Analysis
-
max time kernel
130s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 01:09
Behavioral task
behavioral1
Sample
aa18cb12907c091bdd16e0a48bb34fd2d17ebd3ee1f975bba579120e145fd3bf.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
aa18cb12907c091bdd16e0a48bb34fd2d17ebd3ee1f975bba579120e145fd3bf.exe
-
Size
75KB
-
MD5
374378cff8677cc7f896d2f6f2842a55
-
SHA1
251cc48a9a2d9a91cdcd980b8692ce063fcb3913
-
SHA256
aa18cb12907c091bdd16e0a48bb34fd2d17ebd3ee1f975bba579120e145fd3bf
-
SHA512
4dca7f001ffda7c7674aa297dcb1f82c57902fd7962f4eeb1dc0b90bb71d13e4e2bd64047e7956a5c8e5be89cce600fbd2990131e12d3d5b88e7c9525910b1f9
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFWoFLAxZhMDzE8mpcw:9hOmTsF93UYfwC6GIoutz5yLpOSD8
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1080-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4408-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2000-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1996-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2148-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2284-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3040-500-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4880-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1632-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1972-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2788-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2492-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-414-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3760-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2724-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3024-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4380-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2892-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1552-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4044-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1508-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3660-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2224-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/756-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4408-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1988-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3024-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2292-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1448-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-568-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1340-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1540-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2492-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3392-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/468-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-650-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3288-761-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3108-772-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-879-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2040-955-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1080-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1080-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\1ntnbb.exe UPX C:\httntn.exe UPX behavioral2/memory/2796-12-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vpvjp.exe UPX C:\pdvpp.exe UPX behavioral2/memory/4408-21-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2000-19-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xxlrrll.exe UPX \??