Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 18:46
Behavioral task
behavioral1
Sample
1141c3c682e58cad2dca9ec2a652e408dde4ea33470b8c3ec06b7b08470ef4b2.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
1141c3c682e58cad2dca9ec2a652e408dde4ea33470b8c3ec06b7b08470ef4b2.exe
-
Size
233KB
-
MD5
1529132f6cf1b8be43bf3f71abc48f28
-
SHA1
a79e83fbb8bd34965b70189c15d639827a057cc8
-
SHA256
1141c3c682e58cad2dca9ec2a652e408dde4ea33470b8c3ec06b7b08470ef4b2
-
SHA512
bd8f31fdd24e7f3f05cd5f27997778063ce25c86edce8e26698092076f869e624fb2c49564ff423e9a7e1a757c4b818fb6cfc1b028716efc1eed20a2011e5181
-
SSDEEP
6144:kcm4FmowdHoSSGpJw4PqhraHcpOmFTHDGYhEf5X2aY:y4wFHoSSGpJwGeeFmFTNAp29
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2452-6-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4888-8-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2056-14-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2588-20-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4244-30-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3620-38-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/868-47-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4872-54-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/5068-59-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4360-62-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/536-73-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3260-79-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4844-84-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2364-94-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1676-100-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4432-108-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/368-116-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2488-131-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3768-137-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3360-146-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3132-150-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2272-166-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3636-175-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1624-181-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1396-191-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2244-193-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/956-203-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4276-209-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4052-242-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3572-246-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/5068-250-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3288-254-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4016-258-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2800-262-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3260-263-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3728-270-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3712-274-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3692-282-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4988-284-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1572-290-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4948-321-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3888-325-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1624-347-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/212-370-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2428-381-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2512-384-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/448-392-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/5056-430-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