Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 21:03
Behavioral task
behavioral1
Sample
432d5a3ae6d5f41aff2e05dcd60668d6394a163b338cedb8433f8b19e2d6af3c.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
432d5a3ae6d5f41aff2e05dcd60668d6394a163b338cedb8433f8b19e2d6af3c.exe
-
Size
107KB
-
MD5
5ad2be8311f53baa3542d02794c5eff7
-
SHA1
b1dd0e76ae240a30e1e41704b89b47c034d2ad27
-
SHA256
432d5a3ae6d5f41aff2e05dcd60668d6394a163b338cedb8433f8b19e2d6af3c
-
SHA512
4e4e22af0da9595fd3559434b4f9d537b9d0b1edb0d74ac93bb2e31c024b9e061a9d02b44878c252f295f5aad3617e54863eaba3be494c675c53efe34ef42ff5
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66krop7BcgX:kcm4FmowdHoSphraHcp7yO
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4840-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2620-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1384-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4676-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/932-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2068-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4076-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1440-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4444-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2064-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3184-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4760-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1968-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4108-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/748-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4140-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2264-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/636-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3872-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3872-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1160-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2332-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3876-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4740-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2988-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2256-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2728-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/932-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2960-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-506-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3992-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3144-562-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/812-578-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4744-595-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1208-613-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4616-631-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-665-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4200-672-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-718-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2228-791-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1376-998-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4248-1061-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4840-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lllffrf.exe UPX behavioral2/memory/4840-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1152-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\fxrrllf.exe UPX C:\1nbbhh.exe UPX behavioral2/memory/2620-14-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1384-19-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jddvp.exe UPX behavioral2/memory/1384-25-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4676-30-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xxfxllf.exe UPX \??