Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 20:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
009ca363c0905fc9c567c1f327805d4988a69063b3770efad233e1539d0c4faa.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
009ca363c0905fc9c567c1f327805d4988a69063b3770efad233e1539d0c4faa.exe
-
Size
840KB
-
MD5
0b3d6a376b87373f2afb5ac413977c10
-
SHA1
948230a7fa431c31c1052811cb6c2c154aff88ad
-
SHA256
009ca363c0905fc9c567c1f327805d4988a69063b3770efad233e1539d0c4faa
-
SHA512
382331618d2e9e1e74f004789d95ffaf652e1fa40c289445d564c7883c397264bee979508f90ed6fde3104951a8f2cd8b33b5e82ed90c42b7b61df6808f02b40
-
SSDEEP
24576:Sgdn8whSenedn8whhdn76gdn8whSfgdn8whSzm:TFyVPfz
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/2652-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1672-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1716-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2628-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3332-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1840-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/660-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1644-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
066044.exevppjd.exe20646.exedvvvp.exe264486.exenbhtnh.exelflfxrx.exe66646.exew48208.exe5hbthb.exe820688.exebhhthh.exe88828.exevjjdp.exe40664.exenhthbh.exe282622.exe664282.exe868628.exe884826.exe402284.exedjvpp.exe86606.exellxfllr.exe484602.exe9thbbn.exejdpjp.exe08482.exe828266.exexfxxxxl.exefxrfxxr.exe0422406.exe9tbthh.exe6462888.exe004044.exejvpdp.exe4486048.exe5rrlfrl.exe282242.exetbhbtb.exe66422.exedpdpj.exe20862.exebhhthn.exenbbthb.exe286404.exenbhbbb.exennbtnt.exe3djdp.exeffrlflf.exe5dvpj.exeu226482.exebhbthh.exedvpjd.exevjjvp.exe2000628.exe84426.exe064828.exepjddj.exedpvpj.exefxfxxrr.exe822266.exefrxrllr.exe08448.exepid process 2652 066044.exe 2888 vppjd.exe 1644 20646.exe 1672 dvvvp.exe 3416 264486.exe 1716 nbhtnh.exe 3388 lflfxrx.exe 2628 66646.exe 4984 w48208.exe 1412 5hbthb.exe 660 820688.exe 1048 bhhthh.exe 1544 88828.exe 3260 vjjdp.exe 3076 40664.exe 1860 nhthbh.exe 3052 282622.exe 1160 664282.exe 3904 868628.exe 1424 884826.exe 4508 402284.exe 4448 djvpp.exe 4792 86606.exe 3984 llxfllr.exe 2736 484602.exe 2072 9thbbn.exe 3332 jdpjp.exe 1840 08482.exe 2040 828266.exe 4888 xfxxxxl.exe 4332 fxrfxxr.exe 3640 0422406.exe 3032 9tbthh.exe 1628 6462888.exe 408 004044.exe 460 jvpdp.exe 780 4486048.exe 3520 5rrlfrl.exe 5084 282242.exe 3524 tbhbtb.exe 752 66422.exe 2844 dpdpj.exe 3100 20862.exe 2196 bhhthn.exe 1220 nbbthb.exe 4288 286404.exe 516 nbhbbb.exe 4592 nnbtnt.exe 5036 3djdp.exe 4968 ffrlflf.exe 2108 5dvpj.exe 1424 u226482.exe 2896 bhbthh.exe 2836 dvpjd.exe 220 vjjvp.exe 444 2000628.exe 3020 84426.exe 3332 064828.exe 4292 pjddj.exe 4432 dpvpj.exe 4728 fxfxxrr.exe 2772 822266.exe 1236 frxrllr.exe 1764 08448.exe -
Processes:
