Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08-07-2024 00:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
789e2d6afe1d798b80a152301c912c5bac02d826be68d8ac2eee8801b43f5b92.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
789e2d6afe1d798b80a152301c912c5bac02d826be68d8ac2eee8801b43f5b92.exe
-
Size
122KB
-
MD5
7ce3c13809b0ccbd366c902f1f6717ab
-
SHA1
0048b46b5a725eea3528f1cff109aadbaeafedd2
-
SHA256
789e2d6afe1d798b80a152301c912c5bac02d826be68d8ac2eee8801b43f5b92
-
SHA512
b1210f8f860cf69a2936477935b1f49f1932b50325bce2444c9f87aeb1bf5a7afa624e4114ae34cb309ba0b401c085b9a15435167fd35f969d0eb8772ecc5d63
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDomRGApSuLAR2yPBCQ1nDFu1Q8sp:ymb3NkkiQ3mdBjFomR7UsyJC+n0Gsgc8
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/3528-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3164-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3864-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4580 fxrxffr.exe 616 btthbn.exe 4248 1pjjp.exe 3164 rlrlffx.exe 1828 vdppj.exe 3256 llrffrf.exe 3408 hnnhtb.exe 1496 jddpv.exe 2044 jpppd.exe 3388 lllxrlx.exe 3496 hhhbbn.exe 2016 rllrxxr.exe 3056 tthhbh.exe 3412 pjvvd.exe 4344 tbhbbb.exe 868 jdvvd.exe 1468 ttnhnn.exe 5100 jvjdv.exe 1384 lrrrlll.exe 4092 btnbhh.exe 3864 xrlflrl.exe 2616 lxflrfl.exe 1504 jvjdp.exe 3824 lrlxrxl.exe 1052 htnbtn.exe 5060 rxfrrrr.exe 5004 jjdjd.exe 4280 jpjdj.exe 3720 hnbhtn.exe 264 rfxrrxl.exe 4480 9thnnt.exe 2916 bhtbhn.exe 3528 dvdjj.exe 1420 fxflflx.exe 336 tbnhhh.exe 2284 ppdjp.exe 3020 flrlrfr.exe 1828 btbttt.exe 2756 pdvpj.exe 2204 btbntt.exe 1988 djjjj.exe 4396 5ffrllx.exe 1872 pvvdv.exe 4020 pdpjp.exe 408 rfffrrl.exe 1564 ppdpd.exe 5048 flflfrx.exe 2752 btbntn.exe 2120 ppdpv.exe 3680 lxfffll.exe 3056 ddvdp.exe 3756 nhhtht.exe 916 djdvp.exe 4492 lxfxxxr.exe 392 nbbnhn.exe 364 jjpjp.exe 2240 frlfflr.exe 5100 hhtthn.exe 3132 jppjj.exe 960 rfflfxx.exe 1028 tnbbtt.exe 2152 vvvpj.exe 3232 frfrlfx.exe 2180 ddjdv.exe -
resource yara_rule behavioral2/memory/3528-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3164-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1828-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3864-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-194-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3528 wrote to memory of 4580 3528 789e2d6afe1d798b80a152301c912c5bac02d826be68d8ac2eee8801b43f5b92.exe 82 PID 3528 wrote to memory of 4580 3528 789e2d6afe1d798b80a152301c912c5bac02d826be68d8ac2eee8801b43f5b92.exe 82 PID 3528 wrote to memory of 4580 3528 789e2d6afe1d798b80a152301c912c5bac02d826be68d8ac2eee8801b43f5b92.exe 