Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 20:52
Behavioral task
behavioral1
Sample
3f96140f40b7a7d83a6e82c02acbefdb7063d7ea6848f4294e4d4edd6c54df1e.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
3f96140f40b7a7d83a6e82c02acbefdb7063d7ea6848f4294e4d4edd6c54df1e.exe
-
Size
173KB
-
MD5
48770176d1e34cff0e55453c92e4b567
-
SHA1
2d31c077156947f2171502e3927d9e7fcb61cd3f
-
SHA256
3f96140f40b7a7d83a6e82c02acbefdb7063d7ea6848f4294e4d4edd6c54df1e
-
SHA512
a31939810f3325860a9fc5e426e9ede221eb72ea70074ee5b4da073d393b7f2aed192aae410cbacb00a664501e1c888ad59e62e3fba009dc6ac19675c02eed63
-
SSDEEP
3072:6hOmTsF93UYfwC6GIoutQ0tSe5yLpcka62c+8+dRNN7Yk+6C2W/:6cm4FmowdHoSQ0tH6lCXb7Yb/
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1076-0-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1076-4-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3468-12-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4512-19-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/656-17-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4932-30-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4264-36-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/936-49-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4216-54-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5040-48-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3068-60-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1692-66-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/660-77-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3596-79-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1540-88-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3288-94-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3036-101-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4044-108-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/840-113-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4856-117-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1288-121-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3120-129-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4056-139-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3228-147-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4168-156-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3980-179-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/532-192-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2972-206-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4688-209-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2440-215-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4416-224-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2180-242-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1624-247-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4240-269-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3856-297-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4456-301-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3972-305-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4460-306-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3136-313-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2364-326-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4972-333-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3308-347-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3744-362-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4832-366-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4288-382-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1484-405-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5084-416-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4576-448-