Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 18:37
Behavioral task
behavioral1
Sample
0e730b2808e6b598919514de7bcb2b3cf9c5b8ccd185eeeb16598ad43445c405.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
0e730b2808e6b598919514de7bcb2b3cf9c5b8ccd185eeeb16598ad43445c405.exe
-
Size
279KB
-
MD5
c8b754d8b56b5d2b249f55868ccd2729
-
SHA1
556fa9e21170adc247bee3dd46628bb9d2cbd259
-
SHA256
0e730b2808e6b598919514de7bcb2b3cf9c5b8ccd185eeeb16598ad43445c405
-
SHA512
59611768bb62666d351f1551c1219b7afe5e7c6c89ccd606fb04e4f0d43c732599f2a45ad77ece98e93274acce6ed1087057d501da133c4ad7f0046d181529b1
-
SSDEEP
6144:7cm4FmowdHoSoXSBcm4Vcm4FmowdHoSphra+cm4FMhraHcpOaKHpJ:B4wFHoSoXW434wFHoS3eg4aeFaKHpJ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2176-6-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1300-12-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4216-14-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4216-22-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/936-27-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1056-36-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3140-48-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4180-76-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3144-90-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3824-112-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1644-111-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1504-119-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1504-124-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3180-139-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1992-155-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4616-174-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3532-189-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3508-188-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3532-195-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4848-203-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4980-202-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4652-211-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4652-217-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4472-228-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1344-247-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3992-243-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1296-248-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4660-238-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1296-252-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3660-262-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4632-267-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/680-276-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4828-281-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2092-286-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4884-291-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4620-297-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2228-301-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4620-292-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/468-306-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4024-273-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3660-258-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4576-257-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3504-234-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2008-225-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4848-209-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4716-180-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/844-167-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1992-159-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3904-153-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4536-145-