Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 19:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
009ca363c0905fc9c567c1f327805d4988a69063b3770efad233e1539d0c4faa.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
009ca363c0905fc9c567c1f327805d4988a69063b3770efad233e1539d0c4faa.exe
-
Size
840KB
-
MD5
0b3d6a376b87373f2afb5ac413977c10
-
SHA1
948230a7fa431c31c1052811cb6c2c154aff88ad
-
SHA256
009ca363c0905fc9c567c1f327805d4988a69063b3770efad233e1539d0c4faa
-
SHA512
382331618d2e9e1e74f004789d95ffaf652e1fa40c289445d564c7883c397264bee979508f90ed6fde3104951a8f2cd8b33b5e82ed90c42b7b61df6808f02b40
-
SSDEEP
24576:Sgdn8whSenedn8whhdn76gdn8whSfgdn8whSzm:TFyVPfz
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral2/memory/1792-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/948-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3932-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/424-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1xlfrlx.exennnbtn.exerrxxrlf.exepvpdp.exetnbtbn.exerxxrxxf.exedvdpj.exelffxrrl.exerrfxxff.exe3dvpj.exepjjdd.exehthhbb.exedppjv.exelrrfxxx.exetnnhbb.exedjdvv.exefffxrll.exehhnnbb.exethhbtt.exevjjdp.exehnnhnh.exejvjjj.exenhnbbb.exehbhhnn.exehbbtnn.exevvjpj.exelxfrllf.exehtbtnh.exelrfxxxx.exevjvvd.exeffrflrf.exevpjdv.exerffrfff.exenhbtnh.exelllfxrl.exetbhhhh.exejpjvj.exelxxrlll.exeththbt.exevpjdd.exeddvpj.exexflfxrl.exebntttn.exejpvvv.exexfllfff.exebttnbn.exe9ddvd.exe5flffxx.exe3thbtt.exevdjpv.exexllxrrr.exenhtttt.exejvpjv.exevvppj.exethnhhh.exejppjj.exe7lrllll.exe7hhbhn.exetbbtbt.exe9vjdj.exefxxrlff.exedvjjv.exerxffxxf.exexlrlffx.exepid process 2316 1xlfrlx.exe 4688 nnnbtn.exe 948 rrxxrlf.exe 2412 pvpdp.exe 2756 tnbtbn.exe 624 rxxrxxf.exe 5092 dvdpj.exe 1108 lffxrrl.exe 3280 rrfxxff.exe 4796 3dvpj.exe 864 pjjdd.exe 2284 hthhbb.exe 3932 dppjv.exe 4804 lrrfxxx.exe 2096 tnnhbb.exe 4752 djdvv.exe 3416 fffxrll.exe 972 hhnnbb.exe 3944 thhbtt.exe 2164 vjjdp.exe 4420 hnnhnh.exe 1512 jvjjj.exe 3668 nhnbbb.exe 4344 hbhhnn.exe 3256 hbbtnn.exe 3572 vvjpj.exe 3596 lxfrllf.exe 3016 htbtnh.exe 424 lrfxxxx.exe 1284 vjvvd.exe 760 ffrflrf.exe 1704 vpjdv.exe 3592 rffrfff.exe 4508 nhbtnh.exe 2708 lllfxrl.exe 1008 tbhhhh.exe 4880 jpjvj.exe 3036 lxxrlll.exe 3716 ththbt.exe 1500 vpjdd.exe 4872 ddvpj.exe 2664 xflfxrl.exe 400 bntttn.exe 2172 jpvvv.exe 2068 xfllfff.exe 2384 bttnbn.exe 5096 9ddvd.exe 4216 5flffxx.exe 3756 3thbtt.exe 3264 vdjpv.exe 4572 xllxrrr.exe 4684 nhtttt.exe 4728 jvpjv.exe 4820 vvppj.exe 1612 thnhhh.exe 4252 jppjj.exe 2396 7lrllll.exe 4268 7hhbhn.exe 2856 tbbtbt.exe 3096 9vjdj.exe 2644 fxxrlff.exe 3692 dvjjv.exe 4420 rxffxxf.exe 3032 xlrlffx.exe -
