Analysis
-
max time kernel
150s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 20:50
Behavioral task
behavioral1
Sample
406aa985efb3a630109d6274a4f64f957988ad874e2d816af0405e31a05c27af.exe
Resource
win7-20240419-en
6 signatures
150 seconds
General
-
Target
406aa985efb3a630109d6274a4f64f957988ad874e2d816af0405e31a05c27af.exe
-
Size
158KB
-
MD5
fe4afb4103b3bcb481ada6ea0ce5bd08
-
SHA1
028e2d6929de4db61b7cf3b66eac283e23b76c94
-
SHA256
406aa985efb3a630109d6274a4f64f957988ad874e2d816af0405e31a05c27af
-
SHA512
492e98be0c46f52e0977c31e7fd191cf63ef05f201ef0abcc9f187f4ef977e9a66f1abcda333478c8826b9768a306f8fbd73ca014c021ceeeee147d6ce946056
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH4oGPwJwJE21rn:kcm4FmowdHoSphraHcpOFltH4oGPjJEY
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2372-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1224-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/376-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3096-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1552-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3084-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2424-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2192-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4240-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3660-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4588-537-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-588-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-578-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-596-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1016-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4100-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3748-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1680-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2592-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1228-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3832-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2600-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1000-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1704-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3764-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3532-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1900-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4156-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3804-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4240-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4172-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3132-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3052-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-619-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3308-625-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2372-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xflrxxf.exe UPX behavioral2/memory/2372-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\3ntttb.exe UPX behavioral2/memory/1224-11-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/376-16-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\htbhnn.exe UPX C:\dvjjp.exe UPX behavioral2/memory/2876-22-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3096-28-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\rrrrlrr.exe UPX \??