Analysis
-
max time kernel
55s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2024 10:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b95ebc1b86cb45a213fbbe9f78281de0N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
b95ebc1b86cb45a213fbbe9f78281de0N.exe
-
Size
63KB
-
MD5
b95ebc1b86cb45a213fbbe9f78281de0
-
SHA1
239fc0b394a7b583540630faac0e90790baae6b8
-
SHA256
dd2d000dda50545eff0d74159bf1506917ea19173b11184abe4140050881e083
-
SHA512
f01fe2150d01f390fbb081a8550b8bbb75383c9f9d85f11d160b1d1401f18cde4464824b4fcbc4407ff69913c9911462308b998d14c2132d9115140499a0c389
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzkzN+:ymb3NkkiQ3mdBjFIvlp+
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/2072-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1808-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2120-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/720-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1644-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3776-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/792-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xrrrlff.exeppdjp.exelllrxxf.exexllxlrf.exefxlllxl.exellfxxxx.exerxrxxlr.exerfrrlfr.exedpvjd.exe5fxrffx.exedpppp.exejvdpp.exelrffxll.exehnbttb.exejvdjp.exehhhnbn.exeppddj.exehtttbn.exe1xxrfrf.exerflllff.exedjvjj.exenthnbh.exehhtthh.exenbthhn.exejjddp.exetbnbtb.exetbtttb.exetbhbtb.exebbnbbh.exehtntth.exetbnbhh.exenhhhhn.exepvvjd.exepjpdd.exentnbhb.exenttttb.exejpvdv.exexfrllrf.exeflxlrxl.exepjppp.exe1nhnth.exepvvdd.exejvjpd.exebhtthh.exe5bhhbb.exethbbnt.exexxflrlf.exe7lxxrxl.exepjvdj.exedddjd.exenthnbh.exelllxfxx.exejvjjj.exexxfrlff.exe9vpdd.exenbhnth.exejpvjp.exethnhth.exeppppj.exehhntnh.exexrfxlxl.exeppvpp.exellxllxl.exedvdvv.exepid process 1808 xrrrlff.exe 2120 ppdjp.exe 1408 lllrxxf.exe 2060 xllxlrf.exe 4272 fxlllxl.exe 4004 llfxxxx.exe 4648 rxrxxlr.exe 1092 rfrrlfr.exe 3368 dpvjd.exe 720 5fxrffx.exe 1644 dpppp.exe 736 jvdpp.exe 4320 lrffxll.exe 3776 hnbttb.exe 3788 jvdjp.exe 5020 hhhnbn.exe 3960 ppddj.exe 4160 htttbn.exe 792 1xxrfrf.exe 1184 rflllff.exe 3268 djvjj.exe 1624 nthnbh.exe 2924 hhtthh.exe 3296 nbthhn.exe 3516 jjddp.exe 3428 tbnbtb.exe 4048 tbtttb.exe 4740 tbhbtb.exe 2988 bbnbbh.exe 5104 htntth.exe 4640 tbnbhh.exe 4552 nhhhhn.exe 4496 pvvjd.exe 3092 pjpdd.exe 4544 ntnbhb.exe 2608 nttttb.exe 4500 jpvdv.exe 2488 xfrllrf.exe 3400 flxlrxl.exe 1808 pjppp.exe 3568 1nhnth.exe 1980 pvvdd.exe 512 jvjpd.exe 1340 bhtthh.exe 4200 5bhhbb.exe 3720 thbbnt.exe 1404 xxflrlf.exe 3640 7lxxrxl.exe 60 pjvdj.exe 3584 dddjd.exe 4664 nthnbh.exe 1608 lllxfxx.exe 4064 jvjjj.exe 3688 xxfrlff.exe 736 9vpdd.exe 3060 nbhnth.exe 3776 jpvjp.exe 632 thnhth.exe 740 ppppj.exe 1716 hhntnh.exe 3960 xrfxlxl.exe 4160 ppvpp.exe 792 llxllxl.exe 1184 dvdvv.exe -
