Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 23:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
692b171846ce112664a57eef9e7cc7197a5a4bde0f99582c71fb06b78d66421e.exe
Resource
win7-20240708-en
5 signatures
150 seconds
General
-
Target
692b171846ce112664a57eef9e7cc7197a5a4bde0f99582c71fb06b78d66421e.exe
-
Size
78KB
-
MD5
c74192a8021f3f0d521a2a278d7664bf
-
SHA1
4049d70da0c4018c377a04879d3464c821bdee59
-
SHA256
692b171846ce112664a57eef9e7cc7197a5a4bde0f99582c71fb06b78d66421e
-
SHA512
9fa776ffc694b6b0afdfd827faef394028a1268b6331cd07e151d79f1f372a1b311e54aa562e491f4c39003ef68f48e6d922d84207a3c1172499a252ec4f42ad
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIjaQkPcy8WTeAwHWkMBLrjD:ymb3NkkiQ3mdBjFIpkPcy8qsHjCLrjD
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3948-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1516-35-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1516-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1200-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/968-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/520-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4460 fxxrrrx.exe 4652 nbbhbh.exe 640 jvdvv.exe 1516 rllrlrx.exe 2880 bnntbb.exe 4444 hbhtnb.exe 1412 1jdpj.exe 2268 btbtbb.exe 4888 ntthbt.exe 1688 pjjjj.exe 2528 rxfxrrr.exe 3368 1bnbtt.exe 1200 9tnhbb.exe 220 rxllfff.exe 3036 xlfflll.exe 4352 btbtnh.exe 2188 1jjdv.exe 968 pjjdp.exe 1508 xfrrfff.exe 520 nhhbbb.exe 2788 vvpdd.exe 4916 vpdvd.exe 2228 rlfxxrl.exe 4964 tbttnb.exe 3604 ppjjj.exe 392 dvvpp.exe 1008 3frlrrx.exe 4088 9nttnn.exe 440 vjvvv.exe 3504 fxfxlxr.exe 1136 9thhnn.exe 2244 dddvp.exe 3784 jddjj.exe 4936 rffxxll.exe 4728 flffxff.exe 1856 hbnhbn.exe 1596 btbtnn.exe 1620 7jvdv.exe 4596 dpvvj.exe 4572 fxrrrxl.exe 4436 xflxrfx.exe 3524 bntnnn.exe 3664 hhbtnn.exe 560 ddvvd.exe 2164 fxrrrrx.exe 640 lxfffff.exe 1516 3hnhtt.exe 4796 9tttnt.exe 4904 9ddvp.exe 32 jdppj.exe 2392 rxffxxx.exe 864 fxffxxx.exe 3896 hhtttt.exe 3436 nbbbtb.exe 3900 9jjpj.exe 2632 pvpjv.exe 312 xrlffxx.exe 4748 hbnhbb.exe 3196 hbhhtn.exe 220 jpdvp.exe 3152 9xfflxl.exe 3952 7lrlrrx.exe 4752 nnttnn.exe 2448 dpvpj.exe -
resource yara_rule behavioral2/memory/3948-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1200-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/968-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/520-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2788-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1008-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1136-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3948 wrote to memory of 4460 3948 692b171846ce112664a57eef9e7cc7197a5a4bde0f99582c71fb06b78d66421e.exe 