Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 02:43
Behavioral task
behavioral1
Sample
ae0d97c952da5d6abc7904ab31bb712d49e6eec0e869072c5e5d3f23d4232db4.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
ae0d97c952da5d6abc7904ab31bb712d49e6eec0e869072c5e5d3f23d4232db4.exe
-
Size
378KB
-
MD5
3ff6f62f24093efda0b9081cfb1bb1db
-
SHA1
0c618cc669b3879a768123770ebfad6085d9f1a5
-
SHA256
ae0d97c952da5d6abc7904ab31bb712d49e6eec0e869072c5e5d3f23d4232db4
-
SHA512
08e684ece7148f8ff4a5fe3e60e95a61d4ef104168c58600e7af14fc985c6cb610ac4096a2530ccab0800d52a538fb3ad0ca17fdb2a894280ae9349dfd411763
-
SSDEEP
6144:9cm4FmowdHoS4WEkMawdHoSbdwqGw+tw+ttidCyu:/4wFHoS4WEkMTHoSbG++tw+tYYyu
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3996-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3148-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4028-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1892-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3844-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3112-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1040-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3468-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1996-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3644-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3392-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3284-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/916-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1484-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4036-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/528-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4616-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3856-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3824-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3992-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/668-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/656-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3520-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3684-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1760-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1508-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2652-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/812-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1388-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/544-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3452-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3452-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/912-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1236-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1236-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4200-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4184-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3900-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1480-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1912-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-537-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2484-541-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3644-569-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1196-573-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1900-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1652-657-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3996-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\httnbb.exe