Analysis
-
max time kernel
149s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 22:28
Behavioral task
behavioral1
Sample
52dd07bd75a14ae47f47aad2be5f24f9da80438cd0b73d2469aecec1a7449410.exe
Resource
win7-20240220-en
windows7-x64
6 signatures
150 seconds
General
-
Target
52dd07bd75a14ae47f47aad2be5f24f9da80438cd0b73d2469aecec1a7449410.exe
-
Size
90KB
-
MD5
1f30a02f9765f1da6dd2a12423f5439d
-
SHA1
3277aa4e2909d813f0cee15b11d75d6d69a9a3a5
-
SHA256
52dd07bd75a14ae47f47aad2be5f24f9da80438cd0b73d2469aecec1a7449410
-
SHA512
4c81bd0f3fa5f8f09c4cb117860c700cf2269bd1f7ef2c635ff8abd58ddb6278a7aa239f275f8de233fef17a4c49d49399f44e2479d77afe52a00ee3106c4977
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWpX:8hOmTsF93UYfwC6GIout0fmCiiiXA6mJ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/320-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4128-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1368-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2728-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4340-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1468-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1312-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3612-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/664-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2420-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2340-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2556-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3116-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2600-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1580-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3644-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/828-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2196-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4244-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1376-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4772-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1036-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1264-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2168-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4188-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/636-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4264-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2316-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4328-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2492-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-559-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-616-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2244-643-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-669-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3392-747-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-844-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/320-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nhhhhh.exe UPX behavioral2/memory/320-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4128-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jpppj.exe UPX behavioral2/memory/4728-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ddppp.exe UPX behavioral2/memory/2180-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4128-12-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\nhhbbb.exe UPX \??