Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 21:32
Behavioral task
behavioral1
Sample
401d53c2cfdb012d2df7cb50c22e26fdf65ce054a7e72265e6151473c0fe9a64.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
401d53c2cfdb012d2df7cb50c22e26fdf65ce054a7e72265e6151473c0fe9a64.exe
-
Size
367KB
-
MD5
617065ed1a10d50c0cca41b980b5ef39
-
SHA1
199ed43735a0d36745f9361023817af056f46297
-
SHA256
401d53c2cfdb012d2df7cb50c22e26fdf65ce054a7e72265e6151473c0fe9a64
-
SHA512
56e15f560e1606f9ed4952f3ad4afe3288a878e7a76057516a1d519c953243d909224ef23369e691cfb7bc541acd816c6abad5d4ff2879f0f34db52716387849
-
SSDEEP
6144:9cm4FmowdHoSdSyEAxyx/ZrTTr4qIMgE8Z:/4wFHoSQuxy3rTXIM18Z
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/616-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3796-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1540-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4196-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3356-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1564-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2164-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3444-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3308-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3664-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2168-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1788-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1728-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3336-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3008-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2704-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1352-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/732-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1868-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1124-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/944-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1092-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4548-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/880-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1628-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4272-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4216-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1148-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1500-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3640-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3668-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-541-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-609-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1080-628-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-650-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-701-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2168-726-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1868-755-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-1015-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-1045-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-1086-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/616-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vjpdd.exe UPX behavioral2/memory/3796-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hbhnnb.exe UPX behavioral2/memory/3796-11-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\dvppj.exe UPX behavioral2/memory/1540-20-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\djpvp.exe UPX behavioral2/memory/4196-25-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\rxfxrll.exe UPX C:\tnnnnt.exe UPX \??