Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 00:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a4bab32d4bfc29e37a4241c8f6fa96719c1450f25bd1b91543fb8d4b08479770.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
a4bab32d4bfc29e37a4241c8f6fa96719c1450f25bd1b91543fb8d4b08479770.exe
-
Size
258KB
-
MD5
aa999334248c5ed8ea98ef1dcf1be668
-
SHA1
74fb23abce09fb0f97f88ce04e577f7721ec6286
-
SHA256
a4bab32d4bfc29e37a4241c8f6fa96719c1450f25bd1b91543fb8d4b08479770
-
SHA512
1f35a898eb700a92438d6c6d1941eab29eb22e25716a5bc9e66a69e2c585e4e91ab7a390d498e8dcc1795d7a84315a1187d95b1f916ee16a914b90963716f013
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9FrHSwh/c/hdTWG4lmb37K3BoKLbCZ0E:n3C9BRo7tvnJ9Fywhk/T4i37K3BoKg0E
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2192-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/564-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1312-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/536-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-2943-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2192-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2200-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1432-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2672-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2372-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2440-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2400-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2884-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/564-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2752-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1312-178-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1244-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1984-214-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2172-276-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/536-159-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1796-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1092-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2200-2943-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
bnbbbh.exe202222.exe2062480.exenbnbhh.exec404480.exevvjdp.exe8240228.exe268800.exehtbbhb.exe3lrrllr.exedppvv.exe428804.exe42884.exejdpdv.exe2644040.exehtbbhn.exethhhhb.exelfxflrx.exe9hbhhn.exes8482.exebthhnh.exe482688.exe640688.exevpddv.exe46228.exe04246.exe3jdjv.exe08886.exe20666.exe42446.exe84460.exe4822884.exellllxrf.exenbhhtb.exevpjjp.exeu244046.exejvpvj.exe20624.exe5pjpp.exe26446.exerrxxffl.exe046626.exerfxxllr.exevpddp.exe64006.exenhthnt.exe42884.exea0880.exelxlfffl.exe60662.exek46062.exethnnnn.exe6424222.exe2684666.exe60802.exe08062.exexlfxxrr.exelfrfxxl.exe422288.exexrfrffr.exea6406.exe0288006.exetnbttt.exepdvdj.exepid