Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 02:31
Behavioral task
behavioral1
Sample
cacb60d73dfa0aeeb7e8951c0a6eed78b23c2bb50bdd884497496e3edefa4bc5.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
cacb60d73dfa0aeeb7e8951c0a6eed78b23c2bb50bdd884497496e3edefa4bc5.exe
-
Size
76KB
-
MD5
93dc6c2e7aa3b775bf64cac6e5e03866
-
SHA1
95001f63e27fb008d9eb2451ecfb0fa6c148ac21
-
SHA256
cacb60d73dfa0aeeb7e8951c0a6eed78b23c2bb50bdd884497496e3edefa4bc5
-
SHA512
96cece46559146c3b41522e9fb35f30bdcc054b863605a0972705c9d2380e9aa4692b5b793b64b7bff885a0ae2d6d6de8e83c04e5f3fb1a7c0c3b88003d20812
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFWoFLAxZhMDzE87T:9hOmTsF93UYfwC6GIoutz5yLpOSDRT
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3524-3-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2032-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/752-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3788-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1592-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/672-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/680-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/864-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4808-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4092-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2840-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4620-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1944-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1384-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1400-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2540-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2096-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2912-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2824-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3324-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/632-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1516-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3052-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3364-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1052-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4120-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1668-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1476-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4240-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1620-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4660-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/376-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2632-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3796-594-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3796-598-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-605-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1052-750-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-766-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3524-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3524-3-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lfrllll.exe UPX behavioral2/memory/4048-9-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bhnhbb.exe UPX behavioral2/memory/2032-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3pvvj.exe UPX behavioral2/memory/4940-19-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\1pppv.exe UPX \??