resource yara_rule behavioral2/memory/2652-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2628-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3332-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/660-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-3-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
009ca363c0905fc9c567c1f327805d4988a69063b3770efad233e1539d0c4faa.exe066044.exevppjd.exe20646.exedvvvp.exe264486.exenbhtnh.exelflfxrx.exe66646.exew48208.exe5hbthb.exe820688.exebhhthh.exe88828.exevjjdp.exe40664.exenhthbh.exe282622.exe664282.exe868628.exe884826.exe402284.exedescription pid process target process PID 2748 wrote to memory of 2652 2748 009ca363c0905fc9c567c1f327805d4988a69063b3770efad233e1539d0c4faa.exe 066044.exe PID 2748 wrote to memory of 2652 2748 009ca363c0905fc9c567c1f327805d4988a69063b3770efad233e1539d0c4faa.exe 066044.exe PID 2748 wrote to memory of 2652 2748 009ca363c0905fc9c567c1f327805d4988a69063b3770efad233e1539d0c4faa.exe 066044.exe PID 2652 wrote to memory of 2888 2652 066044.exe vppjd.exe PID 2652 wrote to memory of 2888 2652 066044.exe vppjd.exe PID 2652 wrote to memory of 2888 2652 066044.exe vppjd.exe PID 2888 wrote to memory of 1644 2888 vppjd.exe 20646.exe PID 2888 wrote to memory of 1644 2888 vppjd.exe 20646.exe PID 2888 wrote to memory of 1644 2888 vppjd.exe 20646.exe PID 1644 wrote to memory of 1672 1644 20646.exe dvvvp.exe PID 1644 wrote to memory of 1672 1644 20646.exe dvvvp.exe PID 1644 wrote to memory of 1672 1644 20646.exe dvvvp.exe PID 1672 wrote to memory of 3416 1672 dvvvp.exe 264486.exe PID 1672 wrote to memory of 3416 1672 dvvvp.exe 264486.exe PID 1672 wrote to memory of 3416 1672 dvvvp.exe 264486.exe PID 3416 wrote to memory of 1716 3416 264486.exe 006864.exe PID 3416 wrote to memory of 1716 3416 264486.exe 006864.exe PID 3416 wrote to memory of 1716 3416 264486.exe 006864.exe PID 1716 wrote to memory of 3388 1716 nbhtnh.exe lflfxrx.exe PID 1716 wrote to memory of 3388 1716 nbhtnh.exe lflfxrx.exe PID 1716 wrote to memory of 3388 1716 nbhtnh.exe lflfxrx.exe PID 3388 wrote to memory of 2628 3388 lflfxrx.exe 66646.exe PID 3388 wrote to memory of 2628 3388 lflfxrx.exe 66646.exe PID 3388 wrote to memory of 2628 3388 lflfxrx.exe 66646.exe PID 2628 wrote to memory of 4984 2628 66646.exe w48208.exe PID 2628 wrote to memory of 4984 2628 66646.exe w48208.exe PID 2628 wrote to memory of 4984 2628 66646.exe w48208.exe PID 4984 wrote to memory of 1412 4984 w48208.exe 5hbthb.exe PID 4984 wrote to memory of 1412 4984 w48208.exe 5hbthb.exe PID 4984 wrote to memory of 1412 4984 w48208.exe 5hbthb.exe PID 1412 wrote to memory of 660 1412 5hbthb.exe 820688.exe PID 1412 wrote to memory of 660 1412 5hbthb.exe 820688.exe PID 1412 wrote to memory of 660 1412 5hbthb.exe 820688.exe PID 660 wrote to memory of 1048 660 820688.exe bhhthh.exe PID 660 wrote to memory of 1048 660 820688.exe bhhthh.exe PID 660 wrote to memory of 1048 