1400-435-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4880-462-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1588-514-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/888-530-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1420-562-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3960-569-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2564-594-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4532-742-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1080-766-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3972-794-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4080-798-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3164-826-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1136-858-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4512-936-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4564-985-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3352-1328-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2452-0-0x0000000000400000-0x0000000000437000-memory.dmp UPX \??\c:\thhbbb.exe UPX behavioral2/memory/2452-6-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral2/memory/4888-8-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral2/memory/2056-14-0x0000000000400000-0x0000000000437000-memory.dmp UPX C:\1llllll.exe UPX behavioral2/memory/2588-20-0x0000000000400000-0x0000000000437000-memory.dmp UPX \??\c:\vvppj.exe UPX \??\c:\7xxrllf.exe UPX behavioral2/memory/4244-25-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral2/memory/4244-30-0x0000000000400000-0x0000000000437000-memory.dmp UPX C:\llffllr.exe UPX \??\c:\flrrrxx.exe UPX behavioral2/memory/3620-38-0x0000000000400000-0x0000000000437000-memory.dmp UPX C:\bhttnt.exe UPX C:\djjdv.exe UPX behavioral2/memory/868-47-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral2/memory/4872-49-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral2/memory/4872-54-0x0000000000400000-0x0000000000437000-memory.dmp UPX C:\nhnhhh.exe UPX C:\jpddv.exe UPX behavioral2/memory/5068-59-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral2/memory/4360-62-0x0000000000400000-0x0000000000437000-memory.dmp UPX C:\flrrllf.exe UPX C:\nbnnnn.exe UPX behavioral2/memory/536-73-0x0000000000400000-0x0000000000437000-memory.dmp UPX \??\c:\vjvvp.exe UPX behavioral2/memory/3260-79-0x0000000000400000-0x0000000000437000-memory.dmp UPX \??\c:\5pjjd.exe UPX behavioral2/memory/4844-84-0x0000000000400000-0x0000000000437000-memory.dmp UPX C:\nhnhbt.exe UPX behavioral2/memory/2364-94-0x0000000000400000-0x0000000000437000-memory.dmp UPX C:\5pjdv.exe UPX C:\flxrllf.exe UPX behavioral2/memory/4432-102-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral2/memory/1676-100-0x0000000000400000-0x0000000000437000-memory.dmp UPX C:\vjvvv.exe UPX behavioral2/memory/4432-108-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral2/memory/3772-109-0x0000000000400000-0x0000000000437000-memory.dmp UPX C:\hnhntt.exe UPX behavioral2/memory/368-116-0x0000000000400000-0x0000000000437000-memory.dmp UPX C:\1djjv.exe UPX C:\xffxrrl.exe UPX C:\hhhbbb.exe UPX behavioral2/memory/2488-131-0x0000000000400000-0x0000000000437000-memory.dmp UPX C:\ddjdp.exe UPX behavioral2/memory/3768-137-0x0000000000400000-0x0000000000437000-memory.dmp UPX C:\llllfxx.exe UPX behavioral2/memory/3360-146-0x0000000000400000-0x0000000000437000-memory.dmp UPX C:\nhhhhh.exe UPX behavioral2/memory/3132-150-0x0000000000400000-0x0000000000437000-memory.dmp UPX C:\vjpjd.exe UPX C:\rlxffff.exe UPX \??\c:\3pvvj.exe UPX behavioral2/memory/2272-166-0x0000000000400000-0x0000000000437000-memory.dmp UPX C:\frlrxxr.exe UPX C:\thbbhh.exe UPX behavioral2/memory/3636-175-0x0000000000400000-0x0000000000437000-memory.dmp UPX C:\jdvjv.exe UPX behavioral2/memory/1624-181-0x0000000000400000-0x0000000000437000-memory.dmp UPX C:\flllfff.exe UPX behavioral2/memory/1396-191-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral2/memory/2244-193-0x0000000000400000-0x0000000000437000-memory.dmp UPX behavioral2/memory/956-203-0x0000000000400000-0x0000000000437000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