Processes:
resource yara_rule behavioral2/memory/1792-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/948-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3932-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/424-191-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
009ca363c0905fc9c567c1f327805d4988a69063b3770efad233e1539d0c4faa.exe1xlfrlx.exennnbtn.exerrxxrlf.exepvpdp.exetnbtbn.exerxxrxxf.exedvdpj.exelffxrrl.exerrfxxff.exe3dvpj.exepjjdd.exehthhbb.exedppjv.exelrrfxxx.exetnnhbb.exedjdvv.exefffxrll.exehhnnbb.exethhbtt.exevjjdp.exehnnhnh.exedescription pid process target process PID 1792 wrote to memory of 2316 1792 009ca363c0905fc9c567c1f327805d4988a69063b3770efad233e1539d0c4faa.exe 1xlfrlx.exe PID 1792 wrote to memory of 2316 1792 009ca363c0905fc9c567c1f327805d4988a69063b3770efad233e1539d0c4faa.exe 1xlfrlx.exe PID 1792 wrote to memory of 2316 1792 009ca363c0905fc9c567c1f327805d4988a69063b3770efad233e1539d0c4faa.exe 1xlfrlx.exe PID 2316 wrote to memory of 4688 2316 1xlfrlx.exe nnnbtn.exe PID 2316 wrote to memory of 4688 2316 1xlfrlx.exe nnnbtn.exe PID 2316 wrote to memory of 4688 2316 1xlfrlx.exe nnnbtn.exe PID 4688 wrote to memory of 948 4688 nnnbtn.exe rrxxrlf.exe PID 4688 wrote to memory of 948 4688 nnnbtn.exe rrxxrlf.exe PID 4688 wrote to memory of 948 4688 nnnbtn.exe rrxxrlf.exe PID 948 wrote to memory of 2412 948 rrxxrlf.exe pvpdp.exe PID 948 wrote to memory of 2412 948 rrxxrlf.exe pvpdp.exe PID 948 wrote to memory of 2412 948 rrxxrlf.exe pvpdp.exe PID 2412 wrote to memory of 2756 2412 pvpdp.exe tnbtbn.exe PID 2412 wrote to memory of 2756 2412 pvpdp.exe tnbtbn.exe PID 2412 wrote to memory of 2756 2412 pvpdp.exe tnbtbn.exe PID 2756 wrote to memory of 624 2756 tnbtbn.exe rxxrxxf.exe PID 2756 wrote to memory of 624 2756 tnbtbn.exe rxxrxxf.exe PID 2756 wrote to memory of 624 2756 tnbtbn.exe rxxrxxf.exe PID 624 wrote to memory of 5092 624 rxxrxxf.exe dvdpj.exe PID 624 wrote to memory of 5092 624 rxxrxxf.exe dvdpj.exe PID 624 wrote to memory of 5092 624 rxxrxxf.exe dvdpj.exe PID 5092 wrote to memory of 1108 5092 dvdpj.exe lffxrrl.exe PID 5092 wrote to memory of 1108 5092 dvdpj.exe lffxrrl.exe PID 5092 wrote to memory of 1108 5092 dvdpj.exe lffxrrl.exe PID 1108 wrote to memory of 3280 1108 lffxrrl.exe rrfxxff.exe PID 1108 wrote to memory of 3280 1108 lffxrrl.exe rrfxxff.exe PID 