UPX behavioral2/memory/3996-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ttthbt.exe UPX behavioral2/memory/3148-11-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4028-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xrfxlfx.exe UPX behavioral2/memory/3540-21-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4028-19-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bnnhbt.exe UPX behavioral2/memory/1892-33-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\fxxxrlf.exe UPX C:\thnnhh.exe UPX behavioral2/memory/3844-49-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\jvpjv.exe UPX C:\bbbttt.exe UPX behavioral2/memory/3112-67-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1040-61-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\flrfrll.exe UPX behavioral2/memory/3468-55-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\hthbhb.exe UPX behavioral2/memory/4764-37-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\3dddv.exe UPX behavioral2/memory/3892-28-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\jddvp.exe UPX behavioral2/memory/1996-73-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hhhbbb.exe UPX C:\dpdvv.exe UPX behavioral2/memory/3644-85-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tnnhhh.exe UPX behavioral2/memory/3392-92-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pjdvp.exe UPX C:\thtntt.exe UPX behavioral2/memory/3284-100-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\nthhbb.exe UPX behavioral2/memory/3748-107-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tntnbb.exe UPX C:\vdjdv.exe UPX behavioral2/memory/916-116-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4548-119-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tntnbt.exe UPX C:\5pjvv.exe UPX behavioral2/memory/1484-130-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xfxfrrf.exe UPX behavioral2/memory/4036-137-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\3hhbnn.exe UPX \??\c:\5ttntt.exe UPX \??\c:\pjjjp.exe UPX \??\c:\bhnbtn.exe UPX behavioral2/memory/528-153-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jjdpd.exe UPX behavioral2/memory/4616-166-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4476-170-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\nbbtnh.exe UPX C:\5jddv.exe UPX behavioral2/memory/4988-174-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\fxfxfxx.exe UPX behavioral2/memory/3856-181-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\rllrrxx.exe UPX behavioral2/memory/440-187-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3824-197-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2644-202-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2644-205-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3916-218-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
httnbb.exettthbt.exexrfxlfx.exebnnhbt.exe3dddv.exefxxxrlf.exehthbhb.exethnnhh.exejvpjv.exeflrfrll.exebbbttt.exejddvp.exehhhbbb.exedpdvv.exetnnhhh.exepjdvp.exethtntt.exenthhbb.exetntnbb.exevdjdv.exetntnbt.exe5pjvv.exexfxfrrf.exe3hhbnn.exe5ttntt.exepjjjp.exebhnbtn.exejjdpd.exefxfxfxx.exenbbtnh.exe5jddv.exerllrrxx.exe7lrfxrl.exettthbb.exejvdjj.exe3xxrlll.exehhbthh.exennbbtb.exeddjjd.exe5lrrrxx.exennbhhn.exepdjpj.exevvjjv.exefllllrr.exebbnttt.exejdpjj.exepjppd.exerlrrfff.exenhhhtn.exe5nttnb.exejjpjj.exelllflrr.exe5bnntt.exehhnnhn.exerrxxrll.exerlrrrxx.exenthnnn.exevdjjp.exefrrrxff.exenhnnnn.exevdpvd.exe7vvvv.exerlffllx.exe7bbhnt.exepid