\c:\xxlrllx.exe UPX behavioral2/memory/4180-39-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3624-35-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tttntn.exe UPX behavioral2/memory/4936-48-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9vjdv.exe UPX C:\vpvjj.exe UPX behavioral2/memory/932-55-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1800-56-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rflfrll.exe UPX behavioral2/memory/1800-62-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2068-64-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nhtbbb.exe UPX C:\5ppjj.exe UPX behavioral2/memory/3980-79-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\jjjdd.exe UPX behavioral2/memory/4824-81-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5frlrxf.exe UPX C:\bhntnn.exe UPX C:\pjpjj.exe UPX \??\c:\vdppd.exe UPX behavioral2/memory/4076-104-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rrlfffl.exe UPX C:\bbtnnh.exe UPX behavioral2/memory/4540-112-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bthhhh.exe UPX behavioral2/memory/1440-117-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1440-122-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7pppp.exe UPX \??\c:\djppj.exe UPX C:\xrfxxxf.exe UPX C:\ffllfff.exe UPX behavioral2/memory/4444-138-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2064-144-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hthbtt.exe UPX C:\9pdvj.exe UPX C:\pjvpj.exe UPX behavioral2/memory/3716-156-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\lrrllll.exe UPX behavioral2/memory/3716-161-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hnbtbb.exe UPX behavioral2/memory/3184-168-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hbhbtb.exe UPX behavioral2/memory/4760-174-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3048-176-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vppjp.exe UPX behavioral2/memory/1968-181-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\1jpjd.exe UPX behavioral2/memory/3020-192-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4108-190-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/748-201-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4480-205-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
lllffrf.exefxrrllf.exe1nbbhh.exejddvp.exexxfxllf.exexxlrllx.exetttntn.exe9vjdv.exevpvjj.exerflfrll.exenhtbbb.exe5ppjj.exejjjdd.exe5frlrxf.exebhntnn.exepjpjj.exevdppd.exerrlfffl.exebbtnnh.exebthhhh.exe7pppp.exedjppj.exexrfxxxf.exeffllfff.exehthbtt.exe9pdvj.exepjvpj.exelrrllll.exehnbtbb.exehbhbtb.exevppjp.exe1jpjd.exefxxxxll.exennnnhh.exehbnnnt.exejjppd.exe3lrxrxr.exerxxfxxr.exebhnttt.exeddddp.exedvdjd.exerfxrfrx.exefrxrlll.exettttnb.exepdjjd.exejvdvj.exe3xffffl.exerlrrxxx.exenhbtbt.exetnbbhh.exedpppd.exevvppj.exefllfxlr.exerlxxxfl.exebbttnt.exe7jppd.exevjjvp.exexllfxxr.exe7rrrlll.exebtbbhn.exehtbnhh.exedpdjp.exedvdvv.exe5lllxff.exepid process 1152 lllffrf.exe 2620 fxrrllf.exe 1384 1nbbhh.exe 4676 jddvp.exe 3624 xxfxllf.exe 4180 xxlrllx.exe 4936 tttntn.exe 932 9vjdv.exe 1800 vpvjj.exe 2068 rflfrll.exe 1424 nhtbbb.exe 