Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 19:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1fac6d6eab37951e543c90bf6ab38e91a95b648735f4f67148b4a39b64608872.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
- Target 1fac6d6eab37951e543c90bf6ab38e91a95b648735f4f67148b4a39b64608872.exe
- Size 267KB
- Sample240519-x7tfraeb41
- SHA256 1fac6d6eab37951e543c90bf6ab38e91a95b648735f4f67148b4a39b64608872
- MD5 60480218bea373e87d32c24ced55e1cd
- SHA1 fa533cd244be5e602cecf8829b962ebd9a58fe8f
- SHA512 29f2f698dd0a42c3a507fd8f881ec3fc4171de6c1d42d698639095994a13e9ac6197cf2cd174446ceb51ba8d58e7306329a07aa1bc3f3cc46d7ea4fa078abdb5
- SSDEEP 3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmPzTkV2y/QTa9RBZydZbf83pnzgmmIMJ:n3C9BRIG0asYFm71mPfkVB8dKwaWZ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4684-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2628-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/924-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3864-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3736-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1276-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2396 rrlfrfr.exe 2628 hhhbtt.exe 2732 djpjj.exe 2364 pdvvv.exe 3864 xrxxxxx.exe 3192 hhhtbb.exe 924 3pdvp.exe 1984 9lrrlrf.exe 2148 thnhbb.exe 2944 hhbttt.exe 4928 dvddd.exe 1920 9ntnhh.exe 5028 5pvpp.exe 3736 nthhbb.exe 3000 jpvvv.exe 1848 xlrlffx.exe 1812 tntnbt.exe 4504 xxflfrl.exe 1272 1bbtnh.exe 4688 rflffll.exe 1276 httnbt.exe 2532 bhhhbb.exe 4372 lrlflfl.exe 3216 nntnbt.exe 2268 pdjdj.exe 1404 rflfxrl.exe 916 ppjjd.exe 3256 nnthbn.exe 3700 vjvdj.exe 4816 fxrrlxr.exe 1392 bbhbnh.exe 4920 lllrrff.exe 3008 jdjdv.exe 4824 pjjdp.exe 4828 ffffxrr.exe 4844 hhnnhh.exe 4952 vdpjj.exe 3224 jdjjd.exe 116 lrxlllx.exe 2628 hhhbbn.exe 1708 pdvdj.exe 2848 pvjjj.exe 2108 9thnhh.exe 1032 vjvvp.exe 4144 jpjpv.exe 2320 flflfff.exe 5004 nnhhhn.exe 2180 3vpvv.exe 4044 rrfxrxl.exe 4520 9thttt.exe 3624 vjjjv.exe 2072 xxfxrrl.exe 4112 hnnbhn.exe 3112 vdppp.exe 208 fffllrr.exe 4964 ttnbtn.exe 3692 nbhbbn.exe 1916 pdjvv.exe 492 bhbnnt.exe 552 vvdvj.exe 1308 flxrllx.exe 4772 5bhhhh.exe 2472 jpddp.exe 3856 frrrlrr.exe -
resource yara_rule behavioral2/memory/4684-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2628-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/924-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3864-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1276-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-202-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4684 wrote to memory of 2396 4684 1fac6d6eab37951e543c90bf6ab38e91a95b648735f4f67148b4a39b64608872.exe 