82 PID 3948 wrote to memory of 4460 3948 692b171846ce112664a57eef9e7cc7197a5a4bde0f99582c71fb06b78d66421e.exe 82 PID 3948 wrote to memory of 4460 3948 692b171846ce112664a57eef9e7cc7197a5a4bde0f99582c71fb06b78d66421e.exe 82 PID 4460 wrote to memory of 4652 4460 fxxrrrx.exe 83 PID 4460 wrote to memory of 4652 4460 fxxrrrx.exe 83 PID 4460 wrote to memory of 4652 4460 fxxrrrx.exe 83 PID 4652 wrote to memory of 640 4652 nbbhbh.exe 84 PID 4652 wrote to memory of 640 4652 nbbhbh.exe 84 PID 4652 wrote to memory of 640 4652 nbbhbh.exe 84 PID 640 wrote to memory of 1516 640 jvdvv.exe 85 PID 640 wrote to memory of 1516 640 jvdvv.exe 85 PID 640 wrote to memory of 1516 640 jvdvv.exe 85 PID 1516 wrote to memory of 2880 1516 rllrlrx.exe 86 PID 1516 wrote to memory of 2880 1516 rllrlrx.exe 86 PID 1516 wrote to memory of 2880 1516 rllrlrx.exe 86 PID 2880 wrote to memory of 4444 2880 bnntbb.exe 87 PID 2880 wrote to memory of 4444 2880 bnntbb.exe 87 PID 2880 wrote to memory of 4444 2880 bnntbb.exe 87 PID 4444 wrote to memory of 1412 4444 hbhtnb.exe 88 PID 4444 wrote to memory of 1412 4444 hbhtnb.exe 88 PID 4444 wrote to memory of 1412 4444 hbhtnb.exe 88 PID 1412 wrote to memory of 2268 1412 1jdpj.exe 90 PID 1412 wrote to memory of 2268 1412 1jdpj.exe 90 PID 1412 wrote to memory of 2268 1412 1jdpj.exe 90 PID 2268 wrote to memory of 4888 2268 btbtbb.exe 91 PID 2268 wrote to memory of 4888 2268 btbtbb.exe 91 PID 2268 wrote to memory of 4888 2268 btbtbb.exe 91 PID 4888 wrote to memory of 1688 4888 ntthbt.exe 92 PID 4888 wrote to memory of 1688 4888 ntthbt.exe 92 PID 4888 wrote to memory of 1688 4888 ntthbt.exe 92 PID 1688 wrote to memory of 2528 1688 pjjjj.exe 93 PID 1688 wrote to memory of 2528 1688 pjjjj.exe 93 PID 1688 wrote to memory of 2528 1688 pjjjj.exe 93 PID 2528 wrote to memory of 3368 2528 rxfxrrr.exe 94 PID 2528 wrote to memory of 3368 2528 rxfxrrr.exe 94 PID 2528 wrote to memory of 3368 2528 rxfxrrr.exe 94 PID 3368 wrote to memory of 1200 3368 1bnbtt.exe 95 PID 3368 wrote to memory of 1200 3368 1bnbtt.exe 95 PID 3368 wrote to memory of 1200 3368 1bnbtt.exe 95 PID 1200 wrote to memory of 220 1200 9tnhbb.exe 96 PID 1200 wrote to memory of 220 1200 9tnhbb.exe 96 PID 1200 wrote to memory of 220 1200 9tnhbb.exe 96 PID 220 wrote to memory of 3036 220 rxllfff.exe 97 PID 220 wrote to memory of 3036 220 rxllfff.exe 97 PID 220 wrote to memory of 3036 220 rxllfff.exe 97 PID 3036 wrote to memory of 4352 3036 xlfflll.exe 98 PID 3036 wrote to memory of 4352 3036 xlfflll.exe 98 PID 3036 wrote to memory of 4352 3036 xlfflll.exe 98 PID 4352 wrote to memory of 2188 4352 btbtnh.exe 99 PID 4352 wrote to memory of 2188 4352 btbtnh.exe 99 PID 