Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06-07-2024 04:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f78310d1c8cb2b1d77e9e8605a9122f85356ed11b6462231ea3f776c8fe7c40b.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
General
-
Target
f78310d1c8cb2b1d77e9e8605a9122f85356ed11b6462231ea3f776c8fe7c40b.exe
-
Size
93KB
-
MD5
caf203fcd15b9b441ff19f332a395fd5
-
SHA1
1541a8bfebd97b62351de9851b9f612f18fbd873
-
SHA256
f78310d1c8cb2b1d77e9e8605a9122f85356ed11b6462231ea3f776c8fe7c40b
-
SHA512
34716433c13d8cba4e56735501d9567f94a6a0a442ca596f9c07311c1c4e5b1cb583a347b80d1d823fca0a1fa0f9d00e8ca8df19a74cefe350d72ef9985e4702
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZaRBE:ymb3NkkiQ3mdBjFIVLd2hWZGreRCYBI
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/2512-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3784-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/380-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2688-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-859-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2332 7vvdv.exe 3160 lfllfxf.exe 2440 btnhtb.exe 5016 djdjv.exe 2412 xllflfx.exe 2204 jvpjj.exe 1976 pvppj.exe 2152 jvjjv.exe 1936 jjdpp.exe 3320 nthtbh.exe 3784 pvjpv.exe 380 rfflffx.exe 1908 nnnnhn.exe 3116 pjdvv.exe 2464 rxffffx.exe 3572 bntbtb.exe 4080 rfrlxfl.exe 4724 lxlxxxl.exe 2688 tttnbt.exe 3980 pddpp.exe 3424 lflllll.exe 1064 xllxlrf.exe 1996 bbhbbb.exe 2236 dvjdd.exe 4352 vppdv.exe 3988 xxfffrx.exe 4444 hbthnh.exe 2856 ddppj.exe 432 xrrrllf.exe 3052 tnnnnb.exe 2004 ddjdp.exe 5020 pdjdj.exe 3944 flxrxrx.exe 2836 hhhhnt.exe 4632 5ddpj.exe 3144 5frrlxr.exe 2620 bbhbtt.exe 4176 bhbtnt.exe 2796 nbnhhn.exe 1428 9dpdj.exe 2724 5vvpj.exe 2844 flrlflf.exe 2752 nntbnn.exe 4700 djjdj.exe 2756 jvppj.exe 3252 xlfflll.exe 4716 hhnhtn.exe 2336 nnttnb.exe 1752 pvdvd.exe 312 lxxxlrf.exe 1696 lllrrfx.exe 3784 nbbttt.exe 1096 ddvpd.exe 3796 flrflxl.exe 2120 rrfllrr.exe 3800 thtbbn.exe 2820 dpjdv.exe 3152 lrllxll.exe 4904 hhntnh.exe 4004 bthbhh.exe 3164 dpddd.exe 2600 vddpd.exe 2688 xlfrrrr.exe 1612 hbnbtn.exe -
resource yara_rule behavioral2/memory/2512-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3784-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/380-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2688-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-859-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2332 2512 f78310d1c8cb2b1d77e9e8605a9122f85356ed11b6462231ea3f776c8fe7c40b.exe 82 PID 2512 wrote to memory of 2332 2512 f78310d1c8cb2b1d77e9e8605a9122f85356ed11b6462231ea3f776c8fe7c40b.exe 82 PID 2512 wrote to memory of 2332 