Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 23:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
82af18e0e66e35e29ed364f78b6ca2bf8fbfc590d01426c7b205e7225fdd7c32.exe
Resource
win7-20240705-en
5 signatures
150 seconds
General
-
Target
82af18e0e66e35e29ed364f78b6ca2bf8fbfc590d01426c7b205e7225fdd7c32.exe
-
Size
64KB
-
MD5
efe4ef1cd383c678adf87d2f32ec7abe
-
SHA1
b28dc3f5cb694a1e703f889798357dfd5b14e2d6
-
SHA256
82af18e0e66e35e29ed364f78b6ca2bf8fbfc590d01426c7b205e7225fdd7c32
-
SHA512
18a9d0eaa4da17c95154ab55c5bc91f5b901b9a5f45e634e41dc507c428feed307160d9da3b8e057f1e21948cb3cd24d9c629abfcb885b010a2357807503f968
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvAEaFJL/9X:ymb3NkkiQ3mdBjFIvAvR
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3520-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3796-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/320-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/320-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2512-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4084-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/720-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/832-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2088-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2004 nbbbnt.exe 3012 vvdpp.exe 320 fxffxrl.exe 4940 xrrrrll.exe 3796 hbnnnn.exe 1608 tnhnnh.exe 1180 ddppv.exe 2512 vpppv.exe 1236 nhhtnb.exe 1780 3hnnhh.exe 2920 vpvpp.exe 3228 vpddd.exe 3680 fxllfxx.exe 3096 nnnttt.exe 2844 dpjjj.exe 4924 xlfxxrr.exe 4084 7nttnn.exe 3512 9tnnnn.exe 4860 5pddd.exe 2696 lxlfxxx.exe 720 xrxxxxr.exe 4260 hnbbtb.exe 2272 vpjdj.exe 5064 pdddd.exe 832 5fxrllf.exe 3988 bntbhh.exe 2088 tthbnn.exe 3272 djjdv.exe 1996 fflrlff.exe 3040 ttnhnb.exe 2244 ntbbtb.exe 536 vvdvv.exe 4372 nbbtth.exe 2104 1djjp.exe 1380 3ppjv.exe 4332 frxxxxx.exe 3460 lxxxxxf.exe 1232 bnbhhh.exe 1312 ppjpj.exe 4216 jddvp.exe 4520 xrfrlfr.exe 3544 tbtttn.exe 4604 5pdvp.exe 2004 3jjjv.exe 4892 tntnhh.exe 2200 bntnnh.exe 3720 jdddv.exe 4800 lxfxfff.exe 4832 9llllll.exe 2728 xxffxff.exe 4508 bbbtbh.exe 2436 hhnhbb.exe 2252 vjjjd.exe 1952 xrrfxxr.exe 2192 rrllflf.exe 1780 bntnhn.exe 2120 djdjp.exe 5028 vjppj.exe 3032 rrxxrrl.exe 4988 xxlrxxr.exe 1796 thtnnt.exe 4492 pjdvp.exe 3940 vpjjj.exe 1624 xfllflf.exe -
resource yara_rule behavioral2/memory/3520-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3796-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/320-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/320-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/320-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2512-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4084-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/720-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/832-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2088-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-192-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3520 