Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 20:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3b760197ec5fb86a9f43c557be5d786c2a6401dd4e8c50bed084035fcfcfd75d.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
3b760197ec5fb86a9f43c557be5d786c2a6401dd4e8c50bed084035fcfcfd75d.exe
-
Size
54KB
-
MD5
f9bda3730b0829dcb64aaca0117a9221
-
SHA1
9523779d1a6889bc28eff8ac645830cbb33fa98f
-
SHA256
3b760197ec5fb86a9f43c557be5d786c2a6401dd4e8c50bed084035fcfcfd75d
-
SHA512
0a71791523969d2fdbba13c64318c676f7a305d87182b83ed80170a413030893bbc2ed2b38e54ab2ba9d362caa66abe6cdbf36c07724d065d72d1c9fa2673c93
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFV6:ymb3NkkiQ3mdBjFIFV6
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/332-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1304-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3808-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 22 IoCs
resource yara_rule behavioral2/memory/332-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5000-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2312-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1548-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1304-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/636-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1888-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4240-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/376-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3516-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2752-81-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1528-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/920-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5100-106-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2792-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4212-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4728-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3808-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/748-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4700-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3488-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3576-178-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1548 pjdvp.exe 5000 rfffxxx.exe 2312 hbtnhn.exe 1304 ddddd.exe 636 rffxllf.exe 4076 btbbbb.exe 1888 9hnttn.exe 4240 5vdvp.exe 376 xlrlffr.exe 3516 fxfrlfl.exe 2752 thhbbn.exe 1528 vdvjd.exe 1308 ffxrxxr.exe 920 1lxxrlx.exe 5100 hnnbbb.exe 2792 9pppp.exe 4212 5vjvv.exe 4068 rlrrlrr.exe 4728 nbhhbn.exe 3140 vjvvd.exe 3380 lffxllx.exe 3808 nhtnbb.exe 4504 bhnhbb.exe 748 jvvdd.exe 3212 vjvvp.exe 3812 1lffxxr.exe 3576 7ffllll.exe 3488 hbhnth.exe 3936 bnbbtb.exe 3296 jvddv.exe 4700 vvpdd.exe 3844 5xrlffr.exe 1144 hbtntb.exe 544 nnhbhh.exe 2084 tnbbtb.exe 1056 9djdv.exe 4724 jvvpd.exe 1600 pvjdv.exe 4268 xrfxrxx.exe 4676 xrfxrll.exe 332 httttt.exe 4588 tntnnn.exe 4488 hbbnnn.exe 3088 jpdvd.exe 1652 pvdvp.exe 1740 xlrrrfr.exe 3544 flrrllr.exe 4784 tnbtnn.exe 1584 thbthn.exe 3528 1bhhbb.exe 2128 vdpvj.exe 5012 jdjdv.exe 2572 5xxrxxf.exe 4988 9rxxxxx.exe 3944 ntbhhh.exe 936 nnttnt.exe 468 5ttbth.exe 1308 vpdjd.exe 920 5dpjj.exe 1980 rlfrlll.exe 2768 7flfffx.exe 1044 xfflxlx.exe 4772 hnbhhh.exe 2512 nbhnhn.exe -