process 3148 httnbb.exe 4028 ttthbt.exe 3540 xrfxlfx.exe 3892 bnnhbt.exe 1892 3dddv.exe 4764 fxxxrlf.exe 2656 hthbhb.exe 3844 thnnhh.exe 3468 jvpjv.exe 1040 flrfrll.exe 3112 bbbttt.exe 1996 jddvp.exe 2136 hhhbbb.exe 3644 dpdvv.exe 3392 tnnhhh.exe 3284 pjdvp.exe 3692 thtntt.exe 3748 nthhbb.exe 916 tntnbb.exe 4548 vdjdv.exe 1484 tntnbt.exe 4036 5pjvv.exe 3760 xfxfrrf.exe 808 3hhbnn.exe 1388 5ttntt.exe 528 pjjjp.exe 1036 bhnbtn.exe 4616 jjdpd.exe 4476 fxfxfxx.exe 4988 nbbtnh.exe 3856 5jddv.exe 440 rllrrxx.exe 1004 7lrfxrl.exe 1168 ttthbb.exe 3824 jvdjj.exe 2644 3xxrlll.exe 4512 hhbthh.exe 2188 nnbbtb.exe 4804 ddjjd.exe 3916 5lrrrxx.exe 1644 nnbhhn.exe 3940 pdjpj.exe 4028 vvjjv.exe 3992 fllllrr.exe 1408 bbnttt.exe 4020 jdpjj.exe 1684 pjppd.exe 4768 rlrrfff.exe 4580 nhhhtn.exe 2120 5nttnb.exe 668 jjpjj.exe 1732 lllflrr.exe 656 5bnntt.exe 4456 hhnnhn.exe 3520 rrxxrll.exe 3684 rlrrrxx.exe 1760 nthnnn.exe 3344 vdjjp.exe 3748 frrrxff.exe 2936 nhnnnn.exe 1508 vdpvd.exe 2652 7vvvv.exe 2180 rlffllx.exe 5064 7bbhnt.exe -
Processes:
resource yara_rule behavioral2/memory/3996-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\httnbb.exe upx behavioral2/memory/3996-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttthbt.exe upx behavioral2/memory/3148-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4028-13-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrfxlfx.exe upx behavioral2/memory/3540-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4028-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnnhbt.exe upx behavioral2/memory/1892-33-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxxxrlf.exe upx C:\thnnhh.exe upx behavioral2/memory/3844-49-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jvpjv.exe upx C:\bbbttt.exe upx behavioral2/memory/3112-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1040-61-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\flrfrll.exe upx behavioral2/memory/3468-55-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hthbhb.exe upx behavioral2/memory/4764-37-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3dddv.exe upx behavioral2/memory/3892-28-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jddvp.exe upx behavioral2/memory/1996-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhhbbb.exe upx C:\dpdvv.exe upx behavioral2/memory/3644-85-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnnhhh.exe upx behavioral2/memory/3392-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjdvp.exe upx C:\thtntt.exe upx behavioral2/memory/3284-100-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nthhbb.exe upx behavioral2/memory/3748-107-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tntnbb.exe upx C:\vdjdv.exe upx behavioral2/memory/916-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4548-119-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tntnbt.exe upx C:\5pjvv.exe upx behavioral2/memory/1484-130-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xfxfrrf.exe upx behavioral2/memory/4036-137-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3hhbnn.exe upx \??\c:\5ttntt.exe upx \??\c:\pjjjp.exe upx \??