\c:\tnnhtn.exe UPX behavioral2/memory/3716-36-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1800-43-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rxfrlrr.exe UPX behavioral2/memory/1996-55-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\ddddj.exe UPX \??\c:\7dppd.exe UPX \??\c:\rllxrrl.exe UPX \??\c:\dvpjj.exe UPX \??\c:\ffllrxf.exe UPX behavioral2/memory/876-118-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\pdvpj.exe UPX behavioral2/memory/2148-129-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\7fxxxxr.exe UPX behavioral2/memory/2284-152-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\9pvvd.exe UPX C:\fxlfxll.exe UPX behavioral2/memory/4400-171-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\jpddv.exe UPX behavioral2/memory/1952-197-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3716-231-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1800-236-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4660-327-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4856-372-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1800-400-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2992-410-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1340-454-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3040-500-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4880-522-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4408-538-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1088-551-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1632-494-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1972-443-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2788-437-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4292-429-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4292-425-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2492-416-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2992-414-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1800-396-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3760-392-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2724-380-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3024-371-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3024-367-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4896-345-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4380-341-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2892-322-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1552-314-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4044-310-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1508-294-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3660-285-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2224-277-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4640-273-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4424-270-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2076-263-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
1ntnbb.exehttntn.exevpvjp.exepdvpp.exexxlrrll.exetnnhtn.exenhthtn.exe9jpjd.exerxfrlrr.exellrfxxl.exebntnnh.exeddddj.exe7dppd.exe9flfrrr.exerllxrrl.exe9bbtnn.exedvpjj.exevpjpd.exeffllrxf.exelfrrxxf.exehbtthh.exepdvpj.exepdjdd.exe7fxxxxr.exe9thhbb.exevvddv.exe9pvvd.exefxlfxll.exexrflllf.exenttnhh.exejpddv.exevddpp.exelxrlllf.exexrxfxxx.exenhhttt.exepjjpv.exejdppp.exexllrffl.exefxrlxxx.exefxllrrx.exenbbbtt.exejvdpv.exejvdjv.exerllllll.exe5ffxxff.exetbnhnn.exepvdjp.exevpdvp.exerxrxlxl.exehhnnhn.exehhhhbb.exepdvpd.exevppjj.exexfrxrrr.exetthbbh.exetbnbth.exepvppd.exe9pdvv.exelrxfllx.exe7flrxll.exe5htntt.exebbbbhh.exevjppj.exejdjjv.exepid