1108 wrote to memory of 3280 1108 lffxrrl.exe rrfxxff.exe PID 3280 wrote to memory of 4796 3280 rrfxxff.exe 3dvpj.exe PID 3280 wrote to memory of 4796 3280 rrfxxff.exe 3dvpj.exe PID 3280 wrote to memory of 4796 3280 rrfxxff.exe 3dvpj.exe PID 4796 wrote to memory of 864 4796 3dvpj.exe pjjdd.exe PID 4796 wrote to memory of 864 4796 3dvpj.exe pjjdd.exe PID 4796 wrote to memory of 864 4796 3dvpj.exe pjjdd.exe PID 864 wrote to memory of 2284 864 pjjdd.exe hthhbb.exe PID 864 wrote to memory of 2284 864 pjjdd.exe hthhbb.exe PID 864 wrote to memory of 2284 864 pjjdd.exe hthhbb.exe PID 2284 wrote to memory of 3932 2284 hthhbb.exe dppjv.exe PID 2284 wrote to memory of 3932 2284 hthhbb.exe dppjv.exe PID 2284 wrote to memory of 3932 2284 hthhbb.exe dppjv.exe PID 3932 wrote to memory of 4804 3932 dppjv.exe lrrfxxx.exe PID 3932 wrote to memory of 4804 3932 dppjv.exe lrrfxxx.exe PID 3932 wrote to memory of 4804 3932 dppjv.exe lrrfxxx.exe PID 4804 wrote to memory of 2096 4804 lrrfxxx.exe tnnhbb.exe PID 4804 wrote to memory of 2096 4804 lrrfxxx.exe tnnhbb.exe PID 4804 wrote to memory of 2096 4804 lrrfxxx.exe tnnhbb.exe PID 2096 wrote to memory of 4752 2096 tnnhbb.exe djdvv.exe PID 2096 wrote to memory of 4752 2096 tnnhbb.exe djdvv.exe PID 2096 wrote to memory of 4752 2096 tnnhbb.exe djdvv.exe PID 4752 wrote to memory of 3416 4752 djdvv.exe fffxrll.exe PID 4752 wrote to memory of 3416 4752 djdvv.exe fffxrll.exe PID 4752 wrote to memory of 3416 4752 djdvv.exe fffxrll.exe PID 3416 wrote to memory of 972 3416 fffxrll.exe hhnnbb.exe PID 3416 wrote to memory of 972 3416 fffxrll.exe hhnnbb.exe PID 3416 wrote to memory of 972 3416 fffxrll.exe hhnnbb.exe PID 972 wrote to memory of 3944 972 hhnnbb.exe thhbtt.exe PID 972 wrote to memory of 3944 972 hhnnbb.exe thhbtt.exe PID 972 wrote to memory of 3944 972 hhnnbb.exe thhbtt.exe PID 3944 wrote to memory of 2164 3944 thhbtt.exe vjjdp.exe PID 3944 wrote to memory of 2164 3944 thhbtt.exe vjjdp.exe PID 3944 wrote to memory of 2164 3944 thhbtt.exe vjjdp.exe PID 2164 wrote to memory of 4420 2164 vjjdp.exe hnnhnh.exe PID 2164 wrote to memory of 4420 2164 vjjdp.exe hnnhnh.exe PID 2164 wrote to memory of 4420 2164 vjjdp.exe hnnhnh.exe PID 4420 wrote to memory of 1512 4420 hnnhnh.exe jvjjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\009ca363c0905fc9c567c1f327805d4988a69063b3770efad233e1539d0c4faa.exe"C:\Users\Admin\AppData\Local\Temp\009ca363c0905fc9c567c1f327805d4988a69063b3770efad233e1539d0c4faa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\1xlfrlx.exec:\1xlfrlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\nnnbtn.exec:\nnnbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\rrxxrlf.exec:\rrxxrlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\pvpdp.exec:\pvpdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\tnbtbn.exec:\tnbtbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\rxxrxxf.exec:\rxxrxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\dvdpj.exec:\dvdpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\lffxrrl.exec:\lffxrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\rrfxxff.exec:\rrfxxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\3dvpj.exec:\3dvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\pjjdd.exec:\pjjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\hthhbb.exec:\hthhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\dppjv.exec:\dppjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\lrrfxxx.exec:\lrrfxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\tnnhbb.exec:\tnnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\djdvv.exec:\djdvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\fffxrll.exec:\fffxrll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\hhnnbb.exec:\hhnnbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\thhbtt.exec:\thhbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\vjjdp.exec:\vjjdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\hnnhnh.exec:\hnnhnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\jvjjj.exec:\jvjjj.exe23⤵
- Executes dropped EXE
PID:1512 -
\??\c:\nhnbbb.exec:\nhnbbb.exe24⤵
- Executes dropped EXE
PID:3668 -
\??\c:\hbhhnn.exec:\hbhhnn.exe25⤵
- Executes dropped EXE
PID:4344 -
\??\c:\hbbtnn.exec:\hbbtnn.exe26⤵
- Executes dropped EXE
PID:3256 -
\??\c:\vvjpj.exec:\vvjpj.exe27⤵
- Executes dropped EXE
PID:3572 -
\??\c:\lxfrllf.exec:\lxfrllf.exe28⤵
- Executes dropped EXE
PID:3596 -
\??\c:\htbtnh.exec:\htbtnh.exe29⤵
- Executes dropped EXE
PID:3016 -
\??\c:\lrfxxxx.exec:\lrfxxxx.exe30⤵
- Executes dropped EXE
PID:424 -
\??\c:\vjvvd.exec:\vjvvd.exe31⤵
- Executes dropped EXE
PID:1284 -
\??\c:\ffrflrf.exec:\ffrflrf.exe32⤵
- Executes dropped EXE
PID:760 -
\??\c:\vpjdv.exec:\vpjdv.exe33⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rffrfff.exec:\rffrfff.exe34⤵
- Executes dropped EXE
PID:3592 -
\??\c:\nhbtnh.exec:\nhbtnh.exe35⤵
- Executes dropped EXE
PID:4508 -
\??\c:\lllfxrl.exec:\lllfxrl.exe36⤵
- Executes dropped EXE
PID:2708 -