2512 f78310d1c8cb2b1d77e9e8605a9122f85356ed11b6462231ea3f776c8fe7c40b.exe 82 PID 2332 wrote to memory of 3160 2332 7vvdv.exe 83 PID 2332 wrote to memory of 3160 2332 7vvdv.exe 83 PID 2332 wrote to memory of 3160 2332 7vvdv.exe 83 PID 3160 wrote to memory of 2440 3160 lfllfxf.exe 84 PID 3160 wrote to memory of 2440 3160 lfllfxf.exe 84 PID 3160 wrote to memory of 2440 3160 lfllfxf.exe 84 PID 2440 wrote to memory of 5016 2440 btnhtb.exe 85 PID 2440 wrote to memory of 5016 2440 btnhtb.exe 85 PID 2440 wrote to memory of 5016 2440 btnhtb.exe 85 PID 5016 wrote to memory of 2412 5016 djdjv.exe 86 PID 5016 wrote to memory of 2412 5016 djdjv.exe 86 PID 5016 wrote to memory of 2412 5016 djdjv.exe 86 PID 2412 wrote to memory of 2204 2412 xllflfx.exe 88 PID 2412 wrote to memory of 2204 2412 xllflfx.exe 88 PID 2412 wrote to memory of 2204 2412 xllflfx.exe 88 PID 2204 wrote to memory of 1976 2204 jvpjj.exe 89 PID 2204 wrote to memory of 1976 2204 jvpjj.exe 89 PID 2204 wrote to memory of 1976 2204 jvpjj.exe 89 PID 1976 wrote to memory of 2152 1976 pvppj.exe 91 PID 1976 wrote to memory of 2152 1976 pvppj.exe 91 PID 1976 wrote to memory of 2152 1976 pvppj.exe 91 PID 2152 wrote to memory of 1936 2152 jvjjv.exe 92 PID 2152 wrote to memory of 1936 2152 jvjjv.exe 92 PID 2152 wrote to memory of 1936 2152 jvjjv.exe 92 PID 1936 wrote to memory of 3320 1936 jjdpp.exe 93 PID 1936 wrote to memory of 3320 1936 jjdpp.exe 93 PID 1936 wrote to memory of 3320 1936 jjdpp.exe 93 PID 3320 wrote to memory of 3784 3320 nthtbh.exe 94 PID 3320 wrote to memory of 3784 3320 nthtbh.exe 94 PID 3320 wrote to memory of 3784 3320 nthtbh.exe 94 PID 3784 wrote to memory of 380 3784 pvjpv.exe 95 PID 3784 wrote to memory of 380 3784 pvjpv.exe 95 PID 3784 wrote to memory of 380 3784 pvjpv.exe 95 PID 380 wrote to memory of 1908 380 rfflffx.exe 96 PID 380 wrote to memory of 1908 380 rfflffx.exe 96 PID 380 wrote to memory of 1908 380 rfflffx.exe 96 PID 1908 wrote to memory of 3116 1908 nnnnhn.exe 97 PID 1908 wrote to memory of 3116 1908 nnnnhn.exe 97 PID 1908 wrote to memory of 3116 1908 nnnnhn.exe 97 PID 3116 wrote to memory of 2464 3116 pjdvv.exe 98 PID 3116 wrote to memory of 2464 3116 pjdvv.exe 98 PID 3116 wrote to memory of 2464 3116 pjdvv.exe 98 PID 2464 wrote to memory of 3572 2464 rxffffx.exe 100 PID 2464 wrote to memory of 3572 2464 rxffffx.exe 100 PID 2464 wrote to memory of 3572 2464 rxffffx.exe 100 PID 3572 wrote to memory of 4080 3572 bntbtb.exe 101 PID 3572 wrote to memory of 4080 3572 bntbtb.exe 101 PID 3572 wrote to memory of 4080 3572 bntbtb.exe 101 PID 4080 wrote to memory of 4724 4080 rfrlxfl.exe 102 PID 4080 wrote to memory of 