Analysis
-
max time kernel
149s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 05:00
Behavioral task
behavioral1
Sample
df2236dc39110b6794fbd84c7a00b05e37e0f151809718b085dd32f0218fe08c.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
-
Target
df2236dc39110b6794fbd84c7a00b05e37e0f151809718b085dd32f0218fe08c.exe
-
Size
80KB
-
MD5
e64dd6430ef406da889a8c246c7f6046
-
SHA1
44a6a5c00a67ec44df455cb5fb091d2c9e1abde1
-
SHA256
df2236dc39110b6794fbd84c7a00b05e37e0f151809718b085dd32f0218fe08c
-
SHA512
00494ac3bc0f327391e5269c05087b407fa4f03201283053dc8e4d01a495fcaa701b81ad76135995fa062a95fc887dcc7bbd915b78ef8d2de5bc327b98f74bef
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6T7Qr:zhOmTsF93UYfwC6GIoutiTU2HVS63Qr
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2712-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2488-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1556-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1292-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4340-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3848-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2532-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1512-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/556-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/536-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4016-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3992-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2936-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3184-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/628-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3104-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3612-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2712-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/412-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2824-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1572-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1728-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3248-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2256-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2936-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3728-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2832-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1820-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/892-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3688-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1116-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1192-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1788-477-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2932-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4632-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-565-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2068-621-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2712-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pdjdd.exe UPX behavioral2/memory/2712-4-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rlrrlrr.exe UPX behavioral2/memory/3652-10-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bbbhtt.exe UPX behavioral2/memory/1120-14-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2488-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vjjpj.exe UPX behavioral2/memory/4004-22-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3xxrlll.exe