Analysis
-
max time kernel
149s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 20:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
00d7389dd9b77d3d9e312d2bef23c118bc0a48e96a1021edea4c6b9936aad852.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
00d7389dd9b77d3d9e312d2bef23c118bc0a48e96a1021edea4c6b9936aad852.exe
-
Size
81KB
-
MD5
f6cd42cc135918e8e9426d15822fd560
-
SHA1
93296eb05d4846f4ec12747a72e039bd5ea670c4
-
SHA256
00d7389dd9b77d3d9e312d2bef23c118bc0a48e96a1021edea4c6b9936aad852
-
SHA512
c1c8263ffbda854e0b4ac841192fbfca9ff59562cde58cdeb70069aa0c8af681db9300a33b441ae54c9a39bf54844f74e70317f985bca21cc2aa26d72ce22164
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7xCkTsIwtOa2dYS8nj+:ymb3NkkiQ3mdBjFo7LAIbT6j+
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/1400-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-64-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2668-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1364-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1400 hbbnnt.exe 2024 jpddj.exe 2004 1ddvv.exe 4012 lrxlffx.exe 2436 hnbbtn.exe 2668 bhtnbb.exe 324 vjjjd.exe 1952 1dvvp.exe 4316 rflrflf.exe 3032 nhhbhh.exe 3580 5tnbnh.exe 3428 jjdvj.exe 1460 lfxrfxx.exe 3468 xxlfxxr.exe 640 hbhhnh.exe 4540 5jpjv.exe 4612 pjvjd.exe 2352 rfxlxrl.exe 868 bthhtt.exe 3716 djjjd.exe 2116 lrxrlll.exe 1364 rlfxrlf.exe 888 7hhhhh.exe 3752 vjjjd.exe 1212 jdpjj.exe 1624 3xlfxfx.exe 3852 xffxxrl.exe 2476 ntthhn.exe 4032 bttnbb.exe 3696 jvvjd.exe 3584 xrrfxrl.exe 1500 xfffffx.exe 4188 thttbt.exe 4988 dddvv.exe 3068 jjppv.exe 3212 lffrrrl.exe 4224 rflfllr.exe 2820 bbhhbt.exe 3756 nbnbhh.exe 4560 dvpdj.exe 1548 vpjdv.exe 2796 1xxfrxr.exe 1792 1btnbt.exe 320 bbhnhb.exe 672 jdpjp.exe 1716 vjjvj.exe 2684 xflflrl.exe 4724 hnhbnn.exe 3680 3ddvv.exe 4992 jvpjv.exe 4444 7rxrrll.exe 2416 lrfxfxl.exe 3648 tnntht.exe 744 7hhbnn.exe 4704 hhnntt.exe 640 jjddp.exe 3300 9ddpd.exe 2680 xxrfrrf.exe 1064 tthhtt.exe 2352 thbnhh.exe 972 jvvdv.exe 868 fllxrlr.exe 4676 fffrxrl.exe 1856 jddpd.exe -
resource yara_rule behavioral2/memory/1400-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1364-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3584-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4044 wrote to memory of 1400 4044 00d7389dd9b77d3d9e312d2bef23c118bc0a48e96a1021edea4c6b9936aad852.exe 82 PID 4044 wrote to memory of 1400 4044 00d7389dd9b77d3d9e312d2bef23c118bc0a48e96a1021edea4c6b9936aad852.exe 82 PID 4044 wrote to memory of 1400 4044 00d7389dd9b77d3d9e312d2bef23c118bc0a48e96a1021edea4c6b9936aad852.exe 82 PID 1400 wrote to memory