process 2200 bnbbbh.exe 1432 202222.exe 2672 2062480.exe 2372 nbnbhh.exe 2724 c404480.exe 2440 vvjdp.exe 2400 8240228.exe 1548 268800.exe 1092 htbbhb.exe 2580 3lrrllr.exe 2884 dppvv.exe 2960 428804.exe 564 42884.exe 1248 jdpdv.exe 1796 2644040.exe 536 htbbhn.exe 2752 thhhhb.exe 1312 lfxflrx.exe 328 9hbhhn.exe 1244 s8482.exe 2108 bthhnh.exe 1984 482688.exe 2264 640688.exe 2032 vpddv.exe 612 46228.exe 912 04246.exe 1760 3jdjv.exe 948 08886.exe 2172 20666.exe 1096 42446.exe 2328 84460.exe 1680 4822884.exe 1196 llllxrf.exe 2540 nbhhtb.exe 2544 vpjjp.exe 2716 u244046.exe 1596 jvpvj.exe 2672 20624.exe 2212 5pjpp.exe 2708 26446.exe 768 rrxxffl.exe 2464 046626.exe 2452 rfxxllr.exe 1992 vpddp.exe 2788 64006.exe 2580 nhthnt.exe 2896 42884.exe 848 a0880.exe 1520 lxlfffl.exe 2632 60662.exe 1632 k46062.exe 1664 thnnnn.exe 884 6424222.exe 588 2684666.exe 1696 60802.exe 328 08062.exe 2064 xlfxxrr.exe 2764 lfrfxxl.exe 2304 422288.exe 1984 xrfrffr.exe 840 a6406.exe 1500 0288006.exe 2020 tnbttt.exe 304 pdvdj.exe -
Processes:
resource yara_rule behavioral1/memory/2192-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/564-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1312-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/536-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1092-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-2943-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a4bab32d4bfc29e37a4241c8f6fa96719c1450f25bd1b91543fb8d4b08479770.exebnbbbh.exe202222.exe2062480.exenbnbhh.exec404480.exevvjdp.exe8240228.exe268800.exehtbbhb.exe3lrrllr.exedppvv.exe428804.exe42884.exejdpdv.exe2644040.exedescription pid process target process PID 2192 wrote to memory of 2200 2192 a4bab32d4bfc29e37a4241c8f6fa96719c1450f25bd1b91543fb8d4b08479770.exe bnbbbh.exe PID 2192 wrote to memory of 2200 2192 a4bab32d4bfc29e37a4241c8f6fa96719c1450f25bd1b91543fb8d4b08479770.exe bnbbbh.exe PID 2192 wrote to memory of 2200 2192 a4bab32d4bfc29e37a4241c8f6fa96719c1450f25bd1b91543fb8d4b08479770.exe bnbbbh.exe PID 2192 wrote to memory of 2200 2192 a4bab32d4bfc29e37a4241c8f6fa96719c1450f25bd1b91543fb8d4b08479770.exe bnbbbh.exe PID 2200 wrote to memory of 1432 2200 bnbbbh.exe 202222.exe PID 2200 wrote to memory of 1432 2200 bnbbbh.exe 202222.exe PID 2200 wrote to memory of 1432 2200 bnbbbh.exe 202222.exe PID 2200 wrote to memory of 1432 2200 bnbbbh.exe 202222.exe PID 1432 wrote to memory of 2672 1432 202222.exe 20624.exe PID 1432 wrote to memory of 2672 1432 202222.exe 20624.exe PID 1432 