660 820688.exe bhhthh.exe PID 1048 wrote to memory of 1544 1048 bhhthh.exe 88828.exe PID 1048 wrote to memory of 1544 1048 bhhthh.exe 88828.exe PID 1048 wrote to memory of 1544 1048 bhhthh.exe 88828.exe PID 1544 wrote to memory of 3260 1544 88828.exe vjjdp.exe PID 1544 wrote to memory of 3260 1544 88828.exe vjjdp.exe PID 1544 wrote to memory of 3260 1544 88828.exe vjjdp.exe PID 3260 wrote to memory of 3076 3260 vjjdp.exe 40664.exe PID 3260 wrote to memory of 3076 3260 vjjdp.exe 40664.exe PID 3260 wrote to memory of 3076 3260 vjjdp.exe 40664.exe PID 3076 wrote to memory of 1860 3076 40664.exe nhthbh.exe PID 3076 wrote to memory of 1860 3076 40664.exe nhthbh.exe PID 3076 wrote to memory of 1860 3076 40664.exe nhthbh.exe PID 1860 wrote to memory of 3052 1860 nhthbh.exe 282622.exe PID 1860 wrote to memory of 3052 1860 nhthbh.exe 282622.exe PID 1860 wrote to memory of 3052 1860 nhthbh.exe 282622.exe PID 3052 wrote to memory of 1160 3052 282622.exe 664282.exe PID 3052 wrote to memory of 1160 3052 282622.exe 664282.exe PID 3052 wrote to memory of 1160 3052 282622.exe 664282.exe PID 1160 wrote to memory of 3904 1160 664282.exe 868628.exe PID 1160 wrote to memory of 3904 1160 664282.exe 868628.exe PID 1160 wrote to memory of 3904 1160 664282.exe 868628.exe PID 3904 wrote to memory of 1424 3904 868628.exe tbbttn.exe PID 3904 wrote to memory of 1424 3904 868628.exe tbbttn.exe PID 3904 wrote to memory of 1424 3904 868628.exe tbbttn.exe PID 1424 wrote to memory of 4508 1424 884826.exe 402284.exe PID 1424 wrote to memory of 4508 1424 884826.exe 402284.exe PID 1424 wrote to memory of 4508 1424 884826.exe 402284.exe PID 4508 wrote to memory of 4448 4508 402284.exe djvpp.exe
Processes
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\009ca363c0905fc9c567c1f327805d4988a69063b3770efad233e1539d0c4faa.exe"C:\Users\Admin\AppData\Local\Temp\009ca363c0905fc9c567c1f327805d4988a69063b3770efad233e1539d0c4faa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\066044.exec:\066044.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vppjd.exec:\vppjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\20646.exec:\20646.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\dvvvp.exec:\dvvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\264486.exec:\264486.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\nbhtnh.exec:\nbhtnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\lflfxrx.exec:\lflfxrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\66646.exec:\66646.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\w48208.exec:\w48208.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\5hbthb.exec:\5hbthb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\820688.exec:\820688.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\bhhthh.exec:\bhhthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\88828.exec:\88828.