdddj.exehbbhnb.exelfxlxrf.exebnnttb.exejpvdd.exentnntt.exe9xrffrx.exebbhnhb.exevdjdv.exe9hhhhn.exelrxxlll.exettnhbb.exevdjvp.exenttbbn.exevpjpj.exexfllllx.exettntnh.exehtbnbb.exeppvvp.exerxffllr.exenttbhb.exeppjdp.exe9xflllx.exedpddv.exellfxlxr.exethttbh.exe1pjjv.exefxlfrrf.exebttnhn.exexrffffx.exenhnnnt.exedpjvp.exeflllrlf.exepid process 4008 pdpjp.exe 1360 bnttht.exe 3136 btntht.exe 3620 vvjpv.exe 1772 tnbhhh.exe 4488 rlfrxxx.exe 3968 nnhhnn.exe 720 thtnnb.exe 2124 dvpvj.exe 3572 xxxxxrr.exe 3532 nntbhb.exe 4884 jvjjj.exe 1436 hbhhbn.exe 1980 dvvdj.exe 4516 tbtthn.exe 2644 vpjvj.exe 3428 rlxfrll.exe 516 ppvdj.exe 4912 bnnbbt.exe 4420 pjdvd.exe 2044 rxrfxxr.exe 4552 ttbnnh.exe 2036 llffffl.exe 3320 ddddd.exe 2368 hnhnbb.exe 1528 frffflf.exe 4904 dppvd.exe 2492 hhhhbt.exe 3896 jdjjj.exe 2664 xlrxlrx.exe 452 ppdvp.exe 3336 pdddj.exe 4352 hbbhnb.exe 5096 lfxlxrf.exe 4496 bnnttb.exe 3460 jpvdd.exe 3036 ntnntt.exe 1360 9xrffrx.exe 3604 bbhnhb.exe 456 vdjdv.exe 2608 9hhhhn.exe 4452 lrxxlll.exe 4624 ttnhbb.exe 1440 vdjvp.exe 884 nttbbn.exe 1732 vpjpj.exe 4992 xfllllx.exe 2124 ttntnh.exe 3948 htbnbb.exe 940 ppvvp.exe 2716 rxffllr.exe 2808 nttbhb.exe 1384 ppjdp.exe 8 9xflllx.exe 4584 dpddv.exe 1980 llfxlxr.exe 764 thttbh.exe 1828 1pjjv.exe 2008 fxlfrrf.exe 3428 bttnhn.exe 3304 xrffffx.exe 3352 nhnnnt.exe 3772 dpjvp.exe 4956 flllrlf.exe -
Processes:
resource yara_rule behavioral2/memory/3100-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdpjp.exe upx behavioral2/memory/3100-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4008-12-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bnttht.exe upx C:\btntht.exe upx behavioral2/memory/3136-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1360-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvjpv.exe upx behavioral2/memory/3136-25-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnbhhh.exe upx behavioral2/memory/3620-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1772-33-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rlfrxxx.exe upx behavioral2/memory/4488-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnhhnn.exe upx C:\thtnnb.exe upx behavioral2/memory/3968-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/720-51-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvpvj.exe upx C:\xxxxxrr.exe upx behavioral2/memory/3572-61-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nntbhb.exe upx behavioral2/memory/3572-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvjjj.exe upx behavioral2/memory/3532-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4884-75-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbhhbn.exe upx C:\dvvdj.exe upx behavioral2/memory/1436-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1980-86-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbtthn.exe