4352 wrote to memory of 2188 4352 btbtnh.exe 99 PID 2188 wrote to memory of 968 2188 1jjdv.exe 101 PID 2188 wrote to memory of 968 2188 1jjdv.exe 101 PID 2188 wrote to memory of 968 2188 1jjdv.exe 101 PID 968 wrote to memory of 1508 968 pjjdp.exe 102 PID 968 wrote to memory of 1508 968 pjjdp.exe 102 PID 968 wrote to memory of 1508 968 pjjdp.exe 102 PID 1508 wrote to memory of 520 1508 xfrrfff.exe 103 PID 1508 wrote to memory of 520 1508 xfrrfff.exe 103 PID 1508 wrote to memory of 520 1508 xfrrfff.exe 103 PID 520 wrote to memory of 2788 520 nhhbbb.exe 105 PID 520 wrote to memory of 2788 520 nhhbbb.exe 105 PID 520 wrote to memory of 2788 520 nhhbbb.exe 105 PID 2788 wrote to memory of 4916 2788 vvpdd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\692b171846ce112664a57eef9e7cc7197a5a4bde0f99582c71fb06b78d66421e.exe"C:\Users\Admin\AppData\Local\Temp\692b171846ce112664a57eef9e7cc7197a5a4bde0f99582c71fb06b78d66421e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\fxxrrrx.exec:\fxxrrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\nbbhbh.exec:\nbbhbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\jvdvv.exec:\jvdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\rllrlrx.exec:\rllrlrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\bnntbb.exec:\bnntbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\hbhtnb.exec:\hbhtnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\1jdpj.exec:\1jdpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\btbtbb.exec:\btbtbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\ntthbt.exec:\ntthbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\pjjjj.exec:\pjjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\rxfxrrr.exec:\rxfxrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\1bnbtt.exec:\1bnbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\9tnhbb.exec:\9tnhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\rxllfff.exec:\rxllfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\xlfflll.exec:\xlfflll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\btbtnh.exec:\btbtnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\1jjdv.exec:\1jjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\pjjdp.exec:\pjjdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\xfrrfff.exec:\xfrrfff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\nhhbbb.exec:\nhhbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
\??\c:\vvpdd.exec:\vvpdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\vpdvd.exec:\vpdvd.exe23⤵
- Executes dropped EXE
PID:4916 -
\??\c:\rlfxxrl.exec:\rlfxxrl.exe24⤵
- Executes dropped EXE
PID:2228 -
\??\c:\tbttnb.exec:\tbttnb.exe25⤵
- Executes dropped EXE
