Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 20:06
Behavioral task
behavioral1
Sample
20d5e1eae73e69ff16c3134ae05844f658800c79f1a941325c9d6a1120780e45.exe
Resource
win7-20240419-en
windows7-x64
6 signatures
150 seconds
General
-
Target
20d5e1eae73e69ff16c3134ae05844f658800c79f1a941325c9d6a1120780e45.exe
-
Size
80KB
-
MD5
d596bd7cb7a3f4772559cbb9733cfe33
-
SHA1
993778e74bc4f172b48c9455852f06bfff8bc2bd
-
SHA256
20d5e1eae73e69ff16c3134ae05844f658800c79f1a941325c9d6a1120780e45
-
SHA512
40dd43461c25405006539e6c6aea7adaacccd07eb6ee3b2851db029fc43f131e15edb1242c44f081a2461ef7d3159896c5db28e071f199c9bab7d749df32d6b4
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6TQpKg:zhOmTsF93UYfwC6GIoutiTU2HVS6A
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4224-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/388-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2708-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5056-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2720-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4116-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4448-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1008-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3964-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3612-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-492-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1044-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4140-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1392-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4464-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1788-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4112-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2324-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4516-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1736-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2636-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1496-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2432-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4012-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2416-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1532-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2032-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/540-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/424-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3472-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1044-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1736-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4808-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1940-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2716-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1456-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1312-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/368-537-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule \??\c:\ddjdd.exe UPX \??\c:\xlrlfxx.exe UPX \??\c:\ttnbtn.exe UPX \??\c:\nbnnnh.exe UPX \??\c:\vdvjd.exe UPX \??\c:\1tbthb.exe UPX \??\c:\3ddvj.exe UPX \??\c:\ntbbtn.exe UPX \??\c:\rxlxfrr.exe UPX \??\c:\lllrflf.exe UPX C:\frfrxlx.exe UPX \??