Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 02:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cad8f65496446837ea177abf3de6df54c31a168ab41677097c004fc03bafff8c.exe
Resource
win7-20240708-en
5 signatures
150 seconds
General
-
Target
cad8f65496446837ea177abf3de6df54c31a168ab41677097c004fc03bafff8c.exe
-
Size
65KB
-
MD5
ab853a24eedc44c1ba125050e0bf27fd
-
SHA1
b525c2189626a148eb2f308c4db5091c41da8594
-
SHA256
cad8f65496446837ea177abf3de6df54c31a168ab41677097c004fc03bafff8c
-
SHA512
e13457a67745b6281ca9a60ce3631a37f38dc88bd87ba47ce672b3fa68c86c4ed922dce0a1f85007b96c2cb4edd8c014d48d8c70ca20715c810fcf31cd19ab2e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdWLLQYO:ymb3NkkiQ3mdBjFIFdkO
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2772-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/312-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/676-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/924-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1728-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2584 3jjvj.exe 1628 9frlfrl.exe 3272 bbthbt.exe 1796 jjdvp.exe 3780 xxrlfxl.exe 4404 3ttbtt.exe 4616 5pdvj.exe 2556 rrxllll.exe 1528 xlxrfxl.exe 2572 bnttnh.exe 2000 7dvpj.exe 3220 lffrrfl.exe 4076 bntbhb.exe 312 dvvjv.exe 4920 1ppdp.exe 3948 lrrlxrl.exe 680 nntntn.exe 4480 3ttnbb.exe 1692 dvpjd.exe 4156 fxffxff.exe 4568 fffrfxl.exe 676 nnhhtn.exe 1180 vdvvd.exe 3384 frllllf.exe 840 thbbtn.exe 924 tnbhnh.exe 1632 3jjpj.exe 1728 rfxxlrl.exe 4928 fxfrfxl.exe 3368 bbbthh.exe 3268 rlrllll.exe 1332 xffrlfl.exe 3560 nhnnbb.exe 4232 1dvpj.exe 4492 3rfxrlf.exe 4560 lrrrlll.exe 1472 nbbbtt.exe 3508 bnbtnh.exe 4580 vjddv.exe 1976 xxrrrxx.exe 3000 hbttht.exe 2008 djvjp.exe 4552 7lflrxr.exe 2436 rllxxxx.exe 4904 hbbbtn.exe 1980 httnnn.exe 3356 vvjjj.exe 2124 fxlllll.exe 4644 llxrflx.exe 4136 hbhhhn.exe 5004 nhhnbb.exe 2760 dvddd.exe 2552 fxflxxl.exe 4636 nhbtbb.exe 4476 dvdvj.exe 3432 xxllrlf.exe 4004 rffllrr.exe 1248 htbhhn.exe 1520 9pjdp.exe 440 9vvpj.exe 3948 lxrrlrl.exe 976 flxrffx.exe 1920 tbtbhb.exe 2196 jpdjv.exe -
resource yara_rule behavioral2/memory/2772-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3780-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3780-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3780-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/312-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/676-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/924-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2584 2772 cad8f65496446837ea177abf3de6df54c31a168ab41677097c004fc03bafff8c.exe 84 PID 2772 wrote to memory of 2584 2772 