upx C:\vpjvj.exe upx behavioral2/memory/4516-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2644-98-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlxfrll.exe upx behavioral2/memory/2644-103-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppvdj.exe upx behavioral2/memory/3428-109-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnnbbt.exe upx behavioral2/memory/4912-117-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjdvd.exe upx behavioral2/memory/4420-123-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxrfxxr.exe upx behavioral2/memory/2044-132-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttbnnh.exe upx C:\llffffl.exe upx C:\ddddd.exe upx C:\hnhnbb.exe upx behavioral2/memory/3320-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2368-153-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frffflf.exe upx C:\dppvd.exe upx behavioral2/memory/1528-161-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhhhbt.exe upx behavioral2/memory/4904-166-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdjjj.exe upx C:\xlrxlrx.exe upx behavioral2/memory/3896-177-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppdvp.exe upx behavioral2/memory/452-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2664-183-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdddj.exe upx behavioral2/memory/4352-197-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
dvvpj.exeffxrlff.exerfllrrx.exehnhnbb.exelrfxrll.exehhtbbb.exehtbnnt.exerxffxrl.exehntttb.exedvvvv.exejjpvj.exehbnhbn.exe5lflxxf.exelfrxxxf.exehnbthh.exejpppj.exedjvpp.exenbbbnb.exejppdp.exebbbtnh.exehnbtbt.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ab9f19523644806018117208c62d34f0N.exepdpjp.exebnttht.exebtntht.exevvjpv.exetnbhhh.exerlfrxxx.exennhhnn.exethtnnb.exedvpvj.exexxxxxrr.exenntbhb.exejvjjj.exehbhhbn.exedvvdj.exetbtthn.exevpjvj.exerlxfrll.exeppvdj.exebnnbbt.exepjdvd.exerxrfxxr.exedescription pid process target process PID 3100 wrote to memory of 4008 3100 ab9f19523644806018117208c62d34f0N.exe pdpjp.exe PID 3100 wrote to memory of 4008 3100 ab9f19523644806018117208c62d34f0N.exe pdpjp.exe PID 3100 wrote to memory of 4008 3100 ab9f19523644806018117208c62d34f0N.exe pdpjp.exe PID 4008 wrote to memory of 1360 4008 pdpjp.exe bnttht.exe PID 4008 wrote to memory of 1360 4008 pdpjp.exe bnttht.exe PID 4008 wrote to memory of 1360 4008 pdpjp.exe bnttht.exe PID 1360 wrote to memory of 3136 1360 bnttht.exe btntht.exe PID 1360 wrote to memory of 3136 1360 bnttht.exe btntht.exe PID 1360 wrote to memory of 3136 1360 bnttht.exe btntht.exe PID 3136 wrote to memory of 3620 3136 btntht.exe vvjpv.exe PID 3136 wrote to memory of 3620 3136 btntht.exe vvjpv.exe PID 3136 wrote to memory of 3620 3136 btntht.exe vvjpv.exe PID 3620 wrote to memory