Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 20:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
39f7ab2c42ea954636dfdb1629ec4bf1ac0e399976311321acad3dbbcc8e9b99.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
39f7ab2c42ea954636dfdb1629ec4bf1ac0e399976311321acad3dbbcc8e9b99.exe
-
Size
55KB
-
MD5
c28e502d21a67804ca110e38b7b7ec7a
-
SHA1
4d32e43149a99d228ac432eae3914f0daa417028
-
SHA256
39f7ab2c42ea954636dfdb1629ec4bf1ac0e399976311321acad3dbbcc8e9b99
-
SHA512
f683edbea339b5d62964bea028eae2b2f04eb24d447bdcbd6e7560427d3af21f8f2e513ad06f9f64c5d7dea585d594d774d2480a4f206234bb3433e083aae95c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfEq:ymb3NkkiQ3mdBjFIB
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/432-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1324-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3352-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1500-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2124-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1164-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 23 IoCs
resource yara_rule behavioral2/memory/432-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2024-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1324-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2200-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3352-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1924-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3896-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1500-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2880-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2124-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4956-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2760-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2264-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2532-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4080-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4828-130-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1164-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4852-143-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2248-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2820-161-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5052-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3436-178-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5064-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2024 1dvpp.exe 1324 xrllxrr.exe 2200 rfxxxxx.exe 3352 bttttb.exe 1924 3btttt.exe 3896 jdpdd.exe 3100 1rxxfxf.exe 1500 bntbbb.exe 2880 9hhhbb.exe 2124 pdpjp.exe 1984 fxxfffl.exe 4956 tthhbh.exe 2760 dvddd.exe 2264 jdpdj.exe 2016 9rllffx.exe 2532 thtbbt.exe 4080 dvjdd.exe 3492 lrlfffr.exe 4828 xrxlxrf.exe 1164 3bbnnn.exe 4852 dvpvv.exe 1920 llllfff.exe 2248 btbhnn.exe 2820 jddjv.exe 5052 fxxxrxx.exe 2140 nnthhn.exe 3436 pjjjv.exe 2980 rflflll.exe 5064 rrfffrl.exe 