cad8f65496446837ea177abf3de6df54c31a168ab41677097c004fc03bafff8c.exe 84 PID 2772 wrote to memory of 2584 2772 cad8f65496446837ea177abf3de6df54c31a168ab41677097c004fc03bafff8c.exe 84 PID 2584 wrote to memory of 1628 2584 3jjvj.exe 85 PID 2584 wrote to memory of 1628 2584 3jjvj.exe 85 PID 2584 wrote to memory of 1628 2584 3jjvj.exe 85 PID 1628 wrote to memory of 3272 1628 9frlfrl.exe 86 PID 1628 wrote to memory of 3272 1628 9frlfrl.exe 86 PID 1628 wrote to memory of 3272 1628 9frlfrl.exe 86 PID 3272 wrote to memory of 1796 3272 bbthbt.exe 87 PID 3272 wrote to memory of 1796 3272 bbthbt.exe 87 PID 3272 wrote to memory of 1796 3272 bbthbt.exe 87 PID 1796 wrote to memory of 3780 1796 jjdvp.exe 88 PID 1796 wrote to memory of 3780 1796 jjdvp.exe 88 PID 1796 wrote to memory of 3780 1796 jjdvp.exe 88 PID 3780 wrote to memory of 4404 3780 xxrlfxl.exe 89 PID 3780 wrote to memory of 4404 3780 xxrlfxl.exe 89 PID 3780 wrote to memory of 4404 3780 xxrlfxl.exe 89 PID 4404 wrote to memory of 4616 4404 3ttbtt.exe 90 PID 4404 wrote to memory of 4616 4404 3ttbtt.exe 90 PID 4404 wrote to memory of 4616 4404 3ttbtt.exe 90 PID 4616 wrote to memory of 2556 4616 5pdvj.exe 91 PID 4616 wrote to memory of 2556 4616 5pdvj.exe 91 PID 4616 wrote to memory of 2556 4616 5pdvj.exe 91 PID 2556 wrote to memory of 1528 2556 rrxllll.exe 92 PID 2556 wrote to memory of 1528 2556 rrxllll.exe 92 PID 2556 wrote to memory of 1528 2556 rrxllll.exe 92 PID 1528 wrote to memory of 2572 1528 xlxrfxl.exe 93 PID 1528 wrote to memory of 2572 1528 xlxrfxl.exe 93 PID 1528 wrote to memory of 2572 1528 xlxrfxl.exe 93 PID 2572 wrote to memory of 2000 2572 bnttnh.exe 94 PID 2572 wrote to memory of 2000 2572 bnttnh.exe 94 PID 2572 wrote to memory of 2000 2572 bnttnh.exe 94 PID 2000 wrote to memory of 3220 2000 7dvpj.exe 95 PID 2000 wrote to memory of 3220 2000 7dvpj.exe 95 PID 2000 wrote to memory of 3220 2000 7dvpj.exe 95 PID 3220 wrote to memory of 4076 3220 lffrrfl.exe 96 PID 3220 wrote to memory of 4076 3220 lffrrfl.exe 96 PID 3220 wrote to memory of 4076 3220 lffrrfl.exe 96 PID 4076 wrote to memory of 312 4076 bntbhb.exe 97 PID 4076 wrote to memory of 312 4076 bntbhb.exe 97 PID 4076 wrote to memory of 312 4076 bntbhb.exe 97 PID 312 wrote to memory of 4920 312 dvvjv.exe 98 PID 312 wrote to memory of 4920 312 dvvjv.exe 98 PID 312 wrote to memory of 4920 312 dvvjv.exe 98 PID 4920 wrote to memory of 3948 4920 1ppdp.exe 99 PID 4920 wrote to memory of 3948 4920 1ppdp.exe 99 PID 4920 wrote to memory of 3948 4920 1ppdp.exe 99 PID 3948 wrote to memory of 680 3948 lrrlxrl.exe 100 PID 3948 wrote to memory of 680 3948 lrrlxrl.exe 100 PID 3948 wrote to memory of 680 3948 lrrlxrl.exe 100 PID 680 