Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 03:45
Behavioral task
behavioral1
Sample
c16f1f2f2c5bb0c5477809d48e096ac7f8f1aeab8f4e75ef40547efb83e0f1d3.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
c16f1f2f2c5bb0c5477809d48e096ac7f8f1aeab8f4e75ef40547efb83e0f1d3.exe
-
Size
76KB
-
MD5
443258e22d2d4ecdc2eebe9fe5eec2bd
-
SHA1
5d6535ae567a762678e23791e59c1a57aa254353
-
SHA256
c16f1f2f2c5bb0c5477809d48e096ac7f8f1aeab8f4e75ef40547efb83e0f1d3
-
SHA512
4fc898d3d114623a6e4ca2eca906f3f1fd4990c26b13b2805028ac73df7fff3bc07cd30e92eeef867dff47e3f6cf658f01a7469d6f4da2aa792b5db2edb305e2
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFWoFLAxZhMDzE87M:9hOmTsF93UYfwC6GIoutz5yLpOSDRM
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3432-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2424-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4500-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3224-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/368-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1016-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/868-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1788-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2260-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4812-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2364-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3908-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3420-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3936-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1572-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2032-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1016-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1508-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3372-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3440-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2152-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1344-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3480-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1752-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2988-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4796-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4016-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1988-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2636-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4280-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2308-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/376-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/740-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-455-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3876-458-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-475-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/896-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2948-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1224-582-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2912-648-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-731-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-769-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-796-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3432-1-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pjddd.exe UPX behavioral2/memory/2424-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\fxflrxx.exe UPX behavioral2/memory/4500-12-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nbnhhb.exe UPX behavioral2/memory/4500-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2020-18-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7djjd.exe UPX behavioral2/memory/2020-24-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3224-30-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lfxrfxl.exe UPX C:\nhbbhh.exe UPX behavioral2/memory/368-36-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1016-42-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5ttbht.exe UPX \??