resource yara_rule behavioral2/memory/332-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1304-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-178-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 332 wrote to memory of 1548 332 3b760197ec5fb86a9f43c557be5d786c2a6401dd4e8c50bed084035fcfcfd75d.exe 82 PID 332 wrote to memory of 1548 332 3b760197ec5fb86a9f43c557be5d786c2a6401dd4e8c50bed084035fcfcfd75d.exe 82 PID 332 wrote to memory of 1548 332 3b760197ec5fb86a9f43c557be5d786c2a6401dd4e8c50bed084035fcfcfd75d.exe 82 PID 1548 wrote to memory of 5000 1548 pjdvp.exe 83 PID 1548 wrote to memory of 5000 1548 pjdvp.exe 83 PID 1548 wrote to memory of 5000 1548 pjdvp.exe 83 PID 5000 wrote to memory of 2312 5000 rfffxxx.exe 84 PID 5000 wrote to memory of 2312 5000 rfffxxx.exe 84 PID 5000 wrote to memory of 2312 5000 rfffxxx.exe 84 PID 2312 wrote to memory of 1304 2312 hbtnhn.exe 85 PID 2312 wrote to memory of 1304 2312 hbtnhn.exe 85 PID 2312 wrote to memory of 1304 2312 hbtnhn.exe 85 PID 1304 wrote to memory of 636 1304 ddddd.exe 86 PID 1304 wrote to memory of 636 1304 ddddd.exe 86 PID 1304 wrote to memory of 636 1304 ddddd.exe 86 PID 636 wrote to memory of 4076 636 rffxllf.exe 87 PID 636 wrote to memory of 4076 636 rffxllf.exe 87 PID 636 wrote to memory of 4076 636 rffxllf.exe 87 PID 4076 wrote to memory of 1888 4076 btbbbb.exe 88 PID 4076 wrote to memory of 1888 4076 btbbbb.exe 88 PID 4076 wrote to memory of 1888 4076 btbbbb.exe 88 PID 1888 wrote to memory of 4240 1888 9hnttn.exe 89 PID 1888 wrote to memory of 4240 1888 9hnttn.exe 89 PID 1888 wrote to memory of 4240 1888 9hnttn.exe 89 PID 4240 wrote to memory of 376 4240 5vdvp.exe 90 PID 4240 wrote to memory of 376 4240 5vdvp.exe 90 PID 4240 wrote to memory of 376 4240 5vdvp.exe 90 PID 376 wrote to memory of 3516 376 xlrlffr.exe 91 PID 376 wrote to memory of 3516 376 xlrlffr.exe 91 PID 376 wrote to memory of 3516 376 xlrlffr.exe 91 PID 3516 wrote to memory of 2752 3516 fxfrlfl.exe 92 PID 3516 wrote to memory of 2752 3516 fxfrlfl.exe 92 PID 3516 wrote to memory of 2752 3516 fxfrlfl.exe 92 PID 2752 wrote to memory of 1528 2752 thhbbn.exe 93 PID 2752 wrote to memory of 1528 2752 thhbbn.exe 93 PID 2752 wrote to memory of 1528 2752 thhbbn.exe 93 PID 1528 wrote to memory of 1308 1528 vdvjd.exe 142 PID 1528 wrote to memory of 1308 1528 vdvjd.exe 142 PID 1528 wrote to memory of 1308 1528 vdvjd.exe 142 PID 1308 wrote to memory of 920 1308 ffxrxxr.exe 