Processes:
resource yara_rule behavioral2/memory/2072-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1808-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2120-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2060-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/720-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/792-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-192-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
hhhnbn.exe3jvjv.exexffxrrl.exehhnbbn.exebhtntt.exexrlrlxx.exepjpdd.exenbhnth.exehbhnhb.exedjppp.exe3xllllf.exe3jjdp.exe7bnnhh.exe7xrxfff.exejjpjj.exepjdpp.exevpjpd.exellrlrfx.exehhtthh.exehbnhhh.exennbtbb.exerxllxfx.exejpjdd.exe7fflrrr.exetbnbtb.exedddjd.exe7lxlllx.exeffxllxf.exedjddj.exedvvjd.exexxflrlf.exejvdjv.exejvjpd.exedvpvp.exehhbtht.exejjdjd.exepjvdj.exejpjpd.exejjppd.exerlxxflx.exebnnnhh.exedjpdv.exebtbhnt.exellllflx.exevvjdv.exefrrfxrl.exerffxlrr.exe5hbbnb.exelfrxxrl.exehthbnn.exexlxlfxl.exedjpjp.exedpvpp.exetthhnt.exethbtbt.exetthtnb.exeppppj.exentntnb.exevvjpj.exetnnbnb.exelrrfxfl.exepvppp.exevvjjp.exejdjjj.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xllllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fflrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxlllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b95ebc1b86cb45a213fbbe9f78281de0N.exexrrrlff.exeppdjp.exelllrxxf.exexllxlrf.exefxlllxl.exellfxxxx.exerxrxxlr.exerfrrlfr.exedpvjd.exe5fxrffx.exedpppp.exejvdpp.exelrffxll.exehnbttb.exejvdjp.exehhhnbn.exeppddj.exehtttbn.exe1xxrfrf.exerflllff.exedjvjj.exedescription pid process target process PID 2072 wrote to memory of 1808 2072 b95ebc1b86cb45a213fbbe9f78281de0N.exe xrrrlff.exe PID 2072 wrote to memory of 1808 2072 b95ebc1b86cb45a213fbbe9f78281de0N.exe xrrrlff.exe PID 2072 wrote to memory of 1808 2072 b95ebc1b86cb45a213fbbe9f78281de0N.exe xrrrlff.exe PID 1808 wrote to memory of 2120 1808 xrrrlff.exe ppdjp.exe PID 1808 wrote to memory of 2120 1808 xrrrlff.exe ppdjp.exe PID 1808 wrote to memory of 2120 1808 xrrrlff.exe ppdjp.exe PID 2120 wrote to memory of 1408 2120 ppdjp.exe lllrxxf.exe PID 2120 wrote to memory of 1408 2120 ppdjp.exe lllrxxf.exe PID 2120 wrote to memory of 1408 2120 ppdjp.exe lllrxxf.exe PID 1408 wrote to memory of 2060 1408 lllrxxf.exe xllxlrf.exe PID 1408 wrote to memory of 2060 1408 lllrxxf.exe xllxlrf.exe PID 1408 wrote to memory of 2060 1408 lllrxxf.exe xllxlrf.exe PID 2060 wrote to memory of 4272 2060 xllxlrf.exe fxlllxl.exe PID 2060 wrote to memory of 4272 2060 xllxlrf.exe fxlllxl.exe PID 2060 wrote to memory of 4272 2060 xllxlrf.exe fxlllxl.exe PID 4272 wrote to memory of 4004 4272 fxlllxl.exe llfxxxx.exe PID 4272 wrote to memory of 4004 4272 fxlllxl.exe llfxxxx.exe PID 4272 wrote to memory of 4004 4272 