\c:\tnttbb.exe UPX behavioral2/memory/1552-42-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3084-53-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\ddjjp.exe UPX C:\llrrrff.exe UPX behavioral2/memory/3084-59-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\httbbb.exe UPX \??\c:\vvddj.exe UPX \??\c:\rrxffrx.exe UPX behavioral2/memory/2868-90-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2424-87-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\vvjjj.exe UPX behavioral2/memory/4656-99-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\hbbbnn.exe UPX \??\c:\ddjjj.exe UPX \??\c:\xfrrrxx.exe UPX \??\c:\hhhhhn.exe UPX \??\c:\vvvdd.exe UPX behavioral2/memory/4728-173-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\lxxxfff.exe UPX behavioral2/memory/2192-184-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1900-209-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/624-222-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2408-227-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2452-297-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/976-336-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4936-344-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4240-366-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3660-377-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4148-431-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4588-537-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4584-556-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1612-588-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3380-578-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3012-596-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3012-592-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3392-530-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4492-493-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1016-453-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4100-437-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3748-429-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4304-416-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1680-415-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3296-408-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3696-405-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2592-397-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4932-387-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1228-367-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2872-343-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3832-329-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4784-322-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3276-319-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2600-314-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
xflrxxf.exe3ntttb.exehtbhnn.exedvjjp.exelrxfxfl.exerrrrlrr.exetnttbb.exehbhhhn.exeddjjp.exellrrrff.exetnnnnn.exehttbbb.exeddjjj.exevvddj.exerrxffrx.exehnttbt.exevvjjj.exefflfrll.exerrrrlll.exehbbbnn.exebbnttt.exeddjjj.exejpddd.exexfrrrxx.exennnnnt.exehhhhhn.exepjjpp.exeddjjj.exevvvdd.exelxxxfff.exebbntbh.exettttnn.exedpjjj.exeppdjj.exelxrrrrr.exenhnnnt.exettbbhn.exedpddj.exevjppp.exelrxlrxf.exe9lrrlxr.exenbbhhb.exebthhbh.exepjppp.exe5pvvv.exexxfffll.exefrrrrrl.exe3bbhhn.exebtttnt.exe3tbbtt.exe5dppv.exe1pvvv.exelllffll.exelllfllx.exe3nntbb.exenhttnn.exedpvvv.exevpjpp.exexfxxxxr.exe3rxfflf.exebtbnnh.exebnthbt.exe5pdvv.exevpddd.exepid process 1224 xflrxxf.exe 376 3ntttb.exe 2876 htbhnn.exe 3096 dvjjp.exe 1804 lrxfxfl.exe 4820 rrrrlrr.exe 1552 tnttbb.exe 2496 hbhhhn.exe 3084 ddjjp.exe 3052 llrrrff.exe 3132 tnnnnn.exe 4484 httbbb.exe 4372 ddjjj.exe 2424 vvddj.exe 2868 rrxffrx.exe 4656 hnttbt.exe 4792 vvjjj.exe 3236 fflfrll.exe 1064 rrrrlll.exe 3976 hbbbnn.exe 4172 bbnttt.exe 4476 ddjjj.exe 2856 jpddd.exe 4240 xfrrrxx.exe 1328 nnnnnt.exe 2360 hhhhhn.exe 3328 pjjpp.exe 3804 ddjjj.exe 4728 vvvdd.exe 3128 lxxxfff.exe 2192 bbntbh.exe 3464 ttttnn.exe 4156 dpjjj.exe 3004 ppdjj.exe 2704 lxrrrrr.exe 4304 nhnnnt.exe 4460 ttbbhn.exe 3572 dpddj.exe 1900 vjppp.exe 4044 lrxlrxf.exe 3520 9lrrlxr.exe 624 nbbhhb.exe 2008 bthhbh.exe 2408 pjppp.exe 1608 5pvvv.exe 1480 xxfffll.exe 2808 frrrrrl.exe 4956 3bbhhn.exe 4988 btttnt.exe 3168 3tbbtt.exe 808 5dppv.exe 4644 1pvvv.exe 4612 lllffll.exe 4952 lllfllx.exe 3532 3nntbb.exe 2336 nhttnn.exe 4848 dpvvv.exe 4092 vpjpp.exe 3764 xfxxxxr.exe 1704 3rxfflf.exe 2272 btbnnh.exe 3300 bnthbt.exe 2452 5pdvv.exe 1032 vpddd.exe -
Processes:
resource yara_rule behavioral2/memory/2372-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xflrxxf.exe upx behavioral2/memory/2372-6-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3ntttb.exe upx behavioral2/memory/1224-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/376-16-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htbhnn.exe upx C:\dvjjp.exe upx behavioral2/memory/2876-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3096-28-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rrrrlrr.exe upx \??\c:\tnttbb.exe upx behavioral2/memory/1552-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3084-53-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ddjjp.exe upx C:\llrrrff.exe upx behavioral2/memory/3084-59-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\httbbb.exe upx \??\c:\vvddj.exe upx \??\c:\rrxffrx.exe upx behavioral2/memory/2868-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2424-87-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vvjjj.exe upx behavioral2/memory/4656-99-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hbbbnn.exe upx \??\c:\ddjjj.exe upx \??\c:\xfrrrxx.exe upx \??\c:\hhhhhn.exe upx \??\c:\vvvdd.exe upx behavioral2/memory/4728-173-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lxxxfff.exe upx behavioral2/memory/2192-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1900-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/624-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2408-227-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2452-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/976-336-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4936-344-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4240-366-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3660-377-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4148-431-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4588-537-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4584-556-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1612-588-