wrote to memory of 2004 3520 82af18e0e66e35e29ed364f78b6ca2bf8fbfc590d01426c7b205e7225fdd7c32.exe 84 PID 3520 wrote to memory of 2004 3520 82af18e0e66e35e29ed364f78b6ca2bf8fbfc590d01426c7b205e7225fdd7c32.exe 84 PID 3520 wrote to memory of 2004 3520 82af18e0e66e35e29ed364f78b6ca2bf8fbfc590d01426c7b205e7225fdd7c32.exe 84 PID 2004 wrote to memory of 3012 2004 nbbbnt.exe 85 PID 2004 wrote to memory of 3012 2004 nbbbnt.exe 85 PID 2004 wrote to memory of 3012 2004 nbbbnt.exe 85 PID 3012 wrote to memory of 320 3012 vvdpp.exe 86 PID 3012 wrote to memory of 320 3012 vvdpp.exe 86 PID 3012 wrote to memory of 320 3012 vvdpp.exe 86 PID 320 wrote to memory of 4940 320 fxffxrl.exe 87 PID 320 wrote to memory of 4940 320 fxffxrl.exe 87 PID 320 wrote to memory of 4940 320 fxffxrl.exe 87 PID 4940 wrote to memory of 3796 4940 xrrrrll.exe 88 PID 4940 wrote to memory of 3796 4940 xrrrrll.exe 88 PID 4940 wrote to memory of 3796 4940 xrrrrll.exe 88 PID 3796 wrote to memory of 1608 3796 hbnnnn.exe 89 PID 3796 wrote to memory of 1608 3796 hbnnnn.exe 89 PID 3796 wrote to memory of 1608 3796 hbnnnn.exe 89 PID 1608 wrote to memory of 1180 1608 tnhnnh.exe 90 PID 1608 wrote to memory of 1180 1608 tnhnnh.exe 90 PID 1608 wrote to memory of 1180 1608 tnhnnh.exe 90 PID 1180 wrote to memory of 2512 1180 ddppv.exe 91 PID 1180 wrote to memory of 2512 1180 ddppv.exe 91 PID 1180 wrote to memory of 2512 1180 ddppv.exe 91 PID 2512 wrote to memory of 1236 2512 vpppv.exe 92 PID 2512 wrote to memory of 1236 2512 vpppv.exe 92 PID 2512 wrote to memory of 1236 2512 vpppv.exe 92 PID 1236 wrote to memory of 1780 1236 nhhtnb.exe 93 PID 1236 wrote to memory of 1780 1236 nhhtnb.exe 93 PID 1236 wrote to memory of 1780 1236 nhhtnb.exe 93 PID 1780 wrote to memory of 2920 1780 3hnnhh.exe 94 PID 1780 wrote to memory of 2920 1780 3hnnhh.exe 94 PID 1780 wrote to memory of 2920 1780 3hnnhh.exe 94 PID 2920 wrote to memory of 3228 2920 vpvpp.exe 95 PID 2920 wrote to memory of 3228 2920 vpvpp.exe 95 PID 2920 wrote to memory of 3228 2920 vpvpp.exe 95 PID 3228 wrote to memory of 3680 3228 vpddd.exe 97 PID 3228 wrote to memory of 3680 3228 vpddd.exe 97 PID 3228 wrote to memory of 3680 3228 vpddd.exe 97 PID 3680 wrote to memory of 3096 3680 fxllfxx.exe 98 PID 3680 wrote to memory of 3096 3680 fxllfxx.exe 98 PID 3680 wrote to memory of 3096 3680 fxllfxx.exe 98 PID 3096 wrote to memory of 2844 3096 nnnttt.exe 99 PID 3096 wrote to memory of 2844 3096 nnnttt.exe 99 PID 3096 wrote to memory of 2844 3096 nnnttt.exe 99 PID 