Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 21:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4b9bf3f9b9c544bdbb14db8ccf06bb08b1ca0efaa76909b3fac871ab1cbcc58d.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
4b9bf3f9b9c544bdbb14db8ccf06bb08b1ca0efaa76909b3fac871ab1cbcc58d.exe
-
Size
275KB
-
MD5
cb985c5dce7bfc4627296c28221a8bb3
-
SHA1
84e861c7fdd6bd31cebb27ff8459084337876ae0
-
SHA256
4b9bf3f9b9c544bdbb14db8ccf06bb08b1ca0efaa76909b3fac871ab1cbcc58d
-
SHA512
8067e7f0250dc6394eeeafd355918ab5000c940b2e4bdc0f1b8793e82db97956a65a7c1c773e4907f5b5b1ff6e43b37c6aabb44ebf103ebf21076edbb0a7b5e6
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFp:8cm7ImGddXmNt251UriZFp
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4796-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1732-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1140-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1756-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/776-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2044-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/824-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1328-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/568-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4248-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/496-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-1021-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-1058-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4796-4-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4472-9-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1156-12-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1156-20-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1732-24-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3348-17-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1732-31-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1140-37-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/644-43-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/644-48-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/5004-55-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4916-61-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4236-67-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4624-68-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2448-74-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2452-85-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1072-90-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2992-95-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3040-99-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4492-113-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2020-105-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4656-124-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/444-132-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1756-138-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1756-142-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1628-146-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