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\vjjdp.exec:\vjjdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\40664.exec:\40664.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\nhthbh.exec:\nhthbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\282622.exec:\282622.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\664282.exec:\664282.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\868628.exec:\868628.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\884826.exec:\884826.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\402284.exec:\402284.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\djvpp.exec:\djvpp.exe23⤵
- Executes dropped EXE
PID:4448 -
\??\c:\86606.exec:\86606.exe24⤵
- Executes dropped EXE
PID:4792 -
\??\c:\llxfllr.exec:\llxfllr.exe25⤵
- Executes dropped EXE
PID:3984 -
\??\c:\484602.exec:\484602.exe26⤵
- Executes dropped EXE
PID:2736 -
\??\c:\9thbbn.exec:\9thbbn.exe27⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jdpjp.exec:\jdpjp.exe28⤵
- Executes dropped EXE
PID:3332 -
\??\c:\08482.exec:\08482.exe29⤵
- Executes dropped EXE
PID:1840 -
\??\c:\828266.exec:\828266.exe30⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xfxxxxl.exec:\xfxxxxl.exe31⤵
- Executes dropped EXE
PID:4888 -
\??\c:\fxrfxxr.exec:\fxrfxxr.exe32⤵
- Executes dropped EXE
PID:4332 -
\??\c:\0422406.exec:\0422406.exe33⤵
- Executes dropped EXE
PID:3640 -
\??\c:\9tbthh.exec:\9tbthh.exe34⤵
- Executes dropped EXE
PID:3032 -
\??\c:\6462888.exec:\6462888.exe35⤵
- Executes dropped EXE
PID:1628 -
\??\c:\004044.exec:\004044.exe36⤵
- Executes dropped EXE
PID:408 -
\??\c:\jvpdp.exec:\jvpdp.exe37⤵
- Executes dropped EXE
PID:460 -
\??\c:\4486048.exec:\4486048.exe38⤵
- Executes dropped EXE
PID:780 -
\??\c:\5rrlfrl.exec:\5rrlfrl.exe39⤵
- Executes dropped EXE
PID:3520 -
\??\c:\282242.exec:\282242.exe40⤵
- Executes dropped EXE
PID:5084 -
\??\c:\tbhbtb.exec:\tbhbtb.exe41⤵
- Executes dropped EXE
PID:3524 -
\??\c:\66422.exec:\66422.exe42⤵
- Executes dropped EXE
PID:752 -
\??\c:\dpdpj.exec:\dpdpj.exe43⤵
- Executes dropped EXE
PID:2844 -
\??\c:\20862.exec:\20862.exe44⤵
- Executes dropped EXE
PID:3100 -
\??\c:\bhhthn.exec:\bhhthn.exe45⤵
- Executes dropped EXE
PID:2196 -
\??\c:\nbbthb.exec:\nbbthb.exe46⤵
- Executes dropped EXE
PID:1220 -
\??\c:\286404.exec:\286404.exe47⤵
- Executes dropped EXE
PID:4288 -
\??\c:\nbhbbb.exec:\nbhbbb.exe48⤵
- Executes dropped EXE
PID:516 -
\??\c:\nnbtnt.exec:\nnbtnt.exe49⤵
- Executes dropped EXE
PID:4592 -
\??\c:\3djdp.exec:\3djdp.exe50⤵
- Executes dropped EXE
PID:5036 -
\??\c:\ffrlflf.exec:\ffrlflf.exe51⤵
- Executes dropped EXE
PID:4968 -
\??\c:\5dvpj.exec:\5dvpj.exe52⤵
- Executes dropped EXE
PID:2108 -
\??\c:\u226482.exec:\u226482.exe53⤵
- Executes dropped EXE
PID:1424 -
\??\c:\bhbthh.exec:\bhbthh.exe54⤵
- Executes dropped EXE
PID:2896 -
\??\c:\dvpjd.exec:\dvpjd.exe55⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vjjvp.exec:\vjjvp.exe56⤵