\c:\xxrrlll.exe UPX behavioral2/memory/3496-28-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3bbttt.exe UPX behavioral2/memory/752-34-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7jvpv.exe UPX behavioral2/memory/3788-40-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1612-43-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vvvpp.exe UPX C:\rlrlrxl.exe UPX behavioral2/memory/3036-52-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\flfrlrl.exe UPX behavioral2/memory/1592-58-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tnnhbb.exe UPX behavioral2/memory/672-63-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/680-68-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3jvpj.exe UPX behavioral2/memory/864-74-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\fxfrrff.exe UPX behavioral2/memory/4808-79-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3bbhhh.exe UPX C:\1jpvv.exe UPX behavioral2/memory/1528-90-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xrlfffx.exe UPX C:\1fflffx.exe UPX behavioral2/memory/4092-97-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4092-103-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5hbtnh.exe UPX C:\ppvvv.exe UPX C:\fxfxxxr.exe UPX behavioral2/memory/2840-114-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4376-116-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\ffxxlrl.exe UPX C:\bbtttt.exe UPX behavioral2/memory/4620-125-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ntttnn.exe UPX behavioral2/memory/1944-130-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1384-137-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vjvpj.exe UPX behavioral2/memory/4604-140-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xlrlfff.exe UPX behavioral2/memory/968-148-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xrffffl.exe UPX C:\nhnhnn.exe UPX behavioral2/memory/1400-154-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pvddd.exe UPX behavioral2/memory/2540-160-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\dvdvp.exe UPX behavioral2/memory/2140-167-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2096-172-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pjpjv.exe UPX behavioral2/memory/2912-176-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9rrlxlf.exe UPX C:\7llffxx.exe UPX behavioral2/memory/2732-185-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4608-194-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
lfrllll.exebhnhbb.exe3pvvj.exe1pppv.exexxrrlll.exe3bbttt.exe7jvpv.exevvvpp.exerlrlrxl.exeflfrlrl.exetnnhbb.exe3jvpj.exefxfrrff.exe3bbhhh.exe1jpvv.exexrlfffx.exe1fflffx.exe5hbtnh.exeppvvv.exefxfxxxr.exeffxxlrl.exebbtttt.exentttnn.exevjvpj.exexlrlfff.exexrffffl.exenhnhnn.exepvddd.exedvdvp.exepjpjv.exe9rrlxlf.exe7llffxx.exe7ttttb.exethhbbn.exevvppd.exe9frlxxr.exelxxrlrl.exe1hbtbb.exe1dvpd.exerlffxxx.exetntnhh.exenbbttt.exepjvdd.exepjvpj.exexfllfff.exerlfflfr.exe7ttttb.exe9nttnh.exedvvvp.exepjvvv.exe7dppv.exellrrxxx.exetnnnnn.exennthhh.exe1hhhbt.exedpvvp.exefxrlfff.exerrlfxrf.exebnntbt.exepvjdd.exefrrxrxl.exefrxrlll.exethhhbb.exetnnbtt.exepid process 4048 lfrllll.exe 2032 bhnhbb.exe 4940 3pvvj.exe 3496 1pppv.exe 752 xxrrlll.exe 3788 3bbttt.exe 1612 7jvpv.exe 3036 vvvpp.exe 1592 rlrlrxl.exe 672 flfrlrl.exe 680 tnnhbb.exe 864 3jvpj.exe 4808 fxfrrff.exe 3220 3bbhhh.exe 1528 1jpvv.exe 4316 xrlfffx.exe 4092 1fflffx.exe 4328 5hbtnh.exe 2840 ppvvv.exe 4376 fxfxxxr.exe 4620 ffxxlrl.exe 