Analysis
- max time kernel
150s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 10:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a900122ef6d15e3a9e6d14bcb746cc0.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
- Target 0a900122ef6d15e3a9e6d14bcb746cc0.exe
- Size 65KB
- Sample240518-mnqkmsfc99
- SHA256 3c51bbb40bbc7671497fbc4c9b1caa8e15b317f21525c63d43c5cc82f8dcf727
- MD5 0a900122ef6d15e3a9e6d14bcb746cc0
- SHA1 0343ef81f9ff878d5a57f380a29f5d2103903ca0
- SHA512 2c20f520ec9e6bd42850e2d57eaa5b402c58a8d08351055b088a784f5fd826c0611c0327d5784a2fabb0002680e43567b66badb5aeead4b2c9a42b255cc6be26
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJUDbAIP5:ymb3NkkiQ3mdBjFIFdJ8bT
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/3428-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/860-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1596-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1388-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4736 llrfxff.exe 4000 rxrlrxx.exe 2920 hbbtbb.exe 4900 ppjjd.exe 1112 3rxrfxr.exe 2440 rrxrrxr.exe 4112 ntbnhb.exe 860 pdpjd.exe 4888 dpvvv.exe 1236 7dddp.exe 2636 hnttnt.exe 4612 pdddd.exe 4968 jdjvp.exe 4616 5ffrllf.exe 1492 bttbhh.exe 2320 1hhhhh.exe 3712 vpddj.exe 1548 rllfxxr.exe 2988 bttnnn.exe 4464 5hbbbb.exe 3476 dpvvp.exe 2312 lflxfrx.exe 3076 5fffflf.exe 1596 5bhhbb.exe 3244 3jppp.exe 2772 9llllfr.exe 4872 frrxrrf.exe 748 1nhhnn.exe 4644 jjppv.exe 2124 llxrxfl.exe 1388 xrxrlll.exe 3380 tttbhh.exe 704 5pvvv.exe 1684 5rflrxx.exe 2724 tbntnh.exe 3164 1vjdj.exe 992 frrlffx.exe 752 xfrrlff.exe 2540 bbbhhh.exe 4028 jdjjj.exe 1336 pvdpv.exe 556 xflfxrr.exe 4932 hbhhhh.exe 4188 nnbtbt.exe 2284 ddddp.exe 5000 llxlrfx.exe 3712 rfxlffx.exe 4412 9thhhh.exe 460 bbnhnh.exe 3620 pjjjd.exe 4772 lffxxfx.exe 3408 1hnnnn.exe 3024 pvjjp.exe 224 djvdj.exe 4368 rlffxxr.exe 3244 9thbbh.exe 4984 ddjjv.exe 4736 1lrlfff.exe 3604 nnbnhb.exe 2524 9djpp.exe 1632 xxxxxfx.exe 4440 7bbbtt.exe 1580 bntnhh.exe 60 pvjdp.exe -
resource yara_rule behavioral2/memory/3428-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/860-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1596-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1388-204-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3428 wrote to memory of 4736 3428 0a900122ef6d15e3a9e6d14bcb746cc0.exe 92 PID 3428 wrote to memory of 4736 3428 0a900122ef6d15e3a9e6d14bcb746cc0.exe 92 PID 3428 wrote to memory of 4736 3428 0a900122ef6d15e3a9e6d14bcb746cc0.exe 92 PID 4736 wrote to memory of 4000 4736 llrfxff.exe 93 PID 4736 wrote to memory of 