\c:\tbbhth.exe UPX C:\bbttbt.exe UPX behavioral2/memory/1368-32-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pjvdv.exe UPX behavioral2/memory/2728-37-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ffflrfr.exe UPX behavioral2/memory/4340-30-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nbnnnn.exe UPX behavioral2/memory/3036-44-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\bhhthh.exe UPX behavioral2/memory/1468-52-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vdpvv.exe UPX behavioral2/memory/1312-57-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vpvpp.exe UPX behavioral2/memory/3612-51-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rxxxflr.exe UPX C:\bbhhht.exe UPX behavioral2/memory/4072-69-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vvvjd.exe UPX behavioral2/memory/664-74-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2420-76-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\jddvd.exe UPX behavioral2/memory/1524-80-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9llllll.exe UPX behavioral2/memory/1524-84-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4016-86-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3bnnbb.exe UPX C:\pvjpj.exe UPX behavioral2/memory/3932-94-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rlllfff.exe UPX C:\tntbbh.exe UPX behavioral2/memory/4580-103-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\bntbhb.exe UPX behavioral2/memory/2876-109-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2340-111-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jjjjd.exe UPX C:\ppdjv.exe UPX behavioral2/memory/4940-123-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\rllfxff.exe UPX C:\hnnhbt.exe UPX behavioral2/memory/3616-128-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\thbbbh.exe UPX behavioral2/memory/2556-131-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3116-136-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vjppp.exe UPX C:\xrrxxff.exe UPX behavioral2/memory/4920-144-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bhbbbt.exe UPX behavioral2/memory/2600-148-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hbhhtb.exe UPX behavioral2/memory/1800-154-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vpvvp.exe UPX behavioral2/memory/5116-162-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1580-169-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
nhhhhh.exenhhbbb.exejpppj.exeddppp.exetbbhth.exebbttbt.exepjvdv.exeffflrfr.exenbnnnn.exebhhthh.exevdpvv.exevpvpp.exerxxxflr.exebbhhht.exevvvjd.exejddvd.exe9llllll.exe3bnnbb.exepvjpj.exerlllfff.exetntbbh.exebntbhb.exejjjjd.exeppdjv.exerllfxff.exehnnhbt.exethbbbh.exevjppp.exexrrxxff.exebhbbbt.exehbhhtb.exevpvvp.exe9ffffff.exerlrrrrr.exerlrlrxf.exenbbtnb.exepddpj.exeffffxxr.exerrlxfll.exehbhhbt.exevvppj.exepvddp.exefffrffx.exe7rrrrrr.exetbhhnn.exejvdvp.exelxxrllf.exeffflxxf.exe7tbhbb.exetbhnnt.exejjjjv.exevpjdv.exe9xxrlfl.exenthhhn.exe9bthht.exejpddp.exelxrxxxf.exelllrlxr.exennhhnn.exetnnnbh.exevpvdd.exe5xllllf.exelfxxffr.exennnhbb.exepid process 4128 nhhhhh.exe 2180 nhhbbb.exe 4728 jpppj.exe 5084 ddppp.exe 4340 tbbhth.exe 1368 bbttbt.exe 2728 pjvdv.exe 3036 ffflrfr.exe 3612 nbnnnn.exe 1468 bhhthh.exe 1312 vdpvv.exe 1624 vpvpp.exe 4072 rxxxflr.exe 664 bbhhht.exe 2420 vvvjd.exe 1524 jddvd.exe 4016 9llllll.exe 3932 3bnnbb.exe 3928 pvjpj.exe 4580 rlllfff.exe 2876 tntbbh.exe 2340 bntbhb.exe 4516 jjjjd.exe 4940 ppdjv.exe 3616 