Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 23:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6b369b3c8b984e16a3465fc5e77baaea2b78d674c594b88a7e54f18dd842db02.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
-
Target
6b369b3c8b984e16a3465fc5e77baaea2b78d674c594b88a7e54f18dd842db02.exe
-
Size
76KB
-
MD5
84caa88a04483454194d721164a4e7b6
-
SHA1
dcfe83afc18498a9a97f7c466f97fb52ac65ecd2
-
SHA256
6b369b3c8b984e16a3465fc5e77baaea2b78d674c594b88a7e54f18dd842db02
-
SHA512
c828cf888b0ba31ea164916cab332d6516157d87d1658478eabc3fadd71284f5ab3704fe9ebcd9ce8e5fc9a769c504ff48a614a0d73c06b49b1a2e2ada071998
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC56r:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCQr
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/1636-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2656-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/252-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2120-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1000-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 22 IoCs
resource yara_rule behavioral2/memory/1636-5-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2924-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/408-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1176-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2656-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/252-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2120-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1380-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2332-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4704-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1292-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1664-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4928-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4848-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4104-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2452-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4796-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1000-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3032-181-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4592-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3052-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4940-197-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2924 3vvpp.exe 408 rlllfxr.exe 528 1tnnhh.exe 1176 pjdvd.exe 2656 pjdvp.exe 252 xlfrfxl.exe 820 ffllfxr.exe 2120 tnhbtn.exe 1380 dvpjd.exe 2444 9ffxrlf.exe 2332 1bttnn.exe 4704 btbtbb.exe 1432 jdvpv.exe 1292 lrrrlfx.exe 1664 bttnhh.exe 3880 vddvd.exe 4928 jpppj.exe 3252 lflxrrl.exe 4848 tnnhtn.exe 1764 nbbttn.exe 4104 djjpp.exe 2452 frlfrrl.exe 3084 lfffxxf.exe 4796 1jddv.exe 1000 pvvpp.exe 4132 fllfxxx.exe 1608 7xfxxfx.exe 3032 nttnhh.exe 4592 7jppd.exe 4940 fxrllll.exe 3052 