2644-154-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1612-157-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4620-167-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2580-168-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2580-172-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4288-176-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1288-187-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/776-185-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2044-208-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/824-212-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/116-219-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1328-226-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3360-230-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3144-237-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3144-241-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4956-254-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/568-268-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/64-277-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4624-281-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3236-294-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2808-307-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4740-311-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1724-318-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/5060-325-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/60-332-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2060-339-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1612-343-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2188-353-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4592-369-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4472-388-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3296-389-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4912-396-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/376-469-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3208-485-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2316-495-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2188-496-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/432-510-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4380-529-0x0000000000400000-0x000000000042A000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
hntntb.exe1dvvv.exehhhhbt.exejpddd.exevpddd.exefxrxxxx.exebhtttt.exenbthnh.exepjpjj.exexfxxrrr.exe5hnnnn.exexxlrrxf.exebtbhhh.exejvppj.exexflxfxl.exeddppj.exexrllxfr.exethnhht.exepjvpp.exelflllrr.exethttnb.exeffllllx.exehbhhnn.exe5djjd.exe3vvpj.exebbbtnt.exeppjpv.exexflxfrx.exenthhth.exellxlffl.exe5tnhhn.exe1vppj.exefrrllff.exedvdvp.exevpppj.exe3xlfrrx.exehhbbhh.exe5jppv.exerfllffx.exenhttnn.exedpvpp.exellrllfr.exehttthn.exejvvvj.exelffxxxr.exehtbbbh.exevpppj.exejjpvp.exexlxrllr.exethhttn.exevdvpp.exerlfffxf.exehnnhbb.exepdddv.exefrfrrfr.exe7bhhbb.exepjvjj.exe1lrlffx.exehtbttn.exeppddp.exelxfxxrr.exenttbhn.exexfrrrrr.exebbttnb.exepid process 4472 hntntb.exe 1156 1dvvv.exe 3348 hhhhbt.exe 