\c:\pvpjv.exe UPX behavioral2/memory/868-49-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1788-55-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\pjpvp.exe UPX behavioral2/memory/872-56-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\lffxxxr.exe UPX behavioral2/memory/5024-68-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\hhnhbh.exe UPX behavioral2/memory/2792-75-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bhhhtb.exe UPX behavioral2/memory/2792-81-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\vddvv.exe UPX behavioral2/memory/1608-87-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\vppjj.exe UPX \??\c:\llfrlfx.exe UPX behavioral2/memory/2260-97-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\bhhbtn.exe UPX behavioral2/memory/4812-104-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2364-120-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\9xxllfr.exe UPX \??\c:\hthnhh.exe UPX C:\vjjvv.exe UPX \??\c:\5pjdv.exe UPX \??\c:\hhnnhh.exe UPX \??\c:\vjjdj.exe UPX behavioral2/memory/3908-186-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\llrfxfx.exe UPX behavioral2/memory/3420-206-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/524-215-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4180-205-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3172-195-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\xlllffr.exe UPX behavioral2/memory/3936-182-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\pdvdv.exe UPX behavioral2/memory/1572-232-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3624-239-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2032-243-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3196-246-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1016-250-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1788-254-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1508-258-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3372-229-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1344-262-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4852-276-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4852-279-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3440-286-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2152-290-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3496-296-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
pjddd.exefxflrxx.exenbnhhb.exe7djjd.exelfxrfxl.exenhbbhh.exe5ttbht.exepvpjv.exepjpvp.exelffxxxr.exehhnhbh.exebbbbtt.exebhhhtb.exevddvv.exevppjj.exellfrlfx.exebhhbtn.exebhnhtt.exe3jvpp.exevvppj.exe9ffrfrf.exe9xxllfr.exentnnhn.exehthnhh.exe5pjdv.exevjjvv.exeflxrlll.exehhnnhh.exevjjdj.exepdvdv.exexlllffr.exellrfxfx.exebhhhht.exejpdjp.exejddvj.exe3pvpj.exellxflrx.exe5xlllff.exehhbbbb.exe7bbbtb.exejvddv.exevjppd.exerllllrl.exe9rflfll.exehntbbn.exe5tbhbh.exejvjvj.exe5jjjj.exedpppj.exexxfxrrl.exefllflll.exebntnhn.exebbnthn.exevpjdp.exelflrxrx.exellllfll.exebnbnbh.exe7bbbtb.exevjpjp.exejdpdp.exerfllllr.exelrlrlll.exehhnhnt.exejddvp.exepid