Analysis
- max time kernel
150s - max time network
121s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 00:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9325458392ca6c8ece1777f06dc0abaf3132967c9163ad7a1dec818d887289ed.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
- Target 9325458392ca6c8ece1777f06dc0abaf3132967c9163ad7a1dec818d887289ed.exe
- Size 78KB
- Sample240518-azsg6abe39
- SHA256 9325458392ca6c8ece1777f06dc0abaf3132967c9163ad7a1dec818d887289ed
- MD5 353644fe8c66d4ae94d7baeb789dc290
- SHA1 0db328e41e7670ba1105404ee2d0d41e09cec451
- SHA512 027143b95fb34889f3332384abc78007c4706f88c2fc35d5b9b730a1fabc4162dc5f3f5d42807dbfea17e3d7c0b7df514b68fdc133be91953a862f535caf728f
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAX8YieVIJclPvPJtcdcw:ymb3NkkiQ3mdBjFo68YBVIJc9Jtxw
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4816-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/556-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 24 IoCs
resource yara_rule behavioral2/memory/4816-6-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3956-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/884-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1188-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2904-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4024-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4024-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4652-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1220-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3136-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3136-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3136-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5080-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4696-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3972-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1156-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2352-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4824-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/556-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3192-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1524-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4856-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1884-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1544-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 884 hhhhhb.exe 2348 httttb.exe 3956 pvdjd.exe 1188 9jppp.exe 2904 pjjdd.exe 400 rxfffrf.exe 4024 lrrlrlx.exe 4652 vjpjd.exe 1220 xflxlxl.exe 3136 hntbtt.exe 5080 pvvjv.exe 4532 xxrrxrl.exe 3972 jvdjv.exe 4696 lxfflll.exe 1156 nnbhnb.exe 2352 pvjdd.exe 2312 vvpjp.exe 4824 lxxxflx.exe 812 tnbntn.exe 556 jvpjp.exe 4856 9rlxlrf.exe 1760 nnttbh.exe 1524 vvjvv.exe 3192 xfllxll.exe 3736 7nhtht.exe 1884 vdjpj.exe 3492 xlfxflr.exe 1892 bthbbn.exe 4408 3rlllfx.exe 3128 rfxrxxf.exe 