Analysis
-
max time kernel
150s -
max time network
64s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 03:36
Behavioral task
behavioral1
Sample
dd73cc5c7dd9033a05824b9c8051c5bbdd392e2a0dd91ce8abe58e9b7fb1c09e.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
dd73cc5c7dd9033a05824b9c8051c5bbdd392e2a0dd91ce8abe58e9b7fb1c09e.exe
-
Size
278KB
-
MD5
f0fcb407497b426a1ea1224396bd91f7
-
SHA1
9163ad8a769d62a5bd9dff788cb279e462a3e9a0
-
SHA256
dd73cc5c7dd9033a05824b9c8051c5bbdd392e2a0dd91ce8abe58e9b7fb1c09e
-
SHA512
22fcee6488dc19a87137bacad96ee87015478252542ebefe05608b0122dc52454683a52d4a57d441384c26c5386743c871b1504ada31bedd86f640f2fe191769
-
SSDEEP
6144:7cm4FmowdHoSoXSBcm4Vcm4FmowdHoSphra+cm4FMhraHcpOaKHpg:B4wFHoSoXW434wFHoS3eg4aeFaKHpg
Malware Config
Signatures
-
Detect Blackmoon payload 58 IoCs
Processes:
resource yara_rule behavioral2/memory/4748-35-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/540-42-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4876-76-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4176-89-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4436-95-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4152-117-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4516-151-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4164-227-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2516-231-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4432-301-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/724-2143-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3040-2474-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4224-1732-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1612-311-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3276-306-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3636-296-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4336-291-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3068-286-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/5016-281-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/5016-277-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/368-276-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2168-272-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/872-266-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/872-262-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3952-261-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3448-256-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1604-251-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3084-246-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4184-241-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3812-236-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3536-221-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/448-216-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1624-204-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2200-196-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2072-189-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4400-184-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4440-177-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/428-171-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/5036-164-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1744-156-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1832-143-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3532-137-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2528-130-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4152-122-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