Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 21:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
460fd22e825972536bee86f8354477dd34e7e51ebac18b633a2d0f3b94b7d62e.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
460fd22e825972536bee86f8354477dd34e7e51ebac18b633a2d0f3b94b7d62e.exe
-
Size
69KB
-
MD5
831976b91c46b871ea7dc408ee8de1b8
-
SHA1
7821e3e01b720c4cf0b4d847abdb30cc75b709e8
-
SHA256
460fd22e825972536bee86f8354477dd34e7e51ebac18b633a2d0f3b94b7d62e
-
SHA512
fbe28a1a0549aef1119660d681c3dcc9e31ccf5d07a49163e4bb919ebb66f22b3a262b1454454ef2c4596ecbf5a541c27b2bcd7398522b7d4e62a34194166d03
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUPqrDZVTr7:ymb3NkkiQ3mdBjF0yUm7T
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/2712-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-28-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1180-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4236-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1956-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1268-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2088-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-66-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4536 5jjdv.exe 4556 7flxrrl.exe 4768 hbnhbt.exe 4788 ntbthh.exe 2980 9vvpv.exe 1180 vpjjd.exe 624 lflfxxr.exe 3472 1lfrlfr.exe 4504 hnbbbb.exe 5092 nbhbnh.exe 1940 ddjdv.exe 4168 vjvpd.exe 4916 rlxrxxf.exe 4236 bttttt.exe 64 nhhbbt.exe 2448 djdpp.exe 2452 djvvd.exe 3748 fxfrrrr.exe 2088 frfxrrl.exe 3040 hbnhbt.exe 4856 hnnhbn.exe 4572 ddjdv.exe 1956 ppjjj.exe 4656 vpjdv.exe 4644 7rlrlxr.exe 4720 7nnnnn.exe 1152 nbnhnh.exe 1504 dpvpp.exe 5060 pjjjj.exe 1268 frrlffx.exe 1704 bhbttt.exe 4364 bntnhb.exe 4500 htbbnh.exe 3356 ppvpp.exe 1064 rrffxll.exe 1884 lxfffll.exe 2544 tntbbh.exe 2224 bbthnt.exe 4828 vjppd.exe 3312 vvvpd.exe 1288 jjvvj.exe 4988 5xxrlll.exe 2220 rlrlllf.exe 2268 7ntnhb.exe 1556 7bbnbt.exe 432 3hbthh.exe 940 3vdvd.exe 1172 vvvvv.exe 2304 7xxrfxr.exe 3692 lrfxxrr.exe 4448 7xfxxrr.exe 4408 nhhbnn.exe 1604 hbnhbb.exe 896 3jpdv.exe 2740 pvddv.exe 3052 lxfxrxx.exe 1156 llxxflr.exe 2260 frxrrrl.exe 1552 tbhhhh.exe 3972 9hhhbb.exe 4404 vvppd.exe 3860 fxfxxxr.exe 3012 llfffff.exe 1868 nntttn.exe -
resource yara_rule behavioral2/memory/2712-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4236-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1956-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2088-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-27-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2712 wrote to memory of 4536 2712 460fd22e825972536bee86f8354477dd34e7e51ebac18b633a2d0f3b94b7d62e.exe 