of 2024 1400 hbbnnt.exe 83 PID 1400 wrote to memory of 2024 1400 hbbnnt.exe 83 PID 1400 wrote to memory of 2024 1400 hbbnnt.exe 83 PID 2024 wrote to memory of 2004 2024 jpddj.exe 84 PID 2024 wrote to memory of 2004 2024 jpddj.exe 84 PID 2024 wrote to memory of 2004 2024 jpddj.exe 84 PID 2004 wrote to memory of 4012 2004 1ddvv.exe 85 PID 2004 wrote to memory of 4012 2004 1ddvv.exe 85 PID 2004 wrote to memory of 4012 2004 1ddvv.exe 85 PID 4012 wrote to memory of 2436 4012 lrxlffx.exe 88 PID 4012 wrote to memory of 2436 4012 lrxlffx.exe 88 PID 4012 wrote to memory of 2436 4012 lrxlffx.exe 88 PID 2436 wrote to memory of 2668 2436 hnbbtn.exe 89 PID 2436 wrote to memory of 2668 2436 hnbbtn.exe 89 PID 2436 wrote to memory of 2668 2436 hnbbtn.exe 89 PID 2668 wrote to memory of 324 2668 bhtnbb.exe 90 PID 2668 wrote to memory of 324 2668 bhtnbb.exe 90 PID 2668 wrote to memory of 324 2668 bhtnbb.exe 90 PID 324 wrote to memory of 1952 324 vjjjd.exe 91 PID 324 wrote to memory of 1952 324 vjjjd.exe 91 PID 324 wrote to memory of 1952 324 vjjjd.exe 91 PID 1952 wrote to memory of 4316 1952 1dvvp.exe 92 PID 1952 wrote to memory of 4316 1952 1dvvp.exe 92 PID 1952 wrote to memory of 4316 1952 1dvvp.exe 92 PID 4316 wrote to memory of 3032 4316 rflrflf.exe 93 PID 4316 wrote to memory of 3032 4316 rflrflf.exe 93 PID 4316 wrote to memory of 3032 4316 rflrflf.exe 93 PID 3032 wrote to memory of 3580 3032 nhhbhh.exe 94 PID 3032 wrote to memory of 3580 3032 nhhbhh.exe 94 PID 3032 wrote to memory of 3580 3032 nhhbhh.exe 94 PID 3580 wrote to memory of 3428 3580 5tnbnh.exe 95 PID 3580 wrote to memory of 3428 3580 5tnbnh.exe 95 PID 3580 wrote to memory of 3428 3580 5tnbnh.exe 95 PID 3428 wrote to memory of 1460 3428 jjdvj.exe 96 PID 3428 wrote to memory of 1460 3428 jjdvj.exe 96 PID 3428 wrote to memory of 1460 3428 jjdvj.exe 96 PID 1460 wrote to memory of 3468 1460 lfxrfxx.exe 97 PID 1460 wrote to memory of 3468 1460 lfxrfxx.exe 97 PID 1460 wrote to memory of 3468 1460 lfxrfxx.exe 97 PID 3468 wrote to memory of 640 3468 xxlfxxr.exe 98 PID 3468 wrote to memory of 640 3468 xxlfxxr.exe 98 PID 3468 wrote to memory of 640 3468 xxlfxxr.exe 98 PID 640 wrote to memory of 4540 640 hbhhnh.exe 99 PID 640 wrote to memory of 4540 640 hbhhnh.exe 99 PID 640 wrote to memory of 4540 640 hbhhnh.exe 99 PID 4540 wrote to memory of 4612 4540 5jpjv.exe 100 PID 4540 wrote to memory of 4612 4540 5jpjv.exe 100 PID 4540 wrote to memory of 4612 4540 5jpjv.exe 100 PID 4612 wrote to memory of 2352 4612 pjvjd.exe 101 PID 4612 wrote to memory of 2352 4612 pjvjd.exe 101 PID 4612 wrote to memory of 2352 4612 