Analysis
-
max time kernel
120s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2024 21:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0dad4f633f78f484a1ea2a594390e0d0N.exe
Resource
win7-20240705-en
windows7-x64
5 signatures
120 seconds
General
-
Target
0dad4f633f78f484a1ea2a594390e0d0N.exe
-
Size
73KB
-
MD5
0dad4f633f78f484a1ea2a594390e0d0
-
SHA1
3383f5d0814c2b145de1776469d587908139138f
-
SHA256
afcb9bfae5f1828dd65598dc4f86e7a74494a2306742ced2e94986aeadc62dc1
-
SHA512
66ef6ee536fac779d1d11a1978de43d5c5d0476b41da32d3f194ceaabe5d81b6f0f47ef765c398934e0445d48c07c2fe8755c37ad0fa9656f95b76bd06c9cb07
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7tAHEqSCkKWSf:ymb3NkkiQ3mdBjFIynIKnf
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2720-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/412-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/760-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1500-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2708-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2564-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3552-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3208 lllfffl.exe 4412 bthhhh.exe 3224 nbhhbb.exe 4972 jjpjp.exe 4208 fxllrrf.exe 4436 vdpjj.exe 2384 ntbbbn.exe 3708 ttbhbh.exe 3424 ddddd.exe 2516 lrlllxl.exe 412 3htthn.exe 2996 ppjjj.exe 3268 ppvpj.exe 2912 fxrrrrr.exe 4820 nttttt.exe 972 hhhtnb.exe 760 vvvpp.exe 4572 ffllxxr.exe 1548 bnnnhh.exe 1500 tbbttb.exe 2372 5jppp.exe 1768 llrllff.exe 4348 llllllr.exe 2708 hhtnbh.exe 4648 3dpjd.exe 2564 frfxxxr.exe 3556 bbbbbh.exe 3128 nbhhbb.exe 3552 vjvvj.exe 4524 rrrlffr.exe 1972 hnnnnb.exe 1032 7jvpv.exe 4308 frrrlxr.exe 1732 fllrlrr.exe 3652 nnnnhn.exe 4952 nntnnt.exe 32 pjppv.exe 4300 xffxfll.exe 3544 ttbbbb.exe 4484 htnhnn.exe 4872 pjpjj.exe 3220 bttnbh.exe 2384 nttnth.exe 4144 lflffff.exe 3032 fxxxlff.exe 1028 tntttt.exe 2516 3nnhnn.exe 4928 vjpjd.exe 2960 lfxrlll.exe 3508 bhnnnt.exe 3632 jjjdv.exe 224 rlllxrr.exe 532 bbbbbh.exe 4984 flxxrlr.exe 1340 btnhbb.exe 640 bbtnnn.exe 3664 vvdjd.exe 1924 jdpvd.exe 4296 xrlllrl.exe 1500 1rffllr.exe 1700 hhbtth.exe 1768 hhhhnn.exe 404 jdjjp.exe 1664 xlrllxx.exe -
resource yara_rule behavioral2/memory/2720-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/412-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/760-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1500-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2708-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2564-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3552-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2720 wrote to memory