Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 01:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
41e6e4899d212578ef8ac005908330c0.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
41e6e4899d212578ef8ac005908330c0.exe
-
Size
68KB
-
MD5
41e6e4899d212578ef8ac005908330c0
-
SHA1
0f00659260342edc5775d9ca7a901f284dcc8a38
-
SHA256
92de4763d29a69f2860c169e4eb8b1d35e9ecdba000f6e3a7f03e3b14bd6bea2
-
SHA512
e9291975f6fbeb3949cc5e72cb6f0f7d29f3263849c2a2421f17909b99611946d14ca222b833aadb7b18d1f36d0aac8490fb72dfd20ca332a415cc79d5d70957
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89JgVj:ymb3NkkiQ3mdBjFIvl358nLA89m5
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4628-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-31-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1436-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3344-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3344-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1276-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4260-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/976-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2252-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4272 nhhbhh.exe 3344 djddv.exe 4524 7ddvd.exe 1436 rffxrlf.exe 2696 1ttttt.exe 1972 jddvv.exe 1276 llllfff.exe 2636 lxffrrl.exe 4260 hnhnbt.exe 2984 ppvjv.exe 976 rllfxrl.exe 1424 bttnbt.exe 2212 1dpjd.exe 4220 lllfxrl.exe 184 rrxllll.exe 1508 hbtnht.exe 2832 9jdvv.exe 4784 rllllll.exe 3576 9lfrlxx.exe 2252 nhhbbb.exe 4124 xflfllf.exe 1604 rxfxrrl.exe 1260 hbhhbn.exe 2772 pdddd.exe 4936 rlrrlrf.exe 3984 btbbnn.exe 3320 dpvvj.exe 3512 lxfxxff.exe 1864 nhbbbb.exe 3656 bnhhhh.exe 5020 djppp.exe 1324 htbtnn.exe 1336 pjdpd.exe 2024 lflflrx.exe 4612 nhttbn.exe 4500 dvvpj.exe 704 bbnbth.exe 3356 vvdvd.exe 3252 llllfxr.exe 2688 llxrlrr.exe 3876 ttbbtn.exe 4332 5ppjv.exe 4876 frfrfll.exe 4628 rrrrrxx.exe 2944 7hhbtt.exe 876 pvjjd.exe 1480 jjddp.exe 4752 xflllll.exe 2572 hbnntt.exe 4488 bttnbt.exe 1420 7dvpd.exe 1012 xrlrrxx.exe 4684 xrllfxx.exe 2860 hnbtnh.exe 3080 nnntnh.exe 60 vpvpd.exe 2984 htbtnn.exe 388 dvjjp.exe 4816 1rrlfrl.exe 1176 3nbbnh.exe 2212 pjjdd.exe 3324 xllfffx.exe 4836 fffffll.exe 4940 hbbntt.exe -
resource yara_rule behavioral2/memory/4628-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3344-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1276-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/976-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-195-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4628 wrote to memory of 4272 4628 41e6e4899d212578ef8ac005908330c0.exe 80 PID 4628 wrote to memory of 4272 4628 41e6e4899d212578ef8ac005908330c0.exe 80 PID 4628 wrote to memory of 4272 4628 41e6e4899d212578ef8ac005908330c0.exe 80 PID 4272 wrote to memory of 3344 4272 nhhbhh.exe 81 PID 4272 wrote to memory of 3344 4272 nhhbhh.exe 81 PID 4272 wrote to memory of 3344 4272 nhhbhh.exe 81 PID 3344 wrote to memory of 4524 3344 djddv.exe 82 PID 3344 wrote to memory of 4524 3344 djddv.exe 82 PID 3344 wrote to memory of 4524 3344 djddv.exe 82 PID 4524 wrote to memory of 1436 4524 7ddvd.exe 83 PID 4524 wrote to memory of 1436 4524 7ddvd.exe 83 PID 4524 wrote to memory of 1436 4524 7ddvd.exe 83 PID 1436 wrote to memory of 2696 1436 rffxrlf.exe 85 