Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 21:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4af2cd7e06ca7250693c47bd879df946de86b9be49be80a1a143ae346155491c.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
4af2cd7e06ca7250693c47bd879df946de86b9be49be80a1a143ae346155491c.exe
-
Size
65KB
-
MD5
1d3b49c07e7cd1f47eaaea5eabac9d89
-
SHA1
13d6f7dab4e015be724e86045f09548f14709ec2
-
SHA256
4af2cd7e06ca7250693c47bd879df946de86b9be49be80a1a143ae346155491c
-
SHA512
0d4e69c3d0d510d82667971ff3ba0362e200ca845035319feb9ab3f59e2440c7a94677d907ed908a8ad6b6334d9ccbc5028c964031f373cf6f08beed91e11d82
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6Mu/ePS3AyXmPD:ymb3NkkiQ3mdBjFI46TQyXmPD
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/3516-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/684-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1672-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4188-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-699-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 25 IoCs
resource yara_rule behavioral2/memory/3516-5-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3476-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4140-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3988-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4856-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3880-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4856-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1448-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3060-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4576-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1620-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4740-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2744-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1804-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3364-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4056-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3424-108-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5024-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/684-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1672-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/388-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/516-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4188-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4400-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3060-699-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3476 680488.exe 4140 82008.exe 3988 pddpd.exe 3880 rxrlffx.exe 4856 06860.exe 1448 rrlfrrl.exe 4576 604000.exe 3060 i448660.exe 1620 u404266.exe 4740 80644.exe 2744 006088.exe 1804 4804266.exe 3364 462204.exe 4056 6466442.exe 3424 ttthbt.exe 4532 xrrlffx.exe 1612 08420.exe 3300 4404408.exe 5024 4026464.exe 684 4248488.exe 1672 vdvpj.exe 4236 06848.exe 388 fxrfxrr.exe 2712 4844882.exe 516 flllffx.exe 4468 1jjjp.exe 4920 lxlffff.exe 4188 jdjdd.exe 3104 xxllrrx.exe 4400 40444.exe 2352 1xfxllf.exe 4296 nbhhhh.exe 3564 c800466.exe 3956 jvvpv.exe 5056 0282226.exe 948 vvvvv.exe 3780 828200.exe 788 7djpd.exe 1160 nbbttt.exe 1560 624888.exe 4572 46826.exe 3268 800804.exe 2452 24048.exe 3476 flrlllf.exe 1056 7tbttn.exe 2704 60840.exe 3760 62448.exe 4804 xrrfflf.exe 1580 282288.exe 3092 nhnttt.exe 4148 280006.exe 4576 rfffxrr.exe 2136 606622.exe 1952 226668.exe 1620 4400004.exe 4508 ppjpp.exe 1940 fxfxxfl.exe 1396 rrxxffx.exe 2420 pjvvv.exe 4244 lffxxrr.exe 1120 24628.exe 1332 pjjjd.exe 3664 frfrllf.exe 3416 20428.exe -
