Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 09:54
Behavioral task
behavioral1
Sample
edee31a45c2e8a8108efd0b8c1989e451dc922766653e3b56802cd8a7d4c2cfa.exe
Resource
win7-20240220-en
windows7-x64
6 signatures
150 seconds
General
-
Target
edee31a45c2e8a8108efd0b8c1989e451dc922766653e3b56802cd8a7d4c2cfa.exe
-
Size
365KB
-
MD5
8dc6421e5a7124835096a61c91146d58
-
SHA1
ad0946b6ad684de7bd4e26e7e2e52a099847a372
-
SHA256
edee31a45c2e8a8108efd0b8c1989e451dc922766653e3b56802cd8a7d4c2cfa
-
SHA512
e8985d3e369008a1c380bd557fb0161ac77edcab135bc18482172e91762ea3efd3b6a952f17696233ad5cb719ebac0bea70ed414682ce14c502b0222ddf27512
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwu1b26X1wjdgyPPB9:R4wFHoSHYHUrAwqzQ7PPj
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4676-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1312-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3300-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/764-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1020-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/632-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2516-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1380-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1856-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4844-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1236-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2492-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3676-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1624-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2064-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/988-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4808-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3852-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/768-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/920-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3480-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/944-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4092-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2540-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1304-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3668-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4800-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3372-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2616-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1628-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2780-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2420-564-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-607-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-644-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-719-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-750-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-761-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4676-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lxxfxxl.exe UPX behavioral2/memory/4676-4-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ddjjv.exe UPX C:\pjjdd.exe UPX behavioral2/memory/1312-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\5lxxrxl.exe UPX behavioral2/memory/3672-22-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\xffrxlf.exe UPX behavioral2/memory/3300-27-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/764-32-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\1dpjd.exe