thhbbb.exevvppj.exe1llllll.exe7xxrllf.exellffllr.exeflrrrxx.exebhttnt.exedjjdv.exenhnhhh.exejpddv.exeflrrllf.exenbnnnn.exevjvvp.exe5pjjd.exenhnhbt.exe5pjdv.exeflxrllf.exevjvvv.exehnhntt.exe1djjv.exexffxrrl.exehhhbbb.exeddjdp.exellllfxx.exenhhhhh.exevjpjd.exe3pvvj.exerlxffff.exefrlrxxr.exethbbhh.exejdvjv.exeflllfff.exejjjpp.exedpvvd.exexlrlffx.exebntthh.exennbbbb.exeddjjd.exevpdvp.exe7xfxrrf.exebtnnhh.exehbhhtt.exeddjjp.exe1lllrxx.exe1rfxxxx.exebbtbbh.exepdjdv.exerfxfffx.exefxrrllr.exetntnhb.exeddvpp.exedjvpj.exelxffxxf.exe7bbnht.exenbttht.exejjvvd.exejjppp.exexrxrrxx.exehtttnh.exepjdvj.exe1jvpd.exelxffxxx.exe5fflfxf.exehbbtnn.exepid process 4888 thhbbb.exe 2056 vvppj.exe 2588 1llllll.exe 4244 7xxrllf.exe 448 llffllr.exe 3620 flrrrxx.exe 868 bhttnt.exe 4872 djjdv.exe 5068 nhnhhh.exe 4360 jpddv.exe 4740 flrrllf.exe 536 nbnnnn.exe 3260 vjvvp.exe 4844 5pjjd.exe 2364 nhnhbt.exe 1676 5pjdv.exe 4432 flxrllf.exe 3772 vjvvv.exe 368 hnhntt.exe 4864 1djjv.exe 2488 xffxrrl.exe 768 hhhbbb.exe 3768 ddjdp.exe 3360 llllfxx.exe 3132 nhhhhh.exe 4680 vjpjd.exe 4968 3pvvj.exe 2272 rlxffff.exe 3636 frlrxxr.exe 1624 thbbhh.exe 4208 jdvjv.exe 1396 flllfff.exe 2244 jjjpp.exe 888 dpvvd.exe 3088 xlrlffx.exe 956 bntthh.exe 228 nnbbbb.exe 4276 ddjjd.exe 3560 vpdvp.exe 4124 7xfxrrf.exe 3732 btnnhh.exe 3812 hbhhtt.exe 2624 ddjjp.exe 3928 1lllrxx.exe 3960 1rfxxxx.exe 2064 bbtbbh.exe 4052 pdjdv.exe 3572 rfxfffx.exe 5068 fxrrllr.exe 3288 tntnhb.exe 4016 ddvpp.exe 2800 djvpj.exe 3260 lxffxxf.exe 1708 7bbnht.exe 3728 nbttht.exe 3712 jjvvd.exe 2252 jjppp.exe 3692 xrxrrxx.exe 4988 htttnh.exe 1572 pjdvj.exe 3404 1jvpd.exe 1184 lxffxxx.exe 3844 5fflfxf.exe 1064 hbbtnn.exe -
Processes:
resource yara_rule behavioral2/memory/2452-0-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\thhbbb.exe upx behavioral2/memory/2452-6-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4888-8-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2056-14-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\1llllll.exe upx behavioral2/memory/2588-20-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\vvppj.exe upx \??\c:\7xxrllf.exe upx behavioral2/memory/4244-25-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4244-30-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\llffllr.exe upx \??\c:\flrrrxx.exe upx behavioral2/memory/3620-38-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\bhttnt.exe upx C:\djjdv.exe upx behavioral2/memory/868-47-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4872-49-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4872-54-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\nhnhhh.exe upx C:\jpddv.exe upx behavioral2/memory/5068-59-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4360-62-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\flrrllf.exe upx C:\nbnnnn.exe upx behavioral2/memory/536-73-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\vjvvp.exe upx behavioral2/memory/3260-79-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\5pjjd.exe upx behavioral2/memory/4844-84-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\nhnhbt.exe upx behavioral2/memory/2364-94-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\5pjdv.exe upx