resource yara_rule behavioral2/memory/3516-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/684-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4188-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-699-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3516 wrote to memory of 3476 3516 4af2cd7e06ca7250693c47bd879df946de86b9be49be80a1a143ae346155491c.exe 82 PID 3516 wrote to memory of 3476 3516 4af2cd7e06ca7250693c47bd879df946de86b9be49be80a1a143ae346155491c.exe 82 PID 3516 wrote to memory of 3476 3516 4af2cd7e06ca7250693c47bd879df946de86b9be49be80a1a143ae346155491c.exe 82 PID 3476 wrote to memory of 4140 3476 680488.exe 83 PID 3476 wrote to memory of 4140 3476 680488.exe 83 PID 3476 wrote to memory of 4140 3476 680488.exe 83 PID 4140 wrote to memory of 3988 4140 82008.exe 84 PID 4140 wrote to memory of 3988 4140 82008.exe 84 PID 4140 wrote to memory of 3988 4140 82008.exe 84 PID 3988 wrote to memory of 3880 3988 pddpd.exe 85 PID 3988 wrote to memory of 3880 3988 pddpd.exe 85 PID 3988 wrote to memory of 3880 3988 pddpd.exe 85 PID 3880 wrote to memory of 4856 3880 rxrlffx.exe 86 PID 3880 wrote to memory of 4856 3880 rxrlffx.exe 86 PID 3880 wrote to memory of 4856 3880 rxrlffx.exe 86 PID 4856 wrote to memory of 1448 4856 06860.exe 87 PID 4856 wrote to memory of 1448 4856 06860.exe 87 PID 4856 wrote to memory of 1448 4856 06860.exe 87 PID 1448 wrote to memory of 4576 1448 rrlfrrl.exe 88 PID 1448 wrote to memory of 4576 1448 rrlfrrl.exe 88 PID 1448 wrote to memory of 4576 1448 rrlfrrl.exe 88 PID 4576 wrote to memory of 3060 4576 604000.exe 89 PID 4576 wrote to memory of 3060 4576 604000.exe 89 PID 4576 wrote to memory of 3060 4576 604000.exe 89 PID 3060 wrote to memory of 1620 3060 i448660.exe 91 PID 3060 wrote to memory of 1620 3060 i448660.exe 91 PID 3060 wrote to memory of 1620 3060 i448660.exe 91 PID 1620 wrote to memory of 4740 1620 u404266.exe 92 PID 1620 wrote to memory of 4740 1620 u404266.exe 92 PID 1620 wrote to memory of 4740 1620 u404266.exe 92 PID 4740 wrote to memory of 2744 4740 80644.exe 93 PID 4740 wrote to memory of 2744 4740 80644.exe 93 PID 4740 wrote to memory of 2744 4740 80644.exe 93 PID 2744 wrote to memory of 1804 2744 006088.exe 94 PID 2744 wrote to memory of 1804 2744 006088.exe 94 PID 2744 wrote to memory of 1804 2744 006088.exe 94 PID 1804 wrote to memory of 3364 1804 4804266.exe 96 PID 1804 wrote to memory of 3364 1804 4804266.exe 96 PID 1804 wrote to memory of 3364 1804 4804266.exe 96 PID 3364 wrote to memory of 4056 3364 462204.exe 97 PID 3364 wrote to memory of 4056 3364 462204.exe 97 PID 3364 wrote to memory of 4056 3364 462204.exe 97 PID 4056 wrote to memory of 3424 4056 6466442.exe 98 PID 4056 wrote to memory of 3424 4056 6466442.exe 98 PID 4056 wrote to memory of 3424 4056 6466442.exe 98 PID 3424 wrote to memory of 4532 3424 ttthbt.exe 99 PID 3424 wrote to memory of 4532 3424 ttthbt.exe 99 PID 3424 wrote to memory of 4532 3424 ttthbt.exe 99 PID 4532 wrote to memory of 1612 4532 xrrlffx.exe 100 PID 4532 wrote to memory of 1612 4532 xrrlffx.exe 100 PID 4532 wrote to memory of 1612 4532 xrrlffx.exe 100 PID 1612 wrote to memory of 3300 1612 08420.exe 101 PID 1612 wrote to memory of 3300 1612 08420.exe 101 PID 1612 wrote to memory of 3300 1612 08420.exe 101 PID 3300 wrote to memory of 5024 3300 4404408.exe 102 PID 3300 wrote to memory of 5024 3300 4404408.exe 102 PID 3300 wrote to memory of 5024 3300 4404408.exe 102 PID 5024 wrote to memory of 684 5024 4026464.exe 103 PID 5024 wrote to memory of 684 5024 4026464.exe 103 PID 5024 wrote to memory of 684 5024 4026464.exe 103 PID 684 wrote to memory of 1672 684 4248488.exe 104 PID 684 wrote to memory of 1672 684 4248488.exe 104 PID 684 wrote to memory of 1672 684 4248488.exe 104 PID 1672 wrote to memory of 4236 1672 vdvpj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\4af2cd7e06ca7250693c47bd879df946de86b9be49be80a1a143ae346155491c.exe"C:\Users\Admin\AppData\Local\Temp\4af2cd7e06ca7250693c47bd879df946de86b9be49be80a1a143ae346155491c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\680488.exec:\680488.