\c:\bbnbnh.exe UPX behavioral2/memory/4224-154-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/388-163-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1784-186-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2708-210-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4552-235-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/808-245-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4004-300-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5056-345-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2720-368-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4084-378-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1328-455-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4116-472-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4448-430-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2020-425-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5108-418-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1008-395-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2016-390-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3964-388-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3612-377-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3120-492-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1044-349-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1724-330-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4436-323-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4140-309-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4856-297-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1392-286-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1392-283-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4464-281-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3720-279-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1788-274-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4112-268-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3964-264-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2324-238-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4316-232-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1240-225-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4516-220-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1736-214-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4336-203-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4336-200-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4064-500-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5016-196-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2636-192-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2328-188-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1496-183-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1784-182-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4924-177-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2432-172-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4012-167-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4004-166-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2280-160-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\3ttnbt.exe UPX \??\c:\xxrxflr.exe UPX -
Executes dropped EXE 64 IoCs
Processes:
bhnhtt.exennnbnh.exeddjdd.exejjdvj.exexlrlfxx.exexlrrrrl.exettnbtn.exenbnnnh.exepvvjp.exevdvjd.exe3lrlfll.exe3lrlffx.exebbbtnn.exe1tbthb.exedpdvp.exe3ddvj.exerxxllff.exelfxrlfx.exehnhbtt.exentbbtn.exepddpj.exejdjdj.exeppjvd.exerxlxfrr.exelllrflf.exe7tnnhh.exevpjdp.exeppdvd.exexxrxflr.exefrfrxlx.exebbnbnh.exe3ttnbt.exejdpjv.exexfxrlll.exerfrfxrl.exetbnnbb.exenhbbnn.exedpvvv.exe1ppjd.exe5xxrrlr.exefrrrlrl.exe5bnnhh.exetntbbh.exedjpjv.exejpdjj.exefllfllf.exerlrrrrx.exe1bttnn.exehttnhh.exe3ddvp.exe1dddj.exelflfxxx.exelfrrxff.exehbtnhb.exenbthtt.exe1hhbnn.exevpjdv.exevvjdp.exelfxfxfx.exefxfrrxx.exehnnhtt.exebtnhhh.exe3pjdd.exevjddd.exepid process 