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4536-140-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2780-132-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3824-117-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1644-105-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3636-103-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2600-97-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3636-96-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3620-83-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1140-68-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1656-61-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1656-56-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2900-55-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3140-42-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4480-40-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule C:\bbnbhh.exe UPX behavioral2/memory/2176-6-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/1300-8-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\ttnhtn.exe UPX behavioral2/memory/1300-12-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4216-14-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\jvvdp.exe UPX behavioral2/memory/4216-22-0x0000000000400000-0x000000000044D000-memory.dmp UPX \??\c:\dvpdp.exe UPX behavioral2/memory/936-27-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\9nhnhh.exe UPX behavioral2/memory/1056-36-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\thbbht.exe UPX behavioral2/memory/2900-47-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3140-48-0x0000000000400000-0x000000000044D000-memory.dmp UPX \??\c:\7jvjd.exe UPX C:\5pvpj.exe UPX behavioral2/memory/1140-63-0x0000000000400000-0x000000000044D000-memory.dmp UPX \??\c:\3ffrffx.exe UPX behavioral2/memory/3620-77-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4180-76-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4180-70-0x0000000000400000-0x000000000044D000-memory.dmp UPX \??\c:\frxrrrf.exe UPX behavioral2/memory/3144-90-0x0000000000400000-0x000000000044D000-memory.dmp UPX \??\c:\xffxrxl.exe UPX C:\vpjvj.exe UPX behavioral2/memory/3824-112-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/1644-111-0x0000000000400000-0x000000000044D000-memory.dmp UPX \??\c:\lrlfllf.exe UPX behavioral2/memory/1504-119-0x0000000000400000-0x000000000044D000-memory.dmp UPX \??\c:\rflfxfx.exe UPX behavioral2/memory/1504-124-0x0000000000400000-0x000000000044D000-memory.dmp UPX \??\c:\hbthtn.exe UPX C:\7ppjd.exe UPX behavioral2/memory/3180-133-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3180-139-0x0000000000400000-0x000000000044D000-memory.dmp UPX \??\c:\tnbthb.exe UPX \??\c:\3nnntb.exe UPX behavioral2/memory/4616-174-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3508-182-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3532-189-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3508-188-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3532-195-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4980-202-0x0000000000400000-0x000000000044D000-memory.dmp UPX \??\c:\1tnnnn.exe UPX behavioral2/memory/4652-211-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4652-217-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3504-229-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4472-228-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/1344-247-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3992-243-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/1296-248-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4660-238-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/1296-252-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3660-262-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4