\c:\pdjdv.exe UPX \??\c:\vjppp.exe UPX \??\c:\xfllffx.exe UPX \??\c:\7ntbtb.exe UPX \??\c:\bthntt.exe UPX \??\c:\vdjdv.exe UPX behavioral2/memory/4700-101-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3616-132-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3356-159-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\tntntn.exe UPX behavioral2/memory/3988-191-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1564-275-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2164-294-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3444-289-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3308-280-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3664-272-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4048-267-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3292-260-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4992-254-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2168-250-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1788-245-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1728-235-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3336-228-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3008-225-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4552-217-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2704-195-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\7jjpp.exe UPX behavioral2/memory/1352-177-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\9btnnn.exe UPX behavioral2/memory/4088-171-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\flfllrx.exe UPX behavioral2/memory/732-166-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\dpvvp.exe UPX \??\c:\jpvpp.exe UPX behavioral2/memory/1868-153-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\tntnbb.exe UPX \??\c:\tbnhnn.exe UPX \??\c:\frrllff.exe UPX behavioral2/memory/4788-137-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\rxllffx.exe UPX \??\c:\dvjdd.exe UPX behavioral2/memory/4372-125-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\5nnbtb.exe UPX behavioral2/memory/1124-119-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\nhtnhh.exe UPX behavioral2/memory/4364-114-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\xxlrflx.exe UPX behavioral2/memory/3260-107-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\jdjjd.exe UPX \??\c:\7vpjp.exe UPX behavioral2/memory/4912-95-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\7thbbb.exe UPX behavioral2/memory/1356-89-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
vjpdd.exehbhnnb.exedvppj.exedjpvp.exerxfxrll.exetnnnnt.exepdjdv.exevjppp.exexfllffx.exe7ntbtb.exebthntt.exevdjdv.exe9pppj.exe1ffffll.exe7bhhbb.exe7thbbb.exe7vpjp.exejdjjd.exexxlrflx.exenhtnhh.exe5nnbtb.exedvjdd.exerxllffx.exefrrllff.exetbnhnn.exetntnbb.exejpvpp.exedpvvp.exeflfllrx.exe9btnnn.exetntntn.exe7jjpp.exe7jjdv.exe3lffxff.exenhnhhh.exethnnhh.exepjvpj.exevvddd.exelxrlrfl.exethhhhb.exetbbtnn.exedjpjj.exe7lrllll.exelfxrllf.exetnhbhh.exe7tthnt.exedpvpp.exefflfffx.exexrrlflf.exehnbbtn.exe3vdvj.exejjjjj.exelfrrxrx.exellrllfr.exenhttbn.exe7jdvv.exepvddd.exerflrllf.exerxfffxr.exenbbnnn.exe7jdjd.exedpjvp.exe1ffxrxr.exebntnnb.exepid process 3796 vjpdd.exe 4272 hbhnnb.exe 1540 dvppj.exe 4196 djpvp.exe 1628 rxfxrll.exe 880 tnnnnt.exe 4428 pdjdv.exe 1728 vjppp.exe 1092 xfllffx.exe 944 7ntbtb.exe 