/5064-115-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2772-109-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1220-102-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1440-83-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1528-68-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/216-62-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4284-54-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/540-48-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4748-41-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/60-34-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4792-26-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3276-20-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4000-13-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4144-5-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule \??\c:\hnbhtb.exe UPX behavioral2/memory/4748-35-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/540-42-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\7llfffx.exe UPX \??\c:\bhhhhh.exe UPX behavioral2/memory/1528-63-0x0000000000400000-0x000000000044D000-memory.dmp UPX \??\c:\ttbnnb.exe UPX behavioral2/memory/4876-76-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/1440-77-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4176-89-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\7djjp.exe UPX behavioral2/memory/1220-96-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4436-95-0x0000000000400000-0x000000000044D000-memory.dmp UPX \??\c:\ddddd.exe UPX behavioral2/memory/5064-110-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4152-117-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/2528-124-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3532-131-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/1832-138-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4516-145-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4516-151-0x0000000000400000-0x000000000044D000-memory.dmp UPX \??\c:\rrlrfxf.exe UPX behavioral2/memory/428-165-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\thbbbh.exe UPX \??\c:\jpdjp.exe UPX \??\c:\bthnbh.exe UPX behavioral2/memory/4648-205-0x0000000000400000-0x000000000044D000-memory.dmp UPX \??\c:\9lxxlrf.exe UPX behavioral2/memory/4164-227-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/2516-231-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3812-232-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3448-252-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3952-257-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4336-287-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4432-301-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/1612-307-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/724-2143-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3040-2474-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4224-1732-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3956-312-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/1612-311-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3276-306-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3276-302-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4432-297-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3636-296-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4336-291-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3068-286-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3068-282-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/5016-281-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