2480 bhhbtn.exe 4984 vpvvv.exe 5104 dpvpd.exe 1440 rfxrrrl.exe 872 bntnnt.exe 4292 bhbtnb.exe 4436 jjdvj.exe 3212 jvppd.exe 1788 lflffxx.exe 4360 xrrrrrr.exe 4308 nhbntb.exe 3572 1pvpj.exe 3892 7rrlffx.exe 2184 xlrlffl.exe 2920 ttbhnt.exe 396 1bhhbb.exe 1252 pdppp.exe 1084 ffxxxfl.exe 2948 fxxffff.exe 1764 thhbth.exe 2836 djpvp.exe 1960 vpvjj.exe 656 frxrrxr.exe 3308 7htnnt.exe 4956 btbhtb.exe 1416 dpvpp.exe 3380 ffrlffx.exe 4840 fxlffll.exe 4404 bbbbht.exe 4080 hbbhbb.exe 1584 pjpjj.exe 4280 3rfxffr.exe 3004 7rrxrfx.exe 3960 bbbbtt.exe 2828 dvjpd.exe -
resource yara_rule behavioral2/memory/432-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3352-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1500-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2124-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1164-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-189-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 432 wrote to memory of 2024 432 39f7ab2c42ea954636dfdb1629ec4bf1ac0e399976311321acad3dbbcc8e9b99.exe 83 PID 432 wrote to memory of 2024 432 39f7ab2c42ea954636dfdb1629ec4bf1ac0e399976311321acad3dbbcc8e9b99.exe 83 PID 432 wrote to memory of 2024 432 39f7ab2c42ea954636dfdb1629ec4bf1ac0e399976311321acad3dbbcc8e9b99.exe 83 PID 2024 wrote to memory of 1324 2024 1dvpp.exe 84 PID 2024 wrote to memory of 1324 2024 1dvpp.exe 84 PID 2024 wrote to memory of 1324 2024 1dvpp.exe 84 PID 1324 wrote to memory of 2200 1324 xrllxrr.exe 85 PID 1324 wrote to memory of 2200 1324 xrllxrr.exe 85 PID 1324 wrote to memory of 2200 1324 xrllxrr.exe 85 PID 2200 wrote to memory of 3352 2200 rfxxxxx.exe 86 PID 2200 wrote to memory of 3352 2200 rfxxxxx.exe 86 PID 2200 wrote to memory of 3352 2200 rfxxxxx.exe 86 PID 3352 wrote to memory of 1924 3352 bttttb.exe 87 PID 3352 wrote to memory of 1924 3352 bttttb.exe 87 PID 3352 wrote to memory of 1924 3352 bttttb.exe 87 PID 1924 wrote to memory of 3896 1924 3btttt.exe 88 PID 1924 wrote to memory of 3896 1924 3btttt.exe 88 PID 1924 wrote to memory of 3896 1924 3btttt.exe 88 PID 3896 wrote to memory of 3100 3896 jdpdd.exe 89 PID 3896 wrote to memory of 3100 3896 jdpdd.exe 89 PID 3896 wrote to memory of 3100 3896 jdpdd.exe 89 PID 3100 wrote to memory of 1500 3100 1rxxfxf.exe 90 PID 3100 wrote to memory of 1500 3100 1rxxfxf.exe 90 PID 3100 wrote to memory of 1500 3100 1rxxfxf.exe 90 PID 1500 wrote to memory of 2880 1500 bntbbb.exe 91 PID 1500 wrote to memory of 2880 1500 bntbbb.exe 91 PID 1500 wrote to memory of 2880 1500 bntbbb.exe 91 PID 2880 wrote to memory of 2124 2880 9hhhbb.exe 92 PID 2880 wrote to memory of 2124 2880 9hhhbb.exe 92 PID 2880 wrote to memory of 2124 2880 9hhhbb.exe 92 PID 2124 wrote to memory of 1984 2124 pdpjp.exe 93 PID 2124 wrote to memory of 1984 2124 pdpjp.exe 93 PID 2124 wrote to memory of 1984 2124 pdpjp.exe 93 PID 1984 wrote to memory of 4956 1984 fxxfffl.exe 94 PID 1984 wrote to memory of 4956 1984 fxxfffl.exe 94 PID 