4000 4736 llrfxff.exe 93 PID 4736 wrote to memory of 4000 4736 llrfxff.exe 93 PID 4000 wrote to memory of 2920 4000 rxrlrxx.exe 94 PID 4000 wrote to memory of 2920 4000 rxrlrxx.exe 94 PID 4000 wrote to memory of 2920 4000 rxrlrxx.exe 94 PID 2920 wrote to memory of 4900 2920 hbbtbb.exe 95 PID 2920 wrote to memory of 4900 2920 hbbtbb.exe 95 PID 2920 wrote to memory of 4900 2920 hbbtbb.exe 95 PID 4900 wrote to memory of 1112 4900 ppjjd.exe 96 PID 4900 wrote to memory of 1112 4900 ppjjd.exe 96 PID 4900 wrote to memory of 1112 4900 ppjjd.exe 96 PID 1112 wrote to memory of 2440 1112 3rxrfxr.exe 97 PID 1112 wrote to memory of 2440 1112 3rxrfxr.exe 97 PID 1112 wrote to memory of 2440 1112 3rxrfxr.exe 97 PID 2440 wrote to memory of 4112 2440 rrxrrxr.exe 98 PID 2440 wrote to memory of 4112 2440 rrxrrxr.exe 98 PID 2440 wrote to memory of 4112 2440 rrxrrxr.exe 98 PID 4112 wrote to memory of 860 4112 ntbnhb.exe 99 PID 4112 wrote to memory of 860 4112 ntbnhb.exe 99 PID 4112 wrote to memory of 860 4112 ntbnhb.exe 99 PID 860 wrote to memory of 4888 860 pdpjd.exe 100 PID 860 wrote to memory of 4888 860 pdpjd.exe 100 PID 860 wrote to memory of 4888 860 pdpjd.exe 100 PID 4888 wrote to memory of 1236 4888 dpvvv.exe 101 PID 4888 wrote to memory of 1236 4888 dpvvv.exe 101 PID 4888 wrote to memory of 1236 4888 dpvvv.exe 101 PID 1236 wrote to memory of 2636 1236 7dddp.exe 102 PID 1236 wrote to memory of 2636 1236 7dddp.exe 102 PID 1236 wrote to memory of 2636 1236 7dddp.exe 102 PID 2636 wrote to memory of 4612 2636 hnttnt.exe 103 PID 2636 wrote to memory of 4612 2636 hnttnt.exe 103 PID 2636 wrote to memory of 4612 2636 hnttnt.exe 103 PID 4612 wrote to memory of 4968 4612 pdddd.exe 104 PID 4612 wrote to memory of 4968 4612 pdddd.exe 104 PID 4612 wrote to memory of 4968 4612 pdddd.exe 104 PID 4968 wrote to memory of 4616 4968 jdjvp.exe 105 PID 4968 wrote to memory of 4616 4968 jdjvp.exe 105 PID 4968 wrote to memory of 4616 4968 jdjvp.exe 105 PID 4616 wrote to memory of 1492 4616 5ffrllf.exe 106 PID 4616 wrote to memory of 1492 4616 5ffrllf.exe 106 PID 4616 wrote to memory of 1492 4616 5ffrllf.exe 106 PID 1492 wrote to memory of 2320 1492 bttbhh.exe 107 PID 1492 wrote to memory of 2320 1492 bttbhh.exe 107 PID 1492 wrote to memory of 2320 1492 bttbhh.exe 107 PID 2320 wrote to memory of 3712 2320 1hhhhh.exe 108 PID 2320 wrote to memory of 3712 2320 1hhhhh.exe 108 PID 2320 wrote to memory of 3712 2320 1hhhhh.exe 108 PID 3712 wrote to memory of 1548 3712 vpddj.exe 109 PID 3712 wrote to memory of 1548 3712 vpddj.exe 109 PID 3712 wrote to memory of 1548 3712 vpddj.exe 109 