1544 hhhhtn.exe 1660 vdjpd.exe 440 xllrfrf.exe 752 nthhbh.exe 3968 btnbhn.exe 2168 dpddp.exe 3964 rlxlrxx.exe 4072 ntbnhn.exe 1020 jdjdd.exe 4336 xfrrllf.exe 4684 thbbnn.exe 3312 vdjvp.exe 4936 dvvdv.exe 3376 xfrxfrl.exe 4220 vdvjj.exe 932 llxrrrx.exe 968 5hnhbb.exe 2740 vpjpd.exe 2904 xxxrrlr.exe 4380 5hnnbt.exe 4024 bnbhhn.exe 1448 rfxlfxx.exe 2512 tbbbbb.exe 4700 thntnn.exe 2220 ppppp.exe 2752 llflffx.exe 1832 jdpjv.exe 4516 llrrffr.exe 4976 ffrxlff.exe 2316 5bbbtb.exe 888 vdvjp.exe 2032 rfllffx.exe 4436 5lrllrx.exe 4004 htthnb.exe -
resource yara_rule behavioral2/memory/4816-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1884-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-204-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4816 wrote to memory of 884 4816 9325458392ca6c8ece1777f06dc0abaf3132967c9163ad7a1dec818d887289ed.exe 83 PID 4816 wrote to memory of 884 4816 9325458392ca6c8ece1777f06dc0abaf3132967c9163ad7a1dec818d887289ed.exe 83 PID 4816 wrote to memory of 884 4816 9325458392ca6c8ece1777f06dc0abaf3132967c9163ad7a1dec818d887289ed.exe 83 PID 884 wrote to memory of 2348 884 hhhhhb.exe 84 PID 884 wrote to memory of 2348 884 hhhhhb.exe 84 PID 884 wrote to memory of 2348 884 hhhhhb.exe 84 PID 2348 wrote to memory of 3956 2348 httttb.exe 85 PID 2348 wrote to memory of 3956 2348 httttb.exe 85 PID 2348 wrote to memory of 3956 2348 httttb.exe 85 PID 3956 wrote to memory of 1188 3956 pvdjd.exe 86 PID 3956 wrote to memory of 1188 3956 pvdjd.exe 86 PID 3956 wrote to memory of 1188 3956 pvdjd.exe 86 PID 1188 wrote to memory of 2904 1188 9jppp.exe 87 PID 1188 wrote to memory of 2904 1188 9jppp.exe 87 PID 1188 wrote to memory of 2904 1188 9jppp.exe 87 PID 2904 wrote to memory of 400 2904 pjjdd.exe 88 PID 2904 wrote to memory of 400 2904 pjjdd.exe 88 PID 2904 wrote to memory of 400 2904 pjjdd.exe 88 PID 400 wrote to memory of 4024 400 rxfffrf.exe 89 PID 400 wrote to memory of 4024 400 rxfffrf.exe 89 PID 400 wrote to memory of 4024 400 rxfffrf.exe 89 PID 4024 wrote to memory of 4652 4024 lrrlrlx.exe 90 PID 4024 wrote to memory of 4652 4024 lrrlrlx.exe 90 PID 4024 wrote to memory of 4652 4024 lrrlrlx.exe 90 PID 4652 wrote to memory of 1220 4652 vjpjd.exe 91 PID 4652 wrote to memory of 1220 4652 vjpjd.exe 91 PID 4652 wrote to memory of 1220 4652 vjpjd.exe 91 PID 1220 wrote to memory of 3136 1220 xflxlxl.exe 92 PID 1220 wrote to memory of 3136 1220 xflxlxl.exe 92 PID 1220 wrote to memory of 3136 1220 xflxlxl.exe 92 PID 3136 wrote to memory of 5080 3136 hntbtt.exe 93 PID 3136 wrote to memory of 5080 3136 hntbtt.exe 93 PID 3136 wrote to memory of 5080 3136 hntbtt.exe 93 PID 5080 wrote to memory of 4532 5080 pvvjv.exe 94 PID 5080 wrote to memory of 4532 5080 pvvjv.exe 94 PID 5080 wrote to memory of 4532 5080 pvvjv.exe 94 PID 4532 wrote to memory of 3972 4532 xxrrxrl.exe 95 PID 4532 wrote to memory of 3972 4532 xxrrxrl.exe 95 PID 4532 