\??\c:\tbhhhh.exec:\tbhhhh.exe37⤵
- Executes dropped EXE
PID:1008 -
\??\c:\jpjvj.exec:\jpjvj.exe38⤵
- Executes dropped EXE
PID:4880 -
\??\c:\lxxrlll.exec:\lxxrlll.exe39⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ththbt.exec:\ththbt.exe40⤵
- Executes dropped EXE
PID:3716 -
\??\c:\vpjdd.exec:\vpjdd.exe41⤵
- Executes dropped EXE
PID:1500 -
\??\c:\ddvpj.exec:\ddvpj.exe42⤵
- Executes dropped EXE
PID:4872 -
\??\c:\xflfxrl.exec:\xflfxrl.exe43⤵
- Executes dropped EXE
PID:2664 -
\??\c:\bntttn.exec:\bntttn.exe44⤵
- Executes dropped EXE
PID:400 -
\??\c:\jpvvv.exec:\jpvvv.exe45⤵
- Executes dropped EXE
PID:2172 -
\??\c:\xfllfff.exec:\xfllfff.exe46⤵
- Executes dropped EXE
PID:2068 -
\??\c:\bttnbn.exec:\bttnbn.exe47⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9ddvd.exec:\9ddvd.exe48⤵
- Executes dropped EXE
PID:5096 -
\??\c:\5flffxx.exec:\5flffxx.exe49⤵
- Executes dropped EXE
PID:4216 -
\??\c:\3thbtt.exec:\3thbtt.exe50⤵
- Executes dropped EXE
PID:3756 -
\??\c:\vdjpv.exec:\vdjpv.exe51⤵
- Executes dropped EXE
PID:3264 -
\??\c:\xllxrrr.exec:\xllxrrr.exe52⤵
- Executes dropped EXE
PID:4572 -
\??\c:\nhtttt.exec:\nhtttt.exe53⤵
- Executes dropped EXE
PID:4684 -
\??\c:\jvpjv.exec:\jvpjv.exe54⤵
- Executes dropped EXE
PID:4728 -
\??\c:\vvppj.exec:\vvppj.exe55⤵
- Executes dropped EXE
PID:4820 -
\??\c:\thnhhh.exec:\thnhhh.exe56⤵
- Executes dropped EXE
PID:1612 -
\??\c:\jppjj.exec:\jppjj.exe57⤵
- Executes dropped EXE
PID:4252 -
\??\c:\7lrllll.exec:\7lrllll.exe58⤵
- Executes dropped EXE
PID:2396 -
\??\c:\7hhbhn.exec:\7hhbhn.exe59⤵
- Executes dropped EXE
PID:4268 -
\??\c:\tbbtbt.exec:\tbbtbt.exe60⤵
- Executes dropped EXE
PID:2856 -
\??\c:\9vjdj.exec:\9vjdj.exe61⤵
- Executes dropped EXE
PID:3096 -
\??\c:\fxxrlff.exec:\fxxrlff.exe62⤵
- Executes dropped EXE
PID:2644 -
\??\c:\dvjjv.exec:\dvjjv.exe63⤵
- Executes dropped EXE
PID:3692 -
\??\c:\rxffxxf.exec:\rxffxxf.exe64⤵
- Executes dropped EXE
PID:4420 -
\??\c:\xlrlffx.exec:\xlrlffx.exe65⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nntnhh.exec:\nntnhh.exe66⤵PID:5068
-
\??\c:\djppv.exec:\djppv.exe67⤵PID:2692
-
\??\c:\fxxrflr.exec:\fxxrflr.exe68⤵PID:2296
-
\??\c:\btbttn.exec:\btbttn.exe69⤵PID:1088
-
\??\c:\9vvjv.exec:\9vvjv.exe70⤵PID:3220
-
\??\c:\nbthtb.exec:\nbthtb.exe71⤵PID:3076
-
\??\c:\vjjvd.exec:\vjjvd.exe72⤵PID:1980
-
\??\c:\lxfllxl.exec:\lxfllxl.exe73⤵PID:760
-
\??\c:\tbnbnb.exec:\tbnbnb.exe74⤵PID:4468
-
\??\c:\5dvdv.exec:\5dvdv.exe75⤵PID:2544
-
\??\c:\xrfrfxl.exec:\xrfrfxl.exe76⤵PID:4508
-