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2172-463-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4272-503-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3724-519-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5072-562-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1924-577-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1924-581-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/640-588-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4168-626-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4932-686-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4112-765-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1484-808-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2400-828-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1392-859-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1184-877-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2764-954-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4784-984-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1076-0-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/1076-4-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\7ppvp.exe UPX behavioral2/memory/3468-6-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\tntnnh.exe UPX behavioral2/memory/3468-12-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\vjpjv.exe UPX behavioral2/memory/4512-19-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/656-17-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\xrfxrxx.exe UPX \??\c:\lrxxxxr.exe UPX C:\nhbtbb.exe UPX behavioral2/memory/4932-30-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/4264-36-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\7tbttt.exe UPX behavioral2/memory/936-40-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\xfxxrff.exe UPX behavioral2/memory/936-49-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/4216-54-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\bbntnt.exe UPX behavioral2/memory/5040-48-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\ppppj.exe UPX behavioral2/memory/3068-60-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\3xfxllf.exe UPX behavioral2/memory/1692-66-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\frfrlll.exe UPX C:\7djdv.exe UPX behavioral2/memory/660-77-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/3596-79-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\pddvp.exe UPX C:\nhhbbb.exe UPX behavioral2/memory/1540-88-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\tnttnh.exe UPX behavioral2/memory/3288-94-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/3036-96-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\lffxrlf.exe UPX behavioral2/memory/3036-101-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/4044-103-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/4044-108-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\9bbbtt.exe UPX behavioral2/memory/840-113-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/4856-117-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\pvpjp.exe UPX C:\lllfxrr.exe UPX behavioral2/memory/1288-121-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\hhhhhh.exe UPX behavioral2/memory/3120-129-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\jvpjd.exe UPX behavioral2/memory/4056-134-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\btbtnn.exe UPX behavioral2/memory/4056-139-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/3228-147-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\nhhhtt.exe UPX C:\3jppj.exe UPX \??\c:\dvvjd.exe UPX \??\c:\fllffxl.exe UPX \??\c:\bnnnhh.exe UPX C:\thtttt.exe UPX behavioral2/memory/4168-156-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\dvjdv.exe UPX behavioral2/memory/3980-179-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\rfllflf.exe UPX C:\nbtthh.exe UPX behavioral2/memory/532-192-0x0000000000400000-0x0000000000432000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