C:\flxrllf.exe upx behavioral2/memory/4432-102-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1676-100-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\vjvvv.exe upx behavioral2/memory/4432-108-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3772-109-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\hnhntt.exe upx behavioral2/memory/368-116-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\1djjv.exe upx C:\xffxrrl.exe upx C:\hhhbbb.exe upx behavioral2/memory/2488-131-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\ddjdp.exe upx behavioral2/memory/3768-137-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\llllfxx.exe upx behavioral2/memory/3360-146-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\nhhhhh.exe upx behavioral2/memory/3132-150-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\vjpjd.exe upx C:\rlxffff.exe upx \??\c:\3pvvj.exe upx behavioral2/memory/2272-166-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\frlrxxr.exe upx C:\thbbhh.exe upx behavioral2/memory/3636-175-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\jdvjv.exe upx behavioral2/memory/1624-181-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\flllfff.exe upx behavioral2/memory/1396-191-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2244-193-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/956-203-0x0000000000400000-0x0000000000437000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1141c3c682e58cad2dca9ec2a652e408dde4ea33470b8c3ec06b7b08470ef4b2.exethhbbb.exevvppj.exe1llllll.exe7xxrllf.exellffllr.exeflrrrxx.exebhttnt.exedjjdv.exenhnhhh.exejpddv.exeflrrllf.exenbnnnn.exevjvvp.exe5pjjd.exenhnhbt.exe5pjdv.exeflxrllf.exevjvvv.exehnhntt.exe1djjv.exexffxrrl.exedescription pid process target process PID 2452 wrote to memory of 4888 2452 1141c3c682e58cad2dca9ec2a652e408dde4ea33470b8c3ec06b7b08470ef4b2.exe thhbbb.exe PID 2452 wrote to memory of 4888 2452 1141c3c682e58cad2dca9ec2a652e408dde4ea33470b8c3ec06b7b08470ef4b2.exe thhbbb.exe PID 2452 wrote to memory of 4888 2452 1141c3c682e58cad2dca9ec2a652e408dde4ea33470b8c3ec06b7b08470ef4b2.exe thhbbb.exe PID 4888 wrote to memory of 2056 4888 thhbbb.exe vvppj.exe PID 4888 wrote to memory of 2056 4888 thhbbb.exe vvppj.exe PID 4888 wrote to memory of 2056 4888 thhbbb.exe vvppj.exe PID 2056 wrote to memory of 2588 2056 vvppj.exe 1llllll.exe PID 2056 wrote to memory of 2588 2056 vvppj.exe 1llllll.exe PID 2056 wrote to memory of 2588 2056 vvppj.exe 1llllll.exe PID 2588 wrote to memory of 4244 2588 1llllll.exe 7xxrllf.exe PID 2588 wrote to memory of 4244 2588 1llllll.exe 7xxrllf.exe PID 2588 wrote to memory of 4244 2588 1llllll.exe 7xxrllf.exe PID 4244 wrote to memory of 448 4244 7xxrllf.exe llffllr.exe PID 4244 wrote to memory of 448 4244 7xxrllf.exe llffllr.exe PID 4244 wrote to memory of 448 4244 7xxrllf.exe llffllr.exe PID 448 wrote to memory of 3620 448 llffllr.exe flrrrxx.exe PID 448 wrote to memory of 3620 448 llffllr.exe flrrrxx.exe PID 448 wrote to memory of 3620 448 llffllr.exe flrrrxx.exe PID 3620 wrote to memory of 868 3620 flrrrxx.exe bhttnt.exe PID 3620 wrote to memory of 868 3620 flrrrxx.exe bhttnt.exe PID 3620 wrote to memory of 868 3620 flrrrxx.exe bhttnt.exe PID 868 wrote to memory of 4872 868 bhttnt.exe djjdv.exe PID 868 wrote to memory of 4872 868 bhttnt.exe djjdv.exe PID 868 wrote to memory of 4872 868 bhttnt.exe djjdv.exe PID 4872 wrote to memory of 5068 4872 djjdv.exe nhnhhh.exe PID 4872 wrote to memory of 5068 4872 djjdv.exe nhnhhh.exe PID 4872 wrote to memory of 5068 4872 djjdv.exe nhnhhh.exe PID 5068 wrote to memory of 4360 5068 nhnhhh.exe jpddv.exe PID 5068 wrote to memory of 4360 5068 nhnhhh.exe jpddv.exe PID 