process 2424 pjddd.exe 4500 fxflrxx.exe 2020 nbnhhb.exe 3224 7djjd.exe 368 lfxrfxl.exe 1016 nhbbhh.exe 868 5ttbht.exe 1788 pvpjv.exe 872 pjpvp.exe 4908 lffxxxr.exe 5024 hhnhbh.exe 2792 bbbbtt.exe 1608 bhhhtb.exe 4536 vddvv.exe 2260 vppjj.exe 4812 llfrlfx.exe 428 bhhbtn.exe 2556 bhnhtt.exe 2364 3jvpp.exe 376 vvppj.exe 2852 9ffrfrf.exe 2764 9xxllfr.exe 3240 ntnnhn.exe 4352 hthnhh.exe 4648 5pjdv.exe 5108 vjjvv.exe 4872 flxrlll.exe 2988 hhnnhh.exe 1752 vjjdj.exe 3936 pdvdv.exe 3908 xlllffr.exe 1468 llrfxfx.exe 3172 bhhhht.exe 4996 jpdjp.exe 4180 jddvj.exe 3420 3pvpj.exe 4112 llxflrx.exe 3884 5xlllff.exe 524 hhbbbb.exe 4312 7bbbtb.exe 3604 jvddv.exe 4424 vjppd.exe 3372 rllllrl.exe 1572 9rflfll.exe 3624 hntbbn.exe 2032 5tbhbh.exe 3196 jvjvj.exe 1016 5jjjj.exe 868 dpppj.exe 1788 xxfxrrl.exe 1508 fllflll.exe 1344 bntnhn.exe 1240 bbnthn.exe 4100 vpjdp.exe 5092 lflrxrx.exe 4852 llllfll.exe 1192 bnbnbh.exe 3440 7bbbtb.exe 2152 vjpjp.exe 2264 jdpdp.exe 3496 rfllllr.exe 5080 lrlrlll.exe 2232 hhnhnt.exe 3948 jddvp.exe -
Processes:
resource yara_rule behavioral2/memory/3432-1-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjddd.exe upx behavioral2/memory/2424-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxflrxx.exe upx behavioral2/memory/4500-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbnhhb.exe upx behavioral2/memory/4500-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2020-18-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7djjd.exe upx behavioral2/memory/2020-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3224-30-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfxrfxl.exe upx C:\nhbbhh.exe upx behavioral2/memory/368-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1016-42-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5ttbht.exe upx \??\c:\pvpjv.exe upx behavioral2/memory/868-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1788-55-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjpvp.exe upx behavioral2/memory/872-56-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lffxxxr.exe upx behavioral2/memory/5024-68-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hhnhbh.exe upx behavioral2/memory/2792-75-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhhhtb.exe upx behavioral2/memory/2792-81-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vddvv.exe upx behavioral2/memory/1608-87-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vppjj.exe upx \??\c:\llfrlfx.exe upx behavioral2/memory/2260-97-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bhhbtn.exe upx behavioral2/memory/4812-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2364-120-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9xxllfr.exe upx \??\c:\hthnhh.exe upx C:\vjjvv.exe upx \??\c:\5pjdv.exe upx \??\c:\hhnnhh.exe upx \??\c:\vjjdj.exe upx behavioral2/memory/3908-186-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\llrfxfx.exe upx behavioral2/memory/3420-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/524-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4180-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3172-195-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xlllffr.exe upx behavioral2/memory/3936-182-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pdvdv.exe upx