\??\c:\bnnhtn.exec:\bnnhtn.exe77⤵PID:2752
-
\??\c:\pdvjd.exec:\pdvjd.exe78⤵PID:3012
-
\??\c:\lllxlxl.exec:\lllxlxl.exe79⤵PID:2472
-
\??\c:\1nthtn.exec:\1nthtn.exe80⤵PID:2956
-
\??\c:\vpjvd.exec:\vpjvd.exe81⤵PID:948
-
\??\c:\lllfxxr.exec:\lllfxxr.exe82⤵PID:2616
-
\??\c:\5bhttn.exec:\5bhttn.exe83⤵PID:1576
-
\??\c:\jjpjp.exec:\jjpjp.exe84⤵PID:4592
-
\??\c:\fxlfxrx.exec:\fxlfxrx.exe85⤵PID:2640
-
\??\c:\7ttnhh.exec:\7ttnhh.exe86⤵PID:880
-
\??\c:\ddjvp.exec:\ddjvp.exe87⤵PID:4260
-
\??\c:\ththtt.exec:\ththtt.exe88⤵PID:5012
-
\??\c:\jdpdp.exec:\jdpdp.exe89⤵PID:2300
-
\??\c:\llfxlll.exec:\llfxlll.exe90⤵PID:1632
-
\??\c:\tbbbtn.exec:\tbbbtn.exe91⤵PID:4280
-
\??\c:\dpvjd.exec:\dpvjd.exe92⤵PID:4692
-
\??\c:\lrllffx.exec:\lrllffx.exe93⤵PID:2964
-
\??\c:\pvdvv.exec:\pvdvv.exe94⤵PID:4636
-
\??\c:\vpvpp.exec:\vpvpp.exe95⤵PID:3308
-
\??\c:\lflffxr.exec:\lflffxr.exe96⤵PID:2140
-
\??\c:\nhnhtt.exec:\nhnhtt.exe97⤵PID:408
-
\??\c:\lrrlxrl.exec:\lrrlxrl.exe98⤵PID:4896
-
\??\c:\lrllllf.exec:\lrllllf.exe99⤵PID:3972
-
\??\c:\pjjdj.exec:\pjjdj.exe100⤵PID:1452
-
\??\c:\flflflx.exec:\flflflx.exe101⤵PID:964
-
\??\c:\3btnhh.exec:\3btnhh.exe102⤵PID:1432
-
\??\c:\djdvp.exec:\djdvp.exe103⤵PID:2164
-
\??\c:\xfrlrxl.exec:\xfrlrxl.exe104⤵PID:4948
-
\??\c:\hhhthh.exec:\hhhthh.exe105⤵PID:1512
-
\??\c:\pppvd.exec:\pppvd.exe106⤵PID:2744
-
\??\c:\htthtn.exec:\htthtn.exe107⤵PID:3376
-
\??\c:\3ppdd.exec:\3ppdd.exe108⤵PID:3292
-
\??\c:\lrfxrrl.exec:\lrfxrrl.exe109⤵PID:448
-
\??\c:\hbhthh.exec:\hbhthh.exe110⤵PID:1300
-
\??\c:\vvvjd.exec:\vvvjd.exe111⤵PID:3104
-
\??\c:\9rlfxrl.exec:\9rlfxrl.exe112⤵PID:1284
-
\??\c:\tnhbhh.exec:\tnhbhh.exe113⤵PID:1348
-
\??\c:\1pjdv.exec:\1pjdv.exe114⤵PID:1916
-
\??\c:\rlflfll.exec:\rlflfll.exe115⤵PID:2880
-
\??\c:\hhbthb.exec:\hhbthb.exe116⤵PID:4208
-
\??\c:\djjjj.exec:\djjjj.exe117⤵PID:2972
-
\??\c:\xrlxrxr.exec:\xrlxrxr.exe118⤵PID:1008
-
\??\c:\tntnhh.exec:\tntnhh.exe119⤵PID:2160
-
\??\c:\pddvp.exec:\pddvp.exe120⤵PID:2124
-
\??\c:\frfxrrr.exec:\frfxrrr.exe121⤵PID:5044
-
\??\c:\bhbnhb.exec:\bhbnhb.exe122⤵PID:2100
-
\??\c:\ddpjd.exec:\ddpjd.exe123⤵PID:3704
-
\??\c:\7llfxxr.exec:\7llfxxr.exe124⤵PID:544
-
\??\c:\htnhtt.exec:\htnhtt.exe125⤵PID:1852
-
\??\c:\jddvp.exec:\jddvp.exe126⤵PID:2108
-
\??\c:\fffxrlf.exec:\fffxrlf.exe127⤵PID:2104
-
\??\c:\9nbbtn.exec:\9nbbtn.exe128⤵PID:4260
-
\??\c:\dddvd.exec:\dddvd.exe129⤵PID:4920
-
\??\c:\llrlxrl.exec:\llrlxrl.exe130⤵PID:1200
-
\??\c:\nhnhbn.exec:\nhnhbn.exe131⤵PID:2032
-
\??\c:\pvdvp.exec:\pvdvp.exe132⤵PID:4368
-