/5016-277-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/368-276-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/2168-272-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/2168-267-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/872-266-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/872-262-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3952-261-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3448-256-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/1604-251-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3084-246-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3084-242-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4184-241-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3812-236-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4164-222-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3536-221-0x0000000000400000-0x000000000044D000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
rxrxrxl.exehnbhtb.exehhtthb.exejpvdv.exentbtbb.exehhtbbh.exe7llfffx.exebhhhhh.exefflllll.exettbnnb.exevjjdp.exehtbtnt.exenhhhht.exe7djjp.exeddddd.exetbtnnh.exejvdpj.exefrxrxrf.exevdjdv.exerrlrfxl.exenbhnnn.exepjvpj.exerrlrfxf.exevdpjj.exerrrxxfl.exethbbbh.exedpvpp.exejpdjp.exebthnbh.exehhhnnb.exe9lxxlrf.exexrfxxxr.exevpppj.exevjpjp.exettnntt.exellllfff.exehtbbhb.exebbhntt.exejdjjp.exerflxxrr.exebtbhhh.exepvjjd.exellxffll.exexlfrrrr.exehtntbh.exetbthnb.exe3dpdv.exexflfllf.exentttnn.exejpvpp.exeflfffrr.exehbtbhn.exe3dvvv.exedvvdd.exebhhnbh.exedjvdp.exevddvp.exeflxfllf.exethbnhh.exetntnnn.exevdpdj.exelfrrrrf.exehnthnt.exenhtnhh.exepid process 4000 rxrxrxl.exe 3276 hnbhtb.exe 4792 hhtthb.exe 60 jpvdv.exe 4748 ntbtbb.exe 540 hhtbbh.exe 4284 7llfffx.exe 216 bhhhhh.exe 1528 fflllll.exe 4876 ttbnnb.exe 1440 vjjdp.exe 4176 htbtnt.exe 4436 nhhhht.exe 1220 7djjp.exe 2772 ddddd.exe 5064 tbtnnh.exe 4152 jvdpj.exe 2528 frxrxrf.exe 3532 vdjdv.exe 1832 rrlrfxl.exe 4516 nbhnnn.exe 1744 pjvpj.exe 5036 rrlrfxf.exe 428 vdpjj.exe 4440 rrrxxfl.exe 4400 thbbbh.exe 2072 dpvpp.exe 2200 jpdjp.exe 1624 bthnbh.exe 4648 hhhnnb.exe 448 9lxxlrf.exe 3536 xrfxxxr.exe 4164 vpppj.exe 2516 vjpjp.exe 3812 ttnntt.exe 4184 llllfff.exe 3084 htbbhb.exe 1604 bbhntt.exe 3448 jdjjp.exe 3952 rflxxrr.exe 872 btbhhh.exe 2168 pvjjd.exe 368 llxffll.exe 5016 xlfrrrr.exe 3068 htntbh.exe 4336 tbthnb.exe 3636 3dpdv.exe 4432 xflfllf.exe 3276 ntttnn.exe 1612 jpvpp.exe 3956 flfffrr.exe 2112 hbtbhn.exe 4072 3dvvv.exe 1728 dvvdd.exe 3232 bhhnbh.exe 2040 djvdp.exe 2684 vddvp.exe 4876 flxfllf.exe 4880 thbnhh.exe 4176 tntnnn.exe 4584 vdpdj.exe 764 lfrrrrf.exe 1220 hnthnt.exe 2904 nhtnhh.exe -
Processes:
resource yara_rule behavioral2/memory/4144-0-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\hnbhtb.exe upx behavioral2/memory/4792-21-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/60-27-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4748-35-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/540-42-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\7llfffx.exe upx \??\c:\bhhhhh.exe upx behavioral2/memory/1528-63-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\ttbnnb.exe upx behavioral2/memory/4876-76-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1440-77-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4176-89-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\7djjp.exe upx behavioral2/memory/1220-96-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4436-95-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\ddddd.exe upx behavioral2/memory/5064-110-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4152-117-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/2528-124-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3532-131-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1832-138-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4516-145-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4516-151-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\rrlrfxf.exe upx behavioral2/memory/428-165-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\thbbbh.exe upx \??