wrote to memory of 3972 4532 xxrrxrl.exe 95 PID 3972 wrote to memory of 4696 3972 jvdjv.exe 96 PID 3972 wrote to memory of 4696 3972 jvdjv.exe 96 PID 3972 wrote to memory of 4696 3972 jvdjv.exe 96 PID 4696 wrote to memory of 1156 4696 lxfflll.exe 97 PID 4696 wrote to memory of 1156 4696 lxfflll.exe 97 PID 4696 wrote to memory of 1156 4696 lxfflll.exe 97 PID 1156 wrote to memory of 2352 1156 nnbhnb.exe 98 PID 1156 wrote to memory of 2352 1156 nnbhnb.exe 98 PID 1156 wrote to memory of 2352 1156 nnbhnb.exe 98 PID 2352 wrote to memory of 2312 2352 pvjdd.exe 99 PID 2352 wrote to memory of 2312 2352 pvjdd.exe 99 PID 2352 wrote to memory of 2312 2352 pvjdd.exe 99 PID 2312 wrote to memory of 4824 2312 vvpjp.exe 100 PID 2312 wrote to memory of 4824 2312 vvpjp.exe 100 PID 2312 wrote to memory of 4824 2312 vvpjp.exe 100 PID 4824 wrote to memory of 812 4824 lxxxflx.exe 101 PID 4824 wrote to memory of 812 4824 lxxxflx.exe 101 PID 4824 wrote to memory of 812 4824 lxxxflx.exe 101 PID 812 wrote to memory of 556 812 tnbntn.exe 102 PID 812 wrote to memory of 556 812 tnbntn.exe 102 PID 812 wrote to memory of 556 812 tnbntn.exe 102 PID 556 wrote to memory of 4856 556 jvpjp.exe 103 PID 556 wrote to memory of 4856 556 jvpjp.exe 103 PID 556 wrote to memory of 4856 556 jvpjp.exe 103 PID 4856 wrote to memory of 1760 4856 9rlxlrf.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\9325458392ca6c8ece1777f06dc0abaf3132967c9163ad7a1dec818d887289ed.exe"C:\Users\Admin\AppData\Local\Temp\9325458392ca6c8ece1777f06dc0abaf3132967c9163ad7a1dec818d887289ed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\hhhhhb.exec:\hhhhhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\httttb.exec:\httttb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\pvdjd.exec:\pvdjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\9jppp.exec:\9jppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\pjjdd.exec:\pjjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\rxfffrf.exec:\rxfffrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\lrrlrlx.exec:\lrrlrlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\vjpjd.exec:\vjpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\xflxlxl.exec:\xflxlxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\hntbtt.exec:\hntbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\pvvjv.exec:\pvvjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\xxrrxrl.exec:\xxrrxrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\jvdjv.exec:\jvdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\lxfflll.exec:\lxfflll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\nnbhnb.exec:\nnbhnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\pvjdd.exec:\pvjdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\vvpjp.exec:\vvpjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\lxxxflx.exec:\lxxxflx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\tnbntn.exec:\tnbntn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\jvpjp.exec:\jvpjp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\9rlxlrf.exec:\9rlxlrf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\nnttbh.exec:\nnttbh.exe23⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vvjvv.exec:\vvjvv.exe24⤵