632-267-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/680-276-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4828-281-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/2092-286-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4884-291-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4620-297-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/2228-295-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/2228-301-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4620-292-0x0000000000400000-0x000000000044D000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
bbnbhh.exettnhtn.exejvvdp.exedvpdp.exe9nhnhh.exethbbht.exe7jvjd.exetbbtnn.exe5pvpj.exefrxrrrf.exe3ffrffx.exevvjjv.exexffxrxl.exe5bhtnh.exevpjvj.exelrlfllf.exerflfxfx.exehbthtn.exe7ppjd.exedpjvp.exelrxrrrx.exetnbthb.exepjvdp.exexrlrrrl.exe3nnntb.exe5llfrlr.exetntnhb.exevdjvp.exe1tnnnn.exebnhbtn.exedjpdp.exexxlrxlr.exennhhbn.exe1vdvj.exerrfxrrl.exefrfxllf.exepjddv.exebbhbtt.exejpvpv.exelfxlffr.exenhbbtt.exe1bhtnn.exedpvjd.exexrlrxfl.exejppdp.exexrlfrlf.exe5hnbnn.exennhbnh.exedjjdp.exehththb.exevjpjd.exerrxfxfx.exehnbtht.exevvdpd.exedvvjd.exerflrlll.exebnnhbt.exedjvpp.exe3xfxxrf.exettbbbb.exevvddj.exefxrlffr.exebnhbnb.exejdjjd.exepid process 1300 bbnbhh.exe 4216 ttnhtn.exe 936 jvvdp.exe 1056 dvpdp.exe 4480 9nhnhh.exe 3140 thbbht.exe 2900 7jvjd.exe 1656 tbbtnn.exe 1140 5pvpj.exe 4180 frxrrrf.exe 3620 3ffrffx.exe 3144 vvjjv.exe 2600 xffxrxl.exe 3636 5bhtnh.exe 1644 vpjvj.exe 3824 lrlfllf.exe 1504 rflfxfx.exe 2780 hbthtn.exe 3180 7ppjd.exe 4536 dpjvp.exe 3904 lrxrrrx.exe 1992 tnbthb.exe 844 pjvdp.exe 4616 xrlrrrl.exe 4716 3nnntb.exe 3508 5llfrlr.exe 3532 tntnhb.exe 4980 vdjvp.exe 4848 1tnnnn.exe 4652 bnhbtn.exe 2008 djpdp.exe 4472 xxlrxlr.exe 3504 nnhhbn.exe 4660 1vdvj.exe 3992 rrfxrrl.exe 1344 frfxllf.exe 1296 pjddv.exe 4576 bbhbtt.exe 3660 jpvpv.exe 4632 lfxlffr.exe 4024 nhbbtt.exe 680 1bhtnn.exe 4828 dpvjd.exe 2092 xrlrxfl.exe 4884 jppdp.exe 4620 xrlfrlf.exe 2228 5hnbnn.exe 468 nnhbnh.exe 2612 djjdp.exe 3360 hththb.exe 4372 vjpjd.exe 2604 rrxfxfx.exe 4776 hnbtht.exe 1288 vvdpd.exe 2832 dvvjd.exe 1308 rflrlll.exe 540 bnnhbt.exe 4084 djvpp.exe 4996 3xfxxrf.exe 2468 ttbbbb.exe 4640 vvddj.exe 5000 fxrlffr.exe 2492 bnhbnb.exe 3080 jdjjd.exe -
Processes:
resource yara_rule behavioral2/memory/2176-0-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\bbnbhh.exe upx behavioral2/memory/2176-6-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1300-8-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\ttnhtn.exe upx behavioral2/memory/1300-12-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4216-14-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\jvvdp.exe upx behavioral2/memory/4216-22-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/936-20-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\dvpdp.exe upx behavioral2/memory/936-27-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\9nhnhh.exe upx behavioral2/memory/4480-33-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1056-36-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\thbbht.exe upx behavioral2/memory/2900-47-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3140-48-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\7jvjd.exe upx C:\5pvpj.exe upx behavioral2/memory/1140-63-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\3ffrffx.exe upx behavioral2/memory/3620-77-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4180-76-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4180-70-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\frxrrrf.exe upx behavioral2/memory/2600-91-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3144-90-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\xffxrxl.exe upx C:\vpjvj.exe upx