PID 1548 wrote to memory of 2988 1548 rllfxxr.exe 110 PID 1548 wrote to memory of 2988 1548 rllfxxr.exe 110 PID 1548 wrote to memory of 2988 1548 rllfxxr.exe 110 PID 2988 wrote to memory of 4464 2988 bttnnn.exe 111 PID 2988 wrote to memory of 4464 2988 bttnnn.exe 111 PID 2988 wrote to memory of 4464 2988 bttnnn.exe 111 PID 4464 wrote to memory of 3476 4464 5hbbbb.exe 112 PID 4464 wrote to memory of 3476 4464 5hbbbb.exe 112 PID 4464 wrote to memory of 3476 4464 5hbbbb.exe 112 PID 3476 wrote to memory of 2312 3476 dpvvp.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a900122ef6d15e3a9e6d14bcb746cc0.exe"C:\Users\Admin\AppData\Local\Temp\0a900122ef6d15e3a9e6d14bcb746cc0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\llrfxff.exec:\llrfxff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\rxrlrxx.exec:\rxrlrxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\hbbtbb.exec:\hbbtbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\ppjjd.exec:\ppjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\3rxrfxr.exec:\3rxrfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\rrxrrxr.exec:\rrxrrxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\ntbnhb.exec:\ntbnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\pdpjd.exec:\pdpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\dpvvv.exec:\dpvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\7dddp.exec:\7dddp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\hnttnt.exec:\hnttnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\pdddd.exec:\pdddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\jdjvp.exec:\jdjvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\5ffrllf.exec:\5ffrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\bttbhh.exec:\bttbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\1hhhhh.exec:\1hhhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\vpddj.exec:\vpddj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\rllfxxr.exec:\rllfxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\bttnnn.exec:\bttnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\5hbbbb.exec:\5hbbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\dpvvp.exec:\dpvvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\lflxfrx.exec:\lflxfrx.exe23⤵
- Executes dropped EXE
PID:2312 -
\??\c:\5fffflf.exec:\5fffflf.exe24⤵
- Executes dropped EXE
PID:3076 -
\??\c:\5bhhbb.exec:\5bhhbb.exe25⤵
- Executes dropped EXE
PID:1596 -
\??\c:\3jppp.exec:\3jppp.exe26⤵
- Executes dropped EXE
PID:3244 -
\??\c:\9llllfr.exec:\9llllfr.exe27⤵
- Executes dropped EXE
PID:2772 -
