Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09-07-2024 07:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f685f662584f6fac10287c9f3b09c682878f3de6c1a6daa0c9fa1f175ff1ad9c.exe
Resource
win7-20240705-en
windows7-x64
5 signatures
150 seconds
General
-
Target
f685f662584f6fac10287c9f3b09c682878f3de6c1a6daa0c9fa1f175ff1ad9c.exe
-
Size
402KB
-
MD5
c1a1293a263eb2f969c195df613a3d19
-
SHA1
0528035e8ae10f6e30716f27d27659a27e1ff4f0
-
SHA256
f685f662584f6fac10287c9f3b09c682878f3de6c1a6daa0c9fa1f175ff1ad9c
-
SHA512
35d9e5c4cc02734c62bea0f44608a571ae367336c8dc58e5f4b7b85a3bc28235d4cf88cd21bd840663fd8ac1bab52aceb2da8ae7c4193ede9733af4e0be99425
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmX5kr+uIBpkJITEEuR9XTVyXmmBv:n3C9BRIG0asYFm71mJkr+uIBe1T8X9
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/2120-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2916-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2628-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/960-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1516-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1376-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/940-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4264 flffxrl.exe 4656 bhhbnt.exe 2916 xlrflxx.exe 4192 tthnbh.exe 1060 rlrxrfx.exe 4100 jvdpp.exe 1512 rfxxlxf.exe 884 nbhhnn.exe 5116 vvppd.exe 2628 jjjpj.exe 960 jppdj.exe 1516 lxlxrxr.exe 4200 rrfxrlf.exe 2864 bnthhn.exe 1376 dpvvv.exe 3028 btnnnn.exe 2264 dvdjv.exe 1680 lxfrlff.exe 4784 ddjdv.exe 3900 frllfxx.exe 2148 thttbb.exe 1648 ddjjj.exe 940 vpjdd.exe 3120 rrlllll.exe 2612 bhhhbt.exe 3088 hntthb.exe 4072 vdvpp.exe 2544 ppddv.exe 3012 pdvvv.exe 3024 hnnnnn.exe 3972 xlxxrrl.exe 1820 pddvv.exe 768 flfffxx.exe 840 ppppp.exe 4964 rxlrllx.exe 4076 dpjjd.exe 1712 5flfxxx.exe 3796 rrxrxxl.exe 888 hntnnn.exe 5032 dddpj.exe 1288 rxlllrr.exe 2180 hbthnn.exe 2932 pjpvp.exe 1420 lfllffl.exe 2864 vvpjd.exe 1376 jvddv.exe 4396 lxlfllf.exe 4332 bbhhbt.exe 4172 1jvpd.exe 2652 5fllffx.exe 2376 7htnhn.exe 3016 hntbbt.exe 4820 vpdjp.exe 1744 xffxxxx.exe 844 nbtttt.exe 3936 3ppvv.exe 4408 llffxfx.exe 4528 hbhhnb.exe 2316 jddvd.exe 2168 xxrlfrl.exe 4876 3nbntn.exe 4064 dvvvv.exe 3388 bhnhbn.exe 3012 tthbhn.exe -
resource yara_rule behavioral2/memory/2120-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2916-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2628-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/940-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2120 wrote to memory of 4264 2120 f685f662584f6fac10287c9f3b09c682878f3de6c1a6daa0c9fa1f175ff1ad9c.exe 89 PID 2120 wrote to memory of 4264 2120 