behavioral2/memory/1572-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3624-239-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2032-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3196-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1016-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1788-254-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1508-258-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3372-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1344-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4852-276-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4852-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3440-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2152-290-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3496-296-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c16f1f2f2c5bb0c5477809d48e096ac7f8f1aeab8f4e75ef40547efb83e0f1d3.exepjddd.exefxflrxx.exenbnhhb.exe7djjd.exelfxrfxl.exenhbbhh.exe5ttbht.exepvpjv.exepjpvp.exelffxxxr.exehhnhbh.exebbbbtt.exebhhhtb.exevddvv.exevppjj.exellfrlfx.exebhhbtn.exebhnhtt.exe3jvpp.exevvppj.exe9ffrfrf.exedescription pid process target process PID 3432 wrote to memory of 2424 3432 c16f1f2f2c5bb0c5477809d48e096ac7f8f1aeab8f4e75ef40547efb83e0f1d3.exe pjddd.exe PID 3432 wrote to memory of 2424 3432 c16f1f2f2c5bb0c5477809d48e096ac7f8f1aeab8f4e75ef40547efb83e0f1d3.exe pjddd.exe PID 3432 wrote to memory of 2424 3432 c16f1f2f2c5bb0c5477809d48e096ac7f8f1aeab8f4e75ef40547efb83e0f1d3.exe pjddd.exe PID 2424 wrote to memory of 4500 2424 pjddd.exe RuntimeBroker.exe PID 2424 wrote to memory of 4500 2424 pjddd.exe RuntimeBroker.exe PID 2424 wrote to memory of 4500 2424 pjddd.exe RuntimeBroker.exe PID 4500 wrote to memory of 2020 4500 fxflrxx.exe nbnhhb.exe PID 4500 wrote to memory of 2020 4500 fxflrxx.exe nbnhhb.exe PID 4500 wrote to memory of 2020 4500 fxflrxx.exe nbnhhb.exe PID 2020 wrote to memory of 3224 2020 nbnhhb.exe 7djjd.exe PID 2020 wrote to memory of 3224 2020 nbnhhb.exe 7djjd.exe PID 2020 wrote to memory of 3224 2020 nbnhhb.exe 7djjd.exe PID 3224 wrote to memory of 368 3224 7djjd.exe lfxrfxl.exe PID 3224 wrote to memory of 368 3224 7djjd.exe lfxrfxl.exe PID 3224 wrote to memory of 368 3224 7djjd.exe lfxrfxl.exe PID 368 wrote to memory of 1016 368 lfxrfxl.exe rfxlfxx.exe PID 368 wrote to memory of 1016 368 lfxrfxl.exe rfxlfxx.exe PID 368 wrote to memory of 1016 368 lfxrfxl.exe rfxlfxx.exe PID 1016 wrote to memory of 868 1016 nhbbhh.exe dpppj.exe PID 1016 wrote to memory of 868 1016 nhbbhh.exe dpppj.exe PID 1016 wrote to memory of 868 1016 nhbbhh.exe dpppj.exe PID 868 wrote to memory of 1788 868 5ttbht.exe xxfxrrl.exe PID 868 wrote to memory of 1788 868 5ttbht.exe xxfxrrl.exe PID 868 wrote to memory of 1788 868 5ttbht.exe xxfxrrl.exe PID 1788 wrote to memory of 872 1788 pvpjv.exe pjpvp.exe PID 1788 wrote to memory of 872 1788 pvpjv.exe pjpvp.exe PID 1788 wrote to memory of 872 1788 pvpjv.exe pjpvp.exe PID 872 wrote to memory of 4908 872 pjpvp.exe lffxxxr.exe PID 872 wrote to memory of 4908 872 pjpvp.exe lffxxxr.exe PID 872 wrote to memory of 4908 872 pjpvp.exe lffxxxr.exe PID 4908 wrote to memory of 5024 4908 lffxxxr.exe hhnhbh.exe PID 4908 wrote to memory of 5024 4908 lffxxxr.exe hhnhbh.exe PID 4908 wrote to memory of 5024 4908 lffxxxr.exe hhnhbh.exe PID 5024 wrote to memory of 2792 5024 hhnhbh.exe bbbbtt.exe PID 5024 wrote to memory of 2792 5024 hhnhbh.exe bbbbtt.exe PID 5024 wrote to memory of 2792 5024 hhnhbh.exe bbbbtt.exe PID 2792 wrote to memory of 1608 2792 bbbbtt.exe bhhhtb.exe PID 2792 wrote to memory of 1608 2792 bbbbtt.exe bhhhtb.exe PID 2792 wrote to memory of 1608 2792 bbbbtt.exe bhhhtb.exe PID 1608 wrote to memory of 4536 1608 bhhhtb.exe vddvv.exe PID 1608 wrote to