Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 04:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d9d467619160fd6f4a015459cec428c1ee4fa1e5bd0fed018c90240c9093681a.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
d9d467619160fd6f4a015459cec428c1ee4fa1e5bd0fed018c90240c9093681a.exe
-
Size
200KB
-
MD5
486018afd6c811a77c44ef0004868497
-
SHA1
09f24e487c02441335ff3cd37f5235ed4fb2dfea
-
SHA256
d9d467619160fd6f4a015459cec428c1ee4fa1e5bd0fed018c90240c9093681a
-
SHA512
bc8cf6ee51dc47b008efee1326b3c3cf2d42cf4d5fe1db234bd19328d4c0eb8c7828c489ba1aad38095bd828113e61586632574f4aed56add10e711f9e68d84d
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmc51+GqekBJCvr6zJBUt6iW:n3C9BRIG0asYFm71m8+GdkB9h
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/1448-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-2-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-8-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1452-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-74-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1520-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/780-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-81-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1688-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-67-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3928-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/848-60-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/848-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 21 IoCs
resource yara_rule behavioral2/memory/1448-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/996-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1452-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1520-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4528-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3028-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/780-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4116-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4484-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4496-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4156-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1636-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2028-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1540-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1688-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3928-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/848-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3056-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2992-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2960-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3160-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 996 btbttn.exe 1452 ddjvp.exe 3160 vjddv.exe 2960 5xfffll.exe 2992 hhhhhb.exe 3056 nhnnhb.exe 848 jpjjj.exe 3928 lffxrrl.exe 2332 5lrrrrr.exe 1688 3hhhhn.exe 2076 bbhbbb.exe 1540 vdppp.exe 2028 5lxrffr.exe 1636 