Analysis
-
max time kernel
150s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 01:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ba7ff6682de900e07c6420974c5292fece15f469af4b19b2d3c90e06a7052d98.exe
Resource
win7-20240419-en
4 signatures
150 seconds
General
-
Target
ba7ff6682de900e07c6420974c5292fece15f469af4b19b2d3c90e06a7052d98.exe
-
Size
450KB
-
MD5
c0be1ba073c5841e4b909dd677667910
-
SHA1
61a324cbd418467b8be2eed93e0485af5d6acb22
-
SHA256
ba7ff6682de900e07c6420974c5292fece15f469af4b19b2d3c90e06a7052d98
-
SHA512
ca43cacb0603890f0b304fad82225c4e56cdb3aa5189815add8632af67a225c5ab721758095358c14659e6a40e77d1e4be06f3361c1446ddef2490042e726329
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbex:q7Tc2NYHUrAwfMp3CDx
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
Processes:
resource yara_rule behavioral2/memory/5068-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2812-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/732-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1084-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3420-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/520-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1088-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/312-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1856-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1744-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2112-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-682-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-686-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-742-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-746-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-832-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-955-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-1074-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/5068-7-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2628-13-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2824-19-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4860-26-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2824-24-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/512-56-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4368-90-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4188-102-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3736-142-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2812-155-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2728-161-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2728-166-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4220-191-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1096-194-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/388-195-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/976-203-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3260-199-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