2716 bhnhtt.exe 1940 nnnbnh.exe 1724 ddjdd.exe 3676 jjdvj.exe 2756 xlrlfxx.exe 4808 xlrrrrl.exe 1736 ttnbtn.exe 4840 nbnnnh.exe 2492 pvvjp.exe 5084 vdvjd.exe 1044 3lrlfll.exe 1608 3lrlffx.exe 3472 bbbtnn.exe 4552 1tbthb.exe 424 dpdvp.exe 540 3ddvj.exe 1952 rxxllff.exe 2568 lfxrlfx.exe 1012 hnhbtt.exe 3516 ntbbtn.exe 2032 pddpj.exe 1336 jdjdj.exe 1532 ppjvd.exe 3964 rxlxfrr.exe 2416 lllrflf.exe 1884 7tnnhh.exe 3832 vpjdp.exe 3904 ppdvd.exe 2856 xxrxflr.exe 4224 frfrxlx.exe 2280 bbnbnh.exe 388 3ttnbt.exe 4004 jdpjv.exe 4012 xfxrlll.exe 2432 rfrfxrl.exe 3876 tbnnbb.exe 2376 nhbbnn.exe 4924 dpvvv.exe 1496 1ppjd.exe 1784 5xxrrlr.exe 2328 frrrlrl.exe 2636 5bnnhh.exe 4456 tntbbh.exe 5016 djpjv.exe 2260 jpdjj.exe 4336 fllfllf.exe 4560 rlrrrrx.exe 3016 1bttnn.exe 2708 httnhh.exe 4808 3ddvp.exe 1736 1dddj.exe 4516 lflfxxx.exe 2500 lfrrxff.exe 2968 hbtnhb.exe 4920 nbthtt.exe 1240 1hhbnn.exe 444 vpjdv.exe 4316 vvjdp.exe 4552 lfxfxfx.exe 2324 fxfrrxx.exe 2320 hnnhtt.exe 4940 btnhhh.exe 3920 3pjdd.exe 808 vjddd.exe -
Processes:
resource yara_rule \??\c:\ddjdd.exe upx \??\c:\xlrlfxx.exe upx \??\c:\ttnbtn.exe upx \??\c:\nbnnnh.exe upx \??\c:\vdvjd.exe upx \??\c:\1tbthb.exe upx \??\c:\3ddvj.exe upx \??\c:\ntbbtn.exe upx \??\c:\rxlxfrr.exe upx \??\c:\lllrflf.exe upx C:\frfrxlx.exe upx \??\c:\bbnbnh.exe upx behavioral2/memory/4224-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/388-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1784-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2708-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4552-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/808-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4004-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5056-345-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2720-368-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4084-378-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1328-455-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4116-472-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4448-430-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2020-425-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5108-418-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1008-395-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2016-390-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3964-388-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3612-377-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3120-492-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1044-349-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1724-330-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4436-323-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4140-309-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4856-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1392-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1392-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4464-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3720-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1788-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4112-268-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3964-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2324-238-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4316-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1240-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4516-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1736-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