Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 16:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ed9999b30853eea90593144ca9ed6740.exe.bin.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
ed9999b30853eea90593144ca9ed6740.exe.bin.exe
-
Size
94KB
-
MD5
ed9999b30853eea90593144ca9ed6740
-
SHA1
8addd733f72ee6e7ae93579bbff0880d6314b4fa
-
SHA256
ba50e199acffb605c24c7db7ade336c8dbd658ddc9215b3a23c4e9633124480c
-
SHA512
9c72643bf2a2f40e5c087bcd347f05300af124ce2b9176227bd7edec8f37fe48530d44f7e94913318009a8e61be715b10876752a819e2c8886bda2ec754e44fa
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxEPOfPrA7:ymb3NkkiQ3mdBjFo73PYP1lri3KuOnrW
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral2/memory/3932-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
djdvj.exexlrxrxl.exe9fffllf.exetthbhh.exe3xrfrlx.exebnnhtt.exebnnhhb.exejppjd.exe3ddvp.exexxxlrlf.exehnbnht.exepddvd.exefllrlxx.exetbbbnn.exenntbtt.exepdpvp.exepddvd.exelrfxxff.exethnnhn.exehntthh.exe7ppjj.exe7ppjd.exe5xxrrxr.exetnntnn.exe3hhbtt.exedjjdd.exefffrllf.exebttnbb.exe7btttt.exe1jddd.exe3rxllff.exe1llxffl.exebnnhtn.exevvvpj.exerffrlfx.exe5rrxxff.exe3btntt.exettbbnn.exepjpjd.exexxxrffl.exe9nbbbb.exenhhhtt.exejvvdv.exelllllff.exebntbht.exedjjdv.exevjjjj.exerrlxlxx.exenbbtnn.exehnhnnh.exejdjvv.exerxfrxlr.exetbhbth.exejjdpj.exefxxxxfx.exehhnnnn.exevvvpp.exelfxxffr.exefxlrlrx.exebnnnbh.exe1jppv.exe5lfxrxr.exehtbnbb.exe1vpjd.exepid process 2424 djdvj.exe 1432 xlrxrxl.exe 1676 9fffllf.exe 2716 tthbhh.exe 4852 3xrfrlx.exe 748 bnnhtt.exe 3104 bnnhhb.exe 4616 jppjd.exe 2844 3ddvp.exe 4820 xxxlrlf.exe 1260 hnbnht.exe 4224 pddvd.exe 3500 fllrlxx.exe 4148 tbbbnn.exe 4624 nntbtt.exe 624 pdpvp.exe 4176 pddvd.exe 3448 lrfxxff.exe 2840 thnnhn.exe 4440 hntthh.exe 3060 7ppjj.exe 4716 7ppjd.exe 2720 5xxrrxr.exe 1580 tnntnn.exe 3404 3hhbtt.exe 4768 djjdd.exe 3400 fffrllf.exe 1548 bttnbb.exe 3380 7btttt.exe 508 1jddd.exe 3536 3rxllff.exe 4232 1llxffl.exe 3856 bnnhtn.exe 444 vvvpj.exe 4576 rffrlfx.exe 2452 5rrxxff.exe 1924 3btntt.exe 3932 ttbbnn.exe 428 pjpjd.exe 2888 xxxrffl.exe 2540 9nbbbb.exe 1032 nhhhtt.exe 2524 jvvdv.exe 2716 lllllff.exe 3052 bntbht.exe 744 djjdv.exe 4616 vjjjj.exe 4892 rrlxlxx.exe 4500 nbbtnn.exe 4820 hnhnnh.exe 4528 jdjvv.exe 4404 rxfrxlr.exe 4412 tbhbth.exe 4992 jjdpj.exe 1288 fxxxxfx.exe 4560 hhnnnn.exe 3300 vvvpp.exe 3080 lfxxffr.exe 2376 fxlrlrx.exe 720 bnnnbh.exe 1052 1jppv.exe 1652 5lfxrxr.exe 64 htbnbb.exe 1276 1vpjd.exe -