- Executes dropped EXE
PID:1524 -
\??\c:\xfllxll.exec:\xfllxll.exe25⤵
- Executes dropped EXE
PID:3192 -
\??\c:\7nhtht.exec:\7nhtht.exe26⤵
- Executes dropped EXE
PID:3736 -
\??\c:\vdjpj.exec:\vdjpj.exe27⤵
- Executes dropped EXE
PID:1884 -
\??\c:\xlfxflr.exec:\xlfxflr.exe28⤵
- Executes dropped EXE
PID:3492 -
\??\c:\bthbbn.exec:\bthbbn.exe29⤵
- Executes dropped EXE
PID:1892 -
\??\c:\3rlllfx.exec:\3rlllfx.exe30⤵
- Executes dropped EXE
PID:4408 -
\??\c:\rfxrxxf.exec:\rfxrxxf.exe31⤵
- Executes dropped EXE
PID:3128 -
\??\c:\hhhhtn.exec:\hhhhtn.exe32⤵
- Executes dropped EXE
PID:1544 -
\??\c:\vdjpd.exec:\vdjpd.exe33⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xllrfrf.exec:\xllrfrf.exe34⤵
- Executes dropped EXE
PID:440 -
\??\c:\nthhbh.exec:\nthhbh.exe35⤵
- Executes dropped EXE
PID:752 -
\??\c:\btnbhn.exec:\btnbhn.exe36⤵
- Executes dropped EXE
PID:3968 -
\??\c:\dpddp.exec:\dpddp.exe37⤵
- Executes dropped EXE
PID:2168 -
\??\c:\rlxlrxx.exec:\rlxlrxx.exe38⤵
- Executes dropped EXE
PID:3964 -
\??\c:\ntbnhn.exec:\ntbnhn.exe39⤵
- Executes dropped EXE
PID:4072 -
\??\c:\jdjdd.exec:\jdjdd.exe40⤵
- Executes dropped EXE
PID:1020 -
\??\c:\xfrrllf.exec:\xfrrllf.exe41⤵
- Executes dropped EXE
PID:4336 -
\??\c:\thbbnn.exec:\thbbnn.exe42⤵
- Executes dropped EXE
PID:4684 -
\??\c:\vdjvp.exec:\vdjvp.exe43⤵
- Executes dropped EXE
PID:3312 -
\??\c:\dvvdv.exec:\dvvdv.exe44⤵
- Executes dropped EXE
PID:4936 -
\??\c:\xfrxfrl.exec:\xfrxfrl.exe45⤵
- Executes dropped EXE
PID:3376 -
\??\c:\vdvjj.exec:\vdvjj.exe46⤵
- Executes dropped EXE
PID:4220 -
\??\c:\llxrrrx.exec:\llxrrrx.exe47⤵
- Executes dropped EXE
PID:932 -
\??\c:\5hnhbb.exec:\5hnhbb.exe48⤵
- Executes dropped EXE
PID:968 -
\??\c:\vpjpd.exec:\vpjpd.exe49⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xxxrrlr.exec:\xxxrrlr.exe50⤵
- Executes dropped EXE
PID:2904 -
\??\c:\5hnnbt.exec:\5hnnbt.exe51⤵
- Executes dropped EXE
PID:4380 -
\??\c:\bnbhhn.exec:\bnbhhn.exe52⤵
- Executes dropped EXE
PID:4024 -
\??\c:\rfxlfxx.exec:\rfxlfxx.exe53⤵
- Executes dropped EXE
PID:1448 -
\??\c:\tbbbbb.exec:\tbbbbb.exe54⤵
- Executes dropped EXE
PID:2512 -
\??\c:\thntnn.exec:\thntnn.exe55⤵
- Executes dropped EXE
PID:4700 -
\??\c:\ppppp.exec:\ppppp.exe56⤵
- Executes dropped EXE
PID:2220 -
\??\c:\llflffx.exec:\llflffx.exe57⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jdpjv.exec:\jdpjv.exe58⤵
- Executes dropped EXE
PID:1832 -
\??\c:\llrrffr.exec:\llrrffr.exe59⤵
- Executes dropped EXE
PID:4516 -
\??\c:\ffrxlff.exec:\ffrxlff.exe60⤵
- Executes dropped EXE
PID:4976 -
