Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 21:02
Behavioral task
behavioral1
Sample
35feb60973d4205c953f7ebace0f39d59a7e2d76517d67a3d7d09666acea1ed4.exe
Resource
win7-20240220-en
windows7-x64
6 signatures
150 seconds
General
-
Target
35feb60973d4205c953f7ebace0f39d59a7e2d76517d67a3d7d09666acea1ed4.exe
-
Size
186KB
-
MD5
e4552d0f4eac0f1d34f1c3008c4b7bd1
-
SHA1
8d04b7df83816fe8332fa658ef5797f1f6703046
-
SHA256
35feb60973d4205c953f7ebace0f39d59a7e2d76517d67a3d7d09666acea1ed4
-
SHA512
456f58671db6befa84e9a4c897319b59169680aa04c73dff069d153ff636b7193794042ab4b64d4b759d278c1d3cdcd1719ef9ced6cf64c5a4cefebafd8c1864
-
SSDEEP
3072:3hOmTsF93UYfwC6GIoutw8YcvrqrE66kropO6BWlPFH4tw1D43eM5o:3cm4FmowdHoSzhraHcpOFltH4twl43vC
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3492-1-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/208-12-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4524-14-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/640-25-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4100-30-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4740-40-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4008-54-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4536-61-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3884-76-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2448-82-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4456-90-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/552-101-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2948-104-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1740-111-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1728-115-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2672-120-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1092-129-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1136-150-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3400-154-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3312-179-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1840-183-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4572-190-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/864-202-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2764-204-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4876-211-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/376-215-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4556-225-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4384-229-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1396-231-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3492-237-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2280-239-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1552-245-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3048-250-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5096-259-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4516-261-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3096-275-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2952-278-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4080-296-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2440-298-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1428-313-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/636-318-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4412-324-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/956-331-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1008-336-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3916-354-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/668-369-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1180-414-