143 PID 1308 wrote to memory of 920 1308 ffxrxxr.exe 143 PID 1308 wrote to memory of 920 1308 ffxrxxr.exe 143 PID 920 wrote to memory of 5100 920 1lxxrlx.exe 96 PID 920 wrote to memory of 5100 920 1lxxrlx.exe 96 PID 920 wrote to memory of 5100 920 1lxxrlx.exe 96 PID 5100 wrote to memory of 2792 5100 hnnbbb.exe 97 PID 5100 wrote to memory of 2792 5100 hnnbbb.exe 97 PID 5100 wrote to memory of 2792 5100 hnnbbb.exe 97 PID 2792 wrote to memory of 4212 2792 9pppp.exe 98 PID 2792 wrote to memory of 4212 2792 9pppp.exe 98 PID 2792 wrote to memory of 4212 2792 9pppp.exe 98 PID 4212 wrote to memory of 4068 4212 5vjvv.exe 198 PID 4212 wrote to memory of 4068 4212 5vjvv.exe 198 PID 4212 wrote to memory of 4068 4212 5vjvv.exe 198 PID 4068 wrote to memory of 4728 4068 rlrrlrr.exe 101 PID 4068 wrote to memory of 4728 4068 rlrrlrr.exe 101 PID 4068 wrote to memory of 4728 4068 rlrrlrr.exe 101 PID 4728 wrote to memory of 3140 4728 nbhhbn.exe 151 PID 4728 wrote to memory of 3140 4728 nbhhbn.exe 151 PID 4728 wrote to memory of 3140 4728 nbhhbn.exe 151 PID 3140 wrote to memory of 3380 3140 vjvvd.exe 203 PID 3140 wrote to memory of 3380 3140 vjvvd.exe 203 PID 3140 wrote to memory of 3380 3140 vjvvd.exe 203 PID 3380 wrote to memory of 3808 3380 lffxllx.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b760197ec5fb86a9f43c557be5d786c2a6401dd4e8c50bed084035fcfcfd75d.exe"C:\Users\Admin\AppData\Local\Temp\3b760197ec5fb86a9f43c557be5d786c2a6401dd4e8c50bed084035fcfcfd75d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\pjdvp.exec:\pjdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\rfffxxx.exec:\rfffxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\hbtnhn.exec:\hbtnhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\ddddd.exec:\ddddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\rffxllf.exec:\rffxllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\btbbbb.exec:\btbbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\9hnttn.exec:\9hnttn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\5vdvp.exec:\5vdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\xlrlffr.exec:\xlrlffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\fxfrlfl.exec:\fxfrlfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\thhbbn.exec:\thhbbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\vdvjd.exec:\vdvjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\ffxrxxr.exec:\ffxrxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\1lxxrlx.exec:\1lxxrlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\hnnbbb.exec:\hnnbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\9pppp.exec:\9pppp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\5vjvv.exec:\5vjvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\rlrrlrr.exec:\rlrrlrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\nbhhbn.exec:\nbhhbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\vjvvd.exec:\vjvvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\lffxllx.exec:\lffxllx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\nhtnbb.exec:\nhtnbb.exe23⤵