PID:4964 -
\??\c:\ppjjj.exec:\ppjjj.exe26⤵
- Executes dropped EXE
PID:3604 -
\??\c:\dvvpp.exec:\dvvpp.exe27⤵
- Executes dropped EXE
PID:392 -
\??\c:\3frlrrx.exec:\3frlrrx.exe28⤵
- Executes dropped EXE
PID:1008 -
\??\c:\9nttnn.exec:\9nttnn.exe29⤵
- Executes dropped EXE
PID:4088 -
\??\c:\vjvvv.exec:\vjvvv.exe30⤵
- Executes dropped EXE
PID:440 -
\??\c:\fxfxlxr.exec:\fxfxlxr.exe31⤵
- Executes dropped EXE
PID:3504 -
\??\c:\9thhnn.exec:\9thhnn.exe32⤵
- Executes dropped EXE
PID:1136 -
\??\c:\dddvp.exec:\dddvp.exe33⤵
- Executes dropped EXE
PID:2244 -
\??\c:\jddjj.exec:\jddjj.exe34⤵
- Executes dropped EXE
PID:3784 -
\??\c:\rffxxll.exec:\rffxxll.exe35⤵
- Executes dropped EXE
PID:4936 -
\??\c:\flffxff.exec:\flffxff.exe36⤵
- Executes dropped EXE
PID:4728 -
\??\c:\hbnhbn.exec:\hbnhbn.exe37⤵
- Executes dropped EXE
PID:1856 -
\??\c:\btbtnn.exec:\btbtnn.exe38⤵
- Executes dropped EXE
PID:1596 -
\??\c:\7jvdv.exec:\7jvdv.exe39⤵
- Executes dropped EXE
PID:1620 -
\??\c:\dpvvj.exec:\dpvvj.exe40⤵
- Executes dropped EXE
PID:4596 -
\??\c:\fxrrrxl.exec:\fxrrrxl.exe41⤵
- Executes dropped EXE
PID:4572 -
\??\c:\xflxrfx.exec:\xflxrfx.exe42⤵
- Executes dropped EXE
PID:4436 -
\??\c:\bntnnn.exec:\bntnnn.exe43⤵
- Executes dropped EXE
PID:3524 -
\??\c:\hhbtnn.exec:\hhbtnn.exe44⤵
- Executes dropped EXE
PID:3664 -
\??\c:\ddvvd.exec:\ddvvd.exe45⤵
- Executes dropped EXE
PID:560 -
\??\c:\fxrrrrx.exec:\fxrrrrx.exe46⤵
- Executes dropped EXE
PID:2164 -
\??\c:\lxfffff.exec:\lxfffff.exe47⤵
- Executes dropped EXE
PID:640 -
\??\c:\3hnhtt.exec:\3hnhtt.exe48⤵
- Executes dropped EXE
PID:1516 -
\??\c:\9tttnt.exec:\9tttnt.exe49⤵
- Executes dropped EXE
PID:4796 -
\??\c:\9ddvp.exec:\9ddvp.exe50⤵
- Executes dropped EXE
PID:4904 -
\??\c:\jdppj.exec:\jdppj.exe51⤵
- Executes dropped EXE
PID:32 -
\??\c:\rxffxxx.exec:\rxffxxx.exe52⤵
- Executes dropped EXE
PID:2392 -
\??\c:\fxffxxx.exec:\fxffxxx.exe53⤵
- Executes dropped EXE
PID:864 -
\??\c:\hhtttt.exec:\hhtttt.exe54⤵
- Executes dropped EXE
PID:3896 -
\??\c:\nbbbtb.exec:\nbbbtb.exe55⤵
- Executes dropped EXE
PID:3436 -
\??\c:\9jjpj.exec:\9jjpj.exe56⤵
- Executes dropped EXE
PID:3900 -
\??\c:\pvpjv.exec:\pvpjv.exe57⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xrlffxx.exec:\xrlffxx.exe58⤵
- Executes dropped EXE
PID:312 -
\??\c:\hbnhbb.exec:\hbnhbb.exe59⤵
- Executes dropped EXE
PID:4748 -
\??\c:\hbhhtn.exec:\hbhhtn.exe60⤵
- Executes dropped EXE
PID:3196 -
\??\c:\jpdvp.exec:\jpdvp.exe61⤵
- Executes dropped EXE
PID:220 -
\??\c:\9xfflxl.exec:\9xfflxl.exe62⤵
- Executes dropped EXE
PID:3152 -
\??\c:\7lrlrrx.exec:\7lrlrrx.exe63⤵
- Executes dropped EXE
PID:3952 -
\??\c:\nnttnn.exec:\nnttnn.exe64⤵
- Executes dropped EXE
PID:4752 -