behavioral2/memory/3824-112-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1644-111-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\lrlfllf.exe upx behavioral2/memory/1504-119-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\rflfxfx.exe upx behavioral2/memory/1504-124-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\hbthtn.exe upx C:\7ppjd.exe upx behavioral2/memory/3180-133-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3180-139-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3904-148-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\tnbthb.exe upx behavioral2/memory/1992-155-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4616-168-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\3nnntb.exe upx behavioral2/memory/4616-174-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4716-175-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3508-182-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3532-189-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3508-188-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3532-195-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4848-203-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4980-202-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\1tnnnn.exe upx behavioral2/memory/4652-211-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4652-217-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3504-229-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4472-228-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3992-239-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1344-247-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3992-243-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1296-248-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4660-238-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1296-252-0x0000000000400000-0x000000000044D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0e730b2808e6b598919514de7bcb2b3cf9c5b8ccd185eeeb16598ad43445c405.exebbnbhh.exettnhtn.exejvvdp.exedvpdp.exe9nhnhh.exethbbht.exe7jvjd.exetbbtnn.exe5pvpj.exefrxrrrf.exe3ffrffx.exevvjjv.exexffxrxl.exe5bhtnh.exevpjvj.exelrlfllf.exerflfxfx.exehbthtn.exe7ppjd.exedpjvp.exelrxrrrx.exedescription pid process target process PID 2176 wrote to memory of 1300 2176 0e730b2808e6b598919514de7bcb2b3cf9c5b8ccd185eeeb16598ad43445c405.exe bbnbhh.exe PID 2176 wrote to memory of 1300 2176 0e730b2808e6b598919514de7bcb2b3cf9c5b8ccd185eeeb16598ad43445c405.exe bbnbhh.exe PID 2176 wrote to memory of 1300 2176 0e730b2808e6b598919514de7bcb2b3cf9c5b8ccd185eeeb16598ad43445c405.exe bbnbhh.exe PID 1300 wrote to memory of 4216 1300 bbnbhh.exe ttnhtn.exe PID 1300 wrote to memory of 4216 1300 bbnbhh.exe ttnhtn.exe PID 1300 wrote to memory of 4216 1300 bbnbhh.exe ttnhtn.exe PID 4216 wrote to memory of 936 4216 ttnhtn.exe jvvdp.exe PID 4216 wrote to memory of 936 4216 ttnhtn.exe jvvdp.exe PID 4216 wrote to memory of 936 4216 ttnhtn.exe jvvdp.exe PID 936 wrote to memory of 1056 936 jvvdp.exe dvpdp.exe PID 936 wrote to memory of 1056 936 jvvdp.exe dvpdp.exe PID 936 wrote to memory of 1056 936 jvvdp.exe dvpdp.exe PID 1056 wrote to memory of 4480 1056 dvpdp.exe 9nhnhh.exe PID 1056 wrote to memory of 4480 1056 dvpdp.exe 9nhnhh.exe PID 1056 wrote to memory of 4480 1056 dvpdp.exe 9nhnhh.exe PID 4480 wrote to memory of 3140 4480 9nhnhh.exe thbbht.exe PID 4480 wrote to memory of 3140 4480 9nhnhh.exe thbbht.exe PID 4480 wrote to memory of 3140 4480 9nhnhh.exe thbbht.exe PID 3140 wrote to memory of 2900 3140 thbbht.exe 7jvjd.exe PID 3140 wrote to memory of 2900 3140 thbbht.exe 7jvjd.exe PID 3140 wrote to memory of 2900 3140 thbbht.exe 7jvjd.exe PID 2900 wrote to memory of 1656 2900 7jvjd.exe tbbtnn.exe PID 2900 wrote to memory of 1656 2900 7jvjd.exe tbbtnn.exe PID 2900 wrote