UPX behavioral2/memory/4148-36-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\btnhnh.exe UPX behavioral2/memory/1020-15-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/632-10-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\1lrlffx.exe UPX C:\ffxxxll.exe UPX behavioral2/memory/1204-42-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2516-47-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ttbtbt.exe UPX C:\nhnnhh.exe UPX behavioral2/memory/3604-54-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\dvjjp.exe UPX behavioral2/memory/1380-60-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2756-62-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xxfxxxl.exe UPX behavioral2/memory/1588-70-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\jvddv.exe UPX behavioral2/memory/1856-71-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\btbbbt.exe UPX behavioral2/memory/1856-75-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\fffxxxx.exe UPX C:\3bbttt.exe UPX C:\vvdvp.exe UPX behavioral2/memory/4396-89-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9tnhnt.exe UPX C:\vdjvp.exe UPX behavioral2/memory/4844-98-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tntnnh.exe UPX behavioral2/memory/1236-102-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tnnnhh.exe UPX behavioral2/memory/4644-107-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2492-109-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pjppj.exe UPX behavioral2/memory/5028-116-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hbhbbt.exe UPX \??\c:\9pvvv.exe UPX behavioral2/memory/3676-125-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1624-131-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xxxlffl.exe UPX \??\c:\flrlfxr.exe UPX behavioral2/memory/4224-124-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\fxxxrrr.exe UPX behavioral2/memory/2064-140-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nhnnnb.exe UPX C:\ppvvd.exe UPX C:\5lrllll.exe UPX behavioral2/memory/988-152-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jjjjp.exe UPX behavioral2/memory/5044-158-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4148-166-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4148-168-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4808-175-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
lxxfxxl.exeddjjv.exepjjdd.exe5lxxrxl.exexffrxlf.exebtnhnh.exe1dpjd.exe1lrlffx.exeffxxxll.exettbtbt.exenhnnhh.exedvjjp.exexxfxxxl.exejvddv.exebtbbbt.exefffxxxx.exe3bbttt.exevvdvp.exe9tnhnt.exevdjvp.exetntnnh.exetnnnhh.exepjppj.exehbhbbt.exe9pvvv.exeflrlfxr.exexxxlffl.exefxxxrrr.exenhnnnb.exeppvvd.exe5lrllll.exejjjjp.exeffxxlll.exelllllfl.exehbthbn.exeddddv.exepjjdd.exefrllfxx.exennttnb.exeppjjj.exe9rxrrfx.exetnhbtt.exejdppp.exeflrllxf.exexflfxxr.exentbtnn.exedjddp.exe5xfxrrl.exennttnn.exennttnt.exexlrlfff.exexrxxxrl.exe7vddv.exedvdvp.exexrrrrrl.exehhhhbb.exe5htntt.exejjppp.exe5rxxrrr.exebntnhn.exejddvp.exedpvvd.exefxlfxxr.exethhhbb.exepid process 632 lxxfxxl.exe 1312 ddjjv.exe 1020 pjjdd.exe 3672 5lxxrxl.exe 3300 xffrxlf.exe 764 btnhnh.exe 4148 1dpjd.exe 1204 1lrlffx.exe 2516 ffxxxll.exe 3604 ttbtbt.exe 1380 nhnnhh.exe 2756 dvjjp.exe 1588 xxfxxxl.exe 1856 jvddv.exe 5008 btbbbt.exe 5000 fffxxxx.exe 4396 3bbttt.exe 1996 vvdvp.exe 4844 9tnhnt.exe 1236 vdjvp.exe 4644 tntnnh.exe 2492 tnnnhh.exe 5028 