pjvjd.exe 101 PID 2352 wrote to memory of 868 2352 rfxlxrl.exe 102 PID 2352 wrote to memory of 868 2352 rfxlxrl.exe 102 PID 2352 wrote to memory of 868 2352 rfxlxrl.exe 102 PID 868 wrote to memory of 3716 868 bthhtt.exe 103 PID 868 wrote to memory of 3716 868 bthhtt.exe 103 PID 868 wrote to memory of 3716 868 bthhtt.exe 103 PID 3716 wrote to memory of 2116 3716 djjjd.exe 104 PID 3716 wrote to memory of 2116 3716 djjjd.exe 104 PID 3716 wrote to memory of 2116 3716 djjjd.exe 104 PID 2116 wrote to memory of 1364 2116 lrxrlll.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\00d7389dd9b77d3d9e312d2bef23c118bc0a48e96a1021edea4c6b9936aad852.exe"C:\Users\Admin\AppData\Local\Temp\00d7389dd9b77d3d9e312d2bef23c118bc0a48e96a1021edea4c6b9936aad852.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\hbbnnt.exec:\hbbnnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\jpddj.exec:\jpddj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\1ddvv.exec:\1ddvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\lrxlffx.exec:\lrxlffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\hnbbtn.exec:\hnbbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\bhtnbb.exec:\bhtnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\vjjjd.exec:\vjjjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\1dvvp.exec:\1dvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\rflrflf.exec:\rflrflf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\nhhbhh.exec:\nhhbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\5tnbnh.exec:\5tnbnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\jjdvj.exec:\jjdvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\lfxrfxx.exec:\lfxrfxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\xxlfxxr.exec:\xxlfxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\hbhhnh.exec:\hbhhnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\5jpjv.exec:\5jpjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\pjvjd.exec:\pjvjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\rfxlxrl.exec:\rfxlxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\bthhtt.exec:\bthhtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\djjjd.exec:\djjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\lrxrlll.exec:\lrxrlll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe23⤵
- Executes dropped EXE
PID:1364 -
\??\c:\7hhhhh.exec:\7hhhhh.exe24⤵
- Executes dropped EXE
PID:888 -
\??\c:\vjjjd.exec:\vjjjd.exe25⤵
- Executes dropped EXE
PID:3752 -
\??\c:\jdpjj.exec:\jdpjj.exe26⤵
- Executes dropped EXE
PID:1212 -