4892 bthntt.exe 4284 vdjdv.exe 3668 9pppj.exe 1356 1ffffll.exe 4912 7bhhbb.exe 4700 7thbbb.exe 3260 7vpjp.exe 4364 jdjjd.exe 1124 xxlrflx.exe 4372 nhtnhh.exe 3616 5nnbtb.exe 4788 dvjdd.exe 636 rxllffx.exe 3980 frrllff.exe 1868 tbnhnn.exe 3356 tntnbb.exe 732 jpvpp.exe 4088 dpvvp.exe 1352 flfllrx.exe 60 9btnnn.exe 2004 tntntn.exe 3988 7jjpp.exe 2704 7jjdv.exe 4712 3lffxff.exe 1984 nhnhhh.exe 4488 thnnhh.exe 2660 pjvpj.exe 3204 vvddd.exe 4704 lxrlrfl.exe 4552 thhhhb.exe 1488 tbbtnn.exe 3008 djpjj.exe 3336 7lrllll.exe 4920 lfxrllf.exe 1728 tnhbhh.exe 3632 7tthnt.exe 1012 dpvpp.exe 1788 fflfffx.exe 2168 xrrlflf.exe 4992 hnbbtn.exe 384 3vdvj.exe 3292 jjjjj.exe 4848 lfrrxrx.exe 4048 llrllfr.exe 3664 nhttbn.exe 1564 7jdvv.exe 3308 pvddd.exe 3616 rflrllf.exe 1160 rxfffxr.exe 3444 nbbnnn.exe 2352 7jdjd.exe 2164 dpjvp.exe 436 1ffxrxr.exe 3724 bntnnb.exe -
Processes:
resource yara_rule behavioral2/memory/616-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjpdd.exe upx behavioral2/memory/3796-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbhnnb.exe upx behavioral2/memory/3796-11-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvppj.exe upx behavioral2/memory/1540-20-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djpvp.exe upx behavioral2/memory/4196-25-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rxfxrll.exe upx C:\tnnnnt.exe upx \??\c:\pdjdv.exe upx \??\c:\vjppp.exe upx \??\c:\xfllffx.exe upx \??\c:\7ntbtb.exe upx \??\c:\bthntt.exe upx \??\c:\vdjdv.exe upx behavioral2/memory/4700-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3616-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3356-159-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tntntn.exe upx behavioral2/memory/3988-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1564-275-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2164-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3444-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3308-280-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3664-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4048-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3292-260-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4992-254-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2168-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1788-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1728-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3336-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3008-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4552-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2704-195-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7jjpp.exe upx behavioral2/memory/1352-177-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9btnnn.exe upx behavioral2/memory/4088-171-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\flfllrx.exe upx behavioral2/memory/732-166-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dpvvp.exe upx \??\c:\jpvpp.exe upx behavioral2/memory/1868-153-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tntnbb.exe upx \??\c:\tbnhnn.exe upx \??\c:\frrllff.exe upx behavioral2/memory/4788-137-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rxllffx.exe upx \??\c:\dvjdd.exe upx behavioral2/memory/4372-125-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5nnbtb.exe upx behavioral2/memory/1124-119-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhtnhh.exe upx behavioral2/memory/4364-114-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xxlrflx.exe upx behavioral2/memory/3260-107-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdjjd.exe upx \??\c:\7vpjp.exe upx behavioral2/memory/4912-95-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7thbbb.exe upx behavioral2/memory/1356-89-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