pjppj.exe 4224 hbhbbt.exe 3676 9pvvv.exe 1624 flrlfxr.exe 2668 xxxlffl.exe 2064 fxxxrrr.exe 4344 nhnnnb.exe 5088 ppvvd.exe 988 5lrllll.exe 5044 jjjjp.exe 432 ffxxlll.exe 4536 lllllfl.exe 3868 hbthbn.exe 4148 ddddv.exe 1176 pjjdd.exe 4084 frllfxx.exe 4808 nnttnb.exe 2464 ppjjj.exe 4056 9rxrrfx.exe 2376 tnhbtt.exe 4492 jdppp.exe 4456 flrllxf.exe 444 xflfxxr.exe 1568 ntbtnn.exe 2388 djddp.exe 5008 5xfxrrl.exe 1504 nnttnn.exe 4396 nnttnt.exe 2168 xlrlfff.exe 2036 xrxxxrl.exe 3852 7vddv.exe 452 dvdvp.exe 3952 xrrrrrl.exe 768 hhhhbb.exe 3536 5htntt.exe 920 jjppp.exe 2400 5rxxrrr.exe 912 bntnhn.exe 1532 jddvp.exe 3480 dpvvd.exe 3240 fxlfxxr.exe 4356 thhhbb.exe -
Processes:
resource yara_rule behavioral2/memory/4676-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxxfxxl.exe upx behavioral2/memory/4676-4-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddjjv.exe upx C:\pjjdd.exe upx behavioral2/memory/1312-17-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5lxxrxl.exe upx behavioral2/memory/3672-22-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xffrxlf.exe upx behavioral2/memory/3300-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/764-32-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1dpjd.exe upx behavioral2/memory/4148-36-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\btnhnh.exe upx behavioral2/memory/1020-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/632-10-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1lrlffx.exe upx C:\ffxxxll.exe upx behavioral2/memory/1204-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2516-47-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttbtbt.exe upx C:\nhnnhh.exe upx behavioral2/memory/3604-54-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvjjp.exe upx behavioral2/memory/1380-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2756-62-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxfxxxl.exe upx behavioral2/memory/1588-70-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jvddv.exe upx behavioral2/memory/1856-71-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btbbbt.exe upx behavioral2/memory/1856-75-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fffxxxx.exe upx C:\3bbttt.exe upx C:\vvdvp.exe upx behavioral2/memory/4396-89-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9tnhnt.exe upx C:\vdjvp.exe upx behavioral2/memory/4844-98-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tntnnh.exe upx behavioral2/memory/1236-102-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnnnhh.exe upx behavioral2/memory/4644-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2492-109-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjppj.exe upx behavioral2/memory/5028-116-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbhbbt.exe upx \??\c:\9pvvv.exe upx behavioral2/memory/3676-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1624-131-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxxlffl.exe upx \??\c:\flrlfxr.exe upx behavioral2/memory/4224-124-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxxxrrr.exe upx behavioral2/memory/2064-140-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhnnnb.exe upx C:\ppvvd.exe upx C:\5lrllll.exe upx behavioral2/memory/988-152-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjjjp.exe upx behavioral2/memory/5044-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4148-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4148-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4808-175-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