fxlllxl.exe llfxxxx.exe PID 4004 wrote to memory of 4648 4004 llfxxxx.exe rxrxxlr.exe PID 4004 wrote to memory of 4648 4004 llfxxxx.exe rxrxxlr.exe PID 4004 wrote to memory of 4648 4004 llfxxxx.exe rxrxxlr.exe PID 4648 wrote to memory of 1092 4648 rxrxxlr.exe rfrrlfr.exe PID 4648 wrote to memory of 1092 4648 rxrxxlr.exe rfrrlfr.exe PID 4648 wrote to memory of 1092 4648 rxrxxlr.exe rfrrlfr.exe PID 1092 wrote to memory of 3368 1092 rfrrlfr.exe dpvjd.exe PID 1092 wrote to memory of 3368 1092 rfrrlfr.exe dpvjd.exe PID 1092 wrote to memory of 3368 1092 rfrrlfr.exe dpvjd.exe PID 3368 wrote to memory of 720 3368 dpvjd.exe 5fxrffx.exe PID 3368 wrote to memory of 720 3368 dpvjd.exe 5fxrffx.exe PID 3368 wrote to memory of 720 3368 dpvjd.exe 5fxrffx.exe PID 720 wrote to memory of 1644 720 5fxrffx.exe dpppp.exe PID 720 wrote to memory of 1644 720 5fxrffx.exe dpppp.exe PID 720 wrote to memory of 1644 720 5fxrffx.exe dpppp.exe PID 1644 wrote to memory of 736 1644 dpppp.exe 9vpdd.exe PID 1644 wrote to memory of 736 1644 dpppp.exe 9vpdd.exe PID 1644 wrote to memory of 736 1644 dpppp.exe 9vpdd.exe PID 736 wrote to memory of 4320 736 jvdpp.exe lrffxll.exe PID 736 wrote to memory of 4320 736 jvdpp.exe lrffxll.exe PID 736 wrote to memory of 4320 736 jvdpp.exe lrffxll.exe PID 4320 wrote to memory of 3776 4320 lrffxll.exe jpvjp.exe PID 4320 wrote to memory of 3776 4320 lrffxll.exe jpvjp.exe PID 4320 wrote to memory of 3776 4320 lrffxll.exe jpvjp.exe PID 3776 wrote to memory of 3788 3776 hnbttb.exe jvdjp.exe PID 3776 wrote to memory of 3788 3776 hnbttb.exe jvdjp.exe PID 3776 wrote to memory of 3788 3776 hnbttb.exe jvdjp.exe PID 3788 wrote to memory of 5020 3788 jvdjp.exe hhhnbn.exe PID 3788 wrote to memory of 5020 3788 jvdjp.exe hhhnbn.exe PID 3788 wrote to memory of 5020 3788 jvdjp.exe hhhnbn.exe PID 5020 wrote to memory of 3960 5020 hhhnbn.exe xrfxlxl.exe PID 5020 wrote to memory of 3960 5020 hhhnbn.exe xrfxlxl.exe PID 5020 wrote to memory of 3960 5020 hhhnbn.exe xrfxlxl.exe PID 3960 wrote to memory of 4160 3960 ppddj.exe pvddj.exe PID 3960 wrote to memory of 4160 3960 ppddj.exe pvddj.exe PID 3960 wrote to memory of 4160 3960 ppddj.exe pvddj.exe PID 4160 wrote to memory of 792 4160 htttbn.exe jdpdj.exe PID 4160 wrote to memory of 792 4160 htttbn.exe jdpdj.exe PID 4160 wrote to memory of 792 4160 htttbn.exe jdpdj.exe PID 792 wrote to memory of 1184 792 1xxrfrf.exe dvdvv.exe PID 792 wrote to memory of 1184 792 1xxrfrf.exe dvdvv.exe PID 792 wrote to memory of 1184 792 1xxrfrf.exe dvdvv.exe PID 1184 wrote to memory of 3268 1184 rflllff.exe djvjj.exe PID 1184 wrote to memory of 3268 1184 rflllff.exe djvjj.exe PID 1184 wrote to memory of 3268 1184 rflllff.exe djvjj.exe PID 3268 wrote to memory of 1624 3268 djvjj.exe