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\82008.exec:\82008.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\pddpd.exec:\pddpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\rxrlffx.exec:\rxrlffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\06860.exec:\06860.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\rrlfrrl.exec:\rrlfrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\604000.exec:\604000.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\i448660.exec:\i448660.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\u404266.exec:\u404266.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\80644.exec:\80644.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\006088.exec:\006088.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\4804266.exec:\4804266.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\462204.exec:\462204.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\6466442.exec:\6466442.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\ttthbt.exec:\ttthbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\xrrlffx.exec:\xrrlffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\08420.exec:\08420.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\4404408.exec:\4404408.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\4026464.exec:\4026464.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\4248488.exec:\4248488.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\vdvpj.exec:\vdvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\06848.exec:\06848.exe23⤵
- Executes dropped EXE
PID:4236 -
\??\c:\fxrfxrr.exec:\fxrfxrr.exe24⤵
- Executes dropped EXE
PID:388 -
\??\c:\4844882.exec:\4844882.exe25⤵
- Executes dropped EXE
PID:2712 -
\??\c:\flllffx.exec:\flllffx.exe26⤵
- Executes dropped EXE
PID:516 -
\??\c:\1jjjp.exec:\1jjjp.exe27⤵
- Executes dropped EXE
PID:4468 -
\??\c:\lxlffff.exec:\lxlffff.exe28⤵
- Executes dropped EXE
PID:4920 -
\??\c:\jdjdd.exec:\jdjdd.exe29⤵
- Executes dropped EXE
PID:4188 -
\??\c:\xxllrrx.exec:\xxllrrx.exe30⤵
- Executes dropped EXE
PID:3104 -
\??\c:\40444.exec:\40444.exe31⤵
- Executes dropped EXE
PID:4400 -
\??\c:\1xfxllf.exec:\1xfxllf.exe32⤵
- Executes dropped EXE
PID:2352 -
\??\c:\nbhhhh.exec:\nbhhhh.exe33⤵
- Executes dropped EXE
PID:4296 -
\??\c:\c800466.exec:\c800466.exe34⤵
- Executes dropped EXE
PID:3564 -
\??\c:\jvvpv.exec:\jvvpv.exe35⤵
- Executes dropped EXE
PID:3956 -
\??\c:\0282226.exec:\0282226.exe36⤵
- Executes dropped EXE
PID:5056 -
\??\c:\vvvvv.exec:\vvvvv.exe37⤵
- Executes dropped EXE
PID:948 -
\??\c:\828200.exec:\828200.exe38⤵
- Executes dropped EXE
PID:3780 -
\??\c:\7djpd.exec:\7djpd.exe39⤵
- Executes dropped EXE
PID:788 -
\??\c:\nbbttt.exec:\nbbttt.exe40⤵
- Executes dropped EXE
PID:1160 -
\??\c:\624888.exec:\624888.exe41⤵
- Executes dropped EXE
PID:1560 -
\??\c:\46826.exec:\46826.exe42⤵
- Executes dropped EXE
PID:4572 -
\??\c:\800804.exec:\800804.exe43⤵
- Executes dropped EXE
PID:3268 -
\??\c:\24048.exec:\24048.exe44⤵
- Executes dropped EXE
PID:2452 -
\??\c:\flrlllf.exec:\flrlllf.exe45⤵
- Executes dropped EXE
PID:3476 -
\??\c:\7tbttn.exec:\7tbttn.exe46⤵
- Executes dropped EXE
PID:1056 -
\??\c:\60840.exec:\60840.exe47⤵
- Executes dropped EXE
PID:2704 -
\??\c:\62448.exec:\62448.exe48⤵
- Executes dropped EXE
PID:3760 -
\??\c:\xrrfflf.exec:\xrrfflf.exe49⤵
- Executes dropped EXE