3980 5ppjj.exe 4824 jjjdd.exe 4248 5frlrxf.exe 3528 bhntnn.exe 1160 pjpjj.exe 4076 vdppd.exe 756 rrlfffl.exe 4540 bbtnnh.exe 1440 bthhhh.exe 3664 7pppp.exe 4616 djppj.exe 4444 xrfxxxf.exe 2064 ffllfff.exe 3168 hthbtt.exe 4068 9pdvj.exe 3716 pjvpj.exe 3184 lrrllll.exe 4760 hnbtbb.exe 3048 hbhbtb.exe 1968 vppjp.exe 4108 1jpjd.exe 3020 fxxxxll.exe 1868 nnnnhh.exe 748 hbnnnt.exe 4480 jjppd.exe 4140 3lrxrxr.exe 2728 rxxfxxr.exe 4472 bhnttt.exe 2100 ddddp.exe 1712 dvdjd.exe 1872 rfxrfrx.exe 4852 frxrlll.exe 3144 ttttnb.exe 2264 pdjjd.exe 2260 jvdvj.exe 636 3xffffl.exe 2276 rlrrxxx.exe 1816 nhbtbt.exe 2604 tnbbhh.exe 2568 dpppd.exe 5048 vvppj.exe 4492 fllfxlr.exe 860 rlxxxfl.exe 3872 bbttnt.exe 2160 7jppd.exe 4248 vjjvp.exe 1536 xllfxxr.exe 1160 7rrrlll.exe 3604 btbbhn.exe 3672 htbnhh.exe 3864 dpdjp.exe 4992 dvdvv.exe 1244 5lllxff.exe -
Processes:
resource yara_rule behavioral2/memory/4840-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lllffrf.exe upx behavioral2/memory/4840-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1152-8-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxrrllf.exe upx C:\1nbbhh.exe upx behavioral2/memory/2620-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1384-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jddvp.exe upx behavioral2/memory/1384-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4676-30-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxfxllf.exe upx \??\c:\xxlrllx.exe upx behavioral2/memory/4180-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3624-35-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tttntn.exe upx behavioral2/memory/4936-48-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9vjdv.exe upx C:\vpvjj.exe upx behavioral2/memory/932-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1800-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rflfrll.exe upx behavioral2/memory/1800-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2068-64-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhtbbb.exe upx C:\5ppjj.exe upx behavioral2/memory/3980-79-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jjjdd.exe upx behavioral2/memory/4824-81-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5frlrxf.exe upx C:\bhntnn.exe upx C:\pjpjj.exe upx \??\c:\vdppd.exe upx behavioral2/memory/4076-104-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrlfffl.exe upx C:\bbtnnh.exe upx behavioral2/memory/4540-112-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bthhhh.exe upx behavioral2/memory/1440-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1440-122-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7pppp.exe upx \??\c:\djppj.exe upx C:\xrfxxxf.exe upx C:\ffllfff.exe upx behavioral2/memory/4444-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2064-144-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hthbtt.exe upx C:\9pdvj.exe upx C:\pjvpj.exe upx behavioral2/memory/3716-156-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lrrllll.exe upx behavioral2/memory/3716-161-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hnbtbb.exe upx behavioral2/memory/3184-168-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbhbtb.exe upx behavioral2/memory/4760-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3048-176-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vppjp.exe upx behavioral2/memory/1968-181-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1jpjd.exe upx behavioral2/memory/3020-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4108-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/748-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4480-205-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