4336-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4336-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4064-500-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5016-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2636-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2328-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1496-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1784-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4924-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2432-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4012-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4004-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2280-160-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3ttnbt.exe upx \??\c:\xxrxflr.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
20d5e1eae73e69ff16c3134ae05844f658800c79f1a941325c9d6a1120780e45.exebhnhtt.exennnbnh.exeddjdd.exejjdvj.exexlrlfxx.exexlrrrrl.exettnbtn.exenbnnnh.exepvvjp.exevdvjd.exe3lrlfll.exe3lrlffx.exebbbtnn.exe1tbthb.exedpdvp.exe3ddvj.exerxxllff.exelfxrlfx.exehnhbtt.exentbbtn.exepddpj.exedescription pid process target process PID 1456 wrote to memory of 2716 1456 20d5e1eae73e69ff16c3134ae05844f658800c79f1a941325c9d6a1120780e45.exe bhnhtt.exe PID 1456 wrote to memory of 2716 1456 20d5e1eae73e69ff16c3134ae05844f658800c79f1a941325c9d6a1120780e45.exe bhnhtt.exe PID 1456 wrote to memory of 2716 1456 20d5e1eae73e69ff16c3134ae05844f658800c79f1a941325c9d6a1120780e45.exe bhnhtt.exe PID 2716 wrote to memory of 1940 2716 bhnhtt.exe 5djjp.exe PID 2716 wrote to memory of 1940 2716 bhnhtt.exe 5djjp.exe PID 2716 wrote to memory of 1940 2716 bhnhtt.exe 5djjp.exe PID 1940 wrote to memory of 1724 1940 nnnbnh.exe ddjdd.exe PID 1940 wrote to memory of 1724 1940 nnnbnh.exe ddjdd.exe PID 1940 wrote to memory of 1724 1940 nnnbnh.exe ddjdd.exe PID 1724 wrote to memory of 3676 1724 ddjdd.exe jjdvj.exe PID 1724 wrote to memory of 3676 1724 ddjdd.exe jjdvj.exe PID 1724 wrote to memory of 3676 1724 ddjdd.exe jjdvj.exe PID 3676 wrote to memory of 2756 3676 jjdvj.exe xlrlfxx.exe PID 3676 wrote to memory of 2756 3676 jjdvj.exe xlrlfxx.exe PID 3676 wrote to memory of 2756 3676 jjdvj.exe xlrlfxx.exe PID 2756 wrote to memory of 4808 2756 xlrlfxx.exe xlrrrrl.exe PID 2756 wrote to memory of 4808 2756 xlrlfxx.exe xlrrrrl.exe PID 2756 wrote to memory of 4808 2756 xlrlfxx.exe xlrrrrl.exe PID 4808 wrote to memory of 1736 4808 xlrrrrl.exe ttnbtn.exe PID 4808 wrote to memory of 1736 4808 xlrrrrl.exe ttnbtn.exe PID 4808 wrote to memory of 1736 4808 xlrrrrl.exe ttnbtn.exe PID 1736 wrote to memory of 4840 1736 ttnbtn.exe nbnnnh.exe PID 1736 wrote to memory of 4840 1736 ttnbtn.exe nbnnnh.exe PID 1736 wrote to memory of 4840 1736 ttnbtn.exe nbnnnh.exe PID 4840 wrote to memory of 2492 4840 nbnnnh.exe pvvjp.exe PID 4840 wrote to memory of 2492 4840 nbnnnh.exe pvvjp.exe PID 4840 wrote to memory of 2492 4840 nbnnnh.exe pvvjp.exe PID 2492 wrote to memory of 5084 2492 pvvjp.exe vdvjd.exe PID 2492 wrote to memory of 5084 2492 pvvjp.exe vdvjd.exe PID 2492 wrote to memory of 5084 2492 pvvjp.exe vdvjd.exe PID 5084 wrote to memory of 1044 5084 vdvjd.exe 3lrlfll.exe PID 5084 wrote to memory of 1044 5084 vdvjd.exe 3lrlfll.exe PID 5084 wrote to memory of 1044 5084 vdvjd.exe 3lrlfll.exe PID 1044 wrote to memory of 1608 1044 3lrlfll.exe lxxxlll.exe PID 1044 wrote to memory of 1608 1044 3lrlfll.exe lxxxlll.exe PID 1044 wrote to memory of 1608 1044 3lrlfll.exe lxxxlll.exe PID 1608 wrote to memory of 3472 1608 3lrlffx.exe