5068 wrote to memory of 4360 5068 nhnhhh.exe jpddv.exe PID 4360 wrote to memory of 4740 4360 jpddv.exe flrrllf.exe PID 4360 wrote to memory of 4740 4360 jpddv.exe flrrllf.exe PID 4360 wrote to memory of 4740 4360 jpddv.exe flrrllf.exe PID 4740 wrote to memory of 536 4740 flrrllf.exe nbnnnn.exe PID 4740 wrote to memory of 536 4740 flrrllf.exe nbnnnn.exe PID 4740 wrote to memory of 536 4740 flrrllf.exe nbnnnn.exe PID 536 wrote to memory of 3260 536 nbnnnn.exe vjvvp.exe PID 536 wrote to memory of 3260 536 nbnnnn.exe vjvvp.exe PID 536 wrote to memory of 3260 536 nbnnnn.exe vjvvp.exe PID 3260 wrote to memory of 4844 3260 vjvvp.exe 5pjjd.exe PID 3260 wrote to memory of 4844 3260 vjvvp.exe 5pjjd.exe PID 3260 wrote to memory of 4844 3260 vjvvp.exe 5pjjd.exe PID 4844 wrote to memory of 2364 4844 5pjjd.exe nhnhbt.exe PID 4844 wrote to memory of 2364 4844 5pjjd.exe nhnhbt.exe PID 4844 wrote to memory of 2364 4844 5pjjd.exe nhnhbt.exe PID 2364 wrote to memory of 1676 2364 nhnhbt.exe 5pjdv.exe PID 2364 wrote to memory of 1676 2364 nhnhbt.exe 5pjdv.exe PID 2364 wrote to memory of 1676 2364 nhnhbt.exe 5pjdv.exe PID 1676 wrote to memory of 4432 1676 5pjdv.exe flxrllf.exe PID 1676 wrote to memory of 4432 1676 5pjdv.exe flxrllf.exe PID 1676 wrote to memory of 4432 1676 5pjdv.exe flxrllf.exe PID 4432 wrote to memory of 3772 4432 flxrllf.exe vjvvv.exe PID 4432 wrote to memory of 3772 4432 flxrllf.exe vjvvv.exe PID 4432 wrote to memory of 3772 4432 flxrllf.exe vjvvv.exe PID 3772 wrote to memory of 368 3772 vjvvv.exe hnhntt.exe PID 3772 wrote to memory of 368 3772 vjvvv.exe hnhntt.exe PID 3772 wrote to memory of 368 3772 vjvvv.exe hnhntt.exe PID 368 wrote to memory of 4864 368 hnhntt.exe 1djjv.exe PID 368 wrote to memory of 4864 368 hnhntt.exe 1djjv.exe PID 368 wrote to memory of 4864 368 hnhntt.exe 1djjv.exe PID 4864 wrote to memory of 2488 4864 1djjv.exe xffxrrl.exe PID 4864 wrote to memory of 2488 4864 1djjv.exe xffxrrl.exe PID 4864 wrote to memory of 2488 4864 1djjv.exe xffxrrl.exe PID 2488 wrote to memory of 768 2488 xffxrrl.exe hhhbbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1141c3c682e58cad2dca9ec2a652e408dde4ea33470b8c3ec06b7b08470ef4b2.exe"C:\Users\Admin\AppData\Local\Temp\1141c3c682e58cad2dca9ec2a652e408dde4ea33470b8c3ec06b7b08470ef4b2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\thhbbb.exec:\thhbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\vvppj.exec:\vvppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\1llllll.exec:\1llllll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\7xxrllf.exec:\7xxrllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\llffllr.exec:\llffllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\flrrrxx.exec:\flrrrxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\bhttnt.exec:\bhttnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\djjdv.exec:\djjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\nhnhhh.exec:\nhnhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\jpddv.exec:\jpddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\flrrllf.exec:\flrrllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\nbnnnn.exec:\nbnnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\vjvvp.exec:\vjvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\5pjjd.exec:\5pjjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\nhnhbt.exec:\nhnhbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\5pjdv.exec:\5pjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\flxrllf.exec:\flxrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\vjvvv.exec:\vjvvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\hnhntt.exec:\hnhntt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\1djjv.exec:\1djjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\xffxrrl.exec:\xffxrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\hhhbbb.exec:\hhhbbb.exe23⤵