1984 wrote to memory of 4956 1984 fxxfffl.exe 94 PID 4956 wrote to memory of 2760 4956 tthhbh.exe 95 PID 4956 wrote to memory of 2760 4956 tthhbh.exe 95 PID 4956 wrote to memory of 2760 4956 tthhbh.exe 95 PID 2760 wrote to memory of 2264 2760 dvddd.exe 96 PID 2760 wrote to memory of 2264 2760 dvddd.exe 96 PID 2760 wrote to memory of 2264 2760 dvddd.exe 96 PID 2264 wrote to memory of 2016 2264 jdpdj.exe 97 PID 2264 wrote to memory of 2016 2264 jdpdj.exe 97 PID 2264 wrote to memory of 2016 2264 jdpdj.exe 97 PID 2016 wrote to memory of 2532 2016 9rllffx.exe 98 PID 2016 wrote to memory of 2532 2016 9rllffx.exe 98 PID 2016 wrote to memory of 2532 2016 9rllffx.exe 98 PID 2532 wrote to memory of 4080 2532 thtbbt.exe 99 PID 2532 wrote to memory of 4080 2532 thtbbt.exe 99 PID 2532 wrote to memory of 4080 2532 thtbbt.exe 99 PID 4080 wrote to memory of 3492 4080 dvjdd.exe 100 PID 4080 wrote to memory of 3492 4080 dvjdd.exe 100 PID 4080 wrote to memory of 3492 4080 dvjdd.exe 100 PID 3492 wrote to memory of 4828 3492 lrlfffr.exe 101 PID 3492 wrote to memory of 4828 3492 lrlfffr.exe 101 PID 3492 wrote to memory of 4828 3492 lrlfffr.exe 101 PID 4828 wrote to memory of 1164 4828 xrxlxrf.exe 102 PID 4828 wrote to memory of 1164 4828 xrxlxrf.exe 102 PID 4828 wrote to memory of 1164 4828 xrxlxrf.exe 102 PID 1164 wrote to memory of 4852 1164 3bbnnn.exe 103 PID 1164 wrote to memory of 4852 1164 3bbnnn.exe 103 PID 1164 wrote to memory of 4852 1164 3bbnnn.exe 103 PID 4852 wrote to memory of 1920 4852 dvpvv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\39f7ab2c42ea954636dfdb1629ec4bf1ac0e399976311321acad3dbbcc8e9b99.exe"C:\Users\Admin\AppData\Local\Temp\39f7ab2c42ea954636dfdb1629ec4bf1ac0e399976311321acad3dbbcc8e9b99.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\1dvpp.exec:\1dvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\xrllxrr.exec:\xrllxrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\rfxxxxx.exec:\rfxxxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\bttttb.exec:\bttttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\3btttt.exec:\3btttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\jdpdd.exec:\jdpdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\1rxxfxf.exec:\1rxxfxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\bntbbb.exec:\bntbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\9hhhbb.exec:\9hhhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\pdpjp.exec:\pdpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\fxxfffl.exec:\fxxfffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\tthhbh.exec:\tthhbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\dvddd.exec:\dvddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\jdpdj.exec:\jdpdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\9rllffx.exec:\9rllffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\thtbbt.exec:\thtbbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\dvjdd.exec:\dvjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\lrlfffr.exec:\lrlfffr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\xrxlxrf.exec:\xrxlxrf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\3bbnnn.exec:\3bbnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\dvpvv.exec:\dvpvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\llllfff.exec:\llllfff.exe23⤵