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2196-438-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2448-457-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2872-463-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4620-465-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4080-471-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2704-503-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1540-561-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1560-566-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4620-615-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4272-632-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1340-672-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5088-683-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4752-728-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4444-781-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3084-810-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3444-814-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2020-874-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3492-1-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\jpvvp.exe UPX behavioral2/memory/208-5-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/208-12-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\hnttnh.exe UPX behavioral2/memory/4524-14-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/640-19-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\nhttbn.exe UPX \??\c:\nbtnhh.exe UPX behavioral2/memory/640-25-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/4740-31-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/4100-30-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\hbbttt.exe UPX \??\c:\jdpdj.exe UPX behavioral2/memory/4036-37-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\rxllffx.exe UPX C:\5htnnn.exe UPX behavioral2/memory/4740-40-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/4008-54-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\pjjjd.exe UPX behavioral2/memory/4536-56-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\frlrlrr.exe UPX behavioral2/memory/4536-61-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\tbbtnn.exe UPX C:\jdpjd.exe UPX behavioral2/memory/3884-76-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\lffxrrl.exe UPX behavioral2/memory/2448-82-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\hnnhbt.exe UPX C:\jvvpj.exe UPX behavioral2/memory/4456-90-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\lrxrlff.exe UPX behavioral2/memory/2044-88-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/552-101-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\ddjjj.exe UPX C:\djddd.exe UPX behavioral2/memory/2948-104-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/1740-111-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\1lllllr.exe UPX C:\nhbbtt.exe UPX behavioral2/memory/1728-115-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/2672-120-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\9tbbtt.exe UPX behavioral2/memory/1092-129-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\lflffff.exe UPX C:\htnhnh.exe UPX C:\nhnnnn.exe UPX C:\frxrrlr.exe UPX behavioral2/memory/1136-150-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\1htntn.exe UPX behavioral2/memory/3400-154-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\1dvdv.exe UPX C:\nthhhh.exe UPX \??\c:\btbbhn.exe UPX C:\djpjj.exe UPX C:\xlfxlxr.exe UPX behavioral2/memory/3312-179-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\9pjdv.exe UPX behavioral2/memory/1840-183-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/4572-190-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/864-202-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/2764-204-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/4876-211-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/376-215-0x0000000000400000-0x0000000000432000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