82 PID 4580 wrote to memory of 616 4580 fxrxffr.exe 83 PID 4580 wrote to memory of 616 4580 fxrxffr.exe 83 PID 4580 wrote to memory of 616 4580 fxrxffr.exe 83 PID 616 wrote to memory of 4248 616 btthbn.exe 84 PID 616 wrote to memory of 4248 616 btthbn.exe 84 PID 616 wrote to memory of 4248 616 btthbn.exe 84 PID 4248 wrote to memory of 3164 4248 1pjjp.exe 85 PID 4248 wrote to memory of 3164 4248 1pjjp.exe 85 PID 4248 wrote to memory of 3164 4248 1pjjp.exe 85 PID 3164 wrote to memory of 1828 3164 rlrlffx.exe 122 PID 3164 wrote to memory of 1828 3164 rlrlffx.exe 122 PID 3164 wrote to memory of 1828 3164 rlrlffx.exe 122 PID 1828 wrote to memory of 3256 1828 vdppj.exe 88 PID 1828 wrote to memory of 3256 1828 vdppj.exe 88 PID 1828 wrote to memory of 3256 1828 vdppj.exe 88 PID 3256 wrote to memory of 3408 3256 llrffrf.exe 89 PID 3256 wrote to memory of 3408 3256 llrffrf.exe 89 PID 3256 wrote to memory of 3408 3256 llrffrf.exe 89 PID 3408 wrote to memory of 1496 3408 hnnhtb.exe 90 PID 3408 wrote to memory of 1496 3408 hnnhtb.exe 90 PID 3408 wrote to memory of 1496 3408 hnnhtb.exe 90 PID 1496 wrote to memory of 2044 1496 jddpv.exe 92 PID 1496 wrote to memory of 2044 1496 jddpv.exe 92 PID 1496 wrote to memory of 2044 1496 jddpv.exe 92 PID 2044 wrote to memory of 3388 2044 jpppd.exe 93 PID 2044 wrote to memory of 3388 2044 jpppd.exe 93 PID 2044 wrote to memory of 3388 2044 jpppd.exe 93 PID 3388 wrote to memory of 3496 3388 lllxrlx.exe 94 PID 3388 wrote to memory of 3496 3388 lllxrlx.exe 94 PID 3388 wrote to memory of 3496 3388 lllxrlx.exe 94 PID 3496 wrote to memory of 2016 3496 hhhbbn.exe 95 PID 3496 wrote to memory of 2016 3496 hhhbbn.exe 95 PID 3496 wrote to memory of 2016 3496 hhhbbn.exe 95 PID 2016 wrote to memory of 3056 2016 rllrxxr.exe 291 PID 2016 wrote to memory of 3056 2016 rllrxxr.exe 291 PID 2016 wrote to memory of 3056 2016 rllrxxr.exe 291 PID 3056 wrote to memory of 3412 3056 tthhbh.exe 98 PID 3056 wrote to memory of 3412 3056 tthhbh.exe 98 PID 3056 wrote to memory of 3412 3056 tthhbh.exe 98 PID 3412 wrote to memory of 4344 3412 pjvvd.exe 347 PID 3412 wrote to memory of 4344 3412 pjvvd.exe 347 PID 3412 wrote to memory of 4344 3412 pjvvd.exe 347 PID 4344 wrote to memory of 868 4344 tbhbbb.exe 240 PID 4344 wrote to memory of 868 4344 tbhbbb.exe 240 PID 4344 wrote to memory of 868 4344 tbhbbb.exe 240 PID 868 wrote to memory of 1468 868 jdvvd.exe 101 PID 868 wrote to memory of 1468 868 jdvvd.exe 101 PID 868 wrote to memory of 1468 868 jdvvd.exe 101 PID 1468 wrote to memory of 5100 1468 ttnhnn.exe 191 PID 1468 wrote to memory of 5100 1468 ttnhnn.exe 191 PID 1468 