1732 jpddd.exe 4820 vpddd.exe 1140 fxrxxxx.exe 644 bhtttt.exe 5004 nbthnh.exe 4916 pjpjj.exe 4236 xfxxrrr.exe 4624 5hnnnn.exe 2448 xxlrrxf.exe 2452 btbhhh.exe 1072 jvppj.exe 2992 xflxfxl.exe 3040 ddppj.exe 2020 xrllxfr.exe 4492 thnhht.exe 1956 pjvpp.exe 4656 lflllrr.exe 4160 thttnb.exe 444 ffllllx.exe 1756 hbhhnn.exe 1628 5djjd.exe 2644 3vvpj.exe 1612 bbbtnt.exe 4620 ppjpv.exe 2580 xflxfrx.exe 4288 nthhth.exe 776 llxlffl.exe 1288 5tnhhn.exe 3924 1vppj.exe 4640 frrllff.exe 4864 dvdvp.exe 2348 vpppj.exe 2044 3xlfrrx.exe 824 hhbbhh.exe 2280 5jppv.exe 116 rfllffx.exe 4284 nhttnn.exe 1328 dpvpp.exe 3296 llrllfr.exe 3360 httthn.exe 1552 jvvvj.exe 3144 lffxxxr.exe 3624 htbbbh.exe 3572 vpppj.exe 1940 jjpvp.exe 4956 xlxrllr.exe 2264 thhttn.exe 2956 vdvpp.exe 2488 rlfffxf.exe 2796 hnnhbb.exe 568 pdddv.exe 1520 frfrrfr.exe 64 7bhhbb.exe 4624 pjvjj.exe 4812 1lrlffx.exe 4540 htbttn.exe 3036 ppddp.exe 3236 lxfxxrr.exe 3040 nttbhn.exe 3256 xfrrrrr.exe 4492 bbttnb.exe -
Processes:
resource yara_rule behavioral2/memory/4796-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1732-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1732-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1140-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/776-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2044-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/824-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/568-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-529-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4b9bf3f9b9c544bdbb14db8ccf06bb08b1ca0efaa76909b3fac871ab1cbcc58d.exehntntb.exe1dvvv.exehhhhbt.exejpddd.exevpddd.exefxrxxxx.exebhtttt.exenbthnh.exepjpjj.exexfxxrrr.exe5hnnnn.exexxlrrxf.exebtbhhh.exejvppj.exexflxfxl.exeddppj.exexrllxfr.exethnhht.exepjvpp.exelflllrr.exethttnb.exedescription pid process target process PID 4796 wrote to memory of 4472 4796 4b9bf3f9b9c544bdbb14db8ccf06bb08b1ca0efaa76909b3fac871ab1cbcc58d.exe hntntb.exe PID 4796 wrote to memory of 4472 4796 4b9bf3f9b9c544bdbb14db8ccf06bb08b1ca0efaa76909b3fac871ab1cbcc58d.exe hntntb.exe PID 4796 wrote to memory of 4472 4796 4b9bf3f9b9c544bdbb14db8ccf06bb08b1ca0efaa76909b3fac871ab1cbcc58d.exe hntntb.exe PID 4472 wrote to memory of 1156 4472 hntntb.exe 1dvvv.exe PID 4472 wrote to memory of 1156 4472 hntntb.exe 1dvvv.exe PID 4472 wrote to memory of 1156 4472 hntntb.exe 1dvvv.exe PID 1156 wrote to memory of 3348 1156 1dvvv.exe hhhhbt.exe PID 1156 wrote to memory of 3348 1156 1dvvv.exe hhhhbt.exe PID 1156 wrote to memory of 3348 1156 1dvvv.exe hhhhbt.exe PID 3348 wrote to memory of 1732 3348 hhhhbt.exe jpddd.exe PID 3348 wrote to memory of 1732 3348 hhhhbt.exe jpddd.exe PID 3348 wrote to memory of 1732 3348 hhhhbt.exe jpddd.exe PID 1732 wrote to memory of 4820 1732 jpddd.exe vpddd.exe PID 1732 wrote to memory of 4820 1732 jpddd.exe vpddd.exe PID 1732 wrote to memory of 4820 1732 jpddd.exe vpddd.exe PID 4820 wrote to memory of 1140 4820 vpddd.exe fxrxxxx.exe PID 4820 wrote to memory of 1140 4820 vpddd.exe fxrxxxx.exe PID 4820 wrote to memory of 1140 4820 vpddd.exe