to memory of 1656 2900 7jvjd.exe tbbtnn.exe PID 1656 wrote to memory of 1140 1656 tbbtnn.exe 5pvpj.exe PID 1656 wrote to memory of 1140 1656 tbbtnn.exe 5pvpj.exe PID 1656 wrote to memory of 1140 1656 tbbtnn.exe 5pvpj.exe PID 1140 wrote to memory of 4180 1140 5pvpj.exe frxrrrf.exe PID 1140 wrote to memory of 4180 1140 5pvpj.exe frxrrrf.exe PID 1140 wrote to memory of 4180 1140 5pvpj.exe frxrrrf.exe PID 4180 wrote to memory of 3620 4180 frxrrrf.exe 3ffrffx.exe PID 4180 wrote to memory of 3620 4180 frxrrrf.exe 3ffrffx.exe PID 4180 wrote to memory of 3620 4180 frxrrrf.exe 3ffrffx.exe PID 3620 wrote to memory of 3144 3620 3ffrffx.exe vvjjv.exe PID 3620 wrote to memory of 3144 3620 3ffrffx.exe vvjjv.exe PID 3620 wrote to memory of 3144 3620 3ffrffx.exe vvjjv.exe PID 3144 wrote to memory of 2600 3144 vvjjv.exe xffxrxl.exe PID 3144 wrote to memory of 2600 3144 vvjjv.exe xffxrxl.exe PID 3144 wrote to memory of 2600 3144 vvjjv.exe xffxrxl.exe PID 2600 wrote to memory of 3636 2600 xffxrxl.exe 5bhtnh.exe PID 2600 wrote to memory of 3636 2600 xffxrxl.exe 5bhtnh.exe PID 2600 wrote to memory of 3636 2600 xffxrxl.exe 5bhtnh.exe PID 3636 wrote to memory of 1644 3636 5bhtnh.exe vpjvj.exe PID 3636 wrote to memory of 1644 3636 5bhtnh.exe vpjvj.exe PID 3636 wrote to memory of 1644 3636 5bhtnh.exe vpjvj.exe PID 1644 wrote to memory of 3824 1644 vpjvj.exe lrlfllf.exe PID 1644 wrote to memory of 3824 1644 vpjvj.exe lrlfllf.exe PID 1644 wrote to memory of 3824 1644 vpjvj.exe lrlfllf.exe PID 3824 wrote to memory of 1504 3824 lrlfllf.exe rflfxfx.exe PID 3824 wrote to memory of 1504 3824 lrlfllf.exe rflfxfx.exe PID 3824 wrote to memory of 1504 3824 lrlfllf.exe rflfxfx.exe PID 1504 wrote to memory of 2780 1504 rflfxfx.exe hbthtn.exe PID 1504 wrote to memory of 2780 1504 rflfxfx.exe hbthtn.exe PID 1504 wrote to memory of 2780 1504 rflfxfx.exe hbthtn.exe PID 2780 wrote to memory of 3180 2780 hbthtn.exe 7ppjd.exe PID 2780 wrote to memory of 3180 2780 hbthtn.exe 7ppjd.exe PID 2780 wrote to memory of 3180 2780 hbthtn.exe 7ppjd.exe PID 3180 wrote to memory of 4536 3180 7ppjd.exe dpjvp.exe PID 3180 wrote to memory of 4536 3180 7ppjd.exe dpjvp.exe PID 3180 wrote to memory of 4536 3180 7ppjd.exe dpjvp.exe PID 4536 wrote to memory of 3904 4536 dpjvp.exe lrxrrrx.exe PID 4536 wrote to memory of 3904 4536 dpjvp.exe lrxrrrx.exe PID 4536 wrote to memory of 3904 4536 dpjvp.exe lrxrrrx.exe PID 3904 wrote to memory of 1992 3904 lrxrrrx.exe tnbthb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e730b2808e6b598919514de7bcb2b3cf9c5b8ccd185eeeb16598ad43445c405.exe"C:\Users\Admin\AppData\Local\Temp\0e730b2808e6b598919514de7bcb2b3cf9c5b8ccd185eeeb16598ad43445c405.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\bbnbhh.exec:\bbnbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\ttnhtn.exec:\ttnhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\jvvdp.exec:\jvvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\dvpdp.exec:\dvpdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\9nhnhh.exec:\9nhnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\thbbht.exec:\thbbht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\7jvjd.exec:\7jvjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\tbbtnn.exec:\tbbtnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\5pvpj.exec:\5pvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\frxrrrf.exec:\frxrrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\3ffrffx.exec:\3ffrffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\vvjjv.exec:\vvjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\xffxrxl.exec:\xffxrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\5bhtnh.exec:\5bhtnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\vpjvj.exec:\vpjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\lrlfllf.exec:\lrlfllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\rflfxfx.exec:\rflfxfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\hbthtn.exec:\hbthtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\7ppjd.exec:\7ppjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\dpjvp.exec:\dpjvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\lrxrrrx.exec:\lrxrrrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\tnbthb.exec:\tnbthb.exe23⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pjvdp.exec:\pjvdp.exe24⤵