\??\c:\3xlfxfx.exec:\3xlfxfx.exe27⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xffxxrl.exec:\xffxxrl.exe28⤵
- Executes dropped EXE
PID:3852 -
\??\c:\ntthhn.exec:\ntthhn.exe29⤵
- Executes dropped EXE
PID:2476 -
\??\c:\bttnbb.exec:\bttnbb.exe30⤵
- Executes dropped EXE
PID:4032 -
\??\c:\jvvjd.exec:\jvvjd.exe31⤵
- Executes dropped EXE
PID:3696 -
\??\c:\xrrfxrl.exec:\xrrfxrl.exe32⤵
- Executes dropped EXE
PID:3584 -
\??\c:\xfffffx.exec:\xfffffx.exe33⤵
- Executes dropped EXE
PID:1500 -
\??\c:\thttbt.exec:\thttbt.exe34⤵
- Executes dropped EXE
PID:4188 -
\??\c:\dddvv.exec:\dddvv.exe35⤵
- Executes dropped EXE
PID:4988 -
\??\c:\jjppv.exec:\jjppv.exe36⤵
- Executes dropped EXE
PID:3068 -
\??\c:\lffrrrl.exec:\lffrrrl.exe37⤵
- Executes dropped EXE
PID:3212 -
\??\c:\rflfllr.exec:\rflfllr.exe38⤵
- Executes dropped EXE
PID:4224 -
\??\c:\bbhhbt.exec:\bbhhbt.exe39⤵
- Executes dropped EXE
PID:2820 -
\??\c:\nbnbhh.exec:\nbnbhh.exe40⤵
- Executes dropped EXE
PID:3756 -
\??\c:\dvpdj.exec:\dvpdj.exe41⤵
- Executes dropped EXE
PID:4560 -
\??\c:\vpjdv.exec:\vpjdv.exe42⤵
- Executes dropped EXE
PID:1548 -
\??\c:\1xxfrxr.exec:\1xxfrxr.exe43⤵
- Executes dropped EXE
PID:2796 -
\??\c:\1btnbt.exec:\1btnbt.exe44⤵
- Executes dropped EXE
PID:1792 -
\??\c:\bbhnhb.exec:\bbhnhb.exe45⤵
- Executes dropped EXE
PID:320 -
\??\c:\jdpjp.exec:\jdpjp.exe46⤵
- Executes dropped EXE
PID:672 -
\??\c:\vjjvj.exec:\vjjvj.exe47⤵
- Executes dropped EXE
PID:1716 -
\??\c:\xflflrl.exec:\xflflrl.exe48⤵
- Executes dropped EXE
PID:2684 -
\??\c:\hnhbnn.exec:\hnhbnn.exe49⤵
- Executes dropped EXE
PID:4724 -
\??\c:\3ddvv.exec:\3ddvv.exe50⤵
- Executes dropped EXE
PID:3680 -
\??\c:\jvpjv.exec:\jvpjv.exe51⤵
- Executes dropped EXE
PID:4992 -
\??\c:\7rxrrll.exec:\7rxrrll.exe52⤵
- Executes dropped EXE
PID:4444 -
\??\c:\lrfxfxl.exec:\lrfxfxl.exe53⤵
- Executes dropped EXE
PID:2416 -
\??\c:\tnntht.exec:\tnntht.exe54⤵
- Executes dropped EXE
PID:3648 -
\??\c:\7hhbnn.exec:\7hhbnn.exe55⤵
- Executes dropped EXE
PID:744 -
\??\c:\hhnntt.exec:\hhnntt.exe56⤵
- Executes dropped EXE
PID:4704 -
\??\c:\jjddp.exec:\jjddp.exe57⤵
- Executes dropped EXE
PID:640 -
\??\c:\9ddpd.exec:\9ddpd.exe58⤵
- Executes dropped EXE
PID:3300 -
\??\c:\xxrfrrf.exec:\xxrfrrf.exe59⤵
- Executes dropped EXE
PID:2680 -
\??\c:\tthhtt.exec:\tthhtt.exe60⤵
- Executes dropped EXE
PID:1064 -
\??\c:\thbnhh.exec:\thbnhh.exe61⤵
- Executes dropped EXE
PID:2352 -
\??\c:\jvvdv.exec:\jvvdv.exe62⤵
- Executes dropped EXE
PID:972 -
\??\c:\fllxrlr.exec:\fllxrlr.exe63⤵
- Executes dropped EXE
PID:868 -
\??\c:\fffrxrl.exec:\fffrxrl.exe64⤵
- Executes dropped EXE
PID:4676 -
\??\c:\jddpd.exec:\jddpd.exe65⤵
- Executes dropped EXE
PID:1856 -