7ppvp.exetntnnh.exevjpjv.exexrfxrxx.exelrxxxxr.exenhbtbb.exe7tbttt.exexfxxrff.exebbntnt.exeppppj.exe3xfxllf.exefrfrlll.exe7djdv.exepddvp.exenhhbbb.exetnttnh.exelffxrlf.exe9bbbtt.exepvpjp.exelllfxrr.exehhhhhh.exejvpjd.exebtbtnn.exenhhhtt.exe3jppj.exedvvjd.exefllffxl.exebnnnhh.exethtttt.exedvjdv.exerfllflf.exenbtthh.exexlrlffx.exexxrlffx.exetbnnnn.exe9vdvp.exe5fffrxr.exe5fllfff.exehntnnh.exedjddd.exefrxlfff.exerfxrrrl.exehtbtbh.exehbnhnh.exejdvpv.exepdvpj.exexrrrflf.exelffxrlf.exe9hhbtb.exevvvvp.exejjdvd.exellxlxrf.exehtnnnn.exennbnnn.exedjvvj.exevpdvv.exexxlfrrr.exerffxrrl.exebbnntt.exejvjvp.exejvvpd.exelxxrfff.exe7lrlffx.exettttnn.exepid process 3468 7ppvp.exe 4512 tntnnh.exe 656 vjpjv.exe 2232 xrfxrxx.exe 4932 lrxxxxr.exe 4264 nhbtbb.exe 936 7tbttt.exe 5040 xfxxrff.exe 4216 bbntnt.exe 3068 ppppj.exe 1692 3xfxllf.exe 660 frfrlll.exe 3596 7djdv.exe 1540 pddvp.exe 3288 nhhbbb.exe 3036 tnttnh.exe 4044 lffxrlf.exe 840 9bbbtt.exe 4856 pvpjp.exe 1288 lllfxrr.exe 3120 hhhhhh.exe 4056 jvpjd.exe 1424 btbtnn.exe 3228 nhhhtt.exe 4168 3jppj.exe 1600 dvvjd.exe 4104 fllffxl.exe 3244 bnnnhh.exe 1168 thtttt.exe 3980 dvjdv.exe 3552 rfllflf.exe 532 nbtthh.exe 848 xlrlffx.exe 2052 xxrlffx.exe 2944 tbnnnn.exe 3424 9vdvp.exe 2972 5fffrxr.exe 4688 5fllfff.exe 2440 hntnnh.exe 1456 djddd.exe 4416 frxlfff.exe 3952 rfxrrrl.exe 2688 htbtbh.exe 4564 hbnhnh.exe 4932 jdvpv.exe 3472 pdvpj.exe 2180 xrrrflf.exe 5072 lffxrlf.exe 1624 9hhbtb.exe 3220 vvvvp.exe 4216 jjdvd.exe 3068 llxlxrf.exe 4844 htnnnn.exe 4596 nnbnnn.exe 3280 djvvj.exe 4240 vpdvv.exe 556 xxlfrrr.exe 876 rffxrrl.exe 2064 bbnntt.exe 3580 jvjvp.exe 1500 jvvpd.exe 3696 lxxrfff.exe 2836 7lrlffx.exe 3856 ttttnn.exe -
Processes:
resource yara_rule behavioral2/memory/1076-0-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/1076-4-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\7ppvp.exe upx behavioral2/memory/3468-6-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\tntnnh.exe upx behavioral2/memory/3468-12-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\vjpjv.exe upx behavioral2/memory/4512-19-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/656-17-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\xrfxrxx.exe upx \??\c:\lrxxxxr.exe upx C:\nhbtbb.exe upx behavioral2/memory/4932-30-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4264-36-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\7tbttt.exe upx behavioral2/memory/936-40-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\xfxxrff.exe upx behavioral2/memory/936-49-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4216-54-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\bbntnt.exe upx behavioral2/memory/5040-48-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\ppppj.exe upx behavioral2/memory/3068-60-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\3xfxllf.exe upx behavioral2/memory/1692-66-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\frfrlll.exe upx C:\7djdv.exe upx behavioral2/memory/660-77-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3596-79-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\pddvp.exe upx C:\nhhbbb.exe upx behavioral2/memory/1540-88-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\tnttnh.exe upx behavioral2/memory/3288-94-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3036-96-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\lffxrlf.exe