432d5a3ae6d5f41aff2e05dcd60668d6394a163b338cedb8433f8b19e2d6af3c.exelllffrf.exefxrrllf.exe1nbbhh.exejddvp.exexxfxllf.exexxlrllx.exetttntn.exe9vjdv.exevpvjj.exerflfrll.exenhtbbb.exe5ppjj.exejjjdd.exe5frlrxf.exebhntnn.exepjpjj.exevdppd.exerrlfffl.exebbtnnh.exebthhhh.exe7pppp.exedescription pid process target process PID 4840 wrote to memory of 1152 4840 432d5a3ae6d5f41aff2e05dcd60668d6394a163b338cedb8433f8b19e2d6af3c.exe lllffrf.exe PID 4840 wrote to memory of 1152 4840 432d5a3ae6d5f41aff2e05dcd60668d6394a163b338cedb8433f8b19e2d6af3c.exe lllffrf.exe PID 4840 wrote to memory of 1152 4840 432d5a3ae6d5f41aff2e05dcd60668d6394a163b338cedb8433f8b19e2d6af3c.exe lllffrf.exe PID 1152 wrote to memory of 2620 1152 lllffrf.exe fxrrllf.exe PID 1152 wrote to memory of 2620 1152 lllffrf.exe fxrrllf.exe PID 1152 wrote to memory of 2620 1152 lllffrf.exe fxrrllf.exe PID 2620 wrote to memory of 1384 2620 fxrrllf.exe 1nbbhh.exe PID 2620 wrote to memory of 1384 2620 fxrrllf.exe 1nbbhh.exe PID 2620 wrote to memory of 1384 2620 fxrrllf.exe 1nbbhh.exe PID 1384 wrote to memory of 4676 1384 1nbbhh.exe jddvp.exe PID 1384 wrote to memory of 4676 1384 1nbbhh.exe jddvp.exe PID 1384 wrote to memory of 4676 1384 1nbbhh.exe jddvp.exe PID 4676 wrote to memory of 3624 4676 jddvp.exe xxfxllf.exe PID 4676 wrote to memory of 3624 4676 jddvp.exe xxfxllf.exe PID 4676 wrote to memory of 3624 4676 jddvp.exe xxfxllf.exe PID 3624 wrote to memory of 4180 3624 xxfxllf.exe xxlrllx.exe PID 3624 wrote to memory of 4180 3624 xxfxllf.exe xxlrllx.exe PID 3624 wrote to memory of 4180 3624 xxfxllf.exe xxlrllx.exe PID 4180 wrote to memory of 4936 4180 xxlrllx.exe tttntn.exe PID 4180 wrote to memory of 4936 4180 xxlrllx.exe tttntn.exe PID 4180 wrote to memory of 4936 4180 xxlrllx.exe tttntn.exe PID 4936 wrote to memory of 932 4936 tttntn.exe 9vjdv.exe PID 4936 wrote to memory of 932 4936 tttntn.exe 9vjdv.exe PID 4936 wrote to memory of 932 4936 tttntn.exe 9vjdv.exe PID 932 wrote to memory of 1800 932 9vjdv.exe vpvjj.exe PID 932 wrote to memory of 1800 932 9vjdv.exe vpvjj.exe PID 932 wrote to memory of 1800 932 9vjdv.exe vpvjj.exe PID 1800 wrote to memory of 2068 1800 vpvjj.exe rflfrll.exe PID 1800 wrote to memory of 2068 1800 vpvjj.exe rflfrll.exe PID 1800 wrote to memory of 2068 1800 vpvjj.exe rflfrll.exe PID 2068 wrote to memory of 1424 2068 rflfrll.exe nhtbbb.exe PID 2068 wrote to memory of 1424 2068 rflfrll.exe nhtbbb.exe PID 2068 wrote to memory of 1424 2068 rflfrll.exe nhtbbb.exe PID 1424 wrote to memory of 3980 1424 nhtbbb.exe 5ppjj.exe PID 1424 wrote to memory of 3980 1424 nhtbbb.exe 5ppjj.exe PID 1424 wrote to memory of 3980 1424 nhtbbb.exe 5ppjj.exe PID 3980 wrote to memory of 4824 3980 5ppjj.exe jjjdd.exe PID 3980 wrote to memory of 4824 3980 5ppjj.exe jjjdd.exe PID 3980 wrote to memory of 4824 3980 5ppjj.exe jjjdd.exe PID 4824 wrote to memory of 4248 4824 jjjdd.exe 5frlrxf.exe PID 4824 wrote to memory of 4248 4824 jjjdd.exe 5frlrxf.exe PID 4824 wrote to memory of 4248 4824 jjjdd.exe 5frlrxf.exe PID 4248 wrote to memory of 3528 4248 5frlrxf.exe bhntnn.exe PID 4248 wrote to memory of 3528 4248 5frlrxf.exe bhntnn.exe PID 4248 wrote to memory of 3528 4248 5frlrxf.exe bhntnn.exe PID 3528 wrote