- Executes dropped EXE
PID:768 -
\??\c:\ddjdp.exec:\ddjdp.exe24⤵
- Executes dropped EXE
PID:3768 -
\??\c:\llllfxx.exec:\llllfxx.exe25⤵
- Executes dropped EXE
PID:3360 -
\??\c:\nhhhhh.exec:\nhhhhh.exe26⤵
- Executes dropped EXE
PID:3132 -
\??\c:\vjpjd.exec:\vjpjd.exe27⤵
- Executes dropped EXE
PID:4680 -
\??\c:\3pvvj.exec:\3pvvj.exe28⤵
- Executes dropped EXE
PID:4968 -
\??\c:\rlxffff.exec:\rlxffff.exe29⤵
- Executes dropped EXE
PID:2272 -
\??\c:\frlrxxr.exec:\frlrxxr.exe30⤵
- Executes dropped EXE
PID:3636 -
\??\c:\thbbhh.exec:\thbbhh.exe31⤵
- Executes dropped EXE
PID:1624 -
\??\c:\jdvjv.exec:\jdvjv.exe32⤵
- Executes dropped EXE
PID:4208 -
\??\c:\flllfff.exec:\flllfff.exe33⤵
- Executes dropped EXE
PID:1396 -
\??\c:\jjjpp.exec:\jjjpp.exe34⤵
- Executes dropped EXE
PID:2244 -
\??\c:\dpvvd.exec:\dpvvd.exe35⤵
- Executes dropped EXE
PID:888 -
\??\c:\xlrlffx.exec:\xlrlffx.exe36⤵
- Executes dropped EXE
PID:3088 -
\??\c:\bntthh.exec:\bntthh.exe37⤵
- Executes dropped EXE
PID:956 -
\??\c:\nnbbbb.exec:\nnbbbb.exe38⤵
- Executes dropped EXE
PID:228 -
\??\c:\ddjjd.exec:\ddjjd.exe39⤵
- Executes dropped EXE
PID:4276 -
\??\c:\vpdvp.exec:\vpdvp.exe40⤵
- Executes dropped EXE
PID:3560 -
\??\c:\7xfxrrf.exec:\7xfxrrf.exe41⤵
- Executes dropped EXE
PID:4124 -
\??\c:\btnnhh.exec:\btnnhh.exe42⤵
- Executes dropped EXE
PID:3732 -
\??\c:\hbhhtt.exec:\hbhhtt.exe43⤵
- Executes dropped EXE
PID:3812 -
\??\c:\ddjjp.exec:\ddjjp.exe44⤵
- Executes dropped EXE
PID:2624 -
\??\c:\1lllrxx.exec:\1lllrxx.exe45⤵
- Executes dropped EXE
PID:3928 -
\??\c:\1rfxxxx.exec:\1rfxxxx.exe46⤵
- Executes dropped EXE
PID:3960 -
\??\c:\bbtbbh.exec:\bbtbbh.exe47⤵
- Executes dropped EXE
PID:2064 -
\??\c:\pdjdv.exec:\pdjdv.exe48⤵
- Executes dropped EXE
PID:4052 -
\??\c:\rfxfffx.exec:\rfxfffx.exe49⤵
- Executes dropped EXE
PID:3572 -
\??\c:\fxrrllr.exec:\fxrrllr.exe50⤵
- Executes dropped EXE
PID:5068 -
\??\c:\tntnhb.exec:\tntnhb.exe51⤵
- Executes dropped EXE
PID:3288 -
\??\c:\ddvpp.exec:\ddvpp.exe52⤵
- Executes dropped EXE
PID:4016 -
\??\c:\djvpj.exec:\djvpj.exe53⤵
- Executes dropped EXE
PID:2800 -
\??\c:\lxffxxf.exec:\lxffxxf.exe54⤵
- Executes dropped EXE
PID:3260 -
\??\c:\7bbnht.exec:\7bbnht.exe55⤵
- Executes dropped EXE
PID:1708 -
\??\c:\nbttht.exec:\nbttht.exe56⤵
- Executes dropped EXE
PID:3728 -
\??\c:\jjvvd.exec:\jjvvd.exe57⤵
- Executes dropped EXE
PID:3712 -
\??\c:\jjppp.exec:\jjppp.exe58⤵
- Executes dropped EXE
PID:2252 -
\??\c:\xrxrrxx.exec:\xrxrrxx.exe59⤵
- Executes dropped EXE
PID:3692 -
\??\c:\htttnh.exec:\htttnh.exe60⤵
- Executes dropped EXE
PID:4988 -
\??\c:\pjdvj.exec:\pjdvj.exe61⤵
- Executes dropped EXE
PID:1572 -
\??\c:\1jvpd.exec:\1jvpd.exe62⤵
- Executes dropped EXE
PID:3404 -
\??\c:\lxffxxx.exec:\lxffxxx.exe63⤵
- Executes dropped EXE
PID:1184 -
\??\c:\5fflfxf.exec:\5fflfxf.exe64⤵
- Executes dropped EXE
PID:3844 -
\??\c:\hbbtnn.exec:\hbbtnn.exe65⤵
- Executes dropped EXE
PID:1064 -
\??\c:\djjdd.exec:\djjdd.exe66⤵PID:864
-
\??\c:\pdvdj.exec:\pdvdj.exe67⤵PID:1404
-
\??\c:\lfxxrxx.exec:\lfxxrxx.exe68⤵PID:1604
-
\??\c:\9tnnhn.exec:\9tnnhn.exe69⤵PID:3908
-
\??\c:\nntnbb.exec:\nntnbb.exe70⤵PID:4948
-
\??\c:\vdjdp.exec:\vdjdp.exe71⤵PID:3956
-
\??\c:\llxxxxf.exec:\llxxxxf.exe72⤵PID:3888
-
\??\c:\ttbnhb.exec:\ttbnhb.exe73⤵PID:4596
-
\??\c:\djjdj.exec:\djjdj.exe74⤵PID:4484
-
\??\c:\7pjdv.exec:\7pjdv.exe75⤵PID:1628
-
\??\c:\7rxffrl.exec:\7rxffrl.exe76⤵PID:1996
-
\??\c:\1btttn.exec:\1btttn.exe77⤵PID:3636
-
\??\c:\httthh.exec:\httthh.exe78⤵PID:4660
-
\??\c:\5vjdv.exec:\5vjdv.exe79⤵PID:1624