edee31a45c2e8a8108efd0b8c1989e451dc922766653e3b56802cd8a7d4c2cfa.exelxxfxxl.exeddjjv.exepjjdd.exe5lxxrxl.exexffrxlf.exebtnhnh.exe1dpjd.exe1lrlffx.exeffxxxll.exettbtbt.exenhnnhh.exedvjjp.exexxfxxxl.exejvddv.exebtbbbt.exefffxxxx.exe3bbttt.exevvdvp.exe9tnhnt.exevdjvp.exetntnnh.exedescription pid process target process PID 4676 wrote to memory of 632 4676 edee31a45c2e8a8108efd0b8c1989e451dc922766653e3b56802cd8a7d4c2cfa.exe lxxfxxl.exe PID 4676 wrote to memory of 632 4676 edee31a45c2e8a8108efd0b8c1989e451dc922766653e3b56802cd8a7d4c2cfa.exe lxxfxxl.exe PID 4676 wrote to memory of 632 4676 edee31a45c2e8a8108efd0b8c1989e451dc922766653e3b56802cd8a7d4c2cfa.exe lxxfxxl.exe PID 632 wrote to memory of 1312 632 lxxfxxl.exe ddjjv.exe PID 632 wrote to memory of 1312 632 lxxfxxl.exe ddjjv.exe PID 632 wrote to memory of 1312 632 lxxfxxl.exe ddjjv.exe PID 1312 wrote to memory of 1020 1312 ddjjv.exe pjjdd.exe PID 1312 wrote to memory of 1020 1312 ddjjv.exe pjjdd.exe PID 1312 wrote to memory of 1020 1312 ddjjv.exe pjjdd.exe PID 1020 wrote to memory of 3672 1020 pjjdd.exe 5lxxrxl.exe PID 1020 wrote to memory of 3672 1020 pjjdd.exe 5lxxrxl.exe PID 1020 wrote to memory of 3672 1020 pjjdd.exe 5lxxrxl.exe PID 3672 wrote to memory of 3300 3672 5lxxrxl.exe xffrxlf.exe PID 3672 wrote to memory of 3300 3672 5lxxrxl.exe xffrxlf.exe PID 3672 wrote to memory of 3300 3672 5lxxrxl.exe xffrxlf.exe PID 3300 wrote to memory of 764 3300 xffrxlf.exe btnhnh.exe PID 3300 wrote to memory of 764 3300 xffrxlf.exe btnhnh.exe PID 3300 wrote to memory of 764 3300 xffrxlf.exe btnhnh.exe PID 764 wrote to memory of 4148 764 btnhnh.exe 1dpjd.exe PID 764 wrote to memory of 4148 764 btnhnh.exe 1dpjd.exe PID 764 wrote to memory of 4148 764 btnhnh.exe 1dpjd.exe PID 4148 wrote to memory of 1204 4148 1dpjd.exe 1lrlffx.exe PID 4148 wrote to memory of 1204 4148 1dpjd.exe 1lrlffx.exe PID 4148 wrote to memory of 1204 4148 1dpjd.exe 1lrlffx.exe PID 1204 wrote to memory of 2516 1204 1lrlffx.exe ffxxxll.exe PID 1204 wrote to memory of 2516 1204 1lrlffx.exe ffxxxll.exe PID 1204 wrote to memory of 2516 1204 1lrlffx.exe ffxxxll.exe PID 2516 wrote to memory of 3604 2516 ffxxxll.exe ttbtbt.exe PID 2516 wrote to memory of 3604 2516 ffxxxll.exe ttbtbt.exe PID 2516 wrote to memory of 3604 2516 ffxxxll.exe ttbtbt.exe PID 3604 wrote to memory of 1380 3604 ttbtbt.exe nhnnhh.exe PID 3604 wrote to memory of 1380 3604 ttbtbt.exe nhnnhh.exe PID 3604 wrote to memory of 1380 3604 ttbtbt.exe nhnnhh.exe PID 1380 wrote to memory of 2756 1380 nhnnhh.exe dvjjp.exe PID 1380 wrote to memory of 2756 1380 nhnnhh.exe dvjjp.exe PID 1380 wrote to memory of 2756 1380 nhnnhh.exe dvjjp.exe PID 2756 wrote to memory of 1588 2756 dvjjp.exe xxfxxxl.exe PID 2756 wrote to memory of 1588 2756 dvjjp.exe xxfxxxl.exe PID 2756 wrote to memory of 1588 2756 dvjjp.exe xxfxxxl.exe PID 1588 wrote to memory of 1856 1588 xxfxxxl.exe jvddv.exe PID 1588 wrote to memory of 1856 1588 xxfxxxl.exe jvddv.exe PID 1588 wrote to memory of 1856 1588 xxfxxxl.exe jvddv.exe PID 1856 wrote to memory of 5008 1856 jvddv.exe btbbbt.exe PID 1856 wrote to memory of 5008 1856 jvddv.exe btbbbt.exe PID 1856 wrote to memory of 5008 1856 jvddv.exe btbbbt.exe PID 5008 wrote to memory of 5000 5008 btbbbt.exe fffxxxx.exe PID 5008 wrote to memory of 5000 