Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2024, 23:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
57244ab2c66659f38d556926ec71cd045dbcce4813d3408566ae255f8376beae.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
57244ab2c66659f38d556926ec71cd045dbcce4813d3408566ae255f8376beae.exe
-
Size
63KB
-
MD5
253e3214d0f06ef4374eba8811696c30
-
SHA1
4d01b7cd8ab1ede7a7b43a74b4e8c7ac4b37284b
-
SHA256
57244ab2c66659f38d556926ec71cd045dbcce4813d3408566ae255f8376beae
-
SHA512
b2f4c785ee2ca566f884662ac3e2e4b87b223e205d44fb206ef4f90c9ab5e300efef4b6dc1412f173353fe3247ca287945624c1b96bc04e96cb6efaef22d0dc3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6Mu/ePS3A1:ymb3NkkiQ3mdBjFI46TQ1
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2844-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-54-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3052-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2300-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3936 468226.exe 1684 3rrrrll.exe 3476 bbbbth.exe 5040 6404882.exe 1260 i600004.exe 1112 628222.exe 3096 244224.exe 3052 thnnhh.exe 1620 vvpjd.exe 2232 dvjvv.exe 1576 062822.exe 816 4622600.exe 2444 jjdvv.exe 4552 280088.exe 4192 4088226.exe 2236 82060.exe 3660 60860.exe 2980 hthbbb.exe 5008 24606.exe 1600 hbbbbh.exe 2300 60806.exe 4492 20420.exe 4528 42802.exe 4736 06226.exe 4016 608666.exe 392 hhbtbb.exe 1452 2808826.exe 4468 4024444.exe 4824 jddvv.exe 4224 446600.exe 5060 pdddv.exe 1544 hbtntt.exe 1444 nthbhb.exe 4188 flrrxrx.exe 4272 lllflxx.exe 3968 jjpvp.exe 4212 4846486.exe 2876 686422.exe 4524 jddjj.exe 2492 024888.exe 3656 tntbtt.exe 3508 26660.exe 4740 dvjdj.exe 748 llfxxrx.exe 4328 2404060.exe 768 o280284.exe 920 xfxrxlf.exe 4676 20646.exe 2744 xrfrrrr.exe 3296 tttnnn.exe 4792 28204.exe 1984 060802.exe 816 vvdvv.exe 4080 4688006.exe 5108 468446.exe 4008 228026.exe 2012 pvvjv.exe 4536 86482.exe 848 jpjjd.exe 3488 xlfxfrf.exe 3916 4684280.exe 4276 80604.exe 3616 llxrxxl.exe 3092 6666884.exe -
resource yara_rule behavioral2/memory/2844-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/816-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2300-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-195-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2844 wrote to memory of 3936 2844 57244ab2c66659f38d556926ec71cd045dbcce4813d3408566ae255f8376beae.exe 83 PID 2844 wrote to memory of 3936 2844 57244ab2c66659f38d556926ec71cd045dbcce4813d3408566ae255f8376beae.exe 83 PID 2844 wrote to memory of 3936 2844 57244ab2c66659f38d556926ec71cd045dbcce4813d3408566ae255f8376beae.exe 83 PID 3936 wrote to memory of 1684 3936 468226.exe 84 PID 3936 wrote to memory of 1684 3936 468226.exe 84 PID 3936 wrote to memory of 1684 3936 468226.exe 84 PID 1684 wrote to memory of 3476 1684 3rrrrll.exe 85 PID 1684 wrote to memory of 3476 1684 3rrrrll.exe 85 PID 1684 wrote to memory of 3476 1684 3rrrrll.exe 85 PID 3476 wrote to memory of 5040 3476 bbbbth.exe 86 PID 3476 wrote to memory of 5040 3476 bbbbth.exe 86 PID 3476 wrote to memory of 5040 3476 bbbbth.exe 86 PID 5040 wrote to memory of 1260 5040 6404882.exe 87 PID 5040 wrote to memory of 1260 5040 6404882.exe 87 PID 5040 wrote to memory of 1260 5040 6404882.exe 87 PID 1260 wrote to memory of 1112 1260 