Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 12:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a95eabee5fba7dd9b6b3e52f14148e9c5e6fb297b2fb5e2df33387ad0478ab2.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5a95eabee5fba7dd9b6b3e52f14148e9c5e6fb297b2fb5e2df33387ad0478ab2.exe
-
Size
75KB
-
MD5
c8b7340b884ce99d9b011dc9fec0e09f
-
SHA1
ee65c5c214ca4dd749f917be532c2a7e1a312630
-
SHA256
5a95eabee5fba7dd9b6b3e52f14148e9c5e6fb297b2fb5e2df33387ad0478ab2
-
SHA512
07a4e2702750e9a67706845a8fcdfa4892bb1f57ffe677b9e9a705bf4749a5e405e0ffc11f216b1fe44f22187ee3ee54f3e44bfe7c609a1d65085763fa3fc924
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDWiekja1br3GGBxfot0ijs:ymb3NkkiQ3mdBjFWXkj7afoS
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2144-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3552-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4664-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/892-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1752 nthbnb.exe 2900 dvjdv.exe 4428 flxflfx.exe 764 htttbb.exe 4520 djvvd.exe 4232 dddvv.exe 3004 xlfrxrx.exe 3576 nhttbh.exe 5004 vddjv.exe 4504 lffllll.exe 3828 frrlrrr.exe 4244 3jjdv.exe 4928 lrfllfx.exe 4692 pjppp.exe 3552 vvjdd.exe 1824 llrrrlr.exe 1764 hbbtnn.exe 4664 jpjdp.exe 892 jdddp.exe 4748 7xrfrrl.exe 2228 1hhhhn.exe 3224 djjjv.exe 3388 frllflf.exe 1300 nthbth.exe 1704 7jppp.exe 4060 flflrxl.exe 2640 vjpjd.exe 2592 fxxxxxr.exe 2996 bththn.exe 3232 pjpjp.exe 2568 ppjjd.exe 5052 rlrlffx.exe 2932 thhhbb.exe 3484 9tbbnn.exe 4780 pjjdd.exe 1216 5ddvp.exe 3220 rrxxrff.exe 2164 frxrrrl.exe 4644 ttbbtt.exe 4420 btbtnn.exe 3740 jdjpd.exe 4556 9dpdv.exe 3280 djvdv.exe 1448 fxfrllx.exe 1360 rlllrxx.exe 4608 bthhtt.exe 940 bbnnbb.exe 1496 5vddp.exe 312 dvddv.exe 544 lllfrrr.exe 2944 9xxfxrx.exe 808 nnnhbb.exe 3520 7nbttt.exe 2892 jvdpp.exe 2680 djjjv.exe 3056 vvddp.exe 1660 lfrlfxx.exe 4536 nbbbtn.exe 3568 pjppv.exe 4928 dpddd.exe 4004 fxxxrfx.exe 2360 xrxrllx.exe 3848 hntbbn.exe 408 dvppv.exe -
resource yara_rule behavioral2/memory/2144-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3552-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/892-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2144 wrote to memory of 1752 2144 5a95eabee5fba7dd9b6b3e52f14148e9c5e6fb297b2fb5e2df33387ad0478ab2.exe 82 PID 2144 wrote to memory of 1752 2144 5a95eabee5fba7dd9b6b3e52f14148e9c5e6fb297b2fb5e2df33387ad0478ab2.exe 82 PID 2144 wrote to memory of 1752 2144 5a95eabee5fba7dd9b6b3e52f14148e9c5e6fb297b2fb5e2df33387ad0478ab2.exe 82 PID 1752 wrote to memory of 2900 1752 nthbnb.exe 83 