process 2796 1ntnbb.exe 2000 httntn.exe 4408 vpvjp.exe 468 pdvpp.exe 3716 xxlrrll.exe 1800 tnnhtn.exe 3392 nhthtn.exe 1996 9jpjd.exe 3352 rxfrlrr.exe 2992 llrfxxl.exe 2492 bntnnh.exe 1540 ddddj.exe 4292 7dppd.exe 4424 9flfrrr.exe 4884 rllxrrl.exe 1804 9bbtnn.exe 4004 dvpjj.exe 1340 vpjpd.exe 4344 ffllrxf.exe 876 lfrrxxf.exe 2148 hbtthh.exe 3172 pdvpj.exe 2044 pdjdd.exe 4716 7fxxxxr.exe 2284 9thhbb.exe 5116 vvddv.exe 4892 9pvvd.exe 684 fxlfxll.exe 4400 xrflllf.exe 3984 nttnhh.exe 1448 jpddv.exe 4740 vddpp.exe 3252 lxrlllf.exe 2292 xrxfxxx.exe 1952 nhhttt.exe 3024 pjjpv.exe 4444 jdppp.exe 4420 xllrffl.exe 1988 fxrlxxx.exe 2096 fxllrrx.exe 4600 nbbbtt.exe 4408 jvdpv.exe 1480 jvdjv.exe 3716 rllllll.exe 1800 5ffxxff.exe 3896 tbnhnn.exe 1088 pvdjp.exe 5104 vpdvp.exe 3352 rxrxlxl.exe 244 hhnnhn.exe 756 hhhhbb.exe 2076 pdvpd.exe 3996 vppjj.exe 3948 xfrxrrr.exe 4424 tthbbh.exe 4640 tbnbth.exe 2224 pvppd.exe 3820 9pdvv.exe 3660 lrxfllx.exe 4372 7flrxll.exe 1340 5htntt.exe 1508 bbbbhh.exe 364 vjppj.exe 5080 jdjjv.exe -
Processes:
resource yara_rule behavioral2/memory/1080-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1080-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1ntnbb.exe upx C:\httntn.exe upx behavioral2/memory/2796-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpvjp.exe upx C:\pdvpp.exe upx behavioral2/memory/4408-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2000-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxlrrll.exe upx \??\c:\tnnhtn.exe upx behavioral2/memory/3716-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1800-43-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxfrlrr.exe upx behavioral2/memory/1996-55-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ddddj.exe upx \??\c:\7dppd.exe upx \??\c:\rllxrrl.exe upx \??\c:\dvpjj.exe upx \??\c:\ffllrxf.exe upx behavioral2/memory/876-118-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pdvpj.exe upx behavioral2/memory/2148-129-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7fxxxxr.exe upx behavioral2/memory/2284-152-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9pvvd.exe upx C:\fxlfxll.exe upx behavioral2/memory/4400-171-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jpddv.exe upx behavioral2/memory/1952-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3716-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1800-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4660-327-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4856-372-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1800-400-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2992-410-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1340-454-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3040-500-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4880-522-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4408-538-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1088-551-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1632-494-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1972-443-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2788-437-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4292-429-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4292-425-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2492-416-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2992-414-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1800-396-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3760-392-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