1944 bbtttt.exe 1384 ntttnn.exe 4604 vjvpj.exe 968 xlrlfff.exe 1400 xrffffl.exe 2540 nhnhnn.exe 2140 pvddd.exe 2096 dvdvp.exe 2912 pjpjv.exe 3044 9rrlxlf.exe 2732 7llffxx.exe 1668 7ttttb.exe 4608 thhbbn.exe 2560 vvppd.exe 4920 9frlxxr.exe 2824 lxxrlrl.exe 5052 1hbtbb.exe 2372 1dvpd.exe 380 rlffxxx.exe 4088 tntnhh.exe 392 nbbttt.exe 2764 pjvdd.exe 2276 pjvpj.exe 3584 xfllfff.exe 4824 rlfflfr.exe 632 7ttttb.exe 1516 9nttnh.exe 4572 dvvvp.exe 3052 pjvvv.exe 4808 7dppv.exe 816 llrrxxx.exe 2992 tnnnnn.exe 1920 nnthhh.exe 2280 1hhhbt.exe 3200 dpvvp.exe 3364 fxrlfff.exe 3476 rrlfxrf.exe 1052 bnntbt.exe 4620 pvjdd.exe 4120 frrxrxl.exe 4216 frxrlll.exe 1884 thhhbb.exe 2392 tnnbtt.exe -
Processes:
resource yara_rule behavioral2/memory/3524-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3524-3-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfrllll.exe upx behavioral2/memory/4048-9-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhnhbb.exe upx behavioral2/memory/2032-13-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3pvvj.exe upx behavioral2/memory/4940-19-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1pppv.exe upx \??\c:\xxrrlll.exe upx behavioral2/memory/3496-28-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3bbttt.exe upx behavioral2/memory/752-34-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7jvpv.exe upx behavioral2/memory/3788-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1612-43-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvvpp.exe upx C:\rlrlrxl.exe upx behavioral2/memory/3036-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\flfrlrl.exe upx behavioral2/memory/1592-58-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnnhbb.exe upx behavioral2/memory/672-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/680-68-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3jvpj.exe upx behavioral2/memory/864-74-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxfrrff.exe upx behavioral2/memory/4808-79-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3bbhhh.exe upx C:\1jpvv.exe upx behavioral2/memory/1528-90-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrlfffx.exe upx C:\1fflffx.exe upx behavioral2/memory/4092-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4092-103-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5hbtnh.exe upx C:\ppvvv.exe upx C:\fxfxxxr.exe upx behavioral2/memory/2840-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4376-116-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ffxxlrl.exe upx C:\bbtttt.exe upx behavioral2/memory/4620-125-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ntttnn.exe upx behavioral2/memory/1944-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1384-137-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjvpj.exe upx behavioral2/memory/4604-140-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlrlfff.exe upx behavioral2/memory/968-148-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrffffl.exe upx C:\nhnhnn.exe upx behavioral2/memory/1400-154-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvddd.exe upx behavioral2/memory/2540-160-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dvdvp.exe upx behavioral2/memory/2140-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2096-172-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjpjv.exe upx behavioral2/memory/2912-176-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9rrlxlf.exe