fxrxxxx.exe PID 1140 wrote to memory of 644 1140 fxrxxxx.exe bhtttt.exe PID 1140 wrote to memory of 644 1140 fxrxxxx.exe bhtttt.exe PID 1140 wrote to memory of 644 1140 fxrxxxx.exe bhtttt.exe PID 644 wrote to memory of 5004 644 bhtttt.exe nbthnh.exe PID 644 wrote to memory of 5004 644 bhtttt.exe nbthnh.exe PID 644 wrote to memory of 5004 644 bhtttt.exe nbthnh.exe PID 5004 wrote to memory of 4916 5004 nbthnh.exe pjpjj.exe PID 5004 wrote to memory of 4916 5004 nbthnh.exe pjpjj.exe PID 5004 wrote to memory of 4916 5004 nbthnh.exe pjpjj.exe PID 4916 wrote to memory of 4236 4916 pjpjj.exe xfxxrrr.exe PID 4916 wrote to memory of 4236 4916 pjpjj.exe xfxxrrr.exe PID 4916 wrote to memory of 4236 4916 pjpjj.exe xfxxrrr.exe PID 4236 wrote to memory of 4624 4236 xfxxrrr.exe 5hnnnn.exe PID 4236 wrote to memory of 4624 4236 xfxxrrr.exe 5hnnnn.exe PID 4236 wrote to memory of 4624 4236 xfxxrrr.exe 5hnnnn.exe PID 4624 wrote to memory of 2448 4624 5hnnnn.exe xxlrrxf.exe PID 4624 wrote to memory of 2448 4624 5hnnnn.exe xxlrrxf.exe PID 4624 wrote to memory of 2448 4624 5hnnnn.exe xxlrrxf.exe PID 2448 wrote to memory of 2452 2448 xxlrrxf.exe btbhhh.exe PID 2448 wrote to memory of 2452 2448 xxlrrxf.exe btbhhh.exe PID 2448 wrote to memory of 2452 2448 xxlrrxf.exe btbhhh.exe PID 2452 wrote to memory of 1072 2452 btbhhh.exe jvppj.exe PID 2452 wrote to memory of 1072 2452 btbhhh.exe jvppj.exe PID 2452 wrote to memory of 1072 2452 btbhhh.exe jvppj.exe PID 1072 wrote to memory of 2992 1072 jvppj.exe xflxfxl.exe PID 1072 wrote to memory of 2992 1072 jvppj.exe xflxfxl.exe PID 1072 wrote to memory of 2992 1072 jvppj.exe xflxfxl.exe PID 2992 wrote to memory of 3040 2992 xflxfxl.exe ddppj.exe PID 2992 wrote to memory of 3040 2992 xflxfxl.exe ddppj.exe PID 2992 wrote to memory of 3040 2992 xflxfxl.exe ddppj.exe PID 3040 wrote to memory of 2020 3040 ddppj.exe xrllxfr.exe PID 3040 wrote to memory of 2020 3040 ddppj.exe xrllxfr.exe PID 3040 wrote to memory of 2020 3040 ddppj.exe xrllxfr.exe PID 2020 wrote to memory of 4492 2020 xrllxfr.exe thnhht.exe PID 2020 wrote to memory of 4492 2020 xrllxfr.exe thnhht.exe PID 2020 wrote to memory of 4492 2020 xrllxfr.exe thnhht.exe PID 4492 wrote to memory of 1956 4492 thnhht.exe pjvpp.exe PID 4492 wrote to memory of 1956 4492 thnhht.exe pjvpp.exe PID 4492 wrote to memory of 1956 4492 thnhht.exe pjvpp.exe PID 1956 wrote to memory of 4656 1956 pjvpp.exe lflllrr.exe PID 1956 wrote to memory of 4656 1956 pjvpp.exe lflllrr.exe PID 1956 wrote to memory of 4656 1956 pjvpp.exe lflllrr.exe PID 4656 wrote to memory of 4160 4656 lflllrr.exe thttnb.exe PID 4656 wrote to memory of 4160 4656 lflllrr.exe thttnb.exe PID 4656 wrote to memory of 4160 4656 lflllrr.exe thttnb.exe PID 4160 wrote to memory of 444 4160 thttnb.exe