/212-214-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1656-225-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2324-271-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3028-275-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3008-279-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2352-289-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4928-299-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3576-312-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/732-256-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4628-319-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1084-335-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2968-243-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1704-361-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1704-357-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3420-239-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4324-365-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1188-226-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/212-218-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4332-213-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/520-374-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/520-379-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3668-380-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2824-384-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1096-188-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2956-173-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3736-148-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4900-138-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3688-130-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4572-122-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4216-114-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3324-113-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/5096-81-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1088-79-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1088-73-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/312-72-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1624-54-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1856-43-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4092-37-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4004-32-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3996-412-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1744-6-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3872-419-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4988-420-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4228-430-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1664-434-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1892-444-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2500-490-0x0000000000400000-0x000000000042A000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
bbnbtb.exevjpdd.exelxlrflr.exentnbtn.exehntbnh.exevvjpd.exeflxrxxf.exetbbnnn.exe7dppd.exennhnth.exehbhbbh.exejpddd.exelxflfrl.exelxfflrr.exebntbnt.exethnnth.exeppjjj.exe1xxrflx.exenhnbbh.exepvpvj.exeffrxflr.exedjvdd.exeppjpp.exethnbhn.exejpdjp.exerfrrrfx.exettttnh.exedjvdd.exerxrxxxr.exentbtht.exelfrxfll.exejvpjv.exedjjdd.exebtnbnb.exejpvpj.exepjvvv.exexfxrxfl.exetbbbtb.exejpddd.exelfflxxr.exefxlfffl.exehhhbtn.exeddddd.exe1rfflrf.exebbtttt.exebntttb.exedvdpd.exefxlllrf.exerllxrxr.exe9tthhh.exejvppj.exerlrrrlr.exerllfxrl.exe9pddd.exe5pjpd.exelfrllll.exentthhh.exevdppv.exefrllfxx.exenhnnnt.exebhntbb.exevdjvv.exeflflxff.exebbhnnn.exepid process 5068 bbnbtb.exe 2628 vjpdd.exe 2824 lxlrflr.exe 4860 ntnbtn.exe 4004 hntbnh.exe 4092 vvjpd.exe 1856 flxrxxf.exe 512 tbbnnn.exe 1624 7dppd.exe 1812 nnhnth.exe 312 hbhbbh.exe 1088 jpddd.exe 5096 lxflfrl.exe 744 lxfflrr.exe 4368 bntbnt.exe 4188 thnnth.exe 2300 ppjjj.exe 3324 1xxrflx.exe 4216 nhnbbh.exe 4572 pvpvj.exe 1740 ffrxflr.exe 3688 djvdd.exe 4900 ppjpp.exe 3736 thnbhn.exe 2812 jpdjp.exe 2876 rfrrrfx.exe 2728 ttttnh.exe 2956 djvdd.exe 1708 rxrxxxr.exe 4124 ntbtht.exe 4220 lfrxfll.exe 1096 jvpjv.exe 388 djjdd.exe 3260 btnbnb.exe 976 jpvpj.exe 1012 pjvvv.exe 4332 xfxrxfl.exe 212 tbbbtb.exe 2944 jpddd.exe 1656 lfflxxr.exe 1188 fxlfffl.exe 4860 hhhbtn.exe 632 ddddd.exe 1332 1rfflrf.exe 3420 bbtttt.exe 2968 bntttb.exe 4784 dvdpd.exe 2468 fxlllrf.exe 1376 rllxrxr.exe 732 9tthhh.exe 3552 jvppj.exe 1660 rlrrrlr.exe 2188 rllfxrl.exe 2324 9pddd.exe 3028 5pjpd.exe 3540 lfrllll.exe 3008 ntthhh.exe 2380 vdppv.exe 2352 frllfxx.exe 2084 nhnnnt.exe 4920 bhntbb.exe 1880 vdjvv.exe 4928 flflxff.exe 2940 bbhnnn.exe -
Processes:
resource yara_rule behavioral2/memory/5068-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/732-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/520-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/520-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1088-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1088-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/312-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1856-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-497-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ba7ff6682de900e07c6420974c5292fece15f469af4b19b2d3c90e06a7052d98.exebbnbtb.exevjpdd.exelxlrflr.exentnbtn.exehntbnh.exevvjpd.exeflxrxxf.exetbbnnn.exe7dppd.exennhnth.exehbhbbh.exejpddd.exelxflfrl.exelxfflrr.exebntbnt.exethnnth.exeppjjj.exe1xxrflx.exenhnbbh.exepvpvj.exeffrxflr.exedescription pid process target process PID 1744 wrote to memory of 5068 1744 ba7ff6682de900e07c6420974c5292fece15f469af4b19b2d3c90e06a7052d98.exe bbnbtb.exe PID 1744 wrote to memory of 5068 1744 ba7ff6682de900e07c6420974c5292fece15f469af4b19b2d3c90e06a7052d98.exe bbnbtb.exe PID 1744 wrote to memory of 5068 1744 