Processes:
resource yara_rule behavioral2/memory/3932-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ed9999b30853eea90593144ca9ed6740.exe.bin.exedjdvj.exexlrxrxl.exe9fffllf.exetthbhh.exe3xrfrlx.exebnnhtt.exebnnhhb.exejppjd.exe3ddvp.exexxxlrlf.exehnbnht.exepddvd.exefllrlxx.exetbbbnn.exenntbtt.exepdpvp.exepddvd.exelrfxxff.exethnnhn.exehntthh.exe7ppjj.exedescription pid process target process PID 3932 wrote to memory of 2424 3932 ed9999b30853eea90593144ca9ed6740.exe.bin.exe djdvj.exe PID 3932 wrote to memory of 2424 3932 ed9999b30853eea90593144ca9ed6740.exe.bin.exe djdvj.exe PID 3932 wrote to memory of 2424 3932 ed9999b30853eea90593144ca9ed6740.exe.bin.exe djdvj.exe PID 2424 wrote to memory of 1432 2424 djdvj.exe xlrxrxl.exe PID 2424 wrote to memory of 1432 2424 djdvj.exe xlrxrxl.exe PID 2424 wrote to memory of 1432 2424 djdvj.exe xlrxrxl.exe PID 1432 wrote to memory of 1676 1432 xlrxrxl.exe 9fffllf.exe PID 1432 wrote to memory of 1676 1432 xlrxrxl.exe 9fffllf.exe PID 1432 wrote to memory of 1676 1432 xlrxrxl.exe 9fffllf.exe PID 1676 wrote to memory of 2716 1676 9fffllf.exe tthbhh.exe PID 1676 wrote to memory of 2716 1676 9fffllf.exe tthbhh.exe PID 1676 wrote to memory of 2716 1676 9fffllf.exe tthbhh.exe PID 2716 wrote to memory of 4852 2716 tthbhh.exe 3xrfrlx.exe PID 2716 wrote to memory of 4852 2716 tthbhh.exe 3xrfrlx.exe PID 2716 wrote to memory of 4852 2716 tthbhh.exe 3xrfrlx.exe PID 4852 wrote to memory of 748 4852 3xrfrlx.exe bnnhtt.exe PID 4852 wrote to memory of 748 4852 3xrfrlx.exe bnnhtt.exe PID 4852 wrote to memory of 748 4852 3xrfrlx.exe bnnhtt.exe PID 748 wrote to memory of 3104 748 bnnhtt.exe bnnhhb.exe PID 748 wrote to memory of 3104 748 bnnhtt.exe bnnhhb.exe PID 748 wrote to memory of 3104 748 bnnhtt.exe bnnhhb.exe PID 3104 wrote to memory of 4616 3104 bnnhhb.exe jppjd.exe PID 3104 wrote to memory of 4616 3104 bnnhhb.exe jppjd.exe PID 3104 wrote to memory of 4616 3104 bnnhhb.exe jppjd.exe PID 4616 wrote to memory of 2844 4616 jppjd.exe 3ddvp.exe PID 4616 wrote to memory of 2844 4616 jppjd.exe 3ddvp.exe PID 4616 wrote to memory of 2844 4616 jppjd.exe 3ddvp.exe PID 2844 wrote to memory of 4820 2844 3ddvp.exe xxxlrlf.exe PID 2844 wrote to memory of 4820 2844 3ddvp.exe xxxlrlf.exe PID 2844 wrote to memory of 4820 2844 3ddvp.exe xxxlrlf.exe PID 4820 wrote to memory of 1260 4820 xxxlrlf.exe hnbnht.exe PID 4820 wrote to memory