2724-380-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3024-371-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3024-367-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4896-345-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4380-341-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2892-322-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1552-314-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4044-310-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1508-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3660-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2224-277-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4640-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4424-270-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2076-263-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
aa18cb12907c091bdd16e0a48bb34fd2d17ebd3ee1f975bba579120e145fd3bf.exe1ntnbb.exehttntn.exevpvjp.exepdvpp.exexxlrrll.exetnnhtn.exenhthtn.exe9jpjd.exerxfrlrr.exellrfxxl.exebntnnh.exeddddj.exe7dppd.exe9flfrrr.exerllxrrl.exe9bbtnn.exedvpjj.exevpjpd.exeffllrxf.exelfrrxxf.exehbtthh.exedescription pid process target process PID 1080 wrote to memory of 2796 1080 aa18cb12907c091bdd16e0a48bb34fd2d17ebd3ee1f975bba579120e145fd3bf.exe 1ntnbb.exe PID 1080 wrote to memory of 2796 1080 aa18cb12907c091bdd16e0a48bb34fd2d17ebd3ee1f975bba579120e145fd3bf.exe 1ntnbb.exe PID 1080 wrote to memory of 2796 1080 aa18cb12907c091bdd16e0a48bb34fd2d17ebd3ee1f975bba579120e145fd3bf.exe 1ntnbb.exe PID 2796 wrote to memory of 2000 2796 1ntnbb.exe httntn.exe PID 2796 wrote to memory of 2000 2796 1ntnbb.exe httntn.exe PID 2796 wrote to memory of 2000 2796 1ntnbb.exe httntn.exe PID 2000 wrote to memory of 4408 2000 httntn.exe vpvjp.exe PID 2000 wrote to memory of 4408 2000 httntn.exe vpvjp.exe PID 2000 wrote to memory of 4408 2000 httntn.exe vpvjp.exe PID 4408 wrote to memory of 468 4408 vpvjp.exe pdvpp.exe PID 4408 wrote to memory of 468 4408 vpvjp.exe pdvpp.exe PID 4408 wrote to memory of 468 4408 vpvjp.exe pdvpp.exe PID 468 wrote to memory of 3716 468 pdvpp.exe rllllll.exe PID 468 wrote to memory of 3716 468 pdvpp.exe rllllll.exe PID 468 wrote to memory of 3716 468 pdvpp.exe rllllll.exe PID 3716 wrote to memory of 1800 3716 xxlrrll.exe tnnhtn.exe PID 3716 wrote to memory of 1800 3716 xxlrrll.exe tnnhtn.exe PID 3716 wrote to memory of 1800 3716 xxlrrll.exe tnnhtn.exe PID 1800 wrote to memory of 3392 1800 tnnhtn.exe nhthtn.exe PID 1800 wrote to memory of 3392 1800 tnnhtn.exe nhthtn.exe PID 1800 wrote to memory of 3392 1800 tnnhtn.exe nhthtn.exe PID 3392 wrote to memory of 1996 3392 nhthtn.exe 9jpjd.exe PID 3392 wrote to memory of 1996 3392 nhthtn.exe 9jpjd.exe PID 3392 wrote to memory of 1996 3392 nhthtn.exe 9jpjd.exe PID 1996 wrote to memory of 3352 1996 9jpjd.exe rxrxlxl.exe PID 1996 wrote to memory of 3352 1996 9jpjd.exe rxrxlxl.exe PID 1996 wrote to memory of 3352 1996 9jpjd.exe rxrxlxl.exe PID 3352 wrote to memory of 2992 3352 rxfrlrr.exe llrfxxl.exe PID 3352 wrote to memory of 2992 3352 rxfrlrr.exe llrfxxl.exe PID 3352 wrote to memory of 2992 3352 rxfrlrr.exe llrfxxl.exe PID 2992 wrote to memory of 2492 2992 llrfxxl.exe bntnnh.exe PID 2992 wrote to memory of 2492 2992 llrfxxl.exe bntnnh.exe PID 2992 wrote to memory of 2492 2992 llrfxxl.exe bntnnh.exe PID 2492 wrote to memory of 1540 2492 bntnnh.exe ddddj.exe PID 2492 wrote to memory of 1540 2492 bntnnh.exe ddddj.exe PID 2492 wrote to memory of 1540 2492 bntnnh.exe ddddj.exe PID 1540 wrote to memory of 4292 1540 ddddj.exe 