memory of 4536 1608 bhhhtb.exe vddvv.exe PID 1608 wrote to memory of 4536 1608 bhhhtb.exe vddvv.exe PID 4536 wrote to memory of 2260 4536 vddvv.exe vppjj.exe PID 4536 wrote to memory of 2260 4536 vddvv.exe vppjj.exe PID 4536 wrote to memory of 2260 4536 vddvv.exe vppjj.exe PID 2260 wrote to memory of 4812 2260 vppjj.exe llfrlfx.exe PID 2260 wrote to memory of 4812 2260 vppjj.exe llfrlfx.exe PID 2260 wrote to memory of 4812 2260 vppjj.exe llfrlfx.exe PID 4812 wrote to memory of 428 4812 llfrlfx.exe bhhbtn.exe PID 4812 wrote to memory of 428 4812 llfrlfx.exe bhhbtn.exe PID 4812 wrote to memory of 428 4812 llfrlfx.exe bhhbtn.exe PID 428 wrote to memory of 2556 428 bhhbtn.exe bhnhtt.exe PID 428 wrote to memory of 2556 428 bhhbtn.exe bhnhtt.exe PID 428 wrote to memory of 2556 428 bhhbtn.exe bhnhtt.exe PID 2556 wrote to memory of 2364 2556 bhnhtt.exe 3jvpp.exe PID 2556 wrote to memory of 2364 2556 bhnhtt.exe 3jvpp.exe PID 2556 wrote to memory of 2364 2556 bhnhtt.exe 3jvpp.exe PID 2364 wrote to memory of 376 2364 3jvpp.exe vvppj.exe PID 2364 wrote to memory of 376 2364 3jvpp.exe vvppj.exe PID 2364 wrote to memory of 376 2364 3jvpp.exe vvppj.exe PID 376 wrote to memory of 2852 376 vvppj.exe 9ffrfrf.exe PID 376 wrote to memory of 2852 376 vvppj.exe 9ffrfrf.exe PID 376 wrote to memory of 2852 376 vvppj.exe 9ffrfrf.exe PID 2852 wrote to memory of 2764 2852 9ffrfrf.exe 9xxllfr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c16f1f2f2c5bb0c5477809d48e096ac7f8f1aeab8f4e75ef40547efb83e0f1d3.exe"C:\Users\Admin\AppData\Local\Temp\c16f1f2f2c5bb0c5477809d48e096ac7f8f1aeab8f4e75ef40547efb83e0f1d3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\pjddd.exec:\pjddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\fxflrxx.exec:\fxflrxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\nbnhhb.exec:\nbnhhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\7djjd.exec:\7djjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\lfxrfxl.exec:\lfxrfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\nhbbhh.exec:\nhbbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\5ttbht.exec:\5ttbht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\pvpjv.exec:\pvpjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\pjpvp.exec:\pjpvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\lffxxxr.exec:\lffxxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\hhnhbh.exec:\hhnhbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\bbbbtt.exec:\bbbbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\bhhhtb.exec:\bhhhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\vddvv.exec:\vddvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\vppjj.exec:\vppjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\llfrlfx.exec:\llfrlfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\bhhbtn.exec:\bhhbtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\bhnhtt.exec:\bhnhtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\3jvpp.exec:\3jvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\vvppj.exec:\vvppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\9ffrfrf.exec:\9ffrfrf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\9xxllfr.exec:\9xxllfr.exe23⤵
- Executes dropped EXE
PID:2764 -
\??\c:\ntnnhn.exec:\ntnnhn.exe24⤵
- Executes dropped EXE
PID:3240 -
\??\c:\hthnhh.exec:\hthnhh.exe25⤵
- Executes dropped EXE
PID:4352 -
\??\c:\5pjdv.exec:\5pjdv.exe26⤵
- Executes dropped EXE
PID:4648 -
\??\c:\vjjvv.exec:\vjjvv.exe27⤵
- Executes dropped EXE
PID:5108 -
\??\c:\flxrlll.exec:\flxrlll.exe28⤵