\??\c:\frrxrrf.exec:\frrxrrf.exe28⤵
- Executes dropped EXE
PID:4872 -
\??\c:\1nhhnn.exec:\1nhhnn.exe29⤵
- Executes dropped EXE
PID:748 -
\??\c:\jjppv.exec:\jjppv.exe30⤵
- Executes dropped EXE
PID:4644 -
\??\c:\llxrxfl.exec:\llxrxfl.exe31⤵
- Executes dropped EXE
PID:2124 -
\??\c:\xrxrlll.exec:\xrxrlll.exe32⤵
- Executes dropped EXE
PID:1388 -
\??\c:\tttbhh.exec:\tttbhh.exe33⤵
- Executes dropped EXE
PID:3380 -
\??\c:\5pvvv.exec:\5pvvv.exe34⤵
- Executes dropped EXE
PID:704 -
\??\c:\5rflrxx.exec:\5rflrxx.exe35⤵
- Executes dropped EXE
PID:1684 -
\??\c:\tbntnh.exec:\tbntnh.exe36⤵
- Executes dropped EXE
PID:2724 -
\??\c:\1vjdj.exec:\1vjdj.exe37⤵
- Executes dropped EXE
PID:3164 -
\??\c:\frrlffx.exec:\frrlffx.exe38⤵
- Executes dropped EXE
PID:992 -
\??\c:\xfrrlff.exec:\xfrrlff.exe39⤵
- Executes dropped EXE
PID:752 -
\??\c:\bbbhhh.exec:\bbbhhh.exe40⤵
- Executes dropped EXE
PID:2540 -
\??\c:\jdjjj.exec:\jdjjj.exe41⤵
- Executes dropped EXE
PID:4028 -
\??\c:\pvdpv.exec:\pvdpv.exe42⤵
- Executes dropped EXE
PID:1336 -
\??\c:\xflfxrr.exec:\xflfxrr.exe43⤵
- Executes dropped EXE
PID:556 -
\??\c:\hbhhhh.exec:\hbhhhh.exe44⤵
- Executes dropped EXE
PID:4932 -
\??\c:\nnbtbt.exec:\nnbtbt.exe45⤵
- Executes dropped EXE
PID:4188 -
\??\c:\ddddp.exec:\ddddp.exe46⤵
- Executes dropped EXE
PID:2284 -
\??\c:\llxlrfx.exec:\llxlrfx.exe47⤵
- Executes dropped EXE
PID:5000 -
\??\c:\rfxlffx.exec:\rfxlffx.exe48⤵
- Executes dropped EXE
PID:3712 -
\??\c:\9thhhh.exec:\9thhhh.exe49⤵
- Executes dropped EXE
PID:4412 -
\??\c:\bbnhnh.exec:\bbnhnh.exe50⤵
- Executes dropped EXE
PID:460 -
\??\c:\pjjjd.exec:\pjjjd.exe51⤵
- Executes dropped EXE
PID:3620 -
\??\c:\lffxxfx.exec:\lffxxfx.exe52⤵
- Executes dropped EXE
PID:4772 -
\??\c:\1hnnnn.exec:\1hnnnn.exe53⤵
- Executes dropped EXE
PID:3408 -
\??\c:\pvjjp.exec:\pvjjp.exe54⤵
- Executes dropped EXE
PID:3024 -
\??\c:\djvdj.exec:\djvdj.exe55⤵
- Executes dropped EXE
PID:224 -
\??\c:\rlffxxr.exec:\rlffxxr.exe56⤵
- Executes dropped EXE
PID:4368 -
\??\c:\9thbbh.exec:\9thbbh.exe57⤵
- Executes dropped EXE
PID:3244 -
\??\c:\ddjjv.exec:\ddjjv.exe58⤵
- Executes dropped EXE
PID:4984 -
\??\c:\1lrlfff.exec:\1lrlfff.exe59⤵
- Executes dropped EXE
PID:4736 -
\??\c:\nnbnhb.exec:\nnbnhb.exe60⤵
- Executes dropped EXE
PID:3604 -
\??\c:\9djpp.exec:\9djpp.exe61⤵
- Executes dropped EXE
PID:2524 -
\??\c:\xxxxxfx.exec:\xxxxxfx.exe62⤵
- Executes dropped EXE
PID:1632 -
\??\c:\7bbbtt.exec:\7bbbtt.exe63⤵
- Executes dropped EXE
PID:4440 -
\??\c:\bntnhh.exec:\bntnhh.exe64⤵
- Executes dropped EXE
PID:1580 -
\??\c:\pvjdp.exec:\pvjdp.exe65⤵
- Executes dropped EXE
PID:60 -
\??\c:\xrxfffl.exec:\xrxfffl.exe66⤵PID:2032