4724 4080 rfrlxfl.exe 102 PID 4080 wrote to memory of 4724 4080 rfrlxfl.exe 102 PID 4724 wrote to memory of 2688 4724 lxlxxxl.exe 103 PID 4724 wrote to memory of 2688 4724 lxlxxxl.exe 103 PID 4724 wrote to memory of 2688 4724 lxlxxxl.exe 103 PID 2688 wrote to memory of 3980 2688 tttnbt.exe 104 PID 2688 wrote to memory of 3980 2688 tttnbt.exe 104 PID 2688 wrote to memory of 3980 2688 tttnbt.exe 104 PID 3980 wrote to memory of 3424 3980 pddpp.exe 105 PID 3980 wrote to memory of 3424 3980 pddpp.exe 105 PID 3980 wrote to memory of 3424 3980 pddpp.exe 105 PID 3424 wrote to memory of 1064 3424 lflllll.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\f78310d1c8cb2b1d77e9e8605a9122f85356ed11b6462231ea3f776c8fe7c40b.exe"C:\Users\Admin\AppData\Local\Temp\f78310d1c8cb2b1d77e9e8605a9122f85356ed11b6462231ea3f776c8fe7c40b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\7vvdv.exec:\7vvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\lfllfxf.exec:\lfllfxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\btnhtb.exec:\btnhtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\djdjv.exec:\djdjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\xllflfx.exec:\xllflfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\jvpjj.exec:\jvpjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\pvppj.exec:\pvppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\jvjjv.exec:\jvjjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\jjdpp.exec:\jjdpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\nthtbh.exec:\nthtbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\pvjpv.exec:\pvjpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\rfflffx.exec:\rfflffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\nnnnhn.exec:\nnnnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\pjdvv.exec:\pjdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\rxffffx.exec:\rxffffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\bntbtb.exec:\bntbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\rfrlxfl.exec:\rfrlxfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\lxlxxxl.exec:\lxlxxxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\tttnbt.exec:\tttnbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\pddpp.exec:\pddpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\lflllll.exec:\lflllll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\xllxlrf.exec:\xllxlrf.exe23⤵
- Executes dropped EXE
PID:1064 -
\??\c:\bbhbbb.exec:\bbhbbb.exe24⤵
- Executes dropped EXE
PID:1996 -
\??\c:\dvjdd.exec:\dvjdd.exe25⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vppdv.exec:\vppdv.exe26⤵
- Executes dropped EXE