5008 btbbbt.exe fffxxxx.exe PID 5008 wrote to memory of 5000 5008 btbbbt.exe fffxxxx.exe PID 5000 wrote to memory of 4396 5000 fffxxxx.exe 3bbttt.exe PID 5000 wrote to memory of 4396 5000 fffxxxx.exe 3bbttt.exe PID 5000 wrote to memory of 4396 5000 fffxxxx.exe 3bbttt.exe PID 4396 wrote to memory of 1996 4396 3bbttt.exe vvdvp.exe PID 4396 wrote to memory of 1996 4396 3bbttt.exe vvdvp.exe PID 4396 wrote to memory of 1996 4396 3bbttt.exe vvdvp.exe PID 1996 wrote to memory of 4844 1996 vvdvp.exe 9tnhnt.exe PID 1996 wrote to memory of 4844 1996 vvdvp.exe 9tnhnt.exe PID 1996 wrote to memory of 4844 1996 vvdvp.exe 9tnhnt.exe PID 4844 wrote to memory of 1236 4844 9tnhnt.exe vdjvp.exe PID 4844 wrote to memory of 1236 4844 9tnhnt.exe vdjvp.exe PID 4844 wrote to memory of 1236 4844 9tnhnt.exe vdjvp.exe PID 1236 wrote to memory of 4644 1236 vdjvp.exe tntnnh.exe PID 1236 wrote to memory of 4644 1236 vdjvp.exe tntnnh.exe PID 1236 wrote to memory of 4644 1236 vdjvp.exe tntnnh.exe PID 4644 wrote to memory of 2492 4644 tntnnh.exe tnnnhh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\edee31a45c2e8a8108efd0b8c1989e451dc922766653e3b56802cd8a7d4c2cfa.exe"C:\Users\Admin\AppData\Local\Temp\edee31a45c2e8a8108efd0b8c1989e451dc922766653e3b56802cd8a7d4c2cfa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\lxxfxxl.exec:\lxxfxxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\ddjjv.exec:\ddjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\pjjdd.exec:\pjjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\5lxxrxl.exec:\5lxxrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\xffrxlf.exec:\xffrxlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\btnhnh.exec:\btnhnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\1dpjd.exec:\1dpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\1lrlffx.exec:\1lrlffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\ffxxxll.exec:\ffxxxll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\ttbtbt.exec:\ttbtbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\nhnnhh.exec:\nhnnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\dvjjp.exec:\dvjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\xxfxxxl.exec:\xxfxxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\jvddv.exec:\jvddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\btbbbt.exec:\btbbbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\fffxxxx.exec:\fffxxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\3bbttt.exec:\3bbttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\vvdvp.exec:\vvdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\9tnhnt.exec:\9tnhnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\vdjvp.exec:\vdjvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\tntnnh.exec:\tntnnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\tnnnhh.exec:\tnnnhh.exe23⤵
- Executes dropped EXE
PID:2492 -
\??\c:\pjppj.exec:\pjppj.exe24⤵
- Executes dropped EXE
PID:5028 -
\??\c:\hbhbbt.exec:\hbhbbt.exe25⤵
- Executes dropped EXE
PID:4224 -
\??\c:\9pvvv.exec:\9pvvv.exe26⤵
- Executes dropped EXE
PID:3676 -
\??\c:\flrlfxr.exec:\flrlfxr.exe27⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xxxlffl.exec:\xxxlffl.exe28⤵
- Executes dropped EXE
PID:2668 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe29⤵
- Executes dropped EXE
PID:2064 -
\??\c:\nhnnnb.exec:\nhnnnb.exe30⤵
- Executes dropped EXE
PID:4344 -
\??\c:\ppvvd.exec:\ppvvd.exe31⤵