- Executes dropped EXE
PID:220 -
\??\c:\2000628.exec:\2000628.exe57⤵
- Executes dropped EXE
PID:444 -
\??\c:\84426.exec:\84426.exe58⤵
- Executes dropped EXE
PID:3020 -
\??\c:\064828.exec:\064828.exe59⤵
- Executes dropped EXE
PID:3332 -
\??\c:\pjddj.exec:\pjddj.exe60⤵
- Executes dropped EXE
PID:4292 -
\??\c:\dpvpj.exec:\dpvpj.exe61⤵
- Executes dropped EXE
PID:4432 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe62⤵
- Executes dropped EXE
PID:4728 -
\??\c:\822266.exec:\822266.exe63⤵
- Executes dropped EXE
PID:2772 -
\??\c:\frxrllr.exec:\frxrllr.exe64⤵
- Executes dropped EXE
PID:1236 -
\??\c:\08448.exec:\08448.exe65⤵
- Executes dropped EXE
PID:1764 -
\??\c:\xflfxxr.exec:\xflfxxr.exe66⤵PID:1736
-
\??\c:\7xrrrrx.exec:\7xrrrrx.exe67⤵PID:4316
-
\??\c:\u622284.exec:\u622284.exe68⤵PID:2140
-
\??\c:\rllxrlf.exec:\rllxrlf.exe69⤵PID:2012
-
\??\c:\620408.exec:\620408.exe70⤵PID:460
-
\??\c:\dvpdv.exec:\dvpdv.exe71⤵PID:3872
-
\??\c:\006864.exec:\006864.exe72⤵PID:1716
-
\??\c:\ddvjp.exec:\ddvjp.exe73⤵PID:1136
-
\??\c:\fxxllrl.exec:\fxxllrl.exe74⤵PID:4872
-
\??\c:\jppdv.exec:\jppdv.exe75⤵PID:4676
-
\??\c:\468828.exec:\468828.exe76⤵PID:3076
-
\??\c:\5ffxfxx.exec:\5ffxfxx.exe77⤵PID:2752
-
\??\c:\4026482.exec:\4026482.exe78⤵PID:1308
-
\??\c:\5bbtbn.exec:\5bbtbn.exe79⤵PID:1744
-
\??\c:\1fxfxrr.exec:\1fxfxrr.exe80⤵PID:4968
-
\??\c:\xxxlrxr.exec:\xxxlrxr.exe81⤵PID:2108
-
\??\c:\tbbttn.exec:\tbbttn.exe82⤵PID:1424
-
\??\c:\pvdvp.exec:\pvdvp.exe83⤵PID:3908
-
\??\c:\060224.exec:\060224.exe84⤵PID:2360
-
\??\c:\e06604.exec:\e06604.exe85⤵PID:1640
-
\??\c:\840088.exec:\840088.exe86⤵PID:2804
-
\??\c:\62044.exec:\62044.exe87⤵PID:444
-
\??\c:\4624800.exec:\4624800.exe88⤵PID:1052
-
\??\c:\fxlfrlr.exec:\fxlfrlr.exe89⤵PID:3332
-
\??\c:\06604.exec:\06604.exe90⤵PID:3236
-
\??\c:\604020.exec:\604020.exe91⤵PID:2988
-
\??\c:\0264062.exec:\0264062.exe92⤵PID:3988
-
\??\c:\4840224.exec:\4840224.exe93⤵PID:4380
-
\??\c:\xlfrlfl.exec:\xlfrlfl.exe94⤵PID:1528
-
\??\c:\2082226.exec:\2082226.exe95⤵PID:4652
-
\??\c:\xlxrrrl.exec:\xlxrrrl.exe96⤵PID:4316
-
\??\c:\60626.exec:\60626.exe97⤵PID:2280
-
\??\c:\lflrrlr.exec:\lflrrlr.exe98⤵PID:2528
-
\??\c:\ffxxrxx.exec:\ffxxrxx.exe99⤵PID:460
-
\??\c:\2266448.exec:\2266448.exe100⤵PID:1584
-
\??\c:\dvdvp.exec:\dvdvp.exe101⤵PID:2992
-
\??\c:\8220460.exec:\8220460.exe102⤵PID:1136
-
\??\c:\fxrlffx.exec:\fxrlffx.exe103⤵PID:4476
-
\??\c:\xxfxrxx.exec:\xxfxrxx.exe104⤵PID:516
-
\??\c:\060482.exec:\060482.exe105⤵PID:3052
-
\??\c:\btbbhb.exec:\btbbhb.exe106⤵PID:1308
-
\??\c:\jjvdd.exec:\jjvdd.exe107⤵PID:1744
-
\??\c:\llrffrr.exec:\llrffrr.exe108⤵PID:3228
-
\??\c:\jjdpd.exec:\jjdpd.exe109⤵PID:4688
-
\??\c:\frxrrlf.exec:\frxrrlf.exe110⤵PID:4092
-
\??\c:\hbthbb.exec:\hbthbb.exe111⤵PID:3268
-
\??\c:\bhbbbb.exec:\bhbbbb.exe112⤵PID:2980
-
\??\c:\40406.exec:\40406.exe113⤵PID:2736
-
\??\c:\pvvjj.exec:\pvvjj.exe114⤵PID:2072
-