pddpv.exe 640 djppd.exe 4648 xlfxxxx.exe 2884 tnhhbb.exe 3120 nhnhbb.exe 4544 dppjd.exe 4240 vppjd.exe 1416 hnbtnh.exe 3380 tbhbtt.exe 1944 jdvpp.exe 4364 ffxxxrr.exe 4276 rxfxrll.exe 2924 bttnnh.exe 5032 ddjvd.exe 628 pvdvp.exe 528 frxrxlx.exe 2900 nbbthb.exe 1284 pvvpd.exe 416 ddjdj.exe 3712 xxffllr.exe 4804 bbhhnh.exe 4872 hbnnnn.exe 4336 lllfrrf.exe 2444 fxxfxrr.exe 2072 hnnnhb.exe 4704 pjjjv.exe 2112 7ppdp.exe 2412 lxrlxxx.exe 2424 nbhbbb.exe 4360 vvdvp.exe 4852 vjjdv.exe 5072 lflfxrx.exe 3252 tnhhtt.exe 3192 nhnhbt.exe -
resource yara_rule behavioral2/memory/1636-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/252-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2120-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1000-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1636 wrote to memory of 2924 1636 6b369b3c8b984e16a3465fc5e77baaea2b78d674c594b88a7e54f18dd842db02.exe 82 PID 1636 wrote to memory of 2924 1636 6b369b3c8b984e16a3465fc5e77baaea2b78d674c594b88a7e54f18dd842db02.exe 82 PID 1636 wrote to memory of 2924 1636 6b369b3c8b984e16a3465fc5e77baaea2b78d674c594b88a7e54f18dd842db02.exe 82 PID 2924 wrote to memory of 408 2924 3vvpp.exe 83 PID 2924 wrote to memory of 408 2924 3vvpp.exe 83 PID 2924 wrote to memory of 408 2924 3vvpp.exe 83 PID 408 wrote to memory of 528 408 rlllfxr.exe 84 PID 408 wrote to memory of 528 408 rlllfxr.exe 84 PID 408 wrote to memory of 528 408 rlllfxr.exe 84 PID 528 wrote to memory of 1176 528 1tnnhh.exe 85 PID 528 wrote to memory of 1176 528 1tnnhh.exe 85 PID 528 wrote to memory of 1176 528 1tnnhh.exe 85 PID 1176 wrote to memory of 2656 1176 pjdvd.exe 86 PID 1176 wrote to memory of 2656 1176 pjdvd.exe 86 PID 1176 wrote to memory of 2656 1176 pjdvd.exe 86 PID 2656 wrote to memory of 252 2656 pjdvp.exe 87 PID 2656 wrote to memory of 252 2656 pjdvp.exe 87 PID 2656 wrote to memory of 252 2656 pjdvp.exe 87 PID 252 wrote to memory of 820 252 xlfrfxl.exe 88 PID 252 wrote to memory of 820 252 xlfrfxl.exe 88 PID 252 wrote to memory of 820 252 xlfrfxl.exe 88 PID 820 wrote to memory of 2120 820 ffllfxr.exe 89 PID 820 wrote to memory of 2120 820 ffllfxr.exe 89 PID 820 wrote to memory of 2120 820 ffllfxr.exe 89 PID 2120 wrote to memory of 1380 2120 tnhbtn.exe 90 PID 2120 wrote to memory of 1380 2120 tnhbtn.exe 90 PID 2120 wrote to memory of 1380 2120 tnhbtn.exe 90 PID 1380 wrote to memory of 2444 1380 dvpjd.exe 91 PID 1380 wrote to memory of 2444 1380 dvpjd.exe 91 PID 1380 wrote to memory of 2444 1380 dvpjd.exe 91 PID 2444 wrote to memory of 2332 2444 9ffxrlf.exe 92 PID 2444 wrote to memory of 2332 2444 9ffxrlf.exe 92 PID 2444 wrote to memory of 2332 2444 9ffxrlf.exe 92 PID 2332 wrote to memory of 4704 2332 1bttnn.exe 93 PID 2332 wrote to memory of 4704 2332 1bttnn.exe 93 PID 2332 wrote to memory of 4704 2332 1bttnn.exe 93 PID 4704 wrote to memory of 1432 4704 btbtbb.exe 94 PID 4704 wrote to memory of 