jpvvp.exenhttbn.exehnttnh.exenbtnhh.exehbbttt.exejdpdj.exerxllffx.exe5htnnn.exepjjjd.exefrlrlrr.exetbbtnn.exejdpjd.exelffxrrl.exehnnhbt.exejvvpj.exelrxrlff.exeddjjj.exedjddd.exe1lllllr.exenhbbtt.exe9tbbtt.exelflffff.exehtnhnh.exenhnnnn.exefrxrrlr.exe1htntn.exe1dvdv.exenthhhh.exebtbbhn.exedjpjj.exexlfxlxr.exe9pjdv.exexxllflf.exehbhbtb.exerxfxfrr.exexrrlfff.exebhbnhh.exejvjjv.exeflrlffx.exe5xfxrlf.exetnttbt.exebhhbtn.exevvjdj.exedpvpj.exelrffffx.exetnnhbt.exehbbttt.exepjjpj.exehnntnn.exe1hbbnn.exeppddv.exejddvj.exefxlflfl.exenhhbtt.exethnnhh.exevpdvd.exexflfllf.exe3rxffrr.exexxffxxx.exethnhbt.exeppjpd.exe1rrxrxx.exe1xffxxr.exebtbthh.exepid process 208 jpvvp.exe 4524 nhttbn.exe 640 hnttnh.exe 4100 nbtnhh.exe 4740 hbbttt.exe 4036 jdpdj.exe 1928 rxllffx.exe 4008 5htnnn.exe 4536 pjjjd.exe 4980 frlrlrr.exe 3608 tbbtnn.exe 3884 jdpjd.exe 2448 lffxrrl.exe 4456 hnnhbt.exe 2044 jvvpj.exe 552 lrxrlff.exe 2948 ddjjj.exe 1740 djddd.exe 1728 1lllllr.exe 2672 nhbbtt.exe 1092 9tbbtt.exe 2308 lflffff.exe 2028 htnhnh.exe 3952 nhnnnn.exe 1136 frxrrlr.exe 3400 1htntn.exe 1616 1dvdv.exe 1736 nthhhh.exe 2024 btbbhn.exe 3312 djpjj.exe 1840 xlfxlxr.exe 4152 9pjdv.exe 4572 xxllflf.exe 3472 hbhbtb.exe 1824 rxfxfrr.exe 864 xrrlfff.exe 2764 bhbnhh.exe 1596 jvjjv.exe 4876 flrlffx.exe 376 5xfxrlf.exe 3820 tnttbt.exe 952 bhhbtn.exe 4556 vvjdj.exe 4384 dpvpj.exe 3492 lrffffx.exe 2280 tnnhbt.exe 1552 hbbttt.exe 1940 pjjpj.exe 3048 hnntnn.exe 468 1hbbnn.exe 5096 ppddv.exe 4516 jddvj.exe 4008 fxlflfl.exe 2828 nhhbtt.exe 3848 thnnhh.exe 3096 vpdvd.exe 2952 xflfllf.exe 4952 3rxffrr.exe 1704 xxffxxx.exe 4456 thnhbt.exe 2044 ppjpd.exe 4080 1rrxrxx.exe 2440 1xffxxr.exe 332 btbthh.exe -
Processes:
resource yara_rule behavioral2/memory/3492-1-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\jpvvp.exe upx behavioral2/memory/208-5-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/208-12-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\hnttnh.exe upx behavioral2/memory/4524-14-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/640-19-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\nhttbn.exe upx \??\c:\nbtnhh.exe upx behavioral2/memory/640-25-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4740-31-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4100-30-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\hbbttt.exe upx \??\c:\jdpdj.exe upx behavioral2/memory/4036-37-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\rxllffx.exe upx C:\5htnnn.exe upx behavioral2/memory/4740-40-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4008-54-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\pjjjd.exe upx behavioral2/memory/4536-56-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\frlrlrr.exe upx behavioral2/memory/4536-61-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\tbbtnn.exe upx C:\jdpjd.exe upx behavioral2/memory/3884-76-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\lffxrrl.exe upx behavioral2/memory/2448-82-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\hnnhbt.exe upx C:\jvvpj.exe upx behavioral2/memory/4456-90-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\lrxrlff.exe upx behavioral2/memory/2044-88-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/552-101-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\ddjjj.exe