wrote to memory of 2672 1432 202222.exe 20624.exe PID 1432 wrote to memory of 2672 1432 202222.exe 20624.exe PID 2672 wrote to memory of 2372 2672 2062480.exe nbnbhh.exe PID 2672 wrote to memory of 2372 2672 2062480.exe nbnbhh.exe PID 2672 wrote to memory of 2372 2672 2062480.exe nbnbhh.exe PID 2672 wrote to memory of 2372 2672 2062480.exe nbnbhh.exe PID 2372 wrote to memory of 2724 2372 nbnbhh.exe c404480.exe PID 2372 wrote to memory of 2724 2372 nbnbhh.exe c404480.exe PID 2372 wrote to memory of 2724 2372 nbnbhh.exe c404480.exe PID 2372 wrote to memory of 2724 2372 nbnbhh.exe c404480.exe PID 2724 wrote to memory of 2440 2724 c404480.exe vvjdp.exe PID 2724 wrote to memory of 2440 2724 c404480.exe vvjdp.exe PID 2724 wrote to memory of 2440 2724 c404480.exe vvjdp.exe PID 2724 wrote to memory of 2440 2724 c404480.exe vvjdp.exe PID 2440 wrote to memory of 2400 2440 vvjdp.exe 8240228.exe PID 2440 wrote to memory of 2400 2440 vvjdp.exe 8240228.exe PID 2440 wrote to memory of 2400 2440 vvjdp.exe 8240228.exe PID 2440 wrote to memory of 2400 2440 vvjdp.exe 8240228.exe PID 2400 wrote to memory of 1548 2400 8240228.exe 268800.exe PID 2400 wrote to memory of 1548 2400 8240228.exe 268800.exe PID 2400 wrote to memory of 1548 2400 8240228.exe 268800.exe PID 2400 wrote to memory of 1548 2400 8240228.exe 268800.exe PID 1548 wrote to memory of 1092 1548 268800.exe htbbhb.exe PID 1548 wrote to memory of 1092 1548 268800.exe htbbhb.exe PID 1548 wrote to memory of 1092 1548 268800.exe htbbhb.exe PID 1548 wrote to memory of 1092 1548 268800.exe htbbhb.exe PID 1092 wrote to memory of 2580 1092 htbbhb.exe 3lrrllr.exe PID 1092 wrote to memory of 2580 1092 htbbhb.exe 3lrrllr.exe PID 1092 wrote to memory of 2580 1092 htbbhb.exe 3lrrllr.exe PID 1092 wrote to memory of 2580 1092 htbbhb.exe 3lrrllr.exe PID 2580 wrote to memory of 2884 2580 3lrrllr.exe dppvv.exe PID 2580 wrote to memory of 2884 2580 3lrrllr.exe dppvv.exe PID 2580 wrote to memory of 2884 2580 3lrrllr.exe dppvv.exe PID 2580 wrote to memory of 2884 2580 3lrrllr.exe dppvv.exe PID 2884 wrote to memory of 2960 2884 dppvv.exe 428804.exe PID 2884 wrote to memory of 2960 2884 dppvv.exe 428804.exe PID 2884 wrote to memory of 2960 2884 dppvv.exe 428804.exe PID 2884 wrote to memory of 2960 2884 dppvv.exe 428804.exe PID 2960 wrote to memory of 564 2960 428804.exe 42884.exe PID 2960 wrote to memory of 564 2960 428804.exe 42884.exe PID 2960 wrote to memory of 564 2960 428804.exe 42884.exe PID 2960 wrote to memory of 564 2960 428804.exe 42884.exe PID 564 wrote to memory of 1248 564 42884.exe jdpdv.exe PID 564 wrote to memory of 1248 564 42884.exe jdpdv.exe PID 564 wrote to