401d53c2cfdb012d2df7cb50c22e26fdf65ce054a7e72265e6151473c0fe9a64.exevjpdd.exehbhnnb.exedvppj.exedjpvp.exerxfxrll.exetnnnnt.exepdjdv.exevjppp.exexfllffx.exe7ntbtb.exebthntt.exevdjdv.exe9pppj.exe1ffffll.exe7bhhbb.exe7thbbb.exe7vpjp.exejdjjd.exexxlrflx.exenhtnhh.exe5nnbtb.exedescription pid process target process PID 616 wrote to memory of 3796 616 401d53c2cfdb012d2df7cb50c22e26fdf65ce054a7e72265e6151473c0fe9a64.exe vjpdd.exe PID 616 wrote to memory of 3796 616 401d53c2cfdb012d2df7cb50c22e26fdf65ce054a7e72265e6151473c0fe9a64.exe vjpdd.exe PID 616 wrote to memory of 3796 616 401d53c2cfdb012d2df7cb50c22e26fdf65ce054a7e72265e6151473c0fe9a64.exe vjpdd.exe PID 3796 wrote to memory of 4272 3796 vjpdd.exe hbhnnb.exe PID 3796 wrote to memory of 4272 3796 vjpdd.exe hbhnnb.exe PID 3796 wrote to memory of 4272 3796 vjpdd.exe hbhnnb.exe PID 4272 wrote to memory of 1540 4272 hbhnnb.exe dvppj.exe PID 4272 wrote to memory of 1540 4272 hbhnnb.exe dvppj.exe PID 4272 wrote to memory of 1540 4272 hbhnnb.exe dvppj.exe PID 1540 wrote to memory of 4196 1540 dvppj.exe djpvp.exe PID 1540 wrote to memory of 4196 1540 dvppj.exe djpvp.exe PID 1540 wrote to memory of 4196 1540 dvppj.exe djpvp.exe PID 4196 wrote to memory of 1628 4196 djpvp.exe rxfxrll.exe PID 4196 wrote to memory of 1628 4196 djpvp.exe rxfxrll.exe PID 4196 wrote to memory of 1628 4196 djpvp.exe rxfxrll.exe PID 1628 wrote to memory of 880 1628 rxfxrll.exe tnnnnt.exe PID 1628 wrote to memory of 880 1628 rxfxrll.exe tnnnnt.exe PID 1628 wrote to memory of 880 1628 rxfxrll.exe tnnnnt.exe PID 880 wrote to memory of 4428 880 tnnnnt.exe pdjdv.exe PID 880 wrote to memory of 4428 880 tnnnnt.exe pdjdv.exe PID 880 wrote to memory of 4428 880 tnnnnt.exe pdjdv.exe PID 4428 wrote to memory of 1728 4428 pdjdv.exe tnhbhh.exe PID 4428 wrote to memory of 1728 4428 pdjdv.exe tnhbhh.exe PID 4428 wrote to memory of 1728 4428 pdjdv.exe tnhbhh.exe PID 1728 wrote to memory of 1092 1728 vjppp.exe xfllffx.exe PID 1728 wrote to memory of 1092 1728 vjppp.exe xfllffx.exe PID 1728 wrote to memory of 1092 1728 vjppp.exe xfllffx.exe PID 1092 wrote to memory of 944 1092 xfllffx.exe 7ntbtb.exe PID 1092 wrote to memory of 944 1092 xfllffx.exe 7ntbtb.exe PID 1092 wrote to memory of 944 1092 xfllffx.exe 7ntbtb.exe PID 944 wrote to memory of 4892 944 7ntbtb.exe bthntt.exe PID 944 wrote to memory of 4892 944 7ntbtb.exe bthntt.exe PID 944 wrote to memory of 4892 944 7ntbtb.exe bthntt.exe PID 4892 wrote to memory of 4284 4892 bthntt.exe vdjdv.exe PID 4892 wrote to memory of 4284 4892 bthntt.exe vdjdv.exe PID 4892 wrote to memory of 4284 4892 bthntt.exe vdjdv.exe PID 4284 wrote to memory of 3668 4284 vdjdv.exe 9pppj.exe PID 4284 wrote to memory of 3668 4284 vdjdv.exe 9pppj.exe PID 4284 wrote to memory of 3668 4284 vdjdv.exe 9pppj.exe PID 3668 wrote to memory of 1356 3668 9pppj.exe 1ffffll.exe PID 3668 wrote to memory of 1356 3668 9pppj.exe 1ffffll.exe PID 3668 wrote to memory of 1356 3668 9pppj.exe 1ffffll.exe PID 1356 wrote to memory of 4912 1356 1ffffll.exe 7bhhbb.exe PID 1356 wrote to memory of 4912 1356 1ffffll.exe 7bhhbb.exe