ffllllx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b9bf3f9b9c544bdbb14db8ccf06bb08b1ca0efaa76909b3fac871ab1cbcc58d.exe"C:\Users\Admin\AppData\Local\Temp\4b9bf3f9b9c544bdbb14db8ccf06bb08b1ca0efaa76909b3fac871ab1cbcc58d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\hntntb.exec:\hntntb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\1dvvv.exec:\1dvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\hhhhbt.exec:\hhhhbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\jpddd.exec:\jpddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\vpddd.exec:\vpddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\fxrxxxx.exec:\fxrxxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\bhtttt.exec:\bhtttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\nbthnh.exec:\nbthnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\pjpjj.exec:\pjpjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\xfxxrrr.exec:\xfxxrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\5hnnnn.exec:\5hnnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\xxlrrxf.exec:\xxlrrxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\btbhhh.exec:\btbhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\jvppj.exec:\jvppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\xflxfxl.exec:\xflxfxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\ddppj.exec:\ddppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\xrllxfr.exec:\xrllxfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\thnhht.exec:\thnhht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\pjvpp.exec:\pjvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\lflllrr.exec:\lflllrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\thttnb.exec:\thttnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\ffllllx.exec:\ffllllx.exe23⤵
- Executes dropped EXE
PID:444 -
\??\c:\hbhhnn.exec:\hbhhnn.exe24⤵
- Executes dropped EXE
PID:1756 -
\??\c:\5djjd.exec:\5djjd.exe25⤵
- Executes dropped EXE
PID:1628 -
\??\c:\3vvpj.exec:\3vvpj.exe26⤵
- Executes dropped EXE
PID:2644 -
\??\c:\bbbtnt.exec:\bbbtnt.exe27⤵
- Executes dropped EXE
PID:1612 -
\??\c:\ppjpv.exec:\ppjpv.exe28⤵
- Executes dropped EXE
PID:4620 -
\??\c:\xflxfrx.exec:\xflxfrx.exe29⤵
- Executes dropped EXE
PID:2580 -
\??\c:\nthhth.exec:\nthhth.exe30⤵
- Executes dropped EXE
PID:4288 -
\??\c:\llxlffl.exec:\llxlffl.exe31⤵
- Executes dropped EXE
PID:776 -
\??\c:\5tnhhn.exec:\5tnhhn.exe32⤵
- Executes dropped EXE
PID:1288 -
\??\c:\1vppj.exec:\1vppj.exe33⤵
- Executes dropped EXE
PID:3924 -
\??\c:\frrllff.exec:\frrllff.exe34⤵
- Executes dropped EXE
PID:4640 -
\??\c:\dvdvp.exec:\dvdvp.exe35⤵
- Executes dropped EXE
PID:4864 -
\??\c:\vpppj.exec:\vpppj.exe36⤵
- Executes dropped EXE
PID:2348 -
\??\c:\3xlfrrx.exec:\3xlfrrx.exe37⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hhbbhh.exec:\hhbbhh.exe38⤵
- Executes dropped EXE
PID:824 -
\??\c:\5jppv.exec:\5jppv.exe39⤵
- Executes dropped EXE
PID:2280 -
\??\c:\rfllffx.exec:\rfllffx.exe40⤵
- Executes dropped EXE
PID:116 -
\??\c:\nhttnn.exec:\nhttnn.exe41⤵
- Executes dropped EXE
PID:4284 -
\??\c:\dpvpp.exec:\dpvpp.exe42⤵
- Executes dropped EXE
PID:1328 -
\??\c:\llrllfr.exec:\llrllfr.exe43⤵
- Executes dropped EXE
PID:3296 -
\??\c:\httthn.exec:\httthn.exe44⤵
- Executes dropped EXE
PID:3360 -
\??\c:\jvvvj.exec:\jvvvj.exe45⤵
- Executes dropped EXE
PID:1552 -
\??\c:\lffxxxr.exec:\lffxxxr.exe46⤵
- Executes dropped EXE
PID:3144 -