PID 1436 wrote to memory of 2696 1436 rffxrlf.exe 85 PID 1436 wrote to memory of 2696 1436 rffxrlf.exe 85 PID 2696 wrote to memory of 1972 2696 1ttttt.exe 86 PID 2696 wrote to memory of 1972 2696 1ttttt.exe 86 PID 2696 wrote to memory of 1972 2696 1ttttt.exe 86 PID 1972 wrote to memory of 1276 1972 jddvv.exe 87 PID 1972 wrote to memory of 1276 1972 jddvv.exe 87 PID 1972 wrote to memory of 1276 1972 jddvv.exe 87 PID 1276 wrote to memory of 2636 1276 llllfff.exe 88 PID 1276 wrote to memory of 2636 1276 llllfff.exe 88 PID 1276 wrote to memory of 2636 1276 llllfff.exe 88 PID 2636 wrote to memory of 4260 2636 lxffrrl.exe 89 PID 2636 wrote to memory of 4260 2636 lxffrrl.exe 89 PID 2636 wrote to memory of 4260 2636 lxffrrl.exe 89 PID 4260 wrote to memory of 2984 4260 hnhnbt.exe 91 PID 4260 wrote to memory of 2984 4260 hnhnbt.exe 91 PID 4260 wrote to memory of 2984 4260 hnhnbt.exe 91 PID 2984 wrote to memory of 976 2984 ppvjv.exe 92 PID 2984 wrote to memory of 976 2984 ppvjv.exe 92 PID 2984 wrote to memory of 976 2984 ppvjv.exe 92 PID 976 wrote to memory of 1424 976 rllfxrl.exe 93 PID 976 wrote to memory of 1424 976 rllfxrl.exe 93 PID 976 wrote to memory of 1424 976 rllfxrl.exe 93 PID 1424 wrote to memory of 2212 1424 bttnbt.exe 94 PID 1424 wrote to memory of 2212 1424 bttnbt.exe 94 PID 1424 wrote to memory of 2212 1424 bttnbt.exe 94 PID 2212 wrote to memory of 4220 2212 1dpjd.exe 95 PID 2212 wrote to memory of 4220 2212 1dpjd.exe 95 PID 2212 wrote to memory of 4220 2212 1dpjd.exe 95 PID 4220 wrote to memory of 184 4220 lllfxrl.exe 96 PID 4220 wrote to memory of 184 4220 lllfxrl.exe 96 PID 4220 wrote to memory of 184 4220 lllfxrl.exe 96 PID 184 wrote to memory of 1508 184 rrxllll.exe 97 PID 184 wrote to memory of 1508 184 rrxllll.exe 97 PID 184 wrote to memory of 1508 184 rrxllll.exe 97 PID 1508 wrote to memory of 2832 1508 hbtnht.exe 98 PID 1508 wrote to memory of 2832 1508 hbtnht.exe 98 PID 1508 wrote to memory of 2832 1508 hbtnht.exe 98 PID 2832 wrote to memory of 4784 2832 9jdvv.exe 99 PID 2832 wrote to memory of 4784 2832 9jdvv.exe 99 PID 2832 wrote to memory of 4784 2832 9jdvv.exe 99 PID 4784 wrote to memory of 3576 4784 rllllll.exe 100 PID 4784 wrote to memory of 3576 4784 rllllll.exe 100 PID 4784 wrote to memory of 3576 4784 rllllll.exe 100 PID 3576 wrote to memory of 2252 3576 9lfrlxx.exe 102 PID 3576 wrote to memory of 2252 3576 9lfrlxx.exe 102 PID 3576 wrote to memory of 2252 3576 9lfrlxx.exe 102 PID 2252 wrote to memory of 4124 2252 nhhbbb.exe 103 PID 2252 wrote to memory of 4124 2252 nhhbbb.exe 103 PID 2252 wrote to memory of 4124 2252 nhhbbb.exe 103 PID 4124 wrote to memory of 1604 4124 xflfllf.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\41e6e4899d212578ef8ac005908330c0.exe"C:\Users\Admin\AppData\Local\Temp\41e6e4899d212578ef8ac005908330c0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\nhhbhh.exec:\nhhbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\djddv.exec:\djddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\7ddvd.exec:\7ddvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\rffxrlf.exec:\rffxrlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\1ttttt.exec:\1ttttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\jddvv.exec:\jddvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\llllfff.exec:\llllfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\lxffrrl.exec:\lxffrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\hnhnbt.exec:\hnhnbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\ppvjv.exec:\ppvjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\rllfxrl.exec:\rllfxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\bttnbt.exec:\bttnbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\1dpjd.exec:\1dpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\lllfxrl.exec:\lllfxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\rrxllll.exec:\rrxllll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:184 -
\??\c:\hbtnht.exec:\hbtnht.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\9jdvv.exec:\9jdvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\rllllll.exec:\rllllll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\9lfrlxx.exec:\9lfrlxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\nhhbbb.exec:\nhhbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\xflfllf.exec:\xflfllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\rxfxrrl.exec:\rxfxrrl.exe23⤵
- Executes dropped EXE
PID:1604 -
\??\c:\hbhhbn.exec:\hbhhbn.exe24⤵
- Executes dropped EXE
PID:1260 -
\??\c:\pdddd.exec:\pdddd.exe25⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rlrrlrf.exec:\rlrrlrf.exe26⤵
- Executes dropped EXE
PID:4936 -
\??\c:\btbbnn.exec:\btbbnn.exe27⤵
- Executes dropped EXE
PID:3984 -
\??\c:\dpvvj.exec:\dpvvj.exe28⤵
- Executes dropped EXE
PID:3320 -
\??\c:\lxfxxff.exec:\lxfxxff.exe29⤵
- Executes dropped EXE
PID:3512 -
\??\c:\nhbbbb.exec:\nhbbbb.exe30⤵
- Executes dropped EXE
PID:1864 -
\??\c:\bnhhhh.exec:\bnhhhh.exe31⤵
- Executes dropped EXE
PID:3656 -
\??\c:\djppp.exec:\djppp.exe32⤵
- Executes dropped EXE
PID:5020 -
\??\c:\htbtnn.exec:\htbtnn.exe33⤵
- Executes dropped EXE
PID:1324 -
\??\c:\pjdpd.exec:\pjdpd.exe34⤵
- Executes dropped EXE
PID:1336 -
\??\c:\lflflrx.exec:\lflflrx.exe35⤵
- Executes dropped EXE
PID:2024 -
\??\c:\nhttbn.exec:\nhttbn.exe36⤵
- Executes dropped EXE
PID:4612 -
\??\c:\dvvpj.exec:\dvvpj.exe37⤵
- Executes dropped EXE
PID:4500 -
\??\c:\bbnbth.exec:\bbnbth.exe38⤵
- Executes dropped EXE
PID:704 -
\??\c:\vvdvd.exec:\vvdvd.exe39⤵
- Executes dropped EXE
PID:3356 -
\??\c:\llllfxr.exec:\llllfxr.exe40⤵
- Executes dropped EXE
PID:3252 -
\??\c:\llxrlrr.exec:\llxrlrr.exe41⤵
- Executes dropped EXE
PID:2688 -
\??\c:\ttbbtn.exec:\ttbbtn.exe42⤵
- Executes dropped EXE
PID:3876 -
\??\c:\5ppjv.exec:\5ppjv.exe43⤵
- Executes dropped EXE
PID:4332 -
\??\c:\frfrfll.exec:\frfrfll.exe44⤵
- Executes dropped EXE
PID:4876 -
\??\c:\rrrrrxx.exec:\rrrrrxx.exe45⤵
- Executes dropped EXE
PID:4628 -
\??\c:\7hhbtt.exec:\7hhbtt.exe46⤵
- Executes dropped EXE
PID:2944 -
\??\c:\pvjjd.exec:\pvjjd.exe47⤵
- Executes dropped EXE
PID:876 -
\??\c:\jjddp.exec:\jjddp.exe48⤵
- Executes dropped EXE
PID:1480 -
\??\c:\xflllll.exec:\xflllll.exe49⤵
- Executes dropped EXE
PID:4752 -
\??\c:\hbnntt.exec:\hbnntt.exe50⤵
- Executes dropped EXE
PID:2572 -
\??\c:\bttnbt.exec:\bttnbt.exe51⤵
- Executes dropped EXE
PID:4488 -
\??\c:\7dvpd.exec:\7dvpd.exe52⤵
- Executes dropped EXE
PID:1420 -
\??\c:\xrlrrxx.exec:\xrlrrxx.exe53⤵
- Executes dropped EXE
PID:1012 -
\??\c:\xrllfxx.exec:\xrllfxx.exe54⤵
- Executes dropped EXE
PID:4684 -
\??\c:\hnbtnh.exec:\hnbtnh.exe55⤵