of 3208 2720 0dad4f633f78f484a1ea2a594390e0d0N.exe 84 PID 2720 wrote to memory of 3208 2720 0dad4f633f78f484a1ea2a594390e0d0N.exe 84 PID 2720 wrote to memory of 3208 2720 0dad4f633f78f484a1ea2a594390e0d0N.exe 84 PID 3208 wrote to memory of 4412 3208 lllfffl.exe 85 PID 3208 wrote to memory of 4412 3208 lllfffl.exe 85 PID 3208 wrote to memory of 4412 3208 lllfffl.exe 85 PID 4412 wrote to memory of 3224 4412 bthhhh.exe 86 PID 4412 wrote to memory of 3224 4412 bthhhh.exe 86 PID 4412 wrote to memory of 3224 4412 bthhhh.exe 86 PID 3224 wrote to memory of 4972 3224 nbhhbb.exe 87 PID 3224 wrote to memory of 4972 3224 nbhhbb.exe 87 PID 3224 wrote to memory of 4972 3224 nbhhbb.exe 87 PID 4972 wrote to memory of 4208 4972 jjpjp.exe 88 PID 4972 wrote to memory of 4208 4972 jjpjp.exe 88 PID 4972 wrote to memory of 4208 4972 jjpjp.exe 88 PID 4208 wrote to memory of 4436 4208 fxllrrf.exe 90 PID 4208 wrote to memory of 4436 4208 fxllrrf.exe 90 PID 4208 wrote to memory of 4436 4208 fxllrrf.exe 90 PID 4436 wrote to memory of 2384 4436 vdpjj.exe 91 PID 4436 wrote to memory of 2384 4436 vdpjj.exe 91 PID 4436 wrote to memory of 2384 4436 vdpjj.exe 91 PID 2384 wrote to memory of 3708 2384 ntbbbn.exe 93 PID 2384 wrote to memory of 3708 2384 ntbbbn.exe 93 PID 2384 wrote to memory of 3708 2384 ntbbbn.exe 93 PID 3708 wrote to memory of 3424 3708 ttbhbh.exe 94 PID 3708 wrote to memory of 3424 3708 ttbhbh.exe 94 PID 3708 wrote to memory of 3424 3708 ttbhbh.exe 94 PID 3424 wrote to memory of 2516 3424 ddddd.exe 95 PID 3424 wrote to memory of 2516 3424 ddddd.exe 95 PID 3424 wrote to memory of 2516 3424 ddddd.exe 95 PID 2516 wrote to memory of 412 2516 lrlllxl.exe 96 PID 2516 wrote to memory of 412 2516 lrlllxl.exe 96 PID 2516 wrote to memory of 412 2516 lrlllxl.exe 96 PID 412 wrote to memory of 2996 412 3htthn.exe 97 PID 412 wrote to memory of 2996 412 3htthn.exe 97 PID 412 wrote to memory of 2996 412 3htthn.exe 97 PID 2996 wrote to memory of 3268 2996 ppjjj.exe 98 PID 2996 wrote to memory of 3268 2996 ppjjj.exe 98 PID 2996 wrote to memory of 3268 2996 ppjjj.exe 98 PID 3268 wrote to memory of 2912 3268 ppvpj.exe 99 PID 3268 wrote to memory of 2912 3268 ppvpj.exe 99 PID 3268 wrote to memory of 2912 3268 ppvpj.exe 99 PID 2912 wrote to memory of 4820 2912 fxrrrrr.exe 100 PID 2912 wrote to memory of 4820 2912 fxrrrrr.exe 100 PID 2912 wrote to memory of 4820 2912 fxrrrrr.exe 100 PID 4820 wrote to memory of 972 4820 nttttt.exe 101 PID 4820 wrote to memory of 972 4820 nttttt.exe 101 PID 4820 wrote to memory of 972 4820 nttttt.exe 101 PID 972 wrote to memory of 760 972 hhhtnb.exe 102 PID 972 wrote to memory of 760 972 hhhtnb.exe 102 PID 