upx C:\7llffxx.exe upx behavioral2/memory/2732-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4608-194-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cacb60d73dfa0aeeb7e8951c0a6eed78b23c2bb50bdd884497496e3edefa4bc5.exelfrllll.exebhnhbb.exe3pvvj.exe1pppv.exexxrrlll.exe3bbttt.exe7jvpv.exevvvpp.exerlrlrxl.exeflfrlrl.exetnnhbb.exe3jvpj.exefxfrrff.exe3bbhhh.exe1jpvv.exexrlfffx.exe1fflffx.exe5hbtnh.exeppvvv.exefxfxxxr.exeffxxlrl.exedescription pid process target process PID 3524 wrote to memory of 4048 3524 cacb60d73dfa0aeeb7e8951c0a6eed78b23c2bb50bdd884497496e3edefa4bc5.exe lfrllll.exe PID 3524 wrote to memory of 4048 3524 cacb60d73dfa0aeeb7e8951c0a6eed78b23c2bb50bdd884497496e3edefa4bc5.exe lfrllll.exe PID 3524 wrote to memory of 4048 3524 cacb60d73dfa0aeeb7e8951c0a6eed78b23c2bb50bdd884497496e3edefa4bc5.exe lfrllll.exe PID 4048 wrote to memory of 2032 4048 lfrllll.exe bhnhbb.exe PID 4048 wrote to memory of 2032 4048 lfrllll.exe bhnhbb.exe PID 4048 wrote to memory of 2032 4048 lfrllll.exe bhnhbb.exe PID 2032 wrote to memory of 4940 2032 bhnhbb.exe 3pvvj.exe PID 2032 wrote to memory of 4940 2032 bhnhbb.exe 3pvvj.exe PID 2032 wrote to memory of 4940 2032 bhnhbb.exe 3pvvj.exe PID 4940 wrote to memory of 3496 4940 3pvvj.exe 1pppv.exe PID 4940 wrote to memory of 3496 4940 3pvvj.exe 1pppv.exe PID 4940 wrote to memory of 3496 4940 3pvvj.exe 1pppv.exe PID 3496 wrote to memory of 752 3496 1pppv.exe xxrrlll.exe PID 3496 wrote to memory of 752 3496 1pppv.exe xxrrlll.exe PID 3496 wrote to memory of 752 3496 1pppv.exe xxrrlll.exe PID 752 wrote to memory of 3788 752 xxrrlll.exe 3bbttt.exe PID 752 wrote to memory of 3788 752 xxrrlll.exe 3bbttt.exe PID 752 wrote to memory of 3788 752 xxrrlll.exe 3bbttt.exe PID 3788 wrote to memory of 1612 3788 3bbttt.exe 7jvpv.exe PID 3788 wrote to memory of 1612 3788 3bbttt.exe 7jvpv.exe PID 3788 wrote to memory of 1612 3788 3bbttt.exe 7jvpv.exe PID 1612 wrote to memory of 3036 1612 7jvpv.exe vvvpp.exe PID 1612 wrote to memory of 3036 1612 7jvpv.exe vvvpp.exe PID 1612 wrote to memory of 3036 1612 7jvpv.exe vvvpp.exe PID 3036 wrote to memory of 1592 3036 vvvpp.exe rlrlrxl.exe PID 3036 wrote to memory of 1592 3036 vvvpp.exe rlrlrxl.exe PID 3036 wrote to memory of 1592 3036 vvvpp.exe rlrlrxl.exe PID 1592 wrote to memory of 672 1592 rlrlrxl.exe flfrlrl.exe PID 1592 wrote to memory of 672 1592 rlrlrxl.exe flfrlrl.exe PID 1592 wrote to memory of 672 1592 rlrlrxl.exe flfrlrl.exe PID 672 wrote to memory of 680 672 flfrlrl.exe tnnhbb.exe PID 672 wrote to memory of 680 672 flfrlrl.exe tnnhbb.exe PID 672 wrote to memory of 680 672 flfrlrl.exe tnnhbb.exe PID 680 wrote to memory of 864 680 tnnhbb.exe 3jvpj.exe PID 680 wrote to memory of 864 680 tnnhbb.exe 3jvpj.exe PID 680 wrote to memory of 864 680 tnnhbb.exe 3jvpj.exe PID 864 wrote to memory of 4808 864 3jvpj.exe fxfrrff.exe PID 864 wrote to memory of 4808 864 3jvpj.exe fxfrrff.exe PID 864 wrote to memory of 4808 864 3jvpj.exe fxfrrff.exe PID 4808 wrote to memory of 3220 4808 fxfrrff.exe 3bbhhh.exe PID 4808 wrote to memory of 3220 4808 fxfrrff.exe 3bbhhh.exe PID 4808 wrote to memory of 3220 4808 fxfrrff.exe 3bbhhh.exe PID 3220 wrote to memory of 1528 3220 3bbhhh.exe 1jpvv.exe PID 3220 wrote to memory of 1528 3220 3bbhhh.exe 1jpvv.exe PID 3220 wrote to memory of 1528 3220 3bbhhh.exe 1jpvv.exe PID 1528 wrote to memory of 4316 1528 1jpvv.exe xrlfffx.exe PID 1528 wrote to memory of 4316 1528 