83 PID 4684 wrote to memory of 2396 4684 1fac6d6eab37951e543c90bf6ab38e91a95b648735f4f67148b4a39b64608872.exe 83 PID 4684 wrote to memory of 2396 4684 1fac6d6eab37951e543c90bf6ab38e91a95b648735f4f67148b4a39b64608872.exe 83 PID 2396 wrote to memory of 2628 2396 rrlfrfr.exe 84 PID 2396 wrote to memory of 2628 2396 rrlfrfr.exe 84 PID 2396 wrote to memory of 2628 2396 rrlfrfr.exe 84 PID 2628 wrote to memory of 2732 2628 hhhbtt.exe 85 PID 2628 wrote to memory of 2732 2628 hhhbtt.exe 85 PID 2628 wrote to memory of 2732 2628 hhhbtt.exe 85 PID 2732 wrote to memory of 2364 2732 djpjj.exe 86 PID 2732 wrote to memory of 2364 2732 djpjj.exe 86 PID 2732 wrote to memory of 2364 2732 djpjj.exe 86 PID 2364 wrote to memory of 3864 2364 pdvvv.exe 87 PID 2364 wrote to memory of 3864 2364 pdvvv.exe 87 PID 2364 wrote to memory of 3864 2364 pdvvv.exe 87 PID 3864 wrote to memory of 3192 3864 xrxxxxx.exe 88 PID 3864 wrote to memory of 3192 3864 xrxxxxx.exe 88 PID 3864 wrote to memory of 3192 3864 xrxxxxx.exe 88 PID 3192 wrote to memory of 924 3192 hhhtbb.exe 89 PID 3192 wrote to memory of 924 3192 hhhtbb.exe 89 PID 3192 wrote to memory of 924 3192 hhhtbb.exe 89 PID 924 wrote to memory of 1984 924 3pdvp.exe 90 PID 924 wrote to memory of 1984 924 3pdvp.exe 90 PID 924 wrote to memory of 1984 924 3pdvp.exe 90 PID 1984 wrote to memory of 2148 1984 9lrrlrf.exe 91 PID 1984 wrote to memory of 2148 1984 9lrrlrf.exe 91 PID 1984 wrote to memory of 2148 1984 9lrrlrf.exe 91 PID 2148 wrote to memory of 2944 2148 thnhbb.exe 92 PID 2148 wrote to memory of 2944 2148 thnhbb.exe 92 PID 2148 wrote to memory of 2944 2148 thnhbb.exe 92 PID 2944 wrote to memory of 4928 2944 hhbttt.exe 93 PID 2944 wrote to memory of 4928 2944 hhbttt.exe 93 PID 2944 wrote to memory of 4928 2944 hhbttt.exe 93 PID 4928 wrote to memory of 1920 4928 dvddd.exe 94 PID 4928 wrote to memory of 1920 4928 dvddd.exe 94 PID 4928 wrote to memory of 1920 4928 dvddd.exe 94 PID 1920 wrote to memory of 5028 1920 9ntnhh.exe 95 PID 1920 wrote to memory of 5028 1920 9ntnhh.exe 95 PID 1920 wrote to memory of 5028 1920 9ntnhh.exe 95 PID 5028 wrote to memory of 3736 5028 5pvpp.exe 97 PID 5028 wrote to memory of 3736 5028 5pvpp.exe 97 PID 5028 wrote to memory of 3736 5028 5pvpp.exe 97 PID 3736 wrote to memory of 3000 3736 nthhbb.exe 98 PID 3736 wrote to memory of 3000 3736 nthhbb.exe 98 PID 3736 wrote to memory of 3000 3736 nthhbb.exe 98 PID 3000 wrote to memory of 1848 3000 jpvvv.exe 99 PID 3000 wrote to memory of 1848 3000 jpvvv.exe 99 PID 3000 wrote to memory of 1848 3000 jpvvv.exe 99 PID 1848 wrote to memory of 1812 1848 xlrlffx.exe 100 PID 1848 wrote to memory of 1812 1848 xlrlffx.exe 100 