\c:\jpdjp.exe upx \??\c:\bthnbh.exe upx behavioral2/memory/4648-205-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\9lxxlrf.exe upx behavioral2/memory/3536-217-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4164-227-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/2516-231-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3812-232-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4184-237-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3448-252-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3952-257-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/368-270-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4336-287-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3636-292-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4432-301-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1612-307-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/724-2143-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3040-2474-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4224-1732-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3956-312-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1612-311-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3276-306-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3276-302-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4432-297-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3636-296-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4336-291-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3068-286-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3068-282-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/5016-281-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/5016-277-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/368-276-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/2168-272-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/2168-267-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/872-266-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/872-262-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3952-261-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3448-256-0x0000000000400000-0x000000000044D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dd73cc5c7dd9033a05824b9c8051c5bbdd392e2a0dd91ce8abe58e9b7fb1c09e.exerxrxrxl.exehnbhtb.exehhtthb.exejpvdv.exentbtbb.exehhtbbh.exe7llfffx.exebhhhhh.exefflllll.exettbnnb.exevjjdp.exehtbtnt.exenhhhht.exe7djjp.exeddddd.exetbtnnh.exejvdpj.exefrxrxrf.exevdjdv.exerrlrfxl.exenbhnnn.exedescription pid process target process PID 4144 wrote to memory of 4000 4144 dd73cc5c7dd9033a05824b9c8051c5bbdd392e2a0dd91ce8abe58e9b7fb1c09e.exe rxrxrxl.exe PID 4144 wrote to memory of 4000 4144 dd73cc5c7dd9033a05824b9c8051c5bbdd392e2a0dd91ce8abe58e9b7fb1c09e.exe rxrxrxl.exe PID 4144 wrote to memory of 4000 4144 dd73cc5c7dd9033a05824b9c8051c5bbdd392e2a0dd91ce8abe58e9b7fb1c09e.exe rxrxrxl.exe PID 4000 wrote to memory of 3276 4000 rxrxrxl.exe hnbhtb.exe PID 4000 wrote to memory of 3276 4000 rxrxrxl.exe hnbhtb.exe PID 4000 wrote to memory