memory of 1248 564 42884.exe jdpdv.exe PID 564 wrote to memory of 1248 564 42884.exe jdpdv.exe PID 1248 wrote to memory of 1796 1248 jdpdv.exe 2644040.exe PID 1248 wrote to memory of 1796 1248 jdpdv.exe 2644040.exe PID 1248 wrote to memory of 1796 1248 jdpdv.exe 2644040.exe PID 1248 wrote to memory of 1796 1248 jdpdv.exe 2644040.exe PID 1796 wrote to memory of 536 1796 2644040.exe htbbhn.exe PID 1796 wrote to memory of 536 1796 2644040.exe htbbhn.exe PID 1796 wrote to memory of 536 1796 2644040.exe htbbhn.exe PID 1796 wrote to memory of 536 1796 2644040.exe htbbhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4bab32d4bfc29e37a4241c8f6fa96719c1450f25bd1b91543fb8d4b08479770.exe"C:\Users\Admin\AppData\Local\Temp\a4bab32d4bfc29e37a4241c8f6fa96719c1450f25bd1b91543fb8d4b08479770.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\bnbbbh.exec:\bnbbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\202222.exec:\202222.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\2062480.exec:\2062480.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\nbnbhh.exec:\nbnbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\c404480.exec:\c404480.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\vvjdp.exec:\vvjdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\8240228.exec:\8240228.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\268800.exec:\268800.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\htbbhb.exec:\htbbhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\3lrrllr.exec:\3lrrllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\dppvv.exec:\dppvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\428804.exec:\428804.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\42884.exec:\42884.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\jdpdv.exec:\jdpdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\2644040.exec:\2644040.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\htbbhn.exec:\htbbhn.exe17⤵
- Executes dropped EXE
PID:536 -
\??\c:\thhhhb.exec:\thhhhb.exe18⤵
- Executes dropped EXE
PID:2752 -
\??\c:\lfxflrx.exec:\lfxflrx.exe19⤵
- Executes dropped EXE
PID:1312 -
\??\c:\9hbhhn.exec:\9hbhhn.exe20⤵
- Executes dropped EXE
PID:328 -
\??\c:\s8482.exec:\s8482.exe21⤵
- Executes dropped EXE
PID:1244 -
\??\c:\bthhnh.exec:\bthhnh.exe22⤵
- Executes dropped EXE
PID:2108 -
\??\c:\482688.exec:\482688.exe23⤵
- Executes dropped EXE
PID:1984 -
\??\c:\640688.exec:\640688.exe24⤵
- Executes dropped EXE
PID:2264 -
\??\c:\vpddv.exec:\vpddv.exe25⤵
- Executes dropped EXE
PID:2032 -
\??\c:\46228.exec:\46228.exe26⤵
- Executes dropped EXE
PID:612 -
\??\c:\04246.exec:\04246.exe27⤵