UPX C:\5lxxrfl.exe UPX behavioral2/memory/1556-29-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nttttn.exe UPX behavioral2/memory/1292-36-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pjjvp.exe UPX C:\fffxlfr.exe UPX behavioral2/memory/4180-43-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1528-45-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lrxlfxr.exe UPX behavioral2/memory/4476-51-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nbtnnh.exe UPX C:\vvpjd.exe UPX behavioral2/memory/4340-58-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vjdjv.exe UPX behavioral2/memory/3628-64-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ffffxfx.exe UPX behavioral2/memory/4088-68-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7nhtbt.exe UPX behavioral2/memory/4344-74-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3848-75-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7dpjd.exe UPX C:\dpjdv.exe UPX C:\lrrlffx.exe UPX behavioral2/memory/2532-87-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3916-90-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5tthbb.exe UPX C:\3bttnn.exe UPX \??\c:\dvvvp.exe UPX behavioral2/memory/4596-103-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jvppj.exe UPX C:\flrlxxr.exe UPX behavioral2/memory/1512-110-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ntbbbt.exe UPX behavioral2/memory/556-115-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vjppj.exe UPX behavioral2/memory/536-119-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\5xxrrlx.exe UPX behavioral2/memory/4016-125-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5flxrrl.exe UPX \??\c:\bbbttn.exe UPX behavioral2/memory/4904-134-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3292-138-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xlfrlfr.exe UPX C:\fflrllx.exe UPX C:\9hnhnn.exe UPX behavioral2/memory/3992-148-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pvvvj.exe UPX behavioral2/memory/2868-154-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2868-157-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2936-160-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3184-163-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4600-172-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4780-179-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
pdjdd.exerlrrlrr.exebbbhtt.exevjjpj.exe3xxrlll.exe5lxxrfl.exenttttn.exepjjvp.exefffxlfr.exelrxlfxr.exenbtnnh.exevvpjd.exevjdjv.exeffffxfx.exe7nhtbt.exe7dpjd.exedpjdv.exelrrlffx.exe5tthbb.exe3bttnn.exedvvvp.exejvppj.exeflrlxxr.exentbbbt.exevjppj.exe5xxrrlx.exe5flxrrl.exebbbttn.exexlfrlfr.exefflrllx.exe9hnhnn.exepvvvj.exe3htnhh.exepdjdv.exejdpjd.exehbbthh.exehbthtn.exepjjdp.exe3pjdv.exexrxffrr.exexllflll.exehhbthh.exevpdjd.exedjjdv.exefffxxrl.exeflrrrrr.exenhttnn.exebhbthh.exefxrxrxr.exelxxrllf.exebbhtnn.exevddjv.exejpvvp.exexrlfrlf.exexfllrfx.exetnnhbb.exepjvpp.exevddjj.exe7rfxxxr.exe7nhbtt.exejvvvp.exe3jjjd.exevdjvd.exe3xfxllf.exepid process 3652 pdjdd.exe 1120 rlrrlrr.exe 2488 bbbhtt.exe 4004 vjjpj.exe 1556 3xxrlll.exe 1728 5lxxrfl.exe 1292 nttttn.exe 4180 pjjvp.exe 1528 fffxlfr.exe 4476 lrxlfxr.exe 4340 nbtnnh.exe 3628 vvpjd.exe 4088 vjdjv.exe 4344 ffffxfx.exe 3848 7nhtbt.exe 5080 7dpjd.exe 2532 dpjdv.exe 3916 lrrlffx.exe 748 5tthbb.exe 4928 3bttnn.exe 4596 dvvvp.exe 1512 jvppj.exe 556 