- Executes dropped EXE
PID:5088 -
\??\c:\5lrllll.exec:\5lrllll.exe32⤵
- Executes dropped EXE
PID:988 -
\??\c:\jjjjp.exec:\jjjjp.exe33⤵
- Executes dropped EXE
PID:5044 -
\??\c:\ffxxlll.exec:\ffxxlll.exe34⤵
- Executes dropped EXE
PID:432 -
\??\c:\lllllfl.exec:\lllllfl.exe35⤵
- Executes dropped EXE
PID:4536 -
\??\c:\hbthbn.exec:\hbthbn.exe36⤵
- Executes dropped EXE
PID:3868 -
\??\c:\ddddv.exec:\ddddv.exe37⤵
- Executes dropped EXE
PID:4148 -
\??\c:\pjjdd.exec:\pjjdd.exe38⤵
- Executes dropped EXE
PID:1176 -
\??\c:\frllfxx.exec:\frllfxx.exe39⤵
- Executes dropped EXE
PID:4084 -
\??\c:\nnttnb.exec:\nnttnb.exe40⤵
- Executes dropped EXE
PID:4808 -
\??\c:\ppjjj.exec:\ppjjj.exe41⤵
- Executes dropped EXE
PID:2464 -
\??\c:\9rxrrfx.exec:\9rxrrfx.exe42⤵
- Executes dropped EXE
PID:4056 -
\??\c:\tnhbtt.exec:\tnhbtt.exe43⤵
- Executes dropped EXE
PID:2376 -
\??\c:\jdppp.exec:\jdppp.exe44⤵
- Executes dropped EXE
PID:4492 -
\??\c:\flrllxf.exec:\flrllxf.exe45⤵
- Executes dropped EXE
PID:4456 -
\??\c:\xflfxxr.exec:\xflfxxr.exe46⤵
- Executes dropped EXE
PID:444 -
\??\c:\ntbtnn.exec:\ntbtnn.exe47⤵
- Executes dropped EXE
PID:1568 -
\??\c:\djddp.exec:\djddp.exe48⤵
- Executes dropped EXE
PID:2388 -
\??\c:\5xfxrrl.exec:\5xfxrrl.exe49⤵
- Executes dropped EXE
PID:5008 -
\??\c:\nnttnn.exec:\nnttnn.exe50⤵
- Executes dropped EXE
PID:1504 -
\??\c:\nnttnt.exec:\nnttnt.exe51⤵
- Executes dropped EXE
PID:4396 -
\??\c:\xlrlfff.exec:\xlrlfff.exe52⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xrxxxrl.exec:\xrxxxrl.exe53⤵
- Executes dropped EXE
PID:2036 -
\??\c:\7vddv.exec:\7vddv.exe54⤵
- Executes dropped EXE
PID:3852 -
\??\c:\dvdvp.exec:\dvdvp.exe55⤵
- Executes dropped EXE
PID:452 -
\??\c:\xrrrrrl.exec:\xrrrrrl.exe56⤵
- Executes dropped EXE
PID:3952 -
\??\c:\hhhhbb.exec:\hhhhbb.exe57⤵
- Executes dropped EXE
PID:768 -
\??\c:\5htntt.exec:\5htntt.exe58⤵
- Executes dropped EXE
PID:3536 -
\??\c:\jjppp.exec:\jjppp.exe59⤵
- Executes dropped EXE
PID:920 -
\??\c:\5rxxrrr.exec:\5rxxrrr.exe60⤵
- Executes dropped EXE
PID:2400 -
\??\c:\bntnhn.exec:\bntnhn.exe61⤵
- Executes dropped EXE
PID:912 -
\??\c:\jddvp.exec:\jddvp.exe62⤵
- Executes dropped EXE
PID:1532 -
\??\c:\dpvvd.exec:\dpvvd.exe63⤵
- Executes dropped EXE
PID:3480 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe64⤵
- Executes dropped EXE
PID:3240 -
\??\c:\thhhbb.exec:\thhhbb.exe65⤵
- Executes dropped EXE
PID:4356 -
\??\c:\nbbhhh.exec:\nbbhhh.exe66⤵PID:4460
-
\??\c:\vvvvv.exec:\vvvvv.exe67⤵PID:1384
-
\??\c:\rxxrlll.exec:\rxxrlll.exe68⤵PID:4344
-
\??\c:\htnthn.exec:\htnthn.exe69⤵PID:4828
-
\??\c:\dpppp.exec:\dpppp.exe70⤵PID:3672
-
\??\c:\frrlffx.exec:\frrlffx.exe71⤵PID:2188
-
\??\c:\rrrllll.exec:\rrrllll.exe72⤵PID:2644
-
\??\c:\thbtbt.exec:\thbtbt.exe73⤵PID:944
-
\??\c:\djddp.exec:\djddp.exe74⤵PID:3696
-
\??\c:\rllfrxr.exec:\rllfrxr.exe75⤵PID:3868
-
\??\c:\tbtnhh.exec:\tbtnhh.exe76⤵PID:4092
-
\??\c:\5pvjj.exec:\5pvjj.exe77⤵PID:2516
-
\??\c:\fxffrrr.exec:\fxffrrr.exe78⤵PID:1100
-
\??\c:\rxfxxxx.exec:\rxfxxxx.exe79⤵PID:1112
-
\??\c:\tnnhhh.exec:\tnnhhh.exe80⤵PID:3604
-
\??\c:\9ddvj.exec:\9ddvj.exe81⤵PID:532
-
\??\c:\dvpjj.exec:\dvpjj.exe82⤵PID:2376
-
\??\c:\xrrlfff.exec:\xrrlfff.exe83⤵PID:4492
-
\??\c:\hbbbbn.exec:\hbbbbn.exe84⤵PID:2788
-
\??\c:\nbhhtt.exec:\nbhhtt.exe85⤵PID:2540
-
\??\c:\vvddp.exec:\vvddp.exe86⤵PID:4548
-
\??\c:\5xlfrrr.exec:\5xlfrrr.exe87⤵PID:380
-
\??\c:\lflffxx.exec:\lflffxx.exe88⤵PID:1996
-
\??\c:\nnhhnn.exec:\nnhhnn.exe89⤵PID:5056