of 1260 4820 xxxlrlf.exe hnbnht.exe PID 4820 wrote to memory of 1260 4820 xxxlrlf.exe hnbnht.exe PID 1260 wrote to memory of 4224 1260 hnbnht.exe pddvd.exe PID 1260 wrote to memory of 4224 1260 hnbnht.exe pddvd.exe PID 1260 wrote to memory of 4224 1260 hnbnht.exe pddvd.exe PID 4224 wrote to memory of 3500 4224 pddvd.exe fllrlxx.exe PID 4224 wrote to memory of 3500 4224 pddvd.exe fllrlxx.exe PID 4224 wrote to memory of 3500 4224 pddvd.exe fllrlxx.exe PID 3500 wrote to memory of 4148 3500 fllrlxx.exe tbbbnn.exe PID 3500 wrote to memory of 4148 3500 fllrlxx.exe tbbbnn.exe PID 3500 wrote to memory of 4148 3500 fllrlxx.exe tbbbnn.exe PID 4148 wrote to memory of 4624 4148 tbbbnn.exe nntbtt.exe PID 4148 wrote to memory of 4624 4148 tbbbnn.exe nntbtt.exe PID 4148 wrote to memory of 4624 4148 tbbbnn.exe nntbtt.exe PID 4624 wrote to memory of 624 4624 nntbtt.exe pdpvp.exe PID 4624 wrote to memory of 624 4624 nntbtt.exe pdpvp.exe PID 4624 wrote to memory of 624 4624 nntbtt.exe pdpvp.exe PID 624 wrote to memory of 4176 624 pdpvp.exe pddvd.exe PID 624 wrote to memory of 4176 624 pdpvp.exe pddvd.exe PID 624 wrote to memory of 4176 624 pdpvp.exe pddvd.exe PID 4176 wrote to memory of 3448 4176 pddvd.exe lrfxxff.exe PID 4176 wrote to memory of 3448 4176 pddvd.exe lrfxxff.exe PID 4176 wrote to memory of 3448 4176 pddvd.exe lrfxxff.exe PID 3448 wrote to memory of 2840 3448 lrfxxff.exe thnnhn.exe PID 3448 wrote to memory of 2840 3448 lrfxxff.exe thnnhn.exe PID 3448 wrote to memory of 2840 3448 lrfxxff.exe thnnhn.exe PID 2840 wrote to memory of 4440 2840 thnnhn.exe hntthh.exe PID 2840 wrote to memory of 4440 2840 thnnhn.exe hntthh.exe PID 2840 wrote to memory of 4440 2840 thnnhn.exe hntthh.exe PID 4440 wrote to memory of 3060 4440 hntthh.exe 7ppjj.exe PID 4440 wrote to memory of 3060 4440 hntthh.exe 7ppjj.exe PID 4440 wrote to memory of 3060 4440 hntthh.exe 7ppjj.exe PID 3060 wrote to memory of 4716 3060 7ppjj.exe 7ppjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed9999b30853eea90593144ca9ed6740.exe.bin.exe"C:\Users\Admin\AppData\Local\Temp\ed9999b30853eea90593144ca9ed6740.exe.