upx behavioral2/memory/3036-101-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4044-103-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4044-108-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\9bbbtt.exe upx behavioral2/memory/840-113-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4856-117-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\pvpjp.exe upx C:\lllfxrr.exe upx behavioral2/memory/1288-121-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\hhhhhh.exe upx behavioral2/memory/3120-129-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\jvpjd.exe upx behavioral2/memory/4056-134-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\btbtnn.exe upx behavioral2/memory/4056-139-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3228-147-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\nhhhtt.exe upx C:\3jppj.exe upx \??\c:\dvvjd.exe upx \??\c:\fllffxl.exe upx \??\c:\bnnnhh.exe upx C:\thtttt.exe upx behavioral2/memory/4168-156-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\dvjdv.exe upx behavioral2/memory/3980-179-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\rfllflf.exe upx C:\nbtthh.exe upx behavioral2/memory/532-192-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3f96140f40b7a7d83a6e82c02acbefdb7063d7ea6848f4294e4d4edd6c54df1e.exe7ppvp.exetntnnh.exevjpjv.exexrfxrxx.exelrxxxxr.exenhbtbb.exe7tbttt.exexfxxrff.exebbntnt.exeppppj.exe3xfxllf.exefrfrlll.exe7djdv.exepddvp.exenhhbbb.exetnttnh.exelffxrlf.exe9bbbtt.exepvpjp.exelllfxrr.exehhhhhh.exedescription pid process target process PID 1076 wrote to memory of 3468 1076 3f96140f40b7a7d83a6e82c02acbefdb7063d7ea6848f4294e4d4edd6c54df1e.exe 7ppvp.exe PID 1076 wrote to memory of 3468 1076 3f96140f40b7a7d83a6e82c02acbefdb7063d7ea6848f4294e4d4edd6c54df1e.exe 7ppvp.exe PID 1076 wrote to memory of 3468 1076 3f96140f40b7a7d83a6e82c02acbefdb7063d7ea6848f4294e4d4edd6c54df1e.exe 7ppvp.exe PID 3468 wrote to memory of 4512 3468 7ppvp.exe tntnnh.exe PID 3468 wrote to memory of 4512 3468 7ppvp.exe tntnnh.exe PID 3468 wrote to memory of 4512 3468 7ppvp.exe tntnnh.exe PID 4512 wrote to memory of 656 4512 tntnnh.exe vjpjv.exe PID 4512 wrote to memory of 656 4512 tntnnh.exe vjpjv.exe PID 4512 wrote to memory of 656 4512 tntnnh.exe vjpjv.exe PID 656 wrote to memory of 2232 656 vjpjv.exe xrfxrxx.exe PID 656 wrote to memory of 2232 656 vjpjv.exe xrfxrxx.exe PID 656 wrote to memory of 2232 656 vjpjv.exe xrfxrxx.exe PID 2232 wrote to memory of 4932 2232 xrfxrxx.exe lrxxxxr.exe PID 2232 wrote to memory of 4932 2232 xrfxrxx.exe lrxxxxr.exe PID 2232 wrote to memory of 4932 2232 xrfxrxx.exe lrxxxxr.exe PID 4932 wrote to memory of 4264 4932 lrxxxxr.exe nhbtbb.exe PID 4932 wrote to memory of 4264 4932 lrxxxxr.exe nhbtbb.exe PID 4932 wrote to memory of 4264 4932 lrxxxxr.exe nhbtbb.exe PID 4264 wrote to memory of 936 4264 nhbtbb.exe 7tbttt.exe PID 4264 wrote to memory of 936 4264 nhbtbb.exe 7tbttt.exe PID 4264 wrote to memory of 936 4264 nhbtbb.exe 7tbttt.exe PID 936 wrote to memory of 5040 936 7tbttt.exe xfxxrff.exe PID 936 wrote to memory of 5040 936 7tbttt.exe xfxxrff.exe PID 936 wrote to memory of 5040 936 7tbttt.exe xfxxrff.exe PID 5040 wrote to memory of 4216 5040 xfxxrff.exe bbntnt.exe PID 5040 wrote to memory of 4216 5040 xfxxrff.exe bbntnt.exe PID 5040 wrote to memory of 4216 5040 xfxxrff.exe bbntnt.exe PID 4216 wrote to memory of 3068 4216 bbntnt.exe ppppj.exe PID 4216 wrote to memory of 3068 4216 bbntnt.exe ppppj.exe PID 4216 wrote to memory of 3068 4216 bbntnt.exe ppppj.exe PID 3068 wrote to memory of 1692 3068 ppppj.exe 3xfxllf.exe