rxrrrrl.exe 2572 tnttnn.exe 4156 5nbtbt.exe 4496 vjdvd.exe 1364 xrxxlll.exe 3912 lrxffff.exe 4484 bbtntn.exe 4116 bbnbhn.exe 5068 vvjpd.exe 4644 pdddv.exe 780 xffxrff.exe 388 xflllff.exe 4660 ntbbbb.exe 3028 hhhbbt.exe 2280 jvjpj.exe 4528 xllrlll.exe 1520 5rxxxff.exe 4740 ntttbb.exe 2368 ttnhtb.exe 3032 1pdvd.exe 3516 3flxrfx.exe 1224 hhbttt.exe 4724 nnnnhh.exe 4656 3pdvd.exe 4736 flrxxxf.exe 2836 rfllxxx.exe 1572 nnbttt.exe 3932 httbtt.exe 2704 vvvvp.exe 3496 xfrlrrx.exe 4512 fflrllf.exe 1216 ttbhbb.exe 4028 nhnhbb.exe 4788 pjvpv.exe 2696 pddvp.exe 1928 rlrrfrf.exe 996 xflfxfl.exe 4580 tnbtbb.exe 2104 ddjjj.exe 3664 vjppp.exe 3288 frlfffx.exe 2908 nnhhnh.exe 872 dpppp.exe 1540 jdddv.exe 3656 rlfxrrr.exe 1484 nnhhbb.exe 3376 nhtnnn.exe 4488 ppjjd.exe 4792 xllrlxr.exe 4496 xllllfl.exe 3088 tbhhbb.exe -
resource yara_rule behavioral2/memory/1448-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/780-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3928-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/848-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-25-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1448 wrote to memory of 996 1448 d9d467619160fd6f4a015459cec428c1ee4fa1e5bd0fed018c90240c9093681a.exe 132 PID 1448 wrote to memory of 996 1448 d9d467619160fd6f4a015459cec428c1ee4fa1e5bd0fed018c90240c9093681a.exe 132 PID 1448 wrote to memory of 996 1448 d9d467619160fd6f4a015459cec428c1ee4fa1e5bd0fed018c90240c9093681a.exe 132 PID 996 wrote to memory of 1452 996 btbttn.exe 84 PID 996 wrote to memory of 1452 996 btbttn.exe 84 PID 996 wrote to memory of 1452 996 btbttn.exe 84 PID 1452 wrote to memory of 3160 1452 ddjvp.exe 85 PID 1452 wrote to memory of 3160 1452 ddjvp.exe 85 PID 1452 wrote to memory of 3160 1452 ddjvp.exe 85 PID 3160 wrote to memory of 2960 3160 vjddv.exe 86 PID 3160 wrote to memory of 2960 3160 vjddv.exe 86 PID 3160 wrote to memory of 2960 3160 vjddv.exe 86 PID 2960 wrote to memory of 2992 2960 5xfffll.exe 87 PID 2960 wrote to memory of 2992 2960 5xfffll.exe 87 PID 2960 wrote to memory of 2992 2960 5xfffll.exe 87 PID 2992 wrote to memory of 3056 2992 hhhhhb.exe 88 PID 2992 wrote to memory of 3056 2992 hhhhhb.exe 88 PID 2992 wrote to memory of 3056 2992 hhhhhb.exe 88 PID 3056 wrote to memory of 848 3056 nhnnhb.exe 89 PID 3056 wrote to memory of 848 3056 nhnnhb.exe 89 PID 3056 wrote to memory of 848 3056 nhnnhb.exe 89 PID 848 wrote to memory of 3928 848 jpjjj.exe 90 PID 848 wrote to memory of 3928 848 jpjjj.exe 90 PID 848 wrote to memory of 3928 848 jpjjj.exe 90 PID 3928 wrote to memory of 2332 3928 lffxrrl.exe 91 PID 3928 wrote to memory of 2332 3928 lffxrrl.exe 91 PID 3928 wrote to memory of 2332 3928 lffxrrl.exe 91 PID 2332 wrote to memory of 1688 2332 5lrrrrr.exe 92 PID 2332 wrote to memory of 1688 2332 5lrrrrr.exe 92 PID 2332 wrote to memory of 1688 2332 5lrrrrr.exe 92 PID 1688 wrote to memory of 2076 1688 3hhhhn.exe 93 PID 1688 wrote to memory of 2076 1688 3hhhhn.exe 93 PID 1688 wrote to memory of 2076 1688 3hhhhn.exe 