ba7ff6682de900e07c6420974c5292fece15f469af4b19b2d3c90e06a7052d98.exe bbnbtb.exe PID 5068 wrote to memory of 2628 5068 bbnbtb.exe vjpdd.exe PID 5068 wrote to memory of 2628 5068 bbnbtb.exe vjpdd.exe PID 5068 wrote to memory of 2628 5068 bbnbtb.exe vjpdd.exe PID 2628 wrote to memory of 2824 2628 vjpdd.exe lxlrflr.exe PID 2628 wrote to memory of 2824 2628 vjpdd.exe lxlrflr.exe PID 2628 wrote to memory of 2824 2628 vjpdd.exe lxlrflr.exe PID 2824 wrote to memory of 4860 2824 lxlrflr.exe hhhbtn.exe PID 2824 wrote to memory of 4860 2824 lxlrflr.exe hhhbtn.exe PID 2824 wrote to memory of 4860 2824 lxlrflr.exe hhhbtn.exe PID 4860 wrote to memory of 4004 4860 ntnbtn.exe hntbnh.exe PID 4860 wrote to memory of 4004 4860 ntnbtn.exe hntbnh.exe PID 4860 wrote to memory of 4004 4860 ntnbtn.exe hntbnh.exe PID 4004 wrote to memory of 4092 4004 hntbnh.exe vvjpd.exe PID 4004 wrote to memory of 4092 4004 hntbnh.exe vvjpd.exe PID 4004 wrote to memory of 4092 4004 hntbnh.exe vvjpd.exe PID 4092 wrote to memory of 1856 4092 vvjpd.exe flxrxxf.exe PID 4092 wrote to memory of 1856 4092 vvjpd.exe flxrxxf.exe PID 4092 wrote to memory of 1856 4092 vvjpd.exe flxrxxf.exe PID 1856 wrote to memory of 512 1856 flxrxxf.exe tbbnnn.exe PID 1856 wrote to memory of 512 1856 flxrxxf.exe tbbnnn.exe PID 1856 wrote to memory of 512 1856 flxrxxf.exe tbbnnn.exe PID 512 wrote to memory of 1624 512 tbbnnn.exe 7dppd.exe PID 512 wrote to memory of 1624 512 tbbnnn.exe 7dppd.exe PID 512 wrote to memory of 1624 512 tbbnnn.exe 7dppd.exe PID 1624 wrote to memory of 1812 1624 7dppd.exe nnhnth.exe PID 1624 wrote to memory of 1812 1624 7dppd.exe nnhnth.exe PID 1624 wrote to memory of 1812 1624 7dppd.exe nnhnth.exe PID 1812 wrote to memory of 312 1812 nnhnth.exe hbhbbh.exe PID 1812 wrote to memory of 312 1812 nnhnth.exe hbhbbh.exe PID 1812 wrote to memory of 312 1812 nnhnth.exe hbhbbh.exe PID 312 wrote to memory of 1088 312 hbhbbh.exe jpddd.exe PID 312 wrote to memory of 1088 312 hbhbbh.exe jpddd.exe PID 312 wrote to memory of 1088 312 hbhbbh.exe jpddd.exe PID 1088 wrote to memory of 5096 1088 jpddd.exe lxflfrl.exe PID 1088 wrote to memory of 5096 1088 jpddd.exe lxflfrl.exe PID 1088 wrote to memory of 5096 1088 jpddd.exe lxflfrl.exe PID 5096 wrote to memory of 744 5096 lxflfrl.exe lxfflrr.exe PID 5096 wrote to memory of 744 5096 lxflfrl.exe lxfflrr.exe PID 5096 wrote to memory of 744 5096 lxflfrl.exe lxfflrr.exe PID 744 wrote to memory of 4368 744 lxfflrr.exe bntbnt.exe PID 744 wrote to memory of 4368 744 lxfflrr.exe bntbnt.exe PID 744 wrote to memory of 4368 744 lxfflrr.exe bntbnt.exe PID 4368 wrote to memory of 4188 4368 bntbnt.exe thnnth.exe PID 4368 wrote to memory of 4188 4368 bntbnt.exe thnnth.exe PID 4368 wrote to memory of 4188 4368 bntbnt.exe thnnth.exe PID 4188 wrote to memory of 2300 4188 thnnth.exe ppjjj.exe PID 4188 wrote to memory of 2300 4188 thnnth.exe ppjjj.exe PID 4188 wrote to memory of 2300 4188 thnnth.exe ppjjj.exe PID 2300 wrote