PID:4352 -
\??\c:\xxfffrx.exec:\xxfffrx.exe27⤵
- Executes dropped EXE
PID:3988 -
\??\c:\hbthnh.exec:\hbthnh.exe28⤵
- Executes dropped EXE
PID:4444 -
\??\c:\ddppj.exec:\ddppj.exe29⤵
- Executes dropped EXE
PID:2856 -
\??\c:\xrrrllf.exec:\xrrrllf.exe30⤵
- Executes dropped EXE
PID:432 -
\??\c:\tnnnnb.exec:\tnnnnb.exe31⤵
- Executes dropped EXE
PID:3052 -
\??\c:\ddjdp.exec:\ddjdp.exe32⤵
- Executes dropped EXE
PID:2004 -
\??\c:\pdjdj.exec:\pdjdj.exe33⤵
- Executes dropped EXE
PID:5020 -
\??\c:\flxrxrx.exec:\flxrxrx.exe34⤵
- Executes dropped EXE
PID:3944 -
\??\c:\hhhhnt.exec:\hhhhnt.exe35⤵
- Executes dropped EXE
PID:2836 -
\??\c:\5ddpj.exec:\5ddpj.exe36⤵
- Executes dropped EXE
PID:4632 -
\??\c:\5frrlxr.exec:\5frrlxr.exe37⤵
- Executes dropped EXE
PID:3144 -
\??\c:\bbhbtt.exec:\bbhbtt.exe38⤵
- Executes dropped EXE
PID:2620 -
\??\c:\bhbtnt.exec:\bhbtnt.exe39⤵
- Executes dropped EXE
PID:4176 -
\??\c:\nbnhhn.exec:\nbnhhn.exe40⤵
- Executes dropped EXE
PID:2796 -
\??\c:\9dpdj.exec:\9dpdj.exe41⤵
- Executes dropped EXE
PID:1428 -
\??\c:\5vvpj.exec:\5vvpj.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\flrlflf.exec:\flrlflf.exe43⤵
- Executes dropped EXE
PID:2844 -
\??\c:\nntbnn.exec:\nntbnn.exe44⤵
- Executes dropped EXE
PID:2752 -
\??\c:\djjdj.exec:\djjdj.exe45⤵
- Executes dropped EXE
PID:4700 -
\??\c:\jvppj.exec:\jvppj.exe46⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xlfflll.exec:\xlfflll.exe47⤵
- Executes dropped EXE
PID:3252 -
\??\c:\hhnhtn.exec:\hhnhtn.exe48⤵
- Executes dropped EXE
PID:4716 -
\??\c:\nnttnb.exec:\nnttnb.exe49⤵
- Executes dropped EXE
PID:2336 -
\??\c:\pvdvd.exec:\pvdvd.exe50⤵
- Executes dropped EXE
PID:1752 -
\??\c:\lxxxlrf.exec:\lxxxlrf.exe51⤵
- Executes dropped EXE
PID:312 -
\??\c:\lllrrfx.exec:\lllrrfx.exe52⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nbbttt.exec:\nbbttt.exe53⤵
- Executes dropped EXE
PID:3784 -
\??\c:\ddvpd.exec:\ddvpd.exe54⤵
- Executes dropped EXE
PID:1096 -
\??\c:\flrflxl.exec:\flrflxl.exe55⤵
- Executes dropped EXE
PID:3796 -
\??\c:\rrfllrr.exec:\rrfllrr.exe56⤵
- Executes dropped EXE
PID:2120 -
\??\c:\thtbbn.exec:\thtbbn.exe57⤵
- Executes dropped EXE
PID:3800 -
\??\c:\dpjdv.exec:\dpjdv.exe58⤵
- Executes dropped EXE
PID:2820 -
\??\c:\lrllxll.exec:\lrllxll.exe59⤵
- Executes dropped EXE
PID:3152 -
\??\c:\hhntnh.exec:\hhntnh.exe60⤵
- Executes dropped EXE
PID:4904 -
\??\c:\bthbhh.exec:\bthbhh.exe61⤵
- Executes dropped EXE
PID:4004 -
\??\c:\dpddd.exec:\dpddd.exe62⤵
- Executes dropped EXE
PID:3164 -
\??\c:\vddpd.exec:\vddpd.exe63⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xlfrrrr.exec:\xlfrrrr.exe64⤵
- Executes dropped EXE
PID:2688 -