- Executes dropped EXE
PID:4872 -
\??\c:\hhnnhh.exec:\hhnnhh.exe29⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vjjdj.exec:\vjjdj.exe30⤵
- Executes dropped EXE
PID:1752 -
\??\c:\pdvdv.exec:\pdvdv.exe31⤵
- Executes dropped EXE
PID:3936 -
\??\c:\xlllffr.exec:\xlllffr.exe32⤵
- Executes dropped EXE
PID:3908 -
\??\c:\llrfxfx.exec:\llrfxfx.exe33⤵
- Executes dropped EXE
PID:1468 -
\??\c:\bhhhht.exec:\bhhhht.exe34⤵
- Executes dropped EXE
PID:3172 -
\??\c:\jpdjp.exec:\jpdjp.exe35⤵
- Executes dropped EXE
PID:4996 -
\??\c:\jddvj.exec:\jddvj.exe36⤵
- Executes dropped EXE
PID:4180 -
\??\c:\3pvpj.exec:\3pvpj.exe37⤵
- Executes dropped EXE
PID:3420 -
\??\c:\llxflrx.exec:\llxflrx.exe38⤵
- Executes dropped EXE
PID:4112 -
\??\c:\5xlllff.exec:\5xlllff.exe39⤵
- Executes dropped EXE
PID:3884 -
\??\c:\hhbbbb.exec:\hhbbbb.exe40⤵
- Executes dropped EXE
PID:524 -
\??\c:\7bbbtb.exec:\7bbbtb.exe41⤵
- Executes dropped EXE
PID:4312 -
\??\c:\jvddv.exec:\jvddv.exe42⤵
- Executes dropped EXE
PID:3604 -
\??\c:\vjppd.exec:\vjppd.exe43⤵
- Executes dropped EXE
PID:4424 -
\??\c:\rllllrl.exec:\rllllrl.exe44⤵
- Executes dropped EXE
PID:3372 -
\??\c:\9rflfll.exec:\9rflfll.exe45⤵
- Executes dropped EXE
PID:1572 -
\??\c:\hntbbn.exec:\hntbbn.exe46⤵
- Executes dropped EXE
PID:3624 -
\??\c:\5tbhbh.exec:\5tbhbh.exe47⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jvjvj.exec:\jvjvj.exe48⤵
- Executes dropped EXE
PID:3196 -
\??\c:\5jjjj.exec:\5jjjj.exe49⤵
- Executes dropped EXE
PID:1016 -
\??\c:\dpppj.exec:\dpppj.exe50⤵
- Executes dropped EXE
PID:868 -
\??\c:\xxfxrrl.exec:\xxfxrrl.exe51⤵
- Executes dropped EXE
PID:1788 -
\??\c:\fllflll.exec:\fllflll.exe52⤵
- Executes dropped EXE
PID:1508 -
\??\c:\bntnhn.exec:\bntnhn.exe53⤵
- Executes dropped EXE
PID:1344 -
\??\c:\bbnthn.exec:\bbnthn.exe54⤵
- Executes dropped EXE
PID:1240 -
\??\c:\vpjdp.exec:\vpjdp.exe55⤵
- Executes dropped EXE
PID:4100 -
\??\c:\lflrxrx.exec:\lflrxrx.exe56⤵
- Executes dropped EXE
PID:5092 -
\??\c:\llllfll.exec:\llllfll.exe57⤵
- Executes dropped EXE
PID:4852 -
\??\c:\bnbnbh.exec:\bnbnbh.exe58⤵
- Executes dropped EXE
PID:1192 -
\??\c:\7bbbtb.exec:\7bbbtb.exe59⤵
- Executes dropped EXE
PID:3440 -
\??\c:\vjpjp.exec:\vjpjp.exe60⤵
- Executes dropped EXE
PID:2152 -
\??\c:\jdpdp.exec:\jdpdp.exe61⤵
- Executes dropped EXE
PID:2264 -
\??\c:\rfllllr.exec:\rfllllr.exe62⤵
- Executes dropped EXE
PID:3496 -
\??\c:\lrlrlll.exec:\lrlrlll.exe63⤵
- Executes dropped EXE
PID:5080 -
\??\c:\hhnhnt.exec:\hhnhnt.exe64⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jddvp.exec:\jddvp.exe65⤵
- Executes dropped EXE
PID:3948 -
\??\c:\5pddd.exec:\5pddd.exe66⤵PID:2776
-
\??\c:\lxlfrrl.exec:\lxlfrrl.exe67⤵PID:3480
-
\??\c:\3ffflrr.exec:\3ffflrr.exe68⤵PID:3964
-
\??\c:\7bhnnn.exec:\7bhnnn.exe69⤵PID:3240
-
\??\c:\ppppj.exec:\ppppj.exe70⤵PID:4352
-
\??\c:\ddjjv.exec:\ddjjv.exe71⤵PID:4648
-
\??\c:\llxxxxx.exec:\llxxxxx.exe72⤵PID:4796
-
\??\c:\lfflfxf.exec:\lfflfxf.exe73⤵PID:4596
-
\??\c:\tnttnh.exec:\tnttnh.exe74⤵PID:3568
-
\??\c:\hhnhhh.exec:\hhnhhh.exe75⤵PID:4620
-
\??\c:\9ntttb.exec:\9ntttb.exe76⤵PID:3292
-
\??\c:\1vvvp.exec:\1vvvp.exe77⤵PID:5032
-
\??\c:\jjvdj.exec:\jjvdj.exe78⤵PID:3592
-
\??\c:\rxxxxxf.exec:\rxxxxxf.exe79⤵PID:4016
-
\??\c:\rrrxxfx.exec:\rrrxxfx.exe80⤵PID:2080
-
\??\c:\hbhhbb.exec:\hbhhbb.exe81⤵PID:1988
-
\??\c:\tttnbb.exec:\tttnbb.exe82⤵PID:4368
-
\??\c:\ddjvj.exec:\ddjvj.exe83⤵PID:4452
-
\??\c:\pdddd.exec:\pdddd.exe84⤵PID:4284
-
\??\c:\fflrllx.exec:\fflrllx.exe85⤵PID:2636
-
\??\c:\rrlrxff.exec:\rrlrxff.exe86⤵PID:4944
-