972 wrote to memory of 760 972 hhhtnb.exe 102 PID 760 wrote to memory of 4572 760 vvvpp.exe 103 PID 760 wrote to memory of 4572 760 vvvpp.exe 103 PID 760 wrote to memory of 4572 760 vvvpp.exe 103 PID 4572 wrote to memory of 1548 4572 ffllxxr.exe 104 PID 4572 wrote to memory of 1548 4572 ffllxxr.exe 104 PID 4572 wrote to memory of 1548 4572 ffllxxr.exe 104 PID 1548 wrote to memory of 1500 1548 bnnnhh.exe 106 PID 1548 wrote to memory of 1500 1548 bnnnhh.exe 106 PID 1548 wrote to memory of 1500 1548 bnnnhh.exe 106 PID 1500 wrote to memory of 2372 1500 tbbttb.exe 107 PID 1500 wrote to memory of 2372 1500 tbbttb.exe 107 PID 1500 wrote to memory of 2372 1500 tbbttb.exe 107 PID 2372 wrote to memory of 1768 2372 5jppp.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dad4f633f78f484a1ea2a594390e0d0N.exe"C:\Users\Admin\AppData\Local\Temp\0dad4f633f78f484a1ea2a594390e0d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\lllfffl.exec:\lllfffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\bthhhh.exec:\bthhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\nbhhbb.exec:\nbhhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\jjpjp.exec:\jjpjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\fxllrrf.exec:\fxllrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\vdpjj.exec:\vdpjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\ntbbbn.exec:\ntbbbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\ttbhbh.exec:\ttbhbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\ddddd.exec:\ddddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\lrlllxl.exec:\lrlllxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\3htthn.exec:\3htthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\ppjjj.exec:\ppjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\ppvpj.exec:\ppvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\fxrrrrr.exec:\fxrrrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\nttttt.exec:\nttttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\hhhtnb.exec:\hhhtnb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\vvvpp.exec:\vvvpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\ffllxxr.exec:\ffllxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\bnnnhh.exec:\bnnnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\tbbttb.exec:\tbbttb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\5jppp.exec:\5jppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\llrllff.exec:\llrllff.exe23⤵
- Executes dropped EXE
PID:1768 -
\??\c:\llllllr.exec:\llllllr.exe24⤵
- Executes dropped EXE
PID:4348 -
\??\c:\hhtnbh.exec:\hhtnbh.exe25⤵
- Executes dropped EXE
PID:2708 -