nthnbh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b95ebc1b86cb45a213fbbe9f78281de0N.exe"C:\Users\Admin\AppData\Local\Temp\b95ebc1b86cb45a213fbbe9f78281de0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\xrrrlff.exec:\xrrrlff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\ppdjp.exec:\ppdjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\lllrxxf.exec:\lllrxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\xllxlrf.exec:\xllxlrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\fxlllxl.exec:\fxlllxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\llfxxxx.exec:\llfxxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\rxrxxlr.exec:\rxrxxlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\rfrrlfr.exec:\rfrrlfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\dpvjd.exec:\dpvjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\5fxrffx.exec:\5fxrffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\dpppp.exec:\dpppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\jvdpp.exec:\jvdpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\lrffxll.exec:\lrffxll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\hnbttb.exec:\hnbttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\jvdjp.exec:\jvdjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\hhhnbn.exec:\hhhnbn.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\ppddj.exec:\ppddj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\htttbn.exec:\htttbn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\1xxrfrf.exec:\1xxrfrf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\rflllff.exec:\rflllff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\djvjj.exec:\djvjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\nthnbh.exec:\nthnbh.exe23⤵
- Executes dropped EXE
PID:1624 -
\??\c:\hhtthh.exec:\hhtthh.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2924 -
\??\c:\nbthhn.exec:\nbthhn.exe25⤵
- Executes dropped EXE
PID:3296 -
\??\c:\jjddp.exec:\jjddp.exe26⤵
- Executes dropped EXE
PID:3516 -
\??\c:\tbnbtb.exec:\tbnbtb.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3428 -
\??\c:\tbtttb.exec:\tbtttb.exe28⤵
- Executes dropped EXE
PID:4048 -
\??\c:\tbhbtb.exec:\tbhbtb.exe29⤵
- Executes dropped EXE
PID:4740 -
\??\c:\bbnbbh.exec:\bbnbbh.exe30⤵
- Executes dropped EXE
PID:2988 -
\??\c:\htntth.exec:\htntth.exe31⤵
- Executes dropped EXE
PID:5104 -
\??\c:\tbnbhh.exec:\tbnbhh.exe32⤵
- Executes dropped EXE
PID:4640 -
\??\c:\nhhhhn.exec:\nhhhhn.exe33⤵
- Executes dropped EXE
PID:4552 -
\??\c:\pvvjd.exec:\pvvjd.exe34⤵
- Executes dropped EXE
PID:4496 -
\??\c:\pjpdd.exec:\pjpdd.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3092 -
\??\c:\ntnbhb.exec:\ntnbhb.exe36⤵
- Executes dropped EXE
PID:4544 -
\??\c:\nttttb.exec:\nttttb.exe37⤵
- Executes dropped EXE
PID:2608 -