- Executes dropped EXE
PID:1920 -
\??\c:\btbhnn.exec:\btbhnn.exe24⤵
- Executes dropped EXE
PID:2248 -
\??\c:\jddjv.exec:\jddjv.exe25⤵
- Executes dropped EXE
PID:2820 -
\??\c:\fxxxrxx.exec:\fxxxrxx.exe26⤵
- Executes dropped EXE
PID:5052 -
\??\c:\nnthhn.exec:\nnthhn.exe27⤵
- Executes dropped EXE
PID:2140 -
\??\c:\pjjjv.exec:\pjjjv.exe28⤵
- Executes dropped EXE
PID:3436 -
\??\c:\rflflll.exec:\rflflll.exe29⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rrfffrl.exec:\rrfffrl.exe30⤵
- Executes dropped EXE
PID:5064 -
\??\c:\bhhbtn.exec:\bhhbtn.exe31⤵
- Executes dropped EXE
PID:2480 -
\??\c:\vpvvv.exec:\vpvvv.exe32⤵
- Executes dropped EXE
PID:4984 -
\??\c:\dpvpd.exec:\dpvpd.exe33⤵
- Executes dropped EXE
PID:5104 -
\??\c:\rfxrrrl.exec:\rfxrrrl.exe34⤵
- Executes dropped EXE
PID:1440 -
\??\c:\bntnnt.exec:\bntnnt.exe35⤵
- Executes dropped EXE
PID:872 -
\??\c:\bhbtnb.exec:\bhbtnb.exe36⤵
- Executes dropped EXE
PID:4292 -
\??\c:\jjdvj.exec:\jjdvj.exe37⤵
- Executes dropped EXE
PID:4436 -
\??\c:\jvppd.exec:\jvppd.exe38⤵
- Executes dropped EXE
PID:3212 -
\??\c:\lflffxx.exec:\lflffxx.exe39⤵
- Executes dropped EXE
PID:1788 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe40⤵
- Executes dropped EXE
PID:4360 -
\??\c:\nhbntb.exec:\nhbntb.exe41⤵
- Executes dropped EXE
PID:4308 -
\??\c:\1pvpj.exec:\1pvpj.exe42⤵
- Executes dropped EXE
PID:3572 -
\??\c:\7rrlffx.exec:\7rrlffx.exe43⤵
- Executes dropped EXE
PID:3892 -
\??\c:\xlrlffl.exec:\xlrlffl.exe44⤵
- Executes dropped EXE
PID:2184 -
\??\c:\ttbhnt.exec:\ttbhnt.exe45⤵
- Executes dropped EXE
PID:2920 -
\??\c:\1bhhbb.exec:\1bhhbb.exe46⤵
- Executes dropped EXE
PID:396 -
\??\c:\pdppp.exec:\pdppp.exe47⤵
- Executes dropped EXE
PID:1252 -
\??\c:\ffxxxfl.exec:\ffxxxfl.exe48⤵
- Executes dropped EXE
PID:1084 -
\??\c:\fxxffff.exec:\fxxffff.exe49⤵
- Executes dropped EXE
PID:2948 -
\??\c:\thhbth.exec:\thhbth.exe50⤵
- Executes dropped EXE
PID:1764 -
\??\c:\djpvp.exec:\djpvp.exe51⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vpvjj.exec:\vpvjj.exe52⤵
- Executes dropped EXE
PID:1960 -
\??\c:\frxrrxr.exec:\frxrrxr.exe53⤵
- Executes dropped EXE
PID:656 -
\??\c:\7htnnt.exec:\7htnnt.exe54⤵
- Executes dropped EXE
PID:3308 -
\??\c:\btbhtb.exec:\btbhtb.exe55⤵
- Executes dropped EXE
PID:4956 -
\??\c:\dpvpp.exec:\dpvpp.exe56⤵
- Executes dropped EXE
PID:1416 -
\??\c:\ffrlffx.exec:\ffrlffx.exe57⤵
- Executes dropped EXE
PID:3380 -
\??\c:\fxlffll.exec:\fxlffll.exe58⤵
- Executes dropped EXE
PID:4840 -
\??\c:\bbbbht.exec:\bbbbht.exe59⤵
- Executes dropped EXE
PID:4404 -
\??\c:\hbbhbb.exec:\hbbhbb.exe60⤵