1432 4704 btbtbb.exe 94 PID 4704 wrote to memory of 1432 4704 btbtbb.exe 94 PID 1432 wrote to memory of 1292 1432 jdvpv.exe 95 PID 1432 wrote to memory of 1292 1432 jdvpv.exe 95 PID 1432 wrote to memory of 1292 1432 jdvpv.exe 95 PID 1292 wrote to memory of 1664 1292 lrrrlfx.exe 96 PID 1292 wrote to memory of 1664 1292 lrrrlfx.exe 96 PID 1292 wrote to memory of 1664 1292 lrrrlfx.exe 96 PID 1664 wrote to memory of 3880 1664 bttnhh.exe 97 PID 1664 wrote to memory of 3880 1664 bttnhh.exe 97 PID 1664 wrote to memory of 3880 1664 bttnhh.exe 97 PID 3880 wrote to memory of 4928 3880 vddvd.exe 98 PID 3880 wrote to memory of 4928 3880 vddvd.exe 98 PID 3880 wrote to memory of 4928 3880 vddvd.exe 98 PID 4928 wrote to memory of 3252 4928 jpppj.exe 99 PID 4928 wrote to memory of 3252 4928 jpppj.exe 99 PID 4928 wrote to memory of 3252 4928 jpppj.exe 99 PID 3252 wrote to memory of 4848 3252 lflxrrl.exe 100 PID 3252 wrote to memory of 4848 3252 lflxrrl.exe 100 PID 3252 wrote to memory of 4848 3252 lflxrrl.exe 100 PID 4848 wrote to memory of 1764 4848 tnnhtn.exe 101 PID 4848 wrote to memory of 1764 4848 tnnhtn.exe 101 PID 4848 wrote to memory of 1764 4848 tnnhtn.exe 101 PID 1764 wrote to memory of 4104 1764 nbbttn.exe 102 PID 1764 wrote to memory of 4104 1764 nbbttn.exe 102 PID 1764 wrote to memory of 4104 1764 nbbttn.exe 102 PID 4104 wrote to memory of 2452 4104 djjpp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b369b3c8b984e16a3465fc5e77baaea2b78d674c594b88a7e54f18dd842db02.exe"C:\Users\Admin\AppData\Local\Temp\6b369b3c8b984e16a3465fc5e77baaea2b78d674c594b88a7e54f18dd842db02.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\3vvpp.exec:\3vvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\rlllfxr.exec:\rlllfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\1tnnhh.exec:\1tnnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\pjdvd.exec:\pjdvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\pjdvp.exec:\pjdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\xlfrfxl.exec:\xlfrfxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
\??\c:\ffllfxr.exec:\ffllfxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\tnhbtn.exec:\tnhbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\dvpjd.exec:\dvpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\9ffxrlf.exec:\9ffxrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\1bttnn.exec:\1bttnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\btbtbb.exec:\btbtbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\jdvpv.exec:\jdvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\lrrrlfx.exec:\lrrrlfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\bttnhh.exec:\bttnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\vddvd.exec:\vddvd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\jpppj.exec:\jpppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\lflxrrl.exec:\lflxrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\tnnhtn.exec:\tnnhtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\nbbttn.exec:\nbbttn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\djjpp.exec:\djjpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\frlfrrl.exec:\frlfrrl.exe23⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lfffxxf.exec:\lfffxxf.exe24⤵