\??\c:\jpvdv.exec:\jpvdv.exe38⤵
- Executes dropped EXE
PID:4500 -
\??\c:\xfrllrf.exec:\xfrllrf.exe39⤵
- Executes dropped EXE
PID:2488 -
\??\c:\flxlrxl.exec:\flxlrxl.exe40⤵
- Executes dropped EXE
PID:3400 -
\??\c:\pjppp.exec:\pjppp.exe41⤵
- Executes dropped EXE
PID:1808 -
\??\c:\1nhnth.exec:\1nhnth.exe42⤵
- Executes dropped EXE
PID:3568 -
\??\c:\pvvdd.exec:\pvvdd.exe43⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jvjpd.exec:\jvjpd.exe44⤵
- Executes dropped EXE
PID:512 -
\??\c:\bhtthh.exec:\bhtthh.exe45⤵
- Executes dropped EXE
PID:1340 -
\??\c:\5bhhbb.exec:\5bhhbb.exe46⤵
- Executes dropped EXE
PID:4200 -
\??\c:\thbbnt.exec:\thbbnt.exe47⤵
- Executes dropped EXE
PID:3720 -
\??\c:\xxflrlf.exec:\xxflrlf.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1404 -
\??\c:\7lxxrxl.exec:\7lxxrxl.exe49⤵
- Executes dropped EXE
PID:3640 -
\??\c:\pjvdj.exec:\pjvdj.exe50⤵
- Executes dropped EXE
PID:60 -
\??\c:\dddjd.exec:\dddjd.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3584 -
\??\c:\nthnbh.exec:\nthnbh.exe52⤵
- Executes dropped EXE
PID:4664 -
\??\c:\lllxfxx.exec:\lllxfxx.exe53⤵
- Executes dropped EXE
PID:1608 -
\??\c:\jvjjj.exec:\jvjjj.exe54⤵
- Executes dropped EXE
PID:4064 -
\??\c:\xxfrlff.exec:\xxfrlff.exe55⤵
- Executes dropped EXE
PID:3688 -
\??\c:\9vpdd.exec:\9vpdd.exe56⤵
- Executes dropped EXE
PID:736 -
\??\c:\nbhnth.exec:\nbhnth.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3060 -
\??\c:\jpvjp.exec:\jpvjp.exe58⤵
- Executes dropped EXE
PID:3776 -
\??\c:\thnhth.exec:\thnhth.exe59⤵
- Executes dropped EXE
PID:632 -
\??\c:\ppppj.exec:\ppppj.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:740 -
\??\c:\hhntnh.exec:\hhntnh.exe61⤵
- Executes dropped EXE
PID:1716 -
\??\c:\xrfxlxl.exec:\xrfxlxl.exe62⤵
- Executes dropped EXE
PID:3960 -
\??\c:\ppvpp.exec:\ppvpp.exe63⤵
- Executes dropped EXE
PID:4160 -
\??\c:\llxllxl.exec:\llxllxl.exe64⤵
- Executes dropped EXE
PID:792 -
\??\c:\dvdvv.exec:\dvdvv.exe65⤵
- Executes dropped EXE
PID:1184 -
\??\c:\hhnhtn.exec:\hhnhtn.exe66⤵PID:2548
-
\??\c:\dpjvv.exec:\dpjvv.exe67⤵PID:980
-
\??\c:\tntnth.exec:\tntnth.exe68⤵PID:3636
-
\??\c:\lfxxxxl.exec:\lfxxxxl.exe69⤵PID:4732
-
\??\c:\dppjj.exec:\dppjj.exe70⤵PID:2200
-
\??\c:\xlllrxx.exec:\xlllrxx.exe71⤵PID:3428
-
\??\c:\djpjp.exec:\djpjp.exe72⤵
- System Location Discovery: System Language Discovery
PID:4048 -
\??\c:\jjdpj.exec:\jjdpj.exe73⤵PID:4968
-
\??\c:\llllflx.exec:\llllflx.exe74⤵
- System Location Discovery: System Language Discovery
PID:4176 -
\??\c:\ppppv.exec:\ppppv.exe75⤵PID:4716
-
\??\c:\lxrllfx.exec:\lxrllfx.exe76⤵PID:3804
-
\??\c:\jjdjd.exec:\jjdjd.exe77⤵
- System Location Discovery: System Language Discovery
PID:4992 -
\??\c:\vvppv.exec:\vvppv.exe78⤵PID:3608
-
\??\c:\3bbbht.exec:\3bbbht.exe79⤵PID:1432
-