- Executes dropped EXE
PID:4080 -
\??\c:\pjpjj.exec:\pjpjj.exe61⤵
- Executes dropped EXE
PID:1584 -
\??\c:\3rfxffr.exec:\3rfxffr.exe62⤵
- Executes dropped EXE
PID:4280 -
\??\c:\7rrxrfx.exec:\7rrxrfx.exe63⤵
- Executes dropped EXE
PID:3004 -
\??\c:\bbbbtt.exec:\bbbbtt.exe64⤵
- Executes dropped EXE
PID:3960 -
\??\c:\dvjpd.exec:\dvjpd.exe65⤵
- Executes dropped EXE
PID:2828 -
\??\c:\jvddv.exec:\jvddv.exe66⤵PID:4532
-
\??\c:\3frxxxx.exec:\3frxxxx.exe67⤵PID:3968
-
\??\c:\bbhbbt.exec:\bbhbbt.exe68⤵PID:3516
-
\??\c:\1nttbb.exec:\1nttbb.exe69⤵PID:4676
-
\??\c:\pdddd.exec:\pdddd.exe70⤵PID:2908
-
\??\c:\pvjjj.exec:\pvjjj.exe71⤵PID:2692
-
\??\c:\xfllfff.exec:\xfllfff.exe72⤵PID:2720
-
\??\c:\1rrrrll.exec:\1rrrrll.exe73⤵PID:2984
-
\??\c:\nbnbbb.exec:\nbnbbb.exe74⤵PID:5064
-
\??\c:\vjpvv.exec:\vjpvv.exe75⤵PID:3972
-
\??\c:\jjjjv.exec:\jjjjv.exe76⤵PID:3608
-
\??\c:\rrlffrx.exec:\rrlffrx.exe77⤵PID:2380
-
\??\c:\fxfxfxf.exec:\fxfxfxf.exe78⤵PID:4212
-
\??\c:\bttnnn.exec:\bttnnn.exe79⤵PID:2868
-
\??\c:\vjpjd.exec:\vjpjd.exe80⤵PID:1708
-
\??\c:\hbthbn.exec:\hbthbn.exe81⤵PID:3264
-
\??\c:\hbbthn.exec:\hbbthn.exe82⤵PID:4312
-
\??\c:\jjvvd.exec:\jjvvd.exe83⤵PID:1404
-
\??\c:\xrrfrfx.exec:\xrrfrfx.exe84⤵PID:2072
-
\??\c:\lxfffll.exec:\lxfffll.exe85⤵PID:4380
-
\??\c:\bthbhh.exec:\bthbhh.exe86⤵PID:4272
-
\??\c:\dvdvp.exec:\dvdvp.exe87⤵PID:432
-
\??\c:\rxrrrrx.exec:\rxrrrrx.exe88⤵PID:4500
-
\??\c:\hbnhhn.exec:\hbnhhn.exe89⤵PID:4812
-
\??\c:\bbbhtb.exec:\bbbhtb.exe90⤵PID:3564
-
\??\c:\pjvvd.exec:\pjvvd.exe91⤵PID:3896
-
\??\c:\vvpjj.exec:\vvpjj.exe92⤵PID:1252
-
\??\c:\fllfxxr.exec:\fllfxxr.exe93⤵PID:2128
-
\??\c:\5hnnnn.exec:\5hnnnn.exe94⤵PID:2856
-
\??\c:\nnbbnn.exec:\nnbbnn.exe95⤵PID:3164
-
\??\c:\vvjjp.exec:\vvjjp.exe96⤵PID:1076
-
\??\c:\rlffffx.exec:\rlffffx.exe97⤵PID:3560
-
\??\c:\lffffll.exec:\lffffll.exe98⤵PID:1072
-
\??\c:\nhnnnb.exec:\nhnnnb.exe99⤵PID:4652
-
\??\c:\1httnt.exec:\1httnt.exe100⤵PID:1984
-
\??\c:\5vvvp.exec:\5vvvp.exe101⤵PID:4916
-
\??\c:\rlfxfxr.exec:\rlfxfxr.exe102⤵PID:4844
-
\??\c:\9rlfrrf.exec:\9rlfrrf.exe103⤵PID:4104
-
\??\c:\tnnhhh.exec:\tnnhhh.exe104⤵PID:2624
-
\??\c:\hthbtb.exec:\hthbtb.exe105⤵PID:1208
-
\??\c:\9dpjv.exec:\9dpjv.exe106⤵PID:3208
-
\??\c:\fllfrlf.exec:\fllfrlf.exe107⤵PID:4716
-
\??\c:\ttbnbb.exec:\ttbnbb.exe108⤵PID:2392
-
\??\c:\vvjjd.exec:\vvjjd.exe109⤵PID:5096
-
\??\c:\ppjjj.exec:\ppjjj.exe110⤵PID:1920
-
\??\c:\flxxlll.exec:\flxxlll.exe111⤵PID:2248
-
\??\c:\rllllll.exec:\rllllll.exe112⤵PID:4508
-
\??\c:\hhnnnn.exec:\hhnnnn.exe113⤵PID:2780
-
\??\c:\jjpvp.exec:\jjpvp.exe114⤵PID:2620
-
\??\c:\vpvdd.exec:\vpvdd.exe115⤵PID:3632
-
\??\c:\9lxxrxr.exec:\9lxxrxr.exe116⤵PID:3436
-
\??\c:\nttbbn.exec:\nttbbn.exe117⤵PID:1280
-
\??\c:\tttnbn.exec:\tttnbn.exe118⤵PID:3592
-
\??\c:\pdddp.exec:\pdddp.exe119⤵PID:4940
-
\??\c:\pvvvj.exec:\pvvvj.exe120⤵PID:4004
-
\??\c:\frlfxff.exec:\frlfxff.exe121⤵PID:3608
-
\??\c:\pjvpj.exec:\pjvpj.exe122⤵PID:824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-