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\djdvj.exec:\djdvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\xlrxrxl.exec:\xlrxrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\9fffllf.exec:\9fffllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\tthbhh.exec:\tthbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\3xrfrlx.exec:\3xrfrlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\bnnhtt.exec:\bnnhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\bnnhhb.exec:\bnnhhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\jppjd.exec:\jppjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\3ddvp.exec:\3ddvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\xxxlrlf.exec:\xxxlrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\hnbnht.exec:\hnbnht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\pddvd.exec:\pddvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\fllrlxx.exec:\fllrlxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\tbbbnn.exec:\tbbbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\nntbtt.exec:\nntbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\pdpvp.exec:\pdpvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\pddvd.exec:\pddvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\lrfxxff.exec:\lrfxxff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\thnnhn.exec:\thnnhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\hntthh.exec:\hntthh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\7ppjj.exec:\7ppjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\7ppjd.exec:\7ppjd.exe23⤵
- Executes dropped EXE
PID:4716 -
\??\c:\5xxrrxr.exec:\5xxrrxr.exe24⤵
- Executes dropped EXE
PID:2720 -
\??\c:\tnntnn.exec:\tnntnn.exe25⤵
- Executes dropped EXE
PID:1580 -
\??\c:\3hhbtt.exec:\3hhbtt.exe26⤵
- Executes dropped EXE
PID:3404 -
\??\c:\djjdd.exec:\djjdd.exe27⤵
- Executes dropped EXE
PID:4768 -
\??\c:\fffrllf.exec:\fffrllf.exe28⤵
- Executes dropped EXE
PID:3400 -
\??\c:\bttnbb.exec:\bttnbb.exe29⤵
- Executes dropped EXE
PID:1548 -
\??\c:\7btttt.exec:\7btttt.exe30⤵
- Executes dropped EXE
PID:3380 -
\??\c:\1jddd.exec:\1jddd.exe31⤵
- Executes dropped EXE
PID:508 -
\??\c:\3rxllff.exec:\3rxllff.exe32⤵
- Executes dropped EXE
PID:3536 -
\??\c:\1llxffl.exec:\1llxffl.exe33⤵
- Executes dropped EXE
PID:4232 -
\??\c:\bnnhtn.exec:\bnnhtn.exe34⤵
- Executes dropped EXE
PID:3856 -
\??\c:\vvvpj.exec:\vvvpj.exe35⤵
- Executes dropped EXE
PID:444 -
\??\c:\rffrlfx.exec:\rffrlfx.exe36⤵
- Executes dropped EXE
PID:4576 -
\??\c:\5rrxxff.exec:\5rrxxff.exe37⤵
- Executes dropped EXE
PID:2452 -
\??\c:\3btntt.exec:\3btntt.exe38⤵
- Executes dropped EXE
PID:1924 -
\??\c:\ttbbnn.exec:\ttbbnn.exe39⤵
- Executes dropped EXE
PID:3932 -
\??\c:\pjpjd.exec:\pjpjd.exe40⤵
