Analysis
-
max time kernel
120s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2024 16:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ec627347f7a610fa3eec577e4bd03b70N.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
120 seconds
General
-
Target
ec627347f7a610fa3eec577e4bd03b70N.exe
-
Size
280KB
-
MD5
ec627347f7a610fa3eec577e4bd03b70
-
SHA1
4f680ef451d2f7db0f030d2e4592fd85f50202d7
-
SHA256
f8ffd5f07b52673cc52712b502cf3629597f8d382bd78965d74f3a57b6fd8e79
-
SHA512
9843e2999476b4bb63ec8cb0e98d20cd8161425424d5ed621200a001cc22d4652583625a925d5ab1dcc42c08db27f159a3c6183c85c1729e6e30554bedf61bb7
-
SSDEEP
6144:n3C9BRIG0asYFm71m8+GdkB9yMu7VvemWL:n3C9uYA71kSMue
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4532-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2492-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1228-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1268-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2928 btbtbb.exe 2492 dpddv.exe 1228 1llffff.exe 4576 pddpj.exe 3316 hhthbb.exe 2728 xlffrlx.exe 4816 btbtbb.exe 2912 pjddv.exe 3684 xrrlxxx.exe 1768 9vjdv.exe 3400 rffrffx.exe 3264 btbbnt.exe 4468 pddvj.exe 4440 dpddv.exe 4884 nbnhbt.exe 2184 tnbtnh.exe 2432 jppjd.exe 3644 rlfllxl.exe 2632 3thtnn.exe 3936 xxllrfl.exe 4048 3hhbnn.exe 1040 vjpdp.exe 3132 3btnbb.exe 3828 5rllffx.exe 3284 lxrlfxr.exe 1268 tnthbt.exe 3696 vppjj.exe 2080 3ffxrfx.exe 3752 htthbt.exe 4412 pdpjd.exe 1080 bbhtth.exe 4948 jdjvp.exe 916 djpdv.exe 2452 lfrlxff.exe 756 nnbntn.exe 2332 nbtnbt.exe 3048 jvpjp.exe 1000 jjjvv.exe 4212 rrlxlxf.exe 2500 3ntnnn.exe 1732 5bhhbb.exe 4836 dvdvp.exe 2912 7xfrrlr.exe 2900 xfrllll.exe 456 nhthbb.exe 4516 pdpdd.exe 1532 9ppdv.exe 2112 lfxfrll.exe 1720 1lrrlrr.exe 1900 1tbtbt.exe 1408 jvvpd.exe 1088 vjjdp.exe 4468 3xrfrrf.exe 4364 lfxrfxx.exe 696 nbthtn.exe 2796 9pdvj.exe 3508 9djdv.exe 3260 1lrffxx.exe 3296 rlrrllf.exe 1436 5ttnhb.exe 3092 vvdvj.exe 1396 jjdvp.exe 3936 lffxllx.exe 2548 hbnhbn.exe -
resource yara_rule behavioral2/memory/4532-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2492-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2492-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2492-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1228-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1228-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-215-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4532 wrote to memory of 2928 4532 ec627347f7a610fa3eec577e4bd03b70N.exe 84 PID 4532 wrote to memory of 2928 4532 ec627347f7a610fa3eec577e4bd03b70N.exe 84 PID 4532 wrote to memory of 2928 4532 ec627347f7a610fa3eec577e4bd03b70N.exe 84 PID 2928 wrote to memory of 2492 2928 btbtbb.exe 85 PID 2928 wrote to memory of 2492 2928 btbtbb.exe 85 PID 2928 wrote to memory of 2492 2928 btbtbb.exe 85 PID 2492 wrote to memory of 1228 2492 dpddv.exe 86 PID 2492 wrote to memory of 1228 2492 dpddv.exe 86 PID 2492 wrote to memory of 1228 2492 dpddv.exe 86 PID 1228 wrote to memory of 4576 1228 1llffff.exe 87 PID 1228 wrote to memory of 4576 1228 1llffff.exe 87 PID 1228 wrote to memory of 4576 1228 1llffff.exe 87 PID 4576 wrote to memory of 3316 4576 pddpj.exe 89 PID 4576 wrote to memory of 3316 4576 pddpj.exe 89 PID 4576 wrote to memory of 3316 4576 pddpj.exe 89 PID 3316 wrote to memory of 2728 3316 hhthbb.exe 90 PID 3316 wrote to memory of 2728 3316 hhthbb.exe 90 PID 3316 wrote to memory of 2728 3316 hhthbb.exe 90 PID 2728 wrote to memory of 4816 2728 xlffrlx.exe 92 PID 2728 wrote to memory of 4816 2728 xlffrlx.exe 92 PID 2728 wrote to memory of 4816 2728 xlffrlx.exe 92 PID 4816 wrote to memory of 2912 4816 btbtbb.exe 93 PID 4816 wrote to memory of 2912 4816 btbtbb.exe 93 PID 4816 wrote to memory of 2912 4816 btbtbb.exe 93 PID 2912 wrote to memory of 3684 2912 pjddv.exe 94 PID 2912 wrote to memory of 3684 2912 pjddv.exe 94 PID 2912 wrote to memory of 3684 2912 pjddv.exe 94 PID 3684 wrote to memory of 1768 3684 xrrlxxx.exe 95 PID 3684 wrote to memory of 1768 3684 xrrlxxx.exe 95 PID 3684 wrote to memory of 1768 3684 xrrlxxx.exe 95 PID 1768 wrote to memory of 3400 1768 9vjdv.exe 97 PID 1768 wrote to memory of 3400 1768 9vjdv.exe 97 PID 1768 wrote to memory of 3400 1768 9vjdv.exe 97 PID 3400 wrote to memory of 3264 3400 rffrffx.exe 98 PID 3400 wrote to memory of 3264 3400 rffrffx.exe 98 PID 3400 wrote to memory of 3264 3400 rffrffx.exe 98 PID 3264 wrote to memory of 4468 3264 btbbnt.exe 99 