wrote to memory of 5100 1468 ttnhnn.exe 191 PID 5100 wrote to memory of 1384 5100 jvjdv.exe 411 PID 5100 wrote to memory of 1384 5100 jvjdv.exe 411 PID 5100 wrote to memory of 1384 5100 jvjdv.exe 411 PID 1384 wrote to memory of 4092 1384 lrrrlll.exe 104 PID 1384 wrote to memory of 4092 1384 lrrrlll.exe 104 PID 1384 wrote to memory of 4092 1384 lrrrlll.exe 104 PID 4092 wrote to memory of 3864 4092 btnbhh.exe 105 PID 4092 wrote to memory of 3864 4092 btnbhh.exe 105 PID 4092 wrote to memory of 3864 4092 btnbhh.exe 105 PID 3864 wrote to memory of 2616 3864 xrlflrl.exe 306
Processes
-
C:\Users\Admin\AppData\Local\Temp\789e2d6afe1d798b80a152301c912c5bac02d826be68d8ac2eee8801b43f5b92.exe"C:\Users\Admin\AppData\Local\Temp\789e2d6afe1d798b80a152301c912c5bac02d826be68d8ac2eee8801b43f5b92.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\fxrxffr.exec:\fxrxffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\btthbn.exec:\btthbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
\??\c:\1pjjp.exec:\1pjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\rlrlffx.exec:\rlrlffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\vdppj.exec:\vdppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\llrffrf.exec:\llrffrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\hnnhtb.exec:\hnnhtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\jddpv.exec:\jddpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\jpppd.exec:\jpppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\lllxrlx.exec:\lllxrlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\hhhbbn.exec:\hhhbbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\rllrxxr.exec:\rllrxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\tthhbh.exec:\tthhbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\pjvvd.exec:\pjvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\tbhbbb.exec:\tbhbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\jdvvd.exec:\jdvvd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\ttnhnn.exec:\ttnhnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\jvjdv.exec:\jvjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\lrrrlll.exec:\lrrrlll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\btnbhh.exec:\btnbhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\xrlflrl.exec:\xrlflrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\lxflrfl.exec:\lxflrfl.exe23⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jvjdp.exec:\jvjdp.exe24⤵
- Executes dropped EXE
PID:1504 -
\??\c:\lrlxrxl.exec:\lrlxrxl.exe25⤵
- Executes dropped EXE
PID:3824 -
\??\c:\htnbtn.exec:\htnbtn.exe26⤵
- Executes dropped EXE