- Executes dropped EXE
PID:912 -
\??\c:\3jdjv.exec:\3jdjv.exe28⤵
- Executes dropped EXE
PID:1760 -
\??\c:\08886.exec:\08886.exe29⤵
- Executes dropped EXE
PID:948 -
\??\c:\20666.exec:\20666.exe30⤵
- Executes dropped EXE
PID:2172 -
\??\c:\42446.exec:\42446.exe31⤵
- Executes dropped EXE
PID:1096 -
\??\c:\84460.exec:\84460.exe32⤵
- Executes dropped EXE
PID:2328 -
\??\c:\4822884.exec:\4822884.exe33⤵
- Executes dropped EXE
PID:1680 -
\??\c:\llllxrf.exec:\llllxrf.exe34⤵
- Executes dropped EXE
PID:1196 -
\??\c:\nbhhtb.exec:\nbhhtb.exe35⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vpjjp.exec:\vpjjp.exe36⤵
- Executes dropped EXE
PID:2544 -
\??\c:\u244046.exec:\u244046.exe37⤵
- Executes dropped EXE
PID:2716 -
\??\c:\jvpvj.exec:\jvpvj.exe38⤵
- Executes dropped EXE
PID:1596 -
\??\c:\20624.exec:\20624.exe39⤵
- Executes dropped EXE
PID:2672 -
\??\c:\5pjpp.exec:\5pjpp.exe40⤵
- Executes dropped EXE
PID:2212 -
\??\c:\26446.exec:\26446.exe41⤵
- Executes dropped EXE
PID:2708 -
\??\c:\rrxxffl.exec:\rrxxffl.exe42⤵
- Executes dropped EXE
PID:768 -
\??\c:\046626.exec:\046626.exe43⤵
- Executes dropped EXE
PID:2464 -
\??\c:\rfxxllr.exec:\rfxxllr.exe44⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vpddp.exec:\vpddp.exe45⤵
- Executes dropped EXE
PID:1992 -
\??\c:\64006.exec:\64006.exe46⤵
- Executes dropped EXE
PID:2788 -
\??\c:\nhthnt.exec:\nhthnt.exe47⤵
- Executes dropped EXE
PID:2580 -
\??\c:\42884.exec:\42884.exe48⤵
- Executes dropped EXE
PID:2896 -
\??\c:\a0880.exec:\a0880.exe49⤵
- Executes dropped EXE
PID:848 -
\??\c:\lxlfffl.exec:\lxlfffl.exe50⤵
- Executes dropped EXE
PID:1520 -
\??\c:\60662.exec:\60662.exe51⤵
- Executes dropped EXE
PID:2632 -
\??\c:\k46062.exec:\k46062.exe52⤵
- Executes dropped EXE
PID:1632 -
\??\c:\thnnnn.exec:\thnnnn.exe53⤵
- Executes dropped EXE
PID:1664 -
\??\c:\6424222.exec:\6424222.exe54⤵
- Executes dropped EXE
PID:884 -
\??\c:\2684666.exec:\2684666.exe55⤵
- Executes dropped EXE
PID:588 -
\??\c:\60802.exec:\60802.exe56⤵
- Executes dropped EXE
PID:1696 -
\??\c:\08062.exec:\08062.exe57⤵
- Executes dropped EXE
PID:328 -
\??\c:\xlfxxrr.exec:\xlfxxrr.exe58⤵
- Executes dropped EXE
PID:2064 -
\??\c:\lfrfxxl.exec:\lfrfxxl.exe59⤵
- Executes dropped EXE
PID:2764 -
\??\c:\422288.exec:\422288.exe60⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xrfrffr.exec:\xrfrffr.exe61⤵
- Executes dropped EXE
PID:1984 -
\??\c:\a6406.exec:\a6406.exe62⤵
- Executes dropped EXE
PID:840 -
\??\c:\0288006.exec:\0288006.exe63⤵
- Executes dropped EXE
PID:1500 -
\??\c:\tnbttt.exec:\tnbttt.exe64⤵
- Executes dropped EXE
PID:2020 -
\??\c:\pdvdj.exec:\pdvdj.exe65⤵
- Executes dropped EXE
PID:304 -