rllfxff.exe 2556 hnnhbt.exe 3116 thbbbh.exe 4844 vjppp.exe 4920 xrrxxff.exe 2600 bhbbbt.exe 1800 hbhhtb.exe 4328 vpvvp.exe 5116 9ffffff.exe 4976 rlrrrrr.exe 4080 rlrlrxf.exe 1580 nbbtnb.exe 4612 pddpj.exe 3352 ffffxxr.exe 3644 rrlxfll.exe 2280 hbhhbt.exe 828 vvppj.exe 4008 pvddp.exe 3576 fffrffx.exe 2056 7rrrrrr.exe 624 tbhhnn.exe 3916 jvdvp.exe 3636 lxxrllf.exe 2196 ffflxxf.exe 4244 7tbhbb.exe 4480 tbhnnt.exe 3012 jjjjv.exe 1376 vpjdv.exe 4728 9xxrlfl.exe 4764 nthhhn.exe 5108 9bthht.exe 3284 jpddp.exe 4772 lxrxxxf.exe 2728 lllrlxr.exe 2272 nnhhnn.exe 2640 tnnnbh.exe 1620 vpvdd.exe 1552 5xllllf.exe 2364 lfxxffr.exe 3800 nnnhbb.exe -
Processes:
resource yara_rule behavioral2/memory/320-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhhhhh.exe upx behavioral2/memory/320-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4128-6-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpppj.exe upx behavioral2/memory/4728-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddppp.exe upx behavioral2/memory/2180-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4128-12-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhhbbb.exe upx \??\c:\tbbhth.exe upx C:\bbttbt.exe upx behavioral2/memory/1368-32-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjvdv.exe upx behavioral2/memory/2728-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffflrfr.exe upx behavioral2/memory/4340-30-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbnnnn.exe upx behavioral2/memory/3036-44-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bhhthh.exe upx behavioral2/memory/1468-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vdpvv.exe upx behavioral2/memory/1312-57-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpvpp.exe upx behavioral2/memory/3612-51-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxxxflr.exe upx C:\bbhhht.exe upx behavioral2/memory/4072-69-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvvjd.exe upx behavioral2/memory/664-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2420-76-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jddvd.exe upx behavioral2/memory/1524-80-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9llllll.exe upx behavioral2/memory/1524-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4016-86-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3bnnbb.exe upx C:\pvjpj.exe upx behavioral2/memory/3932-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlllfff.exe upx C:\tntbbh.exe upx behavioral2/memory/4580-103-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bntbhb.exe upx behavioral2/memory/2876-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2340-111-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjjjd.exe upx C:\ppdjv.exe upx behavioral2/memory/4940-123-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rllfxff.exe upx C:\hnnhbt.exe upx behavioral2/memory/3616-128-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thbbbh.exe upx behavioral2/memory/2556-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3116-136-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjppp.exe upx C:\xrrxxff.exe upx behavioral2/memory/4920-144-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhbbbt.exe upx behavioral2/memory/2600-148-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbhhtb.exe upx behavioral2/memory/1800-154-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpvvp.exe upx behavioral2/memory/5116-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1580-169-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