2844 wrote to memory of 4924 2844 dpjjj.exe 100 PID 2844 wrote to memory of 4924 2844 dpjjj.exe 100 PID 2844 wrote to memory of 4924 2844 dpjjj.exe 100 PID 4924 wrote to memory of 4084 4924 xlfxxrr.exe 101 PID 4924 wrote to memory of 4084 4924 xlfxxrr.exe 101 PID 4924 wrote to memory of 4084 4924 xlfxxrr.exe 101 PID 4084 wrote to memory of 3512 4084 7nttnn.exe 102 PID 4084 wrote to memory of 3512 4084 7nttnn.exe 102 PID 4084 wrote to memory of 3512 4084 7nttnn.exe 102 PID 3512 wrote to memory of 4860 3512 9tnnnn.exe 103 PID 3512 wrote to memory of 4860 3512 9tnnnn.exe 103 PID 3512 wrote to memory of 4860 3512 9tnnnn.exe 103 PID 4860 wrote to memory of 2696 4860 5pddd.exe 104 PID 4860 wrote to memory of 2696 4860 5pddd.exe 104 PID 4860 wrote to memory of 2696 4860 5pddd.exe 104 PID 2696 wrote to memory of 720 2696 lxlfxxx.exe 105 PID 2696 wrote to memory of 720 2696 lxlfxxx.exe 105 PID 2696 wrote to memory of 720 2696 lxlfxxx.exe 105 PID 720 wrote to memory of 4260 720 xrxxxxr.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\82af18e0e66e35e29ed364f78b6ca2bf8fbfc590d01426c7b205e7225fdd7c32.exe"C:\Users\Admin\AppData\Local\Temp\82af18e0e66e35e29ed364f78b6ca2bf8fbfc590d01426c7b205e7225fdd7c32.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\nbbbnt.exec:\nbbbnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\vvdpp.exec:\vvdpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\fxffxrl.exec:\fxffxrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\xrrrrll.exec:\xrrrrll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\hbnnnn.exec:\hbnnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\tnhnnh.exec:\tnhnnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\ddppv.exec:\ddppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\vpppv.exec:\vpppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\nhhtnb.exec:\nhhtnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\3hnnhh.exec:\3hnnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\vpvpp.exec:\vpvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\vpddd.exec:\vpddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\fxllfxx.exec:\fxllfxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\nnnttt.exec:\nnnttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\dpjjj.exec:\dpjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\xlfxxrr.exec:\xlfxxrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\7nttnn.exec:\7nttnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\9tnnnn.exec:\9tnnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\5pddd.exec:\5pddd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\xrxxxxr.exec:\xrxxxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\hnbbtb.exec:\hnbbtb.exe23⤵
- Executes dropped EXE