7dppd.exe PID 1540 wrote to memory of 4292 1540 ddddj.exe 7dppd.exe PID 1540 wrote to memory of 4292 1540 ddddj.exe 7dppd.exe PID 4292 wrote to memory of 4424 4292 7dppd.exe 9flfrrr.exe PID 4292 wrote to memory of 4424 4292 7dppd.exe 9flfrrr.exe PID 4292 wrote to memory of 4424 4292 7dppd.exe 9flfrrr.exe PID 4424 wrote to memory of 4884 4424 9flfrrr.exe rllxrrl.exe PID 4424 wrote to memory of 4884 4424 9flfrrr.exe rllxrrl.exe PID 4424 wrote to memory of 4884 4424 9flfrrr.exe rllxrrl.exe PID 4884 wrote to memory of 1804 4884 rllxrrl.exe jdpdv.exe PID 4884 wrote to memory of 1804 4884 rllxrrl.exe jdpdv.exe PID 4884 wrote to memory of 1804 4884 rllxrrl.exe jdpdv.exe PID 1804 wrote to memory of 4004 1804 9bbtnn.exe dvpjj.exe PID 1804 wrote to memory of 4004 1804 9bbtnn.exe dvpjj.exe PID 1804 wrote to memory of 4004 1804 9bbtnn.exe dvpjj.exe PID 4004 wrote to memory of 1340 4004 dvpjj.exe vpjpd.exe PID 4004 wrote to memory of 1340 4004 dvpjj.exe vpjpd.exe PID 4004 wrote to memory of 1340 4004 dvpjj.exe vpjpd.exe PID 1340 wrote to memory of 4344 1340 vpjpd.exe ffllrxf.exe PID 1340 wrote to memory of 4344 1340 vpjpd.exe ffllrxf.exe PID 1340 wrote to memory of 4344 1340 vpjpd.exe ffllrxf.exe PID 4344 wrote to memory of 876 4344 ffllrxf.exe lfrrxxf.exe PID 4344 wrote to memory of 876 4344 ffllrxf.exe lfrrxxf.exe PID 4344 wrote to memory of 876 4344 ffllrxf.exe lfrrxxf.exe PID 876 wrote to memory of 2148 876 lfrrxxf.exe hbtthh.exe PID 876 wrote to memory of 2148 876 lfrrxxf.exe hbtthh.exe PID 876 wrote to memory of 2148 876 lfrrxxf.exe hbtthh.exe PID 2148 wrote to memory of 3172 2148 hbtthh.exe pdvpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa18cb12907c091bdd16e0a48bb34fd2d17ebd3ee1f975bba579120e145fd3bf.exe"C:\Users\Admin\AppData\Local\Temp\aa18cb12907c091bdd16e0a48bb34fd2d17ebd3ee1f975bba579120e145fd3bf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\1ntnbb.exec:\1ntnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\httntn.exec:\httntn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\vpvjp.exec:\vpvjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\pdvpp.exec:\pdvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\xxlrrll.exec:\xxlrrll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\tnnhtn.exec:\tnnhtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\nhthtn.exec:\nhthtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\9jpjd.exec:\9jpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\rxfrlrr.exec:\rxfrlrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\llrfxxl.exec:\llrfxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\bntnnh.exec:\bntnnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\ddddj.exec:\ddddj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\7dppd.exec:\7dppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\9flfrrr.exec:\9flfrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\rllxrrl.exec:\rllxrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\9bbtnn.exec:\9bbtnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\dvpjj.exec:\dvpjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\vpjpd.exec:\vpjpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\ffllrxf.exec:\ffllrxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\hbtthh.exec:\hbtthh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\pdvpj.exec:\pdvpj.exe23⤵
- Executes dropped EXE
PID:3172 -
\??\c:\pdjdd.exec:\pdjdd.exe24⤵
- Executes dropped EXE
PID:2044 -
\??\c:\7fxxxxr.exec:\7fxxxxr.exe25⤵
- Executes dropped EXE
PID:4716 -
\??\c:\9thhbb.exec:\9thhbb.exe26⤵