93 PID 2076 wrote to memory of 1540 2076 bbhbbb.exe 139 PID 2076 wrote to memory of 1540 2076 bbhbbb.exe 139 PID 2076 wrote to memory of 1540 2076 bbhbbb.exe 139 PID 1540 wrote to memory of 2028 1540 vdppp.exe 95 PID 1540 wrote to memory of 2028 1540 vdppp.exe 95 PID 1540 wrote to memory of 2028 1540 vdppp.exe 95 PID 2028 wrote to memory of 1636 2028 5lxrffr.exe 96 PID 2028 wrote to memory of 1636 2028 5lxrffr.exe 96 PID 2028 wrote to memory of 1636 2028 5lxrffr.exe 96 PID 1636 wrote to memory of 2572 1636 rxrrrrl.exe 97 PID 1636 wrote to memory of 2572 1636 rxrrrrl.exe 97 PID 1636 wrote to memory of 2572 1636 rxrrrrl.exe 97 PID 2572 wrote to memory of 4156 2572 tnttnn.exe 98 PID 2572 wrote to memory of 4156 2572 tnttnn.exe 98 PID 2572 wrote to memory of 4156 2572 tnttnn.exe 98 PID 4156 wrote to memory of 4496 4156 5nbtbt.exe 145 PID 4156 wrote to memory of 4496 4156 5nbtbt.exe 145 PID 4156 wrote to memory of 4496 4156 5nbtbt.exe 145 PID 4496 wrote to memory of 1364 4496 vjdvd.exe 100 PID 4496 wrote to memory of 1364 4496 vjdvd.exe 100 PID 4496 wrote to memory of 1364 4496 vjdvd.exe 100 PID 1364 wrote to memory of 3912 1364 xrxxlll.exe 101 PID 1364 wrote to memory of 3912 1364 xrxxlll.exe 101 PID 1364 wrote to memory of 3912 1364 xrxxlll.exe 101 PID 3912 wrote to memory of 4484 3912 lrxffff.exe 102 PID 3912 wrote to memory of 4484 3912 lrxffff.exe 102 PID 3912 wrote to memory of 4484 3912 lrxffff.exe 102 PID 4484 wrote to memory of 4116 4484 bbtntn.exe 103 PID 4484 wrote to memory of 4116 4484 bbtntn.exe 103 PID 4484 wrote to memory of 4116 4484 bbtntn.exe 103 PID 4116 wrote to memory of 5068 4116 bbnbhn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9d467619160fd6f4a015459cec428c1ee4fa1e5bd0fed018c90240c9093681a.exe"C:\Users\Admin\AppData\Local\Temp\d9d467619160fd6f4a015459cec428c1ee4fa1e5bd0fed018c90240c9093681a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\btbttn.exec:\btbttn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\ddjvp.exec:\ddjvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\vjddv.exec:\vjddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\5xfffll.exec:\5xfffll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\hhhhhb.exec:\hhhhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\nhnnhb.exec:\nhnnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\jpjjj.exec:\jpjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\lffxrrl.exec:\lffxrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\5lrrrrr.exec:\5lrrrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\3hhhhn.exec:\3hhhhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\bbhbbb.exec:\bbhbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\vdppp.exec:\vdppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\5lxrffr.exec:\5lxrffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\rxrrrrl.exec:\rxrrrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\tnttnn.exec:\tnttnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\5nbtbt.exec:\5nbtbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\vjdvd.exec:\vjdvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\xrxxlll.exec:\xrxxlll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\lrxffff.exec:\lrxffff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\bbtntn.exec:\bbtntn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\bbnbhn.exec:\bbnbhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\vvjpd.exec:\vvjpd.exe23⤵