\??\c:\htbbbh.exec:\htbbbh.exe47⤵
- Executes dropped EXE
PID:3624 -
\??\c:\vpppj.exec:\vpppj.exe48⤵
- Executes dropped EXE
PID:3572 -
\??\c:\jjpvp.exec:\jjpvp.exe49⤵
- Executes dropped EXE
PID:1940 -
\??\c:\xlxrllr.exec:\xlxrllr.exe50⤵
- Executes dropped EXE
PID:4956 -
\??\c:\thhttn.exec:\thhttn.exe51⤵
- Executes dropped EXE
PID:2264 -
\??\c:\vdvpp.exec:\vdvpp.exe52⤵
- Executes dropped EXE
PID:2956 -
\??\c:\rlfffxf.exec:\rlfffxf.exe53⤵
- Executes dropped EXE
PID:2488 -
\??\c:\hnnhbb.exec:\hnnhbb.exe54⤵
- Executes dropped EXE
PID:2796 -
\??\c:\pdddv.exec:\pdddv.exe55⤵
- Executes dropped EXE
PID:568 -
\??\c:\frfrrfr.exec:\frfrrfr.exe56⤵
- Executes dropped EXE
PID:1520 -
\??\c:\7bhhbb.exec:\7bhhbb.exe57⤵
- Executes dropped EXE
PID:64 -
\??\c:\pjvjj.exec:\pjvjj.exe58⤵
- Executes dropped EXE
PID:4624 -
\??\c:\1lrlffx.exec:\1lrlffx.exe59⤵
- Executes dropped EXE
PID:4812 -
\??\c:\htbttn.exec:\htbttn.exe60⤵
- Executes dropped EXE
PID:4540 -
\??\c:\ppddp.exec:\ppddp.exe61⤵
- Executes dropped EXE
PID:3036 -
\??\c:\lxfxxrr.exec:\lxfxxrr.exe62⤵
- Executes dropped EXE
PID:3236 -
\??\c:\nttbhn.exec:\nttbhn.exe63⤵
- Executes dropped EXE
PID:3040 -
\??\c:\xfrrrrr.exec:\xfrrrrr.exe64⤵
- Executes dropped EXE
PID:3256 -
\??\c:\bbttnb.exec:\bbttnb.exe65⤵
- Executes dropped EXE
PID:4492 -
\??\c:\pddvj.exec:\pddvj.exe66⤵PID:2808
-
\??\c:\frxrlll.exec:\frxrlll.exe67⤵PID:4740
-
\??\c:\hnbtbb.exec:\hnbtbb.exe68⤵PID:376
-
\??\c:\djjjd.exec:\djjjd.exe69⤵PID:1724
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe70⤵PID:1608
-
\??\c:\nhnnnn.exec:\nhnnnn.exe71⤵PID:5060
-
\??\c:\fxrlfll.exec:\fxrlfll.exe72⤵PID:4052
-
\??\c:\vddvv.exec:\vddvv.exe73⤵PID:60
-
\??\c:\xfllxrl.exec:\xfllxrl.exe74⤵PID:4752
-
\??\c:\ttnbbb.exec:\ttnbbb.exe75⤵PID:2060
-
\??\c:\ppvpv.exec:\ppvpv.exe76⤵PID:1612
-
\??\c:\xlxxxrr.exec:\xlxxxrr.exe77⤵PID:1400
-
\??\c:\7bhbtb.exec:\7bhbtb.exe78⤵PID:3736
-
\??\c:\jdvdd.exec:\jdvdd.exe79⤵PID:2188
-
\??\c:\xxllrfl.exec:\xxllrfl.exe80⤵PID:3576
-
\??\c:\5ntbnn.exec:\5ntbnn.exe81⤵PID:2360
-
\??\c:\dppdd.exec:\dppdd.exe82⤵PID:3388
-
\??\c:\vvdjj.exec:\vvdjj.exe83⤵PID:2220
-
\??\c:\fllrrrl.exec:\fllrrrl.exe84⤵PID:4592
-
\??\c:\ffxxxxx.exec:\ffxxxxx.exe85⤵PID:4084
-
\??\c:\bnnnnt.exec:\bnnnnt.exe86⤵PID:244
-
\??\c:\vjjpj.exec:\vjjpj.exe87⤵PID:904
-
\??\c:\dpdvv.exec:\dpdvv.exe88⤵PID:2280
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe89⤵PID:4264
-
\??\c:\ffllxfl.exec:\ffllxfl.exe90⤵PID:4472
-
\??\c:\bntbbh.exec:\bntbbh.exe91⤵PID:3296
-
\??\c:\5jpvp.exec:\5jpvp.exe92⤵PID:4912
-
\??\c:\lfxxxxf.exec:\lfxxxxf.exe93⤵PID:3972
-
\??\c:\tnnnhh.exec:\tnnnhh.exe94⤵PID:3624
-
\??\c:\nhhbtt.exec:\nhhbtt.exe95⤵PID:2408
-
\??\c:\7vvjd.exec:\7vvjd.exe96⤵PID:3944
-
\??\c:\btnhhb.exec:\btnhhb.exe97⤵PID:2516
-
\??\c:\tnnhbn.exec:\tnnhbn.exe98⤵PID:5004
-
\??\c:\3jvdp.exec:\3jvdp.exe99⤵PID:4056
-
\??\c:\3rlfxxr.exec:\3rlfxxr.exe100⤵PID:2488
-
\??\c:\htbtnn.exec:\htbtnn.exe101⤵PID:2796
-
\??\c:\vvppp.exec:\vvppp.exe102⤵PID:568
-
\??\c:\hhnnht.exec:\hhnnht.exe103⤵PID:2592
-
\??\c:\fxrlffr.exec:\fxrlffr.exe104⤵PID:1068
-
\??\c:\ttbbbh.exec:\ttbbbh.exe105⤵PID:4528
-