wrote to memory of 4480 680 nntntn.exe 101 PID 680 wrote to memory of 4480 680 nntntn.exe 101 PID 680 wrote to memory of 4480 680 nntntn.exe 101 PID 4480 wrote to memory of 1692 4480 3ttnbb.exe 102 PID 4480 wrote to memory of 1692 4480 3ttnbb.exe 102 PID 4480 wrote to memory of 1692 4480 3ttnbb.exe 102 PID 1692 wrote to memory of 4156 1692 dvpjd.exe 103 PID 1692 wrote to memory of 4156 1692 dvpjd.exe 103 PID 1692 wrote to memory of 4156 1692 dvpjd.exe 103 PID 4156 wrote to memory of 4568 4156 fxffxff.exe 105 PID 4156 wrote to memory of 4568 4156 fxffxff.exe 105 PID 4156 wrote to memory of 4568 4156 fxffxff.exe 105 PID 4568 wrote to memory of 676 4568 fffrfxl.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\cad8f65496446837ea177abf3de6df54c31a168ab41677097c004fc03bafff8c.exe"C:\Users\Admin\AppData\Local\Temp\cad8f65496446837ea177abf3de6df54c31a168ab41677097c004fc03bafff8c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\3jjvj.exec:\3jjvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\9frlfrl.exec:\9frlfrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\bbthbt.exec:\bbthbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\jjdvp.exec:\jjdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\xxrlfxl.exec:\xxrlfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\3ttbtt.exec:\3ttbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\5pdvj.exec:\5pdvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\rrxllll.exec:\rrxllll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\xlxrfxl.exec:\xlxrfxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\bnttnh.exec:\bnttnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\7dvpj.exec:\7dvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\lffrrfl.exec:\lffrrfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\bntbhb.exec:\bntbhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\dvvjv.exec:\dvvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\1ppdp.exec:\1ppdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\lrrlxrl.exec:\lrrlxrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\nntntn.exec:\nntntn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\3ttnbb.exec:\3ttnbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\dvpjd.exec:\dvpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\fxffxff.exec:\fxffxff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\fffrfxl.exec:\fffrfxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\nnhhtn.exec:\nnhhtn.exe23⤵
- Executes dropped EXE
PID:676 -
\??\c:\vdvvd.exec:\vdvvd.exe24⤵
- Executes dropped EXE
PID:1180 -
\??\c:\frllllf.exec:\frllllf.exe25⤵
- Executes dropped EXE
PID:3384 -