of 3276 4000 rxrxrxl.exe hnbhtb.exe PID 3276 wrote to memory of 4792 3276 hnbhtb.exe hhtthb.exe PID 3276 wrote to memory of 4792 3276 hnbhtb.exe hhtthb.exe PID 3276 wrote to memory of 4792 3276 hnbhtb.exe hhtthb.exe PID 4792 wrote to memory of 60 4792 hhtthb.exe jpvdv.exe PID 4792 wrote to memory of 60 4792 hhtthb.exe jpvdv.exe PID 4792 wrote to memory of 60 4792 hhtthb.exe jpvdv.exe PID 60 wrote to memory of 4748 60 jpvdv.exe ntbtbb.exe PID 60 wrote to memory of 4748 60 jpvdv.exe ntbtbb.exe PID 60 wrote to memory of 4748 60 jpvdv.exe ntbtbb.exe PID 4748 wrote to memory of 540 4748 ntbtbb.exe hhtbbh.exe PID 4748 wrote to memory of 540 4748 ntbtbb.exe hhtbbh.exe PID 4748 wrote to memory of 540 4748 ntbtbb.exe hhtbbh.exe PID 540 wrote to memory of 4284 540 hhtbbh.exe 7llfffx.exe PID 540 wrote to memory of 4284 540 hhtbbh.exe 7llfffx.exe PID 540 wrote to memory of 4284 540 hhtbbh.exe 7llfffx.exe PID 4284 wrote to memory of 216 4284 7llfffx.exe hbnnhh.exe PID 4284 wrote to memory of 216 4284 7llfffx.exe hbnnhh.exe PID 4284 wrote to memory of 216 4284 7llfffx.exe hbnnhh.exe PID 216 wrote to memory of 1528 216 bhhhhh.exe fflllll.exe PID 216 wrote to memory of 1528 216 bhhhhh.exe fflllll.exe PID 216 wrote to memory of 1528 216 bhhhhh.exe fflllll.exe PID 1528 wrote to memory of 4876 1528 fflllll.exe ttbnnb.exe PID 1528 wrote to memory of 4876 1528 fflllll.exe ttbnnb.exe PID 1528 wrote to memory of 4876 1528 fflllll.exe ttbnnb.exe PID 4876 wrote to memory of 1440 4876 ttbnnb.exe vjjdp.exe PID 4876 wrote to memory of 1440 4876 ttbnnb.exe vjjdp.exe PID 4876 wrote to memory of 1440 4876 ttbnnb.exe vjjdp.exe PID 1440 wrote to memory of 4176 1440 vjjdp.exe htbtnt.exe PID 1440 wrote to memory of 4176 1440 vjjdp.exe htbtnt.exe PID 1440 wrote to memory of 4176 1440 vjjdp.exe htbtnt.exe PID 4176 wrote to memory of 4436 4176 htbtnt.exe nhhhht.exe PID 4176 wrote to memory of 4436 4176 htbtnt.exe nhhhht.exe PID 4176 wrote to memory of 4436 4176 htbtnt.exe nhhhht.exe PID 4436 wrote to memory of 1220 4436 nhhhht.exe 7djjp.exe PID 4436 wrote to memory of 1220 4436 nhhhht.exe 7djjp.exe PID 4436 wrote to memory of 1220 4436 nhhhht.exe 7djjp.exe PID 1220 wrote to memory of 2772 1220 7djjp.exe ddddd.exe PID 1220 wrote to memory of 2772 1220 7djjp.exe ddddd.exe PID 1220 wrote to memory of 2772 1220 7djjp.exe ddddd.exe PID 2772 wrote to memory of 5064 2772 ddddd.exe tbtnnh.exe PID 2772 wrote to memory of 5064 2772 ddddd.exe tbtnnh.exe PID 2772 wrote to memory of 5064 2772 ddddd.exe tbtnnh.exe PID 5064 wrote to memory of 4152 5064 tbtnnh.exe jvdpj.exe PID 5064 wrote to memory of 4152 5064 tbtnnh.exe jvdpj.exe PID 5064 wrote to memory of 4152 5064 tbtnnh.exe jvdpj.exe PID 4152 wrote to memory of 2528 4152 jvdpj.exe frxrxrf.exe PID 4152 wrote to memory of 2528 4152 jvdpj.exe frxrxrf.exe PID 4152 wrote to memory of 2528 4152 jvdpj.exe frxrxrf.exe PID 2528 wrote to memory of 3532 2528 frxrxrf.exe nbnhnt.exe PID 2528 wrote to memory of 3532 2528 frxrxrf.exe nbnhnt.exe PID 2528 wrote to memory of 3532 2528 frxrxrf.exe nbnhnt.exe PID 3532 wrote to memory of 1832 3532 vdjdv.exe rrlrfxl.exe PID 3532 wrote to memory of 1832 3532 vdjdv.exe rrlrfxl.exe PID 3532 wrote to memory of 1832 3532 vdjdv.exe rrlrfxl.exe PID 1832 wrote to memory of 4516 1832 rrlrfxl.exe nbhnnn.exe PID 1832 wrote to memory of 4516 1832 rrlrfxl.exe nbhnnn.exe PID 1832 wrote to memory of 4516 1832 rrlrfxl.exe nbhnnn.exe PID 4516 wrote to memory of 1744 4516 nbhnnn.exe pjvpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd73cc5c7dd9033a05824b9c8051c5bbdd392e2a0dd91ce8abe58e9b7fb1c09e.exe"C:\Users\Admin\AppData\Local\Temp\dd73cc5c7dd9033a05824b9c8051c5bbdd392e2a0dd91ce8abe58e9b7fb1c09e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\rxrxrxl.exec:\rxrxrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnbhtb.exec:\hnbhtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhtthb.exec:\hhtthb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpvdv.exec:\jpvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntbtbb.exec:\ntbtbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhtbbh.exec:\hhtbbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7llfffx.exec:\7llfffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhhhhh.exec:\bhhhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fflllll.exec:\fflllll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttbnnb.exec:\ttbnnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjjdp.exec:\vjjdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htbtnt.exec:\htbtnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhhht.exec:\nhhhht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7djjp.exec:\7djjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddddd.exec:\ddddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbtnnh.exec:\tbtnnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvdpj.exec:\jvdpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frxrxrf.exec:\frxrxrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdjdv.exec:\vdjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrlrfxl.exec:\rrlrfxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbhnnn.exec:\nbhnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvpj.exec:\pjvpj.exe23⤵
- Executes dropped EXE
-
\??\c:\rrlrfxf.exec:\rrlrfxf.exe24⤵
- Executes dropped EXE
-
\??\c:\vdpjj.exec:\vdpjj.exe25⤵
- Executes dropped EXE
-
\??\c:\rrrxxfl.exec:\rrrxxfl.exe26⤵
- Executes dropped EXE
-
\??\c:\thbbbh.exec:\thbbbh.exe27⤵
- Executes dropped EXE
-
\??\c:\dpvpp.exec:\dpvpp.exe28⤵
- Executes dropped EXE
-
\??\c:\jpdjp.exec:\jpdjp.exe29⤵
- Executes dropped EXE
-
\??\c:\bthnbh.exec:\bthnbh.exe30⤵
- Executes dropped EXE
-
\??\c:\hhhnnb.exec:\hhhnnb.exe31⤵
- Executes dropped EXE
-
\??\c:\9lxxlrf.exec:\9lxxlrf.exe32⤵
- Executes dropped EXE
-
\??\c:\xrfxxxr.exec:\xrfxxxr.exe33⤵
- Executes dropped EXE
-
\??\c:\vpppj.exec:\vpppj.exe34⤵
- Executes dropped EXE
-
\??\c:\vjpjp.exec:\vjpjp.exe35⤵
- Executes dropped EXE
-
\??\c:\ttnntt.exec:\ttnntt.exe36⤵
- Executes dropped EXE
-
\??\c:\llllfff.exec:\llllfff.exe37⤵
- Executes dropped EXE
-
\??\c:\htbbhb.exec:\htbbhb.exe38⤵
- Executes dropped EXE
-
\??\c:\bbhntt.exec:\bbhntt.exe39⤵
- Executes dropped EXE
-
\??\c:\jdjjp.exec:\jdjjp.exe40⤵
- Executes dropped EXE
-
\??\c:\rflxxrr.exec:\rflxxrr.exe41⤵
- Executes dropped EXE
-
\??\c:\btbhhh.exec:\btbhhh.exe42⤵
- Executes dropped EXE
-
\??\c:\pvjjd.exec:\pvjjd.exe43⤵
- Executes dropped EXE
-
\??\c:\llxffll.exec:\llxffll.exe44⤵
- Executes dropped EXE
-
\??\c:\xlfrrrr.exec:\xlfrrrr.exe45⤵
- Executes dropped EXE
-
\??\c:\htntbh.exec:\htntbh.exe46⤵
- Executes dropped EXE
-
\??\c:\tbthnb.exec:\tbthnb.exe47⤵
- Executes dropped EXE
-
\??\c:\3dpdv.exec:\3dpdv.exe48⤵
- Executes dropped EXE
-
\??\c:\xflfllf.exec:\xflfllf.exe49⤵
- Executes dropped EXE
-
\??\c:\ntttnn.exec:\ntttnn.exe50⤵
- Executes dropped EXE
-
\??\c:\jpvpp.exec:\jpvpp.exe51⤵
- Executes dropped EXE
-
\??\c:\flfffrr.exec:\flfffrr.exe52⤵
- Executes dropped EXE
-
\??\c:\hbtbhn.exec:\hbtbhn.exe53⤵
- Executes dropped EXE
-
\??\c:\3dvvv.exec:\3dvvv.exe54⤵
- Executes dropped EXE
-
\??\c:\dvvdd.exec:\dvvdd.exe55⤵
- Executes dropped EXE
-
\??\c:\bhhnbh.exec:\bhhnbh.exe56⤵