PID 3264 wrote to memory of 4468 3264 btbbnt.exe 99 PID 3264 wrote to memory of 4468 3264 btbbnt.exe 99 PID 4468 wrote to memory of 4440 4468 pddvj.exe 100 PID 4468 wrote to memory of 4440 4468 pddvj.exe 100 PID 4468 wrote to memory of 4440 4468 pddvj.exe 100 PID 4440 wrote to memory of 4884 4440 dpddv.exe 101 PID 4440 wrote to memory of 4884 4440 dpddv.exe 101 PID 4440 wrote to memory of 4884 4440 dpddv.exe 101 PID 4884 wrote to memory of 2184 4884 nbnhbt.exe 102 PID 4884 wrote to memory of 2184 4884 nbnhbt.exe 102 PID 4884 wrote to memory of 2184 4884 nbnhbt.exe 102 PID 2184 wrote to memory of 2432 2184 tnbtnh.exe 103 PID 2184 wrote to memory of 2432 2184 tnbtnh.exe 103 PID 2184 wrote to memory of 2432 2184 tnbtnh.exe 103 PID 2432 wrote to memory of 3644 2432 jppjd.exe 104 PID 2432 wrote to memory of 3644 2432 jppjd.exe 104 PID 2432 wrote to memory of 3644 2432 jppjd.exe 104 PID 3644 wrote to memory of 2632 3644 rlfllxl.exe 105 PID 3644 wrote to memory of 2632 3644 rlfllxl.exe 105 PID 3644 wrote to memory of 2632 3644 rlfllxl.exe 105 PID 2632 wrote to memory of 3936 2632 3thtnn.exe 106 PID 2632 wrote to memory of 3936 2632 3thtnn.exe 106 PID 2632 wrote to memory of 3936 2632 3thtnn.exe 106 PID 3936 wrote to memory of 4048 3936 xxllrfl.exe 107 PID 3936 wrote to memory of 4048 3936 xxllrfl.exe 107 PID 3936 wrote to memory of 4048 3936 xxllrfl.exe 107 PID 4048 wrote to memory of 1040 4048 3hhbnn.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec627347f7a610fa3eec577e4bd03b70N.exe"C:\Users\Admin\AppData\Local\Temp\ec627347f7a610fa3eec577e4bd03b70N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\btbtbb.exec:\btbtbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\dpddv.exec:\dpddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\1llffff.exec:\1llffff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\pddpj.exec:\pddpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\hhthbb.exec:\hhthbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\xlffrlx.exec:\xlffrlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\btbtbb.exec:\btbtbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\pjddv.exec:\pjddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\xrrlxxx.exec:\xrrlxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\9vjdv.exec:\9vjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\rffrffx.exec:\rffrffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\btbbnt.exec:\btbbnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\pddvj.exec:\pddvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\dpddv.exec:\dpddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\nbnhbt.exec:\nbnhbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\tnbtnh.exec:\tnbtnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\jppjd.exec:\jppjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\rlfllxl.exec:\rlfllxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\3thtnn.exec:\3thtnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\xxllrfl.exec:\xxllrfl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\3hhbnn.exec:\3hhbnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\vjpdp.exec:\vjpdp.exe23⤵
- Executes dropped EXE
PID:1040 -
\??\c:\3btnbb.exec:\3btnbb.exe24⤵
- Executes dropped EXE
PID:3132 -
\??\c:\5rllffx.exec:\5rllffx.exe25⤵
- Executes dropped EXE
PID:3828 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe26⤵
- Executes dropped EXE
PID:3284 -
\??\c:\tnthbt.exec:\tnthbt.exe27⤵
- Executes dropped EXE
PID:1268 -
\??\c:\vppjj.exec:\vppjj.exe28⤵
- Executes dropped EXE
PID:3696 -
\??\c:\3ffxrfx.exec:\3ffxrfx.exe29⤵
- Executes dropped EXE
PID:2080 -
\??\c:\htthbt.exec:\htthbt.exe30⤵
- Executes dropped EXE
PID:3752 -
\??\c:\pdpjd.exec:\pdpjd.exe31⤵
- Executes dropped EXE
PID:4412 -
\??\c:\bbhtth.exec:\bbhtth.exe32⤵
- Executes dropped EXE
PID:1080 -
\??\c:\jdjvp.exec:\jdjvp.exe33⤵
- Executes dropped EXE
PID:4948 -
\??\c:\djpdv.exec:\djpdv.exe34⤵
- Executes dropped EXE
PID:916 -
\??\c:\lfrlxff.exec:\lfrlxff.exe35⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nnbntn.exec:\nnbntn.exe36⤵
- Executes dropped EXE
PID:756 -
\??\c:\nbtnbt.exec:\nbtnbt.exe37⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jvpjp.exec:\jvpjp.exe38⤵
- Executes dropped EXE
PID:3048 -
\??\c:\jjjvv.exec:\jjjvv.exe39⤵
- Executes dropped EXE
PID:1000 -
\??\c:\rrlxlxf.exec:\rrlxlxf.exe40⤵
- Executes dropped EXE
PID:4212 -
\??\c:\3ntnnn.exec:\3ntnnn.exe41⤵