-
\??\c:\xfrllll.exec:\xfrllll.exe80⤵PID:3600
-
\??\c:\9ttnbb.exec:\9ttnbb.exe81⤵PID:4980
-
\??\c:\nthbnn.exec:\nthbnn.exe82⤵PID:4296
-
\??\c:\vpdvp.exec:\vpdvp.exe83⤵PID:1436
-
\??\c:\rlfxxxx.exec:\rlfxxxx.exe84⤵PID:4796
-
\??\c:\fxrffff.exec:\fxrffff.exe85⤵PID:4488
-
\??\c:\7nhhbb.exec:\7nhhbb.exe86⤵PID:212
-
\??\c:\7jppp.exec:\7jppp.exe87⤵PID:1504
-
\??\c:\9dddp.exec:\9dddp.exe88⤵PID:3008
-
\??\c:\tttthh.exec:\tttthh.exe89⤵PID:2428
-
\??\c:\ttntbh.exec:\ttntbh.exe90⤵PID:2512
-
\??\c:\jvddv.exec:\jvddv.exe91⤵PID:4264
-
\??\c:\dpvvp.exec:\dpvvp.exe92⤵PID:448
-
\??\c:\3flrrrr.exec:\3flrrrr.exe93⤵PID:3928
-
\??\c:\rrxlllr.exec:\rrxlllr.exe94⤵PID:3960
-
\??\c:\bbhnhh.exec:\bbhnhh.exe95⤵PID:2064
-
\??\c:\jpdjp.exec:\jpdjp.exe96⤵PID:1952
-
\??\c:\rlxlllx.exec:\rlxlllx.exe97⤵PID:4768
-
\??\c:\3fxrrll.exec:\3fxrrll.exe98⤵PID:3368
-
\??\c:\7httnh.exec:\7httnh.exe99⤵PID:4392
-
\??\c:\tbnbtn.exec:\tbnbtn.exe100⤵PID:3332
-
\??\c:\dvvvp.exec:\dvvvp.exe101⤵PID:456
-
\??\c:\xrlllrr.exec:\xrlllrr.exe102⤵PID:1612
-
\??\c:\5rxffll.exec:\5rxffll.exe103⤵PID:5056
-
\??\c:\hnnhnh.exec:\hnnhnh.exe104⤵PID:1400
-
\??\c:\pdjjj.exec:\pdjjj.exe105⤵PID:4308
-
\??\c:\llllfff.exec:\llllfff.exe106⤵PID:4136
-
\??\c:\frrlrrx.exec:\frrlrrx.exe107⤵PID:2396
-
\??\c:\btbbtt.exec:\btbbtt.exe108⤵PID:2444
-
\??\c:\tbtttt.exec:\tbtttt.exe109⤵PID:1188
-
\??\c:\pjjdj.exec:\pjjdj.exe110⤵PID:3940
-
\??\c:\vjpjd.exec:\vjpjd.exe111⤵PID:1976
-
\??\c:\fllllll.exec:\fllllll.exe112⤵PID:3404
-
\??\c:\5bhhnn.exec:\5bhhnn.exe113⤵PID:4880
-
\??\c:\ppjdv.exec:\ppjdv.exe114⤵PID:3844
-
\??\c:\dppjj.exec:\dppjj.exe115⤵PID:3120
-
\??\c:\xxrrfxx.exec:\xxrrfxx.exe116⤵PID:3284
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe117⤵PID:3396
-
\??\c:\ntnbnb.exec:\ntnbnb.exe118⤵PID:3196
-
\??\c:\ddddv.exec:\ddddv.exe119⤵PID:2356
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe120⤵PID:5036
-
\??\c:\xxllxxl.exec:\xxllxxl.exe121⤵PID:4948
-
\??\c:\thnhbh.exec:\thnhbh.exe122⤵PID:384
-
\??\c:\pvdvv.exec:\pvdvv.exe123⤵PID:3888
-
\??\c:\dpdvp.exec:\dpdvp.exe124⤵PID:4932
-
\??\c:\5llfflf.exec:\5llfflf.exe125⤵PID:3356
-
\??\c:\9xxrlll.exec:\9xxrlll.exe126⤵PID:644
-
\??\c:\thtbbh.exec:\thtbbh.exe127⤵PID:2836
-
\??\c:\hbhnnn.exec:\hbhnnn.exe128⤵PID:3904
-
\??\c:\5ddvj.exec:\5ddvj.exe129⤵PID:1588
-
\??\c:\jddpj.exec:\jddpj.exe130⤵PID:3716
-
\??\c:\lxxfrfx.exec:\lxxfrfx.exe131⤵PID:4412
-
\??\c:\9bhhtb.exec:\9bhhtb.exe132⤵PID:816
-
\??\c:\hbnnnn.exec:\hbnnnn.exe133⤵PID:888
-
\??\c:\dddvj.exec:\dddvj.exe134⤵PID:740
-
\??\c:\rrxlrrf.exec:\rrxlrrf.exe135⤵PID:956
-
\??\c:\lflffrx.exec:\lflffrx.exe136⤵PID:228
-
\??\c:\bnnnhn.exec:\bnnnhn.exe137⤵PID:3752
-
\??\c:\hnhbbb.exec:\hnhbbb.exe138⤵PID:2732
-
\??\c:\1jjdd.exec:\1jjdd.exe139⤵PID:2568
-
\??\c:\jdjdv.exec:\jdjdv.exe140⤵PID:4564
-
\??\c:\lllfxff.exec:\lllfxff.exe141⤵PID:3000
-
\??\c:\1rxxrrr.exec:\1rxxrrr.exe142⤵PID:3748
-
\??\c:\thnhbb.exec:\thnhbb.exe143⤵PID:1420
-
\??\c:\jpvvv.exec:\jpvvv.exe144⤵PID:3928
-
\??\c:\jvppp.exec:\jvppp.exe145⤵PID:3960
-
\??\c:\xxllrrr.exec:\xxllrrr.exe146⤵PID:4180
-
\??\c:\xrlffff.exec:\xrlffff.exe147⤵PID:1952
-
\??\c:\tnnnhh.exec:\tnnnhh.exe148⤵PID:4776
-
\??\c:\dvvpp.exec:\dvvpp.exe149⤵PID:4336
-
\??\c:\jddvj.exec:\jddvj.exe150⤵PID:2072
-
\??\c:\rllflfl.exec:\rllflfl.exe151⤵PID:4408
-
\??\c:\9btthh.exec:\9btthh.exe152⤵PID:5028
-
\??\c:\hhhbbh.exec:\hhhbbh.exe153⤵PID:2564
-
\??\c:\jjvvp.exec:\jjvvp.exe154⤵PID:5056
-
\??\c:\5vppj.exec:\5vppj.exe155⤵PID:1400
-
\??\c:\rlxrxxx.exec:\rlxrxxx.exe156⤵PID:3616
-
\??\c:\tntttt.exec:\tntttt.exe157⤵PID:4260
-
\??\c:\bnbttb.exec:\bnbttb.exe158⤵PID:5088
-
\??\c:\vjvvv.exec:\vjvvv.exe159⤵PID:836
-
\??\c:\dvdvd.exec:\dvdvd.exe160⤵PID:3216
-