PID 1848 wrote to memory of 1812 1848 xlrlffx.exe 100 PID 1812 wrote to memory of 4504 1812 tntnbt.exe 101 PID 1812 wrote to memory of 4504 1812 tntnbt.exe 101 PID 1812 wrote to memory of 4504 1812 tntnbt.exe 101 PID 4504 wrote to memory of 1272 4504 xxflfrl.exe 102 PID 4504 wrote to memory of 1272 4504 xxflfrl.exe 102 PID 4504 wrote to memory of 1272 4504 xxflfrl.exe 102 PID 1272 wrote to memory of 4688 1272 1bbtnh.exe 103 PID 1272 wrote to memory of 4688 1272 1bbtnh.exe 103 PID 1272 wrote to memory of 4688 1272 1bbtnh.exe 103 PID 4688 wrote to memory of 1276 4688 rflffll.exe 104 PID 4688 wrote to memory of 1276 4688 rflffll.exe 104 PID 4688 wrote to memory of 1276 4688 rflffll.exe 104 PID 1276 wrote to memory of 2532 1276 httnbt.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fac6d6eab37951e543c90bf6ab38e91a95b648735f4f67148b4a39b64608872.exe"C:\Users\Admin\AppData\Local\Temp\1fac6d6eab37951e543c90bf6ab38e91a95b648735f4f67148b4a39b64608872.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\rrlfrfr.exec:\rrlfrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\hhhbtt.exec:\hhhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\djpjj.exec:\djpjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\pdvvv.exec:\pdvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\hhhtbb.exec:\hhhtbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\3pdvp.exec:\3pdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\9lrrlrf.exec:\9lrrlrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\thnhbb.exec:\thnhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\hhbttt.exec:\hhbttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\dvddd.exec:\dvddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\9ntnhh.exec:\9ntnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\5pvpp.exec:\5pvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\nthhbb.exec:\nthhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\jpvvv.exec:\jpvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\xlrlffx.exec:\xlrlffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\tntnbt.exec:\tntnbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\xxflfrl.exec:\xxflfrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\1bbtnh.exec:\1bbtnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\rflffll.exec:\rflffll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\httnbt.exec:\httnbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\bhhhbb.exec:\bhhhbb.exe23⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lrlflfl.exec:\lrlflfl.exe24⤵
- Executes dropped EXE
PID:4372 -
\??\c:\nntnbt.exec:\nntnbt.exe25⤵
- Executes dropped EXE
PID:3216 -