i600004.exe 88 PID 1260 wrote to memory of 1112 1260 i600004.exe 88 PID 1260 wrote to memory of 1112 1260 i600004.exe 88 PID 1112 wrote to memory of 3096 1112 628222.exe 89 PID 1112 wrote to memory of 3096 1112 628222.exe 89 PID 1112 wrote to memory of 3096 1112 628222.exe 89 PID 3096 wrote to memory of 3052 3096 244224.exe 90 PID 3096 wrote to memory of 3052 3096 244224.exe 90 PID 3096 wrote to memory of 3052 3096 244224.exe 90 PID 3052 wrote to memory of 1620 3052 thnnhh.exe 91 PID 3052 wrote to memory of 1620 3052 thnnhh.exe 91 PID 3052 wrote to memory of 1620 3052 thnnhh.exe 91 PID 1620 wrote to memory of 2232 1620 vvpjd.exe 92 PID 1620 wrote to memory of 2232 1620 vvpjd.exe 92 PID 1620 wrote to memory of 2232 1620 vvpjd.exe 92 PID 2232 wrote to memory of 1576 2232 dvjvv.exe 93 PID 2232 wrote to memory of 1576 2232 dvjvv.exe 93 PID 2232 wrote to memory of 1576 2232 dvjvv.exe 93 PID 1576 wrote to memory of 816 1576 062822.exe 94 PID 1576 wrote to memory of 816 1576 062822.exe 94 PID 1576 wrote to memory of 816 1576 062822.exe 94 PID 816 wrote to memory of 2444 816 4622600.exe 95 PID 816 wrote to memory of 2444 816 4622600.exe 95 PID 816 wrote to memory of 2444 816 4622600.exe 95 PID 2444 wrote to memory of 4552 2444 jjdvv.exe 96 PID 2444 wrote to memory of 4552 2444 jjdvv.exe 96 PID 2444 wrote to memory of 4552 2444 jjdvv.exe 96 PID 4552 wrote to memory of 4192 4552 280088.exe 97 PID 4552 wrote to memory of 4192 4552 280088.exe 97 PID 4552 wrote to memory of 4192 4552 280088.exe 97 PID 4192 wrote to memory of 2236 4192 4088226.exe 98 PID 4192 wrote to memory of 2236 4192 4088226.exe 98 PID 4192 wrote to memory of 2236 4192 4088226.exe 98 PID 2236 wrote to memory of 3660 2236 82060.exe 99 PID 2236 wrote to memory of 3660 2236 82060.exe 99 PID 2236 wrote to memory of 3660 2236 82060.exe 99 PID 3660 wrote to memory of 2980 3660 60860.exe 100 PID 3660 wrote to memory of 2980 3660 60860.exe 100 PID 3660 wrote to memory of 2980 3660 60860.exe 100 PID 2980 wrote to memory of 5008 2980 hthbbb.exe 101 PID 2980 wrote to memory of 5008 2980 hthbbb.exe 101 PID 2980 wrote to memory of 5008 2980 hthbbb.exe 101 PID 5008 wrote to memory of 1600 5008 24606.exe 103 PID 5008 wrote to memory of 1600 5008 24606.exe 103 PID 5008 wrote to memory of 1600 5008 24606.exe 103 PID 1600 wrote to memory of 2300 1600 hbbbbh.exe 104 PID 1600 wrote to memory of 2300 1600 hbbbbh.exe 104 PID 1600 wrote to memory of 2300 1600 hbbbbh.exe 104 PID 2300 wrote to memory of 4492 2300 60806.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\57244ab2c66659f38d556926ec71cd045dbcce4813d3408566ae255f8376beae.exe"C:\Users\Admin\AppData\Local\Temp\57244ab2c66659f38d556926ec71cd045dbcce4813d3408566ae255f8376beae.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\468226.exec:\468226.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\3rrrrll.exec:\3rrrrll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\bbbbth.exec:\bbbbth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\6404882.exec:\6404882.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\i600004.exec:\i600004.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\628222.exec:\628222.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\244224.exec:\244224.