upx C:\djddd.exe upx behavioral2/memory/2948-104-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/1740-111-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\1lllllr.exe upx C:\nhbbtt.exe upx behavioral2/memory/1728-115-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/2672-120-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\9tbbtt.exe upx behavioral2/memory/1092-129-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\lflffff.exe upx C:\htnhnh.exe upx C:\nhnnnn.exe upx C:\frxrrlr.exe upx behavioral2/memory/1136-150-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\1htntn.exe upx behavioral2/memory/3400-154-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\1dvdv.exe upx C:\nthhhh.exe upx \??\c:\btbbhn.exe upx C:\djpjj.exe upx C:\xlfxlxr.exe upx behavioral2/memory/3312-179-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\9pjdv.exe upx behavioral2/memory/1840-183-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4572-190-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/864-202-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/2764-204-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4876-211-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/376-215-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
35feb60973d4205c953f7ebace0f39d59a7e2d76517d67a3d7d09666acea1ed4.exejpvvp.exenhttbn.exehnttnh.exenbtnhh.exehbbttt.exejdpdj.exerxllffx.exe5htnnn.exepjjjd.exefrlrlrr.exetbbtnn.exejdpjd.exelffxrrl.exehnnhbt.exejvvpj.exelrxrlff.exeddjjj.exedjddd.exe1lllllr.exenhbbtt.exe9tbbtt.exedescription pid process target process PID 3492 wrote to memory of 208 3492 35feb60973d4205c953f7ebace0f39d59a7e2d76517d67a3d7d09666acea1ed4.exe jpvvp.exe PID 3492 wrote to memory of 208 3492 35feb60973d4205c953f7ebace0f39d59a7e2d76517d67a3d7d09666acea1ed4.exe jpvvp.exe PID 3492 wrote to memory of 208 3492 35feb60973d4205c953f7ebace0f39d59a7e2d76517d67a3d7d09666acea1ed4.exe jpvvp.exe PID 208 wrote to memory of 4524 208 jpvvp.exe nhttbn.exe PID 208 wrote to memory of 4524 208 jpvvp.exe nhttbn.exe PID 208 wrote to memory of 4524 208 jpvvp.exe nhttbn.exe PID 4524 wrote to memory of 640 4524 nhttbn.exe hnttnh.exe PID 4524 wrote to memory of 640 4524 nhttbn.exe hnttnh.exe PID 4524 wrote to memory of 640 4524 nhttbn.exe hnttnh.exe PID 640 wrote to memory of 4100 640 hnttnh.exe nbtnhh.exe PID 640 wrote to memory of 4100 640 hnttnh.exe nbtnhh.exe PID 640 wrote to memory of 4100 640 hnttnh.exe nbtnhh.exe PID 4100 wrote to memory of 4740 4100 nbtnhh.exe hbbttt.exe PID 4100 wrote to memory of 4740 4100 nbtnhh.exe hbbttt.exe PID 4100 wrote to memory of 4740 4100 nbtnhh.exe hbbttt.exe PID 4740 wrote to memory of 4036 4740 hbbttt.exe jdpdj.exe PID 4740 wrote to memory of 4036 4740 hbbttt.exe jdpdj.exe PID 4740 wrote to memory of 4036 4740 hbbttt.exe jdpdj.exe PID 4036 wrote to memory of 1928 4036 jdpdj.exe rxllffx.exe PID 4036 wrote to memory of 1928 4036 jdpdj.exe rxllffx.exe PID 4036 wrote to memory of 1928 4036 jdpdj.exe rxllffx.exe PID 1928 wrote to memory of 4008 1928 rxllffx.exe 5htnnn.exe PID 1928 wrote to memory of 4008 1928 rxllffx.exe 5htnnn.exe PID 1928 wrote to memory of 4008 1928 rxllffx.exe 5htnnn.exe PID 4008 wrote to memory of 4536 4008 5htnnn.exe pjjjd.exe PID 4008 wrote to memory of 4536 4008 5htnnn.exe pjjjd.exe PID 4008 wrote to memory of 4536 4008 5htnnn.exe pjjjd.exe PID 4536 wrote to memory of 4980 4536 pjjjd.exe frlrlrr.exe PID 4536 wrote to memory of 4980 4536 pjjjd.exe frlrlrr.exe PID 4536 wrote to memory of 4980 4536 pjjjd.exe frlrlrr.exe PID 4980 wrote to memory of 3608 4980 frlrlrr.exe tbbtnn.exe PID 4980 wrote to memory of 3608 4980 frlrlrr.exe