\??\c:\pdjdj.exec:\pdjdj.exe26⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rflfxrl.exec:\rflfxrl.exe27⤵
- Executes dropped EXE
PID:1404 -
\??\c:\ppjjd.exec:\ppjjd.exe28⤵
- Executes dropped EXE
PID:916 -
\??\c:\nnthbn.exec:\nnthbn.exe29⤵
- Executes dropped EXE
PID:3256 -
\??\c:\vjvdj.exec:\vjvdj.exe30⤵
- Executes dropped EXE
PID:3700 -
\??\c:\fxrrlxr.exec:\fxrrlxr.exe31⤵
- Executes dropped EXE
PID:4816 -
\??\c:\bbhbnh.exec:\bbhbnh.exe32⤵
- Executes dropped EXE
PID:1392 -
\??\c:\lllrrff.exec:\lllrrff.exe33⤵
- Executes dropped EXE
PID:4920 -
\??\c:\jdjdv.exec:\jdjdv.exe34⤵
- Executes dropped EXE
PID:3008 -
\??\c:\pjjdp.exec:\pjjdp.exe35⤵
- Executes dropped EXE
PID:4824 -
\??\c:\ffffxrr.exec:\ffffxrr.exe36⤵
- Executes dropped EXE
PID:4828 -
\??\c:\hhnnhh.exec:\hhnnhh.exe37⤵
- Executes dropped EXE
PID:4844 -
\??\c:\vdpjj.exec:\vdpjj.exe38⤵
- Executes dropped EXE
PID:4952 -
\??\c:\jdjjd.exec:\jdjjd.exe39⤵
- Executes dropped EXE
PID:3224 -
\??\c:\lrxlllx.exec:\lrxlllx.exe40⤵
- Executes dropped EXE
PID:116 -
\??\c:\hhhbbn.exec:\hhhbbn.exe41⤵
- Executes dropped EXE
PID:2628 -
\??\c:\pdvdj.exec:\pdvdj.exe42⤵
- Executes dropped EXE
PID:1708 -
\??\c:\pvjjj.exec:\pvjjj.exe43⤵
- Executes dropped EXE
PID:2848 -
\??\c:\9thnhh.exec:\9thnhh.exe44⤵
- Executes dropped EXE
PID:2108 -
\??\c:\vjvvp.exec:\vjvvp.exe45⤵
- Executes dropped EXE
PID:1032 -
\??\c:\jpjpv.exec:\jpjpv.exe46⤵
- Executes dropped EXE
PID:4144 -
\??\c:\flflfff.exec:\flflfff.exe47⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nnhhhn.exec:\nnhhhn.exe48⤵
- Executes dropped EXE
PID:5004 -
\??\c:\3vpvv.exec:\3vpvv.exe49⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rrfxrxl.exec:\rrfxrxl.exe50⤵
- Executes dropped EXE
PID:4044 -
\??\c:\9thttt.exec:\9thttt.exe51⤵
- Executes dropped EXE
PID:4520 -
\??\c:\vjjjv.exec:\vjjjv.exe52⤵
- Executes dropped EXE
PID:3624 -
\??\c:\xxfxrrl.exec:\xxfxrrl.exe53⤵
- Executes dropped EXE
PID:2072 -
\??\c:\hnnbhn.exec:\hnnbhn.exe54⤵
- Executes dropped EXE
PID:4112 -
\??\c:\vdppp.exec:\vdppp.exe55⤵
- Executes dropped EXE
PID:3112 -
\??\c:\fffllrr.exec:\fffllrr.exe56⤵
- Executes dropped EXE
PID:208 -
\??\c:\ttnbtn.exec:\ttnbtn.exe57⤵
- Executes dropped EXE
PID:4964 -
\??\c:\nbhbbn.exec:\nbhbbn.exe58⤵
- Executes dropped EXE
PID:3692 -
\??\c:\pdjvv.exec:\pdjvv.exe59⤵
- Executes dropped EXE
PID:1916 -
\??\c:\bhbnnt.exec:\bhbnnt.exe60⤵
- Executes dropped EXE
PID:492 -
\??\c:\vvdvj.exec:\vvdvj.exe61⤵
- Executes dropped EXE
PID:552 -
\??\c:\flxrllx.exec:\flxrllx.exe62⤵
- Executes dropped EXE
PID:1308 -
\??\c:\5bhhhh.exec:\5bhhhh.exe63⤵
- Executes dropped EXE
PID:4772 -
\??\c:\jpddp.exec:\jpddp.exe64⤵
- Executes dropped EXE
PID:2472 -