\c:\bhnbtn.exe upx behavioral2/memory/528-153-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjdpd.exe upx behavioral2/memory/4616-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4476-170-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbbtnh.exe upx C:\5jddv.exe upx behavioral2/memory/4988-174-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxfxfxx.exe upx behavioral2/memory/3856-181-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rllrrxx.exe upx behavioral2/memory/440-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3824-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2644-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2644-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3916-218-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ae0d97c952da5d6abc7904ab31bb712d49e6eec0e869072c5e5d3f23d4232db4.exehttnbb.exettthbt.exexrfxlfx.exebnnhbt.exe3dddv.exefxxxrlf.exehthbhb.exethnnhh.exejvpjv.exeflrfrll.exebbbttt.exejddvp.exehhhbbb.exedpdvv.exetnnhhh.exepjdvp.exethtntt.exenthhbb.exetntnbb.exevdjdv.exetntnbt.exedescription pid process target process PID 3996 wrote to memory of 3148 3996 ae0d97c952da5d6abc7904ab31bb712d49e6eec0e869072c5e5d3f23d4232db4.exe httnbb.exe PID 3996 wrote to memory of 3148 3996 ae0d97c952da5d6abc7904ab31bb712d49e6eec0e869072c5e5d3f23d4232db4.exe httnbb.exe PID 3996 wrote to memory of 3148 3996 ae0d97c952da5d6abc7904ab31bb712d49e6eec0e869072c5e5d3f23d4232db4.exe httnbb.exe PID 3148 wrote to memory of 4028 3148 httnbb.exe ttthbt.exe PID 3148 wrote to memory of 4028 3148 httnbb.exe ttthbt.exe PID 3148 wrote to memory of 4028 3148 httnbb.exe ttthbt.exe PID 4028 wrote to memory of 3540 4028 ttthbt.exe xrfxlfx.exe PID 4028 wrote to memory of 3540 4028 ttthbt.exe xrfxlfx.exe PID 4028 wrote to memory of 3540 4028 ttthbt.exe xrfxlfx.exe PID 3540 wrote to memory of 3892 3540 xrfxlfx.exe bnnhbt.exe PID 3540 wrote to memory of 3892 3540 xrfxlfx.exe bnnhbt.exe PID 3540 wrote to memory of 3892 3540 xrfxlfx.exe bnnhbt.exe PID 3892 wrote to memory of 1892 3892 bnnhbt.exe 3dddv.exe PID 3892 wrote to memory of 1892 3892 bnnhbt.exe 3dddv.exe PID 3892 wrote to memory of 1892 3892 bnnhbt.exe 3dddv.exe PID 1892 wrote to memory of 4764 1892 3dddv.exe fxxxrlf.exe PID 1892 wrote to memory of 4764 1892 3dddv.exe fxxxrlf.exe PID 1892 wrote to memory of 4764 1892 3dddv.exe fxxxrlf.exe PID 4764 wrote to memory of 2656 4764 fxxxrlf.exe hthbhb.exe PID 4764 wrote to memory of 2656 4764 fxxxrlf.exe hthbhb.exe PID 4764 wrote to memory of 2656 4764 fxxxrlf.exe hthbhb.exe PID 2656 wrote to memory of 3844 2656 hthbhb.exe thnnhh.exe PID 2656 wrote to memory of 3844 2656 hthbhb.exe thnnhh.exe PID 2656 wrote to memory of 3844 2656 hthbhb.exe thnnhh.exe PID 3844 wrote to memory of 3468 3844 thnnhh.exe jvpjv.exe PID 3844 wrote to memory of 3468 3844 thnnhh.exe jvpjv.exe PID 3844 wrote to memory of 3468 3844 thnnhh.exe jvpjv.exe PID 3468 wrote to memory of 1040 3468 jvpjv.exe flrfrll.exe PID 3468 wrote to memory of 1040 3468 jvpjv.exe flrfrll.exe PID 3468 wrote to memory of 1040 3468 jvpjv.exe flrfrll.exe PID 1040 wrote to memory of 3112 1040 flrfrll.exe bbbttt.exe PID 1040 wrote to memory of 3112 1040 flrfrll.exe bbbttt.exe PID 1040 wrote to memory of 3112 1040 flrfrll.exe bbbttt.exe PID 3112 wrote to memory of 1996 3112 bbbttt.exe jddvp.exe PID 3112 wrote to memory of 1996 3112 bbbttt.exe jddvp.exe PID 3112 wrote to memory of 1996 3112 bbbttt.exe jddvp.exe PID 1996 wrote to memory of 2136 1996 jddvp.exe hhhbbb.exe PID 1996 wrote to memory of 2136 1996 jddvp.exe hhhbbb.exe PID 1996 wrote to memory of 2136 1996 jddvp.exe hhhbbb.exe PID 2136 wrote to memory of 3644 2136 hhhbbb.exe dpdvv.exe PID 2136 wrote to memory of 3644 2136 hhhbbb.exe dpdvv.exe PID 2136 wrote to memory of 3644 2136 hhhbbb.exe dpdvv.exe PID 3644 wrote to memory of 3392 3644 