PID 1752 wrote to memory of 2900 1752 nthbnb.exe 83 PID 1752 wrote to memory of 2900 1752 nthbnb.exe 83 PID 2900 wrote to memory of 4428 2900 dvjdv.exe 84 PID 2900 wrote to memory of 4428 2900 dvjdv.exe 84 PID 2900 wrote to memory of 4428 2900 dvjdv.exe 84 PID 4428 wrote to memory of 764 4428 flxflfx.exe 85 PID 4428 wrote to memory of 764 4428 flxflfx.exe 85 PID 4428 wrote to memory of 764 4428 flxflfx.exe 85 PID 764 wrote to memory of 4520 764 htttbb.exe 86 PID 764 wrote to memory of 4520 764 htttbb.exe 86 PID 764 wrote to memory of 4520 764 htttbb.exe 86 PID 4520 wrote to memory of 4232 4520 djvvd.exe 87 PID 4520 wrote to memory of 4232 4520 djvvd.exe 87 PID 4520 wrote to memory of 4232 4520 djvvd.exe 87 PID 4232 wrote to memory of 3004 4232 dddvv.exe 88 PID 4232 wrote to memory of 3004 4232 dddvv.exe 88 PID 4232 wrote to memory of 3004 4232 dddvv.exe 88 PID 3004 wrote to memory of 3576 3004 xlfrxrx.exe 89 PID 3004 wrote to memory of 3576 3004 xlfrxrx.exe 89 PID 3004 wrote to memory of 3576 3004 xlfrxrx.exe 89 PID 3576 wrote to memory of 5004 3576 nhttbh.exe 90 PID 3576 wrote to memory of 5004 3576 nhttbh.exe 90 PID 3576 wrote to memory of 5004 3576 nhttbh.exe 90 PID 5004 wrote to memory of 4504 5004 vddjv.exe 91 PID 5004 wrote to memory of 4504 5004 vddjv.exe 91 PID 5004 wrote to memory of 4504 5004 vddjv.exe 91 PID 4504 wrote to memory of 3828 4504 lffllll.exe 92 PID 4504 wrote to memory of 3828 4504 lffllll.exe 92 PID 4504 wrote to memory of 3828 4504 lffllll.exe 92 PID 3828 wrote to memory of 4244 3828 frrlrrr.exe 93 PID 3828 wrote to memory of 4244 3828 frrlrrr.exe 93 PID 3828 wrote to memory of 4244 3828 frrlrrr.exe 93 PID 4244 wrote to memory of 4928 4244 3jjdv.exe 94 PID 4244 wrote to memory of 4928 4244 3jjdv.exe 94 PID 4244 wrote to memory of 4928 4244 3jjdv.exe 94 PID 4928 wrote to memory of 4692 4928 lrfllfx.exe 95 PID 4928 wrote to memory of 4692 4928 lrfllfx.exe 95 PID 4928 wrote to memory of 4692 4928 lrfllfx.exe 95 PID 4692 wrote to memory of 3552 4692 pjppp.exe 96 PID 4692 wrote to memory of 3552 4692 pjppp.exe 96 PID 4692 wrote to memory of 3552 4692 pjppp.exe 96 PID 3552 wrote to memory of 1824 3552 vvjdd.exe 97 PID 3552 wrote to memory of 1824 3552 vvjdd.exe 97 PID 3552 wrote to memory of 1824 3552 vvjdd.exe 97 PID 1824 wrote to memory of 1764 1824 llrrrlr.exe 98 PID 1824 wrote to memory of 1764 1824 llrrrlr.exe 98 PID 1824 wrote to memory of 1764 1824 llrrrlr.exe 98 PID 1764 wrote to memory of 4664 1764 hbbtnn.exe 99 PID 1764 wrote to memory of 4664 1764 hbbtnn.exe 99 PID 1764 wrote to memory of 4664 1764 hbbtnn.exe 99 PID 