\??\c:\1rllffx.exec:\1rllffx.exe161⤵PID:2756
-
\??\c:\7nttbb.exec:\7nttbb.exe162⤵PID:1560
-
\??\c:\jddpj.exec:\jddpj.exe163⤵PID:1944
-
\??\c:\3jjjj.exec:\3jjjj.exe164⤵PID:3016
-
\??\c:\fxrffrf.exec:\fxrffrf.exe165⤵PID:1080
-
\??\c:\ffffxxr.exec:\ffffxxr.exe166⤵PID:2248
-
\??\c:\nnnhbb.exec:\nnnhbb.exe167⤵PID:3544
-
\??\c:\ppvvv.exec:\ppvvv.exe168⤵PID:1604
-
\??\c:\vpdvv.exec:\vpdvv.exe169⤵PID:2000
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe170⤵PID:2740
-
\??\c:\rllrxxx.exec:\rllrxxx.exe171⤵PID:4968
-
\??\c:\dpppp.exec:\dpppp.exe172⤵PID:4024
-
\??\c:\flxxxxx.exec:\flxxxxx.exe173⤵PID:2500
-
\??\c:\tnnnbb.exec:\tnnnbb.exe174⤵PID:1900
-
\??\c:\jdjdd.exec:\jdjdd.exe175⤵PID:1628
-
\??\c:\pvpdp.exec:\pvpdp.exe176⤵PID:1996
-
\??\c:\rxfxxxr.exec:\rxfxxxr.exe177⤵PID:3636
-
\??\c:\rflfffx.exec:\rflfffx.exe178⤵PID:4328
-
\??\c:\7httbh.exec:\7httbh.exe179⤵PID:1588
-
\??\c:\hnthhh.exec:\hnthhh.exe180⤵PID:2028
-
\??\c:\7jjdd.exec:\7jjdd.exe181⤵PID:948
-
\??\c:\rxxxxll.exec:\rxxxxll.exe182⤵PID:2604
-
\??\c:\nhbtnn.exec:\nhbtnn.exe183⤵PID:2448
-
\??\c:\jdddv.exec:\jdddv.exe184⤵PID:116
-
\??\c:\vpjdj.exec:\vpjdj.exe185⤵PID:2412
-
\??\c:\lrxxrxr.exec:\lrxxrxr.exe186⤵PID:3584
-
\??\c:\btnnnn.exec:\btnnnn.exe187⤵PID:3152
-
\??\c:\bbbttb.exec:\bbbttb.exe188⤵PID:3968
-
\??\c:\vpvvj.exec:\vpvvj.exe189⤵PID:2732
-
\??\c:\vpppp.exec:\vpppp.exe190⤵PID:4604
-
\??\c:\llrlxxx.exec:\llrlxxx.exe191⤵PID:2240
-
\??\c:\1lrxxxf.exec:\1lrxxxf.exe192⤵PID:1872
-
\??\c:\tttbht.exec:\tttbht.exe193⤵PID:5072
-
\??\c:\jdppv.exec:\jdppv.exe194⤵PID:4628
-
\??\c:\jvjjj.exec:\jvjjj.exe195⤵PID:2064
-
\??\c:\xrlllrr.exec:\xrlllrr.exe196⤵PID:2516
-
\??\c:\1jdvv.exec:\1jdvv.exe197⤵PID:4284
-
\??\c:\xxlfxxf.exec:\xxlfxxf.exe198⤵PID:4740
-
\??\c:\7lllxlx.exec:\7lllxlx.exe199⤵PID:4364
-
\??\c:\hhnbhn.exec:\hhnbhn.exe200⤵PID:4552
-
\??\c:\nnbtnt.exec:\nnbtnt.exe201⤵PID:1640
-
\??\c:\dppjv.exec:\dppjv.exe202⤵PID:2116
-
\??\c:\dvjvd.exec:\dvjvd.exe203⤵PID:4532
-
\??\c:\lxflxrl.exec:\lxflxrl.exe204⤵PID:4400
-
\??\c:\lllllll.exec:\lllllll.exe205⤵PID:3616
-
\??\c:\nhbtnn.exec:\nhbtnn.exe206⤵PID:2396
-
\??\c:\vjvpj.exec:\vjvpj.exe207⤵PID:4468
-
\??\c:\1jjdp.exec:\1jjdp.exe208⤵PID:1992
-
\??\c:\vdppv.exec:\vdppv.exe209⤵PID:1560
-
\??\c:\lffxxxl.exec:\lffxxxl.exe210⤵PID:4880
-
\??\c:\9rrlxxl.exec:\9rrlxxl.exe211⤵PID:1080
-
\??\c:\3bhthb.exec:\3bhthb.exe212⤵PID:2248
-
\??\c:\3djdj.exec:\3djdj.exe213⤵PID:800
-
\??\c:\djjjd.exec:\djjjd.exe214⤵PID:1604
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe215⤵PID:1252
-
\??\c:\fxlfxxl.exec:\fxlfxxl.exe216⤵PID:4944
-
\??\c:\7ntnhb.exec:\7ntnhb.exe217⤵PID:4884
-
\??\c:\vpvdd.exec:\vpvdd.exe218⤵PID:3792
-
\??\c:\5llxlff.exec:\5llxlff.exe219⤵PID:3972
-
\??\c:\frrlxxr.exec:\frrlxxr.exe220⤵PID:4080
-
\??\c:\3btnhh.exec:\3btnhh.exe221⤵PID:1996
-
\??\c:\9vpjv.exec:\9vpjv.exe222⤵PID:2524
-
\??\c:\dvppd.exec:\dvppd.exe223⤵PID:4328
-
\??\c:\rrrrfff.exec:\rrrrfff.exe224⤵PID:4636
-
\??\c:\3ttnbt.exec:\3ttnbt.exe225⤵PID:944
-
\??\c:\vpppp.exec:\vpppp.exe226⤵PID:4824
-
\??\c:\9jvjd.exec:\9jvjd.exe227⤵PID:1296
-
\??\c:\lfllxxx.exec:\lfllxxx.exe228⤵PID:2420
-
\??\c:\5nnhhh.exec:\5nnhhh.exe229⤵PID:3164
-
\??\c:\htnnnn.exec:\htnnnn.exe230⤵PID:3092
-
\??\c:\ddvvv.exec:\ddvvv.exe231⤵PID:3008
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe232⤵PID:4232
-
\??\c:\frxrrll.exec:\frxrrll.exe233⤵PID:4244
-
\??\c:\thtnhh.exec:\thtnhh.exe234⤵PID:4264
-
\??\c:\pjvpv.exec:\pjvpv.exe235⤵PID:3516
-
\??\c:\jdjdp.exec:\jdjdp.exe236⤵PID:2640
-
\??\c:\flrllfx.exec:\flrllfx.exe237⤵PID:1320
-
\??\c:\lxlffff.exec:\lxlffff.exe238⤵PID:2384
-
\??\c:\nthnbb.exec:\nthnbb.exe239⤵PID:4640
-
\??\c:\5vvpj.exec:\5vvpj.exe240⤵PID:1136
-
\??\c:\pdpjj.exec:\pdpjj.exe241⤵PID:548
-