dpdvv.exe tnnhhh.exe PID 3644 wrote to memory of 3392 3644 dpdvv.exe tnnhhh.exe PID 3644 wrote to memory of 3392 3644 dpdvv.exe tnnhhh.exe PID 3392 wrote to memory of 3284 3392 tnnhhh.exe pjdvp.exe PID 3392 wrote to memory of 3284 3392 tnnhhh.exe pjdvp.exe PID 3392 wrote to memory of 3284 3392 tnnhhh.exe pjdvp.exe PID 3284 wrote to memory of 3692 3284 pjdvp.exe thtntt.exe PID 3284 wrote to memory of 3692 3284 pjdvp.exe thtntt.exe PID 3284 wrote to memory of 3692 3284 pjdvp.exe thtntt.exe PID 3692 wrote to memory of 3748 3692 thtntt.exe nthhbb.exe PID 3692 wrote to memory of 3748 3692 thtntt.exe nthhbb.exe PID 3692 wrote to memory of 3748 3692 thtntt.exe nthhbb.exe PID 3748 wrote to memory of 916 3748 nthhbb.exe tntnbb.exe PID 3748 wrote to memory of 916 3748 nthhbb.exe tntnbb.exe PID 3748 wrote to memory of 916 3748 nthhbb.exe tntnbb.exe PID 916 wrote to memory of 4548 916 tntnbb.exe vdjdv.exe PID 916 wrote to memory of 4548 916 tntnbb.exe vdjdv.exe PID 916 wrote to memory of 4548 916 tntnbb.exe vdjdv.exe PID 4548 wrote to memory of 1484 4548 vdjdv.exe tntnbt.exe PID 4548 wrote to memory of 1484 4548 vdjdv.exe tntnbt.exe PID 4548 wrote to memory of 1484 4548 vdjdv.exe tntnbt.exe PID 1484 wrote to memory of 4036 1484 tntnbt.exe 5pjvv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae0d97c952da5d6abc7904ab31bb712d49e6eec0e869072c5e5d3f23d4232db4.exe"C:\Users\Admin\AppData\Local\Temp\ae0d97c952da5d6abc7904ab31bb712d49e6eec0e869072c5e5d3f23d4232db4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\httnbb.exec:\httnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\ttthbt.exec:\ttthbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\xrfxlfx.exec:\xrfxlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\bnnhbt.exec:\bnnhbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\3dddv.exec:\3dddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\fxxxrlf.exec:\fxxxrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\hthbhb.exec:\hthbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\thnnhh.exec:\thnnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\jvpjv.exec:\jvpjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\flrfrll.exec:\flrfrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\bbbttt.exec:\bbbttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\jddvp.exec:\jddvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\hhhbbb.exec:\hhhbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\dpdvv.exec:\dpdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\tnnhhh.exec:\tnnhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\pjdvp.exec:\pjdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\thtntt.exec:\thtntt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\nthhbb.exec:\nthhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\tntnbb.exec:\tntnbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\vdjdv.exec:\vdjdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\tntnbt.exec:\tntnbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\5pjvv.exec:\5pjvv.exe23⤵
- Executes dropped EXE
PID:4036 -
\??\c:\xfxfrrf.exec:\xfxfrrf.exe24⤵
- Executes dropped EXE
PID:3760 -
\??\c:\3hhbnn.exec:\3hhbnn.exe25⤵
- Executes dropped EXE
PID:808 -
\??\c:\5ttntt.exec:\5ttntt.exe26⤵
- Executes dropped EXE
PID:1388 -
\??\c:\pjjjp.exec:\pjjjp.exe27⤵
- Executes dropped EXE
PID:528 -
\??\c:\bhnbtn.exec:\bhnbtn.exe28⤵
- Executes dropped EXE
PID:1036 -
\??\c:\jjdpd.exec:\jjdpd.exe29⤵
- Executes dropped EXE
PID:4616 -