of 1772 3620 vvjpv.exe tnbhhh.exe PID 3620 wrote to memory of 1772 3620 vvjpv.exe tnbhhh.exe PID 3620 wrote to memory of 1772 3620 vvjpv.exe tnbhhh.exe PID 1772 wrote to memory of 4488 1772 tnbhhh.exe rlfrxxx.exe PID 1772 wrote to memory of 4488 1772 tnbhhh.exe rlfrxxx.exe PID 1772 wrote to memory of 4488 1772 tnbhhh.exe rlfrxxx.exe PID 4488 wrote to memory of 3968 4488 rlfrxxx.exe nnhhnn.exe PID 4488 wrote to memory of 3968 4488 rlfrxxx.exe nnhhnn.exe PID 4488 wrote to memory of 3968 4488 rlfrxxx.exe nnhhnn.exe PID 3968 wrote to memory of 720 3968 nnhhnn.exe thtnnb.exe PID 3968 wrote to memory of 720 3968 nnhhnn.exe thtnnb.exe PID 3968 wrote to memory of 720 3968 nnhhnn.exe thtnnb.exe PID 720 wrote to memory of 2124 720 thtnnb.exe dvpvj.exe PID 720 wrote to memory of 2124 720 thtnnb.exe dvpvj.exe PID 720 wrote to memory of 2124 720 thtnnb.exe dvpvj.exe PID 2124 wrote to memory of 3572 2124 dvpvj.exe xxxxxrr.exe PID 2124 wrote to memory of 3572 2124 dvpvj.exe xxxxxrr.exe PID 2124 wrote to memory of 3572 2124 dvpvj.exe xxxxxrr.exe PID 3572 wrote to memory of 3532 3572 xxxxxrr.exe nntbhb.exe PID 3572 wrote to memory of 3532 3572 xxxxxrr.exe nntbhb.exe PID 3572 wrote to memory of 3532 3572 xxxxxrr.exe nntbhb.exe PID 3532 wrote to memory of 4884 3532 nntbhb.exe jvjjj.exe PID 3532 wrote to memory of 4884 3532 nntbhb.exe jvjjj.exe PID 3532 wrote to memory of 4884 3532 nntbhb.exe jvjjj.exe PID 4884 wrote to memory of 1436 4884 jvjjj.exe hbhhbn.exe PID 4884 wrote to memory of 1436 4884 jvjjj.exe hbhhbn.exe PID 4884 wrote to memory of 1436 4884 jvjjj.exe hbhhbn.exe PID 1436 wrote to memory of 1980 1436 hbhhbn.exe dvvdj.exe PID 1436 wrote to memory of 1980 1436 hbhhbn.exe dvvdj.exe PID 1436 wrote to memory of 1980 1436 hbhhbn.exe dvvdj.exe PID 1980 wrote to memory of 4516 1980 dvvdj.exe tbtthn.exe PID 1980 wrote to memory of 4516 1980 dvvdj.exe tbtthn.exe PID 1980 wrote to memory of 4516 1980 dvvdj.exe tbtthn.exe PID 4516 wrote to memory of 2644 4516 tbtthn.exe vpjvj.exe PID 4516 wrote to memory of 2644 4516 tbtthn.exe vpjvj.exe PID 4516 wrote to memory of 2644 4516 tbtthn.exe vpjvj.exe PID 2644 wrote to memory of 3428 2644 vpjvj.exe rlxfrll.exe PID 2644 wrote to memory of 3428 2644 vpjvj.exe rlxfrll.exe PID 2644 wrote to memory of 3428 2644 vpjvj.exe rlxfrll.exe PID 3428 wrote to memory of 516 3428 rlxfrll.exe ppvdj.exe PID 3428 wrote to memory of 516 3428 rlxfrll.exe ppvdj.exe PID 3428 wrote to memory of 516 3428 rlxfrll.exe ppvdj.exe PID 516 wrote to memory of 4912 516 ppvdj.exe bnnbbt.exe PID 516 wrote to memory of 4912 516 ppvdj.exe bnnbbt.exe PID 516 wrote to memory of 4912 516 ppvdj.exe bnnbbt.exe PID 4912 wrote to memory of 4420 4912 bnnbbt.exe pjdvd.exe PID 4912 wrote to memory of 4420 4912 bnnbbt.exe pjdvd.exe PID 4912 wrote to memory of 4420 