bbbtnn.exe PID 1608 wrote to memory of 3472 1608 3lrlffx.exe bbbtnn.exe PID 1608 wrote to memory of 3472 1608 3lrlffx.exe bbbtnn.exe PID 3472 wrote to memory of 4552 3472 bbbtnn.exe 1tbthb.exe PID 3472 wrote to memory of 4552 3472 bbbtnn.exe 1tbthb.exe PID 3472 wrote to memory of 4552 3472 bbbtnn.exe 1tbthb.exe PID 4552 wrote to memory of 424 4552 1tbthb.exe dpdvp.exe PID 4552 wrote to memory of 424 4552 1tbthb.exe dpdvp.exe PID 4552 wrote to memory of 424 4552 1tbthb.exe dpdvp.exe PID 424 wrote to memory of 540 424 dpdvp.exe 3ddvj.exe PID 424 wrote to memory of 540 424 dpdvp.exe 3ddvj.exe PID 424 wrote to memory of 540 424 dpdvp.exe 3ddvj.exe PID 540 wrote to memory of 1952 540 3ddvj.exe rxxllff.exe PID 540 wrote to memory of 1952 540 3ddvj.exe rxxllff.exe PID 540 wrote to memory of 1952 540 3ddvj.exe rxxllff.exe PID 1952 wrote to memory of 2568 1952 rxxllff.exe lfxrlfx.exe PID 1952 wrote to memory of 2568 1952 rxxllff.exe lfxrlfx.exe PID 1952 wrote to memory of 2568 1952 rxxllff.exe lfxrlfx.exe PID 2568 wrote to memory of 1012 2568 lfxrlfx.exe hnhbtt.exe PID 2568 wrote to memory of 1012 2568 lfxrlfx.exe hnhbtt.exe PID 2568 wrote to memory of 1012 2568 lfxrlfx.exe hnhbtt.exe PID 1012 wrote to memory of 3516 1012 hnhbtt.exe ntbbtn.exe PID 1012 wrote to memory of 3516 1012 hnhbtt.exe ntbbtn.exe PID 1012 wrote to memory of 3516 1012 hnhbtt.exe ntbbtn.exe PID 3516 wrote to memory of 2032 3516 ntbbtn.exe pddpj.exe PID 3516 wrote to memory of 2032 3516 ntbbtn.exe pddpj.exe PID 3516 wrote to memory of 2032 3516 ntbbtn.exe pddpj.exe PID 2032 wrote to memory of 1336 2032 pddpj.exe jdjdj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20d5e1eae73e69ff16c3134ae05844f658800c79f1a941325c9d6a1120780e45.exe"C:\Users\Admin\AppData\Local\Temp\20d5e1eae73e69ff16c3134ae05844f658800c79f1a941325c9d6a1120780e45.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\bhnhtt.exec:\bhnhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\nnnbnh.exec:\nnnbnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\ddjdd.exec:\ddjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\jjdvj.exec:\jjdvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\xlrrrrl.exec:\xlrrrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\ttnbtn.exec:\ttnbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\nbnnnh.exec:\nbnnnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\pvvjp.exec:\pvvjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\vdvjd.exec:\vdvjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\3lrlfll.exec:\3lrlfll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\3lrlffx.exec:\3lrlffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\bbbtnn.exec:\bbbtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\1tbthb.exec:\1tbthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\dpdvp.exec:\dpdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424 -
\??\c:\3ddvj.exec:\3ddvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\rxxllff.exec:\rxxllff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\hnhbtt.exec:\hnhbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\ntbbtn.exec:\ntbbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\pddpj.exec:\pddpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\jdjdj.exec:\jdjdj.exe23⤵
- Executes dropped EXE
PID:1336 -
\??\c:\ppjvd.exec:\ppjvd.exe24⤵
- Executes dropped EXE
PID:1532 -
\??\c:\rxlxfrr.exec:\rxlxfrr.exe25⤵
- Executes dropped EXE
PID:3964 -
\??\c:\lllrflf.exec:\lllrflf.exe26⤵
- Executes dropped EXE
PID:2416 -
\??\c:\7tnnhh.exec:\7tnnhh.exe27⤵