80 PID 2712 wrote to memory of 4536 2712 460fd22e825972536bee86f8354477dd34e7e51ebac18b633a2d0f3b94b7d62e.exe 80 PID 2712 wrote to memory of 4536 2712 460fd22e825972536bee86f8354477dd34e7e51ebac18b633a2d0f3b94b7d62e.exe 80 PID 4536 wrote to memory of 4556 4536 5jjdv.exe 81 PID 4536 wrote to memory of 4556 4536 5jjdv.exe 81 PID 4536 wrote to memory of 4556 4536 5jjdv.exe 81 PID 4556 wrote to memory of 4768 4556 7flxrrl.exe 82 PID 4556 wrote to memory of 4768 4556 7flxrrl.exe 82 PID 4556 wrote to memory of 4768 4556 7flxrrl.exe 82 PID 4768 wrote to memory of 4788 4768 hbnhbt.exe 83 PID 4768 wrote to memory of 4788 4768 hbnhbt.exe 83 PID 4768 wrote to memory of 4788 4768 hbnhbt.exe 83 PID 4788 wrote to memory of 2980 4788 ntbthh.exe 84 PID 4788 wrote to memory of 2980 4788 ntbthh.exe 84 PID 4788 wrote to memory of 2980 4788 ntbthh.exe 84 PID 2980 wrote to memory of 1180 2980 9vvpv.exe 85 PID 2980 wrote to memory of 1180 2980 9vvpv.exe 85 PID 2980 wrote to memory of 1180 2980 9vvpv.exe 85 PID 1180 wrote to memory of 624 1180 vpjjd.exe 86 PID 1180 wrote to memory of 624 1180 vpjjd.exe 86 PID 1180 wrote to memory of 624 1180 vpjjd.exe 86 PID 624 wrote to memory of 3472 624 lflfxxr.exe 87 PID 624 wrote to memory of 3472 624 lflfxxr.exe 87 PID 624 wrote to memory of 3472 624 lflfxxr.exe 87 PID 3472 wrote to memory of 4504 3472 1lfrlfr.exe 88 PID 3472 wrote to memory of 4504 3472 1lfrlfr.exe 88 PID 3472 wrote to memory of 4504 3472 1lfrlfr.exe 88 PID 4504 wrote to memory of 5092 4504 hnbbbb.exe 89 PID 4504 wrote to memory of 5092 4504 hnbbbb.exe 89 PID 4504 wrote to memory of 5092 4504 hnbbbb.exe 89 PID 5092 wrote to memory of 1940 5092 nbhbnh.exe 90 PID 5092 wrote to memory of 1940 5092 nbhbnh.exe 90 PID 5092 wrote to memory of 1940 5092 nbhbnh.exe 90 PID 1940 wrote to memory of 4168 1940 ddjdv.exe 146 PID 1940 wrote to memory of 4168 1940 ddjdv.exe 146 PID 1940 wrote to memory of 4168 1940 ddjdv.exe 146 PID 4168 wrote to memory of 4916 4168 vjvpd.exe 92 PID 4168 wrote to memory of 4916 4168 vjvpd.exe 92 PID 4168 wrote to memory of 4916 4168 vjvpd.exe 92 PID 4916 wrote to memory of 4236 4916 rlxrxxf.exe 93 PID 4916 wrote to memory of 4236 4916 rlxrxxf.exe 93 PID 4916 wrote to memory of 4236 4916 rlxrxxf.exe 93 PID 4236 wrote to memory of 64 4236 bttttt.exe 152 PID 4236 wrote to memory of 64 4236 bttttt.exe 152 PID 4236 wrote to memory of 64 4236 bttttt.exe 152 PID 64 wrote to memory of 2448 64 nhhbbt.exe 153 PID 64 wrote to memory of 2448 64 nhhbbt.exe 153 PID 64 wrote to memory of 2448 64 nhhbbt.exe 153 PID 2448 wrote to memory of 2452 2448 djdpp.exe 96 PID 2448 wrote to memory of 2452 2448 djdpp.exe 96 PID 2448 wrote