Analysis
-
max time kernel
150s -
max time network
56s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 04:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f02cf73d023306f4d173de9e5b4b9f39f3bd6658a8efbc3969b56151be792971.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
f02cf73d023306f4d173de9e5b4b9f39f3bd6658a8efbc3969b56151be792971.exe
-
Size
69KB
-
MD5
c04b08b0341548855d780322a7c58c7d
-
SHA1
0743fa6066d3a46c692c8f4c1735091a417018a7
-
SHA256
f02cf73d023306f4d173de9e5b4b9f39f3bd6658a8efbc3969b56151be792971
-
SHA512
b64369f076db6905e3eac23884a9d49376d08e4a81113f53d7f9814820a13a9f72dfa53cfa18dccee9aa59343ef329ac92123536f90944db67bc83deee73ab8c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUPqrDZ5Rxfo:ymb3NkkiQ3mdBjF0yUmrfo
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/2636-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2088-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/724-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-87-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2092-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/720-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3804-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/804-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1160-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4416 frrffff.exe 1160 xrflrll.exe 5092 nhthbn.exe 804 1bnbhb.exe 3804 jdvvv.exe 720 fxxrxrf.exe 3172 lfrxfrx.exe 2304 tbbbnt.exe 2092 1pvjv.exe 3940 jjvvv.exe 2636 rlrrffx.exe 5008 thtbbn.exe 724 pjpjd.exe 2456 xrfllrr.exe 1496 lfffxrr.exe 3396 hbbbbb.exe 3264 9btttt.exe 4316 dvvdv.exe 3452 5vjjj.exe 4036 1fllllr.exe 3120 xlrlflf.exe 3828 1nnhhh.exe 4988 jvdjd.exe 4992 lflxflr.exe 4720 rfxxflx.exe 4800 thtbtt.exe 3024 nhhhhh.exe 872 vdvjv.exe 1828 ddjdv.exe 3588 llfrffx.exe 2088 rrrxflx.exe 2584 btbbtt.exe 3152 nbttth.exe 5060 9dpjp.exe 4288 djvdv.exe 3184 fllrxfl.exe 3476 rllffxr.exe 1852 nnnbhb.exe 3224 hnnnth.exe 2964 1bhhtt.exe 3180 vddpj.exe 4272 ddjvv.exe 4856 xxlfllr.exe 3268 xxllrfl.exe 4400 tnnhnn.exe 3648 tbhbtn.exe 4696 1vpjd.exe 4236 jjjjv.exe 2660 lflrrxf.exe 4504 rrllfff.exe 888 fllxlxl.exe 4604 tnnhhh.exe 720 tnhbtt.exe 4060 pjpvv.exe 828 5llfrrl.exe 1920 ffxrrrl.exe 3952 tthhtb.exe 4728 nhhhhh.exe 544 thnbtn.exe 4120 lfffxxx.exe 3696 rxrflfr.exe 3876 5nbhnt.exe 2652 bntbtt.exe 4460 dvjpd.exe -