PID 3068 wrote to memory of 1692 3068 ppppj.exe 3xfxllf.exe PID 3068 wrote to memory of 1692 3068 ppppj.exe 3xfxllf.exe PID 1692 wrote to memory of 660 1692 3xfxllf.exe frfrlll.exe PID 1692 wrote to memory of 660 1692 3xfxllf.exe frfrlll.exe PID 1692 wrote to memory of 660 1692 3xfxllf.exe frfrlll.exe PID 660 wrote to memory of 3596 660 frfrlll.exe 7djdv.exe PID 660 wrote to memory of 3596 660 frfrlll.exe 7djdv.exe PID 660 wrote to memory of 3596 660 frfrlll.exe 7djdv.exe PID 3596 wrote to memory of 1540 3596 7djdv.exe pddvp.exe PID 3596 wrote to memory of 1540 3596 7djdv.exe pddvp.exe PID 3596 wrote to memory of 1540 3596 7djdv.exe pddvp.exe PID 1540 wrote to memory of 3288 1540 pddvp.exe nhhbbb.exe PID 1540 wrote to memory of 3288 1540 pddvp.exe nhhbbb.exe PID 1540 wrote to memory of 3288 1540 pddvp.exe nhhbbb.exe PID 3288 wrote to memory of 3036 3288 nhhbbb.exe tnttnh.exe PID 3288 wrote to memory of 3036 3288 nhhbbb.exe tnttnh.exe PID 3288 wrote to memory of 3036 3288 nhhbbb.exe tnttnh.exe PID 3036 wrote to memory of 4044 3036 tnttnh.exe lffxrlf.exe PID 3036 wrote to memory of 4044 3036 tnttnh.exe lffxrlf.exe PID 3036 wrote to memory of 4044 3036 tnttnh.exe lffxrlf.exe PID 4044 wrote to memory of 840 4044 lffxrlf.exe 9bbbtt.exe PID 4044 wrote to memory of 840 4044 lffxrlf.exe 9bbbtt.exe PID 4044 wrote to memory of 840 4044 lffxrlf.exe 9bbbtt.exe PID 840 wrote to memory of 4856 840 9bbbtt.exe pvpjp.exe PID 840 wrote to memory of 4856 840 9bbbtt.exe pvpjp.exe PID 840 wrote to memory of 4856 840 9bbbtt.exe pvpjp.exe PID 4856 wrote to memory of 1288 4856 pvpjp.exe lllfxrr.exe PID 4856 wrote to memory of 1288 4856 pvpjp.exe lllfxrr.exe PID 4856 wrote to memory of 1288 4856 pvpjp.exe lllfxrr.exe PID 1288 wrote to memory of 3120 1288 lllfxrr.exe hhhhhh.exe PID 1288 wrote to memory of 3120 1288 lllfxrr.exe hhhhhh.exe PID 1288 wrote to memory of 3120 1288 lllfxrr.exe hhhhhh.exe PID 3120 wrote to memory of 4056 3120 hhhhhh.exe jvpjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f96140f40b7a7d83a6e82c02acbefdb7063d7ea6848f4294e4d4edd6c54df1e.exe"C:\Users\Admin\AppData\Local\Temp\3f96140f40b7a7d83a6e82c02acbefdb7063d7ea6848f4294e4d4edd6c54df1e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\7ppvp.exec:\7ppvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\tntnnh.exec:\tntnnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\vjpjv.exec:\vjpjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\xrfxrxx.exec:\xrfxrxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\lrxxxxr.exec:\lrxxxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\nhbtbb.exec:\nhbtbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\7tbttt.exec:\7tbttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\xfxxrff.exec:\xfxxrff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\bbntnt.exec:\bbntnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\ppppj.exec:\ppppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\3xfxllf.exec:\3xfxllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\frfrlll.exec:\frfrlll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\7djdv.exec:\7djdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\pddvp.exec:\pddvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\nhhbbb.exec:\nhhbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\tnttnh.exec:\tnttnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\lffxrlf.exec:\lffxrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\9bbbtt.exec:\9bbbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\pvpjp.exec:\pvpjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\lllfxrr.exec:\lllfxrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\hhhhhh.exec:\hhhhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\jvpjd.exec:\jvpjd.exe23⤵