PID:4804 -
\??\c:\282288.exec:\282288.exe50⤵
- Executes dropped EXE
PID:1580 -
\??\c:\nhnttt.exec:\nhnttt.exe51⤵
- Executes dropped EXE
PID:3092 -
\??\c:\280006.exec:\280006.exe52⤵
- Executes dropped EXE
PID:4148 -
\??\c:\rfffxrr.exec:\rfffxrr.exe53⤵
- Executes dropped EXE
PID:4576 -
\??\c:\606622.exec:\606622.exe54⤵
- Executes dropped EXE
PID:2136 -
\??\c:\226668.exec:\226668.exe55⤵
- Executes dropped EXE
PID:1952 -
\??\c:\4400004.exec:\4400004.exe56⤵
- Executes dropped EXE
PID:1620 -
\??\c:\ppjpp.exec:\ppjpp.exe57⤵
- Executes dropped EXE
PID:4508 -
\??\c:\fxfxxfl.exec:\fxfxxfl.exe58⤵
- Executes dropped EXE
PID:1940 -
\??\c:\rrxxffx.exec:\rrxxffx.exe59⤵
- Executes dropped EXE
PID:1396 -
\??\c:\pjvvv.exec:\pjvvv.exe60⤵
- Executes dropped EXE
PID:2420 -
\??\c:\lffxxrr.exec:\lffxxrr.exe61⤵
- Executes dropped EXE
PID:4244 -
\??\c:\24628.exec:\24628.exe62⤵
- Executes dropped EXE
PID:1120 -
\??\c:\pjjjd.exec:\pjjjd.exe63⤵
- Executes dropped EXE
PID:1332 -
\??\c:\frfrllf.exec:\frfrllf.exe64⤵
- Executes dropped EXE
PID:3664 -
\??\c:\20428.exec:\20428.exe65⤵
- Executes dropped EXE
PID:3416 -
\??\c:\jjpjd.exec:\jjpjd.exe66⤵PID:1440
-
\??\c:\2404226.exec:\2404226.exe67⤵PID:2548
-
\??\c:\ffxrlfx.exec:\ffxrlfx.exe68⤵PID:372
-
\??\c:\dpddd.exec:\dpddd.exe69⤵PID:800
-
\??\c:\400020.exec:\400020.exe70⤵PID:1204
-
\??\c:\2420488.exec:\2420488.exe71⤵PID:4252
-
\??\c:\btnhhh.exec:\btnhhh.exe72⤵PID:688
-
\??\c:\jdddp.exec:\jdddp.exe73⤵PID:1872
-
\??\c:\668888.exec:\668888.exe74⤵PID:3736
-
\??\c:\ffxxrxx.exec:\ffxxrxx.exe75⤵PID:512
-
\??\c:\020044.exec:\020044.exe76⤵PID:2104
-
\??\c:\jjpjj.exec:\jjpjj.exe77⤵PID:2712
-
\??\c:\dvpjv.exec:\dvpjv.exe78⤵PID:2984
-
\??\c:\606002.exec:\606002.exe79⤵PID:4084
-
\??\c:\0026226.exec:\0026226.exe80⤵PID:4036
-
\??\c:\26682.exec:\26682.exe81⤵PID:2320
-
\??\c:\402604.exec:\402604.exe82⤵PID:1252
-
\??\c:\nbbbbb.exec:\nbbbbb.exe83⤵PID:5020
-
\??\c:\8844822.exec:\8844822.exe84⤵PID:4664
-
\??\c:\7hhhhn.exec:\7hhhhn.exe85⤵PID:3188
-
\??\c:\bttnbb.exec:\bttnbb.exe86⤵PID:3920
-
\??\c:\26626.exec:\26626.exe87⤵PID:2140
-
\??\c:\2848282.exec:\2848282.exe88⤵PID:3480
-
\??\c:\hbhbhh.exec:\hbhbhh.exe89⤵PID:2672
-
\??\c:\xflfrrr.exec:\xflfrrr.exe90⤵PID:1868
-
\??\c:\jjdjd.exec:\jjdjd.exe91⤵PID:4200
-
\??\c:\2626444.exec:\2626444.exe92⤵PID:1388
-
\??\c:\rrxxllr.exec:\rrxxllr.exe93⤵PID:4916
-
\??\c:\82440.exec:\82440.exe94⤵PID:844
-
\??\c:\lrxrllf.exec:\lrxrllf.exe95⤵PID:4348
-
\??\c:\008248.exec:\008248.exe96⤵PID:3304
-
\??\c:\80282.exec:\80282.exe97⤵PID:4644
-
\??\c:\pvdvj.exec:\pvdvj.exe98⤵PID:4104
-
\??\c:\m4822.exec:\m4822.exe99⤵PID:3148
-
\??\c:\rlxrfxr.exec:\rlxrfxr.exe100⤵PID:3476
-
\??\c:\bbthbt.exec:\bbthbt.exe101⤵PID:2212
-
\??\c:\82400.exec:\82400.exe102⤵PID:4288
-
\??\c:\xfxrlxr.exec:\xfxrlxr.exe103⤵PID:1800
-
\??\c:\2882608.exec:\2882608.exe104⤵PID:4436
-
\??\c:\86042.exec:\86042.exe105⤵PID:2384
-
\??\c:\48064.exec:\48064.exe106⤵PID:2464
-
\??\c:\1bhhtb.exec:\1bhhtb.exe107⤵PID:3924
-
\??\c:\84608.exec:\84608.exe108⤵PID:2896
-
\??\c:\846422.exec:\846422.exe109⤵PID:1432
-
\??\c:\64486.exec:\64486.exe110⤵PID:1356
-
\??\c:\vdjdp.exec:\vdjdp.exe111⤵PID:2868
-
\??\c:\vdpjd.exec:\vdpjd.exe112⤵PID:2744
-
\??\c:\m6402.exec:\m6402.exe113⤵PID:3628
-
\??\c:\446082.exec:\446082.exe114⤵PID:3380
-
\??\c:\dvpjd.exec:\dvpjd.exe115⤵PID:4116
-
\??\c:\vpvvp.exec:\vpvvp.exe116⤵PID:3228
-
\??\c:\428428.exec:\428428.exe117⤵PID:1504
-
\??\c:\rlxllfl.exec:\rlxllfl.exe118⤵PID:4960
-
\??\c:\2626004.exec:\2626004.exe119⤵PID:992
-
\??\c:\tbtnhh.exec:\tbtnhh.exe120⤵PID:1796
-
\??\c:\202004.exec:\202004.exe121⤵PID:3256
-
\??\c:\6048260.exec:\6048260.exe122⤵PID:4072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-