flrlxxr.exe 536 ntbbbt.exe 4016 vjppj.exe 4048 5xxrrlx.exe 4904 5flxrrl.exe 3292 bbbttn.exe 612 xlfrlfr.exe 3992 fflrllx.exe 3972 9hnhnn.exe 2868 pvvvj.exe 2936 3htnhh.exe 3184 pdjdv.exe 4176 jdpjd.exe 3908 hbbthh.exe 2284 hbthtn.exe 1928 pjjdp.exe 4600 3pjdv.exe 2376 xrxffrr.exe 4780 xllflll.exe 628 hhbthh.exe 3104 vpdjd.exe 1612 djjdv.exe 4280 fffxxrl.exe 1116 flrrrrr.exe 4576 nhttnn.exe 3612 bhbthh.exe 2712 fxrxrxr.exe 2236 lxxrllf.exe 2876 bbhtnn.exe 412 vddjv.exe 2824 jpvvp.exe 1012 xrlfrlf.exe 1572 xfllrfx.exe 1728 tnnhbb.exe 3528 pjvpp.exe 2912 vddjj.exe 3248 7rfxxxr.exe 1168 7nhbtt.exe 1348 jvvvp.exe 736 3jjjd.exe 3864 vdjvd.exe 3560 3xfxllf.exe -
Processes:
resource yara_rule behavioral2/memory/2712-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdjdd.exe upx behavioral2/memory/2712-4-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlrrlrr.exe upx behavioral2/memory/3652-10-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbbhtt.exe upx behavioral2/memory/1120-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2488-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjjpj.exe upx behavioral2/memory/4004-22-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3xxrlll.exe upx C:\5lxxrfl.exe upx behavioral2/memory/1556-29-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nttttn.exe upx behavioral2/memory/1292-36-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjjvp.exe upx C:\fffxlfr.exe upx behavioral2/memory/4180-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1528-45-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrxlfxr.exe upx behavioral2/memory/4476-51-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbtnnh.exe upx C:\vvpjd.exe upx behavioral2/memory/4340-58-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjdjv.exe upx behavioral2/memory/3628-64-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffffxfx.exe upx behavioral2/memory/4088-68-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7nhtbt.exe upx behavioral2/memory/4344-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3848-75-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7dpjd.exe upx C:\dpjdv.exe upx C:\lrrlffx.exe upx behavioral2/memory/2532-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3916-90-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5tthbb.exe upx C:\3bttnn.exe upx \??\c:\dvvvp.exe upx behavioral2/memory/4596-103-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvppj.exe upx C:\flrlxxr.exe upx behavioral2/memory/1512-110-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ntbbbt.exe upx behavioral2/memory/556-115-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjppj.exe upx behavioral2/memory/536-119-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5xxrrlx.exe upx behavioral2/memory/4016-125-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5flxrrl.exe upx \??\c:\bbbttn.exe upx behavioral2/memory/4904-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3292-138-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlfrlfr.exe upx C:\fflrllx.exe upx C:\9hnhnn.exe upx behavioral2/memory/3992-148-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvvvj.exe upx behavioral2/memory/2868-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2868-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2936-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3184-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4600-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4780-179-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