resource yara_rule behavioral2/memory/3172-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1828-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2088-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/724-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/720-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3804-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/804-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/804-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-4-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3156 wrote to memory of 4416 3156 f02cf73d023306f4d173de9e5b4b9f39f3bd6658a8efbc3969b56151be792971.exe 81 PID 3156 wrote to memory of 4416 3156 f02cf73d023306f4d173de9e5b4b9f39f3bd6658a8efbc3969b56151be792971.exe 81 PID 3156 wrote to memory of 4416 3156 f02cf73d023306f4d173de9e5b4b9f39f3bd6658a8efbc3969b56151be792971.exe 81 PID 4416 wrote to memory of 1160 4416 frrffff.exe 82 PID 4416 wrote to memory of 1160 4416 frrffff.exe 82 PID 4416 wrote to memory of 1160 4416 frrffff.exe 82 PID 1160 wrote to memory of 5092 1160 xrflrll.exe 83 PID 1160 wrote to memory of 5092 1160 xrflrll.exe 83 PID 1160 wrote to memory of 5092 1160 xrflrll.exe 83 PID 5092 wrote to memory of 804 5092 nhthbn.exe 84 PID 5092 wrote to memory of 804 5092 nhthbn.exe 84 PID 5092 wrote to memory of 804 5092 nhthbn.exe 84 PID 804 wrote to memory of 3804 804 1bnbhb.exe 85 PID 804 wrote to memory of 3804 804 1bnbhb.exe 85 PID 804 wrote to memory of 3804 804 1bnbhb.exe 85 PID 3804 wrote to memory of 720 3804 jdvvv.exe 86 PID 3804 wrote to memory of 720 3804 jdvvv.exe 86 PID 3804 wrote to memory of 720 3804 jdvvv.exe 86 PID 720 wrote to memory of 3172 720 fxxrxrf.exe 87 PID 720 wrote to memory of 3172 720 fxxrxrf.exe 87 PID 720 wrote to memory of 3172 720 fxxrxrf.exe 87 PID 3172 wrote to memory of 2304 3172 lfrxfrx.exe 88 PID 3172 wrote to memory of 2304 3172 lfrxfrx.exe 88 PID 3172 wrote to memory of 2304 3172 lfrxfrx.exe 88 PID 2304 wrote to memory of 2092 2304 tbbbnt.exe 89 PID 2304 wrote to memory of 2092 2304 tbbbnt.exe 89 PID 2304 wrote to memory of 2092 2304 tbbbnt.exe 89 PID 2092 wrote to memory of 3940 2092 1pvjv.exe 90 PID 2092 wrote to memory of 3940 2092 1pvjv.exe 90 PID 2092 wrote to memory of 3940 2092 1pvjv.exe 90 PID 3940 wrote to memory of 2636 3940 jjvvv.exe 91 PID 3940 wrote to memory of 2636 3940 jjvvv.exe 91 PID 3940 wrote to memory of 2636 3940 jjvvv.exe 91 PID 2636 wrote to memory of 5008 2636 rlrrffx.exe 200 PID 2636 wrote to memory of 5008 2636 rlrrffx.exe 200 PID 2636 wrote to memory of 5008 2636 rlrrffx.exe 200 PID 5008 wrote to memory of 724 5008 thtbbn.exe 93 PID 5008 wrote to memory of 724 5008 thtbbn.exe 93 PID 5008 wrote to memory of 724 5008 thtbbn.exe 93 PID 724 wrote to memory of 2456 724 pjpjd.exe 94 PID 724 wrote to memory of 2456 724 pjpjd.exe 94 PID 724 wrote to memory of 2456 724 pjpjd.exe 94 PID 2456 wrote to memory of 1496 2456 xrfllrr.exe 95 PID 2456 wrote to memory of 1496 2456 xrfllrr.exe 95 PID 2456 wrote to memory of 1496 2456 xrfllrr.exe 95 PID 1496 wrote to memory of 3396 1496 lfffxrr.exe 96 PID 1496 wrote to