4664 wrote to memory of 892 4664 jpjdp.exe 100 PID 4664 wrote to memory of 892 4664 jpjdp.exe 100 PID 4664 wrote to memory of 892 4664 jpjdp.exe 100 PID 892 wrote to memory of 4748 892 jdddp.exe 101 PID 892 wrote to memory of 4748 892 jdddp.exe 101 PID 892 wrote to memory of 4748 892 jdddp.exe 101 PID 4748 wrote to memory of 2228 4748 7xrfrrl.exe 103 PID 4748 wrote to memory of 2228 4748 7xrfrrl.exe 103 PID 4748 wrote to memory of 2228 4748 7xrfrrl.exe 103 PID 2228 wrote to memory of 3224 2228 1hhhhn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a95eabee5fba7dd9b6b3e52f14148e9c5e6fb297b2fb5e2df33387ad0478ab2.exe"C:\Users\Admin\AppData\Local\Temp\5a95eabee5fba7dd9b6b3e52f14148e9c5e6fb297b2fb5e2df33387ad0478ab2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\nthbnb.exec:\nthbnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\dvjdv.exec:\dvjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\flxflfx.exec:\flxflfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\htttbb.exec:\htttbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\djvvd.exec:\djvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\dddvv.exec:\dddvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\xlfrxrx.exec:\xlfrxrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\nhttbh.exec:\nhttbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\vddjv.exec:\vddjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\lffllll.exec:\lffllll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\frrlrrr.exec:\frrlrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\3jjdv.exec:\3jjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\lrfllfx.exec:\lrfllfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\pjppp.exec:\pjppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\vvjdd.exec:\vvjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\llrrrlr.exec:\llrrrlr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\hbbtnn.exec:\hbbtnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\jpjdp.exec:\jpjdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\jdddp.exec:\jdddp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\7xrfrrl.exec:\7xrfrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\1hhhhn.exec:\1hhhhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\djjjv.exec:\djjjv.exe23⤵
- Executes dropped EXE
PID:3224 -
\??\c:\frllflf.exec:\frllflf.exe24⤵
- Executes dropped EXE
PID:3388 -
\??\c:\nthbth.exec:\nthbth.exe25⤵
- Executes dropped EXE
PID:1300 -
\??\c:\7jppp.exec:\7jppp.exe26⤵
- Executes dropped EXE
PID:1704 -
\??\c:\flflrxl.exec:\flflrxl.exe27⤵
- Executes dropped EXE