df2236dc39110b6794fbd84c7a00b05e37e0f151809718b085dd32f0218fe08c.exepdjdd.exerlrrlrr.exebbbhtt.exevjjpj.exe3xxrlll.exe5lxxrfl.exenttttn.exepjjvp.exefffxlfr.exelrxlfxr.exenbtnnh.exevvpjd.exevjdjv.exeffffxfx.exe7nhtbt.exe7dpjd.exedpjdv.exelrrlffx.exe5tthbb.exe3bttnn.exedvvvp.exedescription pid process target process PID 2712 wrote to memory of 3652 2712 df2236dc39110b6794fbd84c7a00b05e37e0f151809718b085dd32f0218fe08c.exe pdjdd.exe PID 2712 wrote to memory of 3652 2712 df2236dc39110b6794fbd84c7a00b05e37e0f151809718b085dd32f0218fe08c.exe pdjdd.exe PID 2712 wrote to memory of 3652 2712 df2236dc39110b6794fbd84c7a00b05e37e0f151809718b085dd32f0218fe08c.exe pdjdd.exe PID 3652 wrote to memory of 1120 3652 pdjdd.exe rlrrlrr.exe PID 3652 wrote to memory of 1120 3652 pdjdd.exe rlrrlrr.exe PID 3652 wrote to memory of 1120 3652 pdjdd.exe rlrrlrr.exe PID 1120 wrote to memory of 2488 1120 rlrrlrr.exe bbbhtt.exe PID 1120 wrote to memory of 2488 1120 rlrrlrr.exe bbbhtt.exe PID 1120 wrote to memory of 2488 1120 rlrrlrr.exe bbbhtt.exe PID 2488 wrote to memory of 4004 2488 bbbhtt.exe vjjpj.exe PID 2488 wrote to memory of 4004 2488 bbbhtt.exe vjjpj.exe PID 2488 wrote to memory of 4004 2488 bbbhtt.exe vjjpj.exe PID 4004 wrote to memory of 1556 4004 vjjpj.exe 3xxrlll.exe PID 4004 wrote to memory of 1556 4004 vjjpj.exe 3xxrlll.exe PID 4004 wrote to memory of 1556 4004 vjjpj.exe 3xxrlll.exe PID 1556 wrote to memory of 1728 1556 3xxrlll.exe 5lxxrfl.exe PID 1556 wrote to memory of 1728 1556 3xxrlll.exe 5lxxrfl.exe PID 1556 wrote to memory of 1728 1556 3xxrlll.exe 5lxxrfl.exe PID 1728 wrote to memory of 1292 1728 5lxxrfl.exe nttttn.exe PID 1728 wrote to memory of 1292 1728 5lxxrfl.exe nttttn.exe PID 1728 wrote to memory of 1292 1728 5lxxrfl.exe nttttn.exe PID 1292 wrote to memory of 4180 1292 nttttn.exe pjjvp.exe PID 1292 wrote to memory of 4180 1292 nttttn.exe pjjvp.exe PID 1292 wrote to memory of 4180 1292 nttttn.exe pjjvp.exe PID 4180 wrote to memory of 1528 4180 pjjvp.exe fffxlfr.exe PID 4180 wrote to memory of 1528 4180 pjjvp.exe fffxlfr.exe PID 4180 wrote to memory of 1528 4180 pjjvp.exe fffxlfr.exe PID 1528 wrote to memory of 4476 1528 fffxlfr.exe lrxlfxr.exe PID 1528 wrote to memory of 4476 1528 fffxlfr.exe lrxlfxr.exe PID 1528 wrote to memory of 4476 1528 fffxlfr.exe lrxlfxr.exe PID 4476 wrote to memory of 4340 4476 lrxlfxr.exe nbtnnh.exe PID 4476 wrote to memory of 4340 4476 lrxlfxr.exe nbtnnh.exe PID 4476 wrote to memory of 4340 4476 lrxlfxr.exe nbtnnh.exe PID 4340 wrote to memory of 3628 4340 nbtnnh.exe vvpjd.exe PID 4340 wrote to memory of 3628 4340 nbtnnh.exe vvpjd.exe PID 4340 wrote to memory of 3628 4340 nbtnnh.exe vvpjd.exe PID 3628 wrote to memory of 4088 3628 vvpjd.exe vjdjv.exe PID 3628 wrote to memory of 4088 3628 vvpjd.exe vjdjv.exe PID 3628 wrote to memory of 4088 3628 vvpjd.exe vjdjv.exe PID 4088 wrote to memory of 4344 4088 vjdjv.exe ffffxfx.exe PID 4088 wrote to memory of 4344 4088 vjdjv.exe ffffxfx.exe PID 4088 wrote to memory of 4344 4088 vjdjv.exe ffffxfx.exe PID 4344 wrote to memory of 3848 4344 ffffxfx.exe 7nhtbt.exe PID 4344 wrote to memory of 3848 4344 ffffxfx.exe 7nhtbt.exe PID 4344 wrote to memory of 3848 4344 ffffxfx.exe 7nhtbt.exe PID 3848 wrote to memory of 5080 3848 7nhtbt.exe 7dpjd.exe PID 3848 wrote to