PID 1356 wrote to memory of 4912 1356 1ffffll.exe 7bhhbb.exe PID 4912 wrote to memory of 4700 4912 7bhhbb.exe 7thbbb.exe PID 4912 wrote to memory of 4700 4912 7bhhbb.exe 7thbbb.exe PID 4912 wrote to memory of 4700 4912 7bhhbb.exe 7thbbb.exe PID 4700 wrote to memory of 3260 4700 7thbbb.exe 7vpjp.exe PID 4700 wrote to memory of 3260 4700 7thbbb.exe 7vpjp.exe PID 4700 wrote to memory of 3260 4700 7thbbb.exe 7vpjp.exe PID 3260 wrote to memory of 4364 3260 7vpjp.exe jdjjd.exe PID 3260 wrote to memory of 4364 3260 7vpjp.exe jdjjd.exe PID 3260 wrote to memory of 4364 3260 7vpjp.exe jdjjd.exe PID 4364 wrote to memory of 1124 4364 jdjjd.exe xxlrflx.exe PID 4364 wrote to memory of 1124 4364 jdjjd.exe xxlrflx.exe PID 4364 wrote to memory of 1124 4364 jdjjd.exe xxlrflx.exe PID 1124 wrote to memory of 4372 1124 xxlrflx.exe nhtnhh.exe PID 1124 wrote to memory of 4372 1124 xxlrflx.exe nhtnhh.exe PID 1124 wrote to memory of 4372 1124 xxlrflx.exe nhtnhh.exe PID 4372 wrote to memory of 3616 4372 nhtnhh.exe rflrllf.exe PID 4372 wrote to memory of 3616 4372 nhtnhh.exe rflrllf.exe PID 4372 wrote to memory of 3616 4372 nhtnhh.exe rflrllf.exe PID 3616 wrote to memory of 4788 3616 5nnbtb.exe dvjdd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\401d53c2cfdb012d2df7cb50c22e26fdf65ce054a7e72265e6151473c0fe9a64.exe"C:\Users\Admin\AppData\Local\Temp\401d53c2cfdb012d2df7cb50c22e26fdf65ce054a7e72265e6151473c0fe9a64.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:616 -
\??\c:\vjpdd.exec:\vjpdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\hbhnnb.exec:\hbhnnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\dvppj.exec:\dvppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\djpvp.exec:\djpvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\rxfxrll.exec:\rxfxrll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\tnnnnt.exec:\tnnnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\pdjdv.exec:\pdjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\vjppp.exec:\vjppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\xfllffx.exec:\xfllffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\7ntbtb.exec:\7ntbtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\bthntt.exec:\bthntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\vdjdv.exec:\vdjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\9pppj.exec:\9pppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\1ffffll.exec:\1ffffll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\7bhhbb.exec:\7bhhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\7thbbb.exec:\7thbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\7vpjp.exec:\7vpjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\jdjjd.exec:\jdjjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\xxlrflx.exec:\xxlrflx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\nhtnhh.exec:\nhtnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\5nnbtb.exec:\5nnbtb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\dvjdd.exec:\dvjdd.exe23⤵
- Executes dropped EXE
PID:4788 -
\??\c:\rxllffx.exec:\rxllffx.exe24⤵
- Executes dropped EXE
PID:636 -
\??\c:\frrllff.exec:\frrllff.exe25⤵
- Executes dropped EXE
PID:3980 -
\??\c:\tbnhnn.exec:\tbnhnn.exe26⤵
- Executes dropped EXE
PID:1868 -
\??\c:\tntnbb.exec:\tntnbb.exe27⤵
- Executes dropped EXE
PID:3356 -
\??\c:\jpvpp.exec:\jpvpp.exe28⤵
- Executes dropped EXE
PID:732 -
\??\c:\dpvvp.exec:\dpvvp.exe29⤵
- Executes dropped EXE
PID:4088 -