memory of 3396 1496 lfffxrr.exe 96 PID 1496 wrote to memory of 3396 1496 lfffxrr.exe 96 PID 3396 wrote to memory of 3264 3396 hbbbbb.exe 97 PID 3396 wrote to memory of 3264 3396 hbbbbb.exe 97 PID 3396 wrote to memory of 3264 3396 hbbbbb.exe 97 PID 3264 wrote to memory of 4316 3264 9btttt.exe 98 PID 3264 wrote to memory of 4316 3264 9btttt.exe 98 PID 3264 wrote to memory of 4316 3264 9btttt.exe 98 PID 4316 wrote to memory of 3452 4316 dvvdv.exe 99 PID 4316 wrote to memory of 3452 4316 dvvdv.exe 99 PID 4316 wrote to memory of 3452 4316 dvvdv.exe 99 PID 3452 wrote to memory of 4036 3452 5vjjj.exe 100 PID 3452 wrote to memory of 4036 3452 5vjjj.exe 100 PID 3452 wrote to memory of 4036 3452 5vjjj.exe 100 PID 4036 wrote to memory of 3120 4036 1fllllr.exe 101 PID 4036 wrote to memory of 3120 4036 1fllllr.exe 101 PID 4036 wrote to memory of 3120 4036 1fllllr.exe 101 PID 3120 wrote to memory of 3828 3120 xlrlflf.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\f02cf73d023306f4d173de9e5b4b9f39f3bd6658a8efbc3969b56151be792971.exe"C:\Users\Admin\AppData\Local\Temp\f02cf73d023306f4d173de9e5b4b9f39f3bd6658a8efbc3969b56151be792971.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\frrffff.exec:\frrffff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\xrflrll.exec:\xrflrll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\nhthbn.exec:\nhthbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\1bnbhb.exec:\1bnbhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\jdvvv.exec:\jdvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\fxxrxrf.exec:\fxxrxrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\lfrxfrx.exec:\lfrxfrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\tbbbnt.exec:\tbbbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\1pvjv.exec:\1pvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\jjvvv.exec:\jjvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\rlrrffx.exec:\rlrrffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\thtbbn.exec:\thtbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\pjpjd.exec:\pjpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
\??\c:\xrfllrr.exec:\xrfllrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\lfffxrr.exec:\lfffxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\hbbbbb.exec:\hbbbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\9btttt.exec:\9btttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\dvvdv.exec:\dvvdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\5vjjj.exec:\5vjjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\1fllllr.exec:\1fllllr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\xlrlflf.exec:\xlrlflf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\1nnhhh.exec:\1nnhhh.exe23⤵