- Executes dropped EXE
PID:428 -
\??\c:\xxxrffl.exec:\xxxrffl.exe41⤵
- Executes dropped EXE
PID:2888 -
\??\c:\9nbbbb.exec:\9nbbbb.exe42⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nhhhtt.exec:\nhhhtt.exe43⤵
- Executes dropped EXE
PID:1032 -
\??\c:\jvvdv.exec:\jvvdv.exe44⤵
- Executes dropped EXE
PID:2524 -
\??\c:\lllllff.exec:\lllllff.exe45⤵
- Executes dropped EXE
PID:2716 -
\??\c:\bntbht.exec:\bntbht.exe46⤵
- Executes dropped EXE
PID:3052 -
\??\c:\djjdv.exec:\djjdv.exe47⤵
- Executes dropped EXE
PID:744 -
\??\c:\vjjjj.exec:\vjjjj.exe48⤵
- Executes dropped EXE
PID:4616 -
\??\c:\rrlxlxx.exec:\rrlxlxx.exe49⤵
- Executes dropped EXE
PID:4892 -
\??\c:\nbbtnn.exec:\nbbtnn.exe50⤵
- Executes dropped EXE
PID:4500 -
\??\c:\hnhnnh.exec:\hnhnnh.exe51⤵
- Executes dropped EXE
PID:4820 -
\??\c:\jdjvv.exec:\jdjvv.exe52⤵
- Executes dropped EXE
PID:4528 -
\??\c:\rxfrxlr.exec:\rxfrxlr.exe53⤵
- Executes dropped EXE
PID:4404 -
\??\c:\tbhbth.exec:\tbhbth.exe54⤵
- Executes dropped EXE
PID:4412 -
\??\c:\jjdpj.exec:\jjdpj.exe55⤵
- Executes dropped EXE
PID:4992 -
\??\c:\fxxxxfx.exec:\fxxxxfx.exe56⤵
- Executes dropped EXE
PID:1288 -
\??\c:\hhnnnn.exec:\hhnnnn.exe57⤵
- Executes dropped EXE
PID:4560 -
\??\c:\vvvpp.exec:\vvvpp.exe58⤵
- Executes dropped EXE
PID:3300 -
\??\c:\lfxxffr.exec:\lfxxffr.exe59⤵
- Executes dropped EXE
PID:3080 -
\??\c:\fxlrlrx.exec:\fxlrlrx.exe60⤵
- Executes dropped EXE
PID:2376 -
\??\c:\bnnnbh.exec:\bnnnbh.exe61⤵
- Executes dropped EXE
PID:720 -
\??\c:\1jppv.exec:\1jppv.exe62⤵
- Executes dropped EXE
PID:1052 -
\??\c:\5lfxrxr.exec:\5lfxrxr.exe63⤵
- Executes dropped EXE
PID:1652 -
\??\c:\htbnbb.exec:\htbnbb.exe64⤵
- Executes dropped EXE
PID:64 -
\??\c:\1vpjd.exec:\1vpjd.exe65⤵
- Executes dropped EXE
PID:1276 -
\??\c:\5lrrxxx.exec:\5lrrxxx.exe66⤵PID:1328
-
\??\c:\nbbbbh.exec:\nbbbbh.exe67⤵PID:2720
-
\??\c:\hbhbtb.exec:\hbhbtb.exe68⤵PID:1784
-
\??\c:\jpppd.exec:\jpppd.exe69⤵PID:928
-
\??\c:\rxxrrrl.exec:\rxxrrrl.exe70⤵PID:5004
-
\??\c:\nthttn.exec:\nthttn.exe71⤵PID:3352
-
\??\c:\btnntb.exec:\btnntb.exe72⤵PID:3896
-
\??\c:\pjvpp.exec:\pjvpp.exe73⤵PID:3092
-
\??\c:\rrfflfl.exec:\rrfflfl.exe74⤵PID:1680
-
\??\c:\7thhbb.exec:\7thhbb.exe75⤵PID:4632
-
\??\c:\djddv.exec:\djddv.exe76⤵PID:1928
-
\??\c:\jddvp.exec:\jddvp.exe77⤵PID:1344
-
\??\c:\9rrrrxx.exec:\9rrrrxx.exe78⤵PID:1868
-
\??\c:\3htthh.exec:\3htthh.exe79⤵PID:3264
-
\??\c:\vppjd.exec:\vppjd.exe80⤵PID:1836
-