4912 bnnbbt.exe pjdvd.exe PID 4420 wrote to memory of 2044 4420 pjdvd.exe rxrfxxr.exe PID 4420 wrote to memory of 2044 4420 pjdvd.exe rxrfxxr.exe PID 4420 wrote to memory of 2044 4420 pjdvd.exe rxrfxxr.exe PID 2044 wrote to memory of 4552 2044 rxrfxxr.exe ttbnnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab9f19523644806018117208c62d34f0N.exe"C:\Users\Admin\AppData\Local\Temp\ab9f19523644806018117208c62d34f0N.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\pdpjp.exec:\pdpjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnttht.exec:\bnttht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btntht.exec:\btntht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvjpv.exec:\vvjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbhhh.exec:\tnbhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlfrxxx.exec:\rlfrxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnhhnn.exec:\nnhhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thtnnb.exec:\thtnnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvpvj.exec:\dvpvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxxxxrr.exec:\xxxxxrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nntbhb.exec:\nntbhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvjjj.exec:\jvjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhhbn.exec:\hbhhbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvvdj.exec:\dvvdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbtthn.exec:\tbtthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjvj.exec:\vpjvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxfrll.exec:\rlxfrll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppvdj.exec:\ppvdj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnnbbt.exec:\bnnbbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjdvd.exec:\pjdvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxrfxxr.exec:\rxrfxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttbnnh.exec:\ttbnnh.exe23⤵
- Executes dropped EXE
-
\??\c:\llffffl.exec:\llffffl.exe24⤵
- Executes dropped EXE
-
\??\c:\ddddd.exec:\ddddd.exe25⤵
- Executes dropped EXE
-
\??\c:\hnhnbb.exec:\hnhnbb.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\frffflf.exec:\frffflf.exe27⤵
- Executes dropped EXE
-
\??\c:\dppvd.exec:\dppvd.exe28⤵
- Executes dropped EXE
-
\??\c:\hhhhbt.exec:\hhhhbt.exe29⤵
- Executes dropped EXE
-
\??\c:\jdjjj.exec:\jdjjj.exe30⤵
- Executes dropped EXE
-
\??\c:\xlrxlrx.exec:\xlrxlrx.exe31⤵
- Executes dropped EXE
-
\??\c:\ppdvp.exec:\ppdvp.exe32⤵
- Executes dropped EXE
-
\??\c:\pdddj.exec:\pdddj.exe33⤵
- Executes dropped EXE
-
\??\c:\hbbhnb.exec:\hbbhnb.exe34⤵
- Executes dropped EXE
-
\??\c:\lfxlxrf.exec:\lfxlxrf.exe35⤵
- Executes dropped EXE
-
\??\c:\bnnttb.exec:\bnnttb.exe36⤵
- Executes dropped EXE
-
\??\c:\jpvdd.exec:\jpvdd.exe37⤵