- Executes dropped EXE
PID:844 -
\??\c:\xrlrrrl.exec:\xrlrrrl.exe25⤵
- Executes dropped EXE
PID:4616 -
\??\c:\3nnntb.exec:\3nnntb.exe26⤵
- Executes dropped EXE
PID:4716 -
\??\c:\5llfrlr.exec:\5llfrlr.exe27⤵
- Executes dropped EXE
PID:3508 -
\??\c:\tntnhb.exec:\tntnhb.exe28⤵
- Executes dropped EXE
PID:3532 -
\??\c:\vdjvp.exec:\vdjvp.exe29⤵
- Executes dropped EXE
PID:4980 -
\??\c:\1tnnnn.exec:\1tnnnn.exe30⤵
- Executes dropped EXE
PID:4848 -
\??\c:\bnhbtn.exec:\bnhbtn.exe31⤵
- Executes dropped EXE
PID:4652 -
\??\c:\djpdp.exec:\djpdp.exe32⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xxlrxlr.exec:\xxlrxlr.exe33⤵
- Executes dropped EXE
PID:4472 -
\??\c:\nnhhbn.exec:\nnhhbn.exe34⤵
- Executes dropped EXE
PID:3504 -
\??\c:\1vdvj.exec:\1vdvj.exe35⤵
- Executes dropped EXE
PID:4660 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe36⤵
- Executes dropped EXE
PID:3992 -
\??\c:\frfxllf.exec:\frfxllf.exe37⤵
- Executes dropped EXE
PID:1344 -
\??\c:\pjddv.exec:\pjddv.exe38⤵
- Executes dropped EXE
PID:1296 -
\??\c:\bbhbtt.exec:\bbhbtt.exe39⤵
- Executes dropped EXE
PID:4576 -
\??\c:\jpvpv.exec:\jpvpv.exe40⤵
- Executes dropped EXE
PID:3660 -
\??\c:\lfxlffr.exec:\lfxlffr.exe41⤵
- Executes dropped EXE
PID:4632 -
\??\c:\nhbbtt.exec:\nhbbtt.exe42⤵
- Executes dropped EXE
PID:4024 -
\??\c:\1bhtnn.exec:\1bhtnn.exe43⤵
- Executes dropped EXE
PID:680 -
\??\c:\dpvjd.exec:\dpvjd.exe44⤵
- Executes dropped EXE
PID:4828 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe45⤵
- Executes dropped EXE
PID:2092 -
\??\c:\jppdp.exec:\jppdp.exe46⤵
- Executes dropped EXE
PID:4884 -
\??\c:\xrlfrlf.exec:\xrlfrlf.exe47⤵
- Executes dropped EXE
PID:4620 -
\??\c:\5hnbnn.exec:\5hnbnn.exe48⤵
- Executes dropped EXE
PID:2228 -
\??\c:\nnhbnh.exec:\nnhbnh.exe49⤵
- Executes dropped EXE
PID:468 -
\??\c:\djjdp.exec:\djjdp.exe50⤵
- Executes dropped EXE
PID:2612 -
\??\c:\hththb.exec:\hththb.exe51⤵
- Executes dropped EXE
PID:3360 -
\??\c:\vjpjd.exec:\vjpjd.exe52⤵
- Executes dropped EXE
PID:4372 -
\??\c:\rrxfxfx.exec:\rrxfxfx.exe53⤵
- Executes dropped EXE
PID:2604 -
\??\c:\hnbtht.exec:\hnbtht.exe54⤵
- Executes dropped EXE
PID:4776 -
\??\c:\vvdpd.exec:\vvdpd.exe55⤵
- Executes dropped EXE
PID:1288 -
\??\c:\dvvjd.exec:\dvvjd.exe56⤵
- Executes dropped EXE
PID:2832 -
\??\c:\rflrlll.exec:\rflrlll.exe57⤵
- Executes dropped EXE
PID:1308 -
\??\c:\bnnhbt.exec:\bnnhbt.exe58⤵
- Executes dropped EXE
PID:540 -
\??\c:\djvpp.exec:\djvpp.exe59⤵
- Executes dropped EXE
PID:4084 -
\??\c:\3xfxxrf.exec:\3xfxxrf.exe60⤵
- Executes dropped EXE
PID:4996 -
\??\c:\ttbbbb.exec:\ttbbbb.exe61⤵
- Executes dropped EXE
PID:2468 -
\??\c:\vvddj.exec:\vvddj.exe62⤵
- Executes dropped EXE
PID:4640 -
\??\c:\fxrlffr.exec:\fxrlffr.exe63⤵
- Executes dropped EXE
PID:5000 -
\??\c:\bnhbnb.exec:\bnhbnb.exe64⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jdjjd.exec:\jdjjd.exe65⤵
- Executes dropped EXE
PID:3080 -
\??\c:\rxrflfr.exec:\rxrflfr.exe66⤵PID:368
-
\??\c:\xflfxrl.exec:\xflfxrl.exe67⤵PID:3508
-
\??\c:\bhbnhb.exec:\bhbnhb.exe68⤵PID:3532
-
\??\c:\vjdvj.exec:\vjdvj.exe69⤵PID:1728
-
\??\c:\5pvpp.exec:\5pvpp.exe70⤵PID:1340
-
\??\c:\1fxrfxl.exec:\1fxrfxl.exe71⤵PID:2572
-
\??\c:\thhthn.exec:\thhthn.exe72⤵PID:2560
-
\??\c:\3jddv.exec:\3jddv.exe73⤵PID:4920
-
\??\c:\llxflxr.exec:\llxflxr.exe74⤵PID:1320