f685f662584f6fac10287c9f3b09c682878f3de6c1a6daa0c9fa1f175ff1ad9c.exe 89 PID 2120 wrote to memory of 4264 2120 f685f662584f6fac10287c9f3b09c682878f3de6c1a6daa0c9fa1f175ff1ad9c.exe 89 PID 4264 wrote to memory of 4656 4264 flffxrl.exe 90 PID 4264 wrote to memory of 4656 4264 flffxrl.exe 90 PID 4264 wrote to memory of 4656 4264 flffxrl.exe 90 PID 4656 wrote to memory of 2916 4656 bhhbnt.exe 91 PID 4656 wrote to memory of 2916 4656 bhhbnt.exe 91 PID 4656 wrote to memory of 2916 4656 bhhbnt.exe 91 PID 2916 wrote to memory of 4192 2916 xlrflxx.exe 92 PID 2916 wrote to memory of 4192 2916 xlrflxx.exe 92 PID 2916 wrote to memory of 4192 2916 xlrflxx.exe 92 PID 4192 wrote to memory of 1060 4192 tthnbh.exe 95 PID 4192 wrote to memory of 1060 4192 tthnbh.exe 95 PID 4192 wrote to memory of 1060 4192 tthnbh.exe 95 PID 1060 wrote to memory of 4100 1060 rlrxrfx.exe 97 PID 1060 wrote to memory of 4100 1060 rlrxrfx.exe 97 PID 1060 wrote to memory of 4100 1060 rlrxrfx.exe 97 PID 4100 wrote to memory of 1512 4100 jvdpp.exe 98 PID 4100 wrote to memory of 1512 4100 jvdpp.exe 98 PID 4100 wrote to memory of 1512 4100 jvdpp.exe 98 PID 1512 wrote to memory of 884 1512 rfxxlxf.exe 99 PID 1512 wrote to memory of 884 1512 rfxxlxf.exe 99 PID 1512 wrote to memory of 884 1512 rfxxlxf.exe 99 PID 884 wrote to memory of 5116 884 nbhhnn.exe 100 PID 884 wrote to memory of 5116 884 nbhhnn.exe 100 PID 884 wrote to memory of 5116 884 nbhhnn.exe 100 PID 5116 wrote to memory of 2628 5116 vvppd.exe 101 PID 5116 wrote to memory of 2628 5116 vvppd.exe 101 PID 5116 wrote to memory of 2628 5116 vvppd.exe 101 PID 2628 wrote to memory of 960 2628 jjjpj.exe 102 PID 2628 wrote to memory of 960 2628 jjjpj.exe 102 PID 2628 wrote to memory of 960 2628 jjjpj.exe 102 PID 960 wrote to memory of 1516 960 jppdj.exe 103 PID 960 wrote to memory of 1516 960 jppdj.exe 103 PID 960 wrote to memory of 1516 960 jppdj.exe 103 PID 1516 wrote to memory of 4200 1516 lxlxrxr.exe 104 PID 1516 wrote to memory of 4200 1516 lxlxrxr.exe 104 PID 1516 wrote to memory of 4200 1516 lxlxrxr.exe 104 PID 4200 wrote to memory of 2864 4200 rrfxrlf.exe 105 PID 4200 wrote to memory of 2864 4200 rrfxrlf.exe 105 PID 4200 wrote to memory of 2864 4200 rrfxrlf.exe 105 PID 2864 wrote to memory of 1376 2864 bnthhn.exe 106 PID 2864 wrote to memory of 1376 2864 bnthhn.exe 106 PID 2864 wrote to memory of 1376 2864 bnthhn.exe 106 PID 1376 wrote to memory of 3028 1376 dpvvv.exe 107 PID 1376 wrote to memory of 3028 1376 dpvvv.exe 107 PID 1376 wrote to memory of 3028 1376 dpvvv.exe 107 PID 3028 wrote to memory of 2264 3028 btnnnn.exe 108 PID 3028 wrote to memory of 2264 3028 btnnnn.exe 108 PID 3028 wrote to memory of 2264 3028 