Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14/07/2024, 21:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
22066d3ad501b7744f5bec1792a8f7b0N.exe
Resource
win7-20240704-en
5 signatures
120 seconds
General
-
Target
22066d3ad501b7744f5bec1792a8f7b0N.exe
-
Size
68KB
-
MD5
22066d3ad501b7744f5bec1792a8f7b0
-
SHA1
84c7453517ed66e4c703a685dbceed6166688dc7
-
SHA256
2425d10ccddee6b8cba576981be3641743a27bd056118982ddc868a67c204891
-
SHA512
517de97c4a65f8bd5423f7e8ed449fd8fafd18039764729dc27b3e52483e8ef01506b6a858f2c05b19276217fb48e68788488d86c0446622756011079210b1e0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+LuvdP:ymb3NkkiQ3mdBjF0yMliP
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2780-25-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2780-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3736-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1336-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1484-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2784-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1336-45-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2148 frrlffx.exe 3544 rxrrlxr.exe 2780 e00488.exe 3736 dd686.exe 1336 84468.exe 1860 e08288.exe 2040 httbnn.exe 3860 0840662.exe 1996 vvjjd.exe 2632 046604.exe 2704 7rxlxxx.exe 2784 vpvjv.exe 1848 246666.exe 2904 tbthth.exe 3212 26004.exe 2792 pvpvj.exe 2064 k24288.exe 3896 u664848.exe 2524 vddjp.exe 1484 s4002.exe 752 vvjjv.exe 4604 006240.exe 664 642228.exe 1680 864422.exe 4648 028822.exe 3960 242266.exe 3948 00280.exe 1548 w68822.exe 4576 020482.exe 2920 62888.exe 2624 jdjdv.exe 3044 42848.exe 1136 djpjj.exe 4444 46260.exe 552 lxllllr.exe 3584 btnhhh.exe 3056 9fllfff.exe 4880 4444882.exe 4368 lffxrll.exe 2132 jdjjd.exe 4864 484604.exe 4948 0440688.exe 3268 a6600.exe 5036 1lxxrrr.exe 1652 a2442.exe 4924 2866044.exe 556 jdvpj.exe 1940 fxrlllx.exe 1376 7xxxxxr.exe 1860 5bbtbt.exe 2716 xrrlfrl.exe 2724 8000004.exe 1160 1ttbbh.exe 5104 ttntbh.exe 1072 664664.exe 2704 xrxxrrl.exe 856 btbtbt.exe 1396 8482860.exe 572 66600.exe 60 a4000.exe 4536 lxxxrrr.exe 4844 8624866.exe 3920 k26044.exe 3896 dpvdp.exe -
resource yara_rule behavioral2/memory/2780-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1484-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1848-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5056 wrote to memory of 2148 5056 22066d3ad501b7744f5bec1792a8f7b0N.exe 84 PID 5056 wrote to memory of 2148 5056 22066d3ad501b7744f5bec1792a8f7b0N.exe 84 PID 5056 wrote to memory of 2148 5056 22066d3ad501b7744f5bec1792a8f7b0N.exe 84 PID 2148 wrote to memory of 3544 2148 frrlffx.exe 85 PID 2148 wrote to memory of 3544 2148 frrlffx.exe 85 PID 2148 wrote to memory of 3544 2148 frrlffx.exe 85 PID 3544 wrote to memory of 2780 3544 rxrrlxr.exe 86 PID 3544 wrote to memory of 2780 3544 rxrrlxr.exe 86 PID 3544 wrote to memory of 2780 3544 rxrrlxr.exe 86 PID 2780 wrote to memory of 3736 2780 e00488.exe 87 PID 2780 wrote to memory of 3736 2780 e00488.exe 87 PID 2780 wrote to memory of 3736 2780 e00488.exe 87 PID 3736 wrote to memory of 1336 3736 dd686.exe 90 PID 3736 wrote to memory of 1336 3736 dd686.exe 90 PID 3736 wrote to memory of 1336 3736 dd686.exe 90 PID 1336 wrote to memory of 1860 1336 84468.exe 91 