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3380-578-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3012-596-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3012-592-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3392-530-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4492-493-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1016-453-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4100-437-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3748-429-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4304-416-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1680-415-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3296-408-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3696-405-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2592-397-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4932-387-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1228-367-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2872-343-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3832-329-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4784-322-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3276-319-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2600-314-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
406aa985efb3a630109d6274a4f64f957988ad874e2d816af0405e31a05c27af.exexflrxxf.exe3ntttb.exehtbhnn.exedvjjp.exelrxfxfl.exerrrrlrr.exetnttbb.exehbhhhn.exeddjjp.exellrrrff.exetnnnnn.exehttbbb.exeddjjj.exevvddj.exerrxffrx.exehnttbt.exevvjjj.exefflfrll.exerrrrlll.exehbbbnn.exebbnttt.exedescription pid process target process PID 2372 wrote to memory of 1224 2372 406aa985efb3a630109d6274a4f64f957988ad874e2d816af0405e31a05c27af.exe xflrxxf.exe PID 2372 wrote to memory of 1224 2372 406aa985efb3a630109d6274a4f64f957988ad874e2d816af0405e31a05c27af.exe xflrxxf.exe PID 2372 wrote to memory of 1224 2372 406aa985efb3a630109d6274a4f64f957988ad874e2d816af0405e31a05c27af.exe xflrxxf.exe PID 1224 wrote to memory of 376 1224 xflrxxf.exe 3ntttb.exe PID 1224 wrote to memory of 376 1224 xflrxxf.exe 3ntttb.exe PID 1224 wrote to memory of 376 1224 xflrxxf.exe 3ntttb.exe PID 376 wrote to memory of 2876 376 3ntttb.exe htbhnn.exe PID 376 wrote to memory of 2876 376 3ntttb.exe htbhnn.exe PID 376 wrote to memory of 2876 376 3ntttb.exe htbhnn.exe PID 2876 wrote to memory of 3096 2876 htbhnn.exe dvjjp.exe PID 2876 wrote to memory of 3096 2876 htbhnn.exe dvjjp.exe PID 2876 wrote to memory of 3096 2876 htbhnn.exe dvjjp.exe PID 3096 wrote to memory of 1804 3096 dvjjp.exe lrxfxfl.exe PID 3096 wrote to memory of 1804 3096 dvjjp.exe lrxfxfl.exe PID 3096 wrote to memory of 1804 3096 dvjjp.exe lrxfxfl.exe PID 1804 wrote to memory of 4820 1804 lrxfxfl.exe rrrrlrr.exe PID 1804 wrote to memory of 4820 1804 lrxfxfl.exe rrrrlrr.exe PID 1804 wrote to memory of 4820 1804 lrxfxfl.exe rrrrlrr.exe PID 4820 wrote to memory of 1552 4820 rrrrlrr.exe tthbhn.exe PID 4820 wrote to memory of 1552 4820 rrrrlrr.exe tthbhn.exe PID 4820 wrote to memory of 1552 4820 rrrrlrr.exe tthbhn.exe PID 1552 wrote to memory of 2496 1552 tnttbb.exe hbhhhn.exe PID 1552 wrote to memory of 2496 1552 tnttbb.exe hbhhhn.exe PID 1552 wrote to memory of 2496 1552 tnttbb.exe hbhhhn.exe PID 2496 wrote to memory of 3084 2496 hbhhhn.exe ddjjp.exe PID 2496 