\??\c:\tthhnb.exec:\tthhnb.exe80⤵PID:212
-
\??\c:\tnbnnb.exec:\tnbnnb.exe81⤵PID:4720
-
\??\c:\lxllrrx.exec:\lxllrrx.exe82⤵PID:4500
-
\??\c:\pjvpj.exec:\pjvpj.exe83⤵PID:3156
-
\??\c:\hbhhhb.exec:\hbhhhb.exe84⤵PID:1808
-
\??\c:\ffxllxf.exec:\ffxllxf.exe85⤵
- System Location Discovery: System Language Discovery
PID:5032 -
\??\c:\djdpp.exec:\djdpp.exe86⤵PID:2120
-
\??\c:\lxlflxr.exec:\lxlflxr.exe87⤵PID:1584
-
\??\c:\nthbbt.exec:\nthbbt.exe88⤵PID:3120
-
\??\c:\fxlfxfx.exec:\fxlfxfx.exe89⤵PID:3168
-
\??\c:\xxxffrr.exec:\xxxffrr.exe90⤵PID:1612
-
\??\c:\dpvpp.exec:\dpvpp.exe91⤵
- System Location Discovery: System Language Discovery
PID:1092 -
\??\c:\dddvv.exec:\dddvv.exe92⤵PID:4984
-
\??\c:\rxxxfxf.exec:\rxxxfxf.exe93⤵PID:2292
-
\??\c:\3jvjv.exec:\3jvjv.exe94⤵
- System Location Discovery: System Language Discovery
PID:2908 -
\??\c:\1vvpd.exec:\1vvpd.exe95⤵PID:1080
-
\??\c:\9nnntn.exec:\9nnntn.exe96⤵PID:2244
-
\??\c:\fxrllfr.exec:\fxrllfr.exe97⤵PID:3528
-
\??\c:\pjppd.exec:\pjppd.exe98⤵PID:2020
-
\??\c:\jvvdj.exec:\jvvdj.exe99⤵PID:2876
-
\??\c:\ntntnb.exec:\ntntnb.exe100⤵
- System Location Discovery: System Language Discovery
PID:1088 -
\??\c:\nhnbht.exec:\nhnbht.exe101⤵PID:1240
-
\??\c:\pvddj.exec:\pvddj.exe102⤵PID:4160
-
\??\c:\jdpdj.exec:\jdpdj.exe103⤵PID:792
-
\??\c:\lllxrlf.exec:\lllxrlf.exe104⤵PID:4576
-
\??\c:\ppvdd.exec:\ppvdd.exe105⤵PID:2548
-
\??\c:\httbnt.exec:\httbnt.exe106⤵PID:980
-
\??\c:\xlrllfr.exec:\xlrllfr.exe107⤵PID:3636
-
\??\c:\tbnhth.exec:\tbnhth.exe108⤵PID:4732
-
\??\c:\rxrfllr.exec:\rxrfllr.exe109⤵PID:2200
-
\??\c:\dppvj.exec:\dppvj.exe110⤵PID:4908
-
\??\c:\tthhnt.exec:\tthhnt.exe111⤵
- System Location Discovery: System Language Discovery
PID:3144 -
\??\c:\3ppvv.exec:\3ppvv.exe112⤵PID:1904
-
\??\c:\nbttth.exec:\nbttth.exe113⤵PID:4660
-
\??\c:\dppdv.exec:\dppdv.exe114⤵PID:3180
-
\??\c:\rxxllfl.exec:\rxxllfl.exe115⤵PID:2088
-
\??\c:\bnhhtn.exec:\bnhhtn.exe116⤵PID:1436
-
\??\c:\llxffrf.exec:\llxffrf.exe117⤵PID:3360
-
\??\c:\ttbbtt.exec:\ttbbtt.exe118⤵PID:1072
-
\??\c:\hbhnhb.exec:\hbhnhb.exe119⤵
- System Location Discovery: System Language Discovery
PID:5112 -
\??\c:\hbttnn.exec:\hbttnn.exe120⤵PID:3820
-
\??\c:\vvjdv.exec:\vvjdv.exe121⤵
- System Location Discovery: System Language Discovery
PID:2288 -
\??\c:\flxlrlx.exec:\flxlrlx.exe122⤵PID:2132
-
\??\c:\frrfxrl.exec:\frrfxrl.exe123⤵
- System Location Discovery: System Language Discovery
PID:2656 -
\??\c:\rrlxfrr.exec:\rrlxfrr.exe124⤵PID:4244
-
\??\c:\bhbhbn.exec:\bhbhbn.exe125⤵PID:2980
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe126⤵PID:1404
-
\??\c:\llxfrrl.exec:\llxfrrl.exe127⤵PID:1612
-
\??\c:\nnbbhh.exec:\nnbbhh.exe128⤵PID:1092
-
\??\c:\xlfllrr.exec:\xlfllrr.exe129⤵PID:4984
-
\??\c:\pjdpp.exec:\pjdpp.exe130⤵
- System Location Discovery: System Language Discovery