btnnnn.exe 108 PID 2264 wrote to memory of 1680 2264 dvdjv.exe 109 PID 2264 wrote to memory of 1680 2264 dvdjv.exe 109 PID 2264 wrote to memory of 1680 2264 dvdjv.exe 109 PID 1680 wrote to memory of 4784 1680 lxfrlff.exe 110 PID 1680 wrote to memory of 4784 1680 lxfrlff.exe 110 PID 1680 wrote to memory of 4784 1680 lxfrlff.exe 110 PID 4784 wrote to memory of 3900 4784 ddjdv.exe 111 PID 4784 wrote to memory of 3900 4784 ddjdv.exe 111 PID 4784 wrote to memory of 3900 4784 ddjdv.exe 111 PID 3900 wrote to memory of 2148 3900 frllfxx.exe 112 PID 3900 wrote to memory of 2148 3900 frllfxx.exe 112 PID 3900 wrote to memory of 2148 3900 frllfxx.exe 112 PID 2148 wrote to memory of 1648 2148 thttbb.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\f685f662584f6fac10287c9f3b09c682878f3de6c1a6daa0c9fa1f175ff1ad9c.exe"C:\Users\Admin\AppData\Local\Temp\f685f662584f6fac10287c9f3b09c682878f3de6c1a6daa0c9fa1f175ff1ad9c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\flffxrl.exec:\flffxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\bhhbnt.exec:\bhhbnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\xlrflxx.exec:\xlrflxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\tthnbh.exec:\tthnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\rlrxrfx.exec:\rlrxrfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\jvdpp.exec:\jvdpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\rfxxlxf.exec:\rfxxlxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\nbhhnn.exec:\nbhhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\vvppd.exec:\vvppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\jjjpj.exec:\jjjpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\jppdj.exec:\jppdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\lxlxrxr.exec:\lxlxrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\rrfxrlf.exec:\rrfxrlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\bnthhn.exec:\bnthhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\dpvvv.exec:\dpvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\btnnnn.exec:\btnnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\dvdjv.exec:\dvdjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\lxfrlff.exec:\lxfrlff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\ddjdv.exec:\ddjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\frllfxx.exec:\frllfxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\thttbb.exec:\thttbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\ddjjj.exec:\ddjjj.exe23⤵
- Executes dropped EXE
PID:1648 -
\??\c:\vpjdd.exec:\vpjdd.exe24⤵
- Executes dropped EXE
PID:940 -
\??\c:\rrlllll.exec:\rrlllll.exe25⤵
- Executes dropped EXE
PID:3120 -