to memory of 2452 2448 djdpp.exe 96 PID 2452 wrote to memory of 3748 2452 djvvd.exe 97 PID 2452 wrote to memory of 3748 2452 djvvd.exe 97 PID 2452 wrote to memory of 3748 2452 djvvd.exe 97 PID 3748 wrote to memory of 2088 3748 fxfrrrr.exe 98 PID 3748 wrote to memory of 2088 3748 fxfrrrr.exe 98 PID 3748 wrote to memory of 2088 3748 fxfrrrr.exe 98 PID 2088 wrote to memory of 3040 2088 frfxrrl.exe 99 PID 2088 wrote to memory of 3040 2088 frfxrrl.exe 99 PID 2088 wrote to memory of 3040 2088 frfxrrl.exe 99 PID 3040 wrote to memory of 4856 3040 hbnhbt.exe 100 PID 3040 wrote to memory of 4856 3040 hbnhbt.exe 100 PID 3040 wrote to memory of 4856 3040 hbnhbt.exe 100 PID 4856 wrote to memory of 4572 4856 hnnhbn.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\460fd22e825972536bee86f8354477dd34e7e51ebac18b633a2d0f3b94b7d62e.exe"C:\Users\Admin\AppData\Local\Temp\460fd22e825972536bee86f8354477dd34e7e51ebac18b633a2d0f3b94b7d62e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\5jjdv.exec:\5jjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\7flxrrl.exec:\7flxrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\hbnhbt.exec:\hbnhbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\ntbthh.exec:\ntbthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\9vvpv.exec:\9vvpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\vpjjd.exec:\vpjjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\lflfxxr.exec:\lflfxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\1lfrlfr.exec:\1lfrlfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\hnbbbb.exec:\hnbbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\nbhbnh.exec:\nbhbnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\ddjdv.exec:\ddjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\vjvpd.exec:\vjvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\bttttt.exec:\bttttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\nhhbbt.exec:\nhhbbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\djdpp.exec:\djdpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\djvvd.exec:\djvvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\fxfrrrr.exec:\fxfrrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\frfxrrl.exec:\frfxrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\hbnhbt.exec:\hbnhbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\hnnhbn.exec:\hnnhbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\ddjdv.exec:\ddjdv.exe23⤵
- Executes dropped EXE
PID:4572 -
\??\c:\ppjjj.exec:\ppjjj.exe24⤵
- Executes dropped EXE
PID:1956 -
\??\c:\vpjdv.exec:\vpjdv.exe25⤵
- Executes dropped EXE
PID:4656 -
\??\c:\7rlrlxr.exec:\7rlrlxr.exe26⤵
- Executes dropped EXE