PID:4060 -
\??\c:\vjpjd.exec:\vjpjd.exe28⤵
- Executes dropped EXE
PID:2640 -
\??\c:\fxxxxxr.exec:\fxxxxxr.exe29⤵
- Executes dropped EXE
PID:2592 -
\??\c:\bththn.exec:\bththn.exe30⤵
- Executes dropped EXE
PID:2996 -
\??\c:\pjpjp.exec:\pjpjp.exe31⤵
- Executes dropped EXE
PID:3232 -
\??\c:\ppjjd.exec:\ppjjd.exe32⤵
- Executes dropped EXE
PID:2568 -
\??\c:\rlrlffx.exec:\rlrlffx.exe33⤵
- Executes dropped EXE
PID:5052 -
\??\c:\thhhbb.exec:\thhhbb.exe34⤵
- Executes dropped EXE
PID:2932 -
\??\c:\9tbbnn.exec:\9tbbnn.exe35⤵
- Executes dropped EXE
PID:3484 -
\??\c:\pjjdd.exec:\pjjdd.exe36⤵
- Executes dropped EXE
PID:4780 -
\??\c:\5ddvp.exec:\5ddvp.exe37⤵
- Executes dropped EXE
PID:1216 -
\??\c:\rrxxrff.exec:\rrxxrff.exe38⤵
- Executes dropped EXE
PID:3220 -
\??\c:\frxrrrl.exec:\frxrrrl.exe39⤵
- Executes dropped EXE
PID:2164 -
\??\c:\ttbbtt.exec:\ttbbtt.exe40⤵
- Executes dropped EXE
PID:4644 -
\??\c:\btbtnn.exec:\btbtnn.exe41⤵
- Executes dropped EXE
PID:4420 -
\??\c:\jdjpd.exec:\jdjpd.exe42⤵
- Executes dropped EXE
PID:3740 -
\??\c:\9dpdv.exec:\9dpdv.exe43⤵
- Executes dropped EXE
PID:4556 -
\??\c:\djvdv.exec:\djvdv.exe44⤵
- Executes dropped EXE
PID:3280 -
\??\c:\fxfrllx.exec:\fxfrllx.exe45⤵
- Executes dropped EXE
PID:1448 -
\??\c:\rlllrxx.exec:\rlllrxx.exe46⤵
- Executes dropped EXE
PID:1360 -
\??\c:\bthhtt.exec:\bthhtt.exe47⤵
- Executes dropped EXE
PID:4608 -
\??\c:\bbnnbb.exec:\bbnnbb.exe48⤵
- Executes dropped EXE
PID:940 -
\??\c:\5vddp.exec:\5vddp.exe49⤵
- Executes dropped EXE
PID:1496 -
\??\c:\dvddv.exec:\dvddv.exe50⤵
- Executes dropped EXE
PID:312 -
\??\c:\lllfrrr.exec:\lllfrrr.exe51⤵
- Executes dropped EXE
PID:544 -
\??\c:\9xxfxrx.exec:\9xxfxrx.exe52⤵
- Executes dropped EXE
PID:2944 -
\??\c:\nnnhbb.exec:\nnnhbb.exe53⤵
- Executes dropped EXE
PID:808 -
\??\c:\7nbttt.exec:\7nbttt.exe54⤵
- Executes dropped EXE
PID:3520 -
\??\c:\jvdpp.exec:\jvdpp.exe55⤵
- Executes dropped EXE
PID:2892 -
\??\c:\djjjv.exec:\djjjv.exe56⤵
- Executes dropped EXE
PID:2680 -
\??\c:\vvddp.exec:\vvddp.exe57⤵
- Executes dropped EXE
PID:3056 -
\??\c:\lfrlfxx.exec:\lfrlfxx.exe58⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nbbbtn.exec:\nbbbtn.exe59⤵
- Executes dropped EXE
PID:4536 -
\??\c:\pjppv.exec:\pjppv.exe60⤵
- Executes dropped EXE
PID:3568 -
\??\c:\dpddd.exec:\dpddd.exe61⤵
- Executes dropped EXE
PID:4928 -
\??\c:\fxxxrfx.exec:\fxxxrfx.exe62⤵
- Executes dropped EXE
PID:4004 -
\??\c:\xrxrllx.exec:\xrxrllx.exe63⤵
- Executes dropped EXE
PID:2360 -
\??\c:\hntbbn.exec:\hntbbn.exe64⤵
- Executes dropped EXE
PID:3848 -
\??\c:\dvppv.exec:\dvppv.exe65⤵
- Executes dropped EXE