- Executes dropped EXE
PID:2284 -
\??\c:\vvddv.exec:\vvddv.exe27⤵
- Executes dropped EXE
PID:5116 -
\??\c:\9pvvd.exec:\9pvvd.exe28⤵
- Executes dropped EXE
PID:4892 -
\??\c:\fxlfxll.exec:\fxlfxll.exe29⤵
- Executes dropped EXE
PID:684 -
\??\c:\xrflllf.exec:\xrflllf.exe30⤵
- Executes dropped EXE
PID:4400 -
\??\c:\nttnhh.exec:\nttnhh.exe31⤵
- Executes dropped EXE
PID:3984 -
\??\c:\jpddv.exec:\jpddv.exe32⤵
- Executes dropped EXE
PID:1448 -
\??\c:\vddpp.exec:\vddpp.exe33⤵
- Executes dropped EXE
PID:4740 -
\??\c:\lxrlllf.exec:\lxrlllf.exe34⤵
- Executes dropped EXE
PID:3252 -
\??\c:\xrxfxxx.exec:\xrxfxxx.exe35⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nhhttt.exec:\nhhttt.exe36⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pjjpv.exec:\pjjpv.exe37⤵
- Executes dropped EXE
PID:3024 -
\??\c:\jdppp.exec:\jdppp.exe38⤵
- Executes dropped EXE
PID:4444 -
\??\c:\xllrffl.exec:\xllrffl.exe39⤵
- Executes dropped EXE
PID:4420 -
\??\c:\fxrlxxx.exec:\fxrlxxx.exe40⤵
- Executes dropped EXE
PID:1988 -
\??\c:\fxllrrx.exec:\fxllrrx.exe41⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nbbbtt.exec:\nbbbtt.exe42⤵
- Executes dropped EXE
PID:4600 -
\??\c:\jvdpv.exec:\jvdpv.exe43⤵
- Executes dropped EXE
PID:4408 -
\??\c:\jvdjv.exec:\jvdjv.exe44⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rllllll.exec:\rllllll.exe45⤵
- Executes dropped EXE
PID:3716 -
\??\c:\5ffxxff.exec:\5ffxxff.exe46⤵
- Executes dropped EXE
PID:1800 -
\??\c:\tbnhnn.exec:\tbnhnn.exe47⤵
- Executes dropped EXE
PID:3896 -
\??\c:\pvdjp.exec:\pvdjp.exe48⤵
- Executes dropped EXE
PID:1088 -
\??\c:\vpdvp.exec:\vpdvp.exe49⤵
- Executes dropped EXE
PID:5104 -
\??\c:\rxrxlxl.exec:\rxrxlxl.exe50⤵
- Executes dropped EXE
PID:3352 -
\??\c:\hhnnhn.exec:\hhnnhn.exe51⤵
- Executes dropped EXE
PID:244 -
\??\c:\hhhhbb.exec:\hhhhbb.exe52⤵
- Executes dropped EXE
PID:756 -
\??\c:\pdvpd.exec:\pdvpd.exe53⤵
- Executes dropped EXE
PID:2076 -
\??\c:\vppjj.exec:\vppjj.exe54⤵
- Executes dropped EXE
PID:3996 -
\??\c:\xfrxrrr.exec:\xfrxrrr.exe55⤵
- Executes dropped EXE
PID:3948 -
\??\c:\tthbbh.exec:\tthbbh.exe56⤵
- Executes dropped EXE
PID:4424 -
\??\c:\tbnbth.exec:\tbnbth.exe57⤵
- Executes dropped EXE
PID:4640 -
\??\c:\pvppd.exec:\pvppd.exe58⤵
- Executes dropped EXE
PID:2224 -
\??\c:\9pdvv.exec:\9pdvv.exe59⤵
- Executes dropped EXE
PID:3820 -
\??\c:\lrxfllx.exec:\lrxfllx.exe60⤵
- Executes dropped EXE
PID:3660 -
\??\c:\7flrxll.exec:\7flrxll.exe61⤵
- Executes dropped EXE
PID:4372 -
\??\c:\5htntt.exec:\5htntt.exe62⤵
- Executes dropped EXE
PID:1340 -
\??\c:\bbbbhh.exec:\bbbbhh.exe63⤵
- Executes dropped EXE
PID:1508 -
\??\c:\vjppj.exec:\vjppj.exe64⤵
- Executes dropped EXE
PID:364 -
\??\c:\jdjjv.exec:\jdjjv.exe65⤵
- Executes dropped EXE
PID:5080 -
\??\c:\9fffrxr.exec:\9fffrxr.exe66⤵PID:4824
-
\??\c:\ffffxxx.exec:\ffffxxx.exe67⤵PID:3708
-
\??\c:\hhttbn.exec:\hhttbn.exe68⤵PID:4044
-
\??\c:\ntbbnt.exec:\ntbbnt.exe69⤵PID:1552
-
\??\c:\1thhnh.exec:\1thhnh.exe70⤵PID:3200
-
\??\c:\jjddv.exec:\jjddv.exe71⤵PID:2892
-
\??\c:\jdvpp.exec:\jdvpp.exe72⤵PID:5032
-
\??\c:\frrxrff.exec:\frrxrff.exe73⤵PID:4660
-
\??\c:\lrrlllf.exec:\lrrlllf.exe74⤵PID:1632
-
\??\c:\hhhnnn.exec:\hhhnnn.exe75⤵PID:4480
-
\??\c:\hnbnbn.exec:\hnbnbn.exe76⤵PID:3040
-
\??\c:\dpjpp.exec:\dpjpp.exe77⤵PID:4380
-
\??\c:\pjppd.exec:\pjppd.exe78⤵PID:4896
-
\??\c:\lxxrffx.exec:\lxxrffx.exe79⤵PID:1456
-
\??\c:\fffrlfx.exec:\fffrlfx.exe80⤵PID:1812
-
\??\c:\nnnhnt.exec:\nnnhnt.exe81⤵PID:2884
-
\??\c:\tthhbh.exec:\tthhbh.exe82⤵PID:4880
-
\??\c:\btbtnn.exec:\btbtnn.exe83⤵PID:620
-
\??\c:\5pvpp.exec:\5pvpp.exe84⤵PID:3672
-