-
\??\c:\3rxrlll.exec:\3rxrlll.exe75⤵PID:4792
-
\??\c:\1hthbb.exec:\1hthbb.exe76⤵PID:832
-
\??\c:\pddvp.exec:\pddvp.exe77⤵PID:4200
-
\??\c:\rrrlfrl.exec:\rrrlfrl.exe78⤵PID:3988
-
\??\c:\5thbbt.exec:\5thbbt.exe79⤵PID:4332
-
\??\c:\3hbnhn.exec:\3hbnhn.exe80⤵PID:3012
-
\??\c:\pjpjp.exec:\pjpjp.exe81⤵PID:4368
-
\??\c:\xlrfrlr.exec:\xlrfrlr.exe82⤵PID:2584
-
\??\c:\hbhhbh.exec:\hbhhbh.exe83⤵PID:456
-
\??\c:\3tbttn.exec:\3tbttn.exe84⤵PID:60
-
\??\c:\djppp.exec:\djppp.exe85⤵PID:1608
-
\??\c:\3xxlffr.exec:\3xxlffr.exe86⤵PID:3924
-
\??\c:\rlfxfrx.exec:\rlfxfrx.exe87⤵PID:1480
-
\??\c:\ttnnhb.exec:\ttnnhb.exe88⤵PID:1292
-
\??\c:\jvdvv.exec:\jvdvv.exe89⤵PID:2228
-
\??\c:\jvdpp.exec:\jvdpp.exe90⤵PID:468
-
\??\c:\1rrfrlr.exec:\1rrfrlr.exe91⤵PID:2020
-
\??\c:\tnbbbh.exec:\tnbbbh.exe92⤵PID:1080
-
\??\c:\rlfrrxr.exec:\rlfrrxr.exe93⤵PID:2592
-
\??\c:\9bbbnb.exec:\9bbbnb.exe94⤵PID:4148
-
\??\c:\vjjvv.exec:\vjjvv.exe95⤵PID:2632
-
\??\c:\fxxrllf.exec:\fxxrllf.exe96⤵PID:1076
-
\??\c:\hhbbnt.exec:\hhbbnt.exe97⤵PID:3236
-
\??\c:\7bnhtn.exec:\7bnhtn.exe98⤵PID:2168
-
\??\c:\3pvjv.exec:\3pvjv.exe99⤵PID:1844
-
\??\c:\xrxrlll.exec:\xrxrlll.exe100⤵PID:3028
-
\??\c:\xfrrflr.exec:\xfrrflr.exe101⤵PID:548
-
\??\c:\hbhhbn.exec:\hbhhbn.exe102⤵PID:1900
-
\??\c:\tbbtnh.exec:\tbbtnh.exe103⤵PID:1980
-
\??\c:\jvddv.exec:\jvddv.exe104⤵PID:844
-
\??\c:\lrlrlrl.exec:\lrlrlrl.exe105⤵PID:1084
-
\??\c:\thhhhn.exec:\thhhhn.exe106⤵PID:1280
-
\??\c:\ttnnbh.exec:\ttnnbh.exe107⤵PID:5040
-
\??\c:\ddvpd.exec:\ddvpd.exe108⤵PID:808
-
\??\c:\flfxlxl.exec:\flfxlxl.exe109⤵PID:3892
-
\??\c:\ttnnnt.exec:\ttnnnt.exe110⤵PID:1100
-
\??\c:\dvdvp.exec:\dvdvp.exe111⤵PID:4848
-
\??\c:\xfllffx.exec:\xfllffx.exe112⤵PID:4652
-
\??\c:\tttbtn.exec:\tttbtn.exe113⤵PID:4484
-
\??\c:\dvvpp.exec:\dvvpp.exe114⤵PID:4216
-
\??\c:\lrxxrrl.exec:\lrxxrrl.exe115⤵PID:2428
-
\??\c:\5bbnhh.exec:\5bbnhh.exe116⤵PID:1056
-
\??\c:\dvvjp.exec:\dvvjp.exe117⤵PID:4032
-
\??\c:\hbnhhb.exec:\hbnhhb.exe118⤵PID:2108
-
\??\c:\9lxrlrl.exec:\9lxrlrl.exe119⤵PID:3596
-
\??\c:\ddvpp.exec:\ddvpp.exe120⤵PID:2608
-
\??\c:\xlxxxrr.exec:\xlxxxrr.exe121⤵PID:1988
-
\??\c:\nbnnbb.exec:\nbnnbb.exe122⤵PID:4012
-
\??\c:\nbbbtt.exec:\nbbbtt.exe123⤵PID:4024
-
\??\c:\jpvdd.exec:\jpvdd.exe124⤵PID:5012
-
\??\c:\5lxrrrx.exec:\5lxrrrx.exe125⤵PID:1324
-
\??\c:\rlffllx.exec:\rlffllx.exe126⤵PID:1784
-
\??\c:\nnbttb.exec:\nnbttb.exe127⤵PID:4620
-
\??\c:\hhhhhh.exec:\hhhhhh.exe128⤵PID:3956
-
\??\c:\ppjdd.exec:\ppjdd.exe129⤵PID:3656
-
\??\c:\9ppvv.exec:\9ppvv.exe130⤵PID:3316
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe131⤵PID:760
-
\??\c:\1frlffx.exec:\1frlffx.exe132⤵PID:2148
-
\??\c:\nnhhnt.exec:\nnhhnt.exe133⤵PID:2036
-
\??\c:\hhhhbh.exec:\hhhhbh.exe134⤵PID:4808
-
\??\c:\1vpjj.exec:\1vpjj.exe135⤵PID:4932
-
\??\c:\jdjdv.exec:\jdjdv.exe136⤵PID:3076
-
\??\c:\flrxlrl.exec:\flrxlrl.exe137⤵PID:652
-
\??\c:\rfffrrl.exec:\rfffrrl.exe138⤵PID:1004
-
\??\c:\hthntn.exec:\hthntn.exe139⤵PID:4996
-
\??\c:\nbntnn.exec:\nbntnn.exe140⤵PID:548
-
\??\c:\dpvvv.exec:\dpvvv.exe141⤵PID:4640
-
\??\c:\vpdvp.exec:\vpdvp.exe142⤵PID:1980
-
\??\c:\xlrrrrl.exec:\xlrrrrl.exe143⤵PID:844
-
\??\c:\nhhhhh.exec:\nhhhhh.exe144⤵PID:2492
-
\??\c:\hbbnnn.exec:\hbbnnn.exe145⤵PID:3732
-
\??\c:\vvjpd.exec:\vvjpd.exe146⤵PID:4528
-
\??\c:\pdpjd.exec:\pdpjd.exe147⤵PID:2660
-
\??\c:\xrxllrr.exec:\xrxllrr.exe148⤵PID:4848
-
\??\c:\3lxxllx.exec:\3lxxllx.exe149⤵PID:2560
-
\??\c:\nntbth.exec:\nntbth.exe150⤵PID:3504
-
\??\c:\pvdjp.exec:\pvdjp.exe151⤵PID:1540
-
\??\c:\dpdvp.exec:\dpdvp.exe152⤵PID:1996
-
\??\c:\flxlllf.exec:\flxlllf.exe153⤵PID:2108
-
\??\c:\3lllfrr.exec:\3lllfrr.exe154⤵PID:5064
-
\??\c:\hhtbhn.exec:\hhtbhn.exe155⤵PID:2412
-
\??\c:\bnbbnb.exec:\bnbbnb.exe156⤵PID:2584
-
\??\c:\vvppj.exec:\vvppj.exe157⤵PID:60
-
\??\c:\pvdvp.exec:\pvdvp.exe158⤵PID:2504
-