1jpvv.exe xrlfffx.exe PID 1528 wrote to memory of 4316 1528 1jpvv.exe xrlfffx.exe PID 4316 wrote to memory of 4092 4316 xrlfffx.exe 1fflffx.exe PID 4316 wrote to memory of 4092 4316 xrlfffx.exe 1fflffx.exe PID 4316 wrote to memory of 4092 4316 xrlfffx.exe 1fflffx.exe PID 4092 wrote to memory of 4328 4092 1fflffx.exe 5hbtnh.exe PID 4092 wrote to memory of 4328 4092 1fflffx.exe 5hbtnh.exe PID 4092 wrote to memory of 4328 4092 1fflffx.exe 5hbtnh.exe PID 4328 wrote to memory of 2840 4328 5hbtnh.exe ppvvv.exe PID 4328 wrote to memory of 2840 4328 5hbtnh.exe ppvvv.exe PID 4328 wrote to memory of 2840 4328 5hbtnh.exe ppvvv.exe PID 2840 wrote to memory of 4376 2840 ppvvv.exe fxfxxxr.exe PID 2840 wrote to memory of 4376 2840 ppvvv.exe fxfxxxr.exe PID 2840 wrote to memory of 4376 2840 ppvvv.exe fxfxxxr.exe PID 4376 wrote to memory of 4620 4376 fxfxxxr.exe ffxxlrl.exe PID 4376 wrote to memory of 4620 4376 fxfxxxr.exe ffxxlrl.exe PID 4376 wrote to memory of 4620 4376 fxfxxxr.exe ffxxlrl.exe PID 4620 wrote to memory of 1944 4620 ffxxlrl.exe bbtttt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cacb60d73dfa0aeeb7e8951c0a6eed78b23c2bb50bdd884497496e3edefa4bc5.exe"C:\Users\Admin\AppData\Local\Temp\cacb60d73dfa0aeeb7e8951c0a6eed78b23c2bb50bdd884497496e3edefa4bc5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\lfrllll.exec:\lfrllll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\bhnhbb.exec:\bhnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\3pvvj.exec:\3pvvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\1pppv.exec:\1pppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\xxrrlll.exec:\xxrrlll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\3bbttt.exec:\3bbttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\7jvpv.exec:\7jvpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\vvvpp.exec:\vvvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\rlrlrxl.exec:\rlrlrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\flfrlrl.exec:\flfrlrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\tnnhbb.exec:\tnnhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\3jvpj.exec:\3jvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\fxfrrff.exec:\fxfrrff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\3bbhhh.exec:\3bbhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\1jpvv.exec:\1jpvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\xrlfffx.exec:\xrlfffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\1fflffx.exec:\1fflffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\5hbtnh.exec:\5hbtnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\ppvvv.exec:\ppvvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\ffxxlrl.exec:\ffxxlrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\bbtttt.exec:\bbtttt.exe23⤵
- Executes dropped EXE
PID:1944 -
\??\c:\ntttnn.exec:\ntttnn.exe24⤵
- Executes dropped EXE
PID:1384 -
\??\c:\vjvpj.exec:\vjvpj.exe25⤵
- Executes dropped EXE
PID:4604 -
\??\c:\xlrlfff.exec:\xlrlfff.exe26⤵
- Executes dropped EXE
PID:968 -
\??\c:\xrffffl.exec:\xrffffl.exe27⤵
- Executes dropped EXE
PID:1400 -
\??\c:\nhnhnn.exec:\nhnhnn.exe28⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pvddd.exec:\pvddd.exe29⤵
- Executes dropped EXE
PID:2140 -
\??\c:\dvdvp.exec:\dvdvp.exe30⤵
- Executes dropped EXE
PID:2096 -
\??\c:\pjpjv.exec:\pjpjv.exe31⤵
- Executes dropped EXE
PID:2912 -
\??\c:\9rrlxlf.exec:\9rrlxlf.exe32⤵
- Executes dropped EXE