wrote to memory of 3084 2496 hbhhhn.exe ddjjp.exe PID 2496 wrote to memory of 3084 2496 hbhhhn.exe ddjjp.exe PID 3084 wrote to memory of 3052 3084 ddjjp.exe llrrrff.exe PID 3084 wrote to memory of 3052 3084 ddjjp.exe llrrrff.exe PID 3084 wrote to memory of 3052 3084 ddjjp.exe llrrrff.exe PID 3052 wrote to memory of 3132 3052 llrrrff.exe tnnnnn.exe PID 3052 wrote to memory of 3132 3052 llrrrff.exe tnnnnn.exe PID 3052 wrote to memory of 3132 3052 llrrrff.exe tnnnnn.exe PID 3132 wrote to memory of 4484 3132 tnnnnn.exe httbbb.exe PID 3132 wrote to memory of 4484 3132 tnnnnn.exe httbbb.exe PID 3132 wrote to memory of 4484 3132 tnnnnn.exe httbbb.exe PID 4484 wrote to memory of 4372 4484 httbbb.exe ddjjj.exe PID 4484 wrote to memory of 4372 4484 httbbb.exe ddjjj.exe PID 4484 wrote to memory of 4372 4484 httbbb.exe ddjjj.exe PID 4372 wrote to memory of 2424 4372 ddjjj.exe vvddj.exe PID 4372 wrote to memory of 2424 4372 ddjjj.exe vvddj.exe PID 4372 wrote to memory of 2424 4372 ddjjj.exe vvddj.exe PID 2424 wrote to memory of 2868 2424 vvddj.exe rrxffrx.exe PID 2424 wrote to memory of 2868 2424 vvddj.exe rrxffrx.exe PID 2424 wrote to memory of 2868 2424 vvddj.exe rrxffrx.exe PID 2868 wrote to memory of 4656 2868 rrxffrx.exe hnttbt.exe PID 2868 wrote to memory of 4656 2868 rrxffrx.exe hnttbt.exe PID 2868 wrote to memory of 4656 2868 rrxffrx.exe hnttbt.exe PID 4656 wrote to memory of 4792 4656 hnttbt.exe vvjjj.exe PID 4656 wrote to memory of 4792 4656 hnttbt.exe vvjjj.exe PID 4656 wrote to memory of 4792 4656 hnttbt.exe vvjjj.exe PID 4792 wrote to memory of 3236 4792 vvjjj.exe fflfrll.exe PID 4792 wrote to memory of 3236 4792 vvjjj.exe fflfrll.exe PID 4792 wrote to memory of 3236 4792 vvjjj.exe fflfrll.exe PID 3236 wrote to memory of 1064 3236 fflfrll.exe rrrrlll.exe PID 3236 wrote to memory of 1064 3236 fflfrll.exe rrrrlll.exe PID 3236 wrote to memory of 1064 3236 fflfrll.exe rrrrlll.exe PID 1064 wrote to memory of 3976 1064 rrrrlll.exe hbbbnn.exe PID 1064 wrote to memory of 3976 1064 rrrrlll.exe hbbbnn.exe PID 1064 wrote to memory of 3976 1064 rrrrlll.exe hbbbnn.exe PID 3976 wrote to memory of 4172 3976 hbbbnn.exe bbnttt.exe PID 3976 wrote to memory of 4172 3976 hbbbnn.exe bbnttt.exe PID 3976 wrote to memory of 4172 3976 hbbbnn.exe bbnttt.exe PID 4172 wrote to memory of 4476 4172 bbnttt.exe ddjjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\406aa985efb3a630109d6274a4f64f957988ad874e2d816af0405e31a05c27af.exe"C:\Users\Admin\AppData\Local\Temp\406aa985efb3a630109d6274a4f64f957988ad874e2d816af0405e31a05c27af.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\xflrxxf.exec:\xflrxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3ntttb.exec:\3ntttb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htbhnn.exec:\htbhnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvjjp.exec:\dvjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrxfxfl.exec:\lrxfxfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrrrlrr.exec:\rrrrlrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnttbb.exec:\tnttbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhhhn.exec:\hbhhhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddjjp.exec:\ddjjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llrrrff.exec:\llrrrff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnnnnn.exec:\tnnnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\httbbb.exec:\httbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddjjj.exec:\ddjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvddj.exec:\vvddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrxffrx.exec:\rrxffrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnttbt.exec:\hnttbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvjjj.exec:\vvjjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fflfrll.exec:\fflfrll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrrrlll.exec:\rrrrlll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbbbnn.exec:\hbbbnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbnttt.exec:\bbnttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddjjj.exec:\ddjjj.exe23⤵
- Executes dropped EXE
-
\??\c:\jpddd.exec:\jpddd.exe24⤵
- Executes dropped EXE
-
\??\c:\xfrrrxx.exec:\xfrrrxx.exe25⤵
- Executes dropped EXE
-
\??\c:\nnnnnt.exec:\nnnnnt.exe26⤵
- Executes dropped EXE
-
\??\c:\hhhhhn.exec:\hhhhhn.exe27⤵
- Executes dropped EXE
-
\??\c:\pjjpp.exec:\pjjpp.exe28⤵
- Executes dropped EXE
-
\??\c:\ddjjj.exec:\ddjjj.exe29⤵
- Executes dropped EXE
-
\??\c:\vvvdd.exec:\vvvdd.exe30⤵
- Executes dropped EXE
-
\??\c:\lxxxfff.exec:\lxxxfff.exe31⤵
- Executes dropped EXE
-
\??\c:\bbntbh.exec:\bbntbh.exe32⤵
- Executes dropped EXE
-
\??\c:\ttttnn.exec:\ttttnn.exe33⤵
- Executes dropped EXE
-
\??\c:\dpjjj.exec:\dpjjj.exe34⤵
- Executes dropped EXE
-
\??\c:\ppdjj.exec:\ppdjj.exe35⤵
- Executes dropped EXE
-
\??\c:\lxrrrrr.exec:\lxrrrrr.exe36⤵
- Executes dropped EXE
-
\??\c:\nhnnnt.exec:\nhnnnt.exe37⤵
- Executes dropped EXE
-
\??\c:\ttbbhn.exec:\ttbbhn.exe38⤵
- Executes dropped EXE
-
\??\c:\dpddj.exec:\dpddj.exe39⤵
- Executes dropped EXE
-
\??\c:\vjppp.exec:\vjppp.exe40⤵
- Executes dropped EXE
-
\??\c:\lrxlrxf.exec:\lrxlrxf.exe41⤵
- Executes dropped EXE
-
\??\c:\9lrrlxr.exec:\9lrrlxr.exe42⤵
- Executes dropped EXE
-
\??\c:\nbbhhb.exec:\nbbhhb.exe43⤵
- Executes dropped EXE
-
\??\c:\bthhbh.exec:\bthhbh.exe44⤵
- Executes dropped EXE
-
\??\c:\pjppp.exec:\pjppp.exe45⤵
- Executes dropped EXE
-
\??\c:\5pvvv.exec:\5pvvv.exe46⤵
- Executes dropped EXE
-
\??\c:\xxfffll.exec:\xxfffll.exe47⤵
- Executes dropped EXE
-
\??\c:\frrrrrl.exec:\frrrrrl.exe48⤵
- Executes dropped EXE
-
\??\c:\3bbhhn.exec:\3bbhhn.exe49⤵
- Executes dropped EXE
-
\??\c:\btttnt.exec:\btttnt.exe50⤵
- Executes dropped EXE
-
\??\c:\3tbbtt.exec:\3tbbtt.exe51⤵
- Executes dropped EXE
-
\??\c:\5dppv.exec:\5dppv.exe52⤵
- Executes dropped EXE
-
\??\c:\1pvvv.exec:\1pvvv.exe53⤵
- Executes dropped EXE
-
\??\c:\lllffll.exec:\lllffll.exe54⤵
- Executes dropped EXE
-
\??\c:\lllfllx.exec:\lllfllx.exe55⤵
- Executes dropped EXE
-
\??\c:\3nntbb.exec:\3nntbb.exe56⤵
- Executes dropped EXE
-
\??\c:\nhttnn.exec:\nhttnn.exe57⤵
- Executes dropped EXE
-
\??\c:\dpvvv.exec:\dpvvv.exe58⤵
- Executes dropped EXE
-
\??\c:\vpjpp.exec:\vpjpp.exe59⤵
- Executes dropped EXE
-
\??\c:\xfxxxxr.exec:\xfxxxxr.exe60⤵
- Executes dropped EXE
-
\??\c:\3rxfflf.exec:\3rxfflf.exe61⤵
- Executes dropped EXE
-
\??\c:\btbnnh.exec:\btbnnh.exe62⤵
- Executes dropped EXE
-
\??\c:\bnthbt.exec:\bnthbt.exe63⤵
- Executes dropped EXE
-
\??\c:\5pdvv.exec:\5pdvv.exe64⤵
- Executes dropped EXE
-
\??\c:\vpddd.exec:\vpddd.exe65⤵
- Executes dropped EXE
-