PID:4644 -
\??\c:\7nnnnn.exec:\7nnnnn.exe27⤵
- Executes dropped EXE
PID:4720 -
\??\c:\nbnhnh.exec:\nbnhnh.exe28⤵
- Executes dropped EXE
PID:1152 -
\??\c:\dpvpp.exec:\dpvpp.exe29⤵
- Executes dropped EXE
PID:1504 -
\??\c:\pjjjj.exec:\pjjjj.exe30⤵
- Executes dropped EXE
PID:5060 -
\??\c:\frrlffx.exec:\frrlffx.exe31⤵
- Executes dropped EXE
PID:1268 -
\??\c:\bhbttt.exec:\bhbttt.exe32⤵
- Executes dropped EXE
PID:1704 -
\??\c:\bntnhb.exec:\bntnhb.exe33⤵
- Executes dropped EXE
PID:4364 -
\??\c:\htbbnh.exec:\htbbnh.exe34⤵
- Executes dropped EXE
PID:4500 -
\??\c:\ppvpp.exec:\ppvpp.exe35⤵
- Executes dropped EXE
PID:3356 -
\??\c:\rrffxll.exec:\rrffxll.exe36⤵
- Executes dropped EXE
PID:1064 -
\??\c:\lxfffll.exec:\lxfffll.exe37⤵
- Executes dropped EXE
PID:1884 -
\??\c:\tntbbh.exec:\tntbbh.exe38⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bbthnt.exec:\bbthnt.exe39⤵
- Executes dropped EXE
PID:2224 -
\??\c:\vjppd.exec:\vjppd.exe40⤵
- Executes dropped EXE
PID:4828 -
\??\c:\vvvpd.exec:\vvvpd.exe41⤵
- Executes dropped EXE
PID:3312 -
\??\c:\jjvvj.exec:\jjvvj.exe42⤵
- Executes dropped EXE
PID:1288 -
\??\c:\5xxrlll.exec:\5xxrlll.exe43⤵
- Executes dropped EXE
PID:4988 -
\??\c:\rlrlllf.exec:\rlrlllf.exe44⤵
- Executes dropped EXE
PID:2220 -
\??\c:\7ntnhb.exec:\7ntnhb.exe45⤵
- Executes dropped EXE
PID:2268 -
\??\c:\7bbnbt.exec:\7bbnbt.exe46⤵
- Executes dropped EXE
PID:1556 -
\??\c:\3hbthh.exec:\3hbthh.exe47⤵
- Executes dropped EXE
PID:432 -
\??\c:\3vdvd.exec:\3vdvd.exe48⤵
- Executes dropped EXE
PID:940 -
\??\c:\vvvvv.exec:\vvvvv.exe49⤵
- Executes dropped EXE
PID:1172 -
\??\c:\7xxrfxr.exec:\7xxrfxr.exe50⤵
- Executes dropped EXE
PID:2304 -
\??\c:\lrfxxrr.exec:\lrfxxrr.exe51⤵
- Executes dropped EXE
PID:3692 -
\??\c:\7xfxxrr.exec:\7xfxxrr.exe52⤵
- Executes dropped EXE
PID:4448 -
\??\c:\nhhbnn.exec:\nhhbnn.exe53⤵
- Executes dropped EXE
PID:4408 -
\??\c:\hbnhbb.exec:\hbnhbb.exe54⤵
- Executes dropped EXE
PID:1604 -
\??\c:\3jpdv.exec:\3jpdv.exe55⤵
- Executes dropped EXE
PID:896 -
\??\c:\pvddv.exec:\pvddv.exe56⤵
- Executes dropped EXE
PID:2740 -
\??\c:\lxfxrxx.exec:\lxfxrxx.exe57⤵
- Executes dropped EXE
PID:3052 -
\??\c:\llxxflr.exec:\llxxflr.exe58⤵
- Executes dropped EXE
PID:1156 -
\??\c:\frxrrrl.exec:\frxrrrl.exe59⤵
- Executes dropped EXE
PID:2260 -
\??\c:\tbhhhh.exec:\tbhhhh.exe60⤵
- Executes dropped EXE
PID:1552 -
\??\c:\9hhhbb.exec:\9hhhbb.exe61⤵
- Executes dropped EXE
PID:3972 -
\??\c:\vvppd.exec:\vvppd.exe62⤵
- Executes dropped EXE
PID:4404 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe63⤵
- Executes dropped EXE
PID:3860 -
\??\c:\llfffff.exec:\llfffff.exe64⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nntttn.exec:\nntttn.exe65⤵