\??\c:\3dpjd.exec:\3dpjd.exe26⤵
- Executes dropped EXE
PID:4648 -
\??\c:\frfxxxr.exec:\frfxxxr.exe27⤵
- Executes dropped EXE
PID:2564 -
\??\c:\bbbbbh.exec:\bbbbbh.exe28⤵
- Executes dropped EXE
PID:3556 -
\??\c:\nbhhbb.exec:\nbhhbb.exe29⤵
- Executes dropped EXE
PID:3128 -
\??\c:\vjvvj.exec:\vjvvj.exe30⤵
- Executes dropped EXE
PID:3552 -
\??\c:\rrrlffr.exec:\rrrlffr.exe31⤵
- Executes dropped EXE
PID:4524 -
\??\c:\hnnnnb.exec:\hnnnnb.exe32⤵
- Executes dropped EXE
PID:1972 -
\??\c:\7jvpv.exec:\7jvpv.exe33⤵
- Executes dropped EXE
PID:1032 -
\??\c:\frrrlxr.exec:\frrrlxr.exe34⤵
- Executes dropped EXE
PID:4308 -
\??\c:\fllrlrr.exec:\fllrlrr.exe35⤵
- Executes dropped EXE
PID:1732 -
\??\c:\nnnnhn.exec:\nnnnhn.exe36⤵
- Executes dropped EXE
PID:3652 -
\??\c:\nntnnt.exec:\nntnnt.exe37⤵
- Executes dropped EXE
PID:4952 -
\??\c:\pjppv.exec:\pjppv.exe38⤵
- Executes dropped EXE
PID:32 -
\??\c:\xffxfll.exec:\xffxfll.exe39⤵
- Executes dropped EXE
PID:4300 -
\??\c:\ttbbbb.exec:\ttbbbb.exe40⤵
- Executes dropped EXE
PID:3544 -
\??\c:\htnhnn.exec:\htnhnn.exe41⤵
- Executes dropped EXE
PID:4484 -
\??\c:\pjpjj.exec:\pjpjj.exe42⤵
- Executes dropped EXE
PID:4872 -
\??\c:\bttnbh.exec:\bttnbh.exe43⤵
- Executes dropped EXE
PID:3220 -
\??\c:\nttnth.exec:\nttnth.exe44⤵
- Executes dropped EXE
PID:2384 -
\??\c:\lflffff.exec:\lflffff.exe45⤵
- Executes dropped EXE
PID:4144 -
\??\c:\fxxxlff.exec:\fxxxlff.exe46⤵
- Executes dropped EXE
PID:3032 -
\??\c:\tntttt.exec:\tntttt.exe47⤵
- Executes dropped EXE
PID:1028 -
\??\c:\3nnhnn.exec:\3nnhnn.exe48⤵
- Executes dropped EXE
PID:2516 -
\??\c:\vjpjd.exec:\vjpjd.exe49⤵
- Executes dropped EXE
PID:4928 -
\??\c:\lfxrlll.exec:\lfxrlll.exe50⤵
- Executes dropped EXE
PID:2960 -
\??\c:\bhnnnt.exec:\bhnnnt.exe51⤵
- Executes dropped EXE
PID:3508 -
\??\c:\jjjdv.exec:\jjjdv.exe52⤵
- Executes dropped EXE
PID:3632 -
\??\c:\rlllxrr.exec:\rlllxrr.exe53⤵
- Executes dropped EXE
PID:224 -
\??\c:\bbbbbh.exec:\bbbbbh.exe54⤵
- Executes dropped EXE
PID:532 -
\??\c:\flxxrlr.exec:\flxxrlr.exe55⤵
- Executes dropped EXE
PID:4984 -
\??\c:\btnhbb.exec:\btnhbb.exe56⤵
- Executes dropped EXE
PID:1340 -
\??\c:\bbtnnn.exec:\bbtnnn.exe57⤵
- Executes dropped EXE
PID:640 -
\??\c:\vvdjd.exec:\vvdjd.exe58⤵
- Executes dropped EXE
PID:3664 -
\??\c:\jdpvd.exec:\jdpvd.exe59⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xrlllrl.exec:\xrlllrl.exe60⤵
- Executes dropped EXE
PID:4296 -
\??\c:\1rffllr.exec:\1rffllr.exe61⤵
- Executes dropped EXE
PID:1500 -
\??\c:\hhbtth.exec:\hhbtth.exe62⤵
- Executes dropped EXE
PID:1700 -
\??\c:\hhhhnn.exec:\hhhhnn.exe63⤵
- Executes dropped EXE
PID:1768 -
\??\c:\jdjjp.exec:\jdjjp.exe64⤵
- Executes dropped EXE
PID:404 -
