Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 23:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
73fbe8f01abf009ae3e7b278f610989760f7d87c5b8ddf6887587f97a8de6445.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
73fbe8f01abf009ae3e7b278f610989760f7d87c5b8ddf6887587f97a8de6445.exe
-
Size
77KB
-
MD5
1b3bd8d426377af1df2c64dd7139747b
-
SHA1
87954ae40414e6182b24bdf81688d3a2a43be5ec
-
SHA256
73fbe8f01abf009ae3e7b278f610989760f7d87c5b8ddf6887587f97a8de6445
-
SHA512
cede94198ab2bfd398768358441ff87a53ab916b19c4cbbabfe459c07a44e5ea4483b1e3a26f40160f728a7c96a5dd6814127770398c8aaac46f7085d7209369
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgygQwKjiawEmBs:ymb3NkkiQ3mdBjFo73thgQ/wEks
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/3960-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/100-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 23 IoCs
resource yara_rule behavioral2/memory/3960-5-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3144-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3364-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4508-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/912-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/100-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2308-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2572-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3316-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5080-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4904-81-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2068-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3688-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1752-106-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4740-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2372-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3288-130-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3292-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3464-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3752-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1436-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3548-177-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1424-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3144 bhbntn.exe 3364 vpppj.exe 912 pjvpj.exe 4508 fxxxlll.exe 100 fxfffff.exe 2308 bttnhh.exe 2572 dpvvp.exe 3316 xxrfxfr.exe 3928 tthbtt.exe 5080 jvvvv.exe 4904 1djjj.exe 436 fffxrrr.exe 2068 7bnntb.exe 3688 5bbtnn.exe 1752 jjjdv.exe 4740 3rlfxxx.exe 2372 5lxxxxr.exe 1840 nhnntn.exe 3288 vjddp.exe 1900 dvppv.exe 1648 fxlfxfx.exe 3292 rrlllfx.exe 3464 5nnnnn.exe 3752 jdddv.exe 1608 xrrrrrr.exe 1436 nnbbbb.exe 3548 tttttn.exe 2304 pddvp.exe 2680 dpvpd.exe 4988 rrrrlrr.exe 1424 lfrlffr.exe 1132 hbhbtt.exe 4108 ntttnn.exe 1772 9pjdp.exe 216 jppjj.exe 2476 xlfllrr.exe 3192 lfrrxrx.exe 4428 bhhbbb.exe 400 9htttb.exe 4556 ppjjd.exe 4600 7djjd.exe 4524 vdppj.exe 3144 lxxllff.exe 1972 hhnnhn.exe 4300 9pppd.exe 1512 jpvvp.exe 1372 rrffflx.exe 3700 9xrrrrx.exe 5064 nhhbtt.exe 2308 vpvvv.exe 4384 ppddj.exe 4236 ffxrxxx.exe 3900 lfrrlxx.exe 2804 lflrrxx.exe 2900 nnnhhh.exe 5116 9ntttt.exe 2924 3rrrlxx.exe 2236 fxffxfx.exe 4500 nhnttb.exe 3160 hnnnhn.exe 768 ddvpd.exe 3180 7xffxrr.exe 2668 rrlxfrl.exe 2584 xrxrrrr.exe -