\??\c:\bhhhbt.exec:\bhhhbt.exe26⤵
- Executes dropped EXE
PID:2612 -
\??\c:\hntthb.exec:\hntthb.exe27⤵
- Executes dropped EXE
PID:3088 -
\??\c:\vdvpp.exec:\vdvpp.exe28⤵
- Executes dropped EXE
PID:4072 -
\??\c:\ppddv.exec:\ppddv.exe29⤵
- Executes dropped EXE
PID:2544 -
\??\c:\pdvvv.exec:\pdvvv.exe30⤵
- Executes dropped EXE
PID:3012 -
\??\c:\hnnnnn.exec:\hnnnnn.exe31⤵
- Executes dropped EXE
PID:3024 -
\??\c:\xlxxrrl.exec:\xlxxrrl.exe32⤵
- Executes dropped EXE
PID:3972 -
\??\c:\pddvv.exec:\pddvv.exe33⤵
- Executes dropped EXE
PID:1820 -
\??\c:\flfffxx.exec:\flfffxx.exe34⤵
- Executes dropped EXE
PID:768 -
\??\c:\ppppp.exec:\ppppp.exe35⤵
- Executes dropped EXE
PID:840 -
\??\c:\rxlrllx.exec:\rxlrllx.exe36⤵
- Executes dropped EXE
PID:4964 -
\??\c:\dpjjd.exec:\dpjjd.exe37⤵
- Executes dropped EXE
PID:4076 -
\??\c:\5flfxxx.exec:\5flfxxx.exe38⤵
- Executes dropped EXE
PID:1712 -
\??\c:\rrxrxxl.exec:\rrxrxxl.exe39⤵
- Executes dropped EXE
PID:3796 -
\??\c:\hntnnn.exec:\hntnnn.exe40⤵
- Executes dropped EXE
PID:888 -
\??\c:\dddpj.exec:\dddpj.exe41⤵
- Executes dropped EXE
PID:5032 -
\??\c:\rxlllrr.exec:\rxlllrr.exe42⤵
- Executes dropped EXE
PID:1288 -
\??\c:\hbthnn.exec:\hbthnn.exe43⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pjpvp.exec:\pjpvp.exe44⤵
- Executes dropped EXE
PID:2932 -
\??\c:\lfllffl.exec:\lfllffl.exe45⤵
- Executes dropped EXE
PID:1420 -
\??\c:\vvpjd.exec:\vvpjd.exe46⤵
- Executes dropped EXE
PID:2864 -
\??\c:\jvddv.exec:\jvddv.exe47⤵
- Executes dropped EXE
PID:1376 -
\??\c:\lxlfllf.exec:\lxlfllf.exe48⤵
- Executes dropped EXE
PID:4396 -
\??\c:\bbhhbt.exec:\bbhhbt.exe49⤵
- Executes dropped EXE
PID:4332 -
\??\c:\1jvpd.exec:\1jvpd.exe50⤵
- Executes dropped EXE
PID:4172 -
\??\c:\5fllffx.exec:\5fllffx.exe51⤵
- Executes dropped EXE
PID:2652 -
\??\c:\7htnhn.exec:\7htnhn.exe52⤵
- Executes dropped EXE
PID:2376 -
\??\c:\hntbbt.exec:\hntbbt.exe53⤵
- Executes dropped EXE
PID:3016 -
\??\c:\vpdjp.exec:\vpdjp.exe54⤵
- Executes dropped EXE
PID:4820 -
\??\c:\xffxxxx.exec:\xffxxxx.exe55⤵
- Executes dropped EXE
PID:1744 -
\??\c:\nbtttt.exec:\nbtttt.exe56⤵
- Executes dropped EXE
PID:844 -
\??\c:\3ppvv.exec:\3ppvv.exe57⤵
- Executes dropped EXE
PID:3936 -
\??\c:\llffxfx.exec:\llffxfx.exe58⤵
- Executes dropped EXE
PID:4408 -
\??\c:\hbhhnb.exec:\hbhhnb.exe59⤵
- Executes dropped EXE
PID:4528 -
\??\c:\jddvd.exec:\jddvd.exe60⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xxrlfrl.exec:\xxrlfrl.exe61⤵
- Executes dropped EXE
PID:2168 -
\??\c:\3nbntn.exec:\3nbntn.exe62⤵
- Executes dropped EXE
PID:4876 -
\??\c:\dvvvv.exec:\dvvvv.exe63⤵
- Executes dropped EXE
PID:4064 -
\??\c:\bhnhbn.exec:\bhnhbn.exe64⤵
- Executes dropped EXE
PID:3388 -