PID:408 -
\??\c:\3dddj.exec:\3dddj.exe66⤵PID:4620
-
\??\c:\xfflrrr.exec:\xfflrrr.exe67⤵PID:2972
-
\??\c:\xlxxrrl.exec:\xlxxrrl.exe68⤵PID:2480
-
\??\c:\bbbtnt.exec:\bbbtnt.exe69⤵PID:1208
-
\??\c:\1bhhbh.exec:\1bhhbh.exe70⤵PID:548
-
\??\c:\7dvjj.exec:\7dvjj.exe71⤵PID:1608
-
\??\c:\fxxrlff.exec:\fxxrlff.exe72⤵PID:4532
-
\??\c:\xlxrxxf.exec:\xlxrxxf.exe73⤵PID:4696
-
\??\c:\htnhhh.exec:\htnhhh.exe74⤵PID:4948
-
\??\c:\hhnhth.exec:\hhnhth.exe75⤵PID:3784
-
\??\c:\lxfflxf.exec:\lxfflxf.exe76⤵PID:2084
-
\??\c:\fffxrxf.exec:\fffxrxf.exe77⤵PID:4312
-
\??\c:\hbttnn.exec:\hbttnn.exe78⤵PID:4444
-
\??\c:\tnnbbb.exec:\tnnbbb.exe79⤵PID:872
-
\??\c:\7vvpv.exec:\7vvpv.exe80⤵PID:3236
-
\??\c:\fxxlfrx.exec:\fxxlfrx.exe81⤵PID:2592
-
\??\c:\rfxxxfl.exec:\rfxxxfl.exe82⤵PID:1632
-
\??\c:\nttttb.exec:\nttttb.exe83⤵PID:2636
-
\??\c:\hhnttt.exec:\hhnttt.exe84⤵PID:1844
-
\??\c:\vpvvv.exec:\vpvvv.exe85⤵PID:2844
-
\??\c:\rrrlxrr.exec:\rrrlxrr.exe86⤵PID:1904
-
\??\c:\7rxffff.exec:\7rxffff.exe87⤵PID:2932
-
\??\c:\hbnntt.exec:\hbnntt.exe88⤵PID:3240
-
\??\c:\vjdjd.exec:\vjdjd.exe89⤵PID:4780
-
\??\c:\jpjdv.exec:\jpjdv.exe90⤵PID:1216
-
\??\c:\rxxrlff.exec:\rxxrlff.exe91⤵PID:4784
-
\??\c:\btnnnn.exec:\btnnnn.exe92⤵PID:2164
-
\??\c:\nbntth.exec:\nbntth.exe93⤵PID:4352
-
\??\c:\vpvvp.exec:\vpvvp.exe94⤵PID:1472
-
\??\c:\pjjdd.exec:\pjjdd.exe95⤵PID:4160
-
\??\c:\rllxllr.exec:\rllxllr.exe96⤵PID:4556
-
\??\c:\5xxxrrl.exec:\5xxxrrl.exe97⤵PID:3280
-
\??\c:\nbbttt.exec:\nbbttt.exe98⤵PID:1448
-
\??\c:\thhhtt.exec:\thhhtt.exe99⤵PID:1360
-
\??\c:\jddvp.exec:\jddvp.exe100⤵PID:3992
-
\??\c:\jjvpv.exec:\jjvpv.exe101⤵PID:940
-
\??\c:\rlflllr.exec:\rlflllr.exe102⤵PID:3160
-
\??\c:\5lllfxr.exec:\5lllfxr.exe103⤵PID:2060
-
\??\c:\nhttbt.exec:\nhttbt.exe104⤵PID:4248
-
\??\c:\3tbbbb.exec:\3tbbbb.exe105⤵PID:3576
-
\??\c:\pvjdd.exec:\pvjdd.exe106⤵PID:808
-
\??\c:\vjpvv.exec:\vjpvv.exe107⤵PID:5108
-
\??\c:\xlrxlll.exec:\xlrxlll.exe108⤵PID:2892
-
\??\c:\xlxxxff.exec:\xlxxxff.exe109⤵PID:3416
-
\??\c:\hbtttt.exec:\hbtttt.exe110⤵PID:4528
-
\??\c:\pdppj.exec:\pdppj.exe111⤵PID:1660
-
\??\c:\jvjjp.exec:\jvjjp.exe112⤵PID:4536
-
\??\c:\rrffxxf.exec:\rrffxxf.exe113⤵PID:3620
-
\??\c:\rfrrrxx.exec:\rfrrrxx.exe114⤵PID:3728
-
\??\c:\5thhbh.exec:\5thhbh.exe115⤵PID:924
-
\??\c:\jvjdd.exec:\jvjdd.exe116⤵PID:1824
-
\??\c:\ddpdv.exec:\ddpdv.exe117⤵PID:4684
-
\??\c:\xffrfrx.exec:\xffrfrx.exe118⤵PID:4636
-
\??\c:\llffffx.exec:\llffffx.exe119⤵PID:4664
-
\??\c:\thnhbb.exec:\thnhbb.exe120⤵PID:3812
-
\??\c:\ntnbbb.exec:\ntnbbb.exe121⤵PID:2756
-
\??\c:\1ppjd.exec:\1ppjd.exe122⤵PID:1464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-