- Executes dropped EXE
PID:1884 -
\??\c:\vpjdp.exec:\vpjdp.exe28⤵
- Executes dropped EXE
PID:3832 -
\??\c:\ppdvd.exec:\ppdvd.exe29⤵
- Executes dropped EXE
PID:3904 -
\??\c:\xxrxflr.exec:\xxrxflr.exe30⤵
- Executes dropped EXE
PID:2856 -
\??\c:\frfrxlx.exec:\frfrxlx.exe31⤵
- Executes dropped EXE
PID:4224 -
\??\c:\bbnbnh.exec:\bbnbnh.exe32⤵
- Executes dropped EXE
PID:2280 -
\??\c:\3ttnbt.exec:\3ttnbt.exe33⤵
- Executes dropped EXE
PID:388 -
\??\c:\jdpjv.exec:\jdpjv.exe34⤵
- Executes dropped EXE
PID:4004 -
\??\c:\xfxrlll.exec:\xfxrlll.exe35⤵
- Executes dropped EXE
PID:4012 -
\??\c:\rfrfxrl.exec:\rfrfxrl.exe36⤵
- Executes dropped EXE
PID:2432 -
\??\c:\tbnnbb.exec:\tbnnbb.exe37⤵
- Executes dropped EXE
PID:3876 -
\??\c:\nhbbnn.exec:\nhbbnn.exe38⤵
- Executes dropped EXE
PID:2376 -
\??\c:\dpvvv.exec:\dpvvv.exe39⤵
- Executes dropped EXE
PID:4924 -
\??\c:\1ppjd.exec:\1ppjd.exe40⤵
- Executes dropped EXE
PID:1496 -
\??\c:\5xxrrlr.exec:\5xxrrlr.exe41⤵
- Executes dropped EXE
PID:1784 -
\??\c:\frrrlrl.exec:\frrrlrl.exe42⤵
- Executes dropped EXE
PID:2328 -
\??\c:\5bnnhh.exec:\5bnnhh.exe43⤵
- Executes dropped EXE
PID:2636 -
\??\c:\tntbbh.exec:\tntbbh.exe44⤵
- Executes dropped EXE
PID:4456 -
\??\c:\djpjv.exec:\djpjv.exe45⤵
- Executes dropped EXE
PID:5016 -
\??\c:\jpdjj.exec:\jpdjj.exe46⤵
- Executes dropped EXE
PID:2260 -
\??\c:\fllfllf.exec:\fllfllf.exe47⤵
- Executes dropped EXE
PID:4336 -
\??\c:\rlrrrrx.exec:\rlrrrrx.exe48⤵
- Executes dropped EXE
PID:4560 -
\??\c:\1bttnn.exec:\1bttnn.exe49⤵
- Executes dropped EXE
PID:3016 -
\??\c:\httnhh.exec:\httnhh.exe50⤵
- Executes dropped EXE
PID:2708 -
\??\c:\3ddvp.exec:\3ddvp.exe51⤵
- Executes dropped EXE
PID:4808 -
\??\c:\1dddj.exec:\1dddj.exe52⤵
- Executes dropped EXE
PID:1736 -
\??\c:\lflfxxx.exec:\lflfxxx.exe53⤵
- Executes dropped EXE
PID:4516 -
\??\c:\lfrrxff.exec:\lfrrxff.exe54⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hbtnhb.exec:\hbtnhb.exe55⤵
- Executes dropped EXE
PID:2968 -
\??\c:\nbthtt.exec:\nbthtt.exe56⤵
- Executes dropped EXE
PID:4920 -
\??\c:\1hhbnn.exec:\1hhbnn.exe57⤵
- Executes dropped EXE
PID:1240 -
\??\c:\vpjdv.exec:\vpjdv.exe58⤵
- Executes dropped EXE
PID:444 -
\??\c:\vvjdp.exec:\vvjdp.exe59⤵
- Executes dropped EXE
PID:4316 -
\??\c:\lfxfxfx.exec:\lfxfxfx.exe60⤵
- Executes dropped EXE
PID:4552 -
\??\c:\fxfrrxx.exec:\fxfrrxx.exe61⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hnnhtt.exec:\hnnhtt.exe62⤵
- Executes dropped EXE
PID:2320 -
\??\c:\btnhhh.exec:\btnhhh.exe63⤵
- Executes dropped EXE
PID:4940 -
\??\c:\3pjdd.exec:\3pjdd.exe64⤵
- Executes dropped EXE
PID:3920 -
\??\c:\vjddd.exec:\vjddd.exe65⤵
- Executes dropped EXE
PID:808 -
\??\c:\lfxlxrl.exec:\lfxlxrl.exe66⤵PID:3008
-
\??\c:\fllfxrl.exec:\fllfxrl.exe67⤵PID:5116
-
\??\c:\nhtthh.exec:\nhtthh.exe68⤵PID:1444
-
\??\c:\nhhhhh.exec:\nhhhhh.exe69⤵PID:760
-
\??\c:\jjjvd.exec:\jjjvd.exe70⤵PID:1312
-
\??\c:\9vvpp.exec:\9vvpp.exe71⤵PID:3180
-
\??\c:\lfxrfxx.exec:\lfxrfxx.exe72⤵PID:1844
-
\??\c:\1hhthb.exec:\1hhthb.exe73⤵PID:1532
-
\??\c:\3ntnhb.exec:\3ntnhb.exe74⤵PID:3964
-
\??\c:\vjdjd.exec:\vjdjd.exe75⤵PID:4112
-
\??\c:\jjvvp.exec:\jjvvp.exe76⤵PID:372
-
\??\c:\ffxxxff.exec:\ffxxxff.exe77⤵PID:1788
-
\??\c:\frxrffl.exec:\frxrffl.exe78⤵PID:1820
-
\??\c:\hbthbt.exec:\hbthbt.exe79⤵PID:3720
-
\??\c:\tttnhh.exec:\tttnhh.exe80⤵PID:4464
-
\??\c:\3jddd.exec:\3jddd.exe81⤵PID:1392
-
\??\c:\1vvpj.exec:\1vvpj.exe82⤵PID:4768
-
\??\c:\fxfxxrx.exec:\fxfxxrx.exe83⤵PID:2280
-
\??\c:\rrlxlfx.exec:\rrlxlfx.exe84⤵PID:4480
-
\??\c:\1ttnhh.exec:\1ttnhh.exe85⤵PID:3484
-
\??\c:\9hbbtb.exec:\9hbbtb.exe86⤵PID:4856