tbbtnn.exe PID 4980 wrote to memory of 3608 4980 frlrlrr.exe tbbtnn.exe PID 3608 wrote to memory of 3884 3608 tbbtnn.exe jdpjd.exe PID 3608 wrote to memory of 3884 3608 tbbtnn.exe jdpjd.exe PID 3608 wrote to memory of 3884 3608 tbbtnn.exe jdpjd.exe PID 3884 wrote to memory of 2448 3884 jdpjd.exe lffxrrl.exe PID 3884 wrote to memory of 2448 3884 jdpjd.exe lffxrrl.exe PID 3884 wrote to memory of 2448 3884 jdpjd.exe lffxrrl.exe PID 2448 wrote to memory of 4456 2448 lffxrrl.exe hnnhbt.exe PID 2448 wrote to memory of 4456 2448 lffxrrl.exe hnnhbt.exe PID 2448 wrote to memory of 4456 2448 lffxrrl.exe hnnhbt.exe PID 4456 wrote to memory of 2044 4456 hnnhbt.exe jvvpj.exe PID 4456 wrote to memory of 2044 4456 hnnhbt.exe jvvpj.exe PID 4456 wrote to memory of 2044 4456 hnnhbt.exe jvvpj.exe PID 2044 wrote to memory of 552 2044 jvvpj.exe lrxrlff.exe PID 2044 wrote to memory of 552 2044 jvvpj.exe lrxrlff.exe PID 2044 wrote to memory of 552 2044 jvvpj.exe lrxrlff.exe PID 552 wrote to memory of 2948 552 lrxrlff.exe ddjjj.exe PID 552 wrote to memory of 2948 552 lrxrlff.exe ddjjj.exe PID 552 wrote to memory of 2948 552 lrxrlff.exe ddjjj.exe PID 2948 wrote to memory of 1740 2948 ddjjj.exe djddd.exe PID 2948 wrote to memory of 1740 2948 ddjjj.exe djddd.exe PID 2948 wrote to memory of 1740 2948 ddjjj.exe djddd.exe PID 1740 wrote to memory of 1728 1740 djddd.exe 1lllllr.exe PID 1740 wrote to memory of 1728 1740 djddd.exe 1lllllr.exe PID 1740 wrote to memory of 1728 1740 djddd.exe 1lllllr.exe PID 1728 wrote to memory of 2672 1728 1lllllr.exe nhbbtt.exe PID 1728 wrote to memory of 2672 1728 1lllllr.exe nhbbtt.exe PID 1728 wrote to memory of 2672 1728 1lllllr.exe nhbbtt.exe PID 2672 wrote to memory of 1092 2672 nhbbtt.exe 9tbbtt.exe PID 2672 wrote to memory of 1092 2672 nhbbtt.exe 9tbbtt.exe PID 2672 wrote to memory of 1092 2672 nhbbtt.exe 9tbbtt.exe PID 1092 wrote to memory of 2308 1092 9tbbtt.exe lflffff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35feb60973d4205c953f7ebace0f39d59a7e2d76517d67a3d7d09666acea1ed4.exe"C:\Users\Admin\AppData\Local\Temp\35feb60973d4205c953f7ebace0f39d59a7e2d76517d67a3d7d09666acea1ed4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\jpvvp.exec:\jpvvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\nhttbn.exec:\nhttbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\hnttnh.exec:\hnttnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\nbtnhh.exec:\nbtnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\hbbttt.exec:\hbbttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\jdpdj.exec:\jdpdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\rxllffx.exec:\rxllffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\5htnnn.exec:\5htnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\pjjjd.exec:\pjjjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\frlrlrr.exec:\frlrlrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\tbbtnn.exec:\tbbtnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\jdpjd.exec:\jdpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\lffxrrl.exec:\lffxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\hnnhbt.exec:\hnnhbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\jvvpj.exec:\jvvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\lrxrlff.exec:\lrxrlff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\ddjjj.exec:\ddjjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\djddd.exec:\djddd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\1lllllr.exec:\1lllllr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\nhbbtt.exec:\nhbbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\9tbbtt.exec:\9tbbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\lflffff.exec:\lflffff.exe23⤵