- Executes dropped EXE
PID:3828 -
\??\c:\jvdjd.exec:\jvdjd.exe24⤵
- Executes dropped EXE
PID:4988 -
\??\c:\lflxflr.exec:\lflxflr.exe25⤵
- Executes dropped EXE
PID:4992 -
\??\c:\rfxxflx.exec:\rfxxflx.exe26⤵
- Executes dropped EXE
PID:4720 -
\??\c:\thtbtt.exec:\thtbtt.exe27⤵
- Executes dropped EXE
PID:4800 -
\??\c:\nhhhhh.exec:\nhhhhh.exe28⤵
- Executes dropped EXE
PID:3024 -
\??\c:\vdvjv.exec:\vdvjv.exe29⤵
- Executes dropped EXE
PID:872 -
\??\c:\ddjdv.exec:\ddjdv.exe30⤵
- Executes dropped EXE
PID:1828 -
\??\c:\llfrffx.exec:\llfrffx.exe31⤵
- Executes dropped EXE
PID:3588 -
\??\c:\rrrxflx.exec:\rrrxflx.exe32⤵
- Executes dropped EXE
PID:2088 -
\??\c:\btbbtt.exec:\btbbtt.exe33⤵
- Executes dropped EXE
PID:2584 -
\??\c:\nbttth.exec:\nbttth.exe34⤵
- Executes dropped EXE
PID:3152 -
\??\c:\9dpjp.exec:\9dpjp.exe35⤵
- Executes dropped EXE
PID:5060 -
\??\c:\djvdv.exec:\djvdv.exe36⤵
- Executes dropped EXE
PID:4288 -
\??\c:\fllrxfl.exec:\fllrxfl.exe37⤵
- Executes dropped EXE
PID:3184 -
\??\c:\rllffxr.exec:\rllffxr.exe38⤵
- Executes dropped EXE
PID:3476 -
\??\c:\nnnbhb.exec:\nnnbhb.exe39⤵
- Executes dropped EXE
PID:1852 -
\??\c:\hnnnth.exec:\hnnnth.exe40⤵
- Executes dropped EXE
PID:3224 -
\??\c:\1bhhtt.exec:\1bhhtt.exe41⤵
- Executes dropped EXE
PID:2964 -
\??\c:\vddpj.exec:\vddpj.exe42⤵
- Executes dropped EXE
PID:3180 -
\??\c:\ddjvv.exec:\ddjvv.exe43⤵
- Executes dropped EXE
PID:4272 -
\??\c:\xxlfllr.exec:\xxlfllr.exe44⤵
- Executes dropped EXE
PID:4856 -
\??\c:\xxllrfl.exec:\xxllrfl.exe45⤵
- Executes dropped EXE
PID:3268 -
\??\c:\tnnhnn.exec:\tnnhnn.exe46⤵
- Executes dropped EXE
PID:4400 -
\??\c:\tbhbtn.exec:\tbhbtn.exe47⤵
- Executes dropped EXE
PID:3648 -
\??\c:\1vpjd.exec:\1vpjd.exe48⤵
- Executes dropped EXE
PID:4696 -
\??\c:\jjjjv.exec:\jjjjv.exe49⤵
- Executes dropped EXE
PID:4236 -
\??\c:\lflrrxf.exec:\lflrrxf.exe50⤵
- Executes dropped EXE
PID:2660 -
\??\c:\rrllfff.exec:\rrllfff.exe51⤵
- Executes dropped EXE
PID:4504 -
\??\c:\fllxlxl.exec:\fllxlxl.exe52⤵
- Executes dropped EXE
PID:888 -
\??\c:\tnnhhh.exec:\tnnhhh.exe53⤵
- Executes dropped EXE
PID:4604 -
\??\c:\tnhbtt.exec:\tnhbtt.exe54⤵
- Executes dropped EXE
PID:720 -
\??\c:\pjpvv.exec:\pjpvv.exe55⤵
- Executes dropped EXE
PID:4060 -
\??\c:\5llfrrl.exec:\5llfrrl.exe56⤵
- Executes dropped EXE
PID:828 -
\??\c:\ffxrrrl.exec:\ffxrrrl.exe57⤵
- Executes dropped EXE
PID:1920 -
\??\c:\tthhtb.exec:\tthhtb.exe58⤵
- Executes dropped EXE
PID:3952 -
\??\c:\nhhhhh.exec:\nhhhhh.exe59⤵
- Executes dropped EXE
PID:4728 -
\??\c:\thnbtn.exec:\thnbtn.exe60⤵
- Executes dropped EXE
PID:544 -
\??\c:\lfffxxx.exec:\lfffxxx.exe61⤵
- Executes dropped EXE
PID:4120 -
\??\c:\rxrflfr.exec:\rxrflfr.exe62⤵
- Executes dropped EXE
PID:3696 -
\??\c:\5nbhnt.exec:\5nbhnt.exe63⤵