\??\c:\flfllrx.exec:\flfllrx.exe30⤵
- Executes dropped EXE
PID:1352 -
\??\c:\9btnnn.exec:\9btnnn.exe31⤵
- Executes dropped EXE
PID:60 -
\??\c:\tntntn.exec:\tntntn.exe32⤵
- Executes dropped EXE
PID:2004 -
\??\c:\7jjpp.exec:\7jjpp.exe33⤵
- Executes dropped EXE
PID:3988 -
\??\c:\7jjdv.exec:\7jjdv.exe34⤵
- Executes dropped EXE
PID:2704 -
\??\c:\3lffxff.exec:\3lffxff.exe35⤵
- Executes dropped EXE
PID:4712 -
\??\c:\nhnhhh.exec:\nhnhhh.exe36⤵
- Executes dropped EXE
PID:1984 -
\??\c:\thnnhh.exec:\thnnhh.exe37⤵
- Executes dropped EXE
PID:4488 -
\??\c:\pjvpj.exec:\pjvpj.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\vvddd.exec:\vvddd.exe39⤵
- Executes dropped EXE
PID:3204 -
\??\c:\lxrlrfl.exec:\lxrlrfl.exe40⤵
- Executes dropped EXE
PID:4704 -
\??\c:\thhhhb.exec:\thhhhb.exe41⤵
- Executes dropped EXE
PID:4552 -
\??\c:\tbbtnn.exec:\tbbtnn.exe42⤵
- Executes dropped EXE
PID:1488 -
\??\c:\djpjj.exec:\djpjj.exe43⤵
- Executes dropped EXE
PID:3008 -
\??\c:\7lrllll.exec:\7lrllll.exe44⤵
- Executes dropped EXE
PID:3336 -
\??\c:\lfxrllf.exec:\lfxrllf.exe45⤵
- Executes dropped EXE
PID:4920 -
\??\c:\tnhbhh.exec:\tnhbhh.exe46⤵
- Executes dropped EXE
PID:1728 -
\??\c:\7tthnt.exec:\7tthnt.exe47⤵
- Executes dropped EXE
PID:3632 -
\??\c:\dpvpp.exec:\dpvpp.exe48⤵
- Executes dropped EXE
PID:1012 -
\??\c:\fflfffx.exec:\fflfffx.exe49⤵
- Executes dropped EXE
PID:1788 -
\??\c:\xrrlflf.exec:\xrrlflf.exe50⤵
- Executes dropped EXE
PID:2168 -
\??\c:\hnbbtn.exec:\hnbbtn.exe51⤵
- Executes dropped EXE
PID:4992 -
\??\c:\3vdvj.exec:\3vdvj.exe52⤵
- Executes dropped EXE
PID:384 -
\??\c:\jjjjj.exec:\jjjjj.exe53⤵
- Executes dropped EXE
PID:3292 -
\??\c:\lfrrxrx.exec:\lfrrxrx.exe54⤵
- Executes dropped EXE
PID:4848 -
\??\c:\llrllfr.exec:\llrllfr.exe55⤵
- Executes dropped EXE
PID:4048 -
\??\c:\nhttbn.exec:\nhttbn.exe56⤵
- Executes dropped EXE
PID:3664 -
\??\c:\7jdvv.exec:\7jdvv.exe57⤵
- Executes dropped EXE
PID:1564 -
\??\c:\pvddd.exec:\pvddd.exe58⤵
- Executes dropped EXE
PID:3308 -
\??\c:\rflrllf.exec:\rflrllf.exe59⤵
- Executes dropped EXE
PID:3616 -
\??\c:\rxfffxr.exec:\rxfffxr.exe60⤵
- Executes dropped EXE
PID:1160 -
\??\c:\nbbnnn.exec:\nbbnnn.exe61⤵
- Executes dropped EXE
PID:3444 -
\??\c:\7jdjd.exec:\7jdjd.exe62⤵
- Executes dropped EXE
PID:2352 -
\??\c:\dpjvp.exec:\dpjvp.exe63⤵
- Executes dropped EXE
PID:2164 -
\??\c:\1ffxrxr.exec:\1ffxrxr.exe64⤵
- Executes dropped EXE
PID:436 -
\??\c:\bntnnb.exec:\bntnnb.exe65⤵
- Executes dropped EXE
PID:3724 -
\??\c:\jdppp.exec:\jdppp.exe66⤵PID:4548
-
\??\c:\fflfxxr.exec:\fflfxxr.exe67⤵PID:2708
-
\??\c:\rllxrlr.exec:\rllxrlr.exe68⤵PID:2232
-
\??\c:\9hhbtt.exec:\9hhbtt.exe69⤵PID:2704
-
\??\c:\3dvvp.exec:\3dvvp.exe70⤵PID:4712
-
\??\c:\lfrfxxx.exec:\lfrfxxx.exe71⤵PID:2360
-
\??\c:\tttnhh.exec:\tttnhh.exe72⤵PID:3796
-
\??\c:\bnbnhh.exec:\bnbnhh.exe73⤵PID:4300
-
\??\c:\jpjdj.exec:\jpjdj.exe74⤵PID:4020
-
\??\c:\lflrllr.exec:\lflrllr.exe75⤵PID:1224
-
\??\c:\bbttnn.exec:\bbttnn.exe76⤵PID:4456
-
\??\c:\nnnbnb.exec:\nnnbnb.exe77⤵PID:4996
-
\??\c:\vdjdv.exec:\vdjdv.exe78⤵PID:2320
-
\??\c:\9xffffx.exec:\9xffffx.exe79⤵PID:5020
-
\??\c:\nntnnn.exec:\nntnnn.exe80⤵PID:1540
-
\??\c:\btbbbb.exec:\btbbbb.exe81⤵PID:1944
-
\??\c:\jdjjv.exec:\jdjjv.exe82⤵PID:4744
-
\??\c:\xrxrllf.exec:\xrxrllf.exe83⤵PID:944
-
\??\c:\btbtbb.exec:\btbtbb.exe84⤵PID:2772
-
\??\c:\bbtnbn.exec:\bbtnbn.exe85⤵PID:2520
-
\??\c:\jdvjj.exec:\jdvjj.exe86⤵PID:2168
-
\??\c:\xlrrlll.exec:\xlrrlll.exe87⤵PID:4216
-
\??\c:\3xxrllf.exec:\3xxrllf.exe88⤵PID:1420
-