-
\??\c:\vppvv.exec:\vppvv.exe90⤵PID:4520
-
\??\c:\rlllfff.exec:\rlllfff.exe91⤵PID:1268
-
\??\c:\nhhhhh.exec:\nhhhhh.exe92⤵PID:2888
-
\??\c:\vpddv.exec:\vpddv.exe93⤵PID:4468
-
\??\c:\jvvpd.exec:\jvvpd.exe94⤵PID:2076
-
\??\c:\9flxxxr.exec:\9flxxxr.exe95⤵PID:768
-
\??\c:\hhbnnn.exec:\hhbnnn.exe96⤵PID:3548
-
\??\c:\pjjpj.exec:\pjjpj.exe97⤵PID:2492
-
\??\c:\7rlfrlf.exec:\7rlfrlf.exe98⤵PID:3216
-
\??\c:\1rrlfrl.exec:\1rrlfrl.exe99⤵PID:2020
-
\??\c:\nhtnnh.exec:\nhtnnh.exe100⤵PID:4564
-
\??\c:\vjpjj.exec:\vjpjj.exe101⤵PID:4108
-
\??\c:\ddjpj.exec:\ddjpj.exe102⤵PID:1304
-
\??\c:\lxffxfx.exec:\lxffxfx.exe103⤵PID:3240
-
\??\c:\hnttbb.exec:\hnttbb.exe104⤵PID:4356
-
\??\c:\btnttb.exec:\btnttb.exe105⤵PID:4460
-
\??\c:\5jvpd.exec:\5jvpd.exe106⤵PID:1384
-
\??\c:\rrxxxfl.exec:\rrxxxfl.exe107⤵PID:3668
-
\??\c:\lxxxrrf.exec:\lxxxrrf.exe108⤵PID:3664
-
\??\c:\nbtnnn.exec:\nbtnnn.exe109⤵PID:2840
-
\??\c:\ppvdd.exec:\ppvdd.exe110⤵PID:2188
-
\??\c:\7vvpp.exec:\7vvpp.exe111⤵PID:2644
-
\??\c:\fxffrll.exec:\fxffrll.exe112⤵PID:3688
-
\??\c:\nbnntt.exec:\nbnntt.exe113⤵PID:4700
-
\??\c:\pjjjv.exec:\pjjjv.exe114⤵PID:2812
-
\??\c:\jjppp.exec:\jjppp.exe115⤵PID:4800
-
\??\c:\5xrrrrl.exec:\5xrrrrl.exe116⤵PID:1408
-
\??\c:\xflrlll.exec:\xflrlll.exe117⤵PID:4640
-
\??\c:\3ttnnn.exec:\3ttnnn.exe118⤵PID:2464
-
\??\c:\dpddj.exec:\dpddj.exe119⤵PID:2656
-
\??\c:\pjjdv.exec:\pjjdv.exe120⤵PID:4456
-
\??\c:\llxxffl.exec:\llxxffl.exe121⤵PID:4452
-
\??\c:\lfffxxx.exec:\lfffxxx.exe122⤵PID:2540
-
\??\c:\nhhbtt.exec:\nhhbtt.exe123⤵PID:2008
-
\??\c:\vppjd.exec:\vppjd.exe124⤵PID:1064
-
\??\c:\1vdvv.exec:\1vdvv.exe125⤵PID:1268
-
\??\c:\1fxxrxr.exec:\1fxxrxr.exe126⤵PID:4288
-
\??\c:\xfrlflf.exec:\xfrlflf.exe127⤵PID:3372
-
\??\c:\tthbhh.exec:\tthbhh.exe128⤵PID:2684
-
\??\c:\vpdvv.exec:\vpdvv.exe129⤵PID:232
-
\??\c:\xlfflll.exec:\xlfflll.exe130⤵PID:4224
-
\??\c:\9tttnt.exec:\9tttnt.exe131⤵PID:2616
-
\??\c:\dddpj.exec:\dddpj.exe132⤵PID:4308
-
\??\c:\frllxrf.exec:\frllxrf.exe133⤵PID:3480
-
\??\c:\hbttnn.exec:\hbttnn.exe134⤵PID:2668
-
\??\c:\djppp.exec:\djppp.exe135⤵PID:1628
-
\??\c:\ddjdj.exec:\ddjdj.exe136⤵PID:5088
-
\??\c:\bnbbbb.exec:\bnbbbb.exe137⤵PID:4500
-
\??\c:\nhnhhh.exec:\nhnhhh.exe138⤵PID:4120
-
\??\c:\jdjjj.exec:\jdjjj.exe139⤵PID:1400
-
\??\c:\vpvpp.exec:\vpvpp.exe140⤵PID:2624
-
\??\c:\fflllrr.exec:\fflllrr.exe141⤵PID:2988
-
\??\c:\nnbbbh.exec:\nnbbbh.exe142⤵PID:2780
-
\??\c:\7vdvj.exec:\7vdvj.exe143⤵PID:1204
-
\??\c:\dvdvv.exec:\dvdvv.exe144⤵PID:4496
-
\??\c:\frfllrl.exec:\frfllrl.exe145⤵PID:1848
-
\??\c:\9xxrllf.exec:\9xxrllf.exe146⤵PID:2800
-
\??\c:\htbttn.exec:\htbttn.exe147⤵PID:4624
-
\??\c:\pdvvp.exec:\pdvvp.exe148⤵PID:1956
-
\??\c:\fxxxrrx.exec:\fxxxrrx.exe149⤵PID:4580
-
\??\c:\1xxrlfx.exec:\1xxrlfx.exe150⤵PID:2868
-
\??\c:\tnbbhh.exec:\tnbbhh.exe151⤵PID:444
-
\??\c:\5jddv.exec:\5jddv.exe152⤵PID:2540
-
\??\c:\9xllfff.exec:\9xllfff.exe153⤵PID:2008
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe154⤵PID:1064
-
\??\c:\bnnnhh.exec:\bnnnhh.exe155⤵PID:4644
-
\??\c:\tttnnn.exec:\tttnnn.exe156⤵PID:1452
-
\??\c:\jpdvp.exec:\jpdvp.exe157⤵PID:768
-
\??\c:\lxrxrxx.exec:\lxrxrxx.exe158⤵PID:116
-
\??\c:\xrxfxxf.exec:\xrxfxxf.exe159⤵PID:3608
-
\??\c:\bnhbtt.exec:\bnhbtt.exe160⤵PID:4224
-
\??\c:\ntttnn.exec:\ntttnn.exe161⤵PID:2616
-
\??\c:\ddvpv.exec:\ddvpv.exe162⤵PID:2448
-
\??\c:\rfffxxf.exec:\rfffxxf.exe163⤵PID:4696
-
\??\c:\3tnnnn.exec:\3tnnnn.exe164⤵PID:4340
-
\??\c:\5tbbbb.exec:\5tbbbb.exe165⤵PID:3628