\??\c:\fxfxfxx.exec:\fxfxfxx.exe30⤵
- Executes dropped EXE
PID:4476 -
\??\c:\nbbtnh.exec:\nbbtnh.exe31⤵
- Executes dropped EXE
PID:4988 -
\??\c:\5jddv.exec:\5jddv.exe32⤵
- Executes dropped EXE
PID:3856 -
\??\c:\rllrrxx.exec:\rllrrxx.exe33⤵
- Executes dropped EXE
PID:440 -
\??\c:\7lrfxrl.exec:\7lrfxrl.exe34⤵
- Executes dropped EXE
PID:1004 -
\??\c:\ttthbb.exec:\ttthbb.exe35⤵
- Executes dropped EXE
PID:1168 -
\??\c:\jvdjj.exec:\jvdjj.exe36⤵
- Executes dropped EXE
PID:3824 -
\??\c:\3xxrlll.exec:\3xxrlll.exe37⤵
- Executes dropped EXE
PID:2644 -
\??\c:\hhbthh.exec:\hhbthh.exe38⤵
- Executes dropped EXE
PID:4512 -
\??\c:\nnbbtb.exec:\nnbbtb.exe39⤵
- Executes dropped EXE
PID:2188 -
\??\c:\ddjjd.exec:\ddjjd.exe40⤵
- Executes dropped EXE
PID:4804 -
\??\c:\5lrrrxx.exec:\5lrrrxx.exe41⤵
- Executes dropped EXE
PID:3916 -
\??\c:\nnbhhn.exec:\nnbhhn.exe42⤵
- Executes dropped EXE
PID:1644 -
\??\c:\pdjpj.exec:\pdjpj.exe43⤵
- Executes dropped EXE
PID:3940 -
\??\c:\vvjjv.exec:\vvjjv.exe44⤵
- Executes dropped EXE
PID:4028 -
\??\c:\fllllrr.exec:\fllllrr.exe45⤵
- Executes dropped EXE
PID:3992 -
\??\c:\bbnttt.exec:\bbnttt.exe46⤵
- Executes dropped EXE
PID:1408 -
\??\c:\jdpjj.exec:\jdpjj.exe47⤵
- Executes dropped EXE
PID:4020 -
\??\c:\pjppd.exec:\pjppd.exe48⤵
- Executes dropped EXE
PID:1684 -
\??\c:\rlrrfff.exec:\rlrrfff.exe49⤵
- Executes dropped EXE
PID:4768 -
\??\c:\nhhhtn.exec:\nhhhtn.exe50⤵
- Executes dropped EXE
PID:4580 -
\??\c:\5nttnb.exec:\5nttnb.exe51⤵
- Executes dropped EXE
PID:2120 -
\??\c:\jjpjj.exec:\jjpjj.exe52⤵
- Executes dropped EXE
PID:668 -
\??\c:\lllflrr.exec:\lllflrr.exe53⤵
- Executes dropped EXE
PID:1732 -
\??\c:\5bnntt.exec:\5bnntt.exe54⤵
- Executes dropped EXE
PID:656 -
\??\c:\hhnnhn.exec:\hhnnhn.exe55⤵
- Executes dropped EXE
PID:4456 -
\??\c:\rrxxrll.exec:\rrxxrll.exe56⤵
- Executes dropped EXE
PID:3520 -
\??\c:\rlrrrxx.exec:\rlrrrxx.exe57⤵
- Executes dropped EXE
PID:3684 -
\??\c:\nthnnn.exec:\nthnnn.exe58⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vdjjp.exec:\vdjjp.exe59⤵
- Executes dropped EXE
PID:3344 -
\??\c:\frrrxff.exec:\frrrxff.exe60⤵
- Executes dropped EXE
PID:3748 -
\??\c:\nhnnnn.exec:\nhnnnn.exe61⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vdpvd.exec:\vdpvd.exe62⤵
- Executes dropped EXE
PID:1508 -
\??\c:\7vvvv.exec:\7vvvv.exe63⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rlffllx.exec:\rlffllx.exe64⤵
- Executes dropped EXE
PID:2180 -
\??\c:\7bbhnt.exec:\7bbhnt.exe65⤵
- Executes dropped EXE
PID:5064 -
\??\c:\5bbbbh.exec:\5bbbbh.exe66⤵PID:2488
-
\??\c:\7jjjj.exec:\7jjjj.exe67⤵PID:812
-
\??\c:\9rrllll.exec:\9rrllll.exe68⤵PID:1480
-
\??\c:\9ttnnn.exec:\9ttnnn.exe69⤵PID:1864
-
\??\c:\3hnnnn.exec:\3hnnnn.exe70⤵PID:1388
-
\??\c:\pvjjd.exec:\pvjjd.exe71⤵PID:1304
-
\??\c:\flxxfff.exec:\flxxfff.exe72⤵PID:4056
-
\??\c:\rrxffff.exec:\rrxffff.exe73⤵PID:1988
-
\??\c:\btbbhh.exec:\btbbhh.exe74⤵PID:4972
-
\??\c:\pjpjj.exec:\pjpjj.exe75⤵PID:3464
-
\??\c:\xlxxxff.exec:\xlxxxff.exe76⤵PID:1192
-
\??\c:\rlfllrr.exec:\rlfllrr.exe77⤵PID:544
-
\??\c:\3bnhtt.exec:\3bnhtt.exe78⤵PID:1788
-
\??\c:\1vjjp.exec:\1vjjp.exe79⤵PID:1412
-
\??\c:\rrlrrxf.exec:\rrlrrxf.exe80⤵PID:5092
-
\??\c:\nbhnnt.exec:\nbhnnt.exe81⤵PID:996
-
\??\c:\vvvvv.exec:\vvvvv.exe82⤵PID:3452
-
\??\c:\lrfxrrf.exec:\lrfxrrf.exe83⤵PID:2844
-
\??\c:\fffffll.exec:\fffffll.exe84⤵PID:1696
-
\??\c:\bnnnth.exec:\bnnnth.exe85⤵PID:3996
-
\??\c:\jjppj.exec:\jjppj.exe86⤵PID:912
-
\??\c:\fflllll.exec:\fflllll.exe87⤵PID:1008
-
\??\c:\lllllrr.exec:\lllllrr.exe88⤵PID:2884