- Executes dropped EXE
PID:3084 -
\??\c:\1jddv.exec:\1jddv.exe25⤵
- Executes dropped EXE
PID:4796 -
\??\c:\pvvpp.exec:\pvvpp.exe26⤵
- Executes dropped EXE
PID:1000 -
\??\c:\fllfxxx.exec:\fllfxxx.exe27⤵
- Executes dropped EXE
PID:4132 -
\??\c:\7xfxxfx.exec:\7xfxxfx.exe28⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nttnhh.exec:\nttnhh.exe29⤵
- Executes dropped EXE
PID:3032 -
\??\c:\7jppd.exec:\7jppd.exe30⤵
- Executes dropped EXE
PID:4592 -
\??\c:\fxrllll.exec:\fxrllll.exe31⤵
- Executes dropped EXE
PID:4940 -
\??\c:\pddpv.exec:\pddpv.exe32⤵
- Executes dropped EXE
PID:3052 -
\??\c:\djppd.exec:\djppd.exe33⤵
- Executes dropped EXE
PID:640 -
\??\c:\xlfxxxx.exec:\xlfxxxx.exe34⤵
- Executes dropped EXE
PID:4648 -
\??\c:\tnhhbb.exec:\tnhhbb.exe35⤵
- Executes dropped EXE
PID:2884 -
\??\c:\nhnhbb.exec:\nhnhbb.exe36⤵
- Executes dropped EXE
PID:3120 -
\??\c:\dppjd.exec:\dppjd.exe37⤵
- Executes dropped EXE
PID:4544 -
\??\c:\vppjd.exec:\vppjd.exe38⤵
- Executes dropped EXE
PID:4240 -
\??\c:\hnbtnh.exec:\hnbtnh.exe39⤵
- Executes dropped EXE
PID:1416 -
\??\c:\tbhbtt.exec:\tbhbtt.exe40⤵
- Executes dropped EXE
PID:3380 -
\??\c:\jdvpp.exec:\jdvpp.exe41⤵
- Executes dropped EXE
PID:1944 -
\??\c:\ffxxxrr.exec:\ffxxxrr.exe42⤵
- Executes dropped EXE
PID:4364 -
\??\c:\rxfxrll.exec:\rxfxrll.exe43⤵
- Executes dropped EXE
PID:4276 -
\??\c:\bttnnh.exec:\bttnnh.exe44⤵
- Executes dropped EXE
PID:2924 -
\??\c:\ddjvd.exec:\ddjvd.exe45⤵
- Executes dropped EXE
PID:5032 -
\??\c:\pvdvp.exec:\pvdvp.exe46⤵
- Executes dropped EXE
PID:628 -
\??\c:\frxrxlx.exec:\frxrxlx.exe47⤵
- Executes dropped EXE
PID:528 -
\??\c:\nbbthb.exec:\nbbthb.exe48⤵
- Executes dropped EXE
PID:2900 -
\??\c:\pvvpd.exec:\pvvpd.exe49⤵
- Executes dropped EXE
PID:1284 -
\??\c:\ddjdj.exec:\ddjdj.exe50⤵
- Executes dropped EXE
PID:416 -
\??\c:\xxffllr.exec:\xxffllr.exe51⤵
- Executes dropped EXE
PID:3712 -
\??\c:\bbhhnh.exec:\bbhhnh.exe52⤵
- Executes dropped EXE
PID:4804 -
\??\c:\hbnnnn.exec:\hbnnnn.exe53⤵
- Executes dropped EXE
PID:4872 -
\??\c:\lllfrrf.exec:\lllfrrf.exe54⤵
- Executes dropped EXE
PID:4336 -
\??\c:\fxxfxrr.exec:\fxxfxrr.exe55⤵
- Executes dropped EXE
PID:2444 -
\??\c:\hnnnhb.exec:\hnnnhb.exe56⤵
- Executes dropped EXE
PID:2072 -
\??\c:\pjjjv.exec:\pjjjv.exe57⤵
- Executes dropped EXE
PID:4704 -
\??\c:\7ppdp.exec:\7ppdp.exe58⤵
- Executes dropped EXE
PID:2112 -
\??\c:\lxrlxxx.exec:\lxrlxxx.exe59⤵
- Executes dropped EXE
PID:2412 -
\??\c:\nbhbbb.exec:\nbhbbb.exe60⤵
- Executes dropped EXE
PID:2424 -
\??\c:\vvdvp.exec:\vvdvp.exe61⤵