PID:3044 -
\??\c:\7llffxx.exec:\7llffxx.exe33⤵
- Executes dropped EXE
PID:2732 -
\??\c:\7ttttb.exec:\7ttttb.exe34⤵
- Executes dropped EXE
PID:1668 -
\??\c:\thhbbn.exec:\thhbbn.exe35⤵
- Executes dropped EXE
PID:4608 -
\??\c:\vvppd.exec:\vvppd.exe36⤵
- Executes dropped EXE
PID:2560 -
\??\c:\9frlxxr.exec:\9frlxxr.exe37⤵
- Executes dropped EXE
PID:4920 -
\??\c:\lxxrlrl.exec:\lxxrlrl.exe38⤵
- Executes dropped EXE
PID:2824 -
\??\c:\1hbtbb.exec:\1hbtbb.exe39⤵
- Executes dropped EXE
PID:5052 -
\??\c:\1dvpd.exec:\1dvpd.exe40⤵
- Executes dropped EXE
PID:2372 -
\??\c:\fxlfllr.exec:\fxlfllr.exe41⤵PID:3324
-
\??\c:\rlffxxx.exec:\rlffxxx.exe42⤵
- Executes dropped EXE
PID:380 -
\??\c:\tntnhh.exec:\tntnhh.exe43⤵
- Executes dropped EXE
PID:4088 -
\??\c:\nbbttt.exec:\nbbttt.exe44⤵
- Executes dropped EXE
PID:392 -
\??\c:\pjvdd.exec:\pjvdd.exe45⤵
- Executes dropped EXE
PID:2764 -
\??\c:\pjvpj.exec:\pjvpj.exe46⤵
- Executes dropped EXE
PID:2276 -
\??\c:\xfllfff.exec:\xfllfff.exe47⤵
- Executes dropped EXE
PID:3584 -
\??\c:\rlfflfr.exec:\rlfflfr.exe48⤵
- Executes dropped EXE
PID:4824 -
\??\c:\7ttttb.exec:\7ttttb.exe49⤵
- Executes dropped EXE
PID:632 -
\??\c:\9nttnh.exec:\9nttnh.exe50⤵
- Executes dropped EXE
PID:1516 -
\??\c:\dvvvp.exec:\dvvvp.exe51⤵
- Executes dropped EXE
PID:4572 -
\??\c:\pjvvv.exec:\pjvvv.exe52⤵
- Executes dropped EXE
PID:3052 -
\??\c:\7dppv.exec:\7dppv.exe53⤵
- Executes dropped EXE
PID:4808 -
\??\c:\llrrxxx.exec:\llrrxxx.exe54⤵
- Executes dropped EXE
PID:816 -
\??\c:\tnnnnn.exec:\tnnnnn.exe55⤵
- Executes dropped EXE
PID:2992 -
\??\c:\nnthhh.exec:\nnthhh.exe56⤵
- Executes dropped EXE
PID:1920 -
\??\c:\1hhhbt.exec:\1hhhbt.exe57⤵
- Executes dropped EXE
PID:2280 -
\??\c:\dpvvp.exec:\dpvvp.exe58⤵
- Executes dropped EXE
PID:3200 -
\??\c:\fxrlfff.exec:\fxrlfff.exe59⤵
- Executes dropped EXE
PID:3364 -
\??\c:\rrlfxrf.exec:\rrlfxrf.exe60⤵
- Executes dropped EXE
PID:3476 -
\??\c:\bnntbt.exec:\bnntbt.exe61⤵
- Executes dropped EXE
PID:1052 -
\??\c:\pvjdd.exec:\pvjdd.exe62⤵
- Executes dropped EXE
PID:4620 -
\??\c:\frrxrxl.exec:\frrxrxl.exe63⤵
- Executes dropped EXE
PID:4120 -
\??\c:\frxrlll.exec:\frxrlll.exe64⤵
- Executes dropped EXE
PID:4216 -
\??\c:\thhhbb.exec:\thhhbb.exe65⤵
- Executes dropped EXE
PID:1884 -
\??\c:\tnnbtt.exec:\tnnbtt.exe66⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jjdjd.exec:\jjdjd.exe67⤵PID:2004
-
\??\c:\dvvpp.exec:\dvvpp.exe68⤵PID:992
-
\??\c:\xlfflrr.exec:\xlfflrr.exe69⤵PID:1576
-
\??\c:\bhnntt.exec:\bhnntt.exe70⤵PID:4084
-
\??\c:\bnttbh.exec:\bnttbh.exe71⤵PID:4136
-
\??\c:\3djpv.exec:\3djpv.exe72⤵PID:3256
-
\??\c:\vjpjd.exec:\vjpjd.exe73⤵PID:1996
-
\??\c:\rfllrxx.exec:\rfllrxx.exe74⤵PID:4284
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe75⤵PID:1880
-
\??\c:\htbbbb.exec:\htbbbb.exe76⤵PID:3628
-
\??\c:\nbhbtt.exec:\nbhbtt.exe77⤵PID:4844
-
\??\c:\vpvpp.exec:\vpvpp.exe78⤵PID:840
-
\??\c:\fflfxlx.exec:\fflfxlx.exe79⤵PID:1668
-
\??\c:\flrrlll.exec:\flrrlll.exe80⤵PID:1476
-
\??\c:\bbnnhn.exec:\bbnnhn.exe81⤵PID:3020
-
\??\c:\hbbttt.exec:\hbbttt.exe82⤵PID:216
-
\??\c:\vvjdv.exec:\vvjdv.exe83⤵PID:4240
-
\??\c:\lxxrfff.exec:\lxxrfff.exe84⤵PID:4580
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe85⤵PID:4036
-
\??\c:\btbtnn.exec:\btbtnn.exe86⤵PID:1048
-
\??\c:\htbbtb.exec:\htbbtb.exe87⤵PID:4720
-
\??\c:\vpjjd.exec:\vpjjd.exe88⤵PID:3496
-
\??\c:\djvpp.exec:\djvpp.exe89⤵PID:1956
-
\??\c:\frfxrrx.exec:\frfxrrx.exe90⤵PID:2880
-
\??\c:\bhthhh.exec:\bhthhh.exe91⤵PID:5036