\??\c:\64602.exec:\64602.exe66⤵PID:2012
-
\??\c:\1hbntb.exec:\1hbntb.exe67⤵PID:956
-
\??\c:\2600840.exec:\2600840.exe68⤵PID:3032
-
\??\c:\82462.exec:\82462.exe69⤵PID:600
-
\??\c:\9bnthh.exec:\9bnthh.exe70⤵PID:2876
-
\??\c:\bthntn.exec:\bthntn.exe71⤵PID:2308
-
\??\c:\nnnnnh.exec:\nnnnnh.exe72⤵PID:2072
-
\??\c:\60840.exec:\60840.exe73⤵PID:2484
-
\??\c:\080400.exec:\080400.exe74⤵PID:2216
-
\??\c:\s8040.exec:\s8040.exe75⤵PID:2188
-
\??\c:\jppjj.exec:\jppjj.exe76⤵PID:2104
-
\??\c:\vjpdj.exec:\vjpdj.exe77⤵PID:2840
-
\??\c:\1xlxlfx.exec:\1xlxlfx.exe78⤵PID:2716
-
\??\c:\4622884.exec:\4622884.exe79⤵PID:3068
-
\??\c:\i004600.exec:\i004600.exe80⤵PID:2828
-
\??\c:\42840.exec:\42840.exe81⤵PID:2424
-
\??\c:\s8402.exec:\s8402.exe82⤵PID:2664
-
\??\c:\8060602.exec:\8060602.exe83⤵PID:2412
-
\??\c:\6440066.exec:\6440066.exe84⤵PID:2936
-
\??\c:\bnbtbt.exec:\bnbtbt.exe85⤵PID:1900
-
\??\c:\g0228.exec:\g0228.exe86⤵PID:2928
-
\??\c:\k02600.exec:\k02600.exe87⤵PID:1092
-
\??\c:\02406.exec:\02406.exe88⤵PID:2920
-
\??\c:\684000.exec:\684000.exe89⤵PID:1812
-
\??\c:\thnbtn.exec:\thnbtn.exe90⤵PID:1228
-
\??\c:\ttbbbb.exec:\ttbbbb.exe91⤵PID:2704
-
\??\c:\vpvpv.exec:\vpvpv.exe92⤵PID:1536
-
\??\c:\xlrllrr.exec:\xlrllrr.exe93⤵PID:2224
-
\??\c:\2860800.exec:\2860800.exe94⤵PID:780
-
\??\c:\u484040.exec:\u484040.exe95⤵PID:2744
-
\??\c:\9flfllx.exec:\9flfllx.exe96⤵PID:2956
-
\??\c:\028484.exec:\028484.exe97⤵PID:2056
-
\??\c:\k86660.exec:\k86660.exe98⤵PID:1188
-
\??\c:\46822.exec:\46822.exe99⤵PID:1056
-
\??\c:\8066000.exec:\8066000.exe100⤵PID:2804
-
\??\c:\jvjpd.exec:\jvjpd.exe101⤵PID:2108
-
\??\c:\7pjjp.exec:\7pjjp.exe102⤵PID:1376
-
\??\c:\djjpp.exec:\djjpp.exe103⤵PID:3044
-
\??\c:\hbnhtn.exec:\hbnhtn.exe104⤵PID:984
-
\??\c:\lllrxxx.exec:\lllrxxx.exe105⤵PID:1168
-
\??\c:\xrxffll.exec:\xrxffll.exe106⤵PID:1320
-
\??\c:\u800228.exec:\u800228.exe107⤵PID:2340
-
\??\c:\1jvjp.exec:\1jvjp.exe108⤵PID:1640
-
\??\c:\4200066.exec:\4200066.exe109⤵PID:1804
-
\??\c:\q82626.exec:\q82626.exe110⤵PID:2152
-
\??\c:\204400.exec:\204400.exe111⤵PID:1964
-
\??\c:\08224.exec:\08224.exe112⤵PID:1876
-
\??\c:\lrfrlfx.exec:\lrfrlfx.exe113⤵PID:1700
-
\??\c:\6400006.exec:\6400006.exe114⤵PID:1328
-
\??\c:\w64400.exec:\w64400.exe115⤵PID:3064
-
\??\c:\86806.exec:\86806.exe116⤵PID:2144
-
\??\c:\486068.exec:\486068.exe117⤵PID:1432
-
\??\c:\k08848.exec:\k08848.exe118⤵PID:2652
-
\??\c:\pjjjp.exec:\pjjjp.exe119⤵PID:2504
-
\??\c:\vjpjj.exec:\vjpjj.exe120⤵PID:2408
-
\??\c:\o248040.exec:\o248040.exe121⤵PID:2560
-
\??\c:\6022280.exec:\6022280.exe122⤵PID:2660
-
\??\c:\646628.exec:\646628.exe123⤵PID:2572
-
\??\c:\6466266.exec:\6466266.exe124⤵PID:2708
-
\??\c:\hthbbt.exec:\hthbbt.exe125⤵PID:768