- Executes dropped EXE
PID:2308 -
\??\c:\htnhnh.exec:\htnhnh.exe24⤵
- Executes dropped EXE
PID:2028 -
\??\c:\nhnnnn.exec:\nhnnnn.exe25⤵
- Executes dropped EXE
PID:3952 -
\??\c:\frxrrlr.exec:\frxrrlr.exe26⤵
- Executes dropped EXE
PID:1136 -
\??\c:\1htntn.exec:\1htntn.exe27⤵
- Executes dropped EXE
PID:3400 -
\??\c:\1dvdv.exec:\1dvdv.exe28⤵
- Executes dropped EXE
PID:1616 -
\??\c:\nthhhh.exec:\nthhhh.exe29⤵
- Executes dropped EXE
PID:1736 -
\??\c:\btbbhn.exec:\btbbhn.exe30⤵
- Executes dropped EXE
PID:2024 -
\??\c:\djpjj.exec:\djpjj.exe31⤵
- Executes dropped EXE
PID:3312 -
\??\c:\xlfxlxr.exec:\xlfxlxr.exe32⤵
- Executes dropped EXE
PID:1840 -
\??\c:\9pjdv.exec:\9pjdv.exe33⤵
- Executes dropped EXE
PID:4152 -
\??\c:\xxllflf.exec:\xxllflf.exe34⤵
- Executes dropped EXE
PID:4572 -
\??\c:\hbhbtb.exec:\hbhbtb.exe35⤵
- Executes dropped EXE
PID:3472 -
\??\c:\rxfxfrr.exec:\rxfxfrr.exe36⤵
- Executes dropped EXE
PID:1824 -
\??\c:\xrrlfff.exec:\xrrlfff.exe37⤵
- Executes dropped EXE
PID:864 -
\??\c:\bhbnhh.exec:\bhbnhh.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jvjjv.exec:\jvjjv.exe39⤵
- Executes dropped EXE
PID:1596 -
\??\c:\flrlffx.exec:\flrlffx.exe40⤵
- Executes dropped EXE
PID:4876 -
\??\c:\5xfxrlf.exec:\5xfxrlf.exe41⤵
- Executes dropped EXE
PID:376 -
\??\c:\tnttbt.exec:\tnttbt.exe42⤵
- Executes dropped EXE
PID:3820 -
\??\c:\bhhbtn.exec:\bhhbtn.exe43⤵
- Executes dropped EXE
PID:952 -
\??\c:\vvjdj.exec:\vvjdj.exe44⤵
- Executes dropped EXE
PID:4556 -
\??\c:\dpvpj.exec:\dpvpj.exe45⤵
- Executes dropped EXE
PID:4384 -
\??\c:\fxlfxfx.exec:\fxlfxfx.exe46⤵PID:1396
-
\??\c:\lrffffx.exec:\lrffffx.exe47⤵
- Executes dropped EXE
PID:3492 -
\??\c:\tnnhbt.exec:\tnnhbt.exe48⤵
- Executes dropped EXE
PID:2280 -
\??\c:\hbbttt.exec:\hbbttt.exe49⤵
- Executes dropped EXE
PID:1552 -
\??\c:\pjjpj.exec:\pjjpj.exe50⤵
- Executes dropped EXE
PID:1940 -
\??\c:\hnntnn.exec:\hnntnn.exe51⤵
- Executes dropped EXE
PID:3048 -
\??\c:\1hbbnn.exec:\1hbbnn.exe52⤵
- Executes dropped EXE
PID:468 -
\??\c:\ppddv.exec:\ppddv.exe53⤵
- Executes dropped EXE
PID:5096 -
\??\c:\jddvj.exec:\jddvj.exe54⤵
- Executes dropped EXE
PID:4516 -
\??\c:\fxlflfl.exec:\fxlflfl.exe55⤵
- Executes dropped EXE
PID:4008 -
\??\c:\nhhbtt.exec:\nhhbtt.exe56⤵
- Executes dropped EXE
PID:2828 -
\??\c:\thnnhh.exec:\thnnhh.exe57⤵
- Executes dropped EXE
PID:3848 -
\??\c:\vpdvd.exec:\vpdvd.exe58⤵
- Executes dropped EXE
PID:3096 -
\??\c:\xflfllf.exec:\xflfllf.exe59⤵
- Executes dropped EXE
PID:2952 -
\??\c:\3rxffrr.exec:\3rxffrr.exe60⤵
- Executes dropped EXE
PID:4952 -
\??\c:\xxffxxx.exec:\xxffxxx.exe61⤵
- Executes dropped EXE
PID:1704 -
\??\c:\thnhbt.exec:\thnhbt.exe62⤵
- Executes dropped EXE
PID:4456 -
\??\c:\ppjpd.exec:\ppjpd.exe63⤵
- Executes dropped EXE
PID:2044 -
\??\c:\1rrxrxx.exec:\1rrxrxx.exe64⤵
- Executes dropped EXE
PID:4080 -
\??\c:\1xffxxr.exec:\1xffxxr.exe65⤵
- Executes dropped EXE
PID:2440 -
\??\c:\btbthh.exec:\btbthh.exe66⤵
- Executes dropped EXE
PID:332 -
\??\c:\3nhbbb.exec:\3nhbbb.exe67⤵PID:1740
-
\??\c:\dpppj.exec:\dpppj.exe68⤵PID:4500
-
\??\c:\frxffxr.exec:\frxffxr.exe69⤵PID:1532
-
\??\c:\ffrrxfl.exec:\ffrrxfl.exe70⤵PID:1428
-
\??\c:\bnhbhh.exec:\bnhbhh.exe71⤵PID:636
-
\??\c:\tnbttt.exec:\tnbttt.exe72⤵PID:4412
-
\??\c:\nhbttb.exec:\nhbttb.exe73⤵PID:4444
-
\??\c:\dpjjj.exec:\dpjjj.exe74⤵PID:956
-
\??\c:\pjjdv.exec:\pjjdv.exe75⤵PID:812
-
\??\c:\fxlflfr.exec:\fxlflfr.exe76⤵PID:1008
-
\??\c:\llxrxxf.exec:\llxrxxf.exe77⤵PID:976
-
\??\c:\htbbtt.exec:\htbbtt.exe78⤵PID:3468
-
\??\c:\9djjv.exec:\9djjv.exe79⤵PID:1976
-
\??\c:\9fffxxx.exec:\9fffxxx.exe80⤵PID:3812
-