\??\c:\frrrlrr.exec:\frrrlrr.exe65⤵
- Executes dropped EXE
PID:3856 -
\??\c:\xxxfrfr.exec:\xxxfrfr.exe66⤵PID:3664
-
\??\c:\tnbttn.exec:\tnbttn.exe67⤵PID:3084
-
\??\c:\pjpjp.exec:\pjpjp.exe68⤵PID:3964
-
\??\c:\xrxfflx.exec:\xrxfflx.exe69⤵PID:5096
-
\??\c:\nhnhhh.exec:\nhnhhh.exe70⤵PID:3080
-
\??\c:\djjpd.exec:\djjpd.exe71⤵PID:4448
-
\??\c:\dppvj.exec:\dppvj.exe72⤵PID:3400
-
\??\c:\hhhbbn.exec:\hhhbbn.exe73⤵PID:916
-
\??\c:\jjddv.exec:\jjddv.exe74⤵PID:3436
-
\??\c:\9xrxllf.exec:\9xrxllf.exe75⤵PID:4480
-
\??\c:\nbhhnn.exec:\nbhhnn.exe76⤵PID:1588
-
\??\c:\pddpp.exec:\pddpp.exe77⤵PID:3700
-
\??\c:\rrxxffl.exec:\rrxxffl.exe78⤵PID:2324
-
\??\c:\1dddd.exec:\1dddd.exe79⤵PID:2968
-
\??\c:\fxlxlfr.exec:\fxlxlfr.exe80⤵PID:840
-
\??\c:\bbtbhb.exec:\bbtbhb.exe81⤵PID:4784
-
\??\c:\jvjpj.exec:\jvjpj.exe82⤵PID:3688
-
\??\c:\fxllxfl.exec:\fxllxfl.exe83⤵PID:632
-
\??\c:\7flrrll.exec:\7flrrll.exe84⤵PID:4528
-
\??\c:\5bnnhh.exec:\5bnnhh.exe85⤵PID:3252
-
\??\c:\pdjjj.exec:\pdjjj.exe86⤵PID:2588
-
\??\c:\xrrlrrx.exec:\xrrlrrx.exe87⤵PID:116
-
\??\c:\rxrrfrl.exec:\rxrrfrl.exe88⤵PID:5112
-
\??\c:\tnnnhh.exec:\tnnnhh.exe89⤵PID:1328
-
\??\c:\9dvpp.exec:\9dvpp.exe90⤵PID:3948
-
\??\c:\xrrrlfr.exec:\xrrrlfr.exe91⤵PID:4144
-
\??\c:\3flllxx.exec:\3flllxx.exe92⤵PID:1204
-
\??\c:\ntbtbh.exec:\ntbtbh.exe93⤵PID:2632
-
\??\c:\pjpvv.exec:\pjpvv.exe94⤵PID:4044
-
\??\c:\jvvvv.exec:\jvvvv.exe95⤵PID:3648
-
\??\c:\lffllrr.exec:\lffllrr.exe96⤵PID:3972
-
\??\c:\thhbbb.exec:\thhbbb.exe97⤵PID:2924
-
\??\c:\7hbttt.exec:\7hbttt.exe98⤵PID:5028
-
\??\c:\pdvvv.exec:\pdvvv.exe99⤵PID:1996
-
\??\c:\9lrrlll.exec:\9lrrlll.exe100⤵PID:3488
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe101⤵PID:492
-
\??\c:\hbbttt.exec:\hbbttt.exe102⤵PID:1852
-
\??\c:\pvpdj.exec:\pvpdj.exe103⤵PID:4316
-
\??\c:\btbttn.exec:\btbttn.exe104⤵PID:4424
-
\??\c:\hntnnn.exec:\hntnnn.exe105⤵PID:3604
-
\??\c:\pvvvd.exec:\pvvvd.exe106⤵PID:2224
-
\??\c:\flrxffl.exec:\flrxffl.exe107⤵PID:1400
-
\??\c:\7ttnth.exec:\7ttnth.exe108⤵PID:1244
-
\??\c:\bhnbbb.exec:\bhnbbb.exe109⤵PID:4064
-
\??\c:\jpppj.exec:\jpppj.exe110⤵PID:2612
-
\??\c:\rfxrrll.exec:\rfxrrll.exe111⤵PID:4696
-
\??\c:\rlxxlrr.exec:\rlxxlrr.exe112⤵PID:5036
-
\??\c:\btnbhb.exec:\btnbhb.exe113⤵PID:4432
-
\??\c:\jddjp.exec:\jddjp.exe114⤵PID:4752
-
\??\c:\dvdvv.exec:\dvdvv.exe115⤵PID:4908
-
\??\c:\rlllffx.exec:\rlllffx.exe116⤵PID:4236
-
\??\c:\tnbtht.exec:\tnbtht.exe117⤵PID:3756
-
\??\c:\djpjj.exec:\djpjj.exe118⤵PID:4900
-
\??\c:\rlfxlfr.exec:\rlfxlfr.exe119⤵PID:4920
-
\??\c:\5lfrflx.exec:\5lfrflx.exe120⤵PID:1284
-
\??\c:\thnhhb.exec:\thnhhb.exe121⤵PID:2620
-
\??\c:\lrrlfxx.exec:\lrrlfxx.exe122⤵PID:4828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-