PID:1052 -
\??\c:\rxfrrrr.exec:\rxfrrrr.exe27⤵
- Executes dropped EXE
PID:5060 -
\??\c:\jjdjd.exec:\jjdjd.exe28⤵
- Executes dropped EXE
PID:5004 -
\??\c:\jpjdj.exec:\jpjdj.exe29⤵
- Executes dropped EXE
PID:4280 -
\??\c:\hnbhtn.exec:\hnbhtn.exe30⤵
- Executes dropped EXE
PID:3720 -
\??\c:\rfxrrxl.exec:\rfxrrxl.exe31⤵
- Executes dropped EXE
PID:264 -
\??\c:\9thnnt.exec:\9thnnt.exe32⤵
- Executes dropped EXE
PID:4480 -
\??\c:\bhtbhn.exec:\bhtbhn.exe33⤵
- Executes dropped EXE
PID:2916 -
\??\c:\dvdjj.exec:\dvdjj.exe34⤵
- Executes dropped EXE
PID:3528 -
\??\c:\fxflflx.exec:\fxflflx.exe35⤵
- Executes dropped EXE
PID:1420 -
\??\c:\tbnhhh.exec:\tbnhhh.exe36⤵
- Executes dropped EXE
PID:336 -
\??\c:\ppdjp.exec:\ppdjp.exe37⤵
- Executes dropped EXE
PID:2284 -
\??\c:\flrlrfr.exec:\flrlrfr.exe38⤵
- Executes dropped EXE
PID:3020 -
\??\c:\btbttt.exec:\btbttt.exe39⤵
- Executes dropped EXE
PID:1828 -
\??\c:\pdvpj.exec:\pdvpj.exe40⤵
- Executes dropped EXE
PID:2756 -
\??\c:\btbntt.exec:\btbntt.exe41⤵
- Executes dropped EXE
PID:2204 -
\??\c:\djjjj.exec:\djjjj.exe42⤵
- Executes dropped EXE
PID:1988 -
\??\c:\5ffrllx.exec:\5ffrllx.exe43⤵
- Executes dropped EXE
PID:4396 -
\??\c:\pvvdv.exec:\pvvdv.exe44⤵
- Executes dropped EXE
PID:1872 -
\??\c:\pdpjp.exec:\pdpjp.exe45⤵
- Executes dropped EXE
PID:4020 -
\??\c:\rfffrrl.exec:\rfffrrl.exe46⤵
- Executes dropped EXE
PID:408 -
\??\c:\ppdpd.exec:\ppdpd.exe47⤵
- Executes dropped EXE
PID:1564 -
\??\c:\flflfrx.exec:\flflfrx.exe48⤵
- Executes dropped EXE
PID:5048 -
\??\c:\btbntn.exec:\btbntn.exe49⤵
- Executes dropped EXE
PID:2752 -
\??\c:\ppdpv.exec:\ppdpv.exe50⤵
- Executes dropped EXE
PID:2120 -
\??\c:\lxfffll.exec:\lxfffll.exe51⤵
- Executes dropped EXE
PID:3680 -
\??\c:\ddvdp.exec:\ddvdp.exe52⤵
- Executes dropped EXE
PID:3056 -
\??\c:\nhhtht.exec:\nhhtht.exe53⤵
- Executes dropped EXE
PID:3756 -
\??\c:\djdvp.exec:\djdvp.exe54⤵
- Executes dropped EXE
PID:916 -
\??\c:\lxfxxxr.exec:\lxfxxxr.exe55⤵
- Executes dropped EXE
PID:4492 -
\??\c:\nbbnhn.exec:\nbbnhn.exe56⤵
- Executes dropped EXE
PID:392 -
\??\c:\jjpjp.exec:\jjpjp.exe57⤵
- Executes dropped EXE
PID:364 -
\??\c:\frlfflr.exec:\frlfflr.exe58⤵
- Executes dropped EXE
PID:2240 -
\??\c:\hhtthn.exec:\hhtthn.exe59⤵
- Executes dropped EXE
PID:5100 -
\??\c:\jppjj.exec:\jppjj.exe60⤵
- Executes dropped EXE
PID:3132 -
\??\c:\rfflfxx.exec:\rfflfxx.exe61⤵
- Executes dropped EXE
PID:960 -
\??\c:\tnbbtt.exec:\tnbbtt.exe62⤵
- Executes dropped EXE
PID:1028 -
\??\c:\vvvpj.exec:\vvvpj.exe63⤵
- Executes dropped EXE
PID:2152 -
\??\c:\frfrlfx.exec:\frfrlfx.exe64⤵
- Executes dropped EXE
PID:3232 -
\??\c:\ddjdv.exec:\ddjdv.exe65⤵