\??\c:\3ffxrrl.exec:\3ffxrrl.exe85⤵PID:3024
-
\??\c:\fffflll.exec:\fffflll.exe86⤵PID:4856
-
\??\c:\ffffxrf.exec:\ffffxrf.exe87⤵PID:2796
-
\??\c:\thtttt.exec:\thtttt.exe88⤵PID:2724
-
\??\c:\bbtbth.exec:\bbtbth.exe89⤵PID:3540
-
\??\c:\3pdvv.exec:\3pdvv.exe90⤵PID:3400
-
\??\c:\5pdjj.exec:\5pdjj.exe91⤵PID:3760
-
\??\c:\frfxflf.exec:\frfxflf.exe92⤵PID:4796
-
\??\c:\9xxxffx.exec:\9xxxffx.exe93⤵PID:1800
-
\??\c:\ttnhbt.exec:\ttnhbt.exe94⤵PID:2160
-
\??\c:\nbtnhb.exec:\nbtnhb.exe95⤵PID:1652
-
\??\c:\ddddv.exec:\ddddv.exe96⤵PID:4540
-
\??\c:\dvjdj.exec:\dvjdj.exe97⤵PID:2992
-
\??\c:\lfllrxf.exec:\lfllrxf.exe98⤵PID:2492
-
\??\c:\dvjjd.exec:\dvjjd.exe99⤵PID:2204
-
\??\c:\jdpjv.exec:\jdpjv.exe100⤵PID:3648
-
\??\c:\dvjdj.exec:\dvjdj.exe101⤵PID:4292
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe102⤵PID:2040
-
\??\c:\rxlfffx.exec:\rxlfffx.exe103⤵PID:3776
-
\??\c:\tthhtb.exec:\tthhtb.exe104⤵PID:2788
-
\??\c:\7thhhh.exec:\7thhhh.exe105⤵PID:1972
-
\??\c:\vvpvv.exec:\vvpvv.exe106⤵PID:4104
-
\??\c:\9vppj.exec:\9vppj.exe107⤵PID:3660
-
\??\c:\lxxxxxr.exec:\lxxxxxr.exe108⤵PID:4372
-
\??\c:\llxfxrx.exec:\llxfxrx.exe109⤵PID:1340
-
\??\c:\lfxxrxx.exec:\lfxxrxx.exe110⤵PID:1908
-
\??\c:\nttttt.exec:\nttttt.exe111⤵PID:876
-
\??\c:\nbhbtt.exec:\nbhbtt.exe112⤵PID:2212
-
\??\c:\nhhnnb.exec:\nhhnnb.exe113⤵PID:4392
-
\??\c:\jdpdv.exec:\jdpdv.exe114⤵PID:1804
-
\??\c:\vddjj.exec:\vddjj.exe115⤵PID:1688
-
\??\c:\lxffxlf.exec:\lxffxlf.exe116⤵PID:3596
-
\??\c:\lxxfxxr.exec:\lxxfxxr.exe117⤵PID:3324
-
\??\c:\rlxrffr.exec:\rlxrffr.exe118⤵PID:2380
-
\??\c:\nnhhtn.exec:\nnhhtn.exe119⤵PID:428
-
\??\c:\thhnnn.exec:\thhnnn.exe120⤵PID:4888
-
\??\c:\dddvp.exec:\dddvp.exe121⤵PID:516
-
\??\c:\vppvj.exec:\vppvj.exe122⤵PID:1632
-
\??\c:\vjjdv.exec:\vjjdv.exe123⤵PID:4400
-
\??\c:\xrrllll.exec:\xrrllll.exe124⤵PID:3040
-
\??\c:\xlllrrr.exec:\xlllrrr.exe125⤵PID:4404
-
\??\c:\httbbb.exec:\httbbb.exe126⤵PID:4124
-
\??\c:\nhtthh.exec:\nhtthh.exe127⤵PID:1456
-
\??\c:\nthtnh.exec:\nthtnh.exe128⤵PID:3236
-
\??\c:\pjppj.exec:\pjppj.exe129⤵PID:2884
-
\??\c:\ddppp.exec:\ddppp.exe130⤵PID:4880
-
\??\c:\vppdp.exec:\vppdp.exe131⤵PID:4448
-
\??\c:\xxxrlll.exec:\xxxrlll.exe132⤵PID:4444
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe133⤵PID:2432
-
\??\c:\xxlrlrf.exec:\xxlrlrf.exe134⤵PID:468
-
\??\c:\ttbbtt.exec:\ttbbtt.exe135⤵PID:4600
-
\??\c:\9tbbbh.exec:\9tbbbh.exe136⤵PID:4408
-
\??\c:\7bhbbn.exec:\7bhbbn.exe137⤵PID:2356
-
\??\c:\vjpjj.exec:\vjpjj.exe138⤵PID:2192
-
\??\c:\jjjjv.exec:\jjjjv.exe139⤵PID:3804
-
\??\c:\rxllxfx.exec:\rxllxfx.exe140⤵PID:1088
-
\??\c:\3rlfffl.exec:\3rlfffl.exe141⤵PID:2648
-
\??\c:\ffllrrx.exec:\ffllrrx.exe142⤵PID:5104
-
\??\c:\tbnnhn.exec:\tbnnhn.exe143⤵PID:4996
-
\??\c:\bnnnnt.exec:\bnnnnt.exe144⤵PID:2868
-
\??\c:\hnnbtt.exec:\hnnbtt.exe145⤵PID:2604
-
\??\c:\9pvvp.exec:\9pvvp.exe146⤵PID:2076
-
\??\c:\ddjpv.exec:\ddjpv.exe147⤵PID:4836
-
\??\c:\9frrxfl.exec:\9frrxfl.exe148⤵PID:212
-
\??\c:\xrffxll.exec:\xrffxll.exe149⤵PID:3828
-
\??\c:\bbhntn.exec:\bbhntn.exe150⤵PID:1860
-
\??\c:\bbnnhh.exec:\bbnnhh.exe151⤵PID:552
-
\??\c:\pdddv.exec:\pdddv.exe152⤵PID:2916
-
\??\c:\ppjjv.exec:\ppjjv.exe153⤵PID:1912
-
\??\c:\llllffl.exec:\llllffl.exe154⤵PID:3320
-
\??\c:\tntnnn.exec:\tntnnn.exe155⤵PID:912
-
\??\c:\nntttt.exec:\nntttt.exe156⤵PID:736
-
\??\c:\pvddd.exec:\pvddd.exe157⤵PID:1508
-
\??\c:\lfrllll.exec:\lfrllll.exe158⤵PID:1908
-
\??\c:\3ffxxxx.exec:\3ffxxxx.exe159⤵PID:1220
-
\??\c:\tnhntb.exec:\tnhntb.exe160⤵PID:2024
-
\??\c:\hhnnhh.exec:\hhnnhh.exe161⤵PID:4904
-
\??\c:\9djjj.exec:\9djjj.exe162⤵PID:2044
-
\??\c:\rfrfflr.exec:\rfrfflr.exe163⤵PID:1688