\??\c:\tnbbhn.exec:\tnbbhn.exe87⤵PID:764
-
\??\c:\3bnhnn.exec:\3bnhnn.exe88⤵PID:1248
-
\??\c:\jjjjd.exec:\jjjjd.exe89⤵PID:4028
-
\??\c:\ddjjp.exec:\ddjjp.exe90⤵PID:3432
-
\??\c:\llxxflr.exec:\llxxflr.exe91⤵PID:4280
-
\??\c:\xlrxxxx.exec:\xlrxxxx.exe92⤵PID:3016
-
\??\c:\btbbbb.exec:\btbbbb.exe93⤵PID:2308
-
\??\c:\nnnttb.exec:\nnnttb.exe94⤵PID:4780
-
\??\c:\jvdjp.exec:\jvdjp.exe95⤵PID:4120
-
\??\c:\jjpjp.exec:\jjpjp.exe96⤵PID:3732
-
\??\c:\lxrffrf.exec:\lxrffrf.exe97⤵PID:4360
-
\??\c:\nhttnt.exec:\nhttnt.exe98⤵PID:1072
-
\??\c:\vjvpj.exec:\vjvpj.exe99⤵PID:3048
-
\??\c:\dvpvd.exec:\dvpvd.exe100⤵PID:740
-
\??\c:\xrfflxf.exec:\xrfflxf.exe101⤵PID:4236
-
\??\c:\bthhtt.exec:\bthhtt.exe102⤵PID:4072
-
\??\c:\bttbbh.exec:\bttbbh.exe103⤵PID:5068
-
\??\c:\vvjdv.exec:\vvjdv.exe104⤵PID:1224
-
\??\c:\9rrlxrf.exec:\9rrlxrf.exe105⤵PID:2024
-
\??\c:\lrrlfff.exec:\lrrlfff.exe106⤵PID:4456
-
\??\c:\hhtbbb.exec:\hhtbbb.exe107⤵PID:2984
-
\??\c:\1thnhh.exec:\1thnhh.exe108⤵PID:4644
-
\??\c:\pjjjd.exec:\pjjjd.exe109⤵PID:4336
-
\??\c:\ppddv.exec:\ppddv.exe110⤵PID:3876
-
\??\c:\xrlfrlf.exec:\xrlfrlf.exe111⤵PID:1356
-
\??\c:\xxfxlfx.exec:\xxfxlfx.exe112⤵PID:4728
-
\??\c:\htbnnb.exec:\htbnnb.exe113⤵PID:4888
-
\??\c:\nntthh.exec:\nntthh.exe114⤵PID:2520
-
\??\c:\ppddj.exec:\ppddj.exe115⤵PID:1944
-
\??\c:\rlxlffl.exec:\rlxlffl.exe116⤵PID:896
-
\??\c:\7rlrxfr.exec:\7rlrxfr.exe117⤵PID:4640
-
\??\c:\llllfxx.exec:\llllfxx.exe118⤵PID:1940
-
\??\c:\thhhbb.exec:\thhhbb.exe119⤵PID:864
-
\??\c:\1tbbbh.exec:\1tbbbh.exe120⤵PID:2988
-
\??\c:\pddjd.exec:\pddjd.exe121⤵PID:1912
-
\??\c:\7djjj.exec:\7djjj.exe122⤵PID:632
-
\??\c:\rlxrlll.exec:\rlxrlll.exe123⤵PID:3912
-
\??\c:\3xfffff.exec:\3xfffff.exe124⤵PID:3908
-
\??\c:\thbbbh.exec:\thbbbh.exe125⤵PID:4568
-
\??\c:\bntbth.exec:\bntbth.exe126⤵PID:2948
-
\??\c:\pjjvv.exec:\pjjvv.exe127⤵PID:3172
-
\??\c:\3flllxr.exec:\3flllxr.exe128⤵PID:4968
-
\??\c:\fflfxxl.exec:\fflfxxl.exe129⤵PID:1968
-
\??\c:\hthbtt.exec:\hthbtt.exe130⤵PID:2952
-
\??\c:\djjdp.exec:\djjdp.exe131⤵PID:2708
-
\??\c:\dvdvp.exec:\dvdvp.exe132⤵PID:3456
-
\??\c:\fxlfxfx.exec:\fxlfxfx.exe133⤵PID:4944
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe134⤵PID:4212
-
\??\c:\bhhtnh.exec:\bhhtnh.exe135⤵PID:4240
-
\??\c:\thhbnh.exec:\thhbnh.exe136⤵PID:1572
-
\??\c:\jpjdp.exec:\jpjdp.exe137⤵PID:3016
-
\??\c:\3djdp.exec:\3djdp.exe138⤵PID:996
-
\??\c:\rfxlfxx.exec:\rfxlfxx.exe139⤵PID:1016
-
\??\c:\hnnhbb.exec:\hnnhbb.exe140⤵PID:3184
-
\??\c:\hhbthh.exec:\hhbthh.exe141⤵PID:4704
-
\??\c:\dvvjp.exec:\dvvjp.exe142⤵PID:1888
-
\??\c:\pvpdj.exec:\pvpdj.exe143⤵PID:2428
-
\??\c:\rrrrffr.exec:\rrrrffr.exe144⤵PID:1240
-
\??\c:\xlrlrlr.exec:\xlrlrlr.exe145⤵PID:4072
-
\??\c:\tttntb.exec:\tttntb.exe146⤵PID:3448
-
\??\c:\vvdpj.exec:\vvdpj.exe147⤵PID:1224
-
\??\c:\jjjjp.exec:\jjjjp.exe148⤵PID:4852
-
\??\c:\fffxfll.exec:\fffxfll.exe149⤵PID:2024
-
\??\c:\bthtnn.exec:\bthtnn.exe150⤵PID:2248
-
\??\c:\1lrxlrl.exec:\1lrxlrl.exe151⤵PID:5104
-
\??\c:\nhtttt.exec:\nhtttt.exe152⤵PID:4412
-
\??\c:\ddjjd.exec:\ddjjd.exe153⤵PID:4060
-
\??\c:\fxlxflr.exec:\fxlxflr.exe154⤵PID:2084
-
\??\c:\3nbbtb.exec:\3nbbtb.exe155⤵PID:4732
-
\??\c:\pdpdv.exec:\pdpdv.exe156⤵PID:3124
-
\??\c:\llxxfff.exec:\llxxfff.exe157⤵PID:1584
-
\??\c:\rffxrlf.exec:\rffxrlf.exe158⤵PID:1944
-
\??\c:\nnhnnt.exec:\nnhnnt.exe159⤵PID:896
-
\??\c:\7vvdj.exec:\7vvdj.exe160⤵PID:2528
-
\??\c:\vddvp.exec:\vddvp.exe161⤵PID:1940
-
\??\c:\xrlxffx.exec:\xrlxffx.exe162⤵PID:4796
-
\??\c:\9hnnhh.exec:\9hnnhh.exe163⤵PID:2716
-
\??\c:\bhnnhh.exec:\bhnnhh.exe164⤵PID:4676
-