memory of 5080 3848 7nhtbt.exe 7dpjd.exe PID 3848 wrote to memory of 5080 3848 7nhtbt.exe 7dpjd.exe PID 5080 wrote to memory of 2532 5080 7dpjd.exe dpjdv.exe PID 5080 wrote to memory of 2532 5080 7dpjd.exe dpjdv.exe PID 5080 wrote to memory of 2532 5080 7dpjd.exe dpjdv.exe PID 2532 wrote to memory of 3916 2532 dpjdv.exe lrrlffx.exe PID 2532 wrote to memory of 3916 2532 dpjdv.exe lrrlffx.exe PID 2532 wrote to memory of 3916 2532 dpjdv.exe lrrlffx.exe PID 3916 wrote to memory of 748 3916 lrrlffx.exe 5tthbb.exe PID 3916 wrote to memory of 748 3916 lrrlffx.exe 5tthbb.exe PID 3916 wrote to memory of 748 3916 lrrlffx.exe 5tthbb.exe PID 748 wrote to memory of 4928 748 5tthbb.exe 3bttnn.exe PID 748 wrote to memory of 4928 748 5tthbb.exe 3bttnn.exe PID 748 wrote to memory of 4928 748 5tthbb.exe 3bttnn.exe PID 4928 wrote to memory of 4596 4928 3bttnn.exe dvvvp.exe PID 4928 wrote to memory of 4596 4928 3bttnn.exe dvvvp.exe PID 4928 wrote to memory of 4596 4928 3bttnn.exe dvvvp.exe PID 4596 wrote to memory of 1512 4596 dvvvp.exe jvppj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df2236dc39110b6794fbd84c7a00b05e37e0f151809718b085dd32f0218fe08c.exe"C:\Users\Admin\AppData\Local\Temp\df2236dc39110b6794fbd84c7a00b05e37e0f151809718b085dd32f0218fe08c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\pdjdd.exec:\pdjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\rlrrlrr.exec:\rlrrlrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\bbbhtt.exec:\bbbhtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\vjjpj.exec:\vjjpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\3xxrlll.exec:\3xxrlll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\5lxxrfl.exec:\5lxxrfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\nttttn.exec:\nttttn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\pjjvp.exec:\pjjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\fffxlfr.exec:\fffxlfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\lrxlfxr.exec:\lrxlfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\nbtnnh.exec:\nbtnnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\vvpjd.exec:\vvpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\vjdjv.exec:\vjdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\ffffxfx.exec:\ffffxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\7nhtbt.exec:\7nhtbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\7dpjd.exec:\7dpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\dpjdv.exec:\dpjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\lrrlffx.exec:\lrrlffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\5tthbb.exec:\5tthbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\3bttnn.exec:\3bttnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\dvvvp.exec:\dvvvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\jvppj.exec:\jvppj.exe23⤵
- Executes dropped EXE
PID:1512 -
\??\c:\flrlxxr.exec:\flrlxxr.exe24⤵
- Executes dropped EXE
PID:556 -
\??\c:\ntbbbt.exec:\ntbbbt.exe25⤵
- Executes dropped EXE
PID:536 -
\??\c:\vjppj.exec:\vjppj.exe26⤵
- Executes dropped EXE
PID:4016 -
\??\c:\5xxrrlx.exec:\5xxrrlx.exe27⤵
- Executes dropped EXE
PID:4048 -
\??\c:\5flxrrl.exec:\5flxrrl.exe28⤵
- Executes dropped EXE
PID:4904 -
\??\c:\bbbttn.exec:\bbbttn.exe29⤵
- Executes dropped EXE
PID:3292 -
\??\c:\xlfrlfr.exec:\xlfrlfr.exe30⤵
- Executes dropped EXE
PID:612 -
\??\c:\fflrllx.exec:\fflrllx.exe31⤵
- Executes dropped EXE