- Executes dropped EXE
PID:4056 -
\??\c:\btbtnn.exec:\btbtnn.exe24⤵
- Executes dropped EXE
PID:1424 -
\??\c:\nhhhtt.exec:\nhhhtt.exe25⤵
- Executes dropped EXE
PID:3228 -
\??\c:\3jppj.exec:\3jppj.exe26⤵
- Executes dropped EXE
PID:4168 -
\??\c:\dvvjd.exec:\dvvjd.exe27⤵
- Executes dropped EXE
PID:1600 -
\??\c:\fllffxl.exec:\fllffxl.exe28⤵
- Executes dropped EXE
PID:4104 -
\??\c:\bnnnhh.exec:\bnnnhh.exe29⤵
- Executes dropped EXE
PID:3244 -
\??\c:\thtttt.exec:\thtttt.exe30⤵
- Executes dropped EXE
PID:1168 -
\??\c:\dvjdv.exec:\dvjdv.exe31⤵
- Executes dropped EXE
PID:3980 -
\??\c:\rfllflf.exec:\rfllflf.exe32⤵
- Executes dropped EXE
PID:3552 -
\??\c:\nbtthh.exec:\nbtthh.exe33⤵
- Executes dropped EXE
PID:532 -
\??\c:\xlrlffx.exec:\xlrlffx.exe34⤵
- Executes dropped EXE
PID:848 -
\??\c:\xxrlffx.exec:\xxrlffx.exe35⤵
- Executes dropped EXE
PID:2052 -
\??\c:\tbnnnn.exec:\tbnnnn.exe36⤵
- Executes dropped EXE
PID:2944 -
\??\c:\9vdvp.exec:\9vdvp.exe37⤵
- Executes dropped EXE
PID:3424 -
\??\c:\5fffrxr.exec:\5fffrxr.exe38⤵
- Executes dropped EXE
PID:2972 -
\??\c:\5fllfff.exec:\5fllfff.exe39⤵
- Executes dropped EXE
PID:4688 -
\??\c:\nbhhbb.exec:\nbhhbb.exe40⤵PID:4556
-
\??\c:\hntnnh.exec:\hntnnh.exe41⤵
- Executes dropped EXE
PID:2440 -
\??\c:\djddd.exec:\djddd.exe42⤵
- Executes dropped EXE
PID:1456 -
\??\c:\frxlfff.exec:\frxlfff.exe43⤵
- Executes dropped EXE
PID:4416 -
\??\c:\rfxrrrl.exec:\rfxrrrl.exe44⤵
- Executes dropped EXE
PID:3952 -
\??\c:\htbtbh.exec:\htbtbh.exe45⤵
- Executes dropped EXE
PID:2688 -
\??\c:\hbnhnh.exec:\hbnhnh.exe46⤵
- Executes dropped EXE
PID:4564 -
\??\c:\jdvpv.exec:\jdvpv.exe47⤵
- Executes dropped EXE
PID:4932 -
\??\c:\pdvpj.exec:\pdvpj.exe48⤵
- Executes dropped EXE
PID:3472 -
\??\c:\xrrrflf.exec:\xrrrflf.exe49⤵
- Executes dropped EXE
PID:2180 -
\??\c:\lffxrlf.exec:\lffxrlf.exe50⤵
- Executes dropped EXE
PID:5072 -
\??\c:\9hhbtb.exec:\9hhbtb.exe51⤵
- Executes dropped EXE
PID:1624 -
\??\c:\vvvvp.exec:\vvvvp.exe52⤵
- Executes dropped EXE
PID:3220 -
\??\c:\jjdvd.exec:\jjdvd.exe53⤵
- Executes dropped EXE
PID:4216 -
\??\c:\llxlxrf.exec:\llxlxrf.exe54⤵
- Executes dropped EXE
PID:3068 -
\??\c:\htnnnn.exec:\htnnnn.exe55⤵
- Executes dropped EXE
PID:4844 -
\??\c:\nnbnnn.exec:\nnbnnn.exe56⤵
- Executes dropped EXE
PID:4596 -
\??\c:\djvvj.exec:\djvvj.exe57⤵
- Executes dropped EXE
PID:3280 -
\??\c:\vpdvv.exec:\vpdvv.exe58⤵
- Executes dropped EXE
PID:4240 -
\??\c:\xxlfrrr.exec:\xxlfrrr.exe59⤵
- Executes dropped EXE
PID:556 -
\??\c:\rffxrrl.exec:\rffxrrl.exe60⤵
- Executes dropped EXE
PID:876 -
\??\c:\bbnntt.exec:\bbnntt.exe61⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jvjvp.exec:\jvjvp.exe62⤵
- Executes dropped EXE
PID:3580 -
\??\c:\jvvpd.exec:\jvvpd.exe63⤵
- Executes dropped EXE
PID:1500 -
\??\c:\lxxrfff.exec:\lxxrfff.exe64⤵
- Executes dropped EXE
PID:3696 -
\??\c:\7lrlffx.exec:\7lrlffx.exe65⤵
- Executes dropped EXE
PID:2836 -
\??\c:\ttttnn.exec:\ttttnn.exe66⤵
- Executes dropped EXE
PID:3856 -
\??\c:\vjjjj.exec:\vjjjj.exe67⤵PID:4456
-
\??\c:\ddpjj.exec:\ddpjj.exe68⤵PID:3972
-
\??\c:\fflfxxr.exec:\fflfxxr.exe69⤵PID:4460
-
\??\c:\bhtttt.exec:\bhtttt.exe70⤵PID:1288
-
\??\c:\jjjjd.exec:\jjjjd.exe71⤵PID:3136
-
\??\c:\rxrlxxl.exec:\rxrlxxl.exe72⤵PID:1828
-
\??\c:\rlrfxxr.exec:\rlrfxxr.exe73⤵PID:4056
-
\??\c:\thbbtt.exec:\thbbtt.exe74⤵PID:2364
-
\??\c:\9jpdp.exec:\9jpdp.exe75⤵PID:2220
-
\??\c:\djvvp.exec:\djvvp.exe76⤵PID:4972
-
\??\c:\3xfxrrl.exec:\3xfxrrl.exe77⤵PID:2460
-
\??\c:\xxlfxxx.exec:\xxlfxxx.exe78⤵PID:4704
-
\??\c:\btnnhh.exec:\btnnhh.exe79⤵PID:3680
-
\??\c:\7jppj.exec:\7jppj.exe80⤵PID:3576