\??\c:\5nbttb.exec:\5nbttb.exe89⤵PID:4848
-
\??\c:\1thbbb.exec:\1thbbb.exe90⤵PID:5076
-
\??\c:\7jvvj.exec:\7jvvj.exe91⤵PID:4372
-
\??\c:\3ffrrrl.exec:\3ffrrrl.exe92⤵PID:2068
-
\??\c:\nbtbbh.exec:\nbtbbh.exe93⤵PID:3080
-
\??\c:\fxfrllx.exec:\fxfrllx.exe94⤵PID:4568
-
\??\c:\tbbbnn.exec:\tbbbnn.exe95⤵PID:4644
-
\??\c:\tnnnnt.exec:\tnnnnt.exe96⤵PID:3196
-
\??\c:\vvvvp.exec:\vvvvp.exe97⤵PID:1148
-
\??\c:\jpvvv.exec:\jpvvv.exe98⤵PID:3980
-
\??\c:\rllffll.exec:\rllffll.exe99⤵PID:932
-
\??\c:\hbnhnh.exec:\hbnhnh.exe100⤵PID:3996
-
\??\c:\pjpjv.exec:\pjpjv.exe101⤵PID:3356
-
\??\c:\ddjpj.exec:\ddjpj.exe102⤵PID:3536
-
\??\c:\1lrlfll.exec:\1lrlfll.exe103⤵PID:1352
-
\??\c:\nbttnn.exec:\nbttnn.exe104⤵PID:3100
-
\??\c:\dpdjv.exec:\dpdjv.exe105⤵PID:2004
-
\??\c:\dvpjd.exec:\dvpjd.exe106⤵PID:660
-
\??\c:\llfllfx.exec:\llfllfx.exe107⤵PID:896
-
\??\c:\7rxxffx.exec:\7rxxffx.exe108⤵PID:1500
-
\??\c:\bbhhbh.exec:\bbhhbh.exe109⤵PID:3840
-
\??\c:\vdjdv.exec:\vdjdv.exe110⤵PID:840
-
\??\c:\vpdjp.exec:\vpdjp.exe111⤵PID:4488
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe112⤵PID:1392
-
\??\c:\hhbbhn.exec:\hhbbhn.exe113⤵PID:4060
-
\??\c:\tthbhh.exec:\tthbhh.exe114⤵PID:4380
-
\??\c:\5jppj.exec:\5jppj.exe115⤵PID:1224
-
\??\c:\rlxrrrf.exec:\rlxrrrf.exe116⤵PID:1584
-
\??\c:\nhnnnh.exec:\nhnnnh.exe117⤵PID:4844
-
\??\c:\bttttt.exec:\bttttt.exe118⤵PID:2984
-
\??\c:\vppjd.exec:\vppjd.exe119⤵PID:2700
-
\??\c:\vvvpj.exec:\vvvpj.exe120⤵PID:1932
-
\??\c:\rxflrlf.exec:\rxflrlf.exe121⤵PID:1944
-
\??\c:\tbbttn.exec:\tbbttn.exe122⤵PID:4800
-
\??\c:\1bnhhh.exec:\1bnhhh.exe123⤵PID:3640
-
\??\c:\ddpjd.exec:\ddpjd.exe124⤵PID:3668
-
\??\c:\7flxxxr.exec:\7flxxxr.exe125⤵PID:1092
-
\??\c:\rlrllff.exec:\rlrllff.exe126⤵PID:4216
-
\??\c:\nhbttn.exec:\nhbttn.exe127⤵PID:4916
-
\??\c:\1ddvp.exec:\1ddvp.exe128⤵PID:3520
-
\??\c:\frrlxxl.exec:\frrlxxl.exe129⤵PID:1080
-
\??\c:\nhnnhb.exec:\nhnnhb.exe130⤵PID:1564
-
\??\c:\jjddd.exec:\jjddd.exe131⤵PID:2068
-
\??\c:\xrrlffx.exec:\xrrlffx.exe132⤵PID:716
-
\??\c:\ntnnhb.exec:\ntnnhb.exe133⤵PID:4568
-
\??\c:\3djdd.exec:\3djdd.exe134⤵PID:1624
-
\??\c:\3djjj.exec:\3djjj.exe135⤵PID:812
-
\??\c:\xxxlxfr.exec:\xxxlxfr.exe136⤵PID:2428
-
\??\c:\9nttht.exec:\9nttht.exe137⤵PID:2572
-
\??\c:\ddppv.exec:\ddppv.exe138⤵PID:5080
-
\??\c:\7frrxfl.exec:\7frrxfl.exe139⤵PID:432
-
\??\c:\1xxrllf.exec:\1xxrllf.exe140⤵PID:4056
-
\??\c:\5bhhtb.exec:\5bhhtb.exe141⤵PID:2768
-
\??\c:\djpjd.exec:\djpjd.exe142⤵PID:2676
-
\??\c:\7dpdj.exec:\7dpdj.exe143⤵PID:532
-
\??\c:\lffxrrl.exec:\lffxrrl.exe144⤵PID:1404
-
\??\c:\tbhbhn.exec:\tbhbhn.exe145⤵PID:3180
-
\??\c:\9vdvp.exec:\9vdvp.exe146⤵PID:2704
-
\??\c:\rlxllff.exec:\rlxllff.exe147⤵PID:1984
-
\??\c:\7bbttt.exec:\7bbttt.exe148⤵PID:2296
-
\??\c:\pppjj.exec:\pppjj.exe149⤵PID:2660
-
\??\c:\9ppjp.exec:\9ppjp.exe150⤵PID:4392
-
\??\c:\9xrrfxl.exec:\9xrrfxl.exe151⤵PID:3708
-
\??\c:\hnhnbt.exec:\hnhnbt.exe152⤵PID:616
-
\??\c:\jvppj.exec:\jvppj.exe153⤵PID:4456
-
\??\c:\ffrllll.exec:\ffrllll.exe154⤵PID:1224
-
\??\c:\xfxfrrx.exec:\xfxfrrx.exe155⤵PID:1584
-
\??\c:\nhbbtt.exec:\nhbbtt.exe156⤵PID:4844
-
\??\c:\dvjdd.exec:\dvjdd.exe157⤵PID:2984
-
\??\c:\dddjd.exec:\dddjd.exe158⤵PID:2700
-
\??\c:\5rfxxxr.exec:\5rfxxxr.exe159⤵PID:1932
-
\??\c:\5xfxxxx.exec:\5xfxxxx.exe160⤵PID:4288
-
\??\c:\nbntnn.exec:\nbntnn.exe161⤵PID:4800
-
\??\c:\ntbbnn.exec:\ntbbnn.exe162⤵PID:1356
-
\??\c:\jddvp.exec:\jddvp.exe163⤵PID:384
-
\??\c:\rlrllll.exec:\rlrllll.exe164⤵PID:4700
-
\??\c:\9xfrrrl.exec:\9xfrrrl.exe165⤵PID:4216