\??\c:\5bbbtb.exec:\5bbbtb.exe61⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vdvjp.exec:\vdvjp.exe62⤵
- Executes dropped EXE
PID:888 -
\??\c:\rfllffx.exec:\rfllffx.exe63⤵
- Executes dropped EXE
PID:2032 -
\??\c:\5lrllrx.exec:\5lrllrx.exe64⤵
- Executes dropped EXE
PID:4436 -
\??\c:\htthnb.exec:\htthnb.exe65⤵
- Executes dropped EXE
PID:4004 -
\??\c:\vjjjj.exec:\vjjjj.exe66⤵PID:4912
-
\??\c:\fxxlrlx.exec:\fxxlrlx.exe67⤵PID:976
-
\??\c:\nhhbbn.exec:\nhhbbn.exe68⤵PID:3876
-
\??\c:\vvdvj.exec:\vvdvj.exe69⤵PID:3788
-
\??\c:\frxrxrx.exec:\frxrxrx.exe70⤵PID:4464
-
\??\c:\nnhbtt.exec:\nnhbtt.exe71⤵PID:2408
-
\??\c:\bbthnt.exec:\bbthnt.exe72⤵PID:4080
-
\??\c:\llllfll.exec:\llllfll.exe73⤵PID:2756
-
\??\c:\ttttbh.exec:\ttttbh.exe74⤵PID:3688
-
\??\c:\pjpjd.exec:\pjpjd.exe75⤵PID:3568
-
\??\c:\xrxllll.exec:\xrxllll.exe76⤵PID:3612
-
\??\c:\lxxfxrr.exec:\lxxfxrr.exe77⤵PID:3084
-
\??\c:\bbhhnn.exec:\bbhhnn.exe78⤵PID:4472
-
\??\c:\pjvdp.exec:\pjvdp.exe79⤵PID:1544
-
\??\c:\jdpdj.exec:\jdpdj.exe80⤵PID:2284
-
\??\c:\1lrlfxr.exec:\1lrlfxr.exe81⤵PID:3952
-
\??\c:\frrlfll.exec:\frrlfll.exe82⤵PID:4636
-
\??\c:\tnhhtt.exec:\tnhhtt.exe83⤵PID:368
-
\??\c:\dppjd.exec:\dppjd.exe84⤵PID:2828
-
\??\c:\xllfxxx.exec:\xllfxxx.exe85⤵PID:4708
-
\??\c:\frxlfll.exec:\frxlfll.exe86⤵PID:3088
-
\??\c:\bbbnnh.exec:\bbbnnh.exe87⤵PID:4488
-
\??\c:\jvpjv.exec:\jvpjv.exe88⤵PID:4324
-
\??\c:\dvpjd.exec:\dvpjd.exe89⤵PID:1252
-
\??\c:\xxrffxf.exec:\xxrffxf.exe90⤵PID:4680
-
\??\c:\tbthnh.exec:\tbthnh.exe91⤵PID:2416
-
\??\c:\ttttnt.exec:\ttttnt.exe92⤵PID:3932
-
\??\c:\9jpjd.exec:\9jpjd.exe93⤵PID:2796
-
\??\c:\rrrxxrx.exec:\rrrxxrx.exe94⤵PID:4804
-
\??\c:\3nbhht.exec:\3nbhht.exe95⤵PID:4176
-
\??\c:\jjpvd.exec:\jjpvd.exe96⤵PID:1448
-
\??\c:\ppjdd.exec:\ppjdd.exe97⤵PID:1648
-
\??\c:\frxlxff.exec:\frxlxff.exe98⤵PID:3696
-
\??\c:\rxflxff.exec:\rxflxff.exe99⤵PID:4644
-
\??\c:\hnbbbh.exec:\hnbbbh.exe100⤵PID:4964
-
\??\c:\djdvv.exec:\djdvv.exe101⤵PID:4516
-
\??\c:\rlxlxff.exec:\rlxlxff.exe102⤵PID:1112
-
\??\c:\tnnnhh.exec:\tnnnhh.exe103⤵PID:944
-
\??\c:\nbhnnt.exec:\nbhnnt.exe104⤵PID:3684
-
\??\c:\5vjpp.exec:\5vjpp.exe105⤵PID:3928
-
\??\c:\lfflrrr.exec:\lfflrrr.exe106⤵PID:4440
-
\??\c:\ffxlrfr.exec:\ffxlrfr.exe107⤵PID:556
-
\??\c:\ntbtnt.exec:\ntbtnt.exe108⤵PID:4248
-
\??\c:\djpjd.exec:\djpjd.exe109⤵PID:396
-
\??\c:\7jjdv.exec:\7jjdv.exe110⤵PID:2200
-
\??\c:\rllfxfr.exec:\rllfxfr.exe111⤵PID:4844
-
\??\c:\bthtnn.exec:\bthtnn.exe112⤵PID:1980
-
\??\c:\3jdvp.exec:\3jdvp.exe113⤵PID:2188
-
\??\c:\flrrxlx.exec:\flrrxlx.exe114⤵PID:2408
-
\??\c:\btttth.exec:\btttth.exe115⤵PID:4080
-
\??\c:\jvvjd.exec:\jvvjd.exe116⤵PID:2756
-
\??\c:\vvjpv.exec:\vvjpv.exe117⤵PID:4812
-
\??\c:\xlrxrlr.exec:\xlrxrlr.exe118⤵PID:3008
-
\??\c:\hhbtth.exec:\hhbtth.exe119⤵PID:5024
-
\??\c:\vjpvv.exec:\vjpvv.exe120⤵PID:3084
-
\??\c:\5rxrlfx.exec:\5rxrlfx.exe121⤵PID:5052
-
\??\c:\lrxfxxx.exec:\lrxfxxx.exe122⤵PID:2092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-