\??\c:\djvpj.exec:\djvpj.exe81⤵PID:936
-
\??\c:\fxxxxfl.exec:\fxxxxfl.exe82⤵PID:4104
-
\??\c:\lrlrlfx.exec:\lrlrlfx.exe83⤵PID:2424
-
\??\c:\htbthh.exec:\htbthh.exe84⤵PID:1736
-
\??\c:\jpvdp.exec:\jpvdp.exe85⤵PID:2540
-
\??\c:\3ppjd.exec:\3ppjd.exe86⤵PID:3116
-
\??\c:\7rrfxrl.exec:\7rrfxrl.exe87⤵PID:1324
-
\??\c:\3nnbtn.exec:\3nnbtn.exe88⤵PID:4608
-
\??\c:\tbtttt.exec:\tbtttt.exe89⤵PID:4860
-
\??\c:\9ppdp.exec:\9ppdp.exe90⤵PID:2616
-
\??\c:\lrfrffr.exec:\lrfrffr.exe91⤵PID:1768
-
\??\c:\rlfrlxx.exec:\rlfrlxx.exe92⤵PID:2828
-
\??\c:\nbtthh.exec:\nbtthh.exe93⤵PID:2776
-
\??\c:\1hbhbb.exec:\1hbhbb.exe94⤵PID:2392
-
\??\c:\dpvpj.exec:\dpvpj.exe95⤵PID:1000
-
\??\c:\7xxrlrl.exec:\7xxrlrl.exe96⤵PID:452
-
\??\c:\fxxxxfx.exec:\fxxxxfx.exe97⤵PID:2808
-
\??\c:\bhnbbn.exec:\bhnbbn.exe98⤵PID:3500
-
\??\c:\pjpjp.exec:\pjpjp.exe99⤵PID:1312
-
\??\c:\dvvvp.exec:\dvvvp.exe100⤵PID:4624
-
\??\c:\xrrllll.exec:\xrrllll.exe101⤵PID:3772
-
\??\c:\fllfxxx.exec:\fllfxxx.exe102⤵PID:4944
-
\??\c:\3tthtn.exec:\3tthtn.exe103⤵PID:3420
-
\??\c:\vvvpv.exec:\vvvpv.exe104⤵PID:796
-
\??\c:\vpjdv.exec:\vpjdv.exe105⤵PID:636
-
\??\c:\xrlfrlf.exec:\xrlfrlf.exe106⤵PID:3556
-
\??\c:\xrffxxr.exec:\xrffxxr.exe107⤵PID:1292
-
\??\c:\htttnn.exec:\htttnn.exe108⤵PID:2232
-
\??\c:\tnhhhn.exec:\tnhhhn.exe109⤵PID:1712
-
\??\c:\jppdp.exec:\jppdp.exe110⤵PID:3252
-
\??\c:\vppjd.exec:\vppjd.exe111⤵PID:2228
-
\??\c:\1xfxxxl.exec:\1xfxxxl.exe112⤵PID:1784
-
\??\c:\3hhnhh.exec:\3hhnhh.exe113⤵PID:4472
-
\??\c:\pvppj.exec:\pvppj.exe114⤵PID:2924
-
\??\c:\rxxrlfx.exec:\rxxrlfx.exe115⤵PID:1876
-
\??\c:\ffxxfxx.exec:\ffxxfxx.exe116⤵PID:3096
-
\??\c:\ttnnhh.exec:\ttnnhh.exe117⤵PID:3536
-
\??\c:\dpdjv.exec:\dpdjv.exe118⤵PID:1040
-
\??\c:\pjjdj.exec:\pjjdj.exe119⤵PID:2168
-
\??\c:\1ddpj.exec:\1ddpj.exe120⤵PID:4328
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe121⤵PID:3932
-
\??\c:\1bhtth.exec:\1bhtth.exe122⤵PID:4584
-
\??\c:\pdpjd.exec:\pdpjd.exe123⤵PID:4776
-
\??\c:\vjvpj.exec:\vjvpj.exe124⤵PID:2832
-
\??\c:\lflrxfl.exec:\lflrxfl.exe125⤵PID:3116
-
\??\c:\bthnnh.exec:\bthnnh.exe126⤵PID:4856
-
\??\c:\jdjpp.exec:\jdjpp.exe127⤵PID:3052
-
\??\c:\pdpdp.exec:\pdpdp.exe128⤵PID:4860
-
\??\c:\rxxflfr.exec:\rxxflfr.exe129⤵PID:4816
-
\??\c:\1hnhtn.exec:\1hnhtn.exe130⤵PID:4424
-
\??\c:\ppjdv.exec:\ppjdv.exe131⤵PID:4460
-
\??\c:\7dddj.exec:\7dddj.exe132⤵PID:4324
-
\??\c:\rfxrfrr.exec:\rfxrfrr.exe133⤵PID:4316
-
\??\c:\bbbtnn.exec:\bbbtnn.exe134⤵PID:1952
-