PID:900 -
\??\c:\pdpjp.exec:\pdpjp.exe131⤵PID:3732
-
\??\c:\bbnhnb.exec:\bbnhnb.exe132⤵PID:3000
-
\??\c:\xrllrll.exec:\xrllrll.exe133⤵PID:1456
-
\??\c:\nbbbnt.exec:\nbbbnt.exe134⤵PID:4612
-
\??\c:\tnnbhn.exec:\tnnbhn.exe135⤵PID:4316
-
\??\c:\ppdjj.exec:\ppdjj.exe136⤵PID:1392
-
\??\c:\djjpp.exec:\djjpp.exe137⤵PID:3580
-
\??\c:\tbnbhn.exec:\tbnbhn.exe138⤵PID:3664
-
\??\c:\llfrxfr.exec:\llfrxfr.exe139⤵PID:1684
-
\??\c:\vvppv.exec:\vvppv.exe140⤵PID:4056
-
\??\c:\btbnnn.exec:\btbnnn.exe141⤵PID:3036
-
\??\c:\flllrll.exec:\flllrll.exe142⤵PID:3328
-
\??\c:\lfrxffr.exec:\lfrxffr.exe143⤵PID:748
-
\??\c:\9nthhn.exec:\9nthhn.exe144⤵PID:3636
-
\??\c:\nnttnn.exec:\nnttnn.exe145⤵PID:5044
-
\??\c:\pjppp.exec:\pjppp.exe146⤵PID:4740
-
\??\c:\pdjdd.exec:\pdjdd.exe147⤵PID:404
-
\??\c:\xffxxrl.exec:\xffxxrl.exe148⤵PID:4640
-
\??\c:\dppdd.exec:\dppdd.exe149⤵PID:4676
-
\??\c:\9rffllr.exec:\9rffllr.exe150⤵PID:4572
-
\??\c:\bnnnhh.exec:\bnnnhh.exe151⤵
- System Location Discovery: System Language Discovery
PID:4288 -
\??\c:\pjpjj.exec:\pjpjj.exe152⤵PID:2836
-
\??\c:\flflllf.exec:\flflllf.exe153⤵PID:3400
-
\??\c:\lxllfrx.exec:\lxllfrx.exe154⤵PID:1140
-
\??\c:\bhbhbt.exec:\bhbhbt.exe155⤵PID:5032
-
\??\c:\ffrrrrr.exec:\ffrrrrr.exe156⤵PID:2828
-
\??\c:\hbnhhh.exec:\hbnhhh.exe157⤵
- System Location Discovery: System Language Discovery
PID:3972 -
\??\c:\7frxxrr.exec:\7frxxrr.exe158⤵PID:3168
-
\??\c:\ntbnnn.exec:\ntbnnn.exe159⤵PID:4832
-
\??\c:\rxfxxfx.exec:\rxfxxfx.exe160⤵PID:1708
-
\??\c:\bnthhn.exec:\bnthhn.exe161⤵PID:3368
-
\??\c:\nhnnbn.exec:\nhnnbn.exe162⤵PID:3280
-
\??\c:\jvvvp.exec:\jvvvp.exe163⤵PID:4220
-
\??\c:\hbhntt.exec:\hbhntt.exe164⤵PID:4064
-
\??\c:\fffrxfl.exec:\fffrxfl.exe165⤵PID:3060
-
\??\c:\jpvpj.exec:\jpvpj.exe166⤵PID:632
-
\??\c:\rrxrxxf.exec:\rrxrxxf.exe167⤵PID:3236
-
\??\c:\vvvjj.exec:\vvvjj.exe168⤵PID:2764
-
\??\c:\rfxflrf.exec:\rfxflrf.exe169⤵PID:4540
-
\??\c:\jvvjj.exec:\jvvjj.exe170⤵PID:1088
-
\??\c:\hhntbn.exec:\hhntbn.exe171⤵PID:5084
-
\??\c:\jdpjj.exec:\jdpjj.exe172⤵PID:3664
-
\??\c:\thttbh.exec:\thttbh.exe173⤵PID:2780
-
\??\c:\rffrffr.exec:\rffrffr.exe174⤵PID:3552
-
\??\c:\7jvdd.exec:\7jvdd.exe175⤵PID:3036
-
\??\c:\tthttb.exec:\tthttb.exe176⤵PID:3516
-
\??\c:\5frfrxf.exec:\5frfrxf.exe177⤵PID:3416
-
\??\c:\nhtbht.exec:\nhtbht.exe178⤵PID:4828
-
\??\c:\pdddp.exec:\pdddp.exe179⤵PID:4924
-
\??\c:\nbbhbb.exec:\nbbhbb.exe180⤵PID:2608
-
\??\c:\pdvvj.exec:\pdvvj.exe181⤵PID:3428
-
\??\c:\bbnhtb.exec:\bbnhtb.exe182⤵PID:2232
-
\??\c:\fllffrx.exec:\fllffrx.exe183⤵PID:4740
-
\??\c:\thhbth.exec:\thhbth.exe184⤵PID:404
-
\??\c:\rrrrrxr.exec:\rrrrrxr.exe185⤵PID:2660
-
\??\c:\dpdvv.exec:\dpdvv.exe186⤵PID:3608
-
\??\c:\ththnt.exec:\ththnt.exe187⤵PID:516
-
\??\c:\vvdpv.exec:\vvdpv.exe188⤵PID:1072
-
\??\c:\hhntbn.exec:\hhntbn.exe189⤵PID:396