PID:4260 -
\??\c:\vpjdj.exec:\vpjdj.exe24⤵
- Executes dropped EXE
PID:2272 -
\??\c:\pdddd.exec:\pdddd.exe25⤵
- Executes dropped EXE
PID:5064 -
\??\c:\5fxrllf.exec:\5fxrllf.exe26⤵
- Executes dropped EXE
PID:832 -
\??\c:\bntbhh.exec:\bntbhh.exe27⤵
- Executes dropped EXE
PID:3988 -
\??\c:\tthbnn.exec:\tthbnn.exe28⤵
- Executes dropped EXE
PID:2088 -
\??\c:\djjdv.exec:\djjdv.exe29⤵
- Executes dropped EXE
PID:3272 -
\??\c:\fflrlff.exec:\fflrlff.exe30⤵
- Executes dropped EXE
PID:1996 -
\??\c:\ttnhnb.exec:\ttnhnb.exe31⤵
- Executes dropped EXE
PID:3040 -
\??\c:\ntbbtb.exec:\ntbbtb.exe32⤵
- Executes dropped EXE
PID:2244 -
\??\c:\vvdvv.exec:\vvdvv.exe33⤵
- Executes dropped EXE
PID:536 -
\??\c:\nbbtth.exec:\nbbtth.exe34⤵
- Executes dropped EXE
PID:4372 -
\??\c:\1djjp.exec:\1djjp.exe35⤵
- Executes dropped EXE
PID:2104 -
\??\c:\3ppjv.exec:\3ppjv.exe36⤵
- Executes dropped EXE
PID:1380 -
\??\c:\frxxxxx.exec:\frxxxxx.exe37⤵
- Executes dropped EXE
PID:4332 -
\??\c:\lxxxxxf.exec:\lxxxxxf.exe38⤵
- Executes dropped EXE
PID:3460 -
\??\c:\bnbhhh.exec:\bnbhhh.exe39⤵
- Executes dropped EXE
PID:1232 -
\??\c:\ppjpj.exec:\ppjpj.exe40⤵
- Executes dropped EXE
PID:1312 -
\??\c:\jddvp.exec:\jddvp.exe41⤵
- Executes dropped EXE
PID:4216 -
\??\c:\xrfrlfr.exec:\xrfrlfr.exe42⤵
- Executes dropped EXE
PID:4520 -
\??\c:\tbtttn.exec:\tbtttn.exe43⤵
- Executes dropped EXE
PID:3544 -
\??\c:\5pdvp.exec:\5pdvp.exe44⤵
- Executes dropped EXE
PID:4604 -
\??\c:\3jjjv.exec:\3jjjv.exe45⤵
- Executes dropped EXE
PID:2004 -
\??\c:\tntnhh.exec:\tntnhh.exe46⤵
- Executes dropped EXE
PID:4892 -
\??\c:\bntnnh.exec:\bntnnh.exe47⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jdddv.exec:\jdddv.exe48⤵
- Executes dropped EXE
PID:3720 -
\??\c:\lxfxfff.exec:\lxfxfff.exe49⤵
- Executes dropped EXE
PID:4800 -
\??\c:\9llllll.exec:\9llllll.exe50⤵
- Executes dropped EXE
PID:4832 -
\??\c:\xxffxff.exec:\xxffxff.exe51⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bbbtbh.exec:\bbbtbh.exe52⤵
- Executes dropped EXE
PID:4508 -
\??\c:\hhnhbb.exec:\hhnhbb.exe53⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vjjjd.exec:\vjjjd.exe54⤵
- Executes dropped EXE
PID:2252 -
\??\c:\xrrfxxr.exec:\xrrfxxr.exe55⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rrllflf.exec:\rrllflf.exe56⤵
- Executes dropped EXE
PID:2192 -
\??\c:\bntnhn.exec:\bntnhn.exe57⤵
- Executes dropped EXE
PID:1780 -
\??\c:\djdjp.exec:\djdjp.exe58⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vjppj.exec:\vjppj.exe59⤵
- Executes dropped EXE
PID:5028 -
\??\c:\rrxxrrl.exec:\rrxxrrl.exe60⤵
- Executes dropped EXE
PID:3032 -
\??\c:\xxlrxxr.exec:\xxlrxxr.exe61⤵
- Executes dropped EXE
PID:4988 -
\??\c:\thtnnt.exec:\thtnnt.exe62⤵
- Executes dropped EXE
PID:1796 -
\??\c:\pjdvp.exec:\pjdvp.exe63⤵