- Executes dropped EXE
PID:3876 -
\??\c:\bntbtt.exec:\bntbtt.exe64⤵
- Executes dropped EXE
PID:2652 -
\??\c:\dvjpd.exec:\dvjpd.exe65⤵
- Executes dropped EXE
PID:4460 -
\??\c:\jvvpj.exec:\jvvpj.exe66⤵PID:2116
-
\??\c:\lxfrxrr.exec:\lxfrxrr.exe67⤵PID:4560
-
\??\c:\bntnhh.exec:\bntnhh.exe68⤵PID:4252
-
\??\c:\7nnhbb.exec:\7nnhbb.exe69⤵PID:4792
-
\??\c:\9hhhtb.exec:\9hhhtb.exe70⤵PID:2544
-
\??\c:\pjjdd.exec:\pjjdd.exe71⤵PID:3216
-
\??\c:\vpjdv.exec:\vpjdv.exe72⤵PID:3108
-
\??\c:\llxfxff.exec:\llxfxff.exe73⤵PID:3452
-
\??\c:\frrrlll.exec:\frrrlll.exe74⤵PID:1360
-
\??\c:\bnnnnn.exec:\bnnnnn.exe75⤵PID:3392
-
\??\c:\7nthbb.exec:\7nthbb.exe76⤵PID:3400
-
\??\c:\btbtnb.exec:\btbtnb.exe77⤵PID:4680
-
\??\c:\jjjdv.exec:\jjjdv.exe78⤵PID:3672
-
\??\c:\jjvjv.exec:\jjvjv.exe79⤵PID:3168
-
\??\c:\5xrxxxr.exec:\5xrxxxr.exe80⤵PID:2960
-
\??\c:\1llllll.exec:\1llllll.exe81⤵PID:1740
-
\??\c:\btnhbh.exec:\btnhbh.exe82⤵PID:3304
-
\??\c:\hhbbtt.exec:\hhbbtt.exe83⤵PID:548
-
\??\c:\vdvdd.exec:\vdvdd.exe84⤵PID:1424
-
\??\c:\jpvpj.exec:\jpvpj.exe85⤵PID:3512
-
\??\c:\lrllxxx.exec:\lrllxxx.exe86⤵PID:2528
-
\??\c:\fxxxrll.exec:\fxxxrll.exe87⤵PID:2648
-
\??\c:\lffffff.exec:\lffffff.exe88⤵PID:2088
-
\??\c:\hbbhbb.exec:\hbbhbb.exe89⤵PID:4712
-
\??\c:\nthhtn.exec:\nthhtn.exe90⤵PID:456
-
\??\c:\1jdvp.exec:\1jdvp.exe91⤵PID:2164
-
\??\c:\dvvvp.exec:\dvvvp.exe92⤵PID:3112
-
\??\c:\vpjdv.exec:\vpjdv.exe93⤵PID:3144
-
\??\c:\lrfxrrr.exec:\lrfxrrr.exe94⤵PID:1088
-
\??\c:\frfxxrl.exec:\frfxxrl.exe95⤵PID:2328
-
\??\c:\nhhnbb.exec:\nhhnbb.exe96⤵PID:1620
-
\??\c:\nhhnnt.exec:\nhhnnt.exe97⤵PID:4848
-
\??\c:\pdpjv.exec:\pdpjv.exe98⤵PID:1640
-
\??\c:\jpjvp.exec:\jpjvp.exe99⤵PID:3020
-
\??\c:\5vddp.exec:\5vddp.exe100⤵PID:404
-
\??\c:\lrxrrxr.exec:\lrxrrxr.exe101⤵PID:3180
-
\??\c:\frxrlrl.exec:\frxrlrl.exe102⤵PID:4864
-
\??\c:\hthhhh.exec:\hthhhh.exe103⤵PID:4392
-
\??\c:\nthttt.exec:\nthttt.exe104⤵PID:2492
-
\??\c:\pjddv.exec:\pjddv.exe105⤵PID:4400
-
\??\c:\jddpj.exec:\jddpj.exe106⤵PID:4416
-
\??\c:\rllrlll.exec:\rllrlll.exe107⤵PID:4696
-
\??\c:\frlxlxr.exec:\frlxlxr.exe108⤵PID:3016
-
\??\c:\bnbhtb.exec:\bnbhtb.exe109⤵PID:1512
-
\??\c:\ddjdv.exec:\ddjdv.exe110⤵PID:4016
-
\??\c:\3lrllrr.exec:\3lrllrr.exe111⤵PID:888
-
\??\c:\hbbbnn.exec:\hbbbnn.exe112⤵PID:512
-
\??\c:\dvdpd.exec:\dvdpd.exe113⤵PID:3860
-
\??\c:\lrxrlxx.exec:\lrxrlxx.exe114⤵PID:2800
-
\??\c:\fxfllrr.exec:\fxfllrr.exe115⤵PID:836
-
\??\c:\nhnhbn.exec:\nhnhbn.exe116⤵PID:752
-
\??\c:\jvddd.exec:\jvddd.exe117⤵PID:740
-
\??\c:\9llfxfx.exec:\9llfxfx.exe118⤵PID:4984
-
\??\c:\bbbttt.exec:\bbbttt.exe119⤵PID:1072
-
\??\c:\bhthhn.exec:\bhthhn.exe120⤵PID:5052
-
\??\c:\pvjdv.exec:\pvjdv.exe121⤵PID:5008
-
\??\c:\hnnnhh.exec:\hnnnhh.exe122⤵PID:3876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-