resource yara_rule behavioral2/memory/3960-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/100-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3548-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3960 wrote to memory of 3144 3960 73fbe8f01abf009ae3e7b278f610989760f7d87c5b8ddf6887587f97a8de6445.exe 83 PID 3960 wrote to memory of 3144 3960 73fbe8f01abf009ae3e7b278f610989760f7d87c5b8ddf6887587f97a8de6445.exe 83 PID 3960 wrote to memory of 3144 3960 73fbe8f01abf009ae3e7b278f610989760f7d87c5b8ddf6887587f97a8de6445.exe 83 PID 3144 wrote to memory of 3364 3144 bhbntn.exe 84 PID 3144 wrote to memory of 3364 3144 bhbntn.exe 84 PID 3144 wrote to memory of 3364 3144 bhbntn.exe 84 PID 3364 wrote to memory of 912 3364 vpppj.exe 85 PID 3364 wrote to memory of 912 3364 vpppj.exe 85 PID 3364 wrote to memory of 912 3364 vpppj.exe 85 PID 912 wrote to memory of 4508 912 pjvpj.exe 86 PID 912 wrote to memory of 4508 912 pjvpj.exe 86 PID 912 wrote to memory of 4508 912 pjvpj.exe 86 PID 4508 wrote to memory of 100 4508 fxxxlll.exe 87 PID 4508 wrote to memory of 100 4508 fxxxlll.exe 87 PID 4508 wrote to memory of 100 4508 fxxxlll.exe 87 PID 100 wrote to memory of 2308 100 fxfffff.exe 88 PID 100 wrote to memory of 2308 100 fxfffff.exe 88 PID 100 wrote to memory of 2308 100 fxfffff.exe 88 PID 2308 wrote to memory of 2572 2308 bttnhh.exe 89 PID 2308 wrote to memory of 2572 2308 bttnhh.exe 89 PID 2308 wrote to memory of 2572 2308 bttnhh.exe 89 PID 2572 wrote to memory of 3316 2572 dpvvp.exe 90 PID 2572 wrote to memory of 3316 2572 dpvvp.exe 90 PID 2572 wrote to memory of 3316 2572 dpvvp.exe 90 PID 3316 wrote to memory of 3928 3316 xxrfxfr.exe 91 PID 3316 wrote to memory of 3928 3316 xxrfxfr.exe 91 PID 3316 wrote to memory of 3928 3316 xxrfxfr.exe 91 PID 3928 wrote to memory of 5080 3928 tthbtt.exe 92 PID 3928 wrote to memory of 5080 3928 tthbtt.exe 92 PID 3928 wrote to memory of 5080 3928 tthbtt.exe 92 PID 5080 wrote to memory of 4904 5080 jvvvv.exe 93 PID 5080 wrote to memory of 4904 5080 jvvvv.exe 93 PID 5080 wrote to memory of 4904 5080 jvvvv.exe 93 PID 4904 wrote to memory of 436 4904 1djjj.exe 94 PID 4904 wrote to memory of 436 4904 1djjj.exe 94 PID 4904 wrote to memory of 436 4904 1djjj.exe 94 PID 436 wrote to memory of 2068 436 fffxrrr.exe 95 PID 436 wrote to memory of 2068 436 fffxrrr.exe 95 PID 436 wrote to memory of 2068 436 fffxrrr.exe 95 PID 2068 wrote to memory of 3688 2068 7bnntb.exe 96 PID 2068 wrote