- Executes dropped EXE
PID:1868 -
\??\c:\9jvpv.exec:\9jvpv.exe66⤵PID:3944
-
\??\c:\vpjdp.exec:\vpjdp.exe67⤵PID:804
-
\??\c:\xxrxffx.exec:\xxrxffx.exe68⤵PID:4168
-
\??\c:\lfrllll.exec:\lfrllll.exe69⤵PID:2208
-
\??\c:\hnnnhn.exec:\hnnnhn.exe70⤵PID:2248
-
\??\c:\9nnnhn.exec:\9nnnhn.exe71⤵PID:2972
-
\??\c:\ppdjj.exec:\ppdjj.exe72⤵PID:2588
-
\??\c:\rxflrxf.exec:\rxflrxf.exe73⤵PID:2524
-
\??\c:\xxxxxff.exec:\xxxxxff.exe74⤵PID:64
-
\??\c:\tbhbbh.exec:\tbhbbh.exe75⤵PID:2448
-
\??\c:\vvpjj.exec:\vvpjj.exe76⤵PID:2992
-
\??\c:\pvvvv.exec:\pvvvv.exe77⤵PID:4324
-
\??\c:\5xxlxff.exec:\5xxlxff.exe78⤵PID:3036
-
\??\c:\vjpvv.exec:\vjpvv.exe79⤵PID:1752
-
\??\c:\xxfflff.exec:\xxfflff.exe80⤵PID:2100
-
\??\c:\9rllfrr.exec:\9rllfrr.exe81⤵PID:3508
-
\??\c:\hnhntb.exec:\hnhntb.exe82⤵PID:4180
-
\??\c:\3bbnnn.exec:\3bbnnn.exe83⤵PID:2240
-
\??\c:\rrlllrr.exec:\rrlllrr.exe84⤵PID:4564
-
\??\c:\tbbbbh.exec:\tbbbbh.exe85⤵PID:3960
-
\??\c:\nthhht.exec:\nthhht.exe86⤵PID:4644
-
\??\c:\vjjdp.exec:\vjjdp.exe87⤵PID:1444
-
\??\c:\pdvjd.exec:\pdvjd.exe88⤵PID:2676
-
\??\c:\rlxxlrr.exec:\rlxxlrr.exe89⤵PID:1152
-
\??\c:\nhnnnt.exec:\nhnnnt.exe90⤵PID:4052
-
\??\c:\jddvv.exec:\jddvv.exe91⤵PID:2164
-
\??\c:\ffxrfrl.exec:\ffxrfrl.exe92⤵PID:960
-
\??\c:\hhntbh.exec:\hhntbh.exe93⤵PID:3024
-
\??\c:\jvjjd.exec:\jvjjd.exe94⤵PID:4792
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe95⤵PID:1408
-
\??\c:\3fllfff.exec:\3fllfff.exe96⤵PID:3688
-
\??\c:\nnntnn.exec:\nnntnn.exe97⤵PID:1540
-
\??\c:\jdjjj.exec:\jdjjj.exe98⤵PID:2188
-
\??\c:\vdjjd.exec:\vdjjd.exe99⤵PID:4288
-
\??\c:\7dvpj.exec:\7dvpj.exe100⤵PID:2548
-
\??\c:\bhhhhh.exec:\bhhhhh.exe101⤵PID:4840
-
\??\c:\7rrlxrf.exec:\7rrlxrf.exe102⤵PID:3444
-
\??\c:\bntthh.exec:\bntthh.exe103⤵PID:776
-
\??\c:\xlxfrrx.exec:\xlxfrrx.exe104⤵PID:2932
-
\??\c:\9rlfxrl.exec:\9rlfxrl.exe105⤵PID:984
-
\??\c:\thnhtt.exec:\thnhtt.exe106⤵PID:2160
-
\??\c:\nhhthh.exec:\nhhthh.exe107⤵PID:4072
-
\??\c:\ppjdd.exec:\ppjdd.exe108⤵PID:1404
-
\??\c:\7rrxxxr.exec:\7rrxxxr.exe109⤵PID:3140
-
\??\c:\rlflxrl.exec:\rlflxrl.exe110⤵PID:4336
-
\??\c:\hbttbb.exec:\hbttbb.exe111⤵PID:432
-
\??\c:\nttnhb.exec:\nttnhb.exe112⤵PID:2608
-
\??\c:\vdjdv.exec:\vdjdv.exe113⤵PID:3068
-
\??\c:\lxrrfrl.exec:\lxrrfrl.exe114⤵PID:4284
-
\??\c:\lfflffr.exec:\lfflffr.exe115⤵PID:4732
-
\??\c:\bnnbtt.exec:\bnnbtt.exe116⤵PID:2632
-
\??\c:\hbttbn.exec:\hbttbn.exe117⤵PID:4724
-
\??\c:\vppjd.exec:\vppjd.exe118⤵PID:2968
-
\??\c:\frxrrrr.exec:\frxrrrr.exe119⤵PID:4608
-
\??\c:\xfxxrrl.exec:\xfxxrrl.exe120⤵PID:4784
-
\??\c:\tnbttb.exec:\tnbttb.exe121⤵PID:4476
-
\??\c:\vdjpj.exec:\vdjpj.exe122⤵PID:3588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-