52dd07bd75a14ae47f47aad2be5f24f9da80438cd0b73d2469aecec1a7449410.exenhhhhh.exenhhbbb.exejpppj.exeddppp.exetbbhth.exebbttbt.exepjvdv.exeffflrfr.exenbnnnn.exebhhthh.exevdpvv.exevpvpp.exerxxxflr.exebbhhht.exevvvjd.exejddvd.exe9llllll.exe3bnnbb.exepvjpj.exerlllfff.exetntbbh.exedescription pid process target process PID 320 wrote to memory of 4128 320 52dd07bd75a14ae47f47aad2be5f24f9da80438cd0b73d2469aecec1a7449410.exe nhhhhh.exe PID 320 wrote to memory of 4128 320 52dd07bd75a14ae47f47aad2be5f24f9da80438cd0b73d2469aecec1a7449410.exe nhhhhh.exe PID 320 wrote to memory of 4128 320 52dd07bd75a14ae47f47aad2be5f24f9da80438cd0b73d2469aecec1a7449410.exe nhhhhh.exe PID 4128 wrote to memory of 2180 4128 nhhhhh.exe nhhbbb.exe PID 4128 wrote to memory of 2180 4128 nhhhhh.exe nhhbbb.exe PID 4128 wrote to memory of 2180 4128 nhhhhh.exe nhhbbb.exe PID 2180 wrote to memory of 4728 2180 nhhbbb.exe jpppj.exe PID 2180 wrote to memory of 4728 2180 nhhbbb.exe jpppj.exe PID 2180 wrote to memory of 4728 2180 nhhbbb.exe jpppj.exe PID 4728 wrote to memory of 5084 4728 jpppj.exe ddppp.exe PID 4728 wrote to memory of 5084 4728 jpppj.exe ddppp.exe PID 4728 wrote to memory of 5084 4728 jpppj.exe ddppp.exe PID 5084 wrote to memory of 4340 5084 ddppp.exe tbbhth.exe PID 5084 wrote to memory of 4340 5084 ddppp.exe tbbhth.exe PID 5084 wrote to memory of 4340 5084 ddppp.exe tbbhth.exe PID 4340 wrote to memory of 1368 4340 tbbhth.exe bbttbt.exe PID 4340 wrote to memory of 1368 4340 tbbhth.exe bbttbt.exe PID 4340 wrote to memory of 1368 4340 tbbhth.exe bbttbt.exe PID 1368 wrote to memory of 2728 1368 bbttbt.exe pjvdv.exe PID 1368 wrote to memory of 2728 1368 bbttbt.exe pjvdv.exe PID 1368 wrote to memory of 2728 1368 bbttbt.exe pjvdv.exe PID 2728 wrote to memory of 3036 2728 pjvdv.exe ffflrfr.exe PID 2728 wrote to memory of 3036 2728 pjvdv.exe ffflrfr.exe PID 2728 wrote to memory of 3036 2728 pjvdv.exe ffflrfr.exe PID 3036 wrote to memory of 3612 3036 ffflrfr.exe nbnnnn.exe PID 3036 wrote to memory of 3612 3036 ffflrfr.exe nbnnnn.exe PID 3036 wrote to memory of 3612 3036 ffflrfr.exe nbnnnn.exe PID 3612 wrote to memory of 1468 3612 nbnnnn.exe bhhthh.exe PID 3612 wrote to memory of 1468 3612 nbnnnn.exe bhhthh.exe PID 3612 wrote to memory of 1468 3612 nbnnnn.exe bhhthh.exe PID 1468 wrote to memory of 1312 1468 bhhthh.exe vdpvv.exe PID 1468 wrote to memory of 1312 1468 bhhthh.exe vdpvv.exe PID 1468 wrote to memory of 1312 1468 bhhthh.exe vdpvv.exe PID 1312 wrote to memory of 1624 1312 vdpvv.exe vpvpp.exe PID 1312 wrote to memory of 1624 1312 vdpvv.exe vpvpp.exe PID 1312 wrote to memory of 1624 1312 vdpvv.exe vpvpp.exe PID 1624 wrote to memory of 4072 1624 vpvpp.exe rxxxflr.exe PID 1624 wrote to memory of 4072 1624 vpvpp.exe rxxxflr.exe PID 1624 wrote to memory of 4072 1624 vpvpp.exe rxxxflr.exe PID 4072 wrote to memory of 664 4072 rxxxflr.exe bbhhht.exe PID 4072 wrote to memory of 664 4072 rxxxflr.exe bbhhht.exe PID 4072 wrote to memory of 664 4072 rxxxflr.exe bbhhht.exe PID 664 wrote to memory of 2420 664 bbhhht.exe vvvjd.exe PID 664 wrote to memory of 2420 664 bbhhht.exe vvvjd.exe PID 664 wrote to memory of 2420 664 bbhhht.exe vvvjd.exe PID 2420 wrote to memory of 1524 2420 vvvjd.exe jddvd.exe PID 2420 wrote to memory of 1524 2420 vvvjd.exe jddvd.exe PID 2420 wrote