\??\c:\frxrllf.exec:\frxrllf.exe133⤵PID:3048
-
\??\c:\1bbtnt.exec:\1bbtnt.exe134⤵PID:4280
-
\??\c:\jvddv.exec:\jvddv.exe135⤵PID:3276
-
\??\c:\lflrlfl.exec:\lflrlfl.exe136⤵PID:1688
-
\??\c:\btbtbt.exec:\btbtbt.exe137⤵PID:3688
-
\??\c:\5vpjd.exec:\5vpjd.exe138⤵PID:3308
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe139⤵PID:2096
-
\??\c:\hhnhbb.exec:\hhnhbb.exe140⤵PID:3224
-
\??\c:\pjppj.exec:\pjppj.exe141⤵PID:4996
-
\??\c:\rflxrrl.exec:\rflxrrl.exe142⤵PID:664
-
\??\c:\hhbbnn.exec:\hhbbnn.exe143⤵PID:1584
-
\??\c:\7pvpj.exec:\7pvpj.exe144⤵PID:4196
-
\??\c:\nnnhhh.exec:\nnnhhh.exe145⤵PID:1432
-
\??\c:\djdpd.exec:\djdpd.exe146⤵PID:1560
-
\??\c:\vvpjv.exec:\vvpjv.exe147⤵PID:4948
-
\??\c:\lfrlrrr.exec:\lfrlrrr.exe148⤵PID:1512
-
\??\c:\dpvpj.exec:\dpvpj.exe149⤵PID:2744
-
\??\c:\7rfxrxx.exec:\7rfxrxx.exe150⤵PID:3560
-
\??\c:\bbbbhh.exec:\bbbbhh.exe151⤵PID:3292
-
\??\c:\jdjjj.exec:\jdjjj.exe152⤵PID:448
-
\??\c:\rlllxff.exec:\rlllxff.exe153⤵PID:1300
-
\??\c:\3bbbtt.exec:\3bbbtt.exe154⤵PID:3204
-
\??\c:\5ppvp.exec:\5ppvp.exe155⤵PID:1284
-
\??\c:\3llflll.exec:\3llflll.exe156⤵PID:1392
-
\??\c:\hbbbtn.exec:\hbbbtn.exe157⤵PID:4464
-
\??\c:\pjpjd.exec:\pjpjd.exe158⤵PID:4816
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe159⤵PID:2316
-
\??\c:\hnbbhh.exec:\hnbbhh.exe160⤵PID:2800
-
\??\c:\dppdp.exec:\dppdp.exe161⤵PID:5112
-
\??\c:\fxrrlll.exec:\fxrrlll.exe162⤵PID:4084
-
\??\c:\ntbtnn.exec:\ntbtnn.exe163⤵PID:3716
-
\??\c:\5jvpd.exec:\5jvpd.exe164⤵PID:4200
-
\??\c:\flxrrll.exec:\flxrrll.exe165⤵PID:5100
-
\??\c:\tntnhb.exec:\tntnhb.exe166⤵PID:2440
-
\??\c:\jjdvp.exec:\jjdvp.exe167⤵PID:2200
-
\??\c:\rxxrrrr.exec:\rxxrrrr.exe168⤵PID:3196
-
\??\c:\tnntnn.exec:\tnntnn.exe169⤵PID:2464
-
\??\c:\dpddj.exec:\dpddj.exe170⤵PID:372
-
\??\c:\7rxlrrf.exec:\7rxlrrf.exe171⤵PID:2952
-
\??\c:\hnhnbt.exec:\hnhnbt.exe172⤵PID:4032
-
\??\c:\pjpjp.exec:\pjpjp.exe173⤵PID:2696
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe174⤵PID:3756
-
\??\c:\bbnhbb.exec:\bbnhbb.exe175⤵PID:4796
-
\??\c:\jvddp.exec:\jvddp.exe176⤵PID:864
-
\??\c:\lxxlfxx.exec:\lxxlfxx.exe177⤵PID:4956
-
\??\c:\btttnh.exec:\btttnh.exe178⤵PID:2924
-
\??\c:\5djdp.exec:\5djdp.exe179⤵PID:4636
-
\??\c:\jjpdp.exec:\jjpdp.exe180⤵PID:936
-
\??\c:\ntbtnh.exec:\ntbtnh.exe181⤵PID:2140
-
\??\c:\pdpvd.exec:\pdpvd.exe182⤵PID:408
-
\??\c:\rffxrrx.exec:\rffxrrx.exe183⤵PID:4896
-
\??\c:\nbbtnn.exec:\nbbtnn.exe184⤵PID:4772
-
\??\c:\vdjjd.exec:\vdjjd.exe185⤵PID:3096
-
\??\c:\rxxrfxr.exec:\rxxrfxr.exe186⤵PID:4152
-