\??\c:\pdppp.exec:\pdppp.exe106⤵PID:3076
-
\??\c:\vpvvp.exec:\vpvvp.exe107⤵PID:2088
-
\??\c:\fxfxfff.exec:\fxfxfff.exe108⤵PID:5024
-
\??\c:\hbthbt.exec:\hbthbt.exe109⤵PID:5028
-
\??\c:\jvppp.exec:\jvppp.exe110⤵PID:2100
-
\??\c:\lfxffrl.exec:\lfxffrl.exe111⤵PID:4576
-
\??\c:\nththh.exec:\nththh.exe112⤵PID:3188
-
\??\c:\jdpvv.exec:\jdpvv.exe113⤵PID:1956
-
\??\c:\vvjjp.exec:\vvjjp.exe114⤵PID:2808
-
\??\c:\rlllxff.exec:\rlllxff.exe115⤵PID:4740
-
\??\c:\tthhbb.exec:\tthhbb.exe116⤵PID:376
-
\??\c:\nntbnn.exec:\nntbnn.exe117⤵PID:1724
-
\??\c:\ppvvv.exec:\ppvvv.exe118⤵PID:2164
-
\??\c:\9ffxlll.exec:\9ffxlll.exe119⤵PID:4016
-
\??\c:\nnttbb.exec:\nnttbb.exe120⤵PID:4500
-
\??\c:\bthhbb.exec:\bthhbb.exe121⤵PID:3208
-
\??\c:\5pjdd.exec:\5pjdd.exe122⤵PID:5108
-
\??\c:\lrrxxfl.exec:\lrrxxfl.exe123⤵PID:4548
-
\??\c:\bhhbbh.exec:\bhhbbh.exe124⤵PID:2316
-
\??\c:\thnbbh.exec:\thnbbh.exe125⤵PID:2188
-
\??\c:\pvdpj.exec:\pvdpj.exe126⤵PID:3576
-
\??\c:\xffrxrl.exec:\xffrxrl.exe127⤵PID:4396
-
\??\c:\nththb.exec:\nththb.exe128⤵PID:5048
-
\??\c:\hthnnt.exec:\hthnnt.exe129⤵PID:432
-
\??\c:\dvdvp.exec:\dvdvp.exe130⤵PID:4864
-
\??\c:\rxlxffr.exec:\rxlxffr.exe131⤵PID:5088
-
\??\c:\lrffffx.exec:\lrffffx.exe132⤵PID:1172
-
\??\c:\nthbbt.exec:\nthbbt.exe133⤵PID:904
-
\??\c:\jpppv.exec:\jpppv.exe134⤵PID:3860
-
\??\c:\llfllrf.exec:\llfllrf.exe135⤵PID:4380
-
\??\c:\7xfffff.exec:\7xfffff.exe136⤵PID:2260
-
\??\c:\nhnnnt.exec:\nhnnnt.exe137⤵PID:4248
-
\??\c:\pjvvv.exec:\pjvvv.exe138⤵PID:428
-
\??\c:\xlfffll.exec:\xlfffll.exe139⤵PID:4820
-
\??\c:\3hbtnn.exec:\3hbtnn.exe140⤵PID:640
-
\??\c:\djpjj.exec:\djpjj.exe141⤵PID:4588
-
\??\c:\fflllrl.exec:\fflllrl.exe142⤵PID:1380
-
\??\c:\hbhhbb.exec:\hbhhbb.exe143⤵PID:808
-
\??\c:\vvvpp.exec:\vvvpp.exe144⤵PID:2208
-
\??\c:\9dvpp.exec:\9dvpp.exe145⤵PID:2272
-
\??\c:\fxxrxrl.exec:\fxxrxrl.exe146⤵PID:3020
-
\??\c:\xfllflf.exec:\xfllflf.exe147⤵PID:4180
-
\??\c:\7nnnnt.exec:\7nnnnt.exe148⤵PID:2240
-
\??\c:\vjvpp.exec:\vjvpp.exe149⤵PID:4624
-
\??\c:\frllfff.exec:\frllfff.exe150⤵PID:1072
-
\??\c:\nhbttn.exec:\nhbttn.exe151⤵PID:4992
-
\??\c:\lrlffxx.exec:\lrlffxx.exe152⤵PID:2088
-
\??\c:\rlrrlxf.exec:\rlrrlxf.exe153⤵PID:5024
-
\??\c:\tnhnnt.exec:\tnhnnt.exe154⤵PID:5084
-
\??\c:\jpjjp.exec:\jpjjp.exe155⤵PID:4872
-
\??\c:\flxfrfx.exec:\flxfrfx.exe156⤵PID:4644
-
\??\c:\fxxrfrx.exec:\fxxrfrx.exe157⤵PID:552
-
\??\c:\nhbtnn.exec:\nhbtnn.exe158⤵PID:4160
-
\??\c:\hbhbtt.exec:\hbhbtt.exe159⤵PID:1864
-
\??\c:\vpvdp.exec:\vpvdp.exe160⤵PID:4740
-
\??\c:\ffxrlll.exec:\ffxrlll.exe161⤵PID:2636
-
\??\c:\ntbnnh.exec:\ntbnnh.exe162⤵PID:3688
-
\??\c:\thhbtt.exec:\thhbtt.exe163⤵PID:1708
-
\??\c:\1dddv.exec:\1dddv.exe164⤵PID:3756
-
\??\c:\vpdvd.exec:\vpdvd.exe165⤵PID:4868
-
\??\c:\fxfffxx.exec:\fxfffxx.exe166⤵PID:1660
-
\??\c:\tnnhbb.exec:\tnnhbb.exe167⤵PID:2612
-
\??\c:\5bhbnn.exec:\5bhbnn.exe168⤵PID:2544
-
\??\c:\pjjpp.exec:\pjjpp.exe169⤵PID:3740
-
\??\c:\9ddvp.exec:\9ddvp.exe170⤵PID:984
-
\??\c:\fxrrrlr.exec:\fxrrrlr.exe171⤵PID:3724
-
\??\c:\tbtnbb.exec:\tbtnbb.exe172⤵PID:3416
-
\??\c:\5nnnnn.exec:\5nnnnn.exe173⤵PID:4592
-
\??\c:\pjjjd.exec:\pjjjd.exe174⤵PID:3764
-