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\thnnhh.exec:\thnnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\vvpjd.exec:\vvpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\dvjvv.exec:\dvjvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\062822.exec:\062822.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\4622600.exec:\4622600.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\jjdvv.exec:\jjdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\280088.exec:\280088.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\4088226.exec:\4088226.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\82060.exec:\82060.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\60860.exec:\60860.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\hthbbb.exec:\hthbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\24606.exec:\24606.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\hbbbbh.exec:\hbbbbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\60806.exec:\60806.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\20420.exec:\20420.exe23⤵
- Executes dropped EXE
PID:4492 -
\??\c:\42802.exec:\42802.exe24⤵
- Executes dropped EXE
PID:4528 -
\??\c:\06226.exec:\06226.exe25⤵
- Executes dropped EXE
PID:4736 -
\??\c:\608666.exec:\608666.exe26⤵
- Executes dropped EXE
PID:4016 -
\??\c:\hhbtbb.exec:\hhbtbb.exe27⤵
- Executes dropped EXE
PID:392 -
\??\c:\2808826.exec:\2808826.exe28⤵
- Executes dropped EXE
PID:1452 -
\??\c:\4024444.exec:\4024444.exe29⤵
- Executes dropped EXE
PID:4468 -
\??\c:\jddvv.exec:\jddvv.exe30⤵
- Executes dropped EXE
PID:4824 -
\??\c:\446600.exec:\446600.exe31⤵
- Executes dropped EXE
PID:4224 -
\??\c:\pdddv.exec:\pdddv.exe32⤵
- Executes dropped EXE
PID:5060 -
\??\c:\hbtntt.exec:\hbtntt.exe33⤵
- Executes dropped EXE
PID:1544 -
\??\c:\nthbhb.exec:\nthbhb.exe34⤵
- Executes dropped EXE
PID:1444 -
\??\c:\flrrxrx.exec:\flrrxrx.exe35⤵
- Executes dropped EXE
PID:4188 -
\??\c:\lllflxx.exec:\lllflxx.exe36⤵
- Executes dropped EXE
PID:4272 -
\??\c:\jjpvp.exec:\jjpvp.exe37⤵
- Executes dropped EXE
PID:3968 -
\??\c:\4846486.exec:\4846486.exe38⤵
- Executes dropped EXE
PID:4212 -
\??\c:\686422.exec:\686422.exe39⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jddjj.exec:\jddjj.exe40⤵
- Executes dropped EXE
PID:4524 -
\??\c:\024888.exec:\024888.exe41⤵
- Executes dropped EXE
PID:2492 -
\??\c:\tntbtt.exec:\tntbtt.exe42⤵
- Executes dropped EXE
PID:3656 -
\??\c:\26660.exec:\26660.exe43⤵
- Executes dropped EXE
PID:3508 -
\??\c:\dvjdj.exec:\dvjdj.exe44⤵
- Executes dropped EXE
PID:4740 -
\??\c:\llfxxrx.exec:\llfxxrx.exe45⤵
- Executes dropped EXE
PID:748 -
\??\c:\2404060.exec:\2404060.exe46⤵
- Executes dropped EXE
PID:4328 -
\??\c:\o280284.exec:\o280284.exe47⤵
- Executes dropped EXE
PID:768 -
\??\c:\xfxrxlf.exec:\xfxrxlf.exe48⤵
- Executes dropped EXE
PID:920 -
\??\c:\20646.exec:\20646.exe49⤵
- Executes dropped EXE
PID:4676 -
\??\c:\xrfrrrr.exec:\xrfrrrr.exe50⤵
- Executes dropped EXE
PID:2744 -
\??\c:\tttnnn.exec:\tttnnn.exe51⤵
- Executes dropped EXE
PID:3296 -
\??\c:\28204.exec:\28204.exe52⤵
- Executes dropped EXE
PID:4792 -
\??\c:\060802.exec:\060802.exe53⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vvdvv.exec:\vvdvv.exe54⤵
- Executes dropped EXE
PID:816 -
\??\c:\4688006.exec:\4688006.exe55⤵
- Executes dropped EXE