- Executes dropped EXE
-
\??\c:\ntnntt.exec:\ntnntt.exe38⤵
- Executes dropped EXE
-
\??\c:\9xrffrx.exec:\9xrffrx.exe39⤵
- Executes dropped EXE
-
\??\c:\bbhnhb.exec:\bbhnhb.exe40⤵
- Executes dropped EXE
-
\??\c:\vdjdv.exec:\vdjdv.exe41⤵
- Executes dropped EXE
-
\??\c:\9hhhhn.exec:\9hhhhn.exe42⤵
- Executes dropped EXE
-
\??\c:\lrxxlll.exec:\lrxxlll.exe43⤵
- Executes dropped EXE
-
\??\c:\ttnhbb.exec:\ttnhbb.exe44⤵
- Executes dropped EXE
-
\??\c:\vdjvp.exec:\vdjvp.exe45⤵
- Executes dropped EXE
-
\??\c:\nttbbn.exec:\nttbbn.exe46⤵
- Executes dropped EXE
-
\??\c:\vpjpj.exec:\vpjpj.exe47⤵
- Executes dropped EXE
-
\??\c:\xfllllx.exec:\xfllllx.exe48⤵
- Executes dropped EXE
-
\??\c:\ttntnh.exec:\ttntnh.exe49⤵
- Executes dropped EXE
-
\??\c:\htbnbb.exec:\htbnbb.exe50⤵
- Executes dropped EXE
-
\??\c:\ppvvp.exec:\ppvvp.exe51⤵
- Executes dropped EXE
-
\??\c:\rxffllr.exec:\rxffllr.exe52⤵
- Executes dropped EXE
-
\??\c:\nttbhb.exec:\nttbhb.exe53⤵
- Executes dropped EXE
-
\??\c:\ppjdp.exec:\ppjdp.exe54⤵
- Executes dropped EXE
-
\??\c:\9xflllx.exec:\9xflllx.exe55⤵
- Executes dropped EXE
-
\??\c:\dpddv.exec:\dpddv.exe56⤵
- Executes dropped EXE
-
\??\c:\llfxlxr.exec:\llfxlxr.exe57⤵
- Executes dropped EXE
-
\??\c:\thttbh.exec:\thttbh.exe58⤵
- Executes dropped EXE
-
\??\c:\1pjjv.exec:\1pjjv.exe59⤵
- Executes dropped EXE
-
\??\c:\fxlfrrf.exec:\fxlfrrf.exe60⤵
- Executes dropped EXE
-
\??\c:\bttnhn.exec:\bttnhn.exe61⤵
- Executes dropped EXE
-
\??\c:\xrffffx.exec:\xrffffx.exe62⤵
- Executes dropped EXE
-
\??\c:\nhnnnt.exec:\nhnnnt.exe63⤵
- Executes dropped EXE
-
\??\c:\dpjvp.exec:\dpjvp.exe64⤵
- Executes dropped EXE
-
\??\c:\flllrlf.exec:\flllrlf.exe65⤵
- Executes dropped EXE
-
\??\c:\3ddpp.exec:\3ddpp.exe66⤵
-
\??\c:\lllrfrr.exec:\lllrfrr.exe67⤵
-
\??\c:\ntbhht.exec:\ntbhht.exe68⤵
-
\??\c:\jdpvp.exec:\jdpvp.exe69⤵
-
\??\c:\fffrxxl.exec:\fffrxxl.exe70⤵
-
\??\c:\9thbbt.exec:\9thbbt.exe71⤵
-
\??\c:\vdpvv.exec:\vdpvv.exe72⤵
-
\??\c:\1thttt.exec:\1thttt.exe73⤵
-
\??\c:\fffflfx.exec:\fffflfx.exe74⤵
-
\??\c:\ththhn.exec:\ththhn.exe75⤵
-
\??\c:\jpdpv.exec:\jpdpv.exe76⤵
-
\??\c:\rllxxff.exec:\rllxxff.exe77⤵
-
\??\c:\nthbhn.exec:\nthbhn.exe78⤵
-
\??\c:\vpppp.exec:\vpppp.exe79⤵
-
\??\c:\rffflrl.exec:\rffflrl.exe80⤵
-
\??\c:\hhbnnn.exec:\hhbnnn.exe81⤵
-
\??\c:\jjpjv.exec:\jjpjv.exe82⤵
-
\??\c:\lffflxl.exec:\lffflxl.exe83⤵
-
\??\c:\tnntnn.exec:\tnntnn.exe84⤵
-
\??\c:\jvpdj.exec:\jvpdj.exe85⤵
-
\??\c:\llxlrxr.exec:\llxlrxr.exe86⤵
-
\??\c:\tbbnhn.exec:\tbbnhn.exe87⤵
-
\??\c:\jjpvj.exec:\jjpvj.exe88⤵
-
\??\c:\ddjdj.exec:\ddjdj.exe89⤵
-
\??\c:\frrrxlx.exec:\frrrxlx.exe90⤵
-
\??\c:\nhtntn.exec:\nhtntn.exe91⤵
-
\??\c:\djpvp.exec:\djpvp.exe92⤵
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe93⤵
-
\??\c:\vvjjd.exec:\vvjjd.exe94⤵
-
\??\c:\5xlrrrf.exec:\5xlrrrf.exe95⤵
-