to memory of 1160 3528 bhntnn.exe pjpjj.exe PID 3528 wrote to memory of 1160 3528 bhntnn.exe pjpjj.exe PID 3528 wrote to memory of 1160 3528 bhntnn.exe pjpjj.exe PID 1160 wrote to memory of 4076 1160 pjpjj.exe vdppd.exe PID 1160 wrote to memory of 4076 1160 pjpjj.exe vdppd.exe PID 1160 wrote to memory of 4076 1160 pjpjj.exe vdppd.exe PID 4076 wrote to memory of 756 4076 vdppd.exe rrlfffl.exe PID 4076 wrote to memory of 756 4076 vdppd.exe rrlfffl.exe PID 4076 wrote to memory of 756 4076 vdppd.exe rrlfffl.exe PID 756 wrote to memory of 4540 756 rrlfffl.exe bbtnnh.exe PID 756 wrote to memory of 4540 756 rrlfffl.exe bbtnnh.exe PID 756 wrote to memory of 4540 756 rrlfffl.exe bbtnnh.exe PID 4540 wrote to memory of 1440 4540 bbtnnh.exe bthhhh.exe PID 4540 wrote to memory of 1440 4540 bbtnnh.exe bthhhh.exe PID 4540 wrote to memory of 1440 4540 bbtnnh.exe bthhhh.exe PID 1440 wrote to memory of 3664 1440 bthhhh.exe 7pppp.exe PID 1440 wrote to memory of 3664 1440 bthhhh.exe 7pppp.exe PID 1440 wrote to memory of 3664 1440 bthhhh.exe 7pppp.exe PID 3664 wrote to memory of 4616 3664 7pppp.exe djppj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\432d5a3ae6d5f41aff2e05dcd60668d6394a163b338cedb8433f8b19e2d6af3c.exe"C:\Users\Admin\AppData\Local\Temp\432d5a3ae6d5f41aff2e05dcd60668d6394a163b338cedb8433f8b19e2d6af3c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\lllffrf.exec:\lllffrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\fxrrllf.exec:\fxrrllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\1nbbhh.exec:\1nbbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\jddvp.exec:\jddvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\xxfxllf.exec:\xxfxllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\xxlrllx.exec:\xxlrllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\tttntn.exec:\tttntn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\9vjdv.exec:\9vjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\vpvjj.exec:\vpvjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\rflfrll.exec:\rflfrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\nhtbbb.exec:\nhtbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\5ppjj.exec:\5ppjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\jjjdd.exec:\jjjdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\5frlrxf.exec:\5frlrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\bhntnn.exec:\bhntnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\pjpjj.exec:\pjpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\vdppd.exec:\vdppd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\rrlfffl.exec:\rrlfffl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\bbtnnh.exec:\bbtnnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\bthhhh.exec:\bthhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\7pppp.exec:\7pppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\djppj.exec:\djppj.exe23⤵
- Executes dropped EXE
PID:4616 -
\??\c:\xrfxxxf.exec:\xrfxxxf.exe24⤵
- Executes dropped EXE
PID:4444 -
\??\c:\ffllfff.exec:\ffllfff.exe25⤵
- Executes dropped EXE
PID:2064 -
\??\c:\hthbtt.exec:\hthbtt.exe26⤵
- Executes dropped EXE
PID:3168 -
\??\c:\9pdvj.exec:\9pdvj.exe27⤵
- Executes dropped EXE
PID:4068 -
\??\c:\pjvpj.exec:\pjvpj.exe28⤵
- Executes dropped EXE
PID:3716 -
\??\c:\lrrllll.exec:\lrrllll.exe29⤵
- Executes dropped EXE
PID:3184 -
\??\c:\hnbtbb.exec:\hnbtbb.exe30⤵
- Executes dropped EXE
PID:4760 -
\??\c:\hbhbtb.exec:\hbhbtb.exe31⤵