to memory of 1524 2420 vvvjd.exe jddvd.exe PID 1524 wrote to memory of 4016 1524 jddvd.exe 9llllll.exe PID 1524 wrote to memory of 4016 1524 jddvd.exe 9llllll.exe PID 1524 wrote to memory of 4016 1524 jddvd.exe 9llllll.exe PID 4016 wrote to memory of 3932 4016 9llllll.exe 3bnnbb.exe PID 4016 wrote to memory of 3932 4016 9llllll.exe 3bnnbb.exe PID 4016 wrote to memory of 3932 4016 9llllll.exe 3bnnbb.exe PID 3932 wrote to memory of 3928 3932 3bnnbb.exe pvjpj.exe PID 3932 wrote to memory of 3928 3932 3bnnbb.exe pvjpj.exe PID 3932 wrote to memory of 3928 3932 3bnnbb.exe pvjpj.exe PID 3928 wrote to memory of 4580 3928 pvjpj.exe rlllfff.exe PID 3928 wrote to memory of 4580 3928 pvjpj.exe rlllfff.exe PID 3928 wrote to memory of 4580 3928 pvjpj.exe rlllfff.exe PID 4580 wrote to memory of 2876 4580 rlllfff.exe tntbbh.exe PID 4580 wrote to memory of 2876 4580 rlllfff.exe tntbbh.exe PID 4580 wrote to memory of 2876 4580 rlllfff.exe tntbbh.exe PID 2876 wrote to memory of 2340 2876 tntbbh.exe bntbhb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52dd07bd75a14ae47f47aad2be5f24f9da80438cd0b73d2469aecec1a7449410.exe"C:\Users\Admin\AppData\Local\Temp\52dd07bd75a14ae47f47aad2be5f24f9da80438cd0b73d2469aecec1a7449410.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\nhhhhh.exec:\nhhhhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\nhhbbb.exec:\nhhbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\jpppj.exec:\jpppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\ddppp.exec:\ddppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\tbbhth.exec:\tbbhth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\bbttbt.exec:\bbttbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\pjvdv.exec:\pjvdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\ffflrfr.exec:\ffflrfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\nbnnnn.exec:\nbnnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\bhhthh.exec:\bhhthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\vdpvv.exec:\vdpvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\vpvpp.exec:\vpvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\rxxxflr.exec:\rxxxflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\bbhhht.exec:\bbhhht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\vvvjd.exec:\vvvjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\jddvd.exec:\jddvd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\9llllll.exec:\9llllll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\3bnnbb.exec:\3bnnbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\pvjpj.exec:\pvjpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\rlllfff.exec:\rlllfff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\tntbbh.exec:\tntbbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\bntbhb.exec:\bntbhb.exe23⤵
- Executes dropped EXE
PID:2340 -
\??\c:\jjjjd.exec:\jjjjd.exe24⤵
- Executes dropped EXE
PID:4516 -
\??\c:\ppdjv.exec:\ppdjv.exe25⤵
- Executes dropped EXE
PID:4940 -
\??\c:\rllfxff.exec:\rllfxff.exe26⤵
- Executes dropped EXE
PID:3616 -
\??\c:\hnnhbt.exec:\hnnhbt.exe27⤵
- Executes dropped EXE
PID:2556 -
\??\c:\thbbbh.exec:\thbbbh.exe28⤵
- Executes dropped EXE
PID:3116 -
\??\c:\vjppp.exec:\vjppp.exe29⤵
- Executes dropped EXE
PID:4844 -
\??\c:\xrrxxff.exec:\xrrxxff.exe30⤵
- Executes dropped EXE
PID:4920 -
\??\c:\bhbbbt.exec:\bhbbbt.exe31⤵
- Executes dropped EXE
PID:2600 -
\??\c:\hbhhtb.exec:\hbhhtb.exe32⤵