-
\??\c:\jvjjj.exec:\jvjjj.exe87⤵PID:4004
-
\??\c:\ddvvj.exec:\ddvvj.exe88⤵PID:4012
-
\??\c:\rlffflf.exec:\rlffflf.exe89⤵PID:2316
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe90⤵PID:4520
-
\??\c:\thnhhh.exec:\thnhhh.exe91⤵PID:2020
-
\??\c:\bbnhtb.exec:\bbnhtb.exe92⤵PID:4140
-
\??\c:\ddvpd.exec:\ddvpd.exe93⤵PID:3376
-
\??\c:\1ddvj.exec:\1ddvj.exe94⤵PID:1208
-
\??\c:\llfxrll.exec:\llfxrll.exe95⤵PID:4792
-
\??\c:\lflllrr.exec:\lflllrr.exe96⤵PID:1584
-
\??\c:\tbbthb.exec:\tbbthb.exe97⤵PID:2328
-
\??\c:\bnhhbt.exec:\bnhhbt.exe98⤵PID:4436
-
\??\c:\hbbbtt.exec:\hbbbtt.exe99⤵PID:1504
-
\??\c:\jddjv.exec:\jddjv.exe100⤵PID:1660
-
\??\c:\vvddj.exec:\vvddj.exe101⤵PID:1724
-
\??\c:\ffxrfxr.exec:\ffxrfxr.exe102⤵PID:1580
-
\??\c:\rrxxxxr.exec:\rrxxxxr.exe103⤵PID:3676
-
\??\c:\bhhhbn.exec:\bhhhbn.exe104⤵PID:4608
-
\??\c:\3nnbtt.exec:\3nnbtt.exe105⤵PID:2948
-
\??\c:\dvpjv.exec:\dvpjv.exe106⤵PID:1520
-
\??\c:\7jdjd.exec:\7jdjd.exe107⤵PID:1576
-
\??\c:\1fffxxr.exec:\1fffxxr.exe108⤵PID:5056
-
\??\c:\rrxxrxr.exec:\rrxxrxr.exe109⤵PID:1044
-
\??\c:\5hnhbb.exec:\5hnhbb.exe110⤵PID:1448
-
\??\c:\hthnnn.exec:\hthnnn.exe111⤵PID:4724
-
\??\c:\nhhhtn.exec:\nhhhtn.exe112⤵PID:2104
-
\??\c:\vvvdd.exec:\vvvdd.exe113⤵PID:4824
-
\??\c:\hhntnh.exec:\hhntnh.exe114⤵PID:1332
-
\??\c:\hhnbnt.exec:\hhnbnt.exe115⤵PID:424
-
\??\c:\thhbbb.exec:\thhbbb.exe116⤵PID:540
-
\??\c:\vjjdd.exec:\vjjdd.exe117⤵PID:4700
-
\??\c:\jvvvv.exec:\jvvvv.exe118⤵PID:2720
-
\??\c:\lxxxlll.exec:\lxxxlll.exe119⤵PID:1608
-
\??\c:\lflflff.exec:\lflflff.exe120⤵PID:1244
-
\??\c:\frrfxrf.exec:\frrfxrf.exe121⤵PID:1992
-
\??\c:\hthhhh.exec:\hthhhh.exe122⤵PID:3612
-
\??\c:\tnhhnh.exec:\tnhhnh.exe123⤵PID:4084
-
\??\c:\3pvvp.exec:\3pvvp.exe124⤵PID:2040
-
\??\c:\pddvp.exec:\pddvp.exe125⤵PID:4576
-
\??\c:\pvpjv.exec:\pvpjv.exe126⤵PID:4676
-
\??\c:\llllfll.exec:\llllfll.exe127⤵PID:3964
-
\??\c:\xrrrlfx.exec:\xrrrlfx.exe128⤵PID:2016
-
\??\c:\ttbbbb.exec:\ttbbbb.exe129⤵PID:1008
-
\??\c:\3nhhbh.exec:\3nhhbh.exe130⤵PID:3832
-
\??\c:\ddjdv.exec:\ddjdv.exe131⤵PID:4384
-
\??\c:\pvdjv.exec:\pvdjv.exe132⤵PID:868
-
\??\c:\rrrxxrx.exec:\rrrxxrx.exe133⤵PID:1048
-
\??\c:\rrllrrf.exec:\rrllrrf.exe134⤵PID:2696
-
\??\c:\bhnttt.exec:\bhnttt.exe135⤵PID:1268
-
\??\c:\nhhbhh.exec:\nhhbhh.exe136⤵PID:320
-
\??\c:\nhbtnn.exec:\nhbtnn.exe137⤵PID:1156
-
\??\c:\jdjdd.exec:\jdjdd.exe138⤵PID:3492
-
\??\c:\jpjvj.exec:\jpjvj.exe139⤵PID:4176
-
\??\c:\rrrxrll.exec:\rrrxrll.exe140⤵PID:5108
-
\??\c:\9ffrfxl.exec:\9ffrfxl.exe141⤵PID:4756
-
\??\c:\5bbtnn.exec:\5bbtnn.exe142⤵PID:3696
-
\??\c:\3nbttb.exec:\3nbttb.exe143⤵PID:2816
-
\??\c:\nnnnhn.exec:\nnnnhn.exe144⤵PID:2020
-
\??\c:\pvvvp.exec:\pvvvp.exe145⤵PID:4448
-
\??\c:\5ddpj.exec:\5ddpj.exe146⤵PID:1340
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe147⤵PID:4452
-
\??\c:\lxllffx.exec:\lxllffx.exe148⤵PID:464
-
\??\c:\nhbntt.exec:\nhbntt.exe149⤵PID:2412
-
\??\c:\nbbbhh.exec:\nbbbhh.exe150⤵PID:2716
-
\??\c:\vddvp.exec:\vddvp.exe151⤵PID:4436
-
\??\c:\5djjp.exec:\5djjp.exe152⤵PID:1940
-
\??\c:\fflfflf.exec:\fflfflf.exe153⤵PID:1660
-
\??\c:\xfrllxf.exec:\xfrllxf.exe154⤵PID:1724
-
\??\c:\tbbbtt.exec:\tbbbtt.exe155⤵PID:3536
-
\??\c:\nnhthh.exec:\nnhthh.exe156⤵PID:4556
-
\??\c:\bhnhbb.exec:\bhnhbb.exe157⤵PID:2604
-
\??\c:\vvppp.exec:\vvppp.exe158⤵PID:1328
-
\??\c:\jpvjd.exec:\jpvjd.exe159⤵PID:1520
-
\??\c:\rrxxlxr.exec:\rrxxlxr.exe160⤵PID:2116
-
\??\c:\frfxrrr.exec:\frfxrrr.exe161⤵PID:4788
-
\??\c:\hbbnhb.exec:\hbbnhb.exe162⤵PID:2288
-
\??\c:\tttnhh.exec:\tttnhh.exe163⤵PID:3396
-
\??\c:\bbhhhn.exec:\bbhhhn.exe164⤵PID:4568