PID:3992 -
\??\c:\9hnhnn.exec:\9hnhnn.exe32⤵
- Executes dropped EXE
PID:3972 -
\??\c:\pvvvj.exec:\pvvvj.exe33⤵
- Executes dropped EXE
PID:2868 -
\??\c:\3htnhh.exec:\3htnhh.exe34⤵
- Executes dropped EXE
PID:2936 -
\??\c:\pdjdv.exec:\pdjdv.exe35⤵
- Executes dropped EXE
PID:3184 -
\??\c:\jdpjd.exec:\jdpjd.exe36⤵
- Executes dropped EXE
PID:4176 -
\??\c:\hbbthh.exec:\hbbthh.exe37⤵
- Executes dropped EXE
PID:3908 -
\??\c:\hbthtn.exec:\hbthtn.exe38⤵
- Executes dropped EXE
PID:2284 -
\??\c:\pjjdp.exec:\pjjdp.exe39⤵
- Executes dropped EXE
PID:1928 -
\??\c:\3pjdv.exec:\3pjdv.exe40⤵
- Executes dropped EXE
PID:4600 -
\??\c:\xrxffrr.exec:\xrxffrr.exe41⤵
- Executes dropped EXE
PID:2376 -
\??\c:\xllflll.exec:\xllflll.exe42⤵
- Executes dropped EXE
PID:4780 -
\??\c:\hhbthh.exec:\hhbthh.exe43⤵
- Executes dropped EXE
PID:628 -
\??\c:\vpdjd.exec:\vpdjd.exe44⤵
- Executes dropped EXE
PID:3104 -
\??\c:\djjdv.exec:\djjdv.exe45⤵
- Executes dropped EXE
PID:1612 -
\??\c:\fffxxrl.exec:\fffxxrl.exe46⤵
- Executes dropped EXE
PID:4280 -
\??\c:\flrrrrr.exec:\flrrrrr.exe47⤵
- Executes dropped EXE
PID:1116 -
\??\c:\nhttnn.exec:\nhttnn.exe48⤵
- Executes dropped EXE
PID:4576 -
\??\c:\bhbthh.exec:\bhbthh.exe49⤵
- Executes dropped EXE
PID:3612 -
\??\c:\vdjjd.exec:\vdjjd.exe50⤵PID:1192
-
\??\c:\fxrxrxr.exec:\fxrxrxr.exe51⤵
- Executes dropped EXE
PID:2712 -
\??\c:\lxxrllf.exec:\lxxrllf.exe52⤵
- Executes dropped EXE
PID:2236 -
\??\c:\bbhtnn.exec:\bbhtnn.exe53⤵
- Executes dropped EXE
PID:2876 -
\??\c:\vddjv.exec:\vddjv.exe54⤵
- Executes dropped EXE
PID:412 -
\??\c:\jpvvp.exec:\jpvvp.exe55⤵
- Executes dropped EXE
PID:2824 -
\??\c:\xrlfrlf.exec:\xrlfrlf.exe56⤵
- Executes dropped EXE
PID:1012 -
\??\c:\xfllrfx.exec:\xfllrfx.exe57⤵
- Executes dropped EXE
PID:1572 -
\??\c:\tnnhbb.exec:\tnnhbb.exe58⤵
- Executes dropped EXE
PID:1728 -
\??\c:\pjvpp.exec:\pjvpp.exe59⤵
- Executes dropped EXE
PID:3528 -
\??\c:\vddjj.exec:\vddjj.exe60⤵
- Executes dropped EXE
PID:2912 -
\??\c:\7rfxxxr.exec:\7rfxxxr.exe61⤵
- Executes dropped EXE
PID:3248 -
\??\c:\7nhbtt.exec:\7nhbtt.exe62⤵
- Executes dropped EXE
PID:1168 -
\??\c:\jvvvp.exec:\jvvvp.exe63⤵
- Executes dropped EXE
PID:1348 -
\??\c:\3jjjd.exec:\3jjjd.exe64⤵
- Executes dropped EXE
PID:736 -
\??\c:\vdjvd.exec:\vdjvd.exe65⤵
- Executes dropped EXE
PID:3864 -
\??\c:\3xfxllf.exec:\3xfxllf.exe66⤵
- Executes dropped EXE
PID:3560 -
\??\c:\fxffllx.exec:\fxffllx.exe67⤵PID:2124
-
\??\c:\tttnnh.exec:\tttnnh.exe68⤵PID:4648
-
\??\c:\3nnnnh.exec:\3nnnnh.exe69⤵PID:4796
-
\??\c:\9jjpj.exec:\9jjpj.exe70⤵PID:4864
-
\??\c:\vjdvj.exec:\vjdvj.exe71⤵PID:4920
-
\??\c:\xlxllll.exec:\xlxllll.exe72⤵PID:3848
-
\??\c:\rrrfffx.exec:\rrrfffx.exe73⤵PID:5080
-
\??\c:\bhbtbb.exec:\bhbtbb.exe74⤵PID:4792
-
\??\c:\nbbnhh.exec:\nbbnhh.exe75⤵PID:1000
-
\??\c:\vvjdv.exec:\vvjdv.exe76⤵PID:2588
-
\??\c:\dpdvp.exec:\dpdvp.exe77⤵PID:748
-
\??\c:\lfllfrr.exec:\lfllfrr.exe78⤵PID:5040
-
\??\c:\rlrfxfr.exec:\rlrfxfr.exe79⤵PID:4928
-
\??\c:\nnnnbb.exec:\nnnnbb.exe80⤵PID:4596
-
\??\c:\nhbhbb.exec:\nhbhbb.exe81⤵PID:888
-
\??\c:\dpvvp.exec:\dpvvp.exe82⤵PID:4516
-
\??\c:\lfflfxf.exec:\lfflfxf.exe83⤵PID:4480
-
\??\c:\rfffllf.exec:\rfffllf.exe84⤵PID:2536
-
\??\c:\9nbtbt.exec:\9nbtbt.exe85⤵PID:4856
-
\??\c:\nhnbnt.exec:\nhnbnt.exe86⤵PID:988
-
\??\c:\xfxrfxl.exec:\xfxrfxl.exe87⤵PID:4892
-
\??\c:\5nhhhh.exec:\5nhhhh.exe88⤵PID:3020
-
\??\c:\hhnhbh.exec:\hhnhbh.exe89⤵PID:4568
-
\??\c:\pjvvv.exec:\pjvvv.exe90⤵PID:1004