- Executes dropped EXE
-
\??\c:\djvdp.exec:\djvdp.exe57⤵
- Executes dropped EXE
-
\??\c:\vddvp.exec:\vddvp.exe58⤵
- Executes dropped EXE
-
\??\c:\flxfllf.exec:\flxfllf.exe59⤵
- Executes dropped EXE
-
\??\c:\thbnhh.exec:\thbnhh.exe60⤵
- Executes dropped EXE
-
\??\c:\tntnnn.exec:\tntnnn.exe61⤵
- Executes dropped EXE
-
\??\c:\vdpdj.exec:\vdpdj.exe62⤵
- Executes dropped EXE
-
\??\c:\lfrrrrf.exec:\lfrrrrf.exe63⤵
- Executes dropped EXE
-
\??\c:\hnthnt.exec:\hnthnt.exe64⤵
- Executes dropped EXE
-
\??\c:\nhtnhh.exec:\nhtnhh.exe65⤵
- Executes dropped EXE
-
\??\c:\1pvvd.exec:\1pvvd.exe66⤵
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe67⤵
-
\??\c:\xfrlxxf.exec:\xfrlxxf.exe68⤵
-
\??\c:\nbnhnt.exec:\nbnhnt.exe69⤵
-
\??\c:\djdpj.exec:\djdpj.exe70⤵
-
\??\c:\vjvdv.exec:\vjvdv.exe71⤵
-
\??\c:\rlfflll.exec:\rlfflll.exe72⤵
-
\??\c:\nbhhhh.exec:\nbhhhh.exe73⤵
-
\??\c:\jppdj.exec:\jppdj.exe74⤵
-
\??\c:\vvjvp.exec:\vvjvp.exe75⤵
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe76⤵
-
\??\c:\btnhhn.exec:\btnhhn.exe77⤵
-
\??\c:\1bbtbn.exec:\1bbtbn.exe78⤵
-
\??\c:\djjpd.exec:\djjpd.exe79⤵
-
\??\c:\flrrflf.exec:\flrrflf.exe80⤵
-
\??\c:\xllllrl.exec:\xllllrl.exe81⤵
-
\??\c:\htthhh.exec:\htthhh.exe82⤵
-
\??\c:\tnhhbb.exec:\tnhhbb.exe83⤵
-
\??\c:\ppddd.exec:\ppddd.exe84⤵
-
\??\c:\xrfllxx.exec:\xrfllxx.exe85⤵
-
\??\c:\3flrrrf.exec:\3flrrrf.exe86⤵
-
\??\c:\hbbhhh.exec:\hbbhhh.exe87⤵
-
\??\c:\nnnttt.exec:\nnnttt.exe88⤵
-
\??\c:\djjvp.exec:\djjvp.exe89⤵
-
\??\c:\rlxrrrl.exec:\rlxrrrl.exe90⤵
-
\??\c:\fllfxxx.exec:\fllfxxx.exe91⤵
-
\??\c:\tbhntb.exec:\tbhntb.exe92⤵
-
\??\c:\5nhhbh.exec:\5nhhbh.exe93⤵
-
\??\c:\dpvdd.exec:\dpvdd.exe94⤵
-
\??\c:\rlxffff.exec:\rlxffff.exe95⤵
-
\??\c:\3rxrllr.exec:\3rxrllr.exe96⤵
-
\??\c:\bbtbtt.exec:\bbtbtt.exe97⤵
-
\??\c:\nnnnhh.exec:\nnnnhh.exe98⤵
-
\??\c:\ddpdd.exec:\ddpdd.exe99⤵
-
\??\c:\rrfxfxl.exec:\rrfxfxl.exe100⤵
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe101⤵
-
\??\c:\bhtttb.exec:\bhtttb.exe102⤵
-
\??\c:\3ntthn.exec:\3ntthn.exe103⤵
-
\??\c:\vdpjp.exec:\vdpjp.exe104⤵
-
\??\c:\flllxll.exec:\flllxll.exe105⤵
-
\??\c:\flxxffl.exec:\flxxffl.exe106⤵
-
\??\c:\hbhntb.exec:\hbhntb.exe107⤵
-
\??\c:\dddpp.exec:\dddpp.exe108⤵
-
\??\c:\7dvpp.exec:\7dvpp.exe109⤵
-
\??\c:\rrxxrxx.exec:\rrxxrxx.exe110⤵
-
\??\c:\3xfxxrx.exec:\3xfxxrx.exe111⤵
-
\??\c:\btthbt.exec:\btthbt.exe112⤵
-
\??\c:\htnbbb.exec:\htnbbb.exe113⤵
-
\??\c:\ppddd.exec:\ppddd.exe114⤵
-
\??\c:\vvvvv.exec:\vvvvv.exe115⤵
-
\??\c:\lllxrxx.exec:\lllxrxx.exe116⤵
-
\??\c:\ttnnnt.exec:\ttnnnt.exe117⤵
-
\??\c:\httntn.exec:\httntn.exe118⤵
-
\??\c:\vvpjp.exec:\vvpjp.exe119⤵
-
\??\c:\jpddd.exec:\jpddd.exe120⤵
-
\??\c:\1flllrl.exec:\1flllrl.exe121⤵
-
\??\c:\fllrrrl.exec:\fllrrrl.exe122⤵
-
\??\c:\bbnnbh.exec:\bbnnbh.exe123⤵
-
\??\c:\1pvjp.exec:\1pvjp.exe124⤵
-
\??\c:\jdpjj.exec:\jdpjj.exe125⤵
-
\??\c:\xrfflxx.exec:\xrfflxx.exe126⤵
-
\??\c:\fxxflrr.exec:\fxxflrr.exe127⤵
-
\??\c:\hhnhnn.exec:\hhnhnn.exe128⤵
-
\??\c:\vvdjj.exec:\vvdjj.exe129⤵
-
\??\c:\vjvvd.exec:\vjvvd.exe130⤵
-
\??\c:\lfxrrxr.exec:\lfxrrxr.exe131⤵
-
\??\c:\hbtnnh.exec:\hbtnnh.exe132⤵
-
\??\c:\9hbthn.exec:\9hbthn.exe133⤵
-
\??\c:\vdddj.exec:\vdddj.exe134⤵
-
\??\c:\lxxrllr.exec:\lxxrllr.exe135⤵
-
\??\c:\llrxxff.exec:\llrxxff.exe136⤵
-
\??\c:\bbbbth.exec:\bbbbth.exe137⤵
-
\??\c:\nhbbbh.exec:\nhbbbh.exe138⤵
-
\??\c:\rrxxrxx.exec:\rrxxrxx.exe139⤵
-
\??\c:\5rfxxxr.exec:\5rfxxxr.exe140⤵
-
\??\c:\hhhbhh.exec:\hhhbhh.exe141⤵
-
\??\c:\nbhhbn.exec:\nbhhbn.exe142⤵
-
\??\c:\vjjdv.exec:\vjjdv.exe143⤵
-
\??\c:\jpjdv.exec:\jpjdv.exe144⤵
-
\??\c:\5ffffll.exec:\5ffffll.exe145⤵
-
\??\c:\9frrrxx.exec:\9frrrxx.exe146⤵