- Executes dropped EXE
PID:3808 -
\??\c:\bhnhbb.exec:\bhnhbb.exe24⤵
- Executes dropped EXE
PID:4504 -
\??\c:\jvvdd.exec:\jvvdd.exe25⤵
- Executes dropped EXE
PID:748 -
\??\c:\vjvvp.exec:\vjvvp.exe26⤵
- Executes dropped EXE
PID:3212 -
\??\c:\1lffxxr.exec:\1lffxxr.exe27⤵
- Executes dropped EXE
PID:3812 -
\??\c:\7ffllll.exec:\7ffllll.exe28⤵
- Executes dropped EXE
PID:3576 -
\??\c:\hbhnth.exec:\hbhnth.exe29⤵
- Executes dropped EXE
PID:3488 -
\??\c:\bnbbtb.exec:\bnbbtb.exe30⤵
- Executes dropped EXE
PID:3936 -
\??\c:\jvddv.exec:\jvddv.exe31⤵
- Executes dropped EXE
PID:3296 -
\??\c:\vvpdd.exec:\vvpdd.exe32⤵
- Executes dropped EXE
PID:4700 -
\??\c:\5xrlffr.exec:\5xrlffr.exe33⤵
- Executes dropped EXE
PID:3844 -
\??\c:\hbtntb.exec:\hbtntb.exe34⤵
- Executes dropped EXE
PID:1144 -
\??\c:\nnhbhh.exec:\nnhbhh.exe35⤵
- Executes dropped EXE
PID:544 -
\??\c:\tnbbtb.exec:\tnbbtb.exe36⤵
- Executes dropped EXE
PID:2084 -
\??\c:\9djdv.exec:\9djdv.exe37⤵
- Executes dropped EXE
PID:1056 -
\??\c:\jvvpd.exec:\jvvpd.exe38⤵
- Executes dropped EXE
PID:4724 -
\??\c:\pvjdv.exec:\pvjdv.exe39⤵
- Executes dropped EXE
PID:1600 -
\??\c:\xrfxrxx.exec:\xrfxrxx.exe40⤵
- Executes dropped EXE
PID:4268 -
\??\c:\xrfxrll.exec:\xrfxrll.exe41⤵
- Executes dropped EXE
PID:4676 -
\??\c:\httttt.exec:\httttt.exe42⤵
- Executes dropped EXE
PID:332 -
\??\c:\tntnnn.exec:\tntnnn.exe43⤵
- Executes dropped EXE
PID:4588 -
\??\c:\hbbnnn.exec:\hbbnnn.exe44⤵
- Executes dropped EXE
PID:4488 -
\??\c:\jpdvd.exec:\jpdvd.exe45⤵
- Executes dropped EXE
PID:3088 -
\??\c:\pvdvp.exec:\pvdvp.exe46⤵
- Executes dropped EXE
PID:1652 -
\??\c:\xlrrrfr.exec:\xlrrrfr.exe47⤵
- Executes dropped EXE
PID:1740 -
\??\c:\flrrllr.exec:\flrrllr.exe48⤵
- Executes dropped EXE
PID:3544 -
\??\c:\tnbtnn.exec:\tnbtnn.exe49⤵
- Executes dropped EXE
PID:4784 -
\??\c:\thbthn.exec:\thbthn.exe50⤵
- Executes dropped EXE
PID:1584 -
\??\c:\1bhhbb.exec:\1bhhbb.exe51⤵
- Executes dropped EXE
PID:3528 -
\??\c:\vdpvj.exec:\vdpvj.exe52⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jdjdv.exec:\jdjdv.exe53⤵
- Executes dropped EXE
PID:5012 -
\??\c:\5xxrxxf.exec:\5xxrxxf.exe54⤵
- Executes dropped EXE
PID:2572 -
\??\c:\9rxxxxx.exec:\9rxxxxx.exe55⤵
- Executes dropped EXE
PID:4988 -
\??\c:\ntbhhh.exec:\ntbhhh.exe56⤵
- Executes dropped EXE
PID:3944 -
\??\c:\nnttnt.exec:\nnttnt.exe57⤵
- Executes dropped EXE
PID:936 -
\??\c:\5ttbth.exec:\5ttbth.exe58⤵
- Executes dropped EXE
PID:468 -
\??\c:\vpdjd.exec:\vpdjd.exe59⤵
- Executes dropped EXE
PID:1308 -
\??\c:\5dpjj.exec:\5dpjj.exe60⤵
- Executes dropped EXE
PID:920 -
\??\c:\rlfrlll.exec:\rlfrlll.exe61⤵
- Executes dropped EXE
PID:1980 -
\??\c:\7flfffx.exec:\7flfffx.exe62⤵