- Executes dropped EXE
PID:4360 -
\??\c:\vjjdv.exec:\vjjdv.exe62⤵
- Executes dropped EXE
PID:4852 -
\??\c:\lflfxrx.exec:\lflfxrx.exe63⤵
- Executes dropped EXE
PID:5072 -
\??\c:\tnhhtt.exec:\tnhhtt.exe64⤵
- Executes dropped EXE
PID:3252 -
\??\c:\nhnhbt.exec:\nhnhbt.exe65⤵
- Executes dropped EXE
PID:3192 -
\??\c:\pdvpd.exec:\pdvpd.exe66⤵PID:3708
-
\??\c:\xrlxrlf.exec:\xrlxrlf.exe67⤵PID:4880
-
\??\c:\tthhbb.exec:\tthhbb.exe68⤵PID:680
-
\??\c:\vddvp.exec:\vddvp.exe69⤵PID:4620
-
\??\c:\xxflrxl.exec:\xxflrxl.exe70⤵PID:1600
-
\??\c:\tthbhh.exec:\tthbhh.exe71⤵PID:5060
-
\??\c:\vjdvd.exec:\vjdvd.exe72⤵PID:1000
-
\??\c:\7dvpj.exec:\7dvpj.exe73⤵PID:1524
-
\??\c:\rllfxxf.exec:\rllfxxf.exe74⤵PID:2812
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe75⤵PID:2092
-
\??\c:\tbbttt.exec:\tbbttt.exe76⤵PID:3608
-
\??\c:\djppd.exec:\djppd.exe77⤵PID:468
-
\??\c:\ppdjp.exec:\ppdjp.exe78⤵PID:2384
-
\??\c:\llrlrrf.exec:\llrlrrf.exe79⤵PID:2996
-
\??\c:\lrrrxxr.exec:\lrrrxxr.exe80⤵PID:3544
-
\??\c:\hnnhbb.exec:\hnnhbb.exe81⤵PID:4116
-
\??\c:\hhnhhh.exec:\hhnhhh.exe82⤵PID:3748
-
\??\c:\jpvpp.exec:\jpvpp.exe83⤵PID:4960
-
\??\c:\pjjjp.exec:\pjjjp.exe84⤵PID:1276
-
\??\c:\rxxllfl.exec:\rxxllfl.exe85⤵PID:4468
-
\??\c:\tnbbhh.exec:\tnbbhh.exe86⤵PID:5076
-
\??\c:\hnbttn.exec:\hnbttn.exe87⤵PID:224
-
\??\c:\jjpjv.exec:\jjpjv.exe88⤵PID:1944
-
\??\c:\5pvpd.exec:\5pvpd.exe89⤵PID:4152
-
\??\c:\xrxxrrx.exec:\xrxxrrx.exe90⤵PID:4280
-
\??\c:\9rrrllf.exec:\9rrrllf.exe91⤵PID:4636
-
\??\c:\bbhtnn.exec:\bbhtnn.exe92⤵PID:3520
-
\??\c:\bbtnhn.exec:\bbtnhn.exe93⤵PID:1176
-
\??\c:\vppjd.exec:\vppjd.exe94⤵PID:1548
-
\??\c:\jddjp.exec:\jddjp.exe95⤵PID:2900
-
\??\c:\vpvpj.exec:\vpvpj.exe96⤵PID:2692
-
\??\c:\frlfrlf.exec:\frlfrlf.exe97⤵PID:416
-
\??\c:\lflrxrf.exec:\lflrxrf.exe98⤵PID:2764
-
\??\c:\hbthbh.exec:\hbthbh.exe99⤵PID:4756
-
\??\c:\dppjd.exec:\dppjd.exe100⤵PID:4952
-
\??\c:\5ppjv.exec:\5ppjv.exe101⤵PID:5068
-
\??\c:\vpppp.exec:\vpppp.exe102⤵PID:3392
-
\??\c:\5llflfx.exec:\5llflfx.exe103⤵PID:4976
-
\??\c:\lfflfll.exec:\lfflfll.exe104⤵PID:1392
-
\??\c:\nhhhbb.exec:\nhhhbb.exe105⤵PID:664
-
\??\c:\btbbtn.exec:\btbbtn.exe106⤵PID:1880
-
\??\c:\1jjpd.exec:\1jjpd.exe107⤵PID:4604
-
\??\c:\vvvdj.exec:\vvvdj.exe108⤵PID:4528
-
\??\c:\xfffrrl.exec:\xfffrrl.exe109⤵PID:3300
-
\??\c:\xxlffxx.exec:\xxlffxx.exe110⤵PID:2788
-
\??\c:\5frlfll.exec:\5frlfll.exe111⤵PID:1668
-
\??\c:\tnnbbb.exec:\tnnbbb.exe112⤵PID:4016
-
\??\c:\tbbtnn.exec:\tbbtnn.exe113⤵PID:2740
-
\??\c:\dpjjd.exec:\dpjjd.exe114⤵PID:2592
-
\??\c:\jddvp.exec:\jddvp.exe115⤵PID:3488
-
\??\c:\xfllllf.exec:\xfllllf.exe116⤵PID:4620
-
\??\c:\xrllffx.exec:\xrllffx.exe117⤵PID:2524
-
\??\c:\3bhbnn.exec:\3bhbnn.exe118⤵PID:64
-
\??\c:\bhhbtn.exec:\bhhbtn.exe119⤵PID:2308
-
\??\c:\pjvvj.exec:\pjvvj.exe120⤵PID:4496
-
\??\c:\dpvpp.exec:\dpvpp.exe121⤵PID:2092
-
\??\c:\lfxxflr.exec:\lfxxflr.exe122⤵PID:4876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-