\??\c:\thbbtn.exec:\thbbtn.exe26⤵
- Executes dropped EXE
PID:840 -
\??\c:\tnbhnh.exec:\tnbhnh.exe27⤵
- Executes dropped EXE
PID:924 -
\??\c:\3jjpj.exec:\3jjpj.exe28⤵
- Executes dropped EXE
PID:1632 -
\??\c:\rfxxlrl.exec:\rfxxlrl.exe29⤵
- Executes dropped EXE
PID:1728 -
\??\c:\fxfrfxl.exec:\fxfrfxl.exe30⤵
- Executes dropped EXE
PID:4928 -
\??\c:\bbbthh.exec:\bbbthh.exe31⤵
- Executes dropped EXE
PID:3368 -
\??\c:\rlrllll.exec:\rlrllll.exe32⤵
- Executes dropped EXE
PID:3268 -
\??\c:\xffrlfl.exec:\xffrlfl.exe33⤵
- Executes dropped EXE
PID:1332 -
\??\c:\nhnnbb.exec:\nhnnbb.exe34⤵
- Executes dropped EXE
PID:3560 -
\??\c:\1dvpj.exec:\1dvpj.exe35⤵
- Executes dropped EXE
PID:4232 -
\??\c:\3rfxrlf.exec:\3rfxrlf.exe36⤵
- Executes dropped EXE
PID:4492 -
\??\c:\lrrrlll.exec:\lrrrlll.exe37⤵
- Executes dropped EXE
PID:4560 -
\??\c:\nbbbtt.exec:\nbbbtt.exe38⤵
- Executes dropped EXE
PID:1472 -
\??\c:\bnbtnh.exec:\bnbtnh.exe39⤵
- Executes dropped EXE
PID:3508 -
\??\c:\vjddv.exec:\vjddv.exe40⤵
- Executes dropped EXE
PID:4580 -
\??\c:\xxrrrxx.exec:\xxrrrxx.exe41⤵
- Executes dropped EXE
PID:1976 -
\??\c:\hbttht.exec:\hbttht.exe42⤵
- Executes dropped EXE
PID:3000 -
\??\c:\djvjp.exec:\djvjp.exe43⤵
- Executes dropped EXE
PID:2008 -
\??\c:\7lflrxr.exec:\7lflrxr.exe44⤵
- Executes dropped EXE
PID:4552 -
\??\c:\rllxxxx.exec:\rllxxxx.exe45⤵
- Executes dropped EXE
PID:2436 -
\??\c:\hbbbtn.exec:\hbbbtn.exe46⤵
- Executes dropped EXE
PID:4904 -
\??\c:\httnnn.exec:\httnnn.exe47⤵
- Executes dropped EXE
PID:1980 -
\??\c:\vvjjj.exec:\vvjjj.exe48⤵
- Executes dropped EXE
PID:3356 -
\??\c:\fxlllll.exec:\fxlllll.exe49⤵
- Executes dropped EXE
PID:2124 -
\??\c:\llxrflx.exec:\llxrflx.exe50⤵
- Executes dropped EXE
PID:4644 -
\??\c:\hbhhhn.exec:\hbhhhn.exe51⤵
- Executes dropped EXE
PID:4136 -
\??\c:\nhhnbb.exec:\nhhnbb.exe52⤵
- Executes dropped EXE
PID:5004 -
\??\c:\dvddd.exec:\dvddd.exe53⤵
- Executes dropped EXE
PID:2760 -
\??\c:\fxflxxl.exec:\fxflxxl.exe54⤵
- Executes dropped EXE
PID:2552 -
\??\c:\nhbtbb.exec:\nhbtbb.exe55⤵
- Executes dropped EXE
PID:4636 -
\??\c:\dvdvj.exec:\dvdvj.exe56⤵
- Executes dropped EXE
PID:4476 -
\??\c:\xxllrlf.exec:\xxllrlf.exe57⤵
- Executes dropped EXE
PID:3432 -
\??\c:\rffllrr.exec:\rffllrr.exe58⤵
- Executes dropped EXE
PID:4004 -
\??\c:\htbhhn.exec:\htbhhn.exe59⤵
- Executes dropped EXE
PID:1248 -
\??\c:\9pjdp.exec:\9pjdp.exe60⤵
- Executes dropped EXE
PID:1520 -
\??\c:\9vvpj.exec:\9vvpj.exe61⤵
- Executes dropped EXE
PID:440 -
\??\c:\lxrrlrl.exec:\lxrrlrl.exe62⤵
- Executes dropped EXE
PID:3948 -
\??\c:\flxrffx.exec:\flxrffx.exe63⤵
- Executes dropped EXE
PID:976 -
\??\c:\tbtbhb.exec:\tbtbhb.exe64⤵
- Executes dropped EXE
PID:1920 -