to memory of 3324 2300 ppjjj.exe 1xxrflx.exe PID 2300 wrote to memory of 3324 2300 ppjjj.exe 1xxrflx.exe PID 2300 wrote to memory of 3324 2300 ppjjj.exe 1xxrflx.exe PID 3324 wrote to memory of 4216 3324 1xxrflx.exe nhnbbh.exe PID 3324 wrote to memory of 4216 3324 1xxrflx.exe nhnbbh.exe PID 3324 wrote to memory of 4216 3324 1xxrflx.exe nhnbbh.exe PID 4216 wrote to memory of 4572 4216 nhnbbh.exe pvpvj.exe PID 4216 wrote to memory of 4572 4216 nhnbbh.exe pvpvj.exe PID 4216 wrote to memory of 4572 4216 nhnbbh.exe pvpvj.exe PID 4572 wrote to memory of 1740 4572 pvpvj.exe ffrxflr.exe PID 4572 wrote to memory of 1740 4572 pvpvj.exe ffrxflr.exe PID 4572 wrote to memory of 1740 4572 pvpvj.exe ffrxflr.exe PID 1740 wrote to memory of 3688 1740 ffrxflr.exe djvdd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba7ff6682de900e07c6420974c5292fece15f469af4b19b2d3c90e06a7052d98.exe"C:\Users\Admin\AppData\Local\Temp\ba7ff6682de900e07c6420974c5292fece15f469af4b19b2d3c90e06a7052d98.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\bbnbtb.exec:\bbnbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjpdd.exec:\vjpdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxlrflr.exec:\lxlrflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntnbtn.exec:\ntnbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hntbnh.exec:\hntbnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvjpd.exec:\vvjpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flxrxxf.exec:\flxrxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbbnnn.exec:\tbbnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7dppd.exec:\7dppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnhnth.exec:\nnhnth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhbbh.exec:\hbhbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpddd.exec:\jpddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxflfrl.exec:\lxflfrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxfflrr.exec:\lxfflrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bntbnt.exec:\bntbnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thnnth.exec:\thnnth.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppjjj.exec:\ppjjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1xxrflx.exec:\1xxrflx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhnbbh.exec:\nhnbbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvpvj.exec:\pvpvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffrxflr.exec:\ffrxflr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djvdd.exec:\djvdd.exe23⤵
- Executes dropped EXE
-
\??\c:\ppjpp.exec:\ppjpp.exe24⤵
- Executes dropped EXE
-
\??\c:\thnbhn.exec:\thnbhn.exe25⤵
- Executes dropped EXE
-
\??\c:\jpdjp.exec:\jpdjp.exe26⤵
- Executes dropped EXE
-
\??\c:\rfrrrfx.exec:\rfrrrfx.exe27⤵
- Executes dropped EXE
-
\??\c:\ttttnh.exec:\ttttnh.exe28⤵
- Executes dropped EXE
-
\??\c:\djvdd.exec:\djvdd.exe29⤵
- Executes dropped EXE