\??\c:\xflllff.exec:\xflllff.exe96⤵
-
\??\c:\hnhbtn.exec:\hnhbtn.exe97⤵
-
\??\c:\pvdvd.exec:\pvdvd.exe98⤵
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe99⤵
-
\??\c:\tbhbnt.exec:\tbhbnt.exe100⤵
-
\??\c:\ddpvv.exec:\ddpvv.exe101⤵
-
\??\c:\fxflxxl.exec:\fxflxxl.exe102⤵
-
\??\c:\hbtttn.exec:\hbtttn.exe103⤵
-
\??\c:\pjppp.exec:\pjppp.exe104⤵
-
\??\c:\xlllllr.exec:\xlllllr.exe105⤵
-
\??\c:\bnnbhh.exec:\bnnbhh.exe106⤵
-
\??\c:\9pjjv.exec:\9pjjv.exe107⤵
-
\??\c:\rxffrxf.exec:\rxffrxf.exe108⤵
-
\??\c:\xlrllfl.exec:\xlrllfl.exe109⤵
-
\??\c:\nbnnbb.exec:\nbnnbb.exe110⤵
-
\??\c:\dppvd.exec:\dppvd.exe111⤵
-
\??\c:\5jjjj.exec:\5jjjj.exe112⤵
-
\??\c:\7rlffll.exec:\7rlffll.exe113⤵
-
\??\c:\bbbbbb.exec:\bbbbbb.exe114⤵
-
\??\c:\9djpd.exec:\9djpd.exe115⤵
-
\??\c:\rfxlrrf.exec:\rfxlrrf.exe116⤵
-
\??\c:\ntbtbb.exec:\ntbtbb.exe117⤵
-
\??\c:\thbtnn.exec:\thbtnn.exe118⤵
-
\??\c:\dpppp.exec:\dpppp.exe119⤵
-
\??\c:\xfxrlfx.exec:\xfxrlfx.exe120⤵
-
\??\c:\nhhhnn.exec:\nhhhnn.exe121⤵
-
\??\c:\vpvpd.exec:\vpvpd.exe122⤵
-
\??\c:\flxxllx.exec:\flxxllx.exe123⤵
-
\??\c:\nhnnnh.exec:\nhnnnh.exe124⤵
-
\??\c:\pjpvv.exec:\pjpvv.exe125⤵
-
\??\c:\lflrrfl.exec:\lflrrfl.exe126⤵
-
\??\c:\bnhntb.exec:\bnhntb.exe127⤵
-
\??\c:\djdjp.exec:\djdjp.exe128⤵
-
\??\c:\lffffrr.exec:\lffffrr.exe129⤵
-
\??\c:\7llrxlr.exec:\7llrxlr.exe130⤵
-
\??\c:\nnnhhn.exec:\nnnhhn.exe131⤵
-
\??\c:\ttbhbb.exec:\ttbhbb.exe132⤵
-
\??\c:\pddjp.exec:\pddjp.exe133⤵
-
\??\c:\rxlxllx.exec:\rxlxllx.exe134⤵
-
\??\c:\1htbht.exec:\1htbht.exe135⤵
-
\??\c:\jvpjd.exec:\jvpjd.exe136⤵
-
\??\c:\rlxlxxr.exec:\rlxlxxr.exe137⤵
-
\??\c:\hhbbbh.exec:\hhbbbh.exe138⤵
-
\??\c:\jpvpp.exec:\jpvpp.exe139⤵
-
\??\c:\dpvdj.exec:\dpvdj.exe140⤵
-
\??\c:\5llxxrf.exec:\5llxxrf.exe141⤵
-
\??\c:\ppddv.exec:\ppddv.exe142⤵
-
\??\c:\fxrrlxr.exec:\fxrrlxr.exe143⤵
-
\??\c:\nthnbt.exec:\nthnbt.exe144⤵
-
\??\c:\pdpvd.exec:\pdpvd.exe145⤵
-
\??\c:\rflxxfr.exec:\rflxxfr.exe146⤵
-
\??\c:\btnnhh.exec:\btnnhh.exe147⤵
-
\??\c:\pppvd.exec:\pppvd.exe148⤵
-
\??\c:\jddvd.exec:\jddvd.exe149⤵
-
\??\c:\ffxrlff.exec:\ffxrlff.exe150⤵
- System Location Discovery: System Language Discovery
-
\??\c:\bthhnh.exec:\bthhnh.exe151⤵
-
\??\c:\jjpvj.exec:\jjpvj.exe152⤵
-
\??\c:\vvjpv.exec:\vvjpv.exe153⤵
-
\??\c:\1ffxfxx.exec:\1ffxfxx.exe154⤵
-
\??\c:\rrrlffx.exec:\rrrlffx.exe155⤵
-
\??\c:\nhbtnh.exec:\nhbtnh.exe156⤵
-
\??\c:\vvdvp.exec:\vvdvp.exe157⤵
-
\??\c:\frflxxx.exec:\frflxxx.exe158⤵
-
\??\c:\bttnbn.exec:\bttnbn.exe159⤵
-
\??\c:\vddvj.exec:\vddvj.exe160⤵
-
\??\c:\flfxlrr.exec:\flfxlrr.exe161⤵
-
\??\c:\hnhnbb.exec:\hnhnbb.exe162⤵
-
\??\c:\djpjd.exec:\djpjd.exe163⤵
-
\??\c:\nnntnt.exec:\nnntnt.exe164⤵
-
\??\c:\nnnbtb.exec:\nnnbtb.exe165⤵
-
\??\c:\jjvdp.exec:\jjvdp.exe166⤵
-
\??\c:\xfxllll.exec:\xfxllll.exe167⤵
-
\??\c:\tthbbh.exec:\tthbbh.exe168⤵
-
\??\c:\nbnhnh.exec:\nbnhnh.exe169⤵