-
\??\c:\dvpdd.exec:\dvpdd.exe81⤵PID:3308
-
\??\c:\7xxxrrl.exec:\7xxxrrl.exe82⤵PID:3968
-
\??\c:\thnhbb.exec:\thnhbb.exe83⤵PID:3788
-
\??\c:\tnnnhn.exec:\tnnnhn.exe84⤵PID:844
-
\??\c:\1pdvp.exec:\1pdvp.exe85⤵PID:3744
-
\??\c:\pjdvp.exec:\pjdvp.exe86⤵PID:4832
-
\??\c:\1frxffx.exec:\1frxffx.exe87⤵PID:5108
-
\??\c:\hntntn.exec:\hntntn.exe88⤵PID:4988
-
\??\c:\dvdvp.exec:\dvdvp.exe89⤵PID:2208
-
\??\c:\dvvjd.exec:\dvvjd.exe90⤵PID:3424
-
\??\c:\rrrrlll.exec:\rrrrlll.exe91⤵PID:4288
-
\??\c:\fxfxllx.exec:\fxfxllx.exe92⤵PID:4688
-
\??\c:\bhhhbb.exec:\bhhhbb.exe93⤵PID:1952
-
\??\c:\pvjdp.exec:\pvjdp.exe94⤵PID:2296
-
\??\c:\dvpvj.exec:\dvpvj.exe95⤵PID:4512
-
\??\c:\frxrllf.exec:\frxrllf.exe96⤵PID:1044
-
\??\c:\nttbnb.exec:\nttbnb.exe97⤵PID:2004
-
\??\c:\thhbtt.exec:\thhbtt.exe98⤵PID:2232
-
\??\c:\1dvpj.exec:\1dvpj.exe99⤵PID:1484
-
\??\c:\pvdvp.exec:\pvdvp.exe100⤵PID:984
-
\??\c:\lxllffx.exec:\lxllffx.exe101⤵PID:3720
-
\??\c:\7rxxrll.exec:\7rxxrll.exe102⤵PID:1340
-
\??\c:\7hhbbb.exec:\7hhbbb.exe103⤵PID:5084
-
\??\c:\hhhhht.exec:\hhhhht.exe104⤵PID:2928
-
\??\c:\7jjdd.exec:\7jjdd.exe105⤵PID:2896
-
\??\c:\9xfffxx.exec:\9xfffxx.exe106⤵PID:2304
-
\??\c:\nttttn.exec:\nttttn.exe107⤵PID:660
-
\??\c:\3tnthh.exec:\3tnthh.exe108⤵PID:1264
-
\??\c:\jjvpp.exec:\jjvpp.exe109⤵PID:4536
-
\??\c:\7pvjd.exec:\7pvjd.exe110⤵PID:2544
-
\??\c:\lflfllx.exec:\lflfllx.exe111⤵PID:2096
-
\??\c:\lrrrrrf.exec:\lrrrrrf.exe112⤵PID:3936
-
\??\c:\bbttnn.exec:\bbttnn.exe113⤵PID:4576
-
\??\c:\hnbttt.exec:\hnbttt.exe114⤵PID:4784
-
\??\c:\pdpjj.exec:\pdpjj.exe115⤵PID:1080
-
\??\c:\xfrrrrr.exec:\xfrrrrr.exe116⤵PID:64
-
\??\c:\rrxrrrl.exec:\rrxrrrl.exe117⤵PID:2172
-
\??\c:\tbbbnh.exec:\tbbbnh.exe118⤵PID:4456
-
\??\c:\5xfxrrl.exec:\5xfxrrl.exe119⤵PID:2512
-
\??\c:\7tbbtt.exec:\7tbbtt.exe120⤵PID:2108
-
\??\c:\tttnhh.exec:\tttnhh.exe121⤵PID:2308
-
\??\c:\djddp.exec:\djddp.exe122⤵PID:3120
-
\??\c:\dpddp.exec:\dpddp.exe123⤵PID:3136
-
\??\c:\3xfffff.exec:\3xfffff.exe124⤵PID:1828
-
\??\c:\rlfxffl.exec:\rlfxffl.exe125⤵PID:4336
-
\??\c:\bbbnnh.exec:\bbbnnh.exe126⤵PID:2364
-
\??\c:\dvpjv.exec:\dvpjv.exe127⤵PID:4964
-
\??\c:\ddjpv.exec:\ddjpv.exe128⤵PID:3940
-
\??\c:\jdjjj.exec:\jdjjj.exe129⤵PID:4112
-
\??\c:\rrrxrrl.exec:\rrrxrrl.exe130⤵PID:4272
-
\??\c:\3bhbbb.exec:\3bhbbb.exe131⤵PID:4048
-
\??\c:\3bthth.exec:\3bthth.exe132⤵PID:3832
-
\??\c:\vjdvv.exec:\vjdvv.exe133⤵PID:3460
-
\??\c:\3jpjj.exec:\3jpjj.exe134⤵PID:3604
-
\??\c:\ffxrlfx.exec:\ffxrlfx.exe135⤵PID:3724
-
\??\c:\rllfxxf.exec:\rllfxxf.exe136⤵PID:3568
-
\??\c:\1tbnnt.exec:\1tbnnt.exe137⤵PID:1136
-
\??\c:\ddjpp.exec:\ddjpp.exe138⤵PID:2780
-
\??\c:\9pjdd.exec:\9pjdd.exe139⤵PID:2944
-
\??\c:\rflfxrl.exec:\rflfxrl.exe140⤵PID:320
-
\??\c:\9thbtt.exec:\9thbtt.exe141⤵PID:1068
-
\??\c:\ppvjv.exec:\ppvjv.exe142⤵PID:2184
-
\??\c:\vvdpj.exec:\vvdpj.exe143⤵PID:3468
-
\??\c:\lfflfxx.exec:\lfflfxx.exe144⤵PID:2600
-
\??\c:\bbnnhn.exec:\bbnnhn.exe145⤵PID:1044
-
\??\c:\3hnhtt.exec:\3hnhtt.exe146⤵PID:1580
-
\??\c:\ppvdd.exec:\ppvdd.exe147⤵PID:316
-
\??\c:\vppjv.exec:\vppjv.exe148⤵PID:984
-
\??\c:\rrxrllf.exec:\rrxrllf.exe149⤵PID:5072
-
\??\c:\hnhbtt.exec:\hnhbtt.exe150⤵PID:1448
-
\??\c:\pdjdj.exec:\pdjdj.exe151⤵PID:3828
-
\??\c:\pjppp.exec:\pjppp.exe152⤵PID:2424
-
\??\c:\7vdpd.exec:\7vdpd.exe153⤵PID:1584
-
\??\c:\ffffflf.exec:\ffffflf.exe154⤵PID:1924
-
\??\c:\hbnhnb.exec:\hbnhnb.exe155⤵PID:980
-
\??\c:\vpppj.exec:\vpppj.exe156⤵PID:5036
-
\??\c:\jvddd.exec:\jvddd.exe157⤵PID:640
-
\??\c:\frfxrrl.exec:\frfxrrl.exe158⤵PID:4884
-
\??\c:\rlfxffr.exec:\rlfxffr.exe159⤵PID:4376
-
\??\c:\tnbttt.exec:\tnbttt.exe160⤵PID:3140
-
\??\c:\tnhbtt.exec:\tnhbtt.exe161⤵PID:4960
-
\??\c:\lllfrrf.exec:\lllfrrf.exe162⤵PID:4856