to memory of 3688 2068 7bnntb.exe 96 PID 2068 wrote to memory of 3688 2068 7bnntb.exe 96 PID 3688 wrote to memory of 1752 3688 5bbtnn.exe 97 PID 3688 wrote to memory of 1752 3688 5bbtnn.exe 97 PID 3688 wrote to memory of 1752 3688 5bbtnn.exe 97 PID 1752 wrote to memory of 4740 1752 jjjdv.exe 98 PID 1752 wrote to memory of 4740 1752 jjjdv.exe 98 PID 1752 wrote to memory of 4740 1752 jjjdv.exe 98 PID 4740 wrote to memory of 2372 4740 3rlfxxx.exe 99 PID 4740 wrote to memory of 2372 4740 3rlfxxx.exe 99 PID 4740 wrote to memory of 2372 4740 3rlfxxx.exe 99 PID 2372 wrote to memory of 1840 2372 5lxxxxr.exe 100 PID 2372 wrote to memory of 1840 2372 5lxxxxr.exe 100 PID 2372 wrote to memory of 1840 2372 5lxxxxr.exe 100 PID 1840 wrote to memory of 3288 1840 nhnntn.exe 101 PID 1840 wrote to memory of 3288 1840 nhnntn.exe 101 PID 1840 wrote to memory of 3288 1840 nhnntn.exe 101 PID 3288 wrote to memory of 1900 3288 vjddp.exe 103 PID 3288 wrote to memory of 1900 3288 vjddp.exe 103 PID 3288 wrote to memory of 1900 3288 vjddp.exe 103 PID 1900 wrote to memory of 1648 1900 dvppv.exe 104 PID 1900 wrote to memory of 1648 1900 dvppv.exe 104 PID 1900 wrote to memory of 1648 1900 dvppv.exe 104 PID 1648 wrote to memory of 3292 1648 fxlfxfx.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\73fbe8f01abf009ae3e7b278f610989760f7d87c5b8ddf6887587f97a8de6445.exe"C:\Users\Admin\AppData\Local\Temp\73fbe8f01abf009ae3e7b278f610989760f7d87c5b8ddf6887587f97a8de6445.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\bhbntn.exec:\bhbntn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\vpppj.exec:\vpppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\pjvpj.exec:\pjvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\fxxxlll.exec:\fxxxlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\fxfffff.exec:\fxfffff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\bttnhh.exec:\bttnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\dpvvp.exec:\dpvvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\xxrfxfr.exec:\xxrfxfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\tthbtt.exec:\tthbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\jvvvv.exec:\jvvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\1djjj.exec:\1djjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\fffxrrr.exec:\fffxrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\7bnntb.exec:\7bnntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\5bbtnn.exec:\5bbtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\jjjdv.exec:\jjjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\3rlfxxx.exec:\3rlfxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\5lxxxxr.exec:\5lxxxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\nhnntn.exec:\nhnntn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\vjddp.exec:\vjddp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\dvppv.exec:\dvppv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\fxlfxfx.exec:\fxlfxfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\rrlllfx.exec:\rrlllfx.exe23⤵