- Executes dropped EXE
PID:1800 -
\??\c:\vpvvp.exec:\vpvvp.exe33⤵
- Executes dropped EXE
PID:4328 -
\??\c:\9ffffff.exec:\9ffffff.exe34⤵
- Executes dropped EXE
PID:5116 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe35⤵
- Executes dropped EXE
PID:4976 -
\??\c:\rlrlrxf.exec:\rlrlrxf.exe36⤵
- Executes dropped EXE
PID:4080 -
\??\c:\nbbtnb.exec:\nbbtnb.exe37⤵
- Executes dropped EXE
PID:1580 -
\??\c:\pddpj.exec:\pddpj.exe38⤵
- Executes dropped EXE
PID:4612 -
\??\c:\ffffxxr.exec:\ffffxxr.exe39⤵
- Executes dropped EXE
PID:3352 -
\??\c:\rrlxfll.exec:\rrlxfll.exe40⤵
- Executes dropped EXE
PID:3644 -
\??\c:\hbhhbt.exec:\hbhhbt.exe41⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vvppj.exec:\vvppj.exe42⤵
- Executes dropped EXE
PID:828 -
\??\c:\pvddp.exec:\pvddp.exe43⤵
- Executes dropped EXE
PID:4008 -
\??\c:\fffrffx.exec:\fffrffx.exe44⤵
- Executes dropped EXE
PID:3576 -
\??\c:\7rrrrrr.exec:\7rrrrrr.exe45⤵
- Executes dropped EXE
PID:2056 -
\??\c:\tbhhnn.exec:\tbhhnn.exe46⤵
- Executes dropped EXE
PID:624 -
\??\c:\jvdvp.exec:\jvdvp.exe47⤵
- Executes dropped EXE
PID:3916 -
\??\c:\lxxrllf.exec:\lxxrllf.exe48⤵
- Executes dropped EXE
PID:3636 -
\??\c:\ffflxxf.exec:\ffflxxf.exe49⤵
- Executes dropped EXE
PID:2196 -
\??\c:\7tbhbb.exec:\7tbhbb.exe50⤵
- Executes dropped EXE
PID:4244 -
\??\c:\tbhnnt.exec:\tbhnnt.exe51⤵
- Executes dropped EXE
PID:4480 -
\??\c:\jjjjv.exec:\jjjjv.exe52⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vpjdv.exec:\vpjdv.exe53⤵
- Executes dropped EXE
PID:1376 -
\??\c:\9xxrlfl.exec:\9xxrlfl.exe54⤵
- Executes dropped EXE
PID:4728 -
\??\c:\nthhhn.exec:\nthhhn.exe55⤵
- Executes dropped EXE
PID:4764 -
\??\c:\9bthht.exec:\9bthht.exe56⤵
- Executes dropped EXE
PID:5108 -
\??\c:\jpddp.exec:\jpddp.exe57⤵
- Executes dropped EXE
PID:3284 -
\??\c:\lxrxxxf.exec:\lxrxxxf.exe58⤵
- Executes dropped EXE
PID:4772 -
\??\c:\lllrlxr.exec:\lllrlxr.exe59⤵
- Executes dropped EXE
PID:2728 -
\??\c:\nnhhnn.exec:\nnhhnn.exe60⤵
- Executes dropped EXE
PID:2272 -
\??\c:\tnnnbh.exec:\tnnnbh.exe61⤵
- Executes dropped EXE
PID:2640 -
\??\c:\vpvdd.exec:\vpvdd.exe62⤵
- Executes dropped EXE
PID:1620 -
\??\c:\5xllllf.exec:\5xllllf.exe63⤵
- Executes dropped EXE
PID:1552 -
\??\c:\lfxxffr.exec:\lfxxffr.exe64⤵
- Executes dropped EXE
PID:2364 -
\??\c:\nnnhbb.exec:\nnnhbb.exe65⤵
- Executes dropped EXE
PID:3800 -
\??\c:\tthhhh.exec:\tthhhh.exe66⤵PID:1036
-
\??\c:\tnttnn.exec:\tnttnn.exe67⤵PID:2128
-
\??\c:\pjppp.exec:\pjppp.exe68⤵PID:2492
-
\??\c:\ffxxxrr.exec:\ffxxxrr.exe69⤵PID:1264
-
\??\c:\xrflfll.exec:\xrflfll.exe70⤵PID:2712
-
\??\c:\bnnnnt.exec:\bnnnnt.exe71⤵PID:4408
-
\??\c:\tnnhbb.exec:\tnnhbb.exe72⤵PID:5076
-
\??\c:\jvdjj.exec:\jvdjj.exe73⤵PID:544
-
\??\c:\ddjdv.exec:\ddjdv.exe74⤵PID:2168
-
\??\c:\rfrrfff.exec:\rfrrfff.exe75⤵PID:436
-
\??\c:\hhbbnt.exec:\hhbbnt.exe76⤵PID:3888
-
\??\c:\jjjjd.exec:\jjjjd.exe77⤵PID:3008
-
\??\c:\jvdvp.exec:\jvdvp.exe78⤵PID:2736
-
\??\c:\7lxrrff.exec:\7lxrrff.exe79⤵PID:4188
-
\??\c:\ffffxfx.exec:\ffffxfx.exe80⤵PID:1472
-
\??\c:\hbhnnb.exec:\hbhnnb.exe81⤵PID:4912
-
\??\c:\bbbbnn.exec:\bbbbnn.exe82⤵PID:3876
-
\??\c:\vjppp.exec:\vjppp.exe83⤵PID:1164
-
\??\c:\5jjpp.exec:\5jjpp.exe84⤵PID:3616
-
\??\c:\lfxrfxr.exec:\lfxrfxr.exe85⤵PID:2900
-
\??\c:\tntttt.exec:\tntttt.exe86⤵PID:2352
-
\??\c:\5nnnhh.exec:\5nnnhh.exe87⤵PID:3180
-
\??\c:\vpvpd.exec:\vpvpd.exe88⤵PID:4368
-
\??\c:\lfllfll.exec:\lfllfll.exe89⤵PID:4500
-
\??\c:\fflfffl.exec:\fflfffl.exe90⤵PID:4944