-
\??\c:\042844.exec:\042844.exe126⤵PID:2552
-
\??\c:\20600.exec:\20600.exe127⤵PID:1692
-
\??\c:\jdjdp.exec:\jdjdp.exe128⤵PID:2808
-
\??\c:\6448828.exec:\6448828.exe129⤵PID:2772
-
\??\c:\1rllxxl.exec:\1rllxxl.exe130⤵PID:2624
-
\??\c:\s6840.exec:\s6840.exe131⤵PID:2932
-
\??\c:\64482.exec:\64482.exe132⤵PID:1860
-
\??\c:\rfxflll.exec:\rfxflll.exe133⤵PID:2612
-
\??\c:\xlxrllr.exec:\xlxrllr.exe134⤵PID:1620
-
\??\c:\vjvvd.exec:\vjvvd.exe135⤵PID:1796
-
\??\c:\nbnhtt.exec:\nbnhtt.exe136⤵PID:540
-
\??\c:\42440.exec:\42440.exe137⤵PID:640
-
\??\c:\bnttbb.exec:\bnttbb.exe138⤵PID:1312
-
\??\c:\48068.exec:\48068.exe139⤵PID:1132
-
\??\c:\rlrxffl.exec:\rlrxffl.exe140⤵PID:276
-
\??\c:\dpdjj.exec:\dpdjj.exe141⤵PID:2100
-
\??\c:\fxfrllx.exec:\fxfrllx.exe142⤵PID:2024
-
\??\c:\jdppv.exec:\jdppv.exe143⤵PID:484
-
\??\c:\9xxfrxf.exec:\9xxfrxf.exe144⤵PID:1932
-
\??\c:\08808.exec:\08808.exe145⤵PID:2976
-
\??\c:\xrrrxfl.exec:\xrrrxfl.exe146⤵PID:1356
-
\??\c:\rlrlllr.exec:\rlrlllr.exe147⤵PID:1952
-
\??\c:\btnthb.exec:\btnthb.exe148⤵PID:1612
-
\??\c:\xrffllr.exec:\xrffllr.exe149⤵PID:284
-
\??\c:\1vvdj.exec:\1vvdj.exe150⤵PID:916
-
\??\c:\28606.exec:\28606.exe151⤵PID:1880
-
\??\c:\8640002.exec:\8640002.exe152⤵PID:1896
-
\??\c:\864640.exec:\864640.exe153⤵PID:2816
-
\??\c:\468444.exec:\468444.exe154⤵PID:896
-
\??\c:\m8644.exec:\m8644.exe155⤵PID:3000
-
\??\c:\420460.exec:\420460.exe156⤵PID:2208
-
\??\c:\flrllff.exec:\flrllff.exe157⤵PID:2968
-
\??\c:\608088.exec:\608088.exe158⤵PID:2144
-
\??\c:\rfllffl.exec:\rfllffl.exe159⤵PID:1592
-
\??\c:\046688.exec:\046688.exe160⤵PID:2652
-
\??\c:\86062.exec:\86062.exe161⤵PID:2720
-
\??\c:\6088440.exec:\6088440.exe162⤵PID:2408
-
\??\c:\tnbnbh.exec:\tnbnbh.exe163⤵PID:2688
-
\??\c:\206688.exec:\206688.exe164⤵PID:2660
-
\??\c:\8684488.exec:\8684488.exe165⤵PID:2440
-
\??\c:\9thhtt.exec:\9thhtt.exe166⤵PID:2416
-
\??\c:\pjjdd.exec:\pjjdd.exe167⤵PID:2944
-
\??\c:\thnhhh.exec:\thnhhh.exe168⤵PID:2448
-
\??\c:\pjvpd.exec:\pjvpd.exe169⤵PID:1992
-
\??\c:\6424280.exec:\6424280.exe170⤵PID:2696
-
\??\c:\048406.exec:\048406.exe171⤵PID:1816
-
\??\c:\080000.exec:\080000.exe172⤵PID:2940
-
\??\c:\0428442.exec:\0428442.exe173⤵PID:800
-
\??\c:\vpvdj.exec:\vpvdj.exe174⤵PID:2960
-
\??\c:\9jpvd.exec:\9jpvd.exe175⤵PID:2388
-
\??\c:\5hbbbt.exec:\5hbbbt.exe176⤵PID:2472
-
\??\c:\860000.exec:\860000.exe177⤵PID:2224
-
\??\c:\9rffffr.exec:\9rffffr.exe178⤵PID:2128
-
\??\c:\w64062.exec:\w64062.exe179⤵PID:1028
-
\??\c:\ffrrflr.exec:\ffrrflr.exe180⤵PID:1492
-
\??\c:\2022006.exec:\2022006.exe181⤵PID:2056
-
\??\c:\fxlxllr.exec:\fxlxllr.exe182⤵PID:1224
-
\??\c:\e06244.exec:\e06244.exe183⤵PID:1244
-
\??\c:\m0846.exec:\m0846.exe184⤵PID:2756