\??\c:\tthbhn.exec:\tthbhn.exe65⤵
- Executes dropped EXE
PID:3012 -
\??\c:\rrrrfxr.exec:\rrrrfxr.exe66⤵PID:4144
-
\??\c:\pvdpd.exec:\pvdpd.exe67⤵PID:4976
-
\??\c:\dvvvd.exec:\dvvvd.exe68⤵PID:2624
-
\??\c:\xxxrllf.exec:\xxxrllf.exe69⤵PID:796
-
\??\c:\bhttbb.exec:\bhttbb.exe70⤵PID:768
-
\??\c:\ffrlxrf.exec:\ffrlxrf.exe71⤵PID:3656
-
\??\c:\hthbtb.exec:\hthbtb.exe72⤵PID:4600
-
\??\c:\jdddd.exec:\jdddd.exe73⤵PID:1452
-
\??\c:\xrlxrlf.exec:\xrlxrlf.exe74⤵PID:1712
-
\??\c:\nnbthh.exec:\nnbthh.exe75⤵PID:2496
-
\??\c:\jpvpp.exec:\jpvpp.exe76⤵PID:888
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe77⤵PID:5032
-
\??\c:\hnnnhn.exec:\hnnnhn.exe78⤵PID:4380
-
\??\c:\vjdvd.exec:\vjdvd.exe79⤵PID:4024
-
\??\c:\xrrxffx.exec:\xrrxffx.exe80⤵PID:1168
-
\??\c:\hbnttn.exec:\hbnttn.exe81⤵PID:2124
-
\??\c:\3jjpj.exec:\3jjpj.exe82⤵PID:1940
-
\??\c:\frxxxxf.exec:\frxxxxf.exe83⤵PID:2884
-
\??\c:\bntnnh.exec:\bntnnh.exe84⤵PID:3824
-
\??\c:\hnbtbh.exec:\hnbtbh.exe85⤵PID:2264
-
\??\c:\vvddd.exec:\vvddd.exe86⤵PID:3356
-
\??\c:\xlfxlff.exec:\xlfxlff.exe87⤵PID:3900
-
\??\c:\tthttt.exec:\tthttt.exe88⤵PID:1196
-
\??\c:\vpvvv.exec:\vpvvv.exe89⤵PID:4868
-
\??\c:\rxrxxxf.exec:\rxrxxxf.exe90⤵PID:1336
-
\??\c:\bbhtnn.exec:\bbhtnn.exe91⤵PID:1648
-
\??\c:\djvpv.exec:\djvpv.exe92⤵PID:972
-
\??\c:\xrrrllf.exec:\xrrrllf.exe93⤵PID:1348
-
\??\c:\tttttt.exec:\tttttt.exe94⤵PID:4400
-
\??\c:\jdjdd.exec:\jdjdd.exe95⤵PID:4576
-
\??\c:\xffflll.exec:\xffflll.exe96⤵PID:3112
-
\??\c:\btbttn.exec:\btbttn.exe97⤵PID:324
-
\??\c:\dpppj.exec:\dpppj.exe98⤵PID:2184
-
\??\c:\lxlfrrl.exec:\lxlfrrl.exe99⤵PID:3236
-
\??\c:\thbhtb.exec:\thbhtb.exe100⤵PID:208
-
\??\c:\xlfxflr.exec:\xlfxflr.exe101⤵PID:2632
-
\??\c:\llrfrxf.exec:\llrfrxf.exe102⤵PID:4924
-
\??\c:\hhbtbn.exec:\hhbtbn.exe103⤵PID:4800
-
\??\c:\9jdpp.exec:\9jdpp.exe104⤵PID:4080
-
\??\c:\rxxrrxr.exec:\rxxrrxr.exe105⤵PID:4308
-
\??\c:\hntttt.exec:\hntttt.exe106⤵PID:1752
-
\??\c:\vpppp.exec:\vpppp.exe107⤵PID:4176
-
\??\c:\rfrlxrf.exec:\rfrlxrf.exe108⤵PID:4276
-
\??\c:\hhtntt.exec:\hhtntt.exe109⤵PID:2368
-
\??\c:\vpvvp.exec:\vpvvp.exe110⤵PID:3880
-
\??\c:\bnhnhb.exec:\bnhnhb.exe111⤵PID:3932
-
\??\c:\jjdvp.exec:\jjdvp.exe112⤵PID:960
-
\??\c:\jvvjp.exec:\jvvjp.exe113⤵PID:1516
-
\??\c:\rlfrxfr.exec:\rlfrxfr.exe114⤵PID:3520
-
\??\c:\hhthtn.exec:\hhthtn.exe115⤵PID:4200
-
\??\c:\jjjpd.exec:\jjjpd.exe116⤵PID:2924
-
\??\c:\xlxffxr.exec:\xlxffxr.exe117⤵PID:3020
-
\??\c:\hbtbhh.exec:\hbtbhh.exe118⤵PID:2196
-
\??\c:\1pjvj.exec:\1pjvj.exe119⤵PID:1260
-
\??\c:\xfrflrr.exec:\xfrflrr.exe120⤵PID:4396
-
\??\c:\3bhtbn.exec:\3bhtbn.exe121⤵PID:2400
-
\??\c:\9jjpj.exec:\9jjpj.exe122⤵PID:4480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-