- Executes dropped EXE
PID:3292 -
\??\c:\5nnnnn.exec:\5nnnnn.exe24⤵
- Executes dropped EXE
PID:3464 -
\??\c:\jdddv.exec:\jdddv.exe25⤵
- Executes dropped EXE
PID:3752 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe26⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nnbbbb.exec:\nnbbbb.exe27⤵
- Executes dropped EXE
PID:1436 -
\??\c:\tttttn.exec:\tttttn.exe28⤵
- Executes dropped EXE
PID:3548 -
\??\c:\pddvp.exec:\pddvp.exe29⤵
- Executes dropped EXE
PID:2304 -
\??\c:\dpvpd.exec:\dpvpd.exe30⤵
- Executes dropped EXE
PID:2680 -
\??\c:\rrrrlrr.exec:\rrrrlrr.exe31⤵
- Executes dropped EXE
PID:4988 -
\??\c:\lfrlffr.exec:\lfrlffr.exe32⤵
- Executes dropped EXE
PID:1424 -
\??\c:\hbhbtt.exec:\hbhbtt.exe33⤵
- Executes dropped EXE
PID:1132 -
\??\c:\ntttnn.exec:\ntttnn.exe34⤵
- Executes dropped EXE
PID:4108 -
\??\c:\9pjdp.exec:\9pjdp.exe35⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jppjj.exec:\jppjj.exe36⤵
- Executes dropped EXE
PID:216 -
\??\c:\xlfllrr.exec:\xlfllrr.exe37⤵
- Executes dropped EXE
PID:2476 -
\??\c:\lfrrxrx.exec:\lfrrxrx.exe38⤵
- Executes dropped EXE
PID:3192 -
\??\c:\bhhbbb.exec:\bhhbbb.exe39⤵
- Executes dropped EXE
PID:4428 -
\??\c:\9htttb.exec:\9htttb.exe40⤵
- Executes dropped EXE
PID:400 -
\??\c:\ppjjd.exec:\ppjjd.exe41⤵
- Executes dropped EXE
PID:4556 -
\??\c:\7djjd.exec:\7djjd.exe42⤵
- Executes dropped EXE
PID:4600 -
\??\c:\vdppj.exec:\vdppj.exe43⤵
- Executes dropped EXE
PID:4524 -
\??\c:\lxxllff.exec:\lxxllff.exe44⤵
- Executes dropped EXE
PID:3144 -
\??\c:\hhnnhn.exec:\hhnnhn.exe45⤵
- Executes dropped EXE
PID:1972 -
\??\c:\9pppd.exec:\9pppd.exe46⤵
- Executes dropped EXE
PID:4300 -
\??\c:\jpvvp.exec:\jpvvp.exe47⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rrffflx.exec:\rrffflx.exe48⤵
- Executes dropped EXE
PID:1372 -
\??\c:\9xrrrrx.exec:\9xrrrrx.exe49⤵
- Executes dropped EXE
PID:3700 -
\??\c:\nhhbtt.exec:\nhhbtt.exe50⤵
- Executes dropped EXE
PID:5064 -
\??\c:\vpvvv.exec:\vpvvv.exe51⤵
- Executes dropped EXE
PID:2308 -
\??\c:\ppddj.exec:\ppddj.exe52⤵
- Executes dropped EXE
PID:4384 -
\??\c:\ffxrxxx.exec:\ffxrxxx.exe53⤵
- Executes dropped EXE
PID:4236 -
\??\c:\lfrrlxx.exec:\lfrrlxx.exe54⤵
- Executes dropped EXE
PID:3900 -
\??\c:\lflrrxx.exec:\lflrrxx.exe55⤵
- Executes dropped EXE
PID:2804 -
\??\c:\nnnhhh.exec:\nnnhhh.exe56⤵
- Executes dropped EXE
PID:2900 -
\??\c:\9ntttt.exec:\9ntttt.exe57⤵
- Executes dropped EXE
PID:5116 -
\??\c:\3rrrlxx.exec:\3rrrlxx.exe58⤵
- Executes dropped EXE
PID:2924 -
\??\c:\fxffxfx.exec:\fxffxfx.exe59⤵
- Executes dropped EXE
PID:2236 -
\??\c:\nhnttb.exec:\nhnttb.exe60⤵
- Executes dropped EXE
PID:4500 -
\??\c:\hnnnhn.exec:\hnnnhn.exe61⤵
- Executes dropped EXE
PID:3160 -
\??\c:\ddvpd.exec:\ddvpd.exe62⤵