-
\??\c:\ddjpp.exec:\ddjpp.exe166⤵PID:5004
-
\??\c:\jpppj.exec:\jpppj.exe167⤵PID:508
-
\??\c:\fxxrflf.exec:\fxxrflf.exe168⤵PID:1484
-
\??\c:\nhnnhn.exec:\nhnnhn.exe169⤵PID:4936
-
\??\c:\7hbbbb.exec:\7hbbbb.exe170⤵PID:3580
-
\??\c:\vddvp.exec:\vddvp.exe171⤵PID:1116
-
\??\c:\7jdvj.exec:\7jdvj.exe172⤵PID:3696
-
\??\c:\7lfxxxr.exec:\7lfxxxr.exe173⤵PID:2780
-
\??\c:\hhnttb.exec:\hhnttb.exe174⤵PID:1176
-
\??\c:\nbhnhn.exec:\nbhnhn.exe175⤵PID:4496
-
\??\c:\dpvvj.exec:\dpvvj.exe176⤵PID:4608
-
\??\c:\rxfffff.exec:\rxfffff.exe177⤵PID:2800
-
\??\c:\fffxrrl.exec:\fffxrrl.exe178⤵PID:3484
-
\??\c:\nttbhn.exec:\nttbhn.exe179⤵PID:4300
-
\??\c:\vdppp.exec:\vdppp.exe180⤵PID:4404
-
\??\c:\jdppj.exec:\jdppj.exe181⤵PID:3092
-
\??\c:\rxffrrr.exec:\rxffrrr.exe182⤵PID:5116
-
\??\c:\xrrxffl.exec:\xrrxffl.exe183⤵PID:4680
-
\??\c:\nnbbhh.exec:\nnbbhh.exe184⤵PID:3212
-
\??\c:\tbnbbh.exec:\tbnbbh.exe185⤵PID:2272
-
\??\c:\ddjjd.exec:\ddjjd.exe186⤵PID:2388
-
\??\c:\rrrxlll.exec:\rrrxlll.exe187⤵PID:2036
-
\??\c:\xflfxlf.exec:\xflfxlf.exe188⤵PID:4384
-
\??\c:\tnnhbb.exec:\tnnhbb.exe189⤵PID:4468
-
\??\c:\dvjvd.exec:\dvjvd.exe190⤵PID:4352
-
\??\c:\rrrlrrr.exec:\rrrlrrr.exe191⤵PID:3876
-
\??\c:\lflxrrl.exec:\lflxrrl.exe192⤵PID:3548
-
\??\c:\tbhnnt.exec:\tbhnnt.exe193⤵PID:4860
-
\??\c:\nntbtb.exec:\nntbtb.exe194⤵PID:2240
-
\??\c:\vvvvp.exec:\vvvvp.exe195⤵PID:1988
-
\??\c:\lrxrrrl.exec:\lrxrrrl.exe196⤵PID:2132
-
\??\c:\3frlllx.exec:\3frlllx.exe197⤵PID:4308
-
\??\c:\3nbtnn.exec:\3nbtnn.exe198⤵PID:1304
-
\??\c:\dvvpd.exec:\dvvpd.exe199⤵PID:3856
-
\??\c:\lffxrrr.exec:\lffxrrr.exe200⤵PID:4828
-
\??\c:\nhnntb.exec:\nhnntb.exe201⤵PID:3672
-
\??\c:\tnntnb.exec:\tnntnb.exe202⤵PID:4500
-
\??\c:\pjvpv.exec:\pjvpv.exe203⤵PID:2604
-
\??\c:\pdppv.exec:\pdppv.exe204⤵PID:1472
-
\??\c:\frrlfxr.exec:\frrlfxr.exe205⤵PID:2644
-
\??\c:\hhhhbb.exec:\hhhhbb.exe206⤵PID:3300
-
\??\c:\nhtnnn.exec:\nhtnnn.exe207⤵PID:2440
-
\??\c:\dpddv.exec:\dpddv.exe208⤵PID:5068
-
\??\c:\rlfxrxf.exec:\rlfxrxf.exe209⤵PID:2812
-
\??\c:\5ffxxfx.exec:\5ffxxfx.exe210⤵PID:4800
-
\??\c:\nbhnnb.exec:\nbhnnb.exe211⤵PID:2464
-
\??\c:\hhtbhn.exec:\hhtbhn.exe212⤵PID:3420
-
\??\c:\3jvpj.exec:\3jvpj.exe213⤵PID:2376
-
\??\c:\vddvv.exec:\vddvv.exe214⤵PID:3260
-
\??\c:\ffllllf.exec:\ffllllf.exe215⤵PID:4004
-
\??\c:\tttttt.exec:\tttttt.exe216⤵PID:3980
-
\??\c:\hbhnht.exec:\hbhnht.exe217⤵PID:2420
-
\??\c:\jdpjv.exec:\jdpjv.exe218⤵PID:2532
-
\??\c:\jdddv.exec:\jdddv.exe219⤵PID:4508
-
\??\c:\fffffxx.exec:\fffffxx.exe220⤵PID:1832
-
\??\c:\5rfxlrx.exec:\5rfxlrx.exe221⤵PID:4888
-
\??\c:\3hnnnt.exec:\3hnnnt.exe222⤵PID:452
-
\??\c:\djvpd.exec:\djvpd.exe223⤵PID:4468
-
\??\c:\jjvpv.exec:\jjvpv.exe224⤵PID:1452
-
\??\c:\rlffrff.exec:\rlffrff.exe225⤵PID:232
-
\??\c:\hhnnnn.exec:\hhnnnn.exe226⤵PID:116
-
\??\c:\nhttbh.exec:\nhttbh.exe227⤵PID:4860
-
\??\c:\jjjdp.exec:\jjjdp.exe228⤵PID:2240
-
\??\c:\pjvvj.exec:\pjvvj.exe229⤵PID:2956
-
\??\c:\1ffrrrl.exec:\1ffrrrl.exe230⤵PID:4728
-
\??\c:\nthbtn.exec:\nthbtn.exe231⤵PID:4308
-
\??\c:\jvjdv.exec:\jvjdv.exe232⤵PID:1072
-
\??\c:\vppdv.exec:\vppdv.exe233⤵PID:3856
-
\??\c:\lxffrrr.exec:\lxffrrr.exe234⤵PID:4828
-
\??\c:\nntbbb.exec:\nntbbb.exe235⤵PID:3668
-
\??\c:\bthbbb.exec:\bthbbb.exe236⤵PID:432
-
\??\c:\vdjjj.exec:\vdjjj.exe237⤵PID:4536
-
\??\c:\lrfxxxr.exec:\lrfxxxr.exe238⤵PID:4164
-
\??\c:\tbhhnn.exec:\tbhhnn.exe239⤵PID:1116
-
\??\c:\3dddd.exec:\3dddd.exe240⤵PID:2780
-
\??\c:\vvjvd.exec:\vvjvd.exe241⤵PID:1584
-