-
\??\c:\bntntn.exec:\bntntn.exe164⤵PID:3596
-
\??\c:\5lllrff.exec:\5lllrff.exe165⤵PID:4384
-
\??\c:\5ttnnt.exec:\5ttnnt.exe166⤵PID:2892
-
\??\c:\tntnnt.exec:\tntnnt.exe167⤵PID:4504
-
\??\c:\bhnnhh.exec:\bhnnhh.exe168⤵PID:4684
-
\??\c:\hhtnhn.exec:\hhtnhn.exe169⤵PID:3396
-
\??\c:\dvpvv.exec:\dvpvv.exe170⤵PID:3108
-
\??\c:\vdjpj.exec:\vdjpj.exe171⤵PID:4896
-
\??\c:\xxllfff.exec:\xxllfff.exe172⤵PID:4740
-
\??\c:\5nhnhn.exec:\5nhnhn.exe173⤵PID:4196
-
\??\c:\thbntt.exec:\thbntt.exe174⤵PID:3256
-
\??\c:\dppvd.exec:\dppvd.exe175⤵PID:3376
-
\??\c:\dvjjd.exec:\dvjjd.exe176⤵PID:3024
-
\??\c:\3dvvj.exec:\3dvvj.exe177⤵PID:4016
-
\??\c:\xxllfxx.exec:\xxllfxx.exe178⤵PID:4612
-
\??\c:\ffrxxxf.exec:\ffrxxxf.exe179⤵PID:532
-
\??\c:\bnhtth.exec:\bnhtth.exe180⤵PID:3760
-
\??\c:\5nttth.exec:\5nttth.exe181⤵PID:1996
-
\??\c:\pvddd.exec:\pvddd.exe182⤵PID:3032
-
\??\c:\lxrfxlx.exec:\lxrfxlx.exe183⤵PID:632
-
\??\c:\rlffllx.exec:\rlffllx.exe184⤵PID:3352
-
\??\c:\thhtnb.exec:\thhtnb.exe185⤵PID:992
-
\??\c:\5jvdv.exec:\5jvdv.exe186⤵PID:4924
-
\??\c:\fxxrlrl.exec:\fxxrlrl.exe187⤵PID:4732
-
\??\c:\htnhbt.exec:\htnhbt.exe188⤵PID:2984
-
\??\c:\pjvpj.exec:\pjvpj.exe189⤵PID:408
-
\??\c:\rlxrlxx.exec:\rlxrlxx.exe190⤵PID:1192
-
\??\c:\xxlffff.exec:\xxlffff.exe191⤵PID:3996
-
\??\c:\htnbnt.exec:\htnbnt.exe192⤵PID:4112
-
\??\c:\bntttt.exec:\bntttt.exe193⤵PID:732
-
\??\c:\xfxlffx.exec:\xfxlffx.exe194⤵PID:3020
-
\??\c:\httnhb.exec:\httnhb.exe195⤵PID:3384
-
\??\c:\jjjdv.exec:\jjjdv.exe196⤵PID:5092
-
\??\c:\7xrrflf.exec:\7xrrflf.exe197⤵PID:3320
-
\??\c:\1xxrfrf.exec:\1xxrfrf.exe198⤵PID:1660
-
\??\c:\vdjjp.exec:\vdjjp.exe199⤵PID:716
-
\??\c:\ppddp.exec:\ppddp.exe200⤵PID:1508
-
\??\c:\bnhntt.exec:\bnhntt.exe201⤵PID:1908
-
\??\c:\pjpjd.exec:\pjpjd.exe202⤵PID:1220
-
\??\c:\xrfrfrx.exec:\xrfrfrx.exe203⤵PID:2384
-
\??\c:\btttnn.exec:\btttnn.exe204⤵PID:1172
-
\??\c:\7jpjv.exec:\7jpjv.exe205⤵PID:2408
-
\??\c:\jpppj.exec:\jpppj.exe206⤵PID:1688
-
\??\c:\xlfflrl.exec:\xlfflrl.exe207⤵PID:3288
-
\??\c:\xrlxxlf.exec:\xrlxxlf.exe208⤵PID:4548
-
\??\c:\tnhbhh.exec:\tnhbhh.exe209⤵PID:1216
-
\??\c:\tnnntb.exec:\tnnntb.exe210⤵PID:4684
-
\??\c:\dvvpp.exec:\dvvpp.exe211⤵PID:3108
-
\??\c:\pdddj.exec:\pdddj.exe212⤵PID:4124
-
\??\c:\lfllrll.exec:\lfllrll.exe213⤵PID:1040
-
\??\c:\xxlffxx.exec:\xxlffxx.exe214⤵PID:5044
-
\??\c:\1hhhbb.exec:\1hhhbb.exe215⤵PID:2296
-
\??\c:\1bhbnn.exec:\1bhbnn.exe216⤵PID:3640
-
\??\c:\ntnnhn.exec:\ntnnhn.exe217⤵PID:5108
-
\??\c:\jdddv.exec:\jdddv.exe218⤵PID:1480
-
\??\c:\7vjjp.exec:\7vjjp.exe219⤵PID:4984
-
\??\c:\rrllllf.exec:\rrllllf.exe220⤵PID:3760
-
\??\c:\rlxxrrr.exec:\rlxxrrr.exe221⤵PID:3804
-
\??\c:\bbhhhh.exec:\bbhhhh.exe222⤵PID:4664
-
\??\c:\dvdvv.exec:\dvdvv.exe223⤵PID:2764
-
\??\c:\ddddd.exec:\ddddd.exe224⤵PID:756
-
\??\c:\dvjdv.exec:\dvjdv.exe225⤵PID:436
-
\??\c:\7xfxxxx.exec:\7xfxxxx.exe226⤵PID:2988
-
\??\c:\rlfxxxx.exec:\rlfxxxx.exe227⤵PID:3184
-
\??\c:\nhnhhh.exec:\nhnhhh.exe228⤵PID:2984
-
\??\c:\thtnhh.exec:\thtnhh.exe229⤵PID:3060
-
\??\c:\tnbbtt.exec:\tnbbtt.exe230⤵PID:5036
-
\??\c:\3vppp.exec:\3vppp.exe231⤵PID:4108
-
\??\c:\1vdvj.exec:\1vdvj.exe232⤵PID:1280
-
\??\c:\lfrfxrl.exec:\lfrfxrl.exe233⤵PID:3044
-
\??\c:\xxlllrx.exec:\xxlllrx.exe234⤵PID:4492
-
\??\c:\hnttbn.exec:\hnttbn.exe235⤵PID:1476
-
\??\c:\9vddd.exec:\9vddd.exe236⤵PID:4372
-
\??\c:\ppjjj.exec:\ppjjj.exe237⤵PID:736
-
\??\c:\frrfxrr.exec:\frrfxrr.exe238⤵PID:856
-
\??\c:\rrxrxrf.exec:\rrxrxrf.exe239⤵PID:2120
-
\??\c:\hbbttb.exec:\hbbttb.exe240⤵PID:824
-
\??\c:\9vjjj.exec:\9vjjj.exe241⤵PID:3592
-
\??\c:\pjjjd.exec:\pjjjd.exe242⤵PID:1552