-
\??\c:\hnnnbt.exec:\hnnnbt.exe166⤵PID:4376
-
\??\c:\jpvpj.exec:\jpvpj.exe167⤵PID:3520
-
\??\c:\pjppj.exec:\pjppj.exe168⤵PID:1080
-
\??\c:\xlxxlll.exec:\xlxxlll.exe169⤵PID:2204
-
\??\c:\9hhbtt.exec:\9hhbtt.exe170⤵PID:3616
-
\??\c:\1bnnnn.exec:\1bnnnn.exe171⤵PID:4812
-
\??\c:\jdjjd.exec:\jdjjd.exe172⤵PID:5036
-
\??\c:\vvvdv.exec:\vvvdv.exe173⤵PID:1868
-
\??\c:\rxllfll.exec:\rxllfll.exe174⤵PID:2300
-
\??\c:\7rfxrrl.exec:\7rfxrrl.exe175⤵PID:536
-
\??\c:\hbtnnh.exec:\hbtnnh.exe176⤵PID:424
-
\??\c:\jjvdd.exec:\jjvdd.exe177⤵PID:4056
-
\??\c:\jpjjd.exec:\jpjjd.exe178⤵PID:3732
-
\??\c:\fxxrlrl.exec:\fxxrlrl.exe179⤵PID:2972
-
\??\c:\1flffff.exec:\1flffff.exe180⤵PID:4728
-
\??\c:\tbnnhh.exec:\tbnnhh.exe181⤵PID:896
-
\??\c:\tthbbb.exec:\tthbbb.exe182⤵PID:3180
-
\??\c:\5vdvp.exec:\5vdvp.exe183⤵PID:2704
-
\??\c:\rllfxrl.exec:\rllfxrl.exe184⤵PID:4352
-
\??\c:\xrrrxxx.exec:\xrrrxxx.exe185⤵PID:1140
-
\??\c:\bttnhh.exec:\bttnhh.exe186⤵PID:1684
-
\??\c:\hthhhn.exec:\hthhhn.exe187⤵PID:3552
-
\??\c:\ppddv.exec:\ppddv.exe188⤵PID:3728
-
\??\c:\djppp.exec:\djppp.exe189⤵PID:2172
-
\??\c:\frrlfxx.exec:\frrlfxx.exe190⤵PID:4456
-
\??\c:\7bbttt.exec:\7bbttt.exe191⤵PID:5028
-
\??\c:\hhnnnn.exec:\hhnnnn.exe192⤵PID:2736
-
\??\c:\pvvvp.exec:\pvvvp.exe193⤵PID:2440
-
\??\c:\9ddvv.exec:\9ddvv.exe194⤵PID:4608
-
\??\c:\9xfxxxx.exec:\9xfxxxx.exe195⤵PID:4784
-
\??\c:\fffrrrx.exec:\fffrrrx.exe196⤵PID:3776
-
\??\c:\hbnnnt.exec:\hbnnnt.exe197⤵PID:2520
-
\??\c:\ttttbb.exec:\ttttbb.exe198⤵PID:2168
-
\??\c:\jjjdv.exec:\jjjdv.exe199⤵PID:2952
-
\??\c:\rrllfff.exec:\rrllfff.exe200⤵PID:4700
-
\??\c:\rlxxfxl.exec:\rlxxfxl.exe201⤵PID:2408
-
\??\c:\tnntnb.exec:\tnntnb.exe202⤵PID:3220
-
\??\c:\tnbbtb.exec:\tnbbtb.exe203⤵PID:2160
-
\??\c:\vvddv.exec:\vvddv.exe204⤵PID:4364
-
\??\c:\flfffxr.exec:\flfffxr.exe205⤵PID:3284
-
\??\c:\hhnbbn.exec:\hhnbbn.exe206⤵PID:812
-
\??\c:\hhnnhh.exec:\hhnnhh.exe207⤵PID:1868
-
\??\c:\pjjjd.exec:\pjjjd.exe208⤵PID:5080
-
\??\c:\pvjjd.exec:\pvjjd.exe209⤵PID:3064
-
\??\c:\fffxffx.exec:\fffxffx.exe210⤵PID:3536
-
\??\c:\nthhht.exec:\nthhht.exe211⤵PID:4988
-
\??\c:\nhtnnt.exec:\nhtnnt.exe212⤵PID:3324
-
\??\c:\jjjdv.exec:\jjjdv.exe213⤵PID:2360
-
\??\c:\1vppj.exec:\1vppj.exe214⤵PID:840
-
\??\c:\lfrllll.exec:\lfrllll.exe215⤵PID:4300
-
\??\c:\nnbbnt.exec:\nnbbnt.exe216⤵PID:3304
-
\??\c:\dvvvp.exec:\dvvvp.exe217⤵PID:4396
-
\??\c:\5flrllf.exec:\5flrllf.exe218⤵PID:876
-
\??\c:\ttnnnn.exec:\ttnnnn.exe219⤵PID:4052
-
\??\c:\rrfxrlf.exec:\rrfxrlf.exe220⤵PID:2320
-
\??\c:\nhhtnn.exec:\nhhtnn.exe221⤵PID:1660
-
\??\c:\pjjdv.exec:\pjjdv.exe222⤵PID:3792
-
\??\c:\lxffxfx.exec:\lxffxfx.exe223⤵PID:1628
-
\??\c:\bhnnhh.exec:\bhnnhh.exe224⤵PID:4692
-
\??\c:\vvjdj.exec:\vvjdj.exe225⤵PID:1932
-
\??\c:\3fxlflf.exec:\3fxlflf.exe226⤵PID:4460
-
\??\c:\3pjvj.exec:\3pjvj.exe227⤵PID:1356
-
\??\c:\5xlfxfx.exec:\5xlfxfx.exe228⤵PID:3668
-
\??\c:\rlrllrr.exec:\rlrllrr.exe229⤵PID:3848
-
\??\c:\jvddv.exec:\jvddv.exe230⤵PID:4916
-
\??\c:\rllffff.exec:\rllffff.exe231⤵PID:1996
-
\??\c:\jpjdv.exec:\jpjdv.exe232⤵PID:4372
-
\??\c:\lfrrllf.exec:\lfrrllf.exe233⤵PID:3196
-
\??\c:\hthhtt.exec:\hthhtt.exe234⤵PID:1160
-
\??\c:\9dpvv.exec:\9dpvv.exe235⤵PID:4812
-
\??\c:\rlllfxx.exec:\rlllfxx.exe236⤵PID:3116
-
\??\c:\btbnhh.exec:\btbnhh.exe237⤵PID:4476
-
\??\c:\bthhbn.exec:\bthhbn.exe238⤵PID:536
-
\??\c:\dpdvv.exec:\dpdvv.exe239⤵PID:3732
-
\??\c:\xlxrlfx.exec:\xlxrlfx.exe240⤵PID:4080
-
\??\c:\1hnhtt.exec:\1hnhtt.exe241⤵PID:2732
-
\??\c:\9hbbhn.exec:\9hbbhn.exe242⤵PID:3216