-
\??\c:\rxrxxxr.exec:\rxrxxxr.exe30⤵
- Executes dropped EXE
-
\??\c:\ntbtht.exec:\ntbtht.exe31⤵
- Executes dropped EXE
-
\??\c:\lfrxfll.exec:\lfrxfll.exe32⤵
- Executes dropped EXE
-
\??\c:\jvpjv.exec:\jvpjv.exe33⤵
- Executes dropped EXE
-
\??\c:\djjdd.exec:\djjdd.exe34⤵
- Executes dropped EXE
-
\??\c:\btnbnb.exec:\btnbnb.exe35⤵
- Executes dropped EXE
-
\??\c:\jpvpj.exec:\jpvpj.exe36⤵
- Executes dropped EXE
-
\??\c:\pjvvv.exec:\pjvvv.exe37⤵
- Executes dropped EXE
-
\??\c:\xfxrxfl.exec:\xfxrxfl.exe38⤵
- Executes dropped EXE
-
\??\c:\tbbbtb.exec:\tbbbtb.exe39⤵
- Executes dropped EXE
-
\??\c:\jpddd.exec:\jpddd.exe40⤵
- Executes dropped EXE
-
\??\c:\lfflxxr.exec:\lfflxxr.exe41⤵
- Executes dropped EXE
-
\??\c:\fxlfffl.exec:\fxlfffl.exe42⤵
- Executes dropped EXE
-
\??\c:\hhhbtn.exec:\hhhbtn.exe43⤵
- Executes dropped EXE
-
\??\c:\ddddd.exec:\ddddd.exe44⤵
- Executes dropped EXE
-
\??\c:\1rfflrf.exec:\1rfflrf.exe45⤵
- Executes dropped EXE
-
\??\c:\bbtttt.exec:\bbtttt.exe46⤵
- Executes dropped EXE
-
\??\c:\bntttb.exec:\bntttb.exe47⤵
- Executes dropped EXE
-
\??\c:\dvdpd.exec:\dvdpd.exe48⤵
- Executes dropped EXE
-
\??\c:\fxlllrf.exec:\fxlllrf.exe49⤵
- Executes dropped EXE
-
\??\c:\rllxrxr.exec:\rllxrxr.exe50⤵
- Executes dropped EXE
-
\??\c:\9tthhh.exec:\9tthhh.exe51⤵
- Executes dropped EXE
-
\??\c:\jvppj.exec:\jvppj.exe52⤵
- Executes dropped EXE
-
\??\c:\rlrrrlr.exec:\rlrrrlr.exe53⤵
- Executes dropped EXE
-
\??\c:\rllfxrl.exec:\rllfxrl.exe54⤵
- Executes dropped EXE
-
\??\c:\9pddd.exec:\9pddd.exe55⤵
- Executes dropped EXE
-
\??\c:\5pjpd.exec:\5pjpd.exe56⤵
- Executes dropped EXE
-
\??\c:\lfrllll.exec:\lfrllll.exe57⤵
- Executes dropped EXE
-
\??\c:\ntthhh.exec:\ntthhh.exe58⤵
- Executes dropped EXE
-
\??\c:\vdppv.exec:\vdppv.exe59⤵
- Executes dropped EXE
-
\??\c:\frllfxx.exec:\frllfxx.exe60⤵
- Executes dropped EXE
-
\??\c:\nhnnnt.exec:\nhnnnt.exe61⤵
- Executes dropped EXE
-
\??\c:\bhntbb.exec:\bhntbb.exe62⤵
- Executes dropped EXE
-
\??\c:\vdjvv.exec:\vdjvv.exe63⤵
- Executes dropped EXE
-
\??\c:\flflxff.exec:\flflxff.exe64⤵
- Executes dropped EXE
-
\??\c:\bbhnnn.exec:\bbhnnn.exe65⤵
- Executes dropped EXE
-
\??\c:\vpjjp.exec:\vpjjp.exe66⤵
-
\??\c:\pjvvd.exec:\pjvvd.exe67⤵
-
\??\c:\rfffrfl.exec:\rfffrfl.exe68⤵
-
\??\c:\nnttbn.exec:\nnttbn.exe69⤵
-
\??\c:\pdjpj.exec:\pdjpj.exe70⤵
-
\??\c:\llfxxxx.exec:\llfxxxx.exe71⤵
-
\??\c:\fxrlffx.exec:\fxrlffx.exe72⤵
-
\??\c:\tbhhbb.exec:\tbhhbb.exe73⤵
-
\??\c:\xlxxffx.exec:\xlxxffx.exe74⤵
-
\??\c:\httttt.exec:\httttt.exe75⤵
-
\??\c:\nbhbbh.exec:\nbhbbh.exe76⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe77⤵
-
\??\c:\1fllflf.exec:\1fllflf.exe78⤵
-
\??\c:\rrxllrx.exec:\rrxllrx.exe79⤵
-
\??\c:\nhnntt.exec:\nhnntt.exe80⤵
-
\??\c:\djvvv.exec:\djvvv.exe81⤵
-
\??\c:\dpddd.exec:\dpddd.exe82⤵
-
\??\c:\rxflllf.exec:\rxflllf.exe83⤵
-
\??\c:\tttttb.exec:\tttttb.exe84⤵
-
\??\c:\vvdvj.exec:\vvdvj.exe85⤵
-
\??\c:\ddvjv.exec:\ddvjv.exe86⤵
-