- Executes dropped EXE
PID:768 -
\??\c:\7xffxrr.exec:\7xffxrr.exe63⤵
- Executes dropped EXE
PID:3180 -
\??\c:\rrlxfrl.exec:\rrlxfrl.exe64⤵
- Executes dropped EXE
PID:2668 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe65⤵
- Executes dropped EXE
PID:2584 -
\??\c:\tbtbnn.exec:\tbtbnn.exe66⤵PID:4552
-
\??\c:\5hhnhn.exec:\5hhnhn.exe67⤵PID:1236
-
\??\c:\pjjpj.exec:\pjjpj.exe68⤵PID:3292
-
\??\c:\jppvv.exec:\jppvv.exe69⤵PID:2884
-
\??\c:\rrrlfff.exec:\rrrlfff.exe70⤵PID:4956
-
\??\c:\rrfrrrr.exec:\rrfrrrr.exe71⤵PID:860
-
\??\c:\btnhhn.exec:\btnhhn.exe72⤵PID:1616
-
\??\c:\bbnnbh.exec:\bbnnbh.exe73⤵PID:1608
-
\??\c:\9ppdv.exec:\9ppdv.exe74⤵PID:1044
-
\??\c:\vjpjj.exec:\vjpjj.exe75⤵PID:2108
-
\??\c:\ddpvv.exec:\ddpvv.exe76⤵PID:4252
-
\??\c:\rrxfrxl.exec:\rrxfrxl.exe77⤵PID:2188
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe78⤵PID:3564
-
\??\c:\nnbbnt.exec:\nnbbnt.exe79⤵PID:4676
-
\??\c:\1ttnnn.exec:\1ttnnn.exe80⤵PID:3248
-
\??\c:\vvvpd.exec:\vvvpd.exe81⤵PID:3672
-
\??\c:\dpddp.exec:\dpddp.exe82⤵PID:2340
-
\??\c:\dpvvp.exec:\dpvvp.exe83⤵PID:1720
-
\??\c:\xlxfflr.exec:\xlxfflr.exe84⤵PID:2252
-
\??\c:\lrxfrrx.exec:\lrxfrrx.exe85⤵PID:4092
-
\??\c:\nnhnbh.exec:\nnhnbh.exe86⤵PID:4640
-
\??\c:\9bbthn.exec:\9bbthn.exe87⤵PID:4320
-
\??\c:\bhnnnt.exec:\bhnnnt.exe88⤵PID:400
-
\??\c:\jpjdp.exec:\jpjdp.exe89⤵PID:4204
-
\??\c:\vjvvp.exec:\vjvvp.exe90⤵PID:4600
-
\??\c:\jdjdd.exec:\jdjdd.exe91⤵PID:3492
-
\??\c:\fxxllll.exec:\fxxllll.exe92⤵PID:2088
-
\??\c:\xffffff.exec:\xffffff.exe93⤵PID:1156
-
\??\c:\hhbhbh.exec:\hhbhbh.exe94⤵PID:908
-
\??\c:\ttttnt.exec:\ttttnt.exe95⤵PID:3332
-
\??\c:\hbhbtt.exec:\hbhbtt.exe96⤵PID:2904
-
\??\c:\1jppj.exec:\1jppj.exe97⤵PID:528
-
\??\c:\vpjdv.exec:\vpjdv.exe98⤵PID:4892
-
\??\c:\rrflfll.exec:\rrflfll.exe99⤵PID:2456
-
\??\c:\fxffxxf.exec:\fxffxxf.exe100⤵PID:2980
-
\??\c:\llrrrrl.exec:\llrrrrl.exe101⤵PID:2288
-
\??\c:\bbnntb.exec:\bbnntb.exe102⤵PID:4268
-
\??\c:\thbhhh.exec:\thbhhh.exe103⤵PID:4332
-
\??\c:\1vppj.exec:\1vppj.exe104⤵PID:3684
-
\??\c:\vpvvp.exec:\vpvvp.exe105⤵PID:2672
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe106⤵PID:1632
-
\??\c:\7fxrrxr.exec:\7fxrrxr.exe107⤵PID:3688
-
\??\c:\tnbbbh.exec:\tnbbbh.exe108⤵PID:4912
-
\??\c:\jpdjj.exec:\jpdjj.exe109⤵PID:836
-
\??\c:\jdjjd.exec:\jdjjd.exe110⤵PID:4980
-
\??\c:\rxrrrrf.exec:\rxrrrrf.exe111⤵PID:812
-
\??\c:\xrlfrrf.exec:\xrlfrrf.exe112⤵PID:760
-
\??\c:\nnnnnn.exec:\nnnnnn.exe113⤵PID:4424
-
\??\c:\ddpvv.exec:\ddpvv.exe114⤵PID:3604
-
\??\c:\jdpvp.exec:\jdpvp.exe115⤵PID:2768
-
\??\c:\lrlllll.exec:\lrlllll.exe116⤵PID:1908
-
\??\c:\fxxfllf.exec:\fxxfllf.exe117⤵PID:1520
-
\??\c:\bbbbtt.exec:\bbbbtt.exe118⤵PID:1004
-
\??\c:\hbbnnn.exec:\hbbnnn.exe119⤵PID:1020
-
\??\c:\vpjjd.exec:\vpjjd.exe120⤵PID:4788
-
\??\c:\1pvvp.exec:\1pvvp.exe121⤵PID:4588
-
\??\c:\7dppd.exec:\7dppd.exe122⤵PID:2704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-