\??\c:\flfxrll.exec:\flfxrll.exe81⤵PID:3916
-
\??\c:\bnnhbb.exec:\bnnhbb.exe82⤵PID:4316
-
\??\c:\pjpjp.exec:\pjpjp.exe83⤵PID:3312
-
\??\c:\pjpjd.exec:\pjpjd.exe84⤵PID:4128
-
\??\c:\frffxff.exec:\frffxff.exe85⤵PID:1340
-
\??\c:\9hnnnn.exec:\9hnnnn.exe86⤵PID:668
-
\??\c:\btnhtn.exec:\btnhtn.exe87⤵PID:1312
-
\??\c:\7jppj.exec:\7jppj.exe88⤵PID:3864
-
\??\c:\jvddp.exec:\jvddp.exe89⤵PID:1764
-
\??\c:\httnhb.exec:\httnhb.exe90⤵PID:4004
-
\??\c:\3hnbhb.exec:\3hnbhb.exe91⤵PID:5092
-
\??\c:\vjjjj.exec:\vjjjj.exe92⤵PID:4948
-
\??\c:\7dvjd.exec:\7dvjd.exe93⤵PID:4840
-
\??\c:\7rrrffx.exec:\7rrrffx.exe94⤵PID:3820
-
\??\c:\lrxxxrf.exec:\lrxxxrf.exe95⤵PID:2304
-
\??\c:\rlrlfff.exec:\rlrlfff.exe96⤵PID:4408
-
\??\c:\nnbtnn.exec:\nnbtnn.exe97⤵PID:60
-
\??\c:\tbbtnn.exec:\tbbtnn.exe98⤵PID:228
-
\??\c:\jvjdv.exec:\jvjdv.exe99⤵PID:3492
-
\??\c:\jdjdd.exec:\jdjdd.exe100⤵PID:1180
-
\??\c:\fxxrllf.exec:\fxxrllf.exe101⤵PID:3968
-
\??\c:\fxffxxr.exec:\fxffxxr.exe102⤵PID:1624
-
\??\c:\ttbtnh.exec:\ttbtnh.exe103⤵PID:1620
-
\??\c:\5ttnhb.exec:\5ttnhb.exe104⤵PID:3512
-
\??\c:\vvvjv.exec:\vvvjv.exe105⤵PID:2008
-
\??\c:\jvvpv.exec:\jvvpv.exe106⤵PID:4912
-
\??\c:\fxxrllr.exec:\fxxrllr.exe107⤵PID:4536
-
\??\c:\1xffxxx.exec:\1xffxxx.exe108⤵PID:2196
-
\??\c:\rlllfff.exec:\rlllfff.exe109⤵PID:2908
-
\??\c:\httnhb.exec:\httnhb.exe110⤵PID:4780
-
\??\c:\nhbnhb.exec:\nhbnhb.exe111⤵PID:3352
-
\??\c:\vvddp.exec:\vvddp.exe112⤵PID:2224
-
\??\c:\5jpjd.exec:\5jpjd.exe113⤵PID:2432
-
\??\c:\rfxrxrl.exec:\rfxrxrl.exe114⤵PID:2448
-
\??\c:\fxlfffx.exec:\fxlfffx.exe115⤵PID:2872
-
\??\c:\hhbbhh.exec:\hhbbhh.exe116⤵PID:4620
-
\??\c:\hhnhbt.exec:\hhnhbt.exe117⤵PID:4080
-
\??\c:\vpjdp.exec:\vpjdp.exe118⤵PID:1368
-
\??\c:\rflfxxr.exec:\rflfxxr.exe119⤵PID:4732
-
\??\c:\xrrlfll.exec:\xrrlfll.exe120⤵PID:1728
-
\??\c:\5ttnhh.exec:\5ttnhh.exe121⤵PID:4496
-
\??\c:\ddddv.exec:\ddddv.exe122⤵PID:728
-
\??\c:\rrfxxxx.exec:\rrfxxxx.exe123⤵PID:1056
-
\??\c:\fxxfffx.exec:\fxxfffx.exe124⤵PID:4368
-
\??\c:\nhnnhh.exec:\nhnnhh.exe125⤵PID:4868
-
\??\c:\jpppj.exec:\jpppj.exe126⤵PID:1460
-
\??\c:\jjjjd.exec:\jjjjd.exe127⤵PID:2704
-
\??\c:\frxrlff.exec:\frxrlff.exe128⤵PID:4580
-
\??\c:\rlxxffr.exec:\rlxxffr.exe129⤵PID:3156
-
\??\c:\nhnhbh.exec:\nhnhbh.exe130⤵PID:4964
-
\??\c:\vvvpj.exec:\vvvpj.exe131⤵PID:1976
-
\??\c:\djddv.exec:\djddv.exe132⤵PID:1152
-
\??\c:\rrfrlxl.exec:\rrfrlxl.exe133⤵PID:2840
-
\??\c:\rrxrlff.exec:\rrxrlff.exe134⤵PID:4600
-
\??\c:\hbnntn.exec:\hbnntn.exe135⤵PID:4784
-
\??\c:\htnnbb.exec:\htnnbb.exe136⤵PID:1968
-
\??\c:\vpjdv.exec:\vpjdv.exe137⤵PID:3020
-
\??\c:\rfrlxxl.exec:\rfrlxxl.exe138⤵PID:2220
-
\??\c:\rfxrllf.exec:\rfxrllf.exe139⤵PID:5088
-
\??\c:\hbbtbb.exec:\hbbtbb.exe140⤵PID:4948
-
\??\c:\tnnhbb.exec:\tnnhbb.exe141⤵PID:4840
-
\??\c:\jpvvj.exec:\jpvvj.exe142⤵PID:3820
-
\??\c:\dvvpj.exec:\dvvpj.exe143⤵PID:4556
-
\??\c:\3ffxxxx.exec:\3ffxxxx.exe144⤵PID:1788
-
\??\c:\bttnhh.exec:\bttnhh.exe145⤵PID:1100
-
\??\c:\nhhbtt.exec:\nhhbtt.exe146⤵PID:1540
-
\??\c:\vjdpj.exec:\vjdpj.exe147⤵PID:1588
-
\??\c:\xrrfrrr.exec:\xrrfrrr.exe148⤵PID:1560
-
\??\c:\xrrlfxl.exec:\xrrlfxl.exe149⤵PID:4832
-
\??\c:\hbhhnh.exec:\hbhhnh.exe150⤵PID:3708
-
\??\c:\vjpdp.exec:\vjpdp.exe151⤵PID:1564
-
\??\c:\jdjvp.exec:\jdjvp.exe152⤵PID:1132
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe153⤵PID:2348
-
\??\c:\5rxlfxr.exec:\5rxlfxr.exe154⤵PID:3764
-
\??\c:\tnthbt.exec:\tnthbt.exe155⤵PID:4400
-
\??\c:\nnhhbb.exec:\nnhhbb.exe156⤵PID:4148
-
\??\c:\9ffffrl.exec:\9ffffrl.exe157⤵PID:3096
-
\??\c:\tnbntn.exec:\tnbntn.exe158⤵PID:404
-
\??\c:\nntbhn.exec:\nntbhn.exe159⤵PID:4332
-
\??\c:\lrrrrxr.exec:\lrrrrxr.exe160⤵PID:4872
-
\??\c:\9bbhbt.exec:\9bbhbt.exe161⤵PID:1704
-