\??\c:\jpdjv.exec:\jpdjv.exe65⤵
- Executes dropped EXE
PID:2196 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe66⤵PID:1696
-
\??\c:\lllfffx.exec:\lllfffx.exe67⤵PID:3352
-
\??\c:\hbbtnn.exec:\hbbtnn.exe68⤵PID:2452
-
\??\c:\7xxrxxr.exec:\7xxrxxr.exe69⤵PID:1380
-
\??\c:\1xlflxl.exec:\1xlflxl.exe70⤵PID:2112
-
\??\c:\lfrfrlx.exec:\lfrfrlx.exe71⤵PID:996
-
\??\c:\tbhthh.exec:\tbhthh.exe72⤵PID:3344
-
\??\c:\vvpvp.exec:\vvpvp.exe73⤵PID:2356
-
\??\c:\dpdvj.exec:\dpdvj.exe74⤵PID:1480
-
\??\c:\9rxxfff.exec:\9rxxfff.exe75⤵PID:3964
-
\??\c:\rlflxrl.exec:\rlflxrl.exe76⤵PID:1728
-
\??\c:\nhhhhh.exec:\nhhhhh.exe77⤵PID:4928
-
\??\c:\jpdjv.exec:\jpdjv.exe78⤵PID:1716
-
\??\c:\7dpdv.exec:\7dpdv.exe79⤵PID:2768
-
\??\c:\flxlxxl.exec:\flxlxxl.exe80⤵PID:2240
-
\??\c:\rrfrrfr.exec:\rrfrrfr.exe81⤵PID:3264
-
\??\c:\httnth.exec:\httnth.exe82⤵PID:2276
-
\??\c:\bbnhbb.exec:\bbnhbb.exe83⤵PID:4832
-
\??\c:\ppdvv.exec:\ppdvv.exe84⤵PID:1676
-
\??\c:\1pppp.exec:\1pppp.exe85⤵PID:4784
-
\??\c:\7rxlllr.exec:\7rxlllr.exe86⤵PID:4540
-
\??\c:\lfllrxf.exec:\lfllrxf.exe87⤵PID:3508
-
\??\c:\hhhbbb.exec:\hhhbbb.exe88⤵PID:4652
-
\??\c:\hbhbhh.exec:\hbhbhh.exe89⤵PID:2772
-
\??\c:\jppdv.exec:\jppdv.exe90⤵PID:3844
-
\??\c:\5jdpd.exec:\5jdpd.exe91⤵PID:928
-
\??\c:\fxxxlll.exec:\fxxxlll.exe92⤵PID:1628
-
\??\c:\frxxxff.exec:\frxxxff.exe93⤵PID:4552
-
\??\c:\nhnhnn.exec:\nhnhnn.exe94⤵PID:4472
-
\??\c:\nnntht.exec:\nnntht.exe95⤵PID:4904
-
\??\c:\pdjdd.exec:\pdjdd.exe96⤵PID:2584
-
\??\c:\1dpdp.exec:\1dpdp.exe97⤵PID:956
-
\??\c:\3flffxx.exec:\3flffxx.exe98⤵PID:2380
-
\??\c:\lxrlxrl.exec:\lxrlxrl.exe99⤵PID:1652
-
\??\c:\9bhhbb.exec:\9bhhbb.exe100⤵PID:1492
-
\??\c:\vjjjd.exec:\vjjjd.exe101⤵PID:2120
-
\??\c:\9xxrxrf.exec:\9xxrxrf.exe102⤵PID:2688
-
\??\c:\lllfffx.exec:\lllfffx.exe103⤵PID:5036
-
\??\c:\hhbhbb.exec:\hhbhbb.exe104⤵PID:3204
-
\??\c:\htttnn.exec:\htttnn.exe105⤵PID:1824
-
\??\c:\jjvpv.exec:\jjvpv.exe106⤵PID:344
-
\??\c:\fxxrrlx.exec:\fxxrrlx.exe107⤵PID:2948
-
\??\c:\7lxrlll.exec:\7lxrlll.exe108⤵PID:744
-
\??\c:\9ttttt.exec:\9ttttt.exe109⤵PID:4780
-
\??\c:\ttbbbh.exec:\ttbbbh.exe110⤵PID:3948
-
\??\c:\jdppv.exec:\jdppv.exe111⤵PID:976
-
\??\c:\vvvdd.exec:\vvvdd.exe112⤵PID:1800
-
\??\c:\3rxrlrl.exec:\3rxrlrl.exe113⤵PID:220
-
\??\c:\hbtbtt.exec:\hbtbtt.exe114⤵PID:1696
-
\??\c:\hbhbtt.exec:\hbhbtt.exe115⤵PID:3496
-
\??\c:\7htnnn.exec:\7htnnn.exe116⤵PID:2096
-
\??\c:\dpddj.exec:\dpddj.exe117⤵PID:1380
-
\??\c:\pjpjj.exec:\pjpjj.exe118⤵PID:2112
-
\??\c:\lfxrxff.exec:\lfxrxff.exe119⤵PID:996
-
\??\c:\rrxrxff.exec:\rrxrxff.exe120⤵PID:924
-
\??\c:\hhhhbb.exec:\hhhhbb.exe121⤵PID:2356
-
\??\c:\nnbntt.exec:\nnbntt.exe122⤵PID:4676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-