PID 1336 wrote to memory of 1860 1336 84468.exe 91 PID 1336 wrote to memory of 1860 1336 84468.exe 91 PID 1860 wrote to memory of 2040 1860 e08288.exe 92 PID 1860 wrote to memory of 2040 1860 e08288.exe 92 PID 1860 wrote to memory of 2040 1860 e08288.exe 92 PID 2040 wrote to memory of 3860 2040 httbnn.exe 93 PID 2040 wrote to memory of 3860 2040 httbnn.exe 93 PID 2040 wrote to memory of 3860 2040 httbnn.exe 93 PID 3860 wrote to memory of 1996 3860 0840662.exe 94 PID 3860 wrote to memory of 1996 3860 0840662.exe 94 PID 3860 wrote to memory of 1996 3860 0840662.exe 94 PID 1996 wrote to memory of 2632 1996 vvjjd.exe 95 PID 1996 wrote to memory of 2632 1996 vvjjd.exe 95 PID 1996 wrote to memory of 2632 1996 vvjjd.exe 95 PID 2632 wrote to memory of 2704 2632 046604.exe 96 PID 2632 wrote to memory of 2704 2632 046604.exe 96 PID 2632 wrote to memory of 2704 2632 046604.exe 96 PID 2704 wrote to memory of 2784 2704 7rxlxxx.exe 97 PID 2704 wrote to memory of 2784 2704 7rxlxxx.exe 97 PID 2704 wrote to memory of 2784 2704 7rxlxxx.exe 97 PID 2784 wrote to memory of 1848 2784 vpvjv.exe 98 PID 2784 wrote to memory of 1848 2784 vpvjv.exe 98 PID 2784 wrote to memory of 1848 2784 vpvjv.exe 98 PID 1848 wrote to memory of 2904 1848 246666.exe 99 PID 1848 wrote to memory of 2904 1848 246666.exe 99 PID 1848 wrote to memory of 2904 1848 246666.exe 99 PID 2904 wrote to memory of 3212 2904 tbthth.exe 100 PID 2904 wrote to memory of 3212 2904 tbthth.exe 100 PID 2904 wrote to memory of 3212 2904 tbthth.exe 100 PID 3212 wrote to memory of 2792 3212 26004.exe 101 PID 3212 wrote to memory of 2792 3212 26004.exe 101 PID 3212 wrote to memory of 2792 3212 26004.exe 101 PID 2792 wrote to memory of 2064 2792 pvpvj.exe 102 PID 2792 wrote to memory of 2064 2792 pvpvj.exe 102 PID 2792 wrote to memory of 2064 2792 pvpvj.exe 102 PID 2064 wrote to memory of 3896 2064 k24288.exe 103 PID 2064 wrote to memory of 3896 2064 k24288.exe 103 PID 2064 wrote to memory of 3896 2064 k24288.exe 103 PID 3896 wrote to memory of 2524 3896 u664848.exe 104 PID 3896 wrote to memory of 2524 3896 u664848.exe 104 PID 3896 wrote to memory of 2524 3896 u664848.exe 104 PID 2524 wrote to memory of 1484 2524 vddjp.exe 105 PID 2524 wrote to memory of 1484 2524 vddjp.exe 105 PID 2524 wrote to memory of 1484 2524 vddjp.exe 105 PID 1484 wrote to memory of 752 1484 s4002.exe 106 PID 1484 wrote to memory of 752 1484 s4002.exe 106 PID 1484 wrote to memory of 752 1484 s4002.exe 106 PID 752 wrote to memory of 4604 752 vvjjv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\22066d3ad501b7744f5bec1792a8f7b0N.exe"C:\Users\Admin\AppData\Local\Temp\22066d3ad501b7744f5bec1792a8f7b0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\frrlffx.exec:\frrlffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\rxrrlxr.exec:\rxrrlxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\e00488.exec:\e00488.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\dd686.exec:\dd686.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\84468.exec:\84468.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\e08288.exec:\e08288.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\httbnn.exec:\httbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\0840662.exec:\0840662.