\??\c:\pvddj.exec:\pvddj.exe162⤵PID:4512
-
\??\c:\xflxrlf.exec:\xflxrlf.exe163⤵PID:4620
-
\??\c:\tntbhh.exec:\tntbhh.exe164⤵PID:4080
-
\??\c:\3dddp.exec:\3dddp.exe165⤵PID:1368
-
\??\c:\pjpjp.exec:\pjpjp.exe166⤵PID:4732
-
\??\c:\xrrlffx.exec:\xrrlffx.exe167⤵PID:1728
-
\??\c:\llrlrrf.exec:\llrlrrf.exe168⤵PID:1220
-
\??\c:\9nnnbb.exec:\9nnnbb.exe169⤵PID:4272
-
\??\c:\pppjv.exec:\pppjv.exe170⤵PID:4412
-
\??\c:\ffrrlrl.exec:\ffrrlrl.exe171⤵PID:2028
-
\??\c:\rfrlfxr.exec:\rfrlfxr.exe172⤵PID:2164
-
\??\c:\7nbtnn.exec:\7nbtnn.exe173⤵PID:1112
-
\??\c:\tnbttt.exec:\tnbttt.exe174⤵PID:2272
-
\??\c:\vjjdp.exec:\vjjdp.exe175⤵PID:3824
-
\??\c:\pppdp.exec:\pppdp.exe176⤵PID:880
-
\??\c:\9fxrffx.exec:\9fxrffx.exe177⤵PID:2596
-
\??\c:\lxrlfxf.exec:\lxrlfxf.exe178⤵PID:2380
-
\??\c:\bhnhnn.exec:\bhnhnn.exe179⤵PID:3328
-
\??\c:\jjjjv.exec:\jjjjv.exe180⤵PID:4800
-
\??\c:\flllxrl.exec:\flllxrl.exe181⤵PID:1340
-
\??\c:\xrrlffr.exec:\xrrlffr.exe182⤵PID:1968
-
\??\c:\9tbnbn.exec:\9tbnbn.exe183⤵PID:4004
-
\??\c:\vddjv.exec:\vddjv.exe184⤵PID:2220
-
\??\c:\ddppj.exec:\ddppj.exe185⤵PID:5088
-
\??\c:\ffxlxxr.exec:\ffxlxxr.exe186⤵PID:4204
-
\??\c:\bttthh.exec:\bttthh.exe187⤵PID:2304
-
\??\c:\bhnnnb.exec:\bhnnnb.exe188⤵PID:208
-
\??\c:\ddddv.exec:\ddddv.exe189⤵PID:224
-
\??\c:\9vvdj.exec:\9vvdj.exe190⤵PID:4404
-
\??\c:\rxfrlfr.exec:\rxfrlfr.exe191⤵PID:692
-
\??\c:\tnhbtt.exec:\tnhbtt.exe192⤵PID:412
-
\??\c:\ppjjd.exec:\ppjjd.exe193⤵PID:3012
-
\??\c:\7ppdv.exec:\7ppdv.exe194⤵PID:1212
-
\??\c:\xxfrxlf.exec:\xxfrxlf.exe195⤵PID:2988
-
\??\c:\lrlxllf.exec:\lrlxllf.exe196⤵PID:4852
-
\??\c:\bhnhhb.exec:\bhnhhb.exe197⤵PID:3852
-
\??\c:\tnnhbb.exec:\tnnhbb.exe198⤵PID:2296
-
\??\c:\jpjvv.exec:\jpjvv.exe199⤵PID:4752
-
\??\c:\lflxrlf.exec:\lflxrlf.exe200⤵PID:2908
-
\??\c:\nhhbtt.exec:\nhhbtt.exe201⤵PID:460
-
\??\c:\nbtbtt.exec:\nbtbtt.exe202⤵PID:2160
-
\??\c:\vpppj.exec:\vpppj.exe203⤵PID:2760
-
\??\c:\3pjvj.exec:\3pjvj.exe204⤵PID:3100
-
\??\c:\7lffflf.exec:\7lffflf.exe205⤵PID:3660
-
\??\c:\frxrlfx.exec:\frxrlfx.exe206⤵PID:3320
-
\??\c:\bbtnhh.exec:\bbtnhh.exe207⤵PID:3656
-
\??\c:\7jjpj.exec:\7jjpj.exe208⤵PID:2884
-
\??\c:\ddvpd.exec:\ddvpd.exe209⤵PID:2064
-
\??\c:\xlxrrlr.exec:\xlxrrlr.exe210⤵PID:4476
-
\??\c:\lffxrrl.exec:\lffxrrl.exe211⤵PID:3136
-
\??\c:\9nhhbb.exec:\9nhhbb.exe212⤵PID:1168
-
\??\c:\pjvpv.exec:\pjvpv.exe213⤵PID:1220
-
\??\c:\rlrrffl.exec:\rlrrffl.exe214⤵PID:2724
-
\??\c:\xlllflr.exec:\xlllflr.exe215⤵PID:4412
-
\??\c:\tntnhb.exec:\tntnhb.exe216⤵PID:4444
-
\??\c:\hhhbbb.exec:\hhhbbb.exe217⤵PID:3368
-
\??\c:\ppvpj.exec:\ppvpj.exe218⤵PID:1112
-
\??\c:\jjpjd.exec:\jjpjd.exe219⤵PID:1700
-
\??\c:\9lxlxfx.exec:\9lxlxfx.exe220⤵PID:2732
-
\??\c:\fffrlfx.exec:\fffrlfx.exe221⤵PID:1976
-
\??\c:\nhnnhh.exec:\nhnnhh.exe222⤵PID:1152
-
\??\c:\nthbtn.exec:\nthbtn.exe223⤵PID:2024
-
\??\c:\jjpjp.exec:\jjpjp.exe224⤵PID:3364
-
\??\c:\xffrlfx.exec:\xffrlfx.exe225⤵PID:3060
-
\??\c:\rllflll.exec:\rllflll.exe226⤵PID:3084
-
\??\c:\nhtbtt.exec:\nhtbtt.exe227⤵PID:3444
-
\??\c:\nhhhtt.exec:\nhhhtt.exe228⤵PID:4724
-
\??\c:\5jjdv.exec:\5jjdv.exe229⤵PID:4392
-
\??\c:\1dvpj.exec:\1dvpj.exe230⤵PID:5088
-
\??\c:\fllfrrl.exec:\fllfrrl.exe231⤵PID:216
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe232⤵PID:1628
-
\??\c:\nbhtnh.exec:\nbhtnh.exe233⤵PID:1552
-
\??\c:\tnthnn.exec:\tnthnn.exe234⤵PID:4404
-
\??\c:\jvpjd.exec:\jvpjd.exe235⤵PID:1268
-
\??\c:\3rxrffl.exec:\3rxrffl.exe236⤵PID:468
-
\??\c:\xrxrllf.exec:\xrxrllf.exe237⤵PID:4836
-
\??\c:\httnhb.exec:\httnhb.exe238⤵PID:456
-
\??\c:\dvppj.exec:\dvppj.exe239⤵PID:4852
-
\??\c:\5vvjd.exec:\5vvjd.exe240⤵PID:4324
-
\??\c:\7rxlllx.exec:\7rxlllx.exe241⤵PID:3608
-
\??\c:\xfffxrl.exec:\xfffxrl.exe242⤵PID:2908