- Executes dropped EXE
PID:3048 -
\??\c:\vppjp.exec:\vppjp.exe32⤵
- Executes dropped EXE
PID:1968 -
\??\c:\1jpjd.exec:\1jpjd.exe33⤵
- Executes dropped EXE
PID:4108 -
\??\c:\fxxxxll.exec:\fxxxxll.exe34⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nnnnhh.exec:\nnnnhh.exe35⤵
- Executes dropped EXE
PID:1868 -
\??\c:\hbnnnt.exec:\hbnnnt.exe36⤵
- Executes dropped EXE
PID:748 -
\??\c:\jjppd.exec:\jjppd.exe37⤵
- Executes dropped EXE
PID:4480 -
\??\c:\3lrxrxr.exec:\3lrxrxr.exe38⤵
- Executes dropped EXE
PID:4140 -
\??\c:\rxxfxxr.exec:\rxxfxxr.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bhnttt.exec:\bhnttt.exe40⤵
- Executes dropped EXE
PID:4472 -
\??\c:\ddddp.exec:\ddddp.exe41⤵
- Executes dropped EXE
PID:2100 -
\??\c:\dvdjd.exec:\dvdjd.exe42⤵
- Executes dropped EXE
PID:1712 -
\??\c:\rfxrfrx.exec:\rfxrfrx.exe43⤵
- Executes dropped EXE
PID:1872 -
\??\c:\frxrlll.exec:\frxrlll.exe44⤵
- Executes dropped EXE
PID:4852 -
\??\c:\ttttnb.exec:\ttttnb.exe45⤵
- Executes dropped EXE
PID:3144 -
\??\c:\pdjjd.exec:\pdjjd.exe46⤵
- Executes dropped EXE
PID:2264 -
\??\c:\jvdvj.exec:\jvdvj.exe47⤵
- Executes dropped EXE
PID:2260 -
\??\c:\3xffffl.exec:\3xffffl.exe48⤵
- Executes dropped EXE
PID:636 -
\??\c:\rlrrxxx.exec:\rlrrxxx.exe49⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nhbtbt.exec:\nhbtbt.exe50⤵
- Executes dropped EXE
PID:1816 -
\??\c:\tnbbhh.exec:\tnbbhh.exe51⤵
- Executes dropped EXE
PID:2604 -
\??\c:\dpppd.exec:\dpppd.exe52⤵
- Executes dropped EXE
PID:2568 -
\??\c:\vvppj.exec:\vvppj.exe53⤵
- Executes dropped EXE
PID:5048 -
\??\c:\fllfxlr.exec:\fllfxlr.exe54⤵
- Executes dropped EXE
PID:4492 -
\??\c:\rlxxxfl.exec:\rlxxxfl.exe55⤵
- Executes dropped EXE
PID:860 -
\??\c:\bbttnt.exec:\bbttnt.exe56⤵
- Executes dropped EXE
PID:3872 -
\??\c:\7jppd.exec:\7jppd.exe57⤵
- Executes dropped EXE
PID:2160 -
\??\c:\vjjvp.exec:\vjjvp.exe58⤵
- Executes dropped EXE
PID:4248 -
\??\c:\xllfxxr.exec:\xllfxxr.exe59⤵
- Executes dropped EXE
PID:1536 -
\??\c:\7rrrlll.exec:\7rrrlll.exe60⤵
- Executes dropped EXE
PID:1160 -
\??\c:\btbbhn.exec:\btbbhn.exe61⤵
- Executes dropped EXE
PID:3604 -
\??\c:\htbnhh.exec:\htbnhh.exe62⤵
- Executes dropped EXE
PID:3672 -
\??\c:\dpdjp.exec:\dpdjp.exe63⤵
- Executes dropped EXE
PID:3864 -
\??\c:\dvdvv.exec:\dvdvv.exe64⤵
- Executes dropped EXE
PID:4992 -
\??\c:\5lllxff.exec:\5lllxff.exe65⤵
- Executes dropped EXE
PID:1244 -
\??\c:\5lxlflf.exec:\5lxlflf.exe66⤵PID:2332
-
\??\c:\1thbtt.exec:\1thbtt.exe67⤵PID:856
-
\??\c:\7jppp.exec:\7jppp.exe68⤵PID:724
-
\??\c:\pvjvp.exec:\pvjvp.exe69⤵PID:4864
-
\??\c:\fxxxlll.exec:\fxxxlll.exe70⤵PID:4624
-
\??\c:\1flffff.exec:\1flffff.exe71⤵PID:3876
-
\??\c:\bbbtbb.exec:\bbbtbb.exe72⤵PID:1580
-
\??\c:\pvdjj.exec:\pvdjj.exe73⤵PID:2988
-
\??\c:\ddpjd.exec:\ddpjd.exe74⤵PID:3716
-
\??\c:\frllrff.exec:\frllrff.exe75⤵PID:1880
-
\??\c:\1tnnhh.exec:\1tnnhh.exe76⤵PID:4760
-
\??\c:\hthbtt.exec:\hthbtt.exe77⤵PID:3240
-
\??\c:\5jjpd.exec:\5jjpd.exe78⤵PID:3048
-
\??\c:\7pvdv.exec:\7pvdv.exe79⤵PID:3584
-
\??\c:\frrrfxl.exec:\frrrfxl.exe80⤵PID:3132
-
\??\c:\1lrrlll.exec:\1lrrlll.exe81⤵PID:972
-
\??\c:\btnnhh.exec:\btnnhh.exe82⤵PID:4740
-
\??\c:\hhbbtt.exec:\hhbbtt.exe83⤵PID:3156
-
\??\c:\dddvp.exec:\dddvp.exe84⤵PID:2256
-
\??\c:\jvvpp.exec:\jvvpp.exe85⤵PID:4100
-
\??\c:\lrrxrrl.exec:\lrrxrrl.exe86⤵PID:4656
-
\??\c:\5thbtt.exec:\5thbtt.exe87⤵PID:4424
-
\??\c:\hhnhhh.exec:\hhnhhh.exe88⤵PID:4460
-
\??\c:\dvdvv.exec:\dvdvv.exe89⤵PID:2728
-