\??\c:\84482.exec:\84482.exe115⤵PID:4556
-
\??\c:\rxfrlrr.exec:\rxfrlrr.exe116⤵PID:4364
-
\??\c:\3ntbbh.exec:\3ntbbh.exe117⤵PID:4292
-
\??\c:\0626604.exec:\0626604.exe118⤵PID:4464
-
\??\c:\248200.exec:\248200.exe119⤵PID:868
-
\??\c:\xrffllf.exec:\xrffllf.exe120⤵PID:3168
-
\??\c:\028268.exec:\028268.exe121⤵PID:3032
-
\??\c:\9llfxfx.exec:\9llfxfx.exe122⤵PID:1020
-
\??\c:\rxffxxx.exec:\rxffxxx.exe123⤵PID:1528
-
\??\c:\bhbnbn.exec:\bhbnbn.exe124⤵PID:4468
-
\??\c:\8404404.exec:\8404404.exe125⤵PID:4316
-
\??\c:\tbtnhb.exec:\tbtnhb.exe126⤵PID:2280
-
\??\c:\nhbttt.exec:\nhbttt.exe127⤵PID:4796
-
\??\c:\600444.exec:\600444.exe128⤵PID:3160
-
\??\c:\466622.exec:\466622.exe129⤵PID:2016
-
\??\c:\xfxllfl.exec:\xfxllfl.exe130⤵PID:2052
-
\??\c:\hbbttn.exec:\hbbttn.exe131⤵PID:5028
-
\??\c:\22268.exec:\22268.exe132⤵PID:2284
-
\??\c:\6646660.exec:\6646660.exe133⤵PID:4872
-
\??\c:\hbbtbt.exec:\hbbtbt.exe134⤵PID:3060
-
\??\c:\vdvpj.exec:\vdvpj.exe135⤵PID:3264
-
\??\c:\s6888.exec:\s6888.exe136⤵PID:4180
-
\??\c:\28482.exec:\28482.exe137⤵PID:3836
-
\??\c:\424808.exec:\424808.exe138⤵PID:3412
-
\??\c:\a2204.exec:\a2204.exe139⤵PID:4792
-
\??\c:\dvdjp.exec:\dvdjp.exe140⤵PID:4188
-
\??\c:\406600.exec:\406600.exe141⤵PID:3352
-
\??\c:\22660.exec:\22660.exe142⤵PID:3700
-
\??\c:\a6644.exec:\a6644.exe143⤵PID:3664
-
\??\c:\nhbtnh.exec:\nhbtnh.exe144⤵PID:5068
-
\??\c:\fllrxlr.exec:\fllrxlr.exe145⤵PID:2832
-
\??\c:\bhnbhn.exec:\bhnbhn.exe146⤵PID:852
-
\??\c:\xlrrffl.exec:\xlrrffl.exe147⤵PID:3020
-
\??\c:\64264.exec:\64264.exe148⤵PID:4520
-
\??\c:\468260.exec:\468260.exe149⤵PID:5040
-
\??\c:\bttttt.exec:\bttttt.exe150⤵PID:2856
-
\??\c:\ntnnnb.exec:\ntnnnb.exe151⤵PID:1580
-
\??\c:\bhhbtt.exec:\bhhbtt.exe152⤵PID:3012
-
\??\c:\5llffxr.exec:\5llffxr.exe153⤵PID:2988
-
\??\c:\84660.exec:\84660.exe154⤵PID:868
-
\??\c:\dddjp.exec:\dddjp.exe155⤵PID:2024
-
\??\c:\htbtnh.exec:\htbtnh.exe156⤵PID:3824
-
\??\c:\httbnt.exec:\httbnt.exe157⤵PID:3340
-
\??\c:\6464040.exec:\6464040.exe158⤵PID:2248
-
\??\c:\0448826.exec:\0448826.exe159⤵PID:2140
-
\??\c:\dpvdv.exec:\dpvdv.exe160⤵PID:980
-
\??\c:\86826.exec:\86826.exe161⤵PID:2144
-
\??\c:\thtbtt.exec:\thtbtt.exe162⤵PID:1716
-
\??\c:\02260.exec:\02260.exe163⤵PID:4796
-
\??\c:\2684844.exec:\2684844.exe164⤵PID:3160
-
\??\c:\6282688.exec:\6282688.exe165⤵PID:4456
-
\??\c:\622064.exec:\622064.exe166⤵PID:2052
-
\??\c:\tbbnhh.exec:\tbbnhh.exe167⤵PID:1556
-
\??\c:\s6848.exec:\s6848.exe168⤵PID:2284
-
\??\c:\04882.exec:\04882.exe169⤵PID:2752
-
\??\c:\08044.exec:\08044.exe170⤵PID:452
-
\??\c:\dpvpj.exec:\dpvpj.exe171⤵PID:4340
-
\??\c:\6008442.exec:\6008442.exe172⤵PID:4900
-
\??\c:\fxfflfl.exec:\fxfflfl.exe173⤵PID:3484
-
\??\c:\e62660.exec:\e62660.exe174⤵PID:3128
-
\??\c:\04200.exec:\04200.exe175⤵PID:1092
-
\??\c:\c264600.exec:\c264600.exe176⤵PID:1768
-
\??\c:\9bnhhb.exec:\9bnhhb.exe177⤵PID:4188
-
\??\c:\20204.exec:\20204.exe178⤵PID:3352
-
\??\c:\rxxfxfx.exec:\rxxfxfx.exe179⤵PID:4668