\??\c:\ntnhbb.exec:\ntnhbb.exe165⤵PID:3756
-
\??\c:\1pvvv.exec:\1pvvv.exe166⤵PID:3912
-
\??\c:\nbnbnt.exec:\nbnbnt.exe167⤵PID:3096
-
\??\c:\rrlllxr.exec:\rrlllxr.exe168⤵PID:2912
-
\??\c:\5rffxxf.exec:\5rffxxf.exe169⤵PID:4016
-
\??\c:\bbbhbh.exec:\bbbhbh.exe170⤵PID:2080
-
\??\c:\btnhhh.exec:\btnhhh.exe171⤵PID:3444
-
\??\c:\vpddd.exec:\vpddd.exe172⤵PID:916
-
\??\c:\3lfrfxr.exec:\3lfrfxr.exe173⤵PID:2952
-
\??\c:\xlrllrl.exec:\xlrllrl.exe174⤵PID:4284
-
\??\c:\nbnbbb.exec:\nbnbbb.exe175⤵PID:4328
-
\??\c:\hthnnn.exec:\hthnnn.exe176⤵PID:4324
-
\??\c:\jdppj.exec:\jdppj.exe177⤵PID:4392
-
\??\c:\lfllfff.exec:\lfllfff.exe178⤵PID:4240
-
\??\c:\3rxxrll.exec:\3rxxrll.exe179⤵PID:4280
-
\??\c:\hhbttb.exec:\hhbttb.exe180⤵PID:1708
-
\??\c:\ppdpd.exec:\ppdpd.exe181⤵PID:4584
-
\??\c:\fxflffx.exec:\fxflffx.exe182⤵PID:1508
-
\??\c:\9xxxrrl.exec:\9xxxrrl.exe183⤵PID:760
-
\??\c:\5tbtnn.exec:\5tbtnn.exe184⤵PID:740
-
\??\c:\bhbntb.exec:\bhbntb.exe185⤵PID:3428
-
\??\c:\jjvvj.exec:\jjvvj.exe186⤵PID:3004
-
\??\c:\7ppjj.exec:\7ppjj.exe187⤵PID:3588
-
\??\c:\fxlflfx.exec:\fxlflfx.exe188⤵PID:2260
-
\??\c:\lrrxxxf.exec:\lrrxxxf.exe189⤵PID:4812
-
\??\c:\ttbnhn.exec:\ttbnhn.exe190⤵PID:452
-
\??\c:\hhnnhh.exec:\hhnnhh.exe191⤵PID:4980
-
\??\c:\1pvpp.exec:\1pvpp.exe192⤵PID:2488
-
\??\c:\djdjj.exec:\djdjj.exe193⤵PID:4792
-
\??\c:\fxlfrrr.exec:\fxlfrrr.exe194⤵PID:4040
-
\??\c:\hbhhhh.exec:\hbhhhh.exe195⤵PID:3948
-
\??\c:\nbtnnh.exec:\nbtnnh.exe196⤵PID:4888
-
\??\c:\dvjvp.exec:\dvjvp.exe197⤵PID:3388
-
\??\c:\ddvpv.exec:\ddvpv.exe198⤵PID:652
-
\??\c:\rrxlfxl.exec:\rrxlfxl.exe199⤵PID:3244
-
\??\c:\lrlrffr.exec:\lrlrffr.exe200⤵PID:4640
-
\??\c:\bthbbt.exec:\bthbbt.exe201⤵PID:1928
-
\??\c:\3tnnnn.exec:\3tnnnn.exe202⤵PID:3572
-
\??\c:\vpjvp.exec:\vpjvp.exe203⤵PID:836
-
\??\c:\1rrrlll.exec:\1rrrlll.exe204⤵PID:1420
-
\??\c:\rllfffx.exec:\rllfffx.exe205⤵PID:956
-
\??\c:\nttbbb.exec:\nttbbb.exe206⤵PID:632
-
\??\c:\ttttbh.exec:\ttttbh.exe207⤵PID:4940
-
\??\c:\jvjpj.exec:\jvjpj.exe208⤵PID:3592
-
\??\c:\xflxrll.exec:\xflxrll.exe209⤵PID:2948
-
\??\c:\ffffxff.exec:\ffffxff.exe210⤵PID:3172
-
\??\c:\thntnt.exec:\thntnt.exe211⤵PID:1080
-
\??\c:\hhnnbh.exec:\hhnnbh.exe212⤵PID:4180
-
\??\c:\jpjjd.exec:\jpjjd.exe213⤵PID:4832
-
\??\c:\fxxlffx.exec:\fxxlffx.exe214⤵PID:3916
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe215⤵PID:2708
-
\??\c:\hbbbhn.exec:\hbbbhn.exe216⤵PID:1724
-
\??\c:\jjjdv.exec:\jjjdv.exe217⤵PID:4332
-
\??\c:\jdddj.exec:\jdddj.exe218⤵PID:4392
-
\??\c:\fxflxfl.exec:\fxflxfl.exe219⤵PID:4240
-
\??\c:\fxxffll.exec:\fxxffll.exe220⤵PID:4280
-
\??\c:\nbnhhh.exec:\nbnhhh.exe221⤵PID:1788
-
\??\c:\djjdd.exec:\djjdd.exe222⤵PID:2432
-
\??\c:\ppvpv.exec:\ppvpv.exe223⤵PID:1888
-
\??\c:\lxllfff.exec:\lxllfff.exe224⤵PID:1344
-
\??\c:\7hhbtn.exec:\7hhbtn.exe225⤵PID:2428
-
\??\c:\3pppj.exec:\3pppj.exe226⤵PID:1240
-
\??\c:\1flflxx.exec:\1flflxx.exe227⤵PID:1532
-
\??\c:\llrrlll.exec:\llrrlll.exe228⤵PID:3448
-
\??\c:\nnbbhn.exec:\nnbbhn.exe229⤵PID:4432
-
\??\c:\vpvpv.exec:\vpvpv.exe230⤵PID:4456
-
\??\c:\pjppv.exec:\pjppv.exe231⤵PID:2472
-
\??\c:\rrlfxfl.exec:\rrlfxfl.exe232⤵PID:3876
-
\??\c:\3xlrlrx.exec:\3xlrlrx.exe233⤵PID:4876
-
\??\c:\ntthbh.exec:\ntthbh.exe234⤵PID:4040
-
\??\c:\hhhtnh.exec:\hhhtnh.exe235⤵PID:3696
-
\??\c:\ddvvv.exec:\ddvvv.exe236⤵PID:2764
-
\??\c:\ddppj.exec:\ddppj.exe237⤵PID:3240
-
\??\c:\flffllr.exec:\flffllr.exe238⤵PID:744
-
\??\c:\lxfxflf.exec:\lxfxflf.exe239⤵PID:1660
-
\??\c:\xrflrxx.exec:\xrflrxx.exe240⤵PID:2552
-
\??\c:\htnhhh.exec:\htnhhh.exe241⤵PID:1940
-
\??\c:\ntttnt.exec:\ntttnt.exe242⤵PID:4620