-
\??\c:\9ntntt.exec:\9ntntt.exe147⤵
-
\??\c:\1ddpd.exec:\1ddpd.exe148⤵
-
\??\c:\7jdjp.exec:\7jdjp.exe149⤵
-
\??\c:\lllrxlf.exec:\lllrxlf.exe150⤵
-
\??\c:\bnnttt.exec:\bnnttt.exe151⤵
-
\??\c:\nntbtn.exec:\nntbtn.exe152⤵
-
\??\c:\ppdpv.exec:\ppdpv.exe153⤵
-
\??\c:\vdddd.exec:\vdddd.exe154⤵
-
\??\c:\lfffrxr.exec:\lfffrxr.exe155⤵
-
\??\c:\nttbbn.exec:\nttbbn.exe156⤵
-
\??\c:\hhttnn.exec:\hhttnn.exe157⤵
-
\??\c:\jpvvd.exec:\jpvvd.exe158⤵
-
\??\c:\dddjv.exec:\dddjv.exe159⤵
-
\??\c:\xxxxlll.exec:\xxxxlll.exe160⤵
-
\??\c:\rlrxlrf.exec:\rlrxlrf.exe161⤵
-
\??\c:\bntbnt.exec:\bntbnt.exe162⤵
-
\??\c:\9tnhtn.exec:\9tnhtn.exe163⤵
-
\??\c:\vdpjj.exec:\vdpjj.exe164⤵
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe165⤵
-
\??\c:\rrlfxll.exec:\rrlfxll.exe166⤵
-
\??\c:\1ttnhh.exec:\1ttnhh.exe167⤵
-
\??\c:\nthhbn.exec:\nthhbn.exe168⤵
-
\??\c:\vpvvp.exec:\vpvvp.exe169⤵
-
\??\c:\ffrlxll.exec:\ffrlxll.exe170⤵
-
\??\c:\5xfflrr.exec:\5xfflrr.exe171⤵
-
\??\c:\nntbtn.exec:\nntbtn.exe172⤵
-
\??\c:\7nnbnh.exec:\7nnbnh.exe173⤵
-
\??\c:\1vjpp.exec:\1vjpp.exe174⤵
-
\??\c:\vddpv.exec:\vddpv.exe175⤵
-
\??\c:\xlxlxrf.exec:\xlxlxrf.exe176⤵
-
\??\c:\nbhhnh.exec:\nbhhnh.exe177⤵
-
\??\c:\hhbtnh.exec:\hhbtnh.exe178⤵
-
\??\c:\5vdjv.exec:\5vdjv.exe179⤵
-
\??\c:\djddd.exec:\djddd.exe180⤵
-
\??\c:\xfxffff.exec:\xfxffff.exe181⤵
-
\??\c:\rlffffr.exec:\rlffffr.exe182⤵
-
\??\c:\tnnhnt.exec:\tnnhnt.exe183⤵
-
\??\c:\hhnhtt.exec:\hhnhtt.exe184⤵
-
\??\c:\vvvpp.exec:\vvvpp.exe185⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe186⤵
-
\??\c:\xxlllxf.exec:\xxlllxf.exe187⤵
-
\??\c:\tthhhn.exec:\tthhhn.exe188⤵
-
\??\c:\bbnnth.exec:\bbnnth.exe189⤵
-
\??\c:\jpdpj.exec:\jpdpj.exe190⤵
-
\??\c:\rrllrfr.exec:\rrllrfr.exe191⤵
-
\??\c:\frxxlfl.exec:\frxxlfl.exe192⤵
-
\??\c:\3nnnhb.exec:\3nnnhb.exe193⤵
-
\??\c:\bnhhhh.exec:\bnhhhh.exe194⤵
-
\??\c:\5pjdp.exec:\5pjdp.exe195⤵
-
\??\c:\pjddv.exec:\pjddv.exe196⤵
-
\??\c:\xrrrrxx.exec:\xrrrrxx.exe197⤵
-
\??\c:\tnnhbb.exec:\tnnhbb.exe198⤵
-
\??\c:\hhhtnh.exec:\hhhtnh.exe199⤵
-
\??\c:\vpvpv.exec:\vpvpv.exe200⤵
-
\??\c:\jdjdp.exec:\jdjdp.exe201⤵
-
\??\c:\fxfxrxf.exec:\fxfxrxf.exe202⤵
-
\??\c:\xlrllrl.exec:\xlrllrl.exe203⤵
-
\??\c:\tnttnn.exec:\tnttnn.exe204⤵
-
\??\c:\3ttntt.exec:\3ttntt.exe205⤵
-
\??\c:\vvvjj.exec:\vvvjj.exe206⤵
-
\??\c:\llfffxx.exec:\llfffxx.exe207⤵
-
\??\c:\xlrrxff.exec:\xlrrxff.exe208⤵
-
\??\c:\thtnbt.exec:\thtnbt.exe209⤵
-
\??\c:\bnhtht.exec:\bnhtht.exe210⤵
-
\??\c:\1pdvd.exec:\1pdvd.exe211⤵
-
\??\c:\rflllll.exec:\rflllll.exe212⤵
-
\??\c:\rxfrlrl.exec:\rxfrlrl.exe213⤵
-
\??\c:\bnnnnt.exec:\bnnnnt.exe214⤵
-
\??\c:\tntttt.exec:\tntttt.exe215⤵
-
\??\c:\pvdjj.exec:\pvdjj.exe216⤵
-
\??\c:\vdjdd.exec:\vdjdd.exe217⤵
-
\??\c:\xxrlfff.exec:\xxrlfff.exe218⤵
-
\??\c:\bhhnnn.exec:\bhhnnn.exe219⤵
-
\??\c:\bhttbh.exec:\bhttbh.exe220⤵
-
\??\c:\7jpjj.exec:\7jpjj.exe221⤵
-
\??\c:\vdpdd.exec:\vdpdd.exe222⤵
-
\??\c:\fxxffrf.exec:\fxxffrf.exe223⤵
-
\??\c:\xrxfrxf.exec:\xrxfrxf.exe224⤵
-
\??\c:\bhbtnb.exec:\bhbtnb.exe225⤵
-
\??\c:\jppjv.exec:\jppjv.exe226⤵
-
\??\c:\jvdvp.exec:\jvdvp.exe227⤵
-
\??\c:\rlrlfff.exec:\rlrlfff.exe228⤵
-
\??\c:\fllllrr.exec:\fllllrr.exe229⤵
-
\??\c:\thtbbh.exec:\thtbbh.exe230⤵
-
\??\c:\nnnntt.exec:\nnnntt.exe231⤵
-
\??\c:\1pvvd.exec:\1pvvd.exe232⤵
-
\??\c:\rxfffrf.exec:\rxfffrf.exe233⤵
-
\??\c:\7lxrllf.exec:\7lxrllf.exe234⤵
-
\??\c:\bbhbbb.exec:\bbhbbb.exe235⤵
-
\??\c:\ntbhtb.exec:\ntbhtb.exe236⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe237⤵
-
\??\c:\vjdjd.exec:\vjdjd.exe238⤵
-
\??\c:\frfrrxx.exec:\frfrrxx.exe239⤵
-
\??\c:\1lxrrrr.exec:\1lxrrrr.exe240⤵
-
\??\c:\9tnttt.exec:\9tnttt.exe241⤵