\??\c:\xllfxxr.exec:\xllfxxr.exe66⤵PID:4276
-
\??\c:\lrxxrxr.exec:\lrxxrxr.exe67⤵PID:1164
-
\??\c:\tbbtnh.exec:\tbbtnh.exe68⤵PID:3288
-
\??\c:\htbbnn.exec:\htbbnn.exe69⤵PID:1700
-
\??\c:\jdpjp.exec:\jdpjp.exe70⤵PID:5068
-
\??\c:\dpvpd.exec:\dpvpd.exe71⤵PID:2296
-
\??\c:\lfrlrrf.exec:\lfrlrrf.exe72⤵PID:4144
-
\??\c:\lfrffxf.exec:\lfrffxf.exe73⤵PID:1020
-
\??\c:\tnhhbb.exec:\tnhhbb.exe74⤵PID:1692
-
\??\c:\ntbthh.exec:\ntbthh.exe75⤵PID:3028
-
\??\c:\9tnhtt.exec:\9tnhtt.exe76⤵PID:3696
-
\??\c:\vjvjv.exec:\vjvjv.exe77⤵PID:1088
-
\??\c:\lxrrlfx.exec:\lxrrlfx.exe78⤵PID:4912
-
\??\c:\lfrllxf.exec:\lfrllxf.exe79⤵PID:2268
-
\??\c:\lrfllfx.exec:\lrfllfx.exe80⤵PID:4608
-
\??\c:\hnntnn.exec:\hnntnn.exe81⤵PID:8
-
\??\c:\jpdpd.exec:\jpdpd.exe82⤵PID:2496
-
\??\c:\vpvjv.exec:\vpvjv.exe83⤵PID:4456
-
\??\c:\pppdv.exec:\pppdv.exe84⤵PID:4496
-
\??\c:\xxxrxxf.exec:\xxxrxxf.exe85⤵PID:2892
-
\??\c:\3nbhbh.exec:\3nbhbh.exe86⤵PID:388
-
\??\c:\bbbtnh.exec:\bbbtnh.exe87⤵PID:2272
-
\??\c:\jvdvp.exec:\jvdvp.exe88⤵PID:2308
-
\??\c:\rlflfxx.exec:\rlflfxx.exe89⤵PID:1828
-
\??\c:\tbbbhn.exec:\tbbbhn.exe90⤵PID:1036
-
\??\c:\7djdv.exec:\7djdv.exe91⤵PID:624
-
\??\c:\lxlrllr.exec:\lxlrllr.exe92⤵PID:4620
-
\??\c:\3ttbth.exec:\3ttbth.exe93⤵PID:1344
-
\??\c:\tnbtnb.exec:\tnbtnb.exe94⤵PID:1952
-
\??\c:\vvdpj.exec:\vvdpj.exe95⤵PID:4200
-
\??\c:\3xfxrrl.exec:\3xfxrrl.exe96⤵PID:1068
-
\??\c:\tnbbhh.exec:\tnbbhh.exe97⤵PID:820
-
\??\c:\tbbbnn.exec:\tbbbnn.exe98⤵PID:2856
-
\??\c:\9jvpv.exec:\9jvpv.exe99⤵PID:748
-
\??\c:\dpjjd.exec:\dpjjd.exe100⤵PID:548
-
\??\c:\rflffff.exec:\rflffff.exe101⤵PID:1820
-
\??\c:\hnbbth.exec:\hnbbth.exe102⤵PID:3468
-
\??\c:\vvpdp.exec:\vvpdp.exe103⤵PID:1580
-
\??\c:\jdvjv.exec:\jdvjv.exe104⤵PID:4540
-
\??\c:\fxlfxrf.exec:\fxlfxrf.exe105⤵PID:4844
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe106⤵PID:4788
-
\??\c:\3bbttn.exec:\3bbttn.exe107⤵PID:4040
-
\??\c:\htnhbt.exec:\htnhbt.exe108⤵PID:2592
-
\??\c:\vpdpp.exec:\vpdpp.exe109⤵PID:4152
-
\??\c:\xfxffxx.exec:\xfxffxx.exe110⤵PID:4024
-
\??\c:\llrllrr.exec:\llrllrr.exe111⤵PID:2804
-
\??\c:\5bbbtt.exec:\5bbbtt.exe112⤵PID:1364
-
\??\c:\pddpd.exec:\pddpd.exe113⤵PID:372
-
\??\c:\7jdvj.exec:\7jdvj.exe114⤵PID:2356
-
\??\c:\5rxrrxr.exec:\5rxrrxr.exe115⤵PID:1892
-
\??\c:\rxflfxr.exec:\rxflfxr.exe116⤵PID:3924
-
\??\c:\bttnnn.exec:\bttnnn.exe117⤵PID:1604
-
\??\c:\bbthht.exec:\bbthht.exe118⤵PID:4960
-
\??\c:\ppppp.exec:\ppppp.exe119⤵PID:1208
-
\??\c:\fflffxf.exec:\fflffxf.exe120⤵PID:1280
-
\??\c:\3flfrrl.exec:\3flfrrl.exe121⤵PID:2732
-
\??\c:\ntthhb.exec:\ntthhb.exe122⤵PID:3516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-