\??\c:\rrllrxr.exec:\rrllrxr.exe66⤵
-
\??\c:\rlxfxxr.exec:\rlxfxxr.exe67⤵
-
\??\c:\llfllll.exec:\llfllll.exe68⤵
-
\??\c:\hhnttt.exec:\hhnttt.exe69⤵
-
\??\c:\9jvvp.exec:\9jvvp.exe70⤵
-
\??\c:\ddjpv.exec:\ddjpv.exe71⤵
-
\??\c:\vpdjj.exec:\vpdjj.exe72⤵
-
\??\c:\rxxflrr.exec:\rxxflrr.exe73⤵
-
\??\c:\lxfllrr.exec:\lxfllrr.exe74⤵
-
\??\c:\tttttb.exec:\tttttb.exe75⤵
-
\??\c:\hbnnnt.exec:\hbnnnt.exe76⤵
-
\??\c:\pjvvd.exec:\pjvvd.exe77⤵
-
\??\c:\pvvjp.exec:\pvvjp.exe78⤵
-
\??\c:\frrrlrr.exec:\frrrlrr.exe79⤵
-
\??\c:\lfrrfff.exec:\lfrrfff.exe80⤵
-
\??\c:\5rrllll.exec:\5rrllll.exe81⤵
-
\??\c:\bbbtbt.exec:\bbbtbt.exe82⤵
-
\??\c:\vvvpp.exec:\vvvpp.exe83⤵
-
\??\c:\pdjpj.exec:\pdjpj.exe84⤵
-
\??\c:\lllrrrr.exec:\lllrrrr.exe85⤵
-
\??\c:\rrffffl.exec:\rrffffl.exe86⤵
-
\??\c:\5hbbnt.exec:\5hbbnt.exe87⤵
-
\??\c:\nthhbb.exec:\nthhbb.exe88⤵
-
\??\c:\ddppv.exec:\ddppv.exe89⤵
-
\??\c:\ppppj.exec:\ppppj.exe90⤵
-
\??\c:\xrffllx.exec:\xrffllx.exe91⤵
-
\??\c:\lxlfffx.exec:\lxlfffx.exe92⤵
-
\??\c:\xrflrxf.exec:\xrflrxf.exe93⤵
-
\??\c:\hhnbtb.exec:\hhnbtb.exe94⤵
-
\??\c:\nthhth.exec:\nthhth.exe95⤵
-
\??\c:\9jppp.exec:\9jppp.exe96⤵
-
\??\c:\ppddd.exec:\ppddd.exe97⤵
-
\??\c:\flxxrxl.exec:\flxxrxl.exe98⤵
-
\??\c:\xrffrxf.exec:\xrffrxf.exe99⤵
-
\??\c:\bbttnn.exec:\bbttnn.exe100⤵
-
\??\c:\bbbbbb.exec:\bbbbbb.exe101⤵
-
\??\c:\vdpjj.exec:\vdpjj.exe102⤵
-
\??\c:\vvddd.exec:\vvddd.exe103⤵
-
\??\c:\ffrflrf.exec:\ffrflrf.exe104⤵
-
\??\c:\3lxfflr.exec:\3lxfflr.exe105⤵
-
\??\c:\bhnttb.exec:\bhnttb.exe106⤵
-
\??\c:\hhnhhn.exec:\hhnhhn.exe107⤵
-
\??\c:\jjppj.exec:\jjppj.exe108⤵
-
\??\c:\jpvdv.exec:\jpvdv.exe109⤵
-
\??\c:\3vvdd.exec:\3vvdd.exe110⤵
-
\??\c:\xxrllrx.exec:\xxrllrx.exe111⤵
-
\??\c:\fxrxxxl.exec:\fxrxxxl.exe112⤵
-
\??\c:\nhbbbb.exec:\nhbbbb.exe113⤵
-
\??\c:\nnnnnb.exec:\nnnnnb.exe114⤵
-
\??\c:\vvjpj.exec:\vvjpj.exe115⤵
-
\??\c:\1dpjj.exec:\1dpjj.exe116⤵
-
\??\c:\dvddd.exec:\dvddd.exe117⤵
-
\??\c:\xxrllxl.exec:\xxrllxl.exe118⤵
-
\??\c:\lfrrxfx.exec:\lfrrxfx.exe119⤵
-
\??\c:\hhbhtb.exec:\hhbhtb.exe120⤵
-
\??\c:\5bbbtb.exec:\5bbbtb.exe121⤵
-
\??\c:\vvdvp.exec:\vvdvp.exe122⤵
-
\??\c:\vpvvv.exec:\vpvvv.exe123⤵
-
\??\c:\jpvvp.exec:\jpvvp.exe124⤵
-
\??\c:\tthbhn.exec:\tthbhn.exe125⤵
-
\??\c:\dpdjp.exec:\dpdjp.exe126⤵
-
\??\c:\ddjvp.exec:\ddjvp.exe127⤵
-
\??\c:\llrrrxx.exec:\llrrrxx.exe128⤵
-
\??\c:\xxxlxlx.exec:\xxxlxlx.exe129⤵
-
\??\c:\ttnthn.exec:\ttnthn.exe130⤵
-
\??\c:\hbbbbh.exec:\hbbbbh.exe131⤵
-
\??\c:\djvjv.exec:\djvjv.exe132⤵
-
\??\c:\vdjjp.exec:\vdjjp.exe133⤵
-
\??\c:\jdvdd.exec:\jdvdd.exe134⤵
-
\??\c:\5lfflrf.exec:\5lfflrf.exe135⤵
-
\??\c:\3lfrxfl.exec:\3lfrxfl.exe136⤵
-
\??\c:\bnbbth.exec:\bnbbth.exe137⤵
-
\??\c:\tnnhbb.exec:\tnnhbb.exe138⤵
-
\??\c:\djpvj.exec:\djpvj.exe139⤵
-
\??\c:\pjppd.exec:\pjppd.exe140⤵
-
\??\c:\lxlxxlf.exec:\lxlxxlf.exe141⤵
-
\??\c:\5xxxxll.exec:\5xxxxll.exe142⤵
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe143⤵
-
\??\c:\bhhhhh.exec:\bhhhhh.exe144⤵
-
\??\c:\hbnhht.exec:\hbnhht.exe145⤵
-
\??\c:\pjjjj.exec:\pjjjj.exe146⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe147⤵
-
\??\c:\dvjdj.exec:\dvjdj.exe148⤵
-
\??\c:\rxrllll.exec:\rxrllll.exe149⤵
-
\??\c:\frxrrrr.exec:\frxrrrr.exe150⤵
-
\??\c:\btbbbb.exec:\btbbbb.exe151⤵
-
\??\c:\nnnnhn.exec:\nnnnhn.exe152⤵
-
\??\c:\vvppp.exec:\vvppp.exe153⤵
-
\??\c:\vjvdv.exec:\vjvdv.exe154⤵
-