\??\c:\jddvp.exec:\jddvp.exe90⤵PID:4472
-
\??\c:\xfrlffl.exec:\xfrlffl.exe91⤵PID:2916
-
\??\c:\3hbbtb.exec:\3hbbtb.exe92⤵PID:1712
-
\??\c:\bhnnnb.exec:\bhnnnb.exe93⤵PID:1768
-
\??\c:\xxllxff.exec:\xxllxff.exe94⤵PID:3488
-
\??\c:\hbnnhn.exec:\hbnnhn.exe95⤵PID:3032
-
\??\c:\pvpjd.exec:\pvpjd.exe96⤵PID:3824
-
\??\c:\jvjjp.exec:\jvjjp.exe97⤵PID:4172
-
\??\c:\1rlfxxx.exec:\1rlfxxx.exe98⤵PID:932
-
\??\c:\rrrlffx.exec:\rrrlffx.exe99⤵PID:1444
-
\??\c:\1xrxrrx.exec:\1xrxrrx.exe100⤵PID:760
-
\??\c:\nthbbb.exec:\nthbbb.exe101⤵PID:780
-
\??\c:\thhbbn.exec:\thhbbn.exe102⤵PID:4360
-
\??\c:\7jpdv.exec:\7jpdv.exe103⤵PID:5048
-
\??\c:\1flfxxr.exec:\1flfxxr.exe104⤵PID:4492
-
\??\c:\xlfxxxr.exec:\xlfxxxr.exe105⤵PID:860
-
\??\c:\bntnhh.exec:\bntnhh.exe106⤵PID:4844
-
\??\c:\nbhbtt.exec:\nbhbtt.exe107⤵PID:2160
-
\??\c:\jjddp.exec:\jjddp.exe108⤵PID:4952
-
\??\c:\pjjdv.exec:\pjjdv.exe109⤵PID:1536
-
\??\c:\xrllxxf.exec:\xrllxxf.exe110⤵PID:1296
-
\??\c:\xllxlrr.exec:\xllxlrr.exe111⤵PID:4884
-
\??\c:\btnnnb.exec:\btnnnb.exe112⤵PID:1236
-
\??\c:\pjjdd.exec:\pjjdd.exe113⤵PID:4640
-
\??\c:\dvppj.exec:\dvppj.exe114⤵PID:4992
-
\??\c:\frxxxxr.exec:\frxxxxr.exe115⤵PID:1244
-
\??\c:\3hnnnn.exec:\3hnnnn.exe116⤵PID:1884
-
\??\c:\9htnnt.exec:\9htnnt.exe117⤵PID:4856
-
\??\c:\hbhbbt.exec:\hbhbbt.exe118⤵PID:2792
-
\??\c:\vvjdv.exec:\vvjdv.exe119⤵PID:428
-
\??\c:\llxlrrf.exec:\llxlrrf.exe120⤵PID:3168
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe121⤵PID:4684
-
\??\c:\bttthh.exec:\bttthh.exe122⤵PID:1664
-
\??\c:\nntnnn.exec:\nntnnn.exe123⤵PID:4904
-
\??\c:\dvdjd.exec:\dvdjd.exe124⤵PID:2960
-
\??\c:\jvddv.exec:\jvddv.exe125⤵PID:2888
-
\??\c:\fllflxl.exec:\fllflxl.exe126⤵PID:4892
-
\??\c:\hhhhhh.exec:\hhhhhh.exe127⤵PID:3240
-
\??\c:\nhhbtt.exec:\nhhbtt.exe128⤵PID:664
-
\??\c:\vdddp.exec:\vdddp.exe129⤵PID:3052
-
\??\c:\9frlfll.exec:\9frlfll.exe130⤵PID:3636
-
\??\c:\xlrffrx.exec:\xlrffrx.exe131⤵PID:544
-
\??\c:\btnnbt.exec:\btnnbt.exe132⤵PID:2408
-
\??\c:\7bhtnn.exec:\7bhtnn.exe133⤵PID:3992
-
\??\c:\5pvpj.exec:\5pvpj.exe134⤵PID:3220
-
\??\c:\9llrlll.exec:\9llrlll.exe135⤵PID:2368
-
\??\c:\1flffff.exec:\1flffff.exe136⤵PID:1452
-
\??\c:\hnbbbn.exec:\hnbbbn.exe137⤵PID:4424
-
\??\c:\5nnhbb.exec:\5nnhbb.exe138⤵PID:2148
-
\??\c:\pvvdd.exec:\pvvdd.exe139⤵PID:4828
-
\??\c:\rrlffff.exec:\rrlffff.exe140⤵PID:2760
-
\??\c:\fxflrlx.exec:\fxflrlx.exe141⤵PID:2948
-
\??\c:\5nbbhh.exec:\5nbbhh.exe142⤵PID:3848
-
\??\c:\tnhbtb.exec:\tnhbtb.exe143⤵PID:4852
-
\??\c:\5rrrlxx.exec:\5rrrlxx.exe144⤵PID:3144
-
\??\c:\nttnhh.exec:\nttnhh.exe145⤵PID:1532
-
\??\c:\1thbtt.exec:\1thbtt.exe146⤵PID:3828
-
\??\c:\ppjjd.exec:\ppjjd.exe147⤵PID:1808
-
\??\c:\5jjjd.exec:\5jjjd.exe148⤵PID:4412
-
\??\c:\llrrllf.exec:\llrrllf.exe149⤵PID:812
-
\??\c:\5fxxxxx.exec:\5fxxxxx.exe150⤵PID:760
-
\??\c:\htttnt.exec:\htttnt.exe151⤵PID:2568
-
\??\c:\hnbbnn.exec:\hnbbnn.exe152⤵PID:4360
-
\??\c:\jddpj.exec:\jddpj.exe153⤵PID:5048
-
\??\c:\djpdv.exec:\djpdv.exe154⤵PID:4824
-
\??\c:\fllfxxx.exec:\fllfxxx.exe155⤵PID:4744
-
\??\c:\5lrlrrr.exec:\5lrlrrr.exe156⤵PID:2656
-
\??\c:\5bbhbb.exec:\5bbhbb.exe157⤵PID:1976
-
\??\c:\bhhnhh.exec:\bhhnhh.exe158⤵PID:4836
-
\??\c:\9jjdv.exec:\9jjdv.exe159⤵PID:1160
-
\??\c:\7vddv.exec:\7vddv.exe160⤵PID:1208
-
\??\c:\dvdvd.exec:\dvdvd.exe161⤵PID:3652
-
\??\c:\rllflll.exec:\rllflll.exe162⤵PID:4540
-
\??\c:\rlxxrrx.exec:\rlxxrrx.exe163⤵PID:4512
-
\??\c:\3htnbb.exec:\3htnbb.exe164⤵PID:3664
-
\??\c:\thhhbb.exec:\thhhbb.exe165⤵PID:3172
-
\??\c:\jdjvp.exec:\jdjvp.exe166⤵PID:4616