-
\??\c:\46600.exec:\46600.exe180⤵PID:3984
-
\??\c:\8460482.exec:\8460482.exe181⤵PID:4576
-
\??\c:\26648.exec:\26648.exe182⤵PID:2416
-
\??\c:\djdvp.exec:\djdvp.exe183⤵PID:2736
-
\??\c:\48484.exec:\48484.exe184⤵PID:4256
-
\??\c:\o840448.exec:\o840448.exe185⤵PID:4556
-
\??\c:\pdjdp.exec:\pdjdp.exe186⤵PID:332
-
\??\c:\9ntthb.exec:\9ntthb.exe187⤵PID:4364
-
\??\c:\68024.exec:\68024.exe188⤵PID:184
-
\??\c:\7rfxllf.exec:\7rfxllf.exe189⤵PID:1804
-
\??\c:\2662000.exec:\2662000.exe190⤵PID:4332
-
\??\c:\1nhbtt.exec:\1nhbtt.exe191⤵PID:3632
-
\??\c:\frfrlfr.exec:\frfrlfr.exe192⤵PID:3168
-
\??\c:\pvjpv.exec:\pvjpv.exe193⤵PID:3440
-
\??\c:\thhbtt.exec:\thhbtt.exe194⤵PID:848
-
\??\c:\tbthtn.exec:\tbthtn.exe195⤵PID:2012
-
\??\c:\thhbtt.exec:\thhbtt.exe196⤵PID:2600
-
\??\c:\btbtnh.exec:\btbtnh.exe197⤵PID:4800
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe198⤵PID:3792
-
\??\c:\bhttbn.exec:\bhttbn.exe199⤵PID:4544
-
\??\c:\rflfrrl.exec:\rflfrrl.exe200⤵PID:2232
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe201⤵PID:540
-
\??\c:\24448.exec:\24448.exe202⤵PID:408
-
\??\c:\jddvp.exec:\jddvp.exe203⤵PID:2976
-
\??\c:\000804.exec:\000804.exe204⤵PID:4676
-
\??\c:\vddvp.exec:\vddvp.exe205⤵PID:1160
-
\??\c:\0882048.exec:\0882048.exe206⤵PID:4488
-
\??\c:\jjdvp.exec:\jjdvp.exe207⤵PID:4912
-
\??\c:\i606666.exec:\i606666.exe208⤵PID:4360
-
\??\c:\ttbtnn.exec:\ttbtnn.exe209⤵PID:3172
-
\??\c:\thtnhh.exec:\thtnhh.exe210⤵PID:4040
-
\??\c:\jvpjd.exec:\jvpjd.exe211⤵PID:3492
-
\??\c:\tnnbbt.exec:\tnnbbt.exe212⤵PID:4988
-
\??\c:\0488822.exec:\0488822.exe213⤵PID:3268
-
\??\c:\8286602.exec:\8286602.exe214⤵PID:3116
-
\??\c:\2644884.exec:\2644884.exe215⤵PID:1840
-
\??\c:\424824.exec:\424824.exe216⤵PID:372
-
\??\c:\6626448.exec:\6626448.exe217⤵PID:2716
-
\??\c:\0848404.exec:\0848404.exe218⤵PID:1788
-
\??\c:\68482.exec:\68482.exe219⤵PID:4312
-
\??\c:\462848.exec:\462848.exe220⤵PID:2412
-
\??\c:\066044.exec:\066044.exe221⤵PID:4364
-
\??\c:\lrfxrlf.exec:\lrfxrlf.exe222⤵PID:2772
-
\??\c:\26600.exec:\26600.exe223⤵PID:1284
-
\??\c:\ddpjd.exec:\ddpjd.exe224⤵PID:4332
-
\??\c:\8880426.exec:\8880426.exe225⤵PID:3452
-
\??\c:\nnnbhh.exec:\nnnbhh.exe226⤵PID:1020
-
\??\c:\3rrlxxl.exec:\3rrlxxl.exe227⤵PID:4708
-
\??\c:\26826.exec:\26826.exe228⤵PID:3732
-
\??\c:\6682828.exec:\6682828.exe229⤵PID:2012
-
\??\c:\7fxrlxl.exec:\7fxrlxl.exe230⤵PID:1620
-
\??\c:\4820884.exec:\4820884.exe231⤵PID:460
-
\??\c:\1pjdp.exec:\1pjdp.exe232⤵PID:3648
-
\??\c:\thtbbb.exec:\thtbbb.exe233⤵PID:4544
-
\??\c:\2868882.exec:\2868882.exe234⤵PID:2232
-
\??\c:\jjppd.exec:\jjppd.exe235⤵PID:2844
-
\??\c:\8048282.exec:\8048282.exe236⤵PID:408
-
\??\c:\q06604.exec:\q06604.exe237⤵PID:4388
-
\??\c:\20048.exec:\20048.exe238⤵PID:4676
-
\??\c:\268448.exec:\268448.exe239⤵PID:2788
-
\??\c:\vdvpv.exec:\vdvpv.exe240⤵PID:5060
-
\??\c:\840004.exec:\840004.exe241⤵PID:4304
-
\??\c:\240222.exec:\240222.exe242⤵PID:1028