-
\??\c:\5ppdv.exec:\5ppdv.exe91⤵PID:4788
-
\??\c:\3xxrflr.exec:\3xxrflr.exe92⤵PID:1308
-
\??\c:\hnnnnt.exec:\hnnnnt.exe93⤵PID:4108
-
\??\c:\9hntnt.exec:\9hntnt.exe94⤵PID:904
-
\??\c:\jvpvp.exec:\jvpvp.exe95⤵PID:3168
-
\??\c:\dvvvd.exec:\dvvvd.exe96⤵PID:5056
-
\??\c:\lfrlfxx.exec:\lfrlfxx.exe97⤵PID:2256
-
\??\c:\hhbbbb.exec:\hhbbbb.exe98⤵PID:2936
-
\??\c:\tbbhhn.exec:\tbbhhn.exe99⤵PID:3184
-
\??\c:\vdjpj.exec:\vdjpj.exe100⤵PID:2616
-
\??\c:\9djjv.exec:\9djjv.exe101⤵PID:4624
-
\??\c:\rxrfxrx.exec:\rxrfxrx.exe102⤵PID:2284
-
\??\c:\xlrlffx.exec:\xlrlffx.exe103⤵PID:2692
-
\??\c:\nhhbbt.exec:\nhhbbt.exe104⤵PID:1452
-
\??\c:\tnntth.exec:\tnntth.exe105⤵PID:2376
-
\??\c:\pdpvv.exec:\pdpvv.exe106⤵PID:4780
-
\??\c:\fflllff.exec:\fflllff.exe107⤵PID:4944
-
\??\c:\rffflxl.exec:\rffflxl.exe108⤵PID:4432
-
\??\c:\nhbbbn.exec:\nhbbbn.exe109⤵PID:4660
-
\??\c:\pddpj.exec:\pddpj.exe110⤵PID:4520
-
\??\c:\pvjjv.exec:\pvjjv.exe111⤵PID:2544
-
\??\c:\fflllrx.exec:\fflllrx.exe112⤵PID:4420
-
\??\c:\rrlllll.exec:\rrlllll.exe113⤵PID:3612
-
\??\c:\ttnnnt.exec:\ttnnnt.exe114⤵PID:3728
-
\??\c:\5pddd.exec:\5pddd.exe115⤵PID:3876
-
\??\c:\vjpjd.exec:\vjpjd.exe116⤵PID:1304
-
\??\c:\fxlffll.exec:\fxlffll.exe117⤵PID:2832
-
\??\c:\lflllll.exec:\lflllll.exe118⤵PID:1500
-
\??\c:\5flffff.exec:\5flffff.exe119⤵PID:4572
-
\??\c:\htbbbh.exec:\htbbbh.exe120⤵PID:2004
-
\??\c:\hhnbtt.exec:\hhnbtt.exe121⤵PID:3516
-
\??\c:\ddddv.exec:\ddddv.exe122⤵PID:1204
-
\??\c:\3djdd.exec:\3djdd.exe123⤵PID:1528
-
\??\c:\rrxlfrr.exec:\rrxlfrr.exe124⤵PID:4476
-
\??\c:\3fflrrr.exec:\3fflrrr.exe125⤵PID:3384
-
\??\c:\bttnhh.exec:\bttnhh.exe126⤵PID:4340
-
\??\c:\nhhhhb.exec:\nhhhhb.exe127⤵PID:4528
-
\??\c:\vvpdd.exec:\vvpdd.exe128⤵PID:4404
-
\??\c:\jdvvp.exec:\jdvvp.exe129⤵PID:3536
-
\??\c:\rrlllll.exec:\rrlllll.exe130⤵PID:760
-
\??\c:\5lllfff.exec:\5lllfff.exe131⤵PID:2976
-
\??\c:\3fffrrf.exec:\3fffrrf.exe132⤵PID:8
-
\??\c:\ttbtbb.exec:\ttbtbb.exe133⤵PID:1772
-
\??\c:\ddvvd.exec:\ddvvd.exe134⤵PID:1028
-
\??\c:\pvvpp.exec:\pvvpp.exe135⤵PID:2532
-
\??\c:\vjjjj.exec:\vjjjj.exe136⤵PID:2260
-
\??\c:\rlxrlfx.exec:\rlxrlfx.exe137⤵PID:824
-
\??\c:\rlflrxx.exec:\rlflrxx.exe138⤵PID:5096
-
\??\c:\nttttb.exec:\nttttb.exe139⤵PID:748
-
\??\c:\vvddv.exec:\vvddv.exe140⤵PID:5040
-
\??\c:\dvdvp.exec:\dvdvp.exe141⤵PID:1820
-
\??\c:\rrllxfr.exec:\rrllxfr.exe142⤵PID:4596
-
\??\c:\hthtnn.exec:\hthtnn.exe143⤵PID:3780
-
\??\c:\9jpdd.exec:\9jpdd.exe144⤵PID:4516
-
\??\c:\jpjdd.exec:\jpjdd.exe145⤵PID:4480
-
\??\c:\1dvpv.exec:\1dvpv.exe146⤵PID:4980
-
\??\c:\xlrrrxx.exec:\xlrrrxx.exe147⤵PID:2056
-
\??\c:\bbhhhn.exec:\bbhhhn.exe148⤵PID:4904
-
\??\c:\jdddd.exec:\jdddd.exe149⤵PID:1796
-
\??\c:\5vpvv.exec:\5vpvv.exe150⤵PID:4872
-
\??\c:\rllfxff.exec:\rllfxff.exe151⤵PID:4052
-
\??\c:\fxfflll.exec:\fxfflll.exe152⤵PID:1004
-
\??\c:\nhhbnh.exec:\nhhbnh.exe153⤵PID:892
-
\??\c:\vdvvv.exec:\vdvvv.exe154⤵PID:948
-
\??\c:\ppjjj.exec:\ppjjj.exe155⤵PID:2576
-
\??\c:\xffxllr.exec:\xffxllr.exe156⤵PID:1396
-
\??\c:\lxxrrxf.exec:\lxxrrxf.exe157⤵PID:2852
-
\??\c:\nbhhhh.exec:\nbhhhh.exe158⤵PID:3688
-
\??\c:\7nthth.exec:\7nthth.exe159⤵PID:3420
-
\??\c:\dpvpd.exec:\dpvpd.exe160⤵PID:2928
-
\??\c:\lflfrlr.exec:\lflfrlr.exe161⤵PID:952
-
\??\c:\frxxxrl.exec:\frxxxrl.exe162⤵PID:2760
-
\??\c:\nbbnhb.exec:\nbbnhb.exe163⤵PID:3928
-
\??\c:\hbhbhb.exec:\hbhbhb.exe164⤵PID:5032
-
\??\c:\pppjd.exec:\pppjd.exe165⤵PID:2376
-
\??\c:\pjvvv.exec:\pjvvv.exe166⤵PID:4656
-