-
\??\c:\bttnnn.exec:\bttnnn.exe89⤵PID:4528
-
\??\c:\djpjp.exec:\djpjp.exe90⤵PID:1532
-
\??\c:\dpjpj.exec:\dpjpj.exe91⤵PID:3924
-
\??\c:\rlxxllx.exec:\rlxxllx.exe92⤵PID:2484
-
\??\c:\hbtbhh.exec:\hbtbhh.exe93⤵PID:1032
-
\??\c:\thhtnh.exec:\thhtnh.exe94⤵PID:948
-
\??\c:\vvdjd.exec:\vvdjd.exe95⤵PID:3904
-
\??\c:\7rlffff.exec:\7rlffff.exe96⤵PID:2064
-
\??\c:\bthnnn.exec:\bthnnn.exe97⤵PID:2080
-
\??\c:\bbtnnh.exec:\bbtnnh.exe98⤵PID:2120
-
\??\c:\5dddd.exec:\5dddd.exe99⤵PID:1968
-
\??\c:\xrlffll.exec:\xrlffll.exe100⤵PID:3004
-
\??\c:\xlflxfr.exec:\xlflxfr.exe101⤵PID:1236
-
\??\c:\3bbhbh.exec:\3bbhbh.exe102⤵PID:4200
-
\??\c:\ddjdd.exec:\ddjdd.exe103⤵PID:4356
-
\??\c:\jpjjd.exec:\jpjjd.exe104⤵PID:4316
-
\??\c:\5xrlffr.exec:\5xrlffr.exe105⤵PID:3392
-
\??\c:\bbbttn.exec:\bbbttn.exe106⤵PID:448
-
\??\c:\3nbtbb.exec:\3nbtbb.exe107⤵PID:3284
-
\??\c:\ppddj.exec:\ppddj.exe108⤵PID:2456
-
\??\c:\5jvpj.exec:\5jvpj.exe109⤵PID:1760
-
\??\c:\rxxxxxf.exec:\rxxxxxf.exe110⤵PID:1204
-
\??\c:\htbttt.exec:\htbttt.exe111⤵PID:1376
-
\??\c:\thttnn.exec:\thttnn.exe112⤵PID:2936
-
\??\c:\dvpjj.exec:\dvpjj.exe113⤵PID:4144
-
\??\c:\rfrrflr.exec:\rfrrflr.exe114⤵PID:1312
-
\??\c:\bbbttt.exec:\bbbttt.exe115⤵PID:4184
-
\??\c:\hnbbth.exec:\hnbbth.exe116⤵PID:3900
-
\??\c:\pjjjj.exec:\pjjjj.exe117⤵PID:4012
-
\??\c:\lxffxxr.exec:\lxffxxr.exe118⤵PID:3504
-
\??\c:\nttttb.exec:\nttttb.exe119⤵PID:1480
-
\??\c:\hnnttt.exec:\hnnttt.exe120⤵PID:1516
-
\??\c:\ddddp.exec:\ddddp.exe121⤵PID:4748
-
\??\c:\vddjd.exec:\vddjd.exe122⤵PID:2520
-
\??\c:\rrxxflr.exec:\rrxxflr.exe123⤵PID:3476
-
\??\c:\nhnnnn.exec:\nhnnnn.exe124⤵PID:1972
-
\??\c:\9bhhhh.exec:\9bhhhh.exe125⤵PID:4424
-
\??\c:\9vddd.exec:\9vddd.exe126⤵PID:440
-
\??\c:\vppjj.exec:\vppjj.exe127⤵PID:5104
-
\??\c:\lllxxrx.exec:\lllxxrx.exe128⤵PID:2264
-
\??\c:\nnnntb.exec:\nnnntb.exe129⤵PID:4508
-
\??\c:\btbbbh.exec:\btbbbh.exe130⤵PID:3156
-
\??\c:\vjppp.exec:\vjppp.exe131⤵PID:3268
-
\??\c:\jvjjd.exec:\jvjjd.exe132⤵PID:224
-
\??\c:\lxlllff.exec:\lxlllff.exe133⤵PID:1912
-
\??\c:\hbnnnn.exec:\hbnnnn.exe134⤵PID:3548
-
\??\c:\pvjjp.exec:\pvjjp.exe135⤵PID:4964
-
\??\c:\llrllrr.exec:\llrllrr.exe136⤵PID:3924
-
\??\c:\thtbhn.exec:\thtbhn.exe137⤵PID:2484
-
\??\c:\xllxrxx.exec:\xllxrxx.exe138⤵PID:2068
-
\??\c:\lrfrfff.exec:\lrfrfff.exe139⤵PID:2100
-
\??\c:\bhbbnt.exec:\bhbbnt.exe140⤵PID:3044
-
\??\c:\vjdjp.exec:\vjdjp.exe141⤵PID:3468
-
\??\c:\jjjjj.exec:\jjjjj.exe142⤵PID:3152
-
\??\c:\bhbhhn.exec:\bhbhhn.exe143⤵PID:3244
-
\??\c:\rlrlfff.exec:\rlrlfff.exe144⤵PID:3004
-
\??\c:\thnnbh.exec:\thnnbh.exe145⤵PID:1740
-
\??\c:\9flrrxx.exec:\9flrrxx.exe146⤵PID:3644
-
\??\c:\tnbbtb.exec:\tnbbtb.exe147⤵PID:4956
-
\??\c:\vpvdd.exec:\vpvdd.exe148⤵PID:1196
-
\??\c:\dpvvd.exec:\dpvvd.exe149⤵PID:1460
-
\??\c:\xxrrlll.exec:\xxrrlll.exe150⤵PID:1900
-
\??\c:\thtbtb.exec:\thtbtb.exe151⤵PID:2876
-
\??\c:\vvjjp.exec:\vvjjp.exe152⤵PID:2984
-
\??\c:\dppvp.exec:\dppvp.exe153⤵PID:4948
-
\??\c:\llrrrrx.exec:\llrrrrx.exe154⤵PID:4548
-
\??\c:\nbnnnn.exec:\nbnnnn.exe155⤵PID:512
-
\??\c:\jjppp.exec:\jjppp.exe156⤵PID:4036
-
\??\c:\rxlllxx.exec:\rxlllxx.exe157⤵PID:4416
-
\??\c:\frxxrrr.exec:\frxxrrr.exe158⤵PID:4240
-
\??\c:\nhnnnt.exec:\nhnnnt.exe159⤵PID:3252
-
\??\c:\vddjd.exec:\vddjd.exe160⤵PID:1736
-
\??\c:\djdjv.exec:\djdjv.exe161⤵PID:4984
-
\??\c:\rfxrrrl.exec:\rfxrrrl.exe162⤵PID:1512
-
\??\c:\tnntth.exec:\tnntth.exe163⤵PID:1516
-
\??\c:\jjppp.exec:\jjppp.exe164⤵PID:3888
-
\??\c:\vvpjd.exec:\vvpjd.exe165⤵PID:716
-
\??\c:\7llllrr.exec:\7llllrr.exe166⤵PID:3856