-
\??\c:\frfllxl.exec:\frfllxl.exe190⤵PID:1484
-
\??\c:\ddjdd.exec:\ddjdd.exe191⤵PID:3540
-
\??\c:\rfrxrff.exec:\rfrxrff.exe192⤵PID:212
-
\??\c:\pjvdj.exec:\pjvdj.exe193⤵
- System Location Discovery: System Language Discovery
PID:1872 -
\??\c:\bbbnbh.exec:\bbbnbh.exe194⤵PID:4764
-
\??\c:\flrrllx.exec:\flrrllx.exe195⤵PID:2980
-
\??\c:\hbhthb.exec:\hbhthb.exe196⤵PID:1336
-
\??\c:\dpppv.exec:\dpppv.exe197⤵PID:8
-
\??\c:\1bbbbn.exec:\1bbbbn.exe198⤵PID:1128
-
\??\c:\jjdvp.exec:\jjdvp.exe199⤵PID:548
-
\??\c:\xxrxrxx.exec:\xxrxrxx.exe200⤵PID:1144
-
\??\c:\vvjpj.exec:\vvjpj.exe201⤵
- System Location Discovery: System Language Discovery
PID:4084 -
\??\c:\tnnbnb.exec:\tnnbnb.exe202⤵
- System Location Discovery: System Language Discovery
PID:2796 -
\??\c:\xrxxrlr.exec:\xrxxrlr.exe203⤵PID:2244
-
\??\c:\nnbtbb.exec:\nnbtbb.exe204⤵
- System Location Discovery: System Language Discovery
PID:3776 -
\??\c:\ffxxrxx.exec:\ffxxrxx.exe205⤵PID:4972
-
\??\c:\1bnbbh.exec:\1bnbbh.exe206⤵PID:4092
-
\??\c:\pvdvd.exec:\pvdvd.exe207⤵PID:3484
-
\??\c:\rfxfrlr.exec:\rfxfrlr.exe208⤵PID:4160
-
\??\c:\httnnt.exec:\httnnt.exe209⤵PID:2732
-
\??\c:\rxxllxr.exec:\rxxllxr.exe210⤵PID:3084
-
\??\c:\5xfxxlr.exec:\5xfxxlr.exe211⤵PID:3296
-
\??\c:\ddppd.exec:\ddppd.exe212⤵PID:840
-
\??\c:\7nnnhh.exec:\7nnnhh.exe213⤵PID:3588
-
\??\c:\dvvvp.exec:\dvvvp.exe214⤵PID:2496
-
\??\c:\5hthnb.exec:\5hthnb.exe215⤵PID:2300
-
\??\c:\lrrfxfl.exec:\lrrfxfl.exe216⤵
- System Location Discovery: System Language Discovery
PID:4392 -
\??\c:\vvvvv.exec:\vvvvv.exe217⤵PID:4636
-
\??\c:\hhbbbt.exec:\hhbbbt.exe218⤵PID:4908
-
\??\c:\vpjpd.exec:\vpjpd.exe219⤵
- System Location Discovery: System Language Discovery
PID:3196 -
\??\c:\ntntnb.exec:\ntntnb.exe220⤵PID:428
-
\??\c:\frlffrl.exec:\frlffrl.exe221⤵PID:2512
-
\??\c:\ttbbht.exec:\ttbbht.exe222⤵PID:4640
-
\??\c:\pdvvj.exec:\pdvvj.exe223⤵PID:4652
-
\??\c:\nnbthh.exec:\nnbthh.exe224⤵PID:1540
-
\??\c:\pddpv.exec:\pddpv.exe225⤵PID:2836
-
\??\c:\nnhtbt.exec:\nnhtbt.exe226⤵PID:3400
-
\??\c:\djppp.exec:\djppp.exe227⤵
- System Location Discovery: System Language Discovery
PID:1908 -
\??\c:\thtbbb.exec:\thtbbb.exe228⤵PID:3540
-
\??\c:\xlxxllx.exec:\xlxxllx.exe229⤵PID:1008
-
\??\c:\htbnbn.exec:\htbnbn.exe230⤵PID:3720
-
\??\c:\hhtbbb.exec:\hhtbbb.exe231⤵PID:3208
-
\??\c:\rfxfrfr.exec:\rfxfrfr.exe232⤵PID:2980
-
\??\c:\pppdj.exec:\pppdj.exe233⤵PID:3224
-
\??\c:\bhthbb.exec:\bhthbb.exe234⤵PID:1452
-
\??\c:\rxxfflf.exec:\rxxfflf.exe235⤵PID:640
-
\??\c:\bhtbnb.exec:\bhtbnb.exe236⤵PID:5004
-
\??\c:\rxfrrrr.exec:\rxfrrrr.exe237⤵PID:2204
-
\??\c:\vvdvj.exec:\vvdvj.exe238⤵PID:548
-
\??\c:\lfrfffx.exec:\lfrfffx.exe239⤵PID:4064
-
\??\c:\5hbtht.exec:\5hbtht.exe240⤵PID:4084
-
\??\c:\pjvpd.exec:\pjvpd.exe241⤵PID:2796
-
\??\c:\xxfflrr.exec:\xxfflrr.exe242⤵PID:3528