\??\c:\dpvpj.exec:\dpvpj.exe65⤵
- Executes dropped EXE
PID:2448 -
\??\c:\pdddj.exec:\pdddj.exe66⤵PID:1592
-
\??\c:\llrrrlf.exec:\llrrrlf.exe67⤵PID:1296
-
\??\c:\bthbhb.exec:\bthbhb.exe68⤵PID:516
-
\??\c:\hbbbhn.exec:\hbbbhn.exe69⤵PID:1768
-
\??\c:\vjpjj.exec:\vjpjj.exe70⤵PID:3612
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe71⤵PID:4384
-
\??\c:\tntttt.exec:\tntttt.exe72⤵PID:4140
-
\??\c:\tnnhhb.exec:\tnnhhb.exe73⤵PID:3284
-
\??\c:\pdpjd.exec:\pdpjd.exe74⤵PID:2960
-
\??\c:\fxrfxlf.exec:\fxrfxlf.exe75⤵PID:4144
-
\??\c:\nnnhhb.exec:\nnnhhb.exe76⤵PID:2764
-
\??\c:\jjjdd.exec:\jjjdd.exe77⤵PID:3060
-
\??\c:\9dpdj.exec:\9dpdj.exe78⤵PID:4072
-
\??\c:\bhnnnh.exec:\bhnnnh.exe79⤵PID:2072
-
\??\c:\dvdjp.exec:\dvdjp.exe80⤵PID:1468
-
\??\c:\rrfllrl.exec:\rrfllrl.exe81⤵PID:212
-
\??\c:\rflxrff.exec:\rflxrff.exe82⤵PID:1440
-
\??\c:\hhhbbt.exec:\hhhbbt.exe83⤵PID:844
-
\??\c:\jdpjd.exec:\jdpjd.exe84⤵PID:2244
-
\??\c:\pjjdd.exec:\pjjdd.exe85⤵PID:4848
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe86⤵PID:4484
-
\??\c:\5nnnhn.exec:\5nnnhn.exe87⤵PID:452
-
\??\c:\dvpjd.exec:\dvpjd.exe88⤵PID:2060
-
\??\c:\dpdvv.exec:\dpdvv.exe89⤵PID:1260
-
\??\c:\vjvpd.exec:\vjvpd.exe90⤵PID:4956
-
\??\c:\xxllffx.exec:\xxllffx.exe91⤵PID:1680
-
\??\c:\nhhhbh.exec:\nhhhbh.exe92⤵PID:4572
-
\??\c:\5tttnn.exec:\5tttnn.exe93⤵PID:3232
-
\??\c:\jpppp.exec:\jpppp.exe94⤵PID:4284
-
\??\c:\9thbtt.exec:\9thbtt.exe95⤵PID:4460
-
\??\c:\thbbth.exec:\thbbth.exe96⤵PID:588
-
\??\c:\djjjd.exec:\djjjd.exe97⤵PID:1612
-
\??\c:\1jjdd.exec:\1jjdd.exe98⤵PID:828
-
\??\c:\llxrrrx.exec:\llxrrrx.exe99⤵PID:3456
-
\??\c:\xlxrlfx.exec:\xlxrlfx.exe100⤵PID:4600
-
\??\c:\bhnnnn.exec:\bhnnnn.exe101⤵PID:2592
-
\??\c:\dvdjj.exec:\dvdjj.exe102⤵PID:3644
-
\??\c:\pvvvd.exec:\pvvvd.exe103⤵PID:2496
-
\??\c:\ffllrxx.exec:\ffllrxx.exe104⤵PID:228
-
\??\c:\fxffxff.exec:\fxffxff.exe105⤵PID:744
-
\??\c:\hbbbbb.exec:\hbbbbb.exe106⤵PID:3444
-
\??\c:\jjjjj.exec:\jjjjj.exe107⤵PID:2528
-
\??\c:\jdddp.exec:\jdddp.exe108⤵PID:1964
-
\??\c:\rlllfff.exec:\rlllfff.exe109⤵PID:3500
-
\??\c:\thhhht.exec:\thhhht.exe110⤵PID:2276
-
\??\c:\jjppv.exec:\jjppv.exe111⤵PID:3636
-
\??\c:\vvjpp.exec:\vvjpp.exe112⤵PID:2604
-
\??\c:\lxffxxx.exec:\lxffxxx.exe113⤵PID:4720
-
\??\c:\rlllfff.exec:\rlllfff.exe114⤵PID:2520
-
\??\c:\tnnhbb.exec:\tnnhbb.exe115⤵PID:2504
-
\??\c:\htbtnn.exec:\htbtnn.exe116⤵PID:400
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe117⤵PID:3620
-
\??\c:\rffxrrl.exec:\rffxrrl.exe118⤵PID:2172
-
\??\c:\tthhtt.exec:\tthhtt.exe119⤵PID:5108
-
\??\c:\7fffffl.exec:\7fffffl.exe120⤵PID:520
-
\??\c:\nhtnnt.exec:\nhtnnt.exe121⤵PID:3096
-
\??\c:\lrrrrxx.exec:\lrrrrxx.exe122⤵PID:5024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-