- Executes dropped EXE
PID:5068 -
\??\c:\pdddv.exec:\pdddv.exe24⤵
- Executes dropped EXE
PID:4644 -
\??\c:\xffxrff.exec:\xffxrff.exe25⤵
- Executes dropped EXE
PID:780 -
\??\c:\xflllff.exec:\xflllff.exe26⤵
- Executes dropped EXE
PID:388 -
\??\c:\ntbbbb.exec:\ntbbbb.exe27⤵
- Executes dropped EXE
PID:4660 -
\??\c:\hhhbbt.exec:\hhhbbt.exe28⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jvjpj.exec:\jvjpj.exe29⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xllrlll.exec:\xllrlll.exe30⤵
- Executes dropped EXE
PID:4528 -
\??\c:\5rxxxff.exec:\5rxxxff.exe31⤵
- Executes dropped EXE
PID:1520 -
\??\c:\ntttbb.exec:\ntttbb.exe32⤵
- Executes dropped EXE
PID:4740 -
\??\c:\ttnhtb.exec:\ttnhtb.exe33⤵
- Executes dropped EXE
PID:2368 -
\??\c:\1pdvd.exec:\1pdvd.exe34⤵
- Executes dropped EXE
PID:3032 -
\??\c:\3flxrfx.exec:\3flxrfx.exe35⤵
- Executes dropped EXE
PID:3516 -
\??\c:\hhbttt.exec:\hhbttt.exe36⤵
- Executes dropped EXE
PID:1224 -
\??\c:\nnnnhh.exec:\nnnnhh.exe37⤵
- Executes dropped EXE
PID:4724 -
\??\c:\3pdvd.exec:\3pdvd.exe38⤵
- Executes dropped EXE
PID:4656 -
\??\c:\flrxxxf.exec:\flrxxxf.exe39⤵
- Executes dropped EXE
PID:4736 -
\??\c:\rfllxxx.exec:\rfllxxx.exe40⤵
- Executes dropped EXE
PID:2836 -
\??\c:\nnbttt.exec:\nnbttt.exe41⤵
- Executes dropped EXE
PID:1572 -
\??\c:\httbtt.exec:\httbtt.exe42⤵
- Executes dropped EXE
PID:3932 -
\??\c:\vvvvp.exec:\vvvvp.exe43⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xfrlrrx.exec:\xfrlrrx.exe44⤵
- Executes dropped EXE
PID:3496 -
\??\c:\fflrllf.exec:\fflrllf.exe45⤵
- Executes dropped EXE
PID:4512 -
\??\c:\ttbhbb.exec:\ttbhbb.exe46⤵
- Executes dropped EXE
PID:1216 -
\??\c:\nhnhbb.exec:\nhnhbb.exe47⤵
- Executes dropped EXE
PID:4028 -
\??\c:\pjvpv.exec:\pjvpv.exe48⤵
- Executes dropped EXE
PID:4788 -
\??\c:\pddvp.exec:\pddvp.exe49⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rlrrfrf.exec:\rlrrfrf.exe50⤵
- Executes dropped EXE
PID:1928 -
\??\c:\xflfxfl.exec:\xflfxfl.exe51⤵
- Executes dropped EXE
PID:996 -
\??\c:\tnbtbb.exec:\tnbtbb.exe52⤵
- Executes dropped EXE
PID:4580 -
\??\c:\ddjjj.exec:\ddjjj.exe53⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vjppp.exec:\vjppp.exe54⤵
- Executes dropped EXE
PID:3664 -
\??\c:\frlfffx.exec:\frlfffx.exe55⤵
- Executes dropped EXE
PID:3288 -
\??\c:\nnhhnh.exec:\nnhhnh.exe56⤵
- Executes dropped EXE
PID:2908 -
\??\c:\dpppp.exec:\dpppp.exe57⤵
- Executes dropped EXE
PID:872 -
\??\c:\jdddv.exec:\jdddv.exe58⤵
- Executes dropped EXE
PID:1540 -
\??\c:\rlfxrrr.exec:\rlfxrrr.exe59⤵
- Executes dropped EXE
PID:3656 -