-
\??\c:\ppjvp.exec:\ppjvp.exe165⤵PID:4964
-
\??\c:\vvpdj.exec:\vvpdj.exe166⤵PID:4116
-
\??\c:\djdvv.exec:\djdvv.exe167⤵PID:1076
-
\??\c:\rlfrffx.exec:\rlfrffx.exe168⤵PID:3680
-
\??\c:\9lrrllx.exec:\9lrrllx.exe169⤵PID:2928
-
\??\c:\3nhhht.exec:\3nhhht.exe170⤵PID:2320
-
\??\c:\9tthtt.exec:\9tthtt.exe171⤵PID:3100
-
\??\c:\dvjdp.exec:\dvjdp.exe172⤵PID:808
-
\??\c:\dddvv.exec:\dddvv.exe173⤵PID:4536
-
\??\c:\llxxrfl.exec:\llxxrfl.exe174⤵PID:1444
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe175⤵PID:3120
-
\??\c:\bnnnnn.exec:\bnnnnn.exe176⤵PID:4692
-
\??\c:\nbnhbn.exec:\nbnhbn.exe177⤵PID:4676
-
\??\c:\vpdvv.exec:\vpdvv.exe178⤵PID:1848
-
\??\c:\pvppj.exec:\pvppj.exe179⤵PID:4064
-
\??\c:\frxxrrl.exec:\frxxrrl.exe180⤵PID:4548
-
\??\c:\xrfrrrr.exec:\xrfrrrr.exe181⤵PID:1312
-
\??\c:\tbbbhn.exec:\tbbbhn.exe182⤵PID:840
-
\??\c:\jdppj.exec:\jdppj.exe183⤵PID:3400
-
\??\c:\3jpvp.exec:\3jpvp.exe184⤵PID:1268
-
\??\c:\llxrrrr.exec:\llxrrrr.exe185⤵PID:1936
-
\??\c:\hbnnnn.exec:\hbnnnn.exe186⤵PID:3492
-
\??\c:\bntnhh.exec:\bntnhh.exe187⤵PID:4176
-
\??\c:\tnhbbb.exec:\tnhbbb.exe188⤵PID:1836
-
\??\c:\jdjjd.exec:\jdjjd.exe189⤵PID:4520
-
\??\c:\jdjpv.exec:\jdjpv.exe190⤵PID:1804
-
\??\c:\rlrrrrl.exec:\rlrrrrl.exe191⤵PID:3252
-
\??\c:\1dddd.exec:\1dddd.exe192⤵PID:1340
-
\??\c:\xfllxff.exec:\xfllxff.exe193⤵PID:1372
-
\??\c:\1frxrrf.exec:\1frxrrf.exe194⤵PID:464
-
\??\c:\lrfflff.exec:\lrfflff.exe195⤵PID:2412
-
\??\c:\tnbbbh.exec:\tnbbbh.exe196⤵PID:368
-
\??\c:\1nttnt.exec:\1nttnt.exe197⤵PID:3392
-
\??\c:\vpvpp.exec:\vpvpp.exe198⤵PID:3016
-
\??\c:\7frrllf.exec:\7frrllf.exe199⤵PID:1724
-
\??\c:\7xxrrrr.exec:\7xxrrrr.exe200⤵PID:4544
-
\??\c:\rlffxfx.exec:\rlffxfx.exe201⤵PID:652
-
\??\c:\bbhbbn.exec:\bbhbbn.exe202⤵PID:4808
-
\??\c:\nthnhn.exec:\nthnhn.exe203⤵PID:4024
-
\??\c:\jjdvp.exec:\jjdvp.exe204⤵PID:2804
-
\??\c:\dvjjd.exec:\dvjjd.exe205⤵PID:2500
-
\??\c:\bnthbn.exec:\bnthbn.exe206⤵PID:1676
-
\??\c:\pjjdv.exec:\pjjdv.exe207⤵PID:1452
-
\??\c:\1vdvp.exec:\1vdvp.exe208⤵PID:3396
-
\??\c:\lfllfll.exec:\lfllfll.exe209⤵PID:3036
-
\??\c:\rlxflrf.exec:\rlxflrf.exe210⤵PID:2212
-
\??\c:\hhbnnt.exec:\hhbnnt.exe211⤵PID:4724
-
\??\c:\7bntnn.exec:\7bntnn.exe212⤵PID:4824
-
\??\c:\dvvjd.exec:\dvvjd.exe213⤵PID:884
-
\??\c:\jdpdj.exec:\jdpdj.exe214⤵PID:540
-
\??\c:\flfxrrx.exec:\flfxrrx.exe215⤵PID:3460
-
\??\c:\1xxfflf.exec:\1xxfflf.exe216⤵PID:1972
-
\??\c:\7thnbb.exec:\7thnbb.exe217⤵PID:1244
-
\??\c:\9dddd.exec:\9dddd.exe218⤵PID:808
-
\??\c:\lrxrrxx.exec:\lrxrrxx.exe219⤵PID:4536
-
\??\c:\hnbbhn.exec:\hnbbhn.exe220⤵PID:1444
-
\??\c:\pdjjj.exec:\pdjjj.exe221⤵PID:3728
-
\??\c:\llllrrr.exec:\llllrrr.exe222⤵PID:3964
-
\??\c:\bnbbbh.exec:\bnbbbh.exe223⤵PID:1368
-
\??\c:\dvpjj.exec:\dvpjj.exe224⤵PID:2120
-
\??\c:\lxlfllx.exec:\lxlfllx.exe225⤵PID:740
-
\??\c:\5rffxff.exec:\5rffxff.exe226⤵PID:4664
-
\??\c:\rxfffff.exec:\rxfffff.exe227⤵PID:228
-
\??\c:\tnbbbh.exec:\tnbbbh.exe228⤵PID:680
-
\??\c:\5bnnnt.exec:\5bnnnt.exe229⤵PID:1000
-
\??\c:\vvvvp.exec:\vvvvp.exe230⤵PID:1268
-
\??\c:\jpjjd.exec:\jpjjd.exe231⤵PID:2084
-
\??\c:\5rxrllf.exec:\5rxrllf.exe232⤵PID:2316
-
\??\c:\5thhbh.exec:\5thhbh.exe233⤵PID:4080
-
\??\c:\thntbh.exec:\thntbh.exe234⤵PID:3704
-
\??\c:\3tbbbb.exec:\3tbbbb.exe235⤵PID:2724
-
\??\c:\pjvpp.exec:\pjvpp.exe236⤵PID:984
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe237⤵PID:4792
-
\??\c:\lrrxrxx.exec:\lrrxrxx.exe238⤵PID:2388
-
\??\c:\9xxrllf.exec:\9xxrllf.exe239⤵PID:4680
-
\??\c:\tbnnhn.exec:\tbnnhn.exe240⤵PID:2036
-
\??\c:\hbbbtt.exec:\hbbbtt.exe241⤵PID:2992
-
\??\c:\jdvvv.exec:\jdvvv.exe242⤵PID:4560