\??\c:\fflflll.exec:\fflflll.exe87⤵
-
\??\c:\9bnhtt.exec:\9bnhtt.exe88⤵
-
\??\c:\nhnnnt.exec:\nhnnnt.exe89⤵
-
\??\c:\jjdjd.exec:\jjdjd.exe90⤵
-
\??\c:\3rfxflf.exec:\3rfxflf.exe91⤵
-
\??\c:\fxfrrrx.exec:\fxfrrrx.exe92⤵
-
\??\c:\tttttt.exec:\tttttt.exe93⤵
-
\??\c:\pddvd.exec:\pddvd.exe94⤵
-
\??\c:\xfllfff.exec:\xfllfff.exe95⤵
-
\??\c:\5rrxxfx.exec:\5rrxxfx.exe96⤵
-
\??\c:\httnht.exec:\httnht.exe97⤵
-
\??\c:\pddpj.exec:\pddpj.exe98⤵
-
\??\c:\jddvv.exec:\jddvv.exe99⤵
-
\??\c:\fflxrlx.exec:\fflxrlx.exe100⤵
-
\??\c:\tnnbtb.exec:\tnnbtb.exe101⤵
-
\??\c:\vjvdj.exec:\vjvdj.exe102⤵
-
\??\c:\xlfxlxf.exec:\xlfxlxf.exe103⤵
-
\??\c:\bnthht.exec:\bnthht.exe104⤵
-
\??\c:\jjdjj.exec:\jjdjj.exe105⤵
-
\??\c:\rlflrfl.exec:\rlflrfl.exe106⤵
-
\??\c:\nhnntb.exec:\nhnntb.exe107⤵
-
\??\c:\ppdjv.exec:\ppdjv.exe108⤵
-
\??\c:\frrxflf.exec:\frrxflf.exe109⤵
-
\??\c:\ffxrfrx.exec:\ffxrfrx.exe110⤵
-
\??\c:\hbnbht.exec:\hbnbht.exe111⤵
-
\??\c:\7dpdj.exec:\7dpdj.exe112⤵
-
\??\c:\rxxfxlf.exec:\rxxfxlf.exe113⤵
-
\??\c:\nnbnnt.exec:\nnbnnt.exe114⤵
-
\??\c:\9vjdv.exec:\9vjdv.exe115⤵
-
\??\c:\fllllrf.exec:\fllllrf.exe116⤵
-
\??\c:\bbhbhh.exec:\bbhbhh.exe117⤵
-
\??\c:\tbtbtn.exec:\tbtbtn.exe118⤵
-
\??\c:\3vvvp.exec:\3vvvp.exe119⤵
-
\??\c:\rxfxxfr.exec:\rxfxxfr.exe120⤵
-
\??\c:\hnnnnn.exec:\hnnnnn.exe121⤵
-
\??\c:\bthbbb.exec:\bthbbb.exe122⤵
-
\??\c:\9jjdd.exec:\9jjdd.exe123⤵
-
\??\c:\5xxxrxx.exec:\5xxxrxx.exe124⤵
-
\??\c:\flrrllf.exec:\flrrllf.exe125⤵
-
\??\c:\bthntb.exec:\bthntb.exe126⤵
-
\??\c:\pjddd.exec:\pjddd.exe127⤵
-
\??\c:\rlfllrx.exec:\rlfllrx.exe128⤵
-
\??\c:\htntbt.exec:\htntbt.exe129⤵
-
\??\c:\jpvdj.exec:\jpvdj.exe130⤵
-
\??\c:\jvjpd.exec:\jvjpd.exe131⤵
-
\??\c:\lrfxrlx.exec:\lrfxrlx.exe132⤵
-
\??\c:\hbtthn.exec:\hbtthn.exe133⤵
-
\??\c:\pjvpd.exec:\pjvpd.exe134⤵
-
\??\c:\ffxllrf.exec:\ffxllrf.exe135⤵
-
\??\c:\lfllfll.exec:\lfllfll.exe136⤵
-
\??\c:\vvddd.exec:\vvddd.exe137⤵
-
\??\c:\thbbhn.exec:\thbbhn.exe138⤵
-
\??\c:\dpvjj.exec:\dpvjj.exe139⤵
-
\??\c:\pjpjv.exec:\pjpjv.exe140⤵
-
\??\c:\xxfflxx.exec:\xxfflxx.exe141⤵
-
\??\c:\jdppp.exec:\jdppp.exe142⤵
-
\??\c:\xffrlfx.exec:\xffrlfx.exe143⤵
-
\??\c:\dvddd.exec:\dvddd.exe144⤵
-
\??\c:\llxfflf.exec:\llxfflf.exe145⤵
-
\??\c:\9nnntb.exec:\9nnntb.exe146⤵
-
\??\c:\jdvjv.exec:\jdvjv.exe147⤵
-
\??\c:\bbnhbt.exec:\bbnhbt.exe148⤵
-
\??\c:\ppvpd.exec:\ppvpd.exe149⤵
-
\??\c:\lrxxfxf.exec:\lrxxfxf.exe150⤵
-
\??\c:\bhttbh.exec:\bhttbh.exe151⤵
-
\??\c:\djjjd.exec:\djjjd.exe152⤵
-
\??\c:\5rfxflf.exec:\5rfxflf.exe153⤵
-
\??\c:\nntnhb.exec:\nntnhb.exe154⤵
-
\??\c:\vvpjj.exec:\vvpjj.exe155⤵
-
\??\c:\xfxflxl.exec:\xfxflxl.exe156⤵
-
\??\c:\tbbhtt.exec:\tbbhtt.exe157⤵
-
\??\c:\1vddj.exec:\1vddj.exe158⤵
-
\??\c:\rlffxxx.exec:\rlffxxx.exe159⤵
-
\??\c:\ttnhbn.exec:\ttnhbn.exe160⤵
-
\??\c:\jdpvj.exec:\jdpvj.exe161⤵
-
\??\c:\flrrxlr.exec:\flrrxlr.exe162⤵
-
\??\c:\nttbhn.exec:\nttbhn.exe163⤵
-
\??\c:\jpvdj.exec:\jpvdj.exe164⤵
-
\??\c:\rrflrfr.exec:\rrflrfr.exe165⤵
-