- Executes dropped EXE
PID:2180 -
\??\c:\lflflll.exec:\lflflll.exe66⤵PID:2592
-
\??\c:\dvvdj.exec:\dvvdj.exe67⤵PID:3824
-
\??\c:\frxlfxl.exec:\frxlfxl.exe68⤵PID:736
-
\??\c:\vpvdv.exec:\vpvdv.exe69⤵PID:4236
-
\??\c:\lrffrlf.exec:\lrffrlf.exe70⤵PID:4532
-
\??\c:\vdjpj.exec:\vdjpj.exe71⤵PID:5004
-
\??\c:\lrxxfxr.exec:\lrxxfxr.exe72⤵PID:4444
-
\??\c:\vvpvd.exec:\vvpvd.exe73⤵PID:4064
-
\??\c:\rrrllll.exec:\rrrllll.exe74⤵PID:3720
-
\??\c:\htnbhn.exec:\htnbhn.exe75⤵PID:264
-
\??\c:\7vvpd.exec:\7vvpd.exe76⤵PID:1188
-
\??\c:\bntnnt.exec:\bntnnt.exe77⤵PID:4516
-
\??\c:\vpjdv.exec:\vpjdv.exe78⤵PID:5012
-
\??\c:\fxllrrx.exec:\fxllrrx.exe79⤵PID:2140
-
\??\c:\lfrxffr.exec:\lfrxffr.exe80⤵PID:616
-
\??\c:\dpjdd.exec:\dpjdd.exe81⤵PID:1420
-
\??\c:\rflxlrr.exec:\rflxlrr.exe82⤵PID:336
-
\??\c:\pdpjp.exec:\pdpjp.exe83⤵PID:1452
-
\??\c:\bhnttt.exec:\bhnttt.exe84⤵PID:4012
-
\??\c:\llllrfl.exec:\llllrfl.exe85⤵PID:4364
-
\??\c:\vjjvd.exec:\vjjvd.exe86⤵PID:1164
-
\??\c:\hhhbbb.exec:\hhhbbb.exe87⤵PID:980
-
\??\c:\lrrrrxl.exec:\lrrrrxl.exe88⤵PID:4548
-
\??\c:\pjvjp.exec:\pjvjp.exe89⤵PID:1200
-
\??\c:\xfxrllr.exec:\xfxrllr.exe90⤵PID:3964
-
\??\c:\nnnhtt.exec:\nnnhtt.exe91⤵PID:2144
-
\??\c:\xrlrrrl.exec:\xrlrrrl.exe92⤵PID:3472
-
\??\c:\pjvpp.exec:\pjvpp.exe93⤵PID:1908
-
\??\c:\ffxfrfx.exec:\ffxfrfx.exe94⤵PID:4612
-
\??\c:\bhhtnt.exec:\bhhtnt.exe95⤵PID:4732
-
\??\c:\pvddj.exec:\pvddj.exe96⤵PID:2752
-
\??\c:\rrfflxl.exec:\rrfflxl.exe97⤵PID:4016
-
\??\c:\nbttnb.exec:\nbttnb.exe98⤵PID:1372
-
\??\c:\vjdvp.exec:\vjdvp.exe99⤵PID:2500
-
\??\c:\dpdvv.exec:\dpdvv.exe100⤵PID:5064
-
\??\c:\xffxrxl.exec:\xffxrxl.exe101⤵PID:3096
-
\??\c:\thtbtn.exec:\thtbtn.exe102⤵PID:4028
-
\??\c:\pvpjp.exec:\pvpjp.exe103⤵PID:4564
-
\??\c:\llxfrfl.exec:\llxfrfl.exe104⤵PID:5092
-
\??\c:\hnhbtt.exec:\hnhbtt.exe105⤵PID:2356
-
\??\c:\djvdv.exec:\djvdv.exe106⤵PID:4088
-
\??\c:\rrflrfx.exec:\rrflrfx.exe107⤵PID:2240
-
\??\c:\thnnnb.exec:\thnnnb.exe108⤵PID:5100
-
\??\c:\ffrxrlf.exec:\ffrxrlf.exe109⤵PID:1936
-
\??\c:\vdppd.exec:\vdppd.exe110⤵PID:3628
-
\??\c:\rxfrfrf.exec:\rxfrfrf.exe111⤵PID:940
-
\??\c:\nnttbh.exec:\nnttbh.exe112⤵PID:3268
-
\??\c:\jjvvd.exec:\jjvvd.exe113⤵PID:3344
-
\??\c:\ntbbnh.exec:\ntbbnh.exe114⤵PID:1836
-
\??\c:\3jjdv.exec:\3jjdv.exe115⤵PID:2768
-
\??\c:\fxxxfff.exec:\fxxxfff.exe116⤵PID:2592
-
\??\c:\hhhnnn.exec:\hhhnnn.exe117⤵PID:1052
-
\??\c:\jjdpj.exec:\jjdpj.exe118⤵PID:5060
-
\??\c:\lfxrflr.exec:\lfxrflr.exe119⤵PID:4376
-
\??\c:\bbhbbh.exec:\bbhbbh.exe120⤵PID:4532
-
\??\c:\jdpvp.exec:\jdpvp.exe121⤵PID:5020
-
\??\c:\bnhhbh.exec:\bnhhbh.exe122⤵PID:1676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-