-
\??\c:\dvvpd.exec:\dvvpd.exe167⤵PID:2040
-
\??\c:\fllllll.exec:\fllllll.exe168⤵PID:1356
-
\??\c:\1nnhhh.exec:\1nnhhh.exe169⤵PID:1188
-
\??\c:\ppvvv.exec:\ppvvv.exe170⤵PID:432
-
\??\c:\frrlxxx.exec:\frrlxxx.exe171⤵PID:3524
-
\??\c:\frrxxxx.exec:\frrxxxx.exe172⤵PID:3760
-
\??\c:\thnhht.exec:\thnhht.exe173⤵PID:1280
-
\??\c:\bhhhbh.exec:\bhhhbh.exe174⤵PID:3184
-
\??\c:\9pjpp.exec:\9pjpp.exe175⤵PID:708
-
\??\c:\jpvpv.exec:\jpvpv.exe176⤵PID:3140
-
\??\c:\9lxxrrr.exec:\9lxxrrr.exe177⤵PID:3592
-
\??\c:\5thhbt.exec:\5thhbt.exe178⤵PID:3540
-
\??\c:\hhnnbn.exec:\hhnnbn.exe179⤵PID:4200
-
\??\c:\jjddv.exec:\jjddv.exe180⤵PID:1572
-
\??\c:\ffllffx.exec:\ffllffx.exe181⤵PID:548
-
\??\c:\rllfrrr.exec:\rllfrrr.exe182⤵PID:3412
-
\??\c:\thbnth.exec:\thbnth.exe183⤵PID:3340
-
\??\c:\bbnhbh.exec:\bbnhbh.exe184⤵PID:4100
-
\??\c:\vvvvp.exec:\vvvvp.exe185⤵PID:2484
-
\??\c:\1pjjd.exec:\1pjjd.exe186⤵PID:2368
-
\??\c:\rxlrlrl.exec:\rxlrlrl.exe187⤵PID:4388
-
\??\c:\rrfxffl.exec:\rrfxffl.exe188⤵PID:4660
-
\??\c:\fxrfffr.exec:\fxrfffr.exe189⤵PID:2620
-
\??\c:\nntbht.exec:\nntbht.exe190⤵PID:2252
-
\??\c:\jdjdd.exec:\jdjdd.exe191⤵PID:2204
-
\??\c:\rxrxlff.exec:\rxrxlff.exe192⤵PID:2880
-
\??\c:\3hhhhh.exec:\3hhhhh.exe193⤵PID:3776
-
\??\c:\bnhhbb.exec:\bnhhbb.exe194⤵PID:4852
-
\??\c:\vppvd.exec:\vppvd.exe195⤵PID:2008
-
\??\c:\jjvpj.exec:\jjvpj.exe196⤵PID:4272
-
\??\c:\9xllrrr.exec:\9xllrrr.exe197⤵PID:4000
-
\??\c:\tbnbtn.exec:\tbnbtn.exe198⤵PID:1444
-
\??\c:\nbhnhh.exec:\nbhnhh.exe199⤵PID:3788
-
\??\c:\1ddvp.exec:\1ddvp.exe200⤵PID:1308
-
\??\c:\dvvpp.exec:\dvvpp.exe201⤵PID:2072
-
\??\c:\frfllrx.exec:\frfllrx.exe202⤵PID:1032
-
\??\c:\tbhbbb.exec:\tbhbbb.exe203⤵PID:3176
-
\??\c:\tbbbnt.exec:\tbbbnt.exe204⤵PID:3872
-
\??\c:\9jddp.exec:\9jddp.exe205⤵PID:436
-
\??\c:\rxfxxxx.exec:\rxfxxxx.exe206⤵PID:2656
-
\??\c:\bthbhh.exec:\bthbhh.exe207⤵PID:1976
-
\??\c:\7hnthh.exec:\7hnthh.exe208⤵PID:1340
-
\??\c:\jddvp.exec:\jddvp.exe209⤵PID:1160
-
\??\c:\dvjdd.exec:\dvjdd.exe210⤵PID:1208
-
\??\c:\1lrlffx.exec:\1lrlffx.exe211⤵PID:4944
-
\??\c:\5bhnnn.exec:\5bhnnn.exe212⤵PID:4540
-
\??\c:\5nnhhn.exec:\5nnhhn.exe213⤵PID:2932
-
\??\c:\1vvpj.exec:\1vvpj.exe214⤵PID:2348
-
\??\c:\xxxrfff.exec:\xxxrfff.exe215⤵PID:1884
-
\??\c:\fflfxxx.exec:\fflfxxx.exe216⤵PID:4568
-
\??\c:\btbttt.exec:\btbttt.exe217⤵PID:2228
-
\??\c:\hbnhnh.exec:\hbnhnh.exe218⤵PID:3168
-
\??\c:\jvdvp.exec:\jvdvp.exe219⤵PID:1188
-
\??\c:\5rrrlrr.exec:\5rrrlrr.exe220⤵PID:1540
-
\??\c:\1flllll.exec:\1flllll.exe221⤵PID:5032
-
\??\c:\btnnnn.exec:\btnnnn.exe222⤵PID:5068
-
\??\c:\nntttt.exec:\nntttt.exe223⤵PID:1552
-
\??\c:\pjjjj.exec:\pjjjj.exe224⤵PID:3184
-
\??\c:\pjjdv.exec:\pjjdv.exe225⤵PID:708
-
\??\c:\lfxxllr.exec:\lfxxllr.exe226⤵PID:3140
-
\??\c:\fxlfllf.exec:\fxlfllf.exe227⤵PID:3160
-
\??\c:\nhnhhh.exec:\nhnhhh.exe228⤵PID:1600
-
\??\c:\5djjv.exec:\5djjv.exe229⤵PID:4740
-
\??\c:\jpppd.exec:\jpppd.exe230⤵PID:3132
-
\??\c:\5flfxxx.exec:\5flfxxx.exe231⤵PID:3336
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe232⤵PID:4092
-
\??\c:\3tttnt.exec:\3tttnt.exe233⤵PID:1784
-
\??\c:\5tbbhh.exec:\5tbbhh.exe234⤵PID:1132
-
\??\c:\dvpjv.exec:\dvpjv.exe235⤵PID:4672
-
\??\c:\vvddv.exec:\vvddv.exe236⤵PID:440
-
\??\c:\rllfxxr.exec:\rllfxxr.exe237⤵PID:3960
-
\??\c:\7fxxrrr.exec:\7fxxrrr.exe238⤵PID:3680
-
\??\c:\nnbbbb.exec:\nnbbbb.exe239⤵PID:4880
-
\??\c:\hhnnnt.exec:\hhnnnt.exe240⤵PID:2900
-
\??\c:\jdvpj.exec:\jdvpj.exe241⤵PID:2836
-
\??\c:\lrrxxrr.exec:\lrrxxrr.exe242⤵PID:3488