\??\c:\ppddv.exec:\ppddv.exe155⤵
-
\??\c:\9xxlxrf.exec:\9xxlxrf.exe156⤵
-
\??\c:\rrlxlff.exec:\rrlxlff.exe157⤵
-
\??\c:\bbhhtt.exec:\bbhhtt.exe158⤵
-
\??\c:\tnbtth.exec:\tnbtth.exe159⤵
-
\??\c:\pvjdd.exec:\pvjdd.exe160⤵
-
\??\c:\jjjdp.exec:\jjjdp.exe161⤵
-
\??\c:\ffxllff.exec:\ffxllff.exe162⤵
-
\??\c:\5tbttn.exec:\5tbttn.exe163⤵
-
\??\c:\vvjjv.exec:\vvjjv.exe164⤵
-
\??\c:\pjjdd.exec:\pjjdd.exe165⤵
-
\??\c:\llfffll.exec:\llfffll.exe166⤵
-
\??\c:\frxrxlr.exec:\frxrxlr.exe167⤵
-
\??\c:\tbnnnt.exec:\tbnnnt.exe168⤵
-
\??\c:\bntbtn.exec:\bntbtn.exe169⤵
-
\??\c:\ddjjd.exec:\ddjjd.exe170⤵
-
\??\c:\pvddv.exec:\pvddv.exe171⤵
-
\??\c:\lfxxrxx.exec:\lfxxrxx.exe172⤵
-
\??\c:\lflfxxf.exec:\lflfxxf.exe173⤵
-
\??\c:\bhhhtt.exec:\bhhhtt.exe174⤵
-
\??\c:\nhnntn.exec:\nhnntn.exe175⤵
-
\??\c:\dvdjj.exec:\dvdjj.exe176⤵
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe177⤵
-
\??\c:\nhtnnn.exec:\nhtnnn.exe178⤵
-
\??\c:\5pvpd.exec:\5pvpd.exe179⤵
-
\??\c:\vjppj.exec:\vjppj.exe180⤵
-
\??\c:\frfxfff.exec:\frfxfff.exe181⤵
-
\??\c:\xlffxxr.exec:\xlffxxr.exe182⤵
-
\??\c:\htbnbt.exec:\htbnbt.exe183⤵
-
\??\c:\jppdd.exec:\jppdd.exe184⤵
-
\??\c:\5vppp.exec:\5vppp.exe185⤵
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe186⤵
-
\??\c:\llrxrfx.exec:\llrxrfx.exe187⤵
-
\??\c:\jdjdp.exec:\jdjdp.exe188⤵
-
\??\c:\5jddj.exec:\5jddj.exe189⤵
-
\??\c:\lrrxrfx.exec:\lrrxrfx.exe190⤵
-
\??\c:\tthnnh.exec:\tthnnh.exe191⤵
-
\??\c:\dvdjd.exec:\dvdjd.exe192⤵
-
\??\c:\rfxlfxf.exec:\rfxlfxf.exe193⤵
-
\??\c:\bnhbnn.exec:\bnhbnn.exe194⤵
-
\??\c:\dvjvp.exec:\dvjvp.exe195⤵
-
\??\c:\vvdvj.exec:\vvdvj.exe196⤵
-
\??\c:\fxxllfx.exec:\fxxllfx.exe197⤵
-
\??\c:\bbnbtn.exec:\bbnbtn.exe198⤵
-
\??\c:\vvjdd.exec:\vvjdd.exe199⤵
-
\??\c:\lrlrrrr.exec:\lrlrrrr.exe200⤵
-
\??\c:\dpjdd.exec:\dpjdd.exe201⤵
-
\??\c:\djjvp.exec:\djjvp.exe202⤵
-
\??\c:\llfxxlf.exec:\llfxxlf.exe203⤵
-
\??\c:\hbhnnn.exec:\hbhnnn.exe204⤵
-
\??\c:\ppvpd.exec:\ppvpd.exe205⤵
-
\??\c:\flxxlrx.exec:\flxxlrx.exe206⤵
-
\??\c:\btbbbb.exec:\btbbbb.exe207⤵
-
\??\c:\vdpjj.exec:\vdpjj.exe208⤵
-
\??\c:\xrrfrrx.exec:\xrrfrrx.exe209⤵
-
\??\c:\nnbnbh.exec:\nnbnbh.exe210⤵
-
\??\c:\hhtttt.exec:\hhtttt.exe211⤵
-
\??\c:\jpppd.exec:\jpppd.exe212⤵
-
\??\c:\pdvvp.exec:\pdvvp.exe213⤵
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe214⤵
-
\??\c:\5nbnhb.exec:\5nbnhb.exe215⤵
-
\??\c:\vjpjp.exec:\vjpjp.exe216⤵
-
\??\c:\1lxxxxr.exec:\1lxxxxr.exe217⤵
-
\??\c:\hbbtnn.exec:\hbbtnn.exe218⤵
-
\??\c:\vddpd.exec:\vddpd.exe219⤵
-
\??\c:\fxrlflf.exec:\fxrlflf.exe220⤵
-
\??\c:\bhbntt.exec:\bhbntt.exe221⤵
-
\??\c:\dvjjv.exec:\dvjjv.exe222⤵
-
\??\c:\xffllxr.exec:\xffllxr.exe223⤵
-
\??\c:\rrrxffl.exec:\rrrxffl.exe224⤵
-
\??\c:\1ttnbh.exec:\1ttnbh.exe225⤵
-
\??\c:\djdvp.exec:\djdvp.exe226⤵
-
\??\c:\hhbbtt.exec:\hhbbtt.exe227⤵
-
\??\c:\ddpvd.exec:\ddpvd.exe228⤵
-
\??\c:\lrrrrlr.exec:\lrrrrlr.exe229⤵
-
\??\c:\bnnnhn.exec:\bnnnhn.exe230⤵
-
\??\c:\hbtnbb.exec:\hbtnbb.exe231⤵
-
\??\c:\9jpjj.exec:\9jpjj.exe232⤵
-
\??\c:\5xfffrx.exec:\5xfffrx.exe233⤵
-
\??\c:\nntntn.exec:\nntntn.exe234⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe235⤵
-
\??\c:\rlllfxr.exec:\rlllfxr.exe236⤵
-
\??\c:\bhtbbh.exec:\bhtbbh.exe237⤵
-
\??\c:\ddjjj.exec:\ddjjj.exe238⤵
-
\??\c:\ffllffx.exec:\ffllffx.exe239⤵
-
\??\c:\tthhnt.exec:\tthhnt.exe240⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe241⤵