- Executes dropped EXE
PID:4492 -
\??\c:\vpjjj.exec:\vpjjj.exe64⤵
- Executes dropped EXE
PID:3940 -
\??\c:\xfllflf.exec:\xfllflf.exe65⤵
- Executes dropped EXE
PID:1624 -
\??\c:\btbbtb.exec:\btbbtb.exe66⤵PID:4960
-
\??\c:\hbbttt.exec:\hbbttt.exe67⤵PID:4084
-
\??\c:\jjvpj.exec:\jjvpj.exe68⤵PID:4208
-
\??\c:\lfffflf.exec:\lfffflf.exe69⤵PID:4432
-
\??\c:\flxfrrf.exec:\flxfrrf.exe70⤵PID:4828
-
\??\c:\nthntb.exec:\nthntb.exe71⤵PID:2804
-
\??\c:\jjppp.exec:\jjppp.exe72⤵PID:5096
-
\??\c:\ppjpd.exec:\ppjpd.exe73⤵PID:4976
-
\??\c:\rlfxffl.exec:\rlfxffl.exe74⤵PID:4004
-
\??\c:\rrfllrr.exec:\rrfllrr.exe75⤵PID:5104
-
\??\c:\nhhhbh.exec:\nhhhbh.exe76⤵PID:2924
-
\??\c:\jjdvp.exec:\jjdvp.exe77⤵PID:832
-
\??\c:\vdjdd.exec:\vdjdd.exe78⤵PID:792
-
\??\c:\rllfrrl.exec:\rllfrrl.exe79⤵PID:2408
-
\??\c:\nbhhhn.exec:\nbhhhn.exe80⤵PID:2956
-
\??\c:\pvddv.exec:\pvddv.exe81⤵PID:428
-
\??\c:\frxrfxl.exec:\frxrfxl.exe82⤵PID:3740
-
\??\c:\hbntbh.exec:\hbntbh.exe83⤵PID:4148
-
\??\c:\tnbbbh.exec:\tnbbbh.exe84⤵PID:380
-
\??\c:\vdjjv.exec:\vdjjv.exe85⤵PID:5076
-
\??\c:\7xlfxxl.exec:\7xlfxxl.exe86⤵PID:4536
-
\??\c:\1bthhh.exec:\1bthhh.exe87⤵PID:1944
-
\??\c:\7jpdp.exec:\7jpdp.exe88⤵PID:452
-
\??\c:\jjjjp.exec:\jjjjp.exe89⤵PID:4532
-
\??\c:\xxrlrrf.exec:\xxrlrrf.exe90⤵PID:540
-
\??\c:\tnhbbb.exec:\tnhbbb.exe91⤵PID:624
-
\??\c:\pjdvp.exec:\pjdvp.exe92⤵PID:620
-
\??\c:\3rxxxxx.exec:\3rxxxxx.exe93⤵PID:2240
-
\??\c:\thhbbb.exec:\thhbbb.exe94⤵PID:4360
-
\??\c:\jjjpp.exec:\jjjpp.exe95⤵PID:3136
-
\??\c:\lxxrffr.exec:\lxxrffr.exe96⤵PID:4552
-
\??\c:\5nnhbt.exec:\5nnhbt.exe97⤵PID:3540
-
\??\c:\7tbtbb.exec:\7tbtbb.exe98⤵PID:3212
-
\??\c:\dpjvp.exec:\dpjvp.exe99⤵PID:820
-
\??\c:\bbhbbt.exec:\bbhbbt.exe100⤵PID:3952
-
\??\c:\hhhbtt.exec:\hhhbtt.exe101⤵PID:3340
-
\??\c:\vpvvv.exec:\vpvvv.exe102⤵PID:1560
-
\??\c:\5rxxlll.exec:\5rxxlll.exe103⤵PID:988
-
\??\c:\7bhhhh.exec:\7bhhhh.exe104⤵PID:4996
-
\??\c:\hthbtt.exec:\hthbtt.exe105⤵PID:3028
-
\??\c:\5ddvp.exec:\5ddvp.exe106⤵PID:2184
-
\??\c:\7pjdv.exec:\7pjdv.exe107⤵PID:640
-
\??\c:\lflrlfl.exec:\lflrlfl.exe108⤵PID:2028
-
\??\c:\thttnb.exec:\thttnb.exe109⤵PID:4180
-
\??\c:\9dpdv.exec:\9dpdv.exe110⤵PID:1464
-
\??\c:\vvvvp.exec:\vvvvp.exe111⤵PID:2644
-
\??\c:\flrrllx.exec:\flrrllx.exe112⤵PID:956
-
\??\c:\btttnn.exec:\btttnn.exe113⤵PID:3000
-
\??\c:\bbhhtt.exec:\bbhhtt.exe114⤵PID:2708
-
\??\c:\dvvpj.exec:\dvvpj.exe115⤵PID:4224
-
\??\c:\rrrrlll.exec:\rrrrlll.exe116⤵PID:5016
-
\??\c:\3xxrlff.exec:\3xxrlff.exe117⤵PID:2844
-
\??\c:\pjpjj.exec:\pjpjj.exe118⤵PID:3268
-
\??\c:\jvdvj.exec:\jvdvj.exe119⤵PID:4528
-
\??\c:\llfxrrl.exec:\llfxrrl.exe120⤵PID:3080
-
\??\c:\bbbtnn.exec:\bbbtnn.exe121⤵PID:4668
-
\??\c:\3jpjd.exec:\3jpjd.exe122⤵PID:964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-