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\vvjjd.exec:\vvjjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\046604.exec:\046604.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\7rxlxxx.exec:\7rxlxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\vpvjv.exec:\vpvjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\246666.exec:\246666.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\tbthth.exec:\tbthth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\26004.exec:\26004.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\pvpvj.exec:\pvpvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\k24288.exec:\k24288.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\u664848.exec:\u664848.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\vddjp.exec:\vddjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\s4002.exec:\s4002.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\vvjjv.exec:\vvjjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\006240.exec:\006240.exe23⤵
- Executes dropped EXE
PID:4604 -
\??\c:\642228.exec:\642228.exe24⤵
- Executes dropped EXE
PID:664 -
\??\c:\864422.exec:\864422.exe25⤵
- Executes dropped EXE
PID:1680 -
\??\c:\028822.exec:\028822.exe26⤵
- Executes dropped EXE
PID:4648 -
\??\c:\242266.exec:\242266.exe27⤵
- Executes dropped EXE
PID:3960 -
\??\c:\00280.exec:\00280.exe28⤵
- Executes dropped EXE
PID:3948 -
\??\c:\w68822.exec:\w68822.exe29⤵
- Executes dropped EXE
PID:1548 -
\??\c:\020482.exec:\020482.exe30⤵
- Executes dropped EXE
PID:4576 -
\??\c:\62888.exec:\62888.exe31⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jdjdv.exec:\jdjdv.exe32⤵
- Executes dropped EXE
PID:2624 -
\??\c:\42848.exec:\42848.exe33⤵
- Executes dropped EXE
PID:3044 -
\??\c:\djpjj.exec:\djpjj.exe34⤵
- Executes dropped EXE
PID:1136 -
\??\c:\46260.exec:\46260.exe35⤵
- Executes dropped EXE
PID:4444 -
\??\c:\lxllllr.exec:\lxllllr.exe36⤵
- Executes dropped EXE
PID:552 -
\??\c:\btnhhh.exec:\btnhhh.exe37⤵
- Executes dropped EXE
PID:3584 -
\??\c:\9fllfff.exec:\9fllfff.exe38⤵
- Executes dropped EXE
PID:3056 -
\??\c:\4444882.exec:\4444882.exe39⤵
- Executes dropped EXE
PID:4880 -
\??\c:\lffxrll.exec:\lffxrll.exe40⤵
- Executes dropped EXE
PID:4368 -
\??\c:\jdjjd.exec:\jdjjd.exe41⤵
- Executes dropped EXE
PID:2132 -
\??\c:\484604.exec:\484604.exe42⤵
- Executes dropped EXE
PID:4864 -
\??\c:\0440688.exec:\0440688.exe43⤵
- Executes dropped EXE
PID:4948 -
\??\c:\a6600.exec:\a6600.exe44⤵
- Executes dropped EXE
PID:3268 -
\??\c:\1lxxrrr.exec:\1lxxrrr.exe45⤵
- Executes dropped EXE
PID:5036 -
\??\c:\a2442.exec:\a2442.exe46⤵
- Executes dropped EXE
PID:1652 -
\??\c:\2866044.exec:\2866044.exe47⤵
- Executes dropped EXE
PID:4924 -
\??\c:\jdvpj.exec:\jdvpj.exe48⤵
- Executes dropped EXE
PID:556 -
\??\c:\fxrlllx.exec:\fxrlllx.exe49⤵
- Executes dropped EXE
PID:1940 -
\??\c:\7xxxxxr.exec:\7xxxxxr.exe50⤵
- Executes dropped EXE
PID:1376 -
\??\c:\5bbtbt.exec:\5bbtbt.exe51⤵
- Executes dropped EXE
PID:1860 -
\??\c:\xrrlfrl.exec:\xrrlfrl.exe52⤵
- Executes dropped EXE
PID:2716 -
\??\c:\8000004.exec:\8000004.exe53⤵
- Executes dropped EXE
PID:2724 -
\??\c:\1ttbbh.exec:\1ttbbh.exe54⤵
- Executes dropped EXE
PID:1160 -
\??\c:\ttntbh.exec:\ttntbh.exe55⤵
- Executes dropped EXE
PID:5104 -
\??\c:\664664.exec:\664664.exe56⤵
- Executes dropped EXE