\??\c:\9rfxxxf.exec:\9rfxxxf.exe159⤵PID:1436
-
\??\c:\rxrffff.exec:\rxrffff.exe160⤵PID:3720
-
\??\c:\tnbbtt.exec:\tnbbtt.exe161⤵PID:4620
-
\??\c:\jvvvp.exec:\jvvvp.exe162⤵PID:3956
-
\??\c:\rlllrrf.exec:\rlllrrf.exe163⤵PID:2308
-
\??\c:\bntttt.exec:\bntttt.exe164⤵PID:1080
-
\??\c:\jvjdv.exec:\jvjdv.exe165⤵PID:4372
-
\??\c:\9llfrxr.exec:\9llfrxr.exe166⤵PID:2148
-
\??\c:\rllxrrl.exec:\rllxrrl.exe167⤵PID:2036
-
\??\c:\3tbbtb.exec:\3tbbtb.exe168⤵PID:4808
-
\??\c:\9ttttt.exec:\9ttttt.exe169⤵PID:1216
-
\??\c:\dvjdj.exec:\dvjdj.exe170⤵PID:1660
-
\??\c:\7xffflr.exec:\7xffflr.exe171⤵PID:3904
-
\??\c:\rrfrxfr.exec:\rrfrxfr.exe172⤵PID:1004
-
\??\c:\9nttnt.exec:\9nttnt.exe173⤵PID:4996
-
\??\c:\jdvpj.exec:\jdvpj.exe174⤵PID:2184
-
\??\c:\ppdjj.exec:\ppdjj.exe175⤵PID:4616
-
\??\c:\7rrxxrr.exec:\7rrxxrr.exe176⤵PID:4716
-
\??\c:\hnnhtn.exec:\hnnhtn.exe177⤵PID:1084
-
\??\c:\7vjjd.exec:\7vjjd.exe178⤵PID:3736
-
\??\c:\dpvjd.exec:\dpvjd.exe179⤵PID:4400
-
\??\c:\5rfflrx.exec:\5rfflrx.exe180⤵PID:3688
-
\??\c:\9nttbb.exec:\9nttbb.exe181⤵PID:1604
-
\??\c:\hbhbbn.exec:\hbhbbn.exe182⤵PID:4076
-
\??\c:\jddvp.exec:\jddvp.exe183⤵PID:4740
-
\??\c:\pjppp.exec:\pjppp.exe184⤵PID:4228
-
\??\c:\lrfxfxx.exec:\lrfxfxx.exe185⤵PID:3056
-
\??\c:\lrrfxxf.exec:\lrrfxxf.exe186⤵PID:1652
-
\??\c:\bnhhhn.exec:\bnhhhn.exe187⤵PID:3756
-
\??\c:\hnhhbh.exec:\hnhhbh.exe188⤵PID:2652
-
\??\c:\pjdvp.exec:\pjdvp.exe189⤵PID:1988
-
\??\c:\djddp.exec:\djddp.exe190⤵PID:1908
-
\??\c:\xffxxlr.exec:\xffxxlr.exe191⤵PID:5012
-
\??\c:\5xfffff.exec:\5xfffff.exe192⤵PID:2096
-
\??\c:\hnnnhh.exec:\hnnnhh.exe193⤵PID:1324
-
\??\c:\9djdv.exec:\9djdv.exe194⤵PID:3720
-
\??\c:\pdjjj.exec:\pdjjj.exe195⤵PID:4620
-
\??\c:\1lrfxxr.exec:\1lrfxxr.exe196⤵PID:1396
-
\??\c:\5fllllr.exec:\5fllllr.exe197⤵PID:5060
-
\??\c:\nthnhh.exec:\nthnhh.exe198⤵PID:4456
-
\??\c:\nnhbnn.exec:\nnhbnn.exe199⤵PID:1288
-
\??\c:\jpjpj.exec:\jpjpj.exe200⤵PID:4892
-
\??\c:\jdjvv.exec:\jdjvv.exe201⤵PID:3180
-
\??\c:\fflrrrf.exec:\fflrrrf.exe202⤵PID:1116
-
\??\c:\xfrllll.exec:\xfrllll.exe203⤵PID:2956
-
\??\c:\ttbnnn.exec:\ttbnnn.exe204⤵PID:4232
-
\??\c:\nntnhb.exec:\nntnhb.exe205⤵PID:3212
-
\??\c:\1pvpp.exec:\1pvpp.exe206⤵PID:2468
-
\??\c:\1vdvp.exec:\1vdvp.exe207⤵PID:3124
-
\??\c:\3lffxff.exec:\3lffxff.exe208⤵PID:1072
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe209⤵PID:4584
-
\??\c:\bnbnhh.exec:\bnbnhh.exe210⤵PID:4468
-
\??\c:\ntnhbh.exec:\ntnhbh.exe211⤵PID:3508
-
\??\c:\pdjjp.exec:\pdjjp.exe212⤵PID:4980
-
\??\c:\xxxxlxx.exec:\xxxxlxx.exe213⤵PID:4528
-
\??\c:\lllfflf.exec:\lllfflf.exe214⤵PID:4596
-
\??\c:\hhtnnh.exec:\hhtnnh.exe215⤵PID:4296
-
\??\c:\1nbtbb.exec:\1nbtbb.exe216⤵PID:3988
-
\??\c:\vvdvp.exec:\vvdvp.exe217⤵PID:4228
-
\??\c:\xxfrlxr.exec:\xxfrlxr.exe218⤵PID:4632
-
\??\c:\flrlxrr.exec:\flrlxrr.exe219⤵PID:1652
-
\??\c:\tnttnb.exec:\tnttnb.exe220⤵PID:1208
-
\??\c:\nbhbtt.exec:\nbhbtt.exe221⤵PID:3024
-
\??\c:\vdjdv.exec:\vdjdv.exe222⤵PID:2932
-
\??\c:\jvddv.exec:\jvddv.exe223⤵PID:1908
-
\??\c:\rrrlffx.exec:\rrrlffx.exe224⤵PID:1480
-
\??\c:\fxxxfff.exec:\fxxxfff.exe225⤵PID:4180
-
\??\c:\bbttnh.exec:\bbttnh.exe226⤵PID:2236
-
\??\c:\7ntnhh.exec:\7ntnhh.exe227⤵PID:2072
-
\??\c:\7djjv.exec:\7djjv.exe228⤵PID:3720
-
\??\c:\vjjpj.exec:\vjjpj.exe229⤵PID:224
-
\??\c:\lxrlllf.exec:\lxrlllf.exe230⤵PID:4148
-
\??\c:\hntbbb.exec:\hntbbb.exe231⤵PID:2300
-
\??\c:\btbbtt.exec:\btbbtt.exe232⤵PID:3920
-
\??\c:\vdjdd.exec:\vdjdd.exe233⤵PID:936
-
\??\c:\1rrrlrl.exec:\1rrrlrl.exe234⤵PID:1620
-
\??\c:\fxlrlrr.exec:\fxlrlrr.exe235⤵PID:1700
-
\??\c:\hbbtnn.exec:\hbbtnn.exe236⤵PID:2168
-
\??\c:\3hhbhn.exec:\3hhbhn.exe237⤵PID:3196
-
\??\c:\pjpdv.exec:\pjpdv.exe238⤵PID:1884
-
\??\c:\fxlfllr.exec:\fxlfllr.exe239⤵PID:4656
-
\??\c:\rflflll.exec:\rflflll.exe240⤵PID:4184
-
\??\c:\bnbtnn.exec:\bnbtnn.exe241⤵PID:4564
-
\??\c:\hnnntt.exec:\hnnntt.exe242⤵PID:5000