PID:4080 -
\??\c:\468446.exec:\468446.exe56⤵
- Executes dropped EXE
PID:5108 -
\??\c:\228026.exec:\228026.exe57⤵
- Executes dropped EXE
PID:4008 -
\??\c:\pvvjv.exec:\pvvjv.exe58⤵
- Executes dropped EXE
PID:2012 -
\??\c:\86482.exec:\86482.exe59⤵
- Executes dropped EXE
PID:4536 -
\??\c:\jpjjd.exec:\jpjjd.exe60⤵
- Executes dropped EXE
PID:848 -
\??\c:\xlfxfrf.exec:\xlfxfrf.exe61⤵
- Executes dropped EXE
PID:3488 -
\??\c:\4684280.exec:\4684280.exe62⤵
- Executes dropped EXE
PID:3916 -
\??\c:\80604.exec:\80604.exe63⤵
- Executes dropped EXE
PID:4276 -
\??\c:\llxrxxl.exec:\llxrxxl.exe64⤵
- Executes dropped EXE
PID:3616 -
\??\c:\6666884.exec:\6666884.exe65⤵
- Executes dropped EXE
PID:3092 -
\??\c:\5pjvd.exec:\5pjvd.exe66⤵PID:4300
-
\??\c:\8466448.exec:\8466448.exe67⤵PID:2288
-
\??\c:\htbbtt.exec:\htbbtt.exe68⤵PID:4592
-
\??\c:\8240882.exec:\8240882.exe69⤵PID:4840
-
\??\c:\2006220.exec:\2006220.exe70⤵PID:2040
-
\??\c:\vpvpp.exec:\vpvpp.exe71⤵PID:392
-
\??\c:\280200.exec:\280200.exe72⤵PID:1452
-
\??\c:\pppjv.exec:\pppjv.exe73⤵PID:2112
-
\??\c:\8288666.exec:\8288666.exe74⤵PID:4904
-
\??\c:\6040002.exec:\6040002.exe75⤵PID:1076
-
\??\c:\xfffllr.exec:\xfffllr.exe76⤵PID:4620
-
\??\c:\2086088.exec:\2086088.exe77⤵PID:4912
-
\??\c:\bnbbnt.exec:\bnbbnt.exe78⤵PID:1412
-
\??\c:\rrrrxlf.exec:\rrrrxlf.exe79⤵PID:2908
-
\??\c:\tthhnn.exec:\tthhnn.exe80⤵PID:4828
-
\??\c:\ntbhnn.exec:\ntbhnn.exe81⤵PID:3876
-
\??\c:\804622.exec:\804622.exe82⤵PID:4684
-
\??\c:\02282.exec:\02282.exe83⤵PID:3968
-
\??\c:\62866.exec:\62866.exe84⤵PID:1516
-
\??\c:\vpjjd.exec:\vpjjd.exe85⤵PID:2796
-
\??\c:\00666.exec:\00666.exe86⤵PID:3664
-
\??\c:\44000.exec:\44000.exe87⤵PID:1648
-
\??\c:\ddddv.exec:\ddddv.exe88⤵PID:4264
-
\??\c:\ttnnnt.exec:\ttnnnt.exe89⤵PID:4120
-
\??\c:\nntttt.exec:\nntttt.exe90⤵PID:5040
-
\??\c:\2268468.exec:\2268468.exe91⤵PID:3732
-
\??\c:\884488.exec:\884488.exe92⤵PID:2056
-
\??\c:\00060.exec:\00060.exe93⤵PID:1108
-
\??\c:\6400044.exec:\6400044.exe94⤵PID:2100
-
\??\c:\228688.exec:\228688.exe95⤵PID:2824
-
\??\c:\000428.exec:\000428.exe96⤵PID:3036
-
\??\c:\frfffrx.exec:\frfffrx.exe97⤵PID:5052
-
\??\c:\9ddvv.exec:\9ddvv.exe98⤵PID:3504
-
\??\c:\7hnnbb.exec:\7hnnbb.exe99⤵PID:2512
-
\??\c:\40046.exec:\40046.exe100⤵PID:2072
-
\??\c:\hnthbt.exec:\hnthbt.exe101⤵PID:3596
-
\??\c:\002644.exec:\002644.exe102⤵PID:3672
-
\??\c:\222024.exec:\222024.exe103⤵PID:3524
-
\??\c:\662862.exec:\662862.exe104⤵PID:2364
-
\??\c:\22006.exec:\22006.exe105⤵PID:2980
-
\??\c:\7ppjd.exec:\7ppjd.exe106⤵PID:2776
-
\??\c:\hbbnbn.exec:\hbbnbn.exe107⤵PID:688
-
\??\c:\662268.exec:\662268.exe108⤵PID:1600
-
\??\c:\066686.exec:\066686.exe109⤵PID:532
-
\??\c:\tnthnn.exec:\tnthnn.exe110⤵PID:3616
-
\??\c:\1nbbhh.exec:\1nbbhh.exe111⤵PID:4924
-
\??\c:\48606.exec:\48606.exe112⤵PID:1724
-
\??\c:\nbbbtn.exec:\nbbbtn.exe113⤵PID:2288
-
\??\c:\680488.exec:\680488.exe114⤵PID:4592
-
\??\c:\7htnhb.exec:\7htnhb.exe115⤵PID:5004
-
\??\c:\66886.exec:\66886.exe116⤵PID:3500
-
\??\c:\djjjv.exec:\djjjv.exe117⤵PID:2124
-
\??\c:\nbbthh.exec:\nbbthh.exe118⤵PID:3340
-
\??\c:\68440.exec:\68440.exe119⤵PID:3304
-
\??\c:\llllfff.exec:\llllfff.exe120⤵PID:2292
-
\??\c:\m2804.exec:\m2804.exe121⤵PID:4116
-
\??\c:\xrrrllx.exec:\xrrrllx.exe122⤵PID:2904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-