-
\??\c:\bnhbtn.exec:\bnhbtn.exe92⤵PID:620
-
\??\c:\jddvv.exec:\jddvv.exe93⤵PID:852
-
\??\c:\flllxlf.exec:\flllxlf.exe94⤵PID:1260
-
\??\c:\3nnhbh.exec:\3nnhbh.exe95⤵PID:2696
-
\??\c:\tttnnn.exec:\tttnnn.exe96⤵PID:5068
-
\??\c:\jjppp.exec:\jjppp.exe97⤵PID:3568
-
\??\c:\1xrfxff.exec:\1xrfxff.exe98⤵PID:1620
-
\??\c:\5lxrrrr.exec:\5lxrrrr.exe99⤵PID:872
-
\??\c:\thnntt.exec:\thnntt.exe100⤵PID:1396
-
\??\c:\jddjd.exec:\jddjd.exe101⤵PID:5020
-
\??\c:\3dpjj.exec:\3dpjj.exe102⤵PID:876
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe103⤵PID:1060
-
\??\c:\9nbtnn.exec:\9nbtnn.exe104⤵PID:4172
-
\??\c:\bbnnnt.exec:\bbnnnt.exe105⤵PID:4664
-
\??\c:\ddppp.exec:\ddppp.exe106⤵PID:816
-
\??\c:\5flfxxr.exec:\5flfxxr.exe107⤵PID:3580
-
\??\c:\rfflfrx.exec:\rfflfrx.exe108⤵PID:4660
-
\??\c:\bhtbbb.exec:\bhtbbb.exe109⤵PID:2280
-
\??\c:\jjvvp.exec:\jjvvp.exe110⤵PID:376
-
\??\c:\lxrrflf.exec:\lxrrflf.exe111⤵PID:1504
-
\??\c:\xrxrllf.exec:\xrxrllf.exe112⤵PID:64
-
\??\c:\ttbbhh.exec:\ttbbhh.exe113⤵PID:4348
-
\??\c:\pjdpj.exec:\pjdpj.exe114⤵PID:4708
-
\??\c:\vjpdp.exec:\vjpdp.exe115⤵PID:1840
-
\??\c:\xrfrrlf.exec:\xrfrrlf.exe116⤵PID:3180
-
\??\c:\rxfxrrx.exec:\rxfxrrx.exe117⤵PID:4604
-
\??\c:\1bhhhh.exec:\1bhhhh.exe118⤵PID:2632
-
\??\c:\3jpjv.exec:\3jpjv.exe119⤵PID:2100
-
\??\c:\pvjdd.exec:\pvjdd.exe120⤵PID:4124
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe121⤵PID:4852
-
\??\c:\nhbbtb.exec:\nhbbtb.exe122⤵PID:2296
-
\??\c:\nhbnth.exec:\nhbnth.exe123⤵PID:2476
-
\??\c:\bhhbnn.exec:\bhhbnn.exe124⤵PID:1752
-
\??\c:\3jpjj.exec:\3jpjj.exe125⤵PID:1916
-
\??\c:\vvvpj.exec:\vvvpj.exe126⤵PID:4712
-
\??\c:\xrlfrfx.exec:\xrlfrfx.exe127⤵PID:388
-
\??\c:\xrllxxr.exec:\xrllxxr.exe128⤵PID:2468
-
\??\c:\thnnhh.exec:\thnnhh.exe129⤵PID:316
-
\??\c:\7bbttt.exec:\7bbttt.exe130⤵PID:1640
-
\??\c:\jjdjd.exec:\jjdjd.exe131⤵PID:2700
-
\??\c:\xrllrxl.exec:\xrllrxl.exe132⤵PID:1172
-
\??\c:\llllfrr.exec:\llllfrr.exe133⤵PID:2372
-
\??\c:\hhbhbn.exec:\hhbhbn.exe134⤵PID:1632
-
\??\c:\htthht.exec:\htthht.exe135⤵PID:3292
-
\??\c:\ppjpd.exec:\ppjpd.exe136⤵PID:4128
-
\??\c:\3jjvj.exec:\3jjvj.exe137⤵PID:4940
-
\??\c:\lrrfxrl.exec:\lrrfxrl.exe138⤵PID:1352
-
\??\c:\xfxxrfx.exec:\xfxxrfx.exe139⤵PID:3008
-
\??\c:\nnhbth.exec:\nnhbth.exe140⤵PID:4560
-
\??\c:\5bnhtn.exec:\5bnhtn.exe141⤵PID:2720
-
\??\c:\thnbbt.exec:\thnbbt.exe142⤵PID:3400
-
\??\c:\7hhbbb.exec:\7hhbbb.exe143⤵PID:620
-
\??\c:\9djjv.exec:\9djjv.exe144⤵PID:852
-
\??\c:\3flxllf.exec:\3flxllf.exe145⤵PID:2612
-
\??\c:\lxxfxfx.exec:\lxxfxfx.exe146⤵PID:4960
-
\??\c:\5hbnbt.exec:\5hbnbt.exe147⤵PID:4572
-
\??\c:\pvvvp.exec:\pvvvp.exe148⤵PID:2756
-
\??\c:\rlfxxxr.exec:\rlfxxxr.exe149⤵PID:672
-
\??\c:\rrxflxf.exec:\rrxflxf.exe150⤵PID:2044
-
\??\c:\httnbb.exec:\httnbb.exe151⤵PID:864
-
\??\c:\pvdjp.exec:\pvdjp.exe152⤵PID:4004
-
\??\c:\pjpjv.exec:\pjpjv.exe153⤵PID:628
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe154⤵PID:5000
-
\??\c:\ffrrrff.exec:\ffrrrff.exe155⤵PID:3544
-
\??\c:\flxfrfr.exec:\flxfrfr.exe156⤵PID:1268
-
\??\c:\bbbbbb.exec:\bbbbbb.exe157⤵PID:2456
-
\??\c:\1ppvp.exec:\1ppvp.exe158⤵PID:3796
-
\??\c:\3dppj.exec:\3dppj.exe159⤵PID:3456
-
\??\c:\llflxxl.exec:\llflxxl.exe160⤵PID:2280
-
\??\c:\rlrxxff.exec:\rlrxxff.exe161⤵PID:2368
-
\??\c:\nnbtbt.exec:\nnbtbt.exe162⤵PID:1504
-
\??\c:\tnbtnn.exec:\tnbtnn.exe163⤵PID:3760
-
\??\c:\pppdp.exec:\pppdp.exe164⤵PID:4120
-
\??\c:\lrfxrxr.exec:\lrfxrxr.exe165⤵PID:3672
-
\??\c:\7lrrllf.exec:\7lrrllf.exe166⤵PID:968