- Executes dropped EXE
PID:2768 -
\??\c:\xfflxlx.exec:\xfflxlx.exe63⤵
- Executes dropped EXE
PID:1044 -
\??\c:\hnbhhh.exec:\hnbhhh.exe64⤵
- Executes dropped EXE
PID:4772 -
\??\c:\nbhnhn.exec:\nbhnhn.exe65⤵
- Executes dropped EXE
PID:2512 -
\??\c:\5jddv.exec:\5jddv.exe66⤵PID:3748
-
\??\c:\ddppj.exec:\ddppj.exe67⤵PID:2348
-
\??\c:\3jpvj.exec:\3jpvj.exe68⤵PID:3140
-
\??\c:\rfffflf.exec:\rfffflf.exe69⤵PID:4620
-
\??\c:\7flrllf.exec:\7flrllf.exe70⤵PID:1700
-
\??\c:\lfllfxr.exec:\lfllfxr.exe71⤵PID:3652
-
\??\c:\tttnhh.exec:\tttnhh.exe72⤵PID:2664
-
\??\c:\bhhbtt.exec:\bhhbtt.exe73⤵PID:4080
-
\??\c:\vppjj.exec:\vppjj.exe74⤵PID:4864
-
\??\c:\vdvvp.exec:\vdvvp.exe75⤵PID:3124
-
\??\c:\frxflfr.exec:\frxflfr.exe76⤵PID:3996
-
\??\c:\lfffxff.exec:\lfffxff.exe77⤵PID:1552
-
\??\c:\bttttn.exec:\bttttn.exe78⤵PID:3588
-
\??\c:\btnhth.exec:\btnhth.exe79⤵PID:2472
-
\??\c:\dvppj.exec:\dvppj.exe80⤵PID:1524
-
\??\c:\djjdv.exec:\djjdv.exe81⤵PID:1852
-
\??\c:\7llfxrr.exec:\7llfxrr.exe82⤵PID:4412
-
\??\c:\fxxxxxr.exec:\fxxxxxr.exe83⤵PID:3344
-
\??\c:\fxrlfff.exec:\fxrlfff.exe84⤵PID:4200
-
\??\c:\bnbbbb.exec:\bnbbbb.exe85⤵PID:2656
-
\??\c:\tntnhh.exec:\tntnhh.exe86⤵PID:1144
-
\??\c:\djpjj.exec:\djpjj.exe87⤵PID:4144
-
\??\c:\jppjv.exec:\jppjv.exe88⤵PID:4632
-
\??\c:\dpjdv.exec:\dpjdv.exe89⤵PID:5056
-
\??\c:\lfrllfl.exec:\lfrllfl.exe90⤵PID:1836
-
\??\c:\fxxxllf.exec:\fxxxllf.exe91⤵PID:3548
-
\??\c:\bnhbtt.exec:\bnhbtt.exe92⤵PID:4464
-
\??\c:\9hnhtb.exec:\9hnhtb.exe93⤵PID:4544
-
\??\c:\bntthh.exec:\bntthh.exe94⤵PID:552
-
\??\c:\jdpdj.exec:\jdpdj.exe95⤵PID:1668
-
\??\c:\jjjdv.exec:\jjjdv.exe96⤵PID:3732
-
\??\c:\rfllflf.exec:\rfllflf.exe97⤵PID:3100
-
\??\c:\fxflrrx.exec:\fxflrrx.exe98⤵PID:368
-
\??\c:\llxrxxf.exec:\llxrxxf.exe99⤵PID:5116
-
\??\c:\hntbtt.exec:\hntbtt.exe100⤵PID:2492
-
\??\c:\9bhbtn.exec:\9bhbtn.exe101⤵PID:4900
-
\??\c:\hbnnhh.exec:\hbnnhh.exe102⤵PID:1372
-
\??\c:\jvddv.exec:\jvddv.exe103⤵PID:2408
-
\??\c:\9ddvj.exec:\9ddvj.exe104⤵PID:4892
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe105⤵PID:2648
-
\??\c:\1xfxfxf.exec:\1xfxfxf.exe106⤵PID:4600
-
\??\c:\xrllffx.exec:\xrllffx.exe107⤵PID:4908
-
\??\c:\9tnnnn.exec:\9tnnnn.exe108⤵PID:4576
-
\??\c:\nbnhbb.exec:\nbnhbb.exe109⤵PID:2588
-
\??\c:\lxxxxxr.exec:\lxxxxxr.exe110⤵PID:2080
-
\??\c:\nttbbt.exec:\nttbbt.exe111⤵PID:4104
-
\??\c:\hbnnbb.exec:\hbnnbb.exe112⤵PID:892
-
\??\c:\nnntht.exec:\nnntht.exe113⤵PID:2036
-
\??\c:\jvvvv.exec:\jvvvv.exe114⤵PID:400
-
\??\c:\dvpvv.exec:\dvpvv.exe115⤵PID:4068
-
\??\c:\xfllffl.exec:\xfllffl.exe116⤵PID:3284
-
\??\c:\rlrxrlf.exec:\rlrxrlf.exe117⤵PID:5096
-
\??\c:\thnthn.exec:\thnthn.exe118⤵PID:1684
-
\??\c:\tbhbtt.exec:\tbhbtt.exe119⤵PID:2764
-
\??\c:\jvpjv.exec:\jvpjv.exe120⤵PID:3380
-
\??\c:\vjdvj.exec:\vjdvj.exe121⤵PID:4684
-
\??\c:\dvpdj.exec:\dvpdj.exe122⤵PID:3884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-