-
\??\c:\thhnnn.exec:\thhnnn.exe91⤵PID:636
-
\??\c:\hhnnbb.exec:\hhnnbb.exe92⤵PID:3976
-
\??\c:\vpvvv.exec:\vpvvv.exe93⤵PID:508
-
\??\c:\vpddj.exec:\vpddj.exe94⤵PID:2320
-
\??\c:\rrfxxff.exec:\rrfxxff.exe95⤵PID:4264
-
\??\c:\fxffxff.exec:\fxffxff.exe96⤵PID:3788
-
\??\c:\nbnttt.exec:\nbnttt.exe97⤵PID:1656
-
\??\c:\pjpdv.exec:\pjpdv.exe98⤵PID:2324
-
\??\c:\dddvp.exec:\dddvp.exe99⤵PID:3100
-
\??\c:\rlfxxxr.exec:\rlfxxxr.exe100⤵PID:4056
-
\??\c:\llrrffl.exec:\llrrffl.exe101⤵PID:2360
-
\??\c:\3bnntt.exec:\3bnntt.exe102⤵PID:3156
-
\??\c:\hbnhtb.exec:\hbnhtb.exe103⤵PID:2396
-
\??\c:\7djdv.exec:\7djdv.exe104⤵PID:2056
-
\??\c:\pvvdv.exec:\pvvdv.exe105⤵PID:624
-
\??\c:\fllffll.exec:\fllffll.exe106⤵PID:4840
-
\??\c:\bbttbh.exec:\bbttbh.exe107⤵PID:2532
-
\??\c:\bbbbtb.exec:\bbbbtb.exe108⤵PID:4448
-
\??\c:\jdddd.exec:\jdddd.exe109⤵PID:5004
-
\??\c:\djvdv.exec:\djvdv.exe110⤵PID:2172
-
\??\c:\llfflfl.exec:\llfflfl.exe111⤵PID:1180
-
\??\c:\tbtttn.exec:\tbtttn.exe112⤵PID:1872
-
\??\c:\7pjpp.exec:\7pjpp.exe113⤵PID:2328
-
\??\c:\ppvpj.exec:\ppvpj.exe114⤵PID:2412
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe115⤵PID:668
-
\??\c:\xffffll.exec:\xffffll.exe116⤵PID:4636
-
\??\c:\nnhhtb.exec:\nnhhtb.exe117⤵PID:5108
-
\??\c:\nnttnn.exec:\nnttnn.exe118⤵PID:3284
-
\??\c:\jvddp.exec:\jvddp.exe119⤵PID:3952
-
\??\c:\ddddj.exec:\ddddj.exe120⤵PID:4756
-
\??\c:\xrfxllr.exec:\xrfxllr.exe121⤵PID:2272
-
\??\c:\rflxrxr.exec:\rflxrxr.exe122⤵PID:3128
-
\??\c:\9hhnht.exec:\9hhnht.exe123⤵PID:1468
-
\??\c:\nhbbnn.exec:\nhbbnn.exe124⤵PID:1040
-
\??\c:\pdppj.exec:\pdppj.exe125⤵PID:5040
-
\??\c:\jvjdd.exec:\jvjdd.exe126⤵PID:3648
-
\??\c:\rrxffxx.exec:\rrxffxx.exe127⤵PID:3868
-
\??\c:\xlrrrxx.exec:\xlrrrxx.exe128⤵PID:2316
-
\??\c:\nhhbhh.exec:\nhhbhh.exe129⤵PID:1576
-
\??\c:\1nnhtt.exec:\1nnhtt.exe130⤵PID:3208
-
\??\c:\3djjd.exec:\3djjd.exe131⤵PID:2712
-
\??\c:\9vdvp.exec:\9vdvp.exe132⤵PID:3776
-
\??\c:\xxxxxff.exec:\xxxxxff.exe133⤵PID:452
-
\??\c:\lxlfllr.exec:\lxlfllr.exe134⤵PID:3932
-
\??\c:\3hhttb.exec:\3hhttb.exe135⤵PID:2168
-
\??\c:\jvvvd.exec:\jvvvd.exe136⤵PID:3192
-
\??\c:\vppjv.exec:\vppjv.exe137⤵PID:1168
-
\??\c:\lflfrrl.exec:\lflfrrl.exe138⤵PID:460
-
\??\c:\5lfflrx.exec:\5lfflrx.exe139⤵PID:532
-
\??\c:\htnnhn.exec:\htnnhn.exe140⤵PID:568
-
\??\c:\tbthbt.exec:\tbthbt.exe141⤵PID:1256
-
\??\c:\ffrxllf.exec:\ffrxllf.exe142⤵PID:4316
-
\??\c:\bbbttb.exec:\bbbttb.exe143⤵PID:2900
-
\??\c:\7bhhbb.exec:\7bhhbb.exe144⤵PID:4988
-
\??\c:\thhbbb.exec:\thhbbb.exe145⤵PID:5036
-
\??\c:\ddvjp.exec:\ddvjp.exe146⤵PID:2488
-
\??\c:\jddvv.exec:\jddvv.exe147⤵PID:4880
-
\??\c:\xrfllrr.exec:\xrfllrr.exe148⤵PID:4328
-
\??\c:\xlrrrff.exec:\xlrrrff.exe149⤵PID:5116
-
\??\c:\tnhbtt.exec:\tnhbtt.exe150⤵PID:1184
-
\??\c:\bhbnnb.exec:\bhbnnb.exe151⤵PID:4464
-
\??\c:\vpppd.exec:\vpppd.exe152⤵PID:3548
-
\??\c:\xrlllxx.exec:\xrlllxx.exe153⤵PID:4400
-
\??\c:\fflllrx.exec:\fflllrx.exe154⤵PID:3576
-
\??\c:\nbbttt.exec:\nbbttt.exe155⤵PID:1460
-
\??\c:\1hbnhh.exec:\1hbnhh.exe156⤵PID:1416
-
\??\c:\bnttbn.exec:\bnttbn.exe157⤵PID:4840
-
\??\c:\vvpjp.exec:\vvpjp.exe158⤵PID:4252
-
\??\c:\dvvvp.exec:\dvvvp.exe159⤵PID:1856
-
\??\c:\xlffffl.exec:\xlffffl.exe160⤵PID:4244
-
\??\c:\lrxrllx.exec:\lrxrllx.exe161⤵PID:3120
-
\??\c:\hbntbh.exec:\hbntbh.exe162⤵PID:1072
-
\??\c:\bhbbtb.exec:\bhbbtb.exe163⤵PID:3708
-
\??\c:\dpvpj.exec:\dpvpj.exe164⤵PID:2180
-
\??\c:\lrrlflf.exec:\lrrlflf.exe165⤵PID:1248
-
\??\c:\lxffxxx.exec:\lxffxxx.exe166⤵PID:4760