-
\??\c:\fxfxfff.exec:\fxfxfff.exe67⤵PID:468
-
\??\c:\1tnnnn.exec:\1tnnnn.exe68⤵PID:4192
-
\??\c:\pjjdd.exec:\pjjdd.exe69⤵PID:4112
-
\??\c:\vjjdp.exec:\vjjdp.exe70⤵PID:4980
-
\??\c:\rrlflfx.exec:\rrlflfx.exe71⤵PID:3164
-
\??\c:\5frxxff.exec:\5frxxff.exe72⤵PID:3248
-
\??\c:\nntntb.exec:\nntntb.exe73⤵PID:2060
-
\??\c:\nbbttn.exec:\nbbttn.exe74⤵PID:4396
-
\??\c:\jjpvp.exec:\jjpvp.exe75⤵PID:4632
-
\??\c:\llllflf.exec:\llllflf.exe76⤵PID:556
-
\??\c:\nbhbbb.exec:\nbhbbb.exe77⤵PID:4932
-
\??\c:\vpppp.exec:\vpppp.exe78⤵PID:4188
-
\??\c:\7djvp.exec:\7djvp.exe79⤵PID:4616
-
\??\c:\3pjjd.exec:\3pjjd.exe80⤵PID:1976
-
\??\c:\xrrlfff.exec:\xrrlfff.exe81⤵PID:3376
-
\??\c:\tttbhn.exec:\tttbhn.exe82⤵PID:2988
-
\??\c:\nhbttt.exec:\nhbttt.exe83⤵PID:5076
-
\??\c:\1ddvv.exec:\1ddvv.exe84⤵PID:1308
-
\??\c:\ppvpj.exec:\ppvpj.exe85⤵PID:1264
-
\??\c:\lxxllfx.exec:\lxxllfx.exe86⤵PID:1096
-
\??\c:\htbthb.exec:\htbthb.exe87⤵PID:328
-
\??\c:\hthhbb.exec:\hthhbb.exe88⤵PID:4792
-
\??\c:\vdppv.exec:\vdppv.exe89⤵PID:856
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe90⤵PID:3276
-
\??\c:\9xxffll.exec:\9xxffll.exe91⤵PID:4000
-
\??\c:\tnhbtn.exec:\tnhbtn.exe92⤵PID:2076
-
\??\c:\hbtttt.exec:\hbtttt.exe93⤵PID:4556
-
\??\c:\9pvdd.exec:\9pvdd.exe94⤵PID:516
-
\??\c:\ddvvp.exec:\ddvvp.exe95⤵PID:4900
-
\??\c:\rxlxrfx.exec:\rxlxrfx.exe96⤵PID:4468
-
\??\c:\tbbtth.exec:\tbbtth.exe97⤵PID:3088
-
\??\c:\nhbnhb.exec:\nhbnhb.exe98⤵PID:4284
-
\??\c:\htnhbb.exec:\htnhbb.exe99⤵PID:1068
-
\??\c:\pdjdp.exec:\pdjdp.exe100⤵PID:1684
-
\??\c:\djjjd.exec:\djjjd.exe101⤵PID:5052
-
\??\c:\fxffffl.exec:\fxffffl.exe102⤵PID:2724
-
\??\c:\thnnhn.exec:\thnnhn.exe103⤵PID:3600
-
\??\c:\nhnhht.exec:\nhnhht.exe104⤵PID:1164
-
\??\c:\vdpjd.exec:\vdpjd.exe105⤵PID:4612
-
\??\c:\xlffffx.exec:\xlffffx.exe106⤵PID:2652
-
\??\c:\fxfxlxl.exec:\fxfxlxl.exe107⤵PID:4396
-
\??\c:\nhhbtt.exec:\nhhbtt.exe108⤵PID:116
-
\??\c:\dpppj.exec:\dpppj.exe109⤵PID:1080
-
\??\c:\dvjpj.exec:\dvjpj.exe110⤵PID:4108
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe111⤵PID:3752
-
\??\c:\xxfxffl.exec:\xxfxffl.exe112⤵PID:1548
-
\??\c:\nbnnhn.exec:\nbnnhn.exe113⤵PID:2760
-
\??\c:\vdvvd.exec:\vdvvd.exe114⤵PID:3476
-
\??\c:\vppjd.exec:\vppjd.exe115⤵PID:4248
-
\??\c:\xxxrffl.exec:\xxxrffl.exe116⤵PID:2452
-
\??\c:\5rxxxxf.exec:\5rxxxxf.exe117⤵PID:216
-
\??\c:\5bnnhh.exec:\5bnnhh.exe118⤵PID:4376
-
\??\c:\5hhtnh.exec:\5hhtnh.exe119⤵PID:3044
-
\??\c:\vdjjd.exec:\vdjjd.exe120⤵PID:1744
-
\??\c:\3pdvj.exec:\3pdvj.exe121⤵PID:3580
-
\??\c:\9rlxrrl.exec:\9rlxrrl.exe122⤵PID:1964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-