-
\??\c:\3xrlfll.exec:\3xrlfll.exe163⤵PID:2512
-
\??\c:\bhnnnt.exec:\bhnnnt.exe164⤵PID:8
-
\??\c:\9tnhtt.exec:\9tnhtt.exe165⤵PID:2088
-
\??\c:\1djjd.exec:\1djjd.exe166⤵PID:4056
-
\??\c:\jdvpp.exec:\jdvpp.exe167⤵PID:4360
-
\??\c:\5xfxrrf.exec:\5xfxrrf.exe168⤵PID:4168
-
\??\c:\1llfxxr.exec:\1llfxxr.exe169⤵PID:1420
-
\??\c:\tnnhbb.exec:\tnnhbb.exe170⤵PID:4092
-
\??\c:\tnhbnn.exec:\tnhbnn.exe171⤵PID:4104
-
\??\c:\pjvdv.exec:\pjvdv.exe172⤵PID:4088
-
\??\c:\vppjd.exec:\vppjd.exe173⤵PID:3680
-
\??\c:\lffllll.exec:\lffllll.exe174⤵PID:4528
-
\??\c:\5lxrrrx.exec:\5lxrrrx.exe175⤵PID:3260
-
\??\c:\htbttb.exec:\htbttb.exe176⤵PID:3448
-
\??\c:\1ttnhh.exec:\1ttnhh.exe177⤵PID:3552
-
\??\c:\dvvpj.exec:\dvvpj.exe178⤵PID:3000
-
\??\c:\fflrlfl.exec:\fflrlfl.exe179⤵PID:3144
-
\??\c:\fxxrllf.exec:\fxxrllf.exe180⤵PID:2052
-
\??\c:\tnttnn.exec:\tnttnn.exe181⤵PID:2780
-
\??\c:\bthttt.exec:\bthttt.exe182⤵PID:2944
-
\??\c:\5pdvv.exec:\5pdvv.exe183⤵PID:1916
-
\??\c:\9jppj.exec:\9jppj.exe184⤵PID:4084
-
\??\c:\7rrlffx.exec:\7rrlffx.exe185⤵PID:2296
-
\??\c:\3bbbtt.exec:\3bbbtt.exe186⤵PID:4524
-
\??\c:\hnnnnn.exec:\hnnnnn.exe187⤵PID:5064
-
\??\c:\vpjjj.exec:\vpjjj.exe188⤵PID:4932
-
\??\c:\llxrrrx.exec:\llxrrrx.exe189⤵PID:316
-
\??\c:\lrrrrll.exec:\lrrrrll.exe190⤵PID:3032
-
\??\c:\9ttnnh.exec:\9ttnnh.exe191⤵PID:5072
-
\??\c:\tbnhhh.exec:\tbnhhh.exe192⤵PID:3220
-
\??\c:\vdddv.exec:\vdddv.exe193⤵PID:4976
-
\??\c:\ffffxxr.exec:\ffffxxr.exe194⤵PID:4332
-
\??\c:\rlfxffl.exec:\rlfxffl.exe195⤵PID:1584
-
\??\c:\3tbhht.exec:\3tbhht.exe196⤵PID:1924
-
\??\c:\9pvvv.exec:\9pvvv.exe197⤵PID:2096
-
\??\c:\lrrflll.exec:\lrrflll.exe198⤵PID:3036
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe199⤵PID:1124
-
\??\c:\bbhhhn.exec:\bbhhhn.exe200⤵PID:4784
-
\??\c:\pdjjp.exec:\pdjjp.exe201⤵PID:1824
-
\??\c:\fxlffff.exec:\fxlffff.exe202⤵PID:64
-
\??\c:\fxfffff.exec:\fxfffff.exe203⤵PID:2540
-
\??\c:\thtttt.exec:\thtttt.exe204⤵PID:4856
-
\??\c:\1ththh.exec:\1ththh.exe205⤵PID:4440
-
\??\c:\tnbbbb.exec:\tnbbbb.exe206⤵PID:2512
-
\??\c:\jvdjv.exec:\jvdjv.exe207⤵PID:3564
-
\??\c:\fxrflxl.exec:\fxrflxl.exe208⤵PID:1188
-
\??\c:\lxlrfxl.exec:\lxlrfxl.exe209⤵PID:3644
-
\??\c:\tthhtt.exec:\tthhtt.exe210⤵PID:1432
-
\??\c:\nhhbtt.exec:\nhhbtt.exe211⤵PID:4168
-
\??\c:\dddvv.exec:\dddvv.exe212⤵PID:1216
-
\??\c:\vpdvv.exec:\vpdvv.exe213⤵PID:4112
-
\??\c:\fxfxrll.exec:\fxfxrll.exe214⤵PID:5052
-
\??\c:\hnbtnh.exec:\hnbtnh.exe215⤵PID:4572
-
\??\c:\thnhht.exec:\thnhht.exe216⤵PID:3700
-
\??\c:\vvjjj.exec:\vvjjj.exe217⤵PID:1636
-
\??\c:\pdjjd.exec:\pdjjd.exe218⤵PID:532
-
\??\c:\rfxrllf.exec:\rfxrllf.exe219⤵PID:4464
-
\??\c:\5llrllf.exec:\5llrllf.exe220⤵PID:3568
-
\??\c:\nhnnhh.exec:\nhnnhh.exe221⤵PID:4680
-
\??\c:\vppjd.exec:\vppjd.exe222⤵PID:4916
-
\??\c:\9vvvj.exec:\9vvvj.exe223⤵PID:2780
-
\??\c:\ppvvd.exec:\ppvvd.exe224⤵PID:4016
-
\??\c:\xfrlfff.exec:\xfrlfff.exe225⤵PID:2440
-
\??\c:\xxlrxxl.exec:\xxlrxxl.exe226⤵PID:4796
-
\??\c:\1bhhnn.exec:\1bhhnn.exe227⤵PID:2580
-
\??\c:\ppjdv.exec:\ppjdv.exe228⤵PID:1484
-
\??\c:\vdpdv.exec:\vdpdv.exe229⤵PID:2156
-
\??\c:\xrrrlll.exec:\xrrrlll.exe230⤵PID:984
-
\??\c:\3rxxrxr.exec:\3rxxrxr.exe231⤵PID:1724
-
\??\c:\ntbtbb.exec:\ntbtbb.exe232⤵PID:2248
-
\??\c:\tthbbb.exec:\tthbbb.exe233⤵PID:1448
-
\??\c:\djdvv.exec:\djdvv.exe234⤵PID:2400
-
\??\c:\pjpjp.exec:\pjpjp.exe235⤵PID:2424
-
\??\c:\fxffxxr.exec:\fxffxxr.exe236⤵PID:2684
-
\??\c:\1ntnht.exec:\1ntnht.exe237⤵PID:4712
-
\??\c:\3tttnh.exec:\3tttnh.exe238⤵PID:980
-
\??\c:\pjpjd.exec:\pjpjd.exe239⤵PID:5036
-
\??\c:\7ddvp.exec:\7ddvp.exe240⤵PID:1500
-
\??\c:\ffxxffl.exec:\ffxxffl.exe241⤵PID:4364
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe242⤵PID:4956