\??\c:\hbnbtn.exec:\hbnbtn.exe65⤵
- Executes dropped EXE
PID:1612 -
\??\c:\nnhhnt.exec:\nnhhnt.exe66⤵PID:656
-
\??\c:\pdvvd.exec:\pdvvd.exe67⤵PID:2212
-
\??\c:\9llfffx.exec:\9llfffx.exe68⤵PID:2376
-
\??\c:\thtntn.exec:\thtntn.exe69⤵PID:4624
-
\??\c:\vjpjv.exec:\vjpjv.exe70⤵PID:5084
-
\??\c:\pjjjp.exec:\pjjjp.exe71⤵PID:4352
-
\??\c:\lxxxrrx.exec:\lxxxrrx.exe72⤵PID:2548
-
\??\c:\flxxfrr.exec:\flxxfrr.exe73⤵PID:4336
-
\??\c:\ntnnhn.exec:\ntnnhn.exe74⤵PID:3044
-
\??\c:\vpppj.exec:\vpppj.exe75⤵PID:3960
-
\??\c:\7rxxrrr.exec:\7rxxrrr.exe76⤵PID:4580
-
\??\c:\xxrxffx.exec:\xxrxffx.exe77⤵PID:5096
-
\??\c:\nbbttb.exec:\nbbttb.exe78⤵PID:1844
-
\??\c:\htbntn.exec:\htbntn.exe79⤵PID:4000
-
\??\c:\vvpdd.exec:\vvpdd.exe80⤵PID:1760
-
\??\c:\xfxxxlf.exec:\xfxxxlf.exe81⤵PID:4492
-
\??\c:\bbtbnh.exec:\bbtbnh.exe82⤵PID:3300
-
\??\c:\vvpjp.exec:\vvpjp.exe83⤵PID:3756
-
\??\c:\rllflfr.exec:\rllflfr.exe84⤵PID:1244
-
\??\c:\hnbbnh.exec:\hnbbnh.exe85⤵PID:4504
-
\??\c:\pjpjd.exec:\pjpjd.exe86⤵PID:4884
-
\??\c:\vdpdv.exec:\vdpdv.exe87⤵PID:2640
-
\??\c:\nntntt.exec:\nntntt.exe88⤵PID:2328
-
\??\c:\dpjdd.exec:\dpjdd.exe89⤵PID:4840
-
\??\c:\ddvpd.exec:\ddvpd.exe90⤵PID:4556
-
\??\c:\lfrxfff.exec:\lfrxfff.exe91⤵PID:4916
-
\??\c:\bnnbtn.exec:\bnnbtn.exe92⤵PID:3448
-
\??\c:\dddpj.exec:\dddpj.exe93⤵PID:1976
-
\??\c:\xlxfrxf.exec:\xlxfrxf.exe94⤵PID:1728
-
\??\c:\tbnhtn.exec:\tbnhtn.exe95⤵PID:4716
-
\??\c:\hthnbn.exec:\hthnbn.exe96⤵PID:2336
-
\??\c:\xfrffxx.exec:\xfrffxx.exe97⤵PID:1752
-
\??\c:\ddpdj.exec:\ddpdj.exe98⤵PID:3564
-
\??\c:\lxrlxlx.exec:\lxrlxlx.exe99⤵PID:2256
-
\??\c:\flfllfr.exec:\flfllfr.exe100⤵PID:2888
-
\??\c:\hnbbnt.exec:\hnbbnt.exe101⤵PID:1096
-
\??\c:\dpppj.exec:\dpppj.exe102⤵PID:1908
-
\??\c:\pvpvd.exec:\pvpvd.exe103⤵PID:2120
-
\??\c:\lxxflrr.exec:\lxxflrr.exe104⤵PID:2936
-
\??\c:\tththt.exec:\tththt.exe105⤵PID:2820
-
\??\c:\vvddp.exec:\vvddp.exe106⤵PID:4128
-
\??\c:\rlrflfr.exec:\rlrflfr.exe107⤵PID:2912
-
\??\c:\ntbttt.exec:\ntbttt.exe108⤵PID:3540
-
\??\c:\pdpvv.exec:\pdpvv.exe109⤵PID:3164
-
\??\c:\fxrfxxr.exec:\fxrfxxr.exe110⤵PID:4008
-
\??\c:\hhbnth.exec:\hhbnth.exe111⤵PID:2688
-
\??\c:\hnnbtn.exec:\hnnbtn.exe112⤵PID:3240
-
\??\c:\pdpjd.exec:\pdpjd.exe113⤵PID:4356
-
\??\c:\lxrrxfx.exec:\lxrrxfx.exe114⤵PID:1116
-
\??\c:\xxllllr.exec:\xxllllr.exe115⤵PID:2376
-
\??\c:\bbthhn.exec:\bbthhn.exe116⤵PID:4952
-
\??\c:\dppvp.exec:\dppvp.exe117⤵PID:1100
-
\??\c:\rxflrxr.exec:\rxflrxr.exe118⤵PID:2276
-
\??\c:\tbhhbt.exec:\tbhhbt.exe119⤵PID:1860
-
\??\c:\jvddj.exec:\jvddj.exe120⤵PID:1560
-
\??\c:\lfflxrx.exec:\lfflxrx.exe121⤵PID:1516
-
\??\c:\7httbt.exec:\7httbt.exe122⤵PID:1496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-