\??\c:\tbbbbn.exec:\tbbbbn.exe166⤵
-
\??\c:\hntbhn.exec:\hntbhn.exe167⤵
-
\??\c:\xrxffrx.exec:\xrxffrx.exe168⤵
-
\??\c:\nththh.exec:\nththh.exe169⤵
-
\??\c:\djvvv.exec:\djvvv.exe170⤵
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe171⤵
-
\??\c:\bbhhhn.exec:\bbhhhn.exe172⤵
-
\??\c:\jpvpp.exec:\jpvpp.exe173⤵
-
\??\c:\flflxlr.exec:\flflxlr.exe174⤵
-
\??\c:\hhhhbt.exec:\hhhhbt.exe175⤵
-
\??\c:\vvppj.exec:\vvppj.exe176⤵
-
\??\c:\fxfxrxx.exec:\fxfxrxx.exe177⤵
-
\??\c:\hbnntt.exec:\hbnntt.exe178⤵
-
\??\c:\pvvpj.exec:\pvvpj.exe179⤵
-
\??\c:\rllxllx.exec:\rllxllx.exe180⤵
-
\??\c:\nnntbb.exec:\nnntbb.exe181⤵
-
\??\c:\thnnbn.exec:\thnnbn.exe182⤵
-
\??\c:\xlxfffx.exec:\xlxfffx.exe183⤵
-
\??\c:\bbnttb.exec:\bbnttb.exe184⤵
-
\??\c:\vjpdp.exec:\vjpdp.exe185⤵
-
\??\c:\1rxlxfr.exec:\1rxlxfr.exe186⤵
-
\??\c:\tthhnb.exec:\tthhnb.exe187⤵
-
\??\c:\vdjvv.exec:\vdjvv.exe188⤵
-
\??\c:\pjjpj.exec:\pjjpj.exe189⤵
-
\??\c:\frrrrrx.exec:\frrrrrx.exe190⤵
-
\??\c:\ttbtbh.exec:\ttbtbh.exe191⤵
-
\??\c:\xxlrrll.exec:\xxlrrll.exe192⤵
-
\??\c:\9htbnb.exec:\9htbnb.exe193⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe194⤵
-
\??\c:\rrxxxff.exec:\rrxxxff.exe195⤵
-
\??\c:\vjvvv.exec:\vjvvv.exe196⤵
-
\??\c:\jpjpd.exec:\jpjpd.exe197⤵
-
\??\c:\xrlxxxx.exec:\xrlxxxx.exe198⤵
-
\??\c:\1rrrrfr.exec:\1rrrrfr.exe199⤵
-
\??\c:\vjvdj.exec:\vjvdj.exe200⤵
-
\??\c:\nbtnhb.exec:\nbtnhb.exe201⤵
-
\??\c:\dddvp.exec:\dddvp.exe202⤵
-
\??\c:\rrflrfx.exec:\rrflrfx.exe203⤵
-
\??\c:\9nhntb.exec:\9nhntb.exe204⤵
-
\??\c:\rxlrflr.exec:\rxlrflr.exe205⤵
-
\??\c:\nhhbnh.exec:\nhhbnh.exe206⤵
-
\??\c:\dvpvd.exec:\dvpvd.exe207⤵
-
\??\c:\xffxxfl.exec:\xffxxfl.exe208⤵
-
\??\c:\tnhnnh.exec:\tnhnnh.exe209⤵
-
\??\c:\5bnnhn.exec:\5bnnhn.exe210⤵
-
\??\c:\jjpjp.exec:\jjpjp.exe211⤵
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe212⤵
-
\??\c:\bbtbhh.exec:\bbtbhh.exe213⤵
-
\??\c:\jdjpv.exec:\jdjpv.exe214⤵
-
\??\c:\dppvv.exec:\dppvv.exe215⤵
-
\??\c:\lxlrrxr.exec:\lxlrrxr.exe216⤵
-
\??\c:\hhnbht.exec:\hhnbht.exe217⤵
-
\??\c:\pjpvd.exec:\pjpvd.exe218⤵
-
\??\c:\7bhhbn.exec:\7bhhbn.exe219⤵
-
\??\c:\ppvpp.exec:\ppvpp.exe220⤵
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe221⤵
-
\??\c:\hbtnhb.exec:\hbtnhb.exe222⤵
-
\??\c:\3nhnhh.exec:\3nhnhh.exe223⤵
-
\??\c:\9jvdv.exec:\9jvdv.exe224⤵
-
\??\c:\frfllrf.exec:\frfllrf.exe225⤵
-
\??\c:\tbnthh.exec:\tbnthh.exe226⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe227⤵
-
\??\c:\3xxrllf.exec:\3xxrllf.exe228⤵
-
\??\c:\rfrrllf.exec:\rfrrllf.exe229⤵
-
\??\c:\hnbbhn.exec:\hnbbhn.exe230⤵
-
\??\c:\jdjdj.exec:\jdjdj.exe231⤵
-
\??\c:\3djjd.exec:\3djjd.exe232⤵
-
\??\c:\frxffff.exec:\frxffff.exe233⤵
-
\??\c:\htbhhh.exec:\htbhhh.exe234⤵
-
\??\c:\ddvdj.exec:\ddvdj.exe235⤵
-
\??\c:\rlrllff.exec:\rlrllff.exe236⤵
-
\??\c:\7ntnbt.exec:\7ntnbt.exe237⤵
-
\??\c:\3vdpp.exec:\3vdpp.exe238⤵
-
\??\c:\jjpvd.exec:\jjpvd.exe239⤵
-
\??\c:\lrxrllr.exec:\lrxrllr.exe240⤵
-
\??\c:\hhtbbh.exec:\hhtbbh.exe241⤵