\??\c:\xlrllxx.exec:\xlrllxx.exe65⤵
- Executes dropped EXE
PID:1664 -
\??\c:\hhbhbh.exec:\hhbhbh.exe66⤵PID:628
-
\??\c:\ppjjp.exec:\ppjjp.exe67⤵PID:2676
-
\??\c:\5lffxff.exec:\5lffxff.exe68⤵PID:3020
-
\??\c:\nnbbtt.exec:\nnbbtt.exe69⤵PID:3976
-
\??\c:\vjppj.exec:\vjppj.exe70⤵PID:624
-
\??\c:\dddvp.exec:\dddvp.exe71⤵PID:3824
-
\??\c:\3lrrrrl.exec:\3lrrrrl.exe72⤵PID:4784
-
\??\c:\9nnnnn.exec:\9nnnnn.exe73⤵PID:2808
-
\??\c:\tnntnn.exec:\tnntnn.exe74⤵PID:4052
-
\??\c:\jddpd.exec:\jddpd.exe75⤵PID:4924
-
\??\c:\rlfxxxx.exec:\rlfxxxx.exe76⤵PID:1032
-
\??\c:\1lxxrxx.exec:\1lxxrxx.exe77⤵PID:2440
-
\??\c:\tttttt.exec:\tttttt.exe78⤵PID:2876
-
\??\c:\dvjdv.exec:\dvjdv.exe79⤵PID:4988
-
\??\c:\jjpdp.exec:\jjpdp.exe80⤵PID:1944
-
\??\c:\frxxllx.exec:\frxxllx.exe81⤵PID:3588
-
\??\c:\nhnhbb.exec:\nhnhbb.exe82⤵PID:2412
-
\??\c:\9jjjd.exec:\9jjjd.exe83⤵PID:3084
-
\??\c:\7dpjd.exec:\7dpjd.exe84⤵PID:1072
-
\??\c:\lfffxlr.exec:\lfffxlr.exe85⤵PID:4872
-
\??\c:\nhhhhn.exec:\nhhhhn.exe86⤵PID:2744
-
\??\c:\ttbbtb.exec:\ttbbtb.exe87⤵PID:2384
-
\??\c:\dvjvv.exec:\dvjvv.exe88⤵PID:4144
-
\??\c:\jjjdd.exec:\jjjdd.exe89⤵PID:4000
-
\??\c:\rrxrllf.exec:\rrxrllf.exe90⤵PID:4680
-
\??\c:\lflffff.exec:\lflffff.exe91⤵PID:5068
-
\??\c:\hhbbbh.exec:\hhbbbh.exe92⤵PID:1504
-
\??\c:\htbbbt.exec:\htbbbt.exe93⤵PID:1120
-
\??\c:\dvddd.exec:\dvddd.exe94⤵PID:4416
-
\??\c:\ffxrxxl.exec:\ffxrxxl.exe95⤵PID:4488
-
\??\c:\fxflfll.exec:\fxflfll.exe96⤵PID:376
-
\??\c:\nnnttb.exec:\nnnttb.exe97⤵PID:3460
-
\??\c:\1vddv.exec:\1vddv.exe98⤵PID:400
-
\??\c:\rlllxxr.exec:\rlllxxr.exe99⤵PID:2388
-
\??\c:\nnnhht.exec:\nnnhht.exe100⤵PID:1236
-
\??\c:\5nbbtb.exec:\5nbbtb.exe101⤵PID:3392
-
\??\c:\ddppd.exec:\ddppd.exe102⤵PID:1548
-
\??\c:\jdppj.exec:\jdppj.exe103⤵PID:3704
-
\??\c:\frxxrxx.exec:\frxxrxx.exe104⤵PID:4724
-
\??\c:\xlrxrrr.exec:\xlrxrrr.exe105⤵PID:4064
-
\??\c:\tnnnhn.exec:\tnnnhn.exe106⤵PID:748
-
\??\c:\vvjpv.exec:\vvjpv.exe107⤵PID:816
-
\??\c:\rrfffll.exec:\rrfffll.exe108⤵PID:2488
-
\??\c:\lxlxrrf.exec:\lxlxrrf.exe109⤵PID:2584
-
\??\c:\pjddd.exec:\pjddd.exe110⤵PID:2520
-
\??\c:\lrxxrrr.exec:\lrxxrrr.exe111⤵PID:3556
-
\??\c:\llrrrrr.exec:\llrrrrr.exe112⤵PID:1188
-
\??\c:\nhbnbt.exec:\nhbnbt.exe113⤵PID:5004
-
\??\c:\bbbbbh.exec:\bbbbbh.exe114⤵PID:864
-
\??\c:\pjvvd.exec:\pjvvd.exe115⤵PID:3660
-
\??\c:\1vdvp.exec:\1vdvp.exe116⤵PID:4308
-
\??\c:\frrrlxf.exec:\frrrlxf.exe117⤵PID:2724
-
\??\c:\rrrllrr.exec:\rrrllrr.exe118⤵PID:4952
-
\??\c:\lxxrllf.exec:\lxxrllf.exe119⤵PID:4300
-
\??\c:\nntttt.exec:\nntttt.exe120⤵PID:3224
-
\??\c:\vjddv.exec:\vjddv.exe121⤵PID:3676
-
\??\c:\jjvvp.exec:\jjvvp.exe122⤵PID:3124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-