-
\??\c:\thbthh.exec:\thbthh.exe170⤵
-
\??\c:\lrllrll.exec:\lrllrll.exe171⤵
-
\??\c:\3nttbh.exec:\3nttbh.exe172⤵
-
\??\c:\pdvdp.exec:\pdvdp.exe173⤵
-
\??\c:\bthbhh.exec:\bthbhh.exe174⤵
-
\??\c:\vjvjd.exec:\vjvjd.exe175⤵
-
\??\c:\xfllrxf.exec:\xfllrxf.exe176⤵
-
\??\c:\bnbtnn.exec:\bnbtnn.exe177⤵
-
\??\c:\5jdjj.exec:\5jdjj.exe178⤵
-
\??\c:\xllrfrl.exec:\xllrfrl.exe179⤵
-
\??\c:\thbbbh.exec:\thbbbh.exe180⤵
-
\??\c:\xffxxxr.exec:\xffxxxr.exe181⤵
-
\??\c:\xxxfxfr.exec:\xxxfxfr.exe182⤵
-
\??\c:\nhhtnn.exec:\nhhtnn.exe183⤵
-
\??\c:\pddvd.exec:\pddvd.exe184⤵
-
\??\c:\rlrrlff.exec:\rlrrlff.exe185⤵
-
\??\c:\nbhtbt.exec:\nbhtbt.exe186⤵
-
\??\c:\thnnnh.exec:\thnnnh.exe187⤵
-
\??\c:\vdpjd.exec:\vdpjd.exe188⤵
-
\??\c:\5fxxrxx.exec:\5fxxrxx.exe189⤵
-
\??\c:\bthtnb.exec:\bthtnb.exe190⤵
-
\??\c:\vdjdp.exec:\vdjdp.exe191⤵
-
\??\c:\xfrlffl.exec:\xfrlffl.exe192⤵
-
\??\c:\jppdp.exec:\jppdp.exe193⤵
- System Location Discovery: System Language Discovery
-
\??\c:\rxrfflx.exec:\rxrfflx.exe194⤵
-
\??\c:\7nnhhn.exec:\7nnhhn.exe195⤵
-
\??\c:\hhnhtn.exec:\hhnhtn.exe196⤵
-
\??\c:\1dpdv.exec:\1dpdv.exe197⤵
-
\??\c:\lfrlrfl.exec:\lfrlrfl.exe198⤵
-
\??\c:\lxrfrlf.exec:\lxrfrlf.exe199⤵
-
\??\c:\bnhnbb.exec:\bnhnbb.exe200⤵
-
\??\c:\jdjjp.exec:\jdjjp.exe201⤵
-
\??\c:\llfrxfl.exec:\llfrxfl.exe202⤵
-
\??\c:\nbnntb.exec:\nbnntb.exe203⤵
-
\??\c:\dvvvd.exec:\dvvvd.exe204⤵
-
\??\c:\rlllfff.exec:\rlllfff.exe205⤵
-
\??\c:\vjvpp.exec:\vjvpp.exe206⤵
-
\??\c:\9dvpd.exec:\9dvpd.exe207⤵
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe208⤵
-
\??\c:\dvdjd.exec:\dvdjd.exe209⤵
-
\??\c:\lrllxlf.exec:\lrllxlf.exe210⤵
-
\??\c:\bnbnnn.exec:\bnbnnn.exe211⤵
-
\??\c:\nnnttb.exec:\nnnttb.exe212⤵
-
\??\c:\jpdvj.exec:\jpdvj.exe213⤵
-
\??\c:\3frflfr.exec:\3frflfr.exe214⤵
-
\??\c:\flxxffr.exec:\flxxffr.exe215⤵
-
\??\c:\thbbtb.exec:\thbbtb.exe216⤵
-
\??\c:\nbbnhb.exec:\nbbnhb.exe217⤵
-
\??\c:\vvvpp.exec:\vvvpp.exe218⤵
-
\??\c:\xlfrlfr.exec:\xlfrlfr.exe219⤵
-
\??\c:\hnhnbh.exec:\hnhnbh.exe220⤵
-
\??\c:\pdpvd.exec:\pdpvd.exe221⤵
-
\??\c:\5rxrlfr.exec:\5rxrlfr.exe222⤵
-
\??\c:\bbbtnh.exec:\bbbtnh.exe223⤵
- System Location Discovery: System Language Discovery
-
\??\c:\jvpdp.exec:\jvpdp.exe224⤵
-
\??\c:\9dpjp.exec:\9dpjp.exe225⤵
-
\??\c:\tbbbbh.exec:\tbbbbh.exe226⤵
-
\??\c:\pvvvv.exec:\pvvvv.exe227⤵
-
\??\c:\dppdp.exec:\dppdp.exe228⤵
-
\??\c:\fxlflfl.exec:\fxlflfl.exe229⤵
-
\??\c:\nhttbh.exec:\nhttbh.exe230⤵
-
\??\c:\jjdpv.exec:\jjdpv.exe231⤵
-
\??\c:\ffxlxfr.exec:\ffxlxfr.exe232⤵
-
\??\c:\frrlxfl.exec:\frrlxfl.exe233⤵
-
\??\c:\hhhhhh.exec:\hhhhhh.exe234⤵
-
\??\c:\thbhnn.exec:\thbhnn.exe235⤵
-
\??\c:\jpvjv.exec:\jpvjv.exe236⤵
-
\??\c:\lfffrxr.exec:\lfffrxr.exe237⤵
-
\??\c:\bttttb.exec:\bttttb.exe238⤵
-
\??\c:\bbhhnt.exec:\bbhhnt.exe239⤵
-
\??\c:\jvddj.exec:\jvddj.exe240⤵
-
\??\c:\xxrffff.exec:\xxrffff.exe241⤵