- Executes dropped EXE
PID:2860 -
\??\c:\nnntnh.exec:\nnntnh.exe56⤵
- Executes dropped EXE
PID:3080 -
\??\c:\vpvpd.exec:\vpvpd.exe57⤵
- Executes dropped EXE
PID:60 -
\??\c:\htbtnn.exec:\htbtnn.exe58⤵
- Executes dropped EXE
PID:2984 -
\??\c:\dvjjp.exec:\dvjjp.exe59⤵
- Executes dropped EXE
PID:388 -
\??\c:\1rrlfrl.exec:\1rrlfrl.exe60⤵
- Executes dropped EXE
PID:4816 -
\??\c:\3nbbnh.exec:\3nbbnh.exe61⤵
- Executes dropped EXE
PID:1176 -
\??\c:\pjjdd.exec:\pjjdd.exe62⤵
- Executes dropped EXE
PID:2212 -
\??\c:\xllfffx.exec:\xllfffx.exe63⤵
- Executes dropped EXE
PID:3324 -
\??\c:\fffffll.exec:\fffffll.exe64⤵
- Executes dropped EXE
PID:4836 -
\??\c:\hbbntt.exec:\hbbntt.exe65⤵
- Executes dropped EXE
PID:4940 -
\??\c:\djdvp.exec:\djdvp.exe66⤵PID:4352
-
\??\c:\ddjvj.exec:\ddjvj.exe67⤵PID:1372
-
\??\c:\frrlfxx.exec:\frrlfxx.exe68⤵PID:2004
-
\??\c:\bthbtn.exec:\bthbtn.exe69⤵PID:1948
-
\??\c:\hbnhhh.exec:\hbnhhh.exe70⤵PID:836
-
\??\c:\jdjvv.exec:\jdjvv.exe71⤵PID:3056
-
\??\c:\5vddd.exec:\5vddd.exe72⤵PID:640
-
\??\c:\rrrllll.exec:\rrrllll.exe73⤵PID:1708
-
\??\c:\9httbn.exec:\9httbn.exe74⤵PID:768
-
\??\c:\pjdpv.exec:\pjdpv.exe75⤵PID:5088
-
\??\c:\pvvpd.exec:\pvvpd.exe76⤵PID:4012
-
\??\c:\lrrllfx.exec:\lrrllfx.exe77⤵PID:396
-
\??\c:\nnnnnn.exec:\nnnnnn.exe78⤵PID:2088
-
\??\c:\hhnhtb.exec:\hhnhtb.exe79⤵PID:752
-
\??\c:\pvjjp.exec:\pvjjp.exe80⤵PID:3856
-
\??\c:\frxrrxr.exec:\frxrrxr.exe81⤵PID:3320
-
\??\c:\rlflflf.exec:\rlflflf.exe82⤵PID:3512
-
\??\c:\tbbbhh.exec:\tbbbhh.exe83⤵PID:1872
-
\??\c:\7pvvv.exec:\7pvvv.exe84⤵PID:3328
-
\??\c:\9pjjp.exec:\9pjjp.exe85⤵PID:924
-
\??\c:\xrfxlll.exec:\xrfxlll.exe86⤵PID:4680
-
\??\c:\hntbtn.exec:\hntbtn.exe87⤵PID:432
-
\??\c:\vvjdj.exec:\vvjdj.exe88⤵PID:1524
-
\??\c:\1ddvj.exec:\1ddvj.exe89⤵PID:1412
-
\??\c:\1fffrxl.exec:\1fffrxl.exe90⤵PID:4980
-
\??\c:\rlrxfxl.exec:\rlrxfxl.exe91⤵PID:548
-
\??\c:\1tbbhh.exec:\1tbbhh.exe92⤵PID:920
-
\??\c:\5jjvj.exec:\5jjvj.exe93⤵PID:4596
-
\??\c:\ppdjd.exec:\ppdjd.exe94⤵PID:2868
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe95⤵PID:1860
-
\??\c:\tbbnhb.exec:\tbbnhb.exe96⤵PID:2580
-
\??\c:\nhtnnh.exec:\nhtnnh.exe97⤵PID:3092
-
\??\c:\jpjdp.exec:\jpjdp.exe98⤵PID:1092
-
\??\c:\5xrlllx.exec:\5xrlllx.exe99⤵PID:2496
-
\??\c:\1rrfxxr.exec:\1rrfxxr.exe100⤵PID:4272
-
\??\c:\hnhntn.exec:\hnhntn.exe101⤵PID:3936
-
\??\c:\bttnnh.exec:\bttnnh.exe102⤵PID:4584
-
\??\c:\vvjdj.exec:\vvjdj.exe103⤵PID:1436
-
\??\c:\1rlrlfr.exec:\1rlrlfr.exe104⤵PID:4420
-
\??\c:\xrfxfff.exec:\xrfxfff.exe105⤵PID:2696
-
\??\c:\tnbbnn.exec:\tnbbnn.exe106⤵PID:2872
-
\??\c:\xlfxllx.exec:\xlfxllx.exe107⤵PID:4428
-
\??\c:\9hhtnh.exec:\9hhtnh.exe108⤵PID:412
-
\??\c:\dppjj.exec:\dppjj.exe109⤵PID:2056
-
\??\c:\vjjdv.exec:\vjjdv.exe110⤵PID:4448
-
\??\c:\1lllllf.exec:\1lllllf.exe111⤵PID:4636
-
\??\c:\nbttnn.exec:\nbttnn.exe112⤵PID:4820
-
\??\c:\9pvpp.exec:\9pvpp.exe113⤵PID:2468
-
\??\c:\vvvdd.exec:\vvvdd.exe114⤵PID:3156
-
\??\c:\rlxxlfl.exec:\rlxxlfl.exe115⤵PID:4528
-
\??\c:\5ttntn.exec:\5ttntn.exe116⤵PID:1424
-
\??\c:\9bhhhh.exec:\9bhhhh.exe117⤵PID:1820
-
\??\c:\jdjvp.exec:\jdjvp.exe118⤵PID:1136
-
\??\c:\7pvvj.exec:\7pvvj.exe119⤵PID:2116
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe120⤵PID:4360
-
\??\c:\thnhbb.exec:\thnhbb.exe121⤵PID:1532
-
\??\c:\1pjdv.exec:\1pjdv.exe122⤵PID:4940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-