\??\c:\lffxllf.exec:\lffxllf.exe167⤵PID:4944
-
\??\c:\xllxrrr.exec:\xllxrrr.exe168⤵PID:3376
-
\??\c:\tttnnh.exec:\tttnnh.exe169⤵PID:3500
-
\??\c:\5vvvj.exec:\5vvvj.exe170⤵PID:1116
-
\??\c:\fxxrllf.exec:\fxxrllf.exe171⤵PID:2544
-
\??\c:\xfffxrl.exec:\xfffxrl.exe172⤵PID:1192
-
\??\c:\tnnhnh.exec:\tnnhnh.exe173⤵PID:2324
-
\??\c:\jvpdp.exec:\jvpdp.exe174⤵PID:2236
-
\??\c:\jdvpd.exec:\jdvpd.exe175⤵PID:1788
-
\??\c:\5fxrfxr.exec:\5fxrfxr.exe176⤵PID:2832
-
\??\c:\ntbttn.exec:\ntbttn.exe177⤵PID:2900
-
\??\c:\9dvjj.exec:\9dvjj.exe178⤵PID:3648
-
\??\c:\pdjjj.exec:\pdjjj.exe179⤵PID:3024
-
\??\c:\xxfxfxf.exec:\xxfxfxf.exe180⤵PID:3624
-
\??\c:\5rlfxrl.exec:\5rlfxrl.exe181⤵PID:3912
-
\??\c:\bhhhbb.exec:\bhhhbb.exe182⤵PID:2912
-
\??\c:\tnnhbb.exec:\tnnhbb.exe183⤵PID:3248
-
\??\c:\pjjdp.exec:\pjjdp.exe184⤵PID:1516
-
\??\c:\pdjdp.exec:\pdjdp.exe185⤵PID:1348
-
\??\c:\fflrrrf.exec:\fflrrrf.exe186⤵PID:2756
-
\??\c:\flrflxf.exec:\flrflxf.exe187⤵PID:3492
-
\??\c:\htnhnn.exec:\htnhnn.exe188⤵PID:3560
-
\??\c:\nhhhtt.exec:\nhhhtt.exe189⤵PID:2124
-
\??\c:\vjjvp.exec:\vjjvp.exe190⤵PID:2668
-
\??\c:\jvvpj.exec:\jvvpj.exe191⤵PID:2080
-
\??\c:\xfrrrrr.exec:\xfrrrrr.exe192⤵PID:3828
-
\??\c:\xfxllfx.exec:\xfxllfx.exe193⤵PID:1772
-
\??\c:\hhtbnt.exec:\hhtbnt.exe194⤵PID:2932
-
\??\c:\1btnhh.exec:\1btnhh.exe195⤵PID:824
-
\??\c:\dvpjd.exec:\dvpjd.exe196⤵PID:2396
-
\??\c:\vjjdv.exec:\vjjdv.exe197⤵PID:3616
-
\??\c:\xrxrrlr.exec:\xrxrrlr.exe198⤵PID:624
-
\??\c:\xfflfxl.exec:\xfflfxl.exe199⤵PID:1376
-
\??\c:\httbbh.exec:\httbbh.exe200⤵PID:4632
-
\??\c:\7htntt.exec:\7htntt.exe201⤵PID:4696
-
\??\c:\jpjjj.exec:\jpjjj.exe202⤵PID:3412
-
\??\c:\7rxfxll.exec:\7rxfxll.exe203⤵PID:2920
-
\??\c:\xfrrrfl.exec:\xfrrrfl.exe204⤵PID:4056
-
\??\c:\7hhbnt.exec:\7hhbnt.exe205⤵PID:1680
-
\??\c:\7htbhh.exec:\7htbhh.exe206⤵PID:4820
-
\??\c:\dvdvv.exec:\dvdvv.exe207⤵PID:904
-
\??\c:\djjjv.exec:\djjjv.exe208⤵PID:4812
-
\??\c:\fflfxlx.exec:\fflfxlx.exe209⤵PID:4156
-
\??\c:\xfxxrlr.exec:\xfxxrlr.exe210⤵PID:2296
-
\??\c:\fxfflrr.exec:\fxfflrr.exe211⤵PID:3940
-
\??\c:\nnbbbb.exec:\nnbbbb.exe212⤵PID:1644
-
\??\c:\bttttt.exec:\bttttt.exe213⤵PID:4624
-
\??\c:\jdjjd.exec:\jdjjd.exe214⤵PID:2284
-
\??\c:\rlffxxx.exec:\rlffxxx.exe215⤵PID:768
-
\??\c:\htnnhh.exec:\htnnhh.exe216⤵PID:1452
-
\??\c:\btbnnh.exec:\btbnnh.exe217⤵PID:2872
-
\??\c:\nththb.exec:\nththb.exe218⤵PID:3680
-
\??\c:\vdppj.exec:\vdppj.exe219⤵PID:3104
-
\??\c:\xffxxxl.exec:\xffxxxl.exe220⤵PID:1612
-
\??\c:\tnnbbt.exec:\tnnbbt.exe221⤵PID:4280
-
\??\c:\nttbtb.exec:\nttbtb.exe222⤵PID:3276
-
\??\c:\dvvpp.exec:\dvvpp.exe223⤵PID:2640
-
\??\c:\pppvd.exec:\pppvd.exe224⤵PID:1584
-
\??\c:\rfrxrxf.exec:\rfrxrxf.exe225⤵PID:3876
-
\??\c:\ntbbtn.exec:\ntbbtn.exe226⤵PID:412
-
\??\c:\5bttnb.exec:\5bttnb.exe227⤵PID:2488
-
\??\c:\dvvjd.exec:\dvvjd.exe228⤵PID:1500
-
\??\c:\jjddv.exec:\jjddv.exe229⤵PID:3872
-
\??\c:\9lxfrxr.exec:\9lxfrxr.exe230⤵PID:1728
-
\??\c:\nhbthh.exec:\nhbthh.exe231⤵PID:1112
-
\??\c:\bhhhbb.exec:\bhhhbb.exe232⤵PID:3528
-
\??\c:\nnhbtt.exec:\nnhbtt.exe233⤵PID:3624
-
\??\c:\vpddp.exec:\vpddp.exe234⤵PID:2744
-
\??\c:\fxxllfr.exec:\fxxllfr.exe235⤵PID:2248
-
\??\c:\bnhnhh.exec:\bnhnhh.exe236⤵PID:1168
-
\??\c:\bhbbtt.exec:\bhbbtt.exe237⤵PID:4580
-
\??\c:\dpvpj.exec:\dpvpj.exe238⤵PID:828
-
\??\c:\5rrllff.exec:\5rrllff.exe239⤵PID:4884
-
\??\c:\lrxfffx.exec:\lrxfffx.exe240⤵PID:3628
-
\??\c:\bttnnh.exec:\bttnnh.exe241⤵PID:4628
-
\??\c:\pjdvp.exec:\pjdvp.exe242⤵PID:756