-
\??\c:\hhnnnt.exec:\hhnnnt.exe167⤵PID:4636
-
\??\c:\ppdvv.exec:\ppdvv.exe168⤵PID:5036
-
\??\c:\jjjjp.exec:\jjjjp.exe169⤵PID:1976
-
\??\c:\llxrflx.exec:\llxrflx.exe170⤵PID:3536
-
\??\c:\hhbhnn.exec:\hhbhnn.exe171⤵PID:372
-
\??\c:\5bhhbh.exec:\5bhhbh.exe172⤵PID:3996
-
\??\c:\pdppp.exec:\pdppp.exe173⤵PID:4928
-
\??\c:\rxxllff.exec:\rxxllff.exe174⤵PID:1652
-
\??\c:\hnhhhh.exec:\hnhhhh.exe175⤵PID:2184
-
\??\c:\bhhhbb.exec:\bhhhbb.exe176⤵PID:1892
-
\??\c:\jjjpd.exec:\jjjpd.exe177⤵PID:1416
-
\??\c:\xxrrllf.exec:\xxrrllf.exe178⤵PID:4964
-
\??\c:\thbbnt.exec:\thbbnt.exe179⤵PID:3924
-
\??\c:\ttnnnn.exec:\ttnnnn.exe180⤵PID:2484
-
\??\c:\vjvpj.exec:\vjvpj.exe181⤵PID:3532
-
\??\c:\rlrllll.exec:\rlrllll.exe182⤵PID:2100
-
\??\c:\5xxrrlx.exec:\5xxrrlx.exe183⤵PID:668
-
\??\c:\hhnnnn.exec:\hhnnnn.exe184⤵PID:3604
-
\??\c:\htbbhn.exec:\htbbhn.exe185⤵PID:3152
-
\??\c:\vdvvd.exec:\vdvvd.exe186⤵PID:4136
-
\??\c:\jjddd.exec:\jjddd.exe187⤵PID:1236
-
\??\c:\rlfffll.exec:\rlfffll.exe188⤵PID:2540
-
\??\c:\7bnnhn.exec:\7bnnhn.exe189⤵PID:4016
-
\??\c:\nnbtbh.exec:\nnbtbh.exe190⤵PID:1436
-
\??\c:\1vjjv.exec:\1vjjv.exe191⤵PID:1460
-
\??\c:\vvppd.exec:\vvppd.exe192⤵PID:2456
-
\??\c:\rxrlrxx.exec:\rxrlrxx.exe193⤵PID:916
-
\??\c:\fflllrr.exec:\fflllrr.exe194⤵PID:1204
-
\??\c:\hthhhn.exec:\hthhhn.exe195⤵PID:4432
-
\??\c:\nnbbhn.exec:\nnbbhn.exe196⤵PID:4144
-
\??\c:\vvddv.exec:\vvddv.exe197⤵PID:1176
-
\??\c:\ffffxff.exec:\ffffxff.exe198⤵PID:2180
-
\??\c:\5fllflf.exec:\5fllflf.exe199⤵PID:808
-
\??\c:\tntbbh.exec:\tntbbh.exe200⤵PID:1768
-
\??\c:\nbbttn.exec:\nbbttn.exe201⤵PID:3740
-
\??\c:\jpjvv.exec:\jpjvv.exe202⤵PID:1120
-
\??\c:\5lllxfl.exec:\5lllxfl.exe203⤵PID:4748
-
\??\c:\lxrxxxx.exec:\lxrxxxx.exe204⤵PID:2676
-
\??\c:\hnnhhh.exec:\hnnhhh.exe205⤵PID:3464
-
\??\c:\ddjdd.exec:\ddjdd.exe206⤵PID:1916
-
\??\c:\xllllrx.exec:\xllllrx.exe207⤵PID:1788
-
\??\c:\nhnttb.exec:\nhnttb.exe208⤵PID:4260
-
\??\c:\nntbbb.exec:\nntbbb.exe209⤵PID:4624
-
\??\c:\llrxflx.exec:\llrxflx.exe210⤵PID:2644
-
\??\c:\nhtnnt.exec:\nhtnnt.exe211⤵PID:4880
-
\??\c:\ddpvd.exec:\ddpvd.exe212⤵PID:4288
-
\??\c:\jvvjp.exec:\jvvjp.exe213⤵PID:4028
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe214⤵PID:1912
-
\??\c:\bnhhhh.exec:\bnhhhh.exe215⤵PID:3548
-
\??\c:\ddvvp.exec:\ddvvp.exe216⤵PID:1532
-
\??\c:\lrrxxfl.exec:\lrrxxfl.exe217⤵PID:1628
-
\??\c:\5lxflfr.exec:\5lxflfr.exe218⤵PID:1960
-
\??\c:\hhtnnt.exec:\hhtnnt.exe219⤵PID:2212
-
\??\c:\pdjjj.exec:\pdjjj.exe220⤵PID:760
-
\??\c:\xflllrr.exec:\xflllrr.exe221⤵PID:3484
-
\??\c:\rflllff.exec:\rflllff.exe222⤵PID:2496
-
\??\c:\bnttbb.exec:\bnttbb.exe223⤵PID:1940
-
\??\c:\jpvvv.exec:\jpvvv.exe224⤵PID:3244
-
\??\c:\xrlrxrf.exec:\xrlrxrf.exe225⤵PID:2412
-
\??\c:\9xffxff.exec:\9xffxff.exe226⤵PID:2344
-
\??\c:\nnnnhh.exec:\nnnnhh.exe227⤵PID:4740
-
\??\c:\dvddd.exec:\dvddd.exe228⤵PID:4956
-
\??\c:\xrlllll.exec:\xrlllll.exe229⤵PID:448
-
\??\c:\lxrlxxx.exec:\lxrlxxx.exe230⤵PID:3704
-
\??\c:\tbbbnt.exec:\tbbbnt.exe231⤵PID:2908
-
\??\c:\ppddj.exec:\ppddj.exe232⤵PID:708
-
\??\c:\7xfxrrl.exec:\7xfxrrl.exe233⤵PID:1508
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe234⤵PID:1484
-
\??\c:\bnnbnn.exec:\bnnbnn.exe235⤵PID:3424
-
\??\c:\djjdd.exec:\djjdd.exe236⤵PID:4184
-
\??\c:\xrffxxx.exec:\xrffxxx.exe237⤵PID:2488
-
\??\c:\xrfffff.exec:\xrfffff.exe238⤵PID:1108
-
\??\c:\tttbtn.exec:\tttbtn.exe239⤵PID:1768
-
\??\c:\7pjjd.exec:\7pjjd.exe240⤵PID:4936
-
\??\c:\jjjjd.exec:\jjjjd.exe241⤵PID:1512
-
\??\c:\rlxxxll.exec:\rlxxxll.exe242⤵PID:1988