-
\??\c:\0866880.exec:\0866880.exe185⤵PID:2496
-
\??\c:\08062.exec:\08062.exe186⤵PID:1976
-
\??\c:\bttthb.exec:\bttthb.exe187⤵PID:3044
-
\??\c:\fxffflr.exec:\fxffflr.exe188⤵PID:984
-
\??\c:\btnntb.exec:\btnntb.exe189⤵PID:1904
-
\??\c:\dpddj.exec:\dpddj.exe190⤵PID:1484
-
\??\c:\xrllxff.exec:\xrllxff.exe191⤵PID:844
-
\??\c:\fxllxxf.exec:\fxllxxf.exe192⤵PID:904
-
\??\c:\60880.exec:\60880.exe193⤵PID:1160
-
\??\c:\hbtbhn.exec:\hbtbhn.exe194⤵PID:1892
-
\??\c:\s4628.exec:\s4628.exe195⤵PID:2096
-
\??\c:\3bnhhh.exec:\3bnhhh.exe196⤵PID:1144
-
\??\c:\rlxfffr.exec:\rlxfffr.exe197⤵PID:3004
-
\??\c:\2088480.exec:\2088480.exe198⤵PID:1680
-
\??\c:\xrflffr.exec:\xrflffr.exe199⤵PID:1328
-
\??\c:\nhtbhh.exec:\nhtbhh.exe200⤵PID:2112
-
\??\c:\a4224.exec:\a4224.exe201⤵PID:2492
-
\??\c:\08446.exec:\08446.exe202⤵PID:2668
-
\??\c:\26842.exec:\26842.exe203⤵PID:2652
-
\??\c:\286642.exec:\286642.exe204⤵PID:2504
-
\??\c:\82680.exec:\82680.exe205⤵PID:2408
-
\??\c:\9htbnh.exec:\9htbnh.exe206⤵PID:2688
-
\??\c:\5xxfrrf.exec:\5xxfrrf.exe207⤵PID:2660
-
\??\c:\nhnntt.exec:\nhnntt.exe208⤵PID:2568
-
\??\c:\0424662.exec:\0424662.exe209⤵PID:2416
-
\??\c:\0462446.exec:\0462446.exe210⤵PID:1920
-
\??\c:\jdpjp.exec:\jdpjp.exe211⤵PID:2464
-
\??\c:\btbbhb.exec:\btbbhb.exe212⤵PID:1992
-
\??\c:\3lxxlfr.exec:\3lxxlfr.exe213⤵PID:2904
-
\??\c:\0428040.exec:\0428040.exe214⤵PID:2580
-
\??\c:\0428446.exec:\0428446.exe215⤵PID:2912
-
\??\c:\9hbbnn.exec:\9hbbnn.exe216⤵PID:800
-
\??\c:\pjvvj.exec:\pjvvj.exe217⤵PID:2960
-
\??\c:\jdvdp.exec:\jdvdp.exe218⤵PID:2388
-
\??\c:\480240.exec:\480240.exe219⤵PID:1300
-
\??\c:\btbbhb.exec:\btbbhb.exe220⤵PID:536
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe221⤵PID:2128
-
\??\c:\02488.exec:\02488.exe222⤵PID:540
-
\??\c:\ffxlxxl.exec:\ffxlxxl.exe223⤵PID:1492
-
\??\c:\xlfflfl.exec:\xlfflfl.exe224⤵PID:1308
-
\??\c:\btnnbb.exec:\btnnbb.exe225⤵PID:1100
-
\??\c:\vpvvj.exec:\vpvvj.exe226⤵PID:2804
-
\??\c:\dvjdv.exec:\dvjdv.exe227⤵PID:2108
-
\??\c:\hbnnhn.exec:\hbnnhn.exe228⤵PID:2024
-
\??\c:\i268446.exec:\i268446.exe229⤵PID:1976
-
\??\c:\2644668.exec:\2644668.exe230⤵PID:1376
-
\??\c:\tnhtbh.exec:\tnhtbh.exe231⤵PID:2040
-
\??\c:\5thhtt.exec:\5thhtt.exe232⤵PID:1952
-
\??\c:\086240.exec:\086240.exe233⤵PID:912
-
\??\c:\jjvjd.exec:\jjvjd.exe234⤵PID:284
-
\??\c:\e80028.exec:\e80028.exe235⤵PID:1864
-
\??\c:\nhbhnt.exec:\nhbhnt.exe236⤵PID:1880
-
\??\c:\48064.exec:\48064.exe237⤵PID:1896
-
\??\c:\2862408.exec:\2862408.exe238⤵PID:2280
-
\??\c:\820240.exec:\820240.exe239⤵PID:896
-
\??\c:\rlxxfff.exec:\rlxxfff.exe240⤵PID:1876
-
\??\c:\046606.exec:\046606.exe241⤵PID:3064
-
\??\c:\680666.exec:\680666.exe242⤵PID:3040