\??\c:\thtnbt.exec:\thtnbt.exe187⤵PID:1268
-
\??\c:\vdjdd.exec:\vdjdd.exe188⤵PID:2220
-
\??\c:\rflflfl.exec:\rflflfl.exe189⤵PID:1796
-
\??\c:\nbhbtn.exec:\nbhbtn.exe190⤵PID:2768
-
\??\c:\pjdjj.exec:\pjdjj.exe191⤵PID:2256
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe192⤵PID:1404
-
\??\c:\nbbhth.exec:\nbbhth.exe193⤵PID:3516
-
\??\c:\jdppp.exec:\jdppp.exe194⤵PID:1088
-
\??\c:\rrrlfff.exec:\rrrlfff.exe195⤵PID:1300
-
\??\c:\7hbnhn.exec:\7hbnhn.exe196⤵PID:1284
-
\??\c:\jdvpj.exec:\jdvpj.exe197⤵PID:4568
-
\??\c:\xxxlxrl.exec:\xxxlxrl.exe198⤵PID:536
-
\??\c:\nbnnbt.exec:\nbnnbt.exe199⤵PID:5036
-
\??\c:\vvppp.exec:\vvppp.exe200⤵PID:1900
-
\??\c:\5lxrfxl.exec:\5lxrfxl.exe201⤵PID:3860
-
\??\c:\thnhbb.exec:\thnhbb.exe202⤵PID:2796
-
\??\c:\ddpjd.exec:\ddpjd.exe203⤵PID:4592
-
\??\c:\9flfrlf.exec:\9flfrlf.exe204⤵PID:1484
-
\??\c:\jjdpj.exec:\jjdpj.exe205⤵PID:2864
-
\??\c:\fxlrxrx.exec:\fxlrxrx.exe206⤵PID:2104
-
\??\c:\hnhhhb.exec:\hnhhhb.exe207⤵PID:4132
-
\??\c:\ppjpd.exec:\ppjpd.exe208⤵PID:4616
-
\??\c:\rllxlxf.exec:\rllxlxf.exe209⤵PID:4920
-
\??\c:\ntthnh.exec:\ntthnh.exe210⤵PID:2300
-
\??\c:\pddpd.exec:\pddpd.exe211⤵PID:4052
-
\??\c:\flrffrx.exec:\flrffrx.exe212⤵PID:3264
-
\??\c:\7htnbt.exec:\7htnbt.exe213⤵PID:1588
-
\??\c:\dddvp.exec:\dddvp.exe214⤵PID:4684
-
\??\c:\jddpj.exec:\jddpj.exe215⤵PID:4728
-
\??\c:\llrflrr.exec:\llrflrr.exe216⤵PID:4376
-
\??\c:\nhhbtn.exec:\nhhbtn.exe217⤵PID:4656
-
\??\c:\ddpjp.exec:\ddpjp.exe218⤵PID:4252
-
\??\c:\rlrffxf.exec:\rlrffxf.exe219⤵PID:3372
-
\??\c:\ntnthh.exec:\ntnthh.exe220⤵PID:1972
-
\??\c:\vjdvp.exec:\vjdvp.exe221⤵PID:3416
-
\??\c:\pdvjv.exec:\pdvjv.exe222⤵PID:2204
-
\??\c:\1rrfrrf.exec:\1rrfrrf.exe223⤵PID:4496
-
\??\c:\ddjpd.exec:\ddjpd.exe224⤵PID:2644
-
\??\c:\frllxrf.exec:\frllxrf.exe225⤵PID:5040
-
\??\c:\hhhthn.exec:\hhhthn.exe226⤵PID:1560
-
\??\c:\dvpjd.exec:\dvpjd.exe227⤵PID:2180
-
\??\c:\rfrlxrf.exec:\rfrlxrf.exe228⤵PID:3376
-
\??\c:\bhnhhb.exec:\bhnhhb.exe229⤵PID:2492
-
\??\c:\vpvpd.exec:\vpvpd.exe230⤵PID:2512
-
\??\c:\fffxxrl.exec:\fffxxrl.exe231⤵PID:4140
-
\??\c:\bhtnnn.exec:\bhtnnn.exe232⤵PID:2132
-
\??\c:\3pdjd.exec:\3pdjd.exe233⤵PID:2544
-
\??\c:\lfxxrrl.exec:\lfxxrrl.exe234⤵PID:3300
-
\??\c:\nnnbbt.exec:\nnnbbt.exe235⤵PID:4372
-
\??\c:\vdjdd.exec:\vdjdd.exe236⤵PID:3288
-
\??\c:\xrfxxxr.exec:\xrfxxxr.exe237⤵PID:3036
-
\??\c:\nbhhbh.exec:\nbhhbh.exe238⤵PID:2412
-
\??\c:\pjjjd.exec:\pjjjd.exe239⤵PID:540
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe240⤵PID:4588
-
\??\c:\nhnnhb.exec:\nhnnhb.exe241⤵PID:4344
-