PID:1072 -
\??\c:\xrxxrrl.exec:\xrxxrrl.exe57⤵
- Executes dropped EXE
PID:2704 -
\??\c:\btbtbt.exec:\btbtbt.exe58⤵
- Executes dropped EXE
PID:856 -
\??\c:\8482860.exec:\8482860.exe59⤵
- Executes dropped EXE
PID:1396 -
\??\c:\66600.exec:\66600.exe60⤵
- Executes dropped EXE
PID:572 -
\??\c:\a4000.exec:\a4000.exe61⤵
- Executes dropped EXE
PID:60 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe62⤵
- Executes dropped EXE
PID:4536 -
\??\c:\8624866.exec:\8624866.exe63⤵
- Executes dropped EXE
PID:4844 -
\??\c:\k26044.exec:\k26044.exe64⤵
- Executes dropped EXE
PID:3920 -
\??\c:\dpvdp.exec:\dpvdp.exe65⤵
- Executes dropped EXE
PID:3896 -
\??\c:\xfllffx.exec:\xfllffx.exe66⤵PID:2524
-
\??\c:\pjjjj.exec:\pjjjj.exe67⤵PID:2652
-
\??\c:\068266.exec:\068266.exe68⤵PID:3460
-
\??\c:\268668.exec:\268668.exe69⤵PID:3984
-
\??\c:\k08266.exec:\k08266.exe70⤵PID:3848
-
\??\c:\fxrrfll.exec:\fxrrfll.exe71⤵PID:4740
-
\??\c:\640666.exec:\640666.exe72⤵PID:5024
-
\??\c:\ttntht.exec:\ttntht.exe73⤵PID:4744
-
\??\c:\6806000.exec:\6806000.exe74⤵PID:3308
-
\??\c:\2424680.exec:\2424680.exe75⤵PID:4804
-
\??\c:\4244006.exec:\4244006.exe76⤵PID:1216
-
\??\c:\xrfxrxr.exec:\xrfxrxr.exe77⤵PID:3960
-
\??\c:\64222.exec:\64222.exe78⤵PID:336
-
\??\c:\046066.exec:\046066.exe79⤵PID:4320
-
\??\c:\nhhbtn.exec:\nhhbtn.exe80⤵PID:4816
-
\??\c:\lrrrlll.exec:\lrrrlll.exe81⤵PID:1232
-
\??\c:\vdjdv.exec:\vdjdv.exe82⤵PID:4956
-
\??\c:\9hhbbt.exec:\9hhbbt.exe83⤵PID:668
-
\??\c:\q28884.exec:\q28884.exe84⤵PID:1608
-
\??\c:\bthbbb.exec:\bthbbb.exe85⤵PID:2636
-
\??\c:\thtnhn.exec:\thtnhn.exe86⤵PID:3060
-
\??\c:\600488.exec:\600488.exe87⤵PID:2248
-
\??\c:\pdddp.exec:\pdddp.exe88⤵PID:2928
-
\??\c:\tntttt.exec:\tntttt.exe89⤵PID:4440
-
\??\c:\828288.exec:\828288.exe90⤵PID:4996
-
\??\c:\46840.exec:\46840.exe91⤵PID:4880
-
\??\c:\rxxlxxr.exec:\rxxlxxr.exe92⤵PID:720
-
\??\c:\jvvpp.exec:\jvvpp.exe93⤵PID:3352
-
\??\c:\6282222.exec:\6282222.exe94⤵PID:4684
-
\??\c:\ddjjj.exec:\ddjjj.exe95⤵PID:4840
-
\??\c:\rrrlxfx.exec:\rrrlxfx.exe96⤵PID:3268
-
\??\c:\88264.exec:\88264.exe97⤵PID:940
-
\??\c:\llrrffx.exec:\llrrffx.exe98⤵PID:956
-
\??\c:\hhtthh.exec:\hhtthh.exe99⤵PID:2292
-
\??\c:\4444488.exec:\4444488.exe100⤵PID:2100
-
\??\c:\hbnnhh.exec:\hbnnhh.exe101⤵PID:4728
-
\??\c:\i066044.exec:\i066044.exe102⤵PID:2596
-
\??\c:\1dvvv.exec:\1dvvv.exe103⤵PID:468
-
\??\c:\xllfxxr.exec:\xllfxxr.exe104⤵PID:208
-
\??\c:\fxxrxxf.exec:\fxxrxxf.exe105⤵PID:4668
-
\??\c:\482844.exec:\482844.exe106⤵PID:4188
-
\??\c:\2402660.exec:\2402660.exe107⤵PID:2672
-
\??\c:\hhttbb.exec:\hhttbb.exe108⤵PID:1072
-
\??\c:\5lfxrxx.exec:\5lfxrxx.exe109⤵PID:924
-
\??\c:\5vddd.exec:\5vddd.exe110⤵PID:1240
-
\??\c:\46820.exec:\46820.exe111⤵PID:1128
-
\??\c:\xrrlxfx.exec:\xrrlxfx.exe112⤵PID:4268
-
\??\c:\hhnthh.exec:\hhnthh.exe113⤵PID:2324
-
\??\c:\5vjvj.exec:\5vjvj.exe114⤵PID:4536
-
\??\c:\8800400.exec:\8800400.exe115⤵PID:4608
-
\??\c:\c000666.exec:\c000666.exe116⤵PID:2476
-
\??\c:\u684006.exec:\u684006.exe117⤵PID:1076
-
\??\c:\06406.exec:\06406.exe118⤵PID:4992
-
\??\c:\4060448.exec:\4060448.exe119⤵PID:4076
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe120⤵PID:3460
-
\??\c:\frrrrrr.exec:\frrrrrr.exe121⤵PID:3984
-
\??\c:\u688666.exec:\u688666.exe122⤵PID:1380
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-