\??\c:\nnhhbb.exec:\nnhhbb.exe60⤵
- Executes dropped EXE
PID:1484 -
\??\c:\nhtnnn.exec:\nhtnnn.exe61⤵
- Executes dropped EXE
PID:3376 -
\??\c:\ppjjd.exec:\ppjjd.exe62⤵
- Executes dropped EXE
PID:4488 -
\??\c:\xllrlxr.exec:\xllrlxr.exe63⤵
- Executes dropped EXE
PID:4792 -
\??\c:\xllllfl.exec:\xllllfl.exe64⤵
- Executes dropped EXE
PID:4496 -
\??\c:\tbhhbb.exec:\tbhhbb.exe65⤵
- Executes dropped EXE
PID:3088 -
\??\c:\jjjdd.exec:\jjjdd.exe66⤵PID:1396
-
\??\c:\rlrllll.exec:\rlrllll.exe67⤵PID:2804
-
\??\c:\xlffxxr.exec:\xlffxxr.exe68⤵PID:3640
-
\??\c:\nnntnb.exec:\nnntnb.exe69⤵PID:2848
-
\??\c:\pvjjp.exec:\pvjjp.exe70⤵PID:1496
-
\??\c:\jdddd.exec:\jdddd.exe71⤵PID:388
-
\??\c:\xrrlfff.exec:\xrrlfff.exe72⤵PID:1400
-
\??\c:\3httnn.exec:\3httnn.exe73⤵PID:1532
-
\??\c:\htbtnh.exec:\htbtnh.exe74⤵PID:2056
-
\??\c:\jvjpj.exec:\jvjpj.exe75⤵PID:876
-
\??\c:\ddddj.exec:\ddddj.exe76⤵PID:4360
-
\??\c:\fxffxfx.exec:\fxffxfx.exe77⤵PID:4728
-
\??\c:\xxxrlrr.exec:\xxxrlrr.exe78⤵PID:4296
-
\??\c:\9thntn.exec:\9thntn.exe79⤵PID:428
-
\??\c:\jjddj.exec:\jjddj.exe80⤵PID:2800
-
\??\c:\dvpjv.exec:\dvpjv.exe81⤵PID:3104
-
\??\c:\rrxrxxf.exec:\rrxrxxf.exe82⤵PID:2720
-
\??\c:\nnnhhh.exec:\nnnhhh.exe83⤵PID:4312
-
\??\c:\djjjd.exec:\djjjd.exe84⤵PID:4432
-
\??\c:\7flfrrx.exec:\7flfrrx.exe85⤵PID:1256
-
\??\c:\frxxrrl.exec:\frxxrrl.exe86⤵PID:3608
-
\??\c:\ttbhbb.exec:\ttbhbb.exe87⤵PID:2784
-
\??\c:\dvjdv.exec:\dvjdv.exe88⤵PID:1996
-
\??\c:\jjjdv.exec:\jjjdv.exe89⤵PID:3128
-
\??\c:\9xffrrl.exec:\9xffrrl.exe90⤵PID:2124
-
\??\c:\nhhbtn.exec:\nhhbtn.exe91⤵PID:1468
-
\??\c:\jdjdp.exec:\jdjdp.exe92⤵PID:4820
-
\??\c:\ddvpd.exec:\ddvpd.exe93⤵PID:5108
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe94⤵PID:4028
-
\??\c:\rxrlllf.exec:\rxrlllf.exe95⤵PID:2448
-
\??\c:\ppvpd.exec:\ppvpd.exe96⤵PID:2460
-
\??\c:\vppvp.exec:\vppvp.exe97⤵PID:2992
-
\??\c:\frllllf.exec:\frllllf.exe98⤵PID:1616
-
\??\c:\lrfllrl.exec:\lrfllrl.exe99⤵PID:1064
-
\??\c:\nnnnhh.exec:\nnnnhh.exe100⤵PID:2104
-
\??\c:\jdpjj.exec:\jdpjj.exe101⤵PID:5000
-
\??\c:\dvpjd.exec:\dvpjd.exe102⤵PID:3288
-
\??\c:\xxfrrrl.exec:\xxfrrrl.exe103⤵PID:2908
-
\??\c:\lrffxxx.exec:\lrffxxx.exe104⤵PID:872
-
\??\c:\tnbtbb.exec:\tnbtbb.exe105⤵PID:1956
-
\??\c:\btttnn.exec:\btttnn.exe106⤵PID:3656
-
\??\c:\1vvpp.exec:\1vvpp.exe107⤵PID:1964
-
\??\c:\jdddj.exec:\jdddj.exe108⤵PID:3376
-
\??\c:\xxxxrrl.exec:\xxxxrrl.exe109⤵PID:3084
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe110⤵PID:2936
-
\??\c:\tnnbth.exec:\tnnbth.exe111⤵PID:2012
-
\??\c:\jvddp.exec:\jvddp.exe112⤵PID:4496
-
\??\c:\pdvpp.exec:\pdvpp.exe113⤵PID:4116
-
\??\c:\9xffxfx.exec:\9xffxfx.exe114⤵PID:1396
-
\??\c:\ntbbbb.exec:\ntbbbb.exe115⤵PID:3816
-
\??\c:\jdjjd.exec:\jdjjd.exe116⤵PID:2716
-
\??\c:\rffxxxr.exec:\rffxxxr.exe117⤵PID:5028
-
\??\c:\tttnhh.exec:\tttnhh.exe118⤵PID:2372
-
\??\c:\3ppjj.exec:\3ppjj.exe119⤵PID:3028
-
\??\c:\pjvpj.exec:\pjvpj.exe120⤵PID:2056
-
\??\c:\rffffff.exec:\rffffff.exe121⤵PID:4740
-
\??\c:\1rrrlll.exec:\1rrrlll.exe122⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-