\??\c:\bnhtnh.exec:\bnhtnh.exe135⤵PID:2196
-
\??\c:\pddjv.exec:\pddjv.exe136⤵PID:812
-
\??\c:\xrlfllx.exec:\xrlfllx.exe137⤵PID:2076
-
\??\c:\fxxrlxr.exec:\fxxrlxr.exe138⤵PID:1020
-
\??\c:\nbtbbt.exec:\nbtbbt.exe139⤵PID:1880
-
\??\c:\ntttnt.exec:\ntttnt.exe140⤵PID:4936
-
\??\c:\1jpjv.exec:\1jpjv.exe141⤵PID:1788
-
\??\c:\rfxrlfx.exec:\rfxrlfx.exe142⤵PID:3992
-
\??\c:\lfllxrx.exec:\lfllxrx.exe143⤵PID:884
-
\??\c:\7hhbtn.exec:\7hhbtn.exe144⤵PID:2824
-
\??\c:\bhhbtt.exec:\bhhbtt.exe145⤵PID:2084
-
\??\c:\pvdvj.exec:\pvdvj.exe146⤵PID:4612
-
\??\c:\5pdvd.exec:\5pdvd.exe147⤵PID:1276
-
\??\c:\7xrlxrl.exec:\7xrlxrl.exe148⤵PID:1028
-
\??\c:\nbtbtn.exec:\nbtbtn.exe149⤵PID:2720
-
\??\c:\5hbthb.exec:\5hbthb.exe150⤵PID:4804
-
\??\c:\djjvd.exec:\djjvd.exe151⤵PID:4472
-
\??\c:\lllfrlx.exec:\lllfrlx.exe152⤵PID:4780
-
\??\c:\frllffx.exec:\frllffx.exe153⤵PID:2316
-
\??\c:\7tbthb.exec:\7tbthb.exe154⤵PID:2528
-
\??\c:\dpddd.exec:\dpddd.exe155⤵PID:4576
-
\??\c:\jvdpd.exec:\jvdpd.exe156⤵PID:1924
-
\??\c:\frlfflx.exec:\frlfflx.exe157⤵PID:716
-
\??\c:\9nbttt.exec:\9nbttt.exe158⤵PID:1484
-
\??\c:\hbbbtn.exec:\hbbbtn.exe159⤵PID:2888
-
\??\c:\jdvjv.exec:\jdvjv.exe160⤵PID:4728
-
\??\c:\fxrxrlr.exec:\fxrxrlr.exe161⤵PID:3132
-
\??\c:\xxrlfrx.exec:\xxrlfrx.exe162⤵PID:1324
-
\??\c:\5tnhtn.exec:\5tnhtn.exe163⤵PID:4608
-
\??\c:\tntnhh.exec:\tntnhh.exe164⤵PID:3104
-
\??\c:\dvjdj.exec:\dvjdj.exe165⤵PID:2464
-
\??\c:\ddvpp.exec:\ddvpp.exe166⤵PID:2544
-
\??\c:\lxlxlfx.exec:\lxlxlfx.exe167⤵PID:692
-
\??\c:\rxfxllx.exec:\rxfxllx.exe168⤵PID:4392
-
\??\c:\htbhtb.exec:\htbhtb.exe169⤵PID:1672
-
\??\c:\ddvvj.exec:\ddvvj.exe170⤵PID:2760
-
\??\c:\vpppj.exec:\vpppj.exe171⤵PID:4224
-
\??\c:\llxllll.exec:\llxllll.exe172⤵PID:2808
-
\??\c:\ffxlxlx.exec:\ffxlxlx.exe173⤵PID:2988
-
\??\c:\ttnbnb.exec:\ttnbnb.exe174⤵PID:1312
-
\??\c:\5jppp.exec:\5jppp.exe175⤵PID:2664
-
\??\c:\pvvdd.exec:\pvvdd.exe176⤵PID:4372
-
\??\c:\xlfrfxr.exec:\xlfrfxr.exe177⤵PID:4396
-
\??\c:\rrrllfx.exec:\rrrllfx.exe178⤵PID:2380
-
\??\c:\9ntbtn.exec:\9ntbtn.exe179⤵PID:4664
-
\??\c:\nbbhbt.exec:\nbbhbt.exe180⤵PID:944
-
\??\c:\7vvpp.exec:\7vvpp.exe181⤵PID:1448
-
\??\c:\7vpvd.exec:\7vpvd.exe182⤵PID:4988
-
\??\c:\1vvdj.exec:\1vvdj.exe183⤵PID:4812
-
\??\c:\xlxlxrf.exec:\xlxlxrf.exe184⤵PID:2792
-
\??\c:\flllfxx.exec:\flllfxx.exe185⤵PID:1028
-
\??\c:\bhbthb.exec:\bhbthb.exe186⤵PID:4768
-
\??\c:\htthhn.exec:\htthhn.exe187⤵PID:3136
-
\??\c:\vpjvv.exec:\vpjvv.exe188⤵PID:1548