\??\c:\rrrllfx.exec:\rrrllfx.exe175⤵PID:3212
-
\??\c:\fxxrrrx.exec:\fxxrrrx.exe176⤵PID:2476
-
\??\c:\bnhnnt.exec:\bnhnnt.exe177⤵PID:1156
-
\??\c:\vpvvv.exec:\vpvvv.exe178⤵PID:4344
-
\??\c:\ddppv.exec:\ddppv.exe179⤵PID:4024
-
\??\c:\hhhbnn.exec:\hhhbnn.exe180⤵PID:4504
-
\??\c:\7htnbb.exec:\7htnbb.exe181⤵PID:2248
-
\??\c:\ppppj.exec:\ppppj.exe182⤵PID:1732
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe183⤵PID:1512
-
\??\c:\5hbttt.exec:\5hbttt.exe184⤵PID:2264
-
\??\c:\bnbtnn.exec:\bnbtnn.exe185⤵PID:2956
-
\??\c:\7ppvp.exec:\7ppvp.exe186⤵PID:5004
-
\??\c:\rfxxrlf.exec:\rfxxrlf.exe187⤵PID:2488
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe188⤵PID:2916
-
\??\c:\bhtnhh.exec:\bhtnhh.exe189⤵PID:496
-
\??\c:\vvdvp.exec:\vvdvp.exe190⤵PID:2028
-
\??\c:\pdjpj.exec:\pdjpj.exe191⤵PID:5016
-
\??\c:\3frlfll.exec:\3frlfll.exe192⤵PID:1596
-
\??\c:\xxrrlll.exec:\xxrrlll.exe193⤵PID:4812
-
\??\c:\hbbtbb.exec:\hbbtbb.exe194⤵PID:1096
-
\??\c:\7pdvp.exec:\7pdvp.exe195⤵PID:3180
-
\??\c:\jvvvv.exec:\jvvvv.exe196⤵PID:1084
-
\??\c:\ffxxfrl.exec:\ffxxfrl.exe197⤵PID:2020
-
\??\c:\nbhhbb.exec:\nbhhbb.exe198⤵PID:1992
-
\??\c:\jvdvp.exec:\jvdvp.exe199⤵PID:2852
-
\??\c:\1jvpp.exec:\1jvpp.exe200⤵PID:4804
-
\??\c:\xfrfxrl.exec:\xfrfxrl.exe201⤵PID:3960
-
\??\c:\htnnhn.exec:\htnnhn.exe202⤵PID:4896
-
\??\c:\3nnnhh.exec:\3nnnhh.exe203⤵PID:444
-
\??\c:\pjvvv.exec:\pjvvv.exe204⤵PID:1608
-
\??\c:\xxlfxrl.exec:\xxlfxrl.exe205⤵PID:4052
-
\??\c:\lfxxfff.exec:\lfxxfff.exe206⤵PID:60
-
\??\c:\7btnhh.exec:\7btnhh.exe207⤵PID:3364
-
\??\c:\pdjdv.exec:\pdjdv.exe208⤵PID:3468
-
\??\c:\xlxlfxx.exec:\xlxlfxx.exe209⤵PID:4912
-
\??\c:\nntbbb.exec:\nntbbb.exe210⤵PID:1560
-
\??\c:\pjpjd.exec:\pjpjd.exe211⤵PID:1972
-
\??\c:\lfflxfl.exec:\lfflxfl.exe212⤵PID:1884
-
\??\c:\7xxrrrr.exec:\7xxrrrr.exe213⤵PID:2224
-
\??\c:\bbhhhn.exec:\bbhhhn.exe214⤵PID:2360
-
\??\c:\dpvdp.exec:\dpvdp.exe215⤵PID:4072
-
\??\c:\lffxrrr.exec:\lffxrrr.exe216⤵PID:2220
-
\??\c:\7ntttt.exec:\7ntttt.exe217⤵PID:1036
-
\??\c:\djjdd.exec:\djjdd.exe218⤵PID:3416
-
\??\c:\xrffflr.exec:\xrffflr.exe219⤵PID:4356
-
\??\c:\1fxxrxx.exec:\1fxxrxx.exe220⤵PID:1160
-
\??\c:\nhnthh.exec:\nhnthh.exe221⤵PID:492
-
\??\c:\nnbtnn.exec:\nnbtnn.exe222⤵PID:4292
-
\??\c:\pddvp.exec:\pddvp.exe223⤵PID:2476
-
\??\c:\flrrrxr.exec:\flrrrxr.exe224⤵PID:1156
-
\??\c:\ttntbn.exec:\ttntbn.exe225⤵PID:756
-
\??\c:\pvpdp.exec:\pvpdp.exe226⤵PID:4024
-
\??\c:\jddvp.exec:\jddvp.exe227⤵PID:2076
-
\??\c:\llfxxrr.exec:\llfxxrr.exe228⤵PID:2408
-
\??\c:\3bhbbh.exec:\3bhbbh.exe229⤵PID:640
-
\??\c:\dvpvv.exec:\dvpvv.exe230⤵PID:3944
-
\??\c:\rfllxxl.exec:\rfllxxl.exe231⤵PID:2516
-
\??\c:\hbbhtn.exec:\hbbhtn.exe232⤵PID:808
-
\??\c:\1bttnn.exec:\1bttnn.exe233⤵PID:3272
-
\??\c:\vdpjj.exec:\vdpjj.exe234⤵PID:2272
-
\??\c:\3frrxfl.exec:\3frrxfl.exe235⤵PID:568
-
\??\c:\bnhbtb.exec:\bnhbtb.exe236⤵PID:496
-
\??\c:\dvddv.exec:\dvddv.exe237⤵PID:2028
-
\??\c:\llfrrxl.exec:\llfrrxl.exe238⤵PID:1564
-
\??\c:\nnnbbh.exec:\nnnbbh.exe239⤵PID:1596
-
\??\c:\jdpvj.exec:\jdpvj.exe240⤵PID:4812
-
\??\c:\xfxxlrl.exec:\xfxxlrl.exe241⤵PID:5028
-
\??\c:\llrlrfx.exec:\llrlrfx.exe242⤵PID:5024