-
\??\c:\bnhntb.exec:\bnhntb.exe167⤵PID:4320
-
\??\c:\9btnnb.exec:\9btnnb.exe168⤵PID:1896
-
\??\c:\3vdvp.exec:\3vdvp.exe169⤵PID:3780
-
\??\c:\jvvjv.exec:\jvvjv.exe170⤵PID:3272
-
\??\c:\9rxrrxx.exec:\9rxrrxx.exe171⤵PID:1292
-
\??\c:\7xfrrrr.exec:\7xfrrrr.exe172⤵PID:1908
-
\??\c:\hbbbtt.exec:\hbbbtt.exe173⤵PID:3044
-
\??\c:\1ddvv.exec:\1ddvv.exe174⤵PID:3972
-
\??\c:\jvjdv.exec:\jvjdv.exe175⤵PID:2056
-
\??\c:\vjppv.exec:\vjppv.exe176⤵PID:2824
-
\??\c:\rlflllx.exec:\rlflllx.exe177⤵PID:4464
-
\??\c:\xrllrfl.exec:\xrllrfl.exe178⤵PID:3460
-
\??\c:\ttttnn.exec:\ttttnn.exe179⤵PID:4564
-
\??\c:\dvjjj.exec:\dvjjj.exe180⤵PID:4312
-
\??\c:\5flffll.exec:\5flffll.exe181⤵PID:1048
-
\??\c:\xrlrxlr.exec:\xrlrxlr.exe182⤵PID:392
-
\??\c:\ntbhhh.exec:\ntbhhh.exe183⤵PID:2764
-
\??\c:\dvjjp.exec:\dvjjp.exe184⤵PID:228
-
\??\c:\lrrxlxr.exec:\lrrxlxr.exe185⤵PID:3988
-
\??\c:\bbbhbn.exec:\bbbhbn.exe186⤵PID:532
-
\??\c:\5pppp.exec:\5pppp.exe187⤵PID:1684
-
\??\c:\vdjdd.exec:\vdjdd.exe188⤵PID:4820
-
\??\c:\7frxxlr.exec:\7frxxlr.exe189⤵PID:536
-
\??\c:\frrxrrr.exec:\frrxrrr.exe190⤵PID:1260
-
\??\c:\nnnhbn.exec:\nnnhbn.exe191⤵PID:2696
-
\??\c:\1bhhbb.exec:\1bhhbb.exe192⤵PID:5068
-
\??\c:\7pdvj.exec:\7pdvj.exe193⤵PID:3568
-
\??\c:\pppjd.exec:\pppjd.exe194⤵PID:1768
-
\??\c:\xfrlllf.exec:\xfrlllf.exe195⤵PID:1396
-
\??\c:\xllrrrr.exec:\xllrrrr.exe196⤵PID:1284
-
\??\c:\nhnttt.exec:\nhnttt.exe197⤵PID:864
-
\??\c:\htnntt.exec:\htnntt.exe198⤵PID:4004
-
\??\c:\pvjdd.exec:\pvjdd.exe199⤵PID:628
-
\??\c:\vpvpj.exec:\vpvpj.exe200⤵PID:2984
-
\??\c:\1rlfxrf.exec:\1rlfxrf.exe201⤵PID:4788
-
\??\c:\fllrfxl.exec:\fllrfxl.exe202⤵PID:3048
-
\??\c:\ttbbhh.exec:\ttbbhh.exe203⤵PID:4380
-
\??\c:\hthnhn.exec:\hthnhn.exe204⤵PID:2844
-
\??\c:\1tttnn.exec:\1tttnn.exe205⤵PID:4376
-
\??\c:\ddvpd.exec:\ddvpd.exe206⤵PID:4768
-
\??\c:\vpppd.exec:\vpppd.exe207⤵PID:1420
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe208⤵PID:1052
-
\??\c:\fxfffrr.exec:\fxfffrr.exe209⤵PID:4348
-
\??\c:\9tnbtt.exec:\9tnbtt.exe210⤵PID:2124
-
\??\c:\httnhb.exec:\httnhb.exe211⤵PID:3180
-
\??\c:\1pjvd.exec:\1pjvd.exe212⤵PID:2000
-
\??\c:\vjjdv.exec:\vjjdv.exe213⤵PID:1660
-
\??\c:\xflfxrf.exec:\xflfxrf.exe214⤵PID:1896
-
\??\c:\1ntbnn.exec:\1ntbnn.exe215⤵PID:3780
-
\??\c:\vpjjd.exec:\vpjjd.exe216⤵PID:2476
-
\??\c:\vvjjj.exec:\vvjjj.exe217⤵PID:3628
-
\??\c:\nhbntn.exec:\nhbntn.exe218⤵PID:1908
-
\??\c:\3vjvj.exec:\3vjvj.exe219⤵PID:388
-
\??\c:\9jdjv.exec:\9jdjv.exe220⤵PID:3972
-
\??\c:\lfxlfxx.exec:\lfxlfxx.exe221⤵PID:4880
-
\??\c:\tnhbnn.exec:\tnhbnn.exe222⤵PID:1304
-
\??\c:\pddjj.exec:\pddjj.exe223⤵PID:4048
-
\??\c:\lrxfrrl.exec:\lrxfrrl.exe224⤵PID:4352
-
\??\c:\lfllrlr.exec:\lfllrlr.exe225⤵PID:2752
-
\??\c:\hthnnn.exec:\hthnnn.exe226⤵PID:4312
-
\??\c:\djppj.exec:\djppj.exe227⤵PID:4940
-
\??\c:\flrfffx.exec:\flrfffx.exe228⤵PID:2792
-
\??\c:\7lrlxxl.exec:\7lrlxxl.exe229⤵PID:2764
-
\??\c:\5tbttt.exec:\5tbttt.exe230⤵PID:4360
-
\??\c:\jdjvj.exec:\jdjvj.exe231⤵PID:4796
-
\??\c:\djpjj.exec:\djpjj.exe232⤵PID:3584
-
\??\c:\xlllfxr.exec:\xlllfxr.exe233⤵PID:2428
-
\??\c:\btnnhh.exec:\btnnhh.exe234⤵PID:4820
-
\??\c:\bnnnnt.exec:\bnnnnt.exe235⤵PID:1728
-
\??\c:\7pjvj.exec:\7pjvj.exe236⤵PID:932
-
\??\c:\pdddp.exec:\pdddp.exe237⤵PID:1992
-
\??\c:\rxxxrxx.exec:\rxxxrxx.exe238⤵PID:3060
-
\??\c:\nnnnht.exec:\nnnnht.exe239⤵PID:672
-
\??\c:\9hbtnh.exec:\9hbtnh.exe240⤵PID:872
-
\??\c:\dpddd.exec:\dpddd.exe241⤵PID:1204
-
\??\c:\xflfxxr.exec:\xflfxxr.exe242⤵PID:4912