-
\??\c:\pdpjd.exec:\pdpjd.exe189⤵PID:1876
-
\??\c:\rrlffxx.exec:\rrlffxx.exe190⤵PID:4636
-
\??\c:\httbbb.exec:\httbbb.exe191⤵PID:1104
-
\??\c:\hhtbhb.exec:\hhtbhb.exe192⤵PID:1868
-
\??\c:\vpdvv.exec:\vpdvv.exe193⤵PID:2452
-
\??\c:\pvvpp.exec:\pvvpp.exe194⤵PID:3724
-
\??\c:\xxlrrll.exec:\xxlrrll.exe195⤵PID:1676
-
\??\c:\rxxlfxr.exec:\rxxlfxr.exe196⤵PID:1432
-
\??\c:\3nnhbb.exec:\3nnhbb.exe197⤵PID:2092
-
\??\c:\nbttbb.exec:\nbttbb.exe198⤵PID:2540
-
\??\c:\djdvp.exec:\djdvp.exe199⤵PID:4256
-
\??\c:\xxfrfxr.exec:\xxfrfxr.exe200⤵PID:2920
-
\??\c:\nthbtt.exec:\nthbtt.exe201⤵PID:744
-
\??\c:\7hhbth.exec:\7hhbth.exe202⤵PID:4876
-
\??\c:\jdjvj.exec:\jdjvj.exe203⤵PID:396
-
\??\c:\rlfrlfx.exec:\rlfrlfx.exe204⤵PID:4144
-
\??\c:\nbtnhb.exec:\nbtnhb.exe205⤵PID:2864
-
\??\c:\nhbhnb.exec:\nhbhnb.exe206⤵PID:1000
-
\??\c:\5pjdp.exec:\5pjdp.exe207⤵PID:4404
-
\??\c:\dpvjd.exec:\dpvjd.exe208⤵PID:4724
-
\??\c:\xlrfrlx.exec:\xlrfrlx.exe209⤵PID:1608
-
\??\c:\3rrlfxx.exec:\3rrlfxx.exe210⤵PID:3984
-
\??\c:\9hhbtn.exec:\9hhbtn.exe211⤵PID:1560
-
\??\c:\hbhbnb.exec:\hbhbnb.exe212⤵PID:1020
-
\??\c:\ddpjp.exec:\ddpjp.exe213⤵PID:4936
-
\??\c:\pvvpd.exec:\pvvpd.exe214⤵PID:796
-
\??\c:\1frrlrf.exec:\1frrlrf.exe215⤵PID:720
-
\??\c:\hbtnhb.exec:\hbtnhb.exe216⤵PID:948
-
\??\c:\vpjpp.exec:\vpjpp.exe217⤵PID:884
-
\??\c:\3jjvj.exec:\3jjvj.exe218⤵PID:4716
-
\??\c:\vdvjv.exec:\vdvjv.exe219⤵PID:1444
-
\??\c:\lllfxrl.exec:\lllfxrl.exe220⤵PID:4976
-
\??\c:\ntbtnh.exec:\ntbtnh.exe221⤵PID:1772
-
\??\c:\hhbbnt.exec:\hhbbnt.exe222⤵PID:2924
-
\??\c:\7ddjv.exec:\7ddjv.exe223⤵PID:4472
-
\??\c:\lxrlrlr.exec:\lxrlrlr.exe224⤵PID:3644
-
\??\c:\xxffxrl.exec:\xxffxrl.exe225⤵PID:2316
-
\??\c:\thhhbt.exec:\thhhbt.exe226⤵PID:3536
-
\??\c:\7pjdv.exec:\7pjdv.exe227⤵PID:2528
-
\??\c:\7vvpd.exec:\7vvpd.exe228⤵PID:1868
-
\??\c:\lflxxrx.exec:\lflxxrx.exe229⤵PID:716
-
\??\c:\bhnttt.exec:\bhnttt.exe230⤵PID:3724
-
\??\c:\bbbbtt.exec:\bbbbtt.exe231⤵PID:4584
-
\??\c:\vdpjd.exec:\vdpjd.exe232⤵PID:3720
-
\??\c:\rxfxlfx.exec:\rxfxlfx.exe233⤵PID:3132
-
\??\c:\9lfxrrl.exec:\9lfxrrl.exe234⤵PID:4856
-
\??\c:\hnnnhh.exec:\hnnnhh.exe235⤵PID:2616
-
\??\c:\nbhtnh.exec:\nbhtnh.exe236⤵PID:4132
-
\??\c:\3vdvj.exec:\3vdvj.exe237⤵PID:4928
-
\??\c:\1jjpd.exec:\1jjpd.exe238⤵PID:216
-
\??\c:\lxrlxxr.exec:\lxrlxxr.exe239⤵PID:396
-
\??\c:\3thhtt.exec:\3thhtt.exe240⤵PID:4820
-
\??\c:\hbnhbb.exec:\hbnhbb.exe241⤵PID:452
-
\??\c:\jjdvp.exec:\jjdvp.exe242⤵PID:4800