-
\??\c:\nhnnnn.exec:\nhnnnn.exe167⤵PID:528
-
\??\c:\9pdjd.exec:\9pdjd.exe168⤵PID:1176
-
\??\c:\dpdvd.exec:\dpdvd.exe169⤵PID:4192
-
\??\c:\lffxrfl.exec:\lffxrfl.exe170⤵PID:3892
-
\??\c:\frlxrrr.exec:\frlxrrr.exe171⤵PID:1584
-
\??\c:\1bbbtb.exec:\1bbbtb.exe172⤵PID:3104
-
\??\c:\bbnbtt.exec:\bbnbtt.exe173⤵PID:1312
-
\??\c:\vdvvp.exec:\vdvvp.exe174⤵PID:4836
-
\??\c:\rlxrlrl.exec:\rlxrlrl.exe175⤵PID:2364
-
\??\c:\hnnnnn.exec:\hnnnnn.exe176⤵PID:3800
-
\??\c:\bbbtbb.exec:\bbbtbb.exe177⤵PID:2128
-
\??\c:\vvdjj.exec:\vvdjj.exe178⤵PID:4452
-
\??\c:\jdvpp.exec:\jdvpp.exe179⤵PID:2492
-
\??\c:\xrrxxxx.exec:\xrrxxxx.exe180⤵PID:1576
-
\??\c:\xxfrlrr.exec:\xxfrlrr.exe181⤵PID:3208
-
\??\c:\bbttbh.exec:\bbttbh.exe182⤵PID:2712
-
\??\c:\djjdp.exec:\djjdp.exe183⤵PID:3776
-
\??\c:\fxxrffx.exec:\fxxrffx.exe184⤵PID:452
-
\??\c:\ttthhh.exec:\ttthhh.exe185⤵PID:3932
-
\??\c:\jpvvp.exec:\jpvvp.exe186⤵PID:3888
-
\??\c:\pvvvp.exec:\pvvvp.exe187⤵PID:2876
-
\??\c:\xrfxrxx.exec:\xrfxrxx.exe188⤵PID:3904
-
\??\c:\bthhhh.exec:\bthhhh.exe189⤵PID:3376
-
\??\c:\pjvdj.exec:\pjvdj.exe190⤵PID:4940
-
\??\c:\xxlrrfl.exec:\xxlrrfl.exe191⤵PID:1420
-
\??\c:\rrxxrxx.exec:\rrxxrxx.exe192⤵PID:2212
-
\??\c:\tnnnhh.exec:\tnnnhh.exe193⤵PID:4580
-
\??\c:\9vppj.exec:\9vppj.exe194⤵PID:1588
-
\??\c:\vjvvv.exec:\vjvvv.exe195⤵PID:2188
-
\??\c:\xfllfff.exec:\xfllfff.exe196⤵PID:4576
-
\??\c:\xllxrlf.exec:\xllxrlf.exe197⤵PID:3388
-
\??\c:\nnnnbb.exec:\nnnnbb.exe198⤵PID:4944
-
\??\c:\jdvdv.exec:\jdvdv.exe199⤵PID:4880
-
\??\c:\7rrrllf.exec:\7rrrllf.exe200⤵PID:4976
-
\??\c:\xlxlffx.exec:\xlxlffx.exe201⤵PID:5116
-
\??\c:\3hnnbh.exec:\3hnnbh.exe202⤵PID:1184
-
\??\c:\7jvvj.exec:\7jvvj.exe203⤵PID:4464
-
\??\c:\dvddp.exec:\dvddp.exe204⤵PID:3736
-
\??\c:\lfrlfff.exec:\lfrlfff.exe205⤵PID:4400
-
\??\c:\xrlffrr.exec:\xrlffrr.exe206⤵PID:3576
-
\??\c:\tbtttn.exec:\tbtttn.exe207⤵PID:1460
-
\??\c:\nbhbbb.exec:\nbhbbb.exe208⤵PID:4796
-
\??\c:\pvvdv.exec:\pvvdv.exe209⤵PID:4824
-
\??\c:\dvppp.exec:\dvppp.exe210⤵PID:1876
-
\??\c:\pdvvj.exec:\pdvvj.exe211⤵PID:4600
-
\??\c:\lfffffl.exec:\lfffffl.exe212⤵PID:4548
-
\??\c:\fflllrr.exec:\fflllrr.exe213⤵PID:3468
-
\??\c:\hhntbh.exec:\hhntbh.exe214⤵PID:1072
-
\??\c:\1nhhht.exec:\1nhhht.exe215⤵PID:5084
-
\??\c:\tnbbbb.exec:\tnbbbb.exe216⤵PID:2180
-
\??\c:\dpdjd.exec:\dpdjd.exe217⤵PID:4888
-
\??\c:\ppjdd.exec:\ppjdd.exe218⤵PID:4760
-
\??\c:\xlxxrxx.exec:\xlxxrxx.exe219⤵PID:4772
-
\??\c:\fxrxxff.exec:\fxrxxff.exe220⤵PID:2728
-
\??\c:\ntbbbh.exec:\ntbbbh.exe221⤵PID:4756
-
\??\c:\bthnhh.exec:\bthnhh.exe222⤵PID:1620
-
\??\c:\vdjjj.exec:\vdjjj.exe223⤵PID:1468
-
\??\c:\ppvvd.exec:\ppvvd.exe224⤵PID:2176
-
\??\c:\pvvdv.exec:\pvvdv.exe225⤵PID:5040
-
\??\c:\frxxrrr.exec:\frxxrrr.exe226⤵PID:3648
-
\??\c:\rrxfflr.exec:\rrxfflr.exe227⤵PID:664
-
\??\c:\ttttnt.exec:\ttttnt.exe228⤵PID:1692
-
\??\c:\7nbtbb.exec:\7nbtbb.exe229⤵PID:4308
-
\??\c:\jjpjj.exec:\jjpjj.exe230⤵PID:4060
-
\??\c:\pjppj.exec:\pjppj.exe231⤵PID:2476
-
\??\c:\rxxfxff.exec:\rxxfxff.exe232⤵PID:1764
-
\??\c:\ffxrrrr.exec:\ffxrrrr.exe233⤵PID:2960
-
\??\c:\ntbbbb.exec:\ntbbbb.exe234⤵PID:3928
-
\??\c:\ntttbh.exec:\ntttbh.exe235⤵PID:4952
-
\??\c:\tnhnhb.exec:\tnhnhb.exe236⤵PID:3740
-
\??\c:\pjppj.exec:\pjppj.exe237⤵PID:4188
-
\??\c:\vpvpj.exec:\vpvpj.exe238⤵PID:1596
-
\??\c:\jvvjj.exec:\jvvjj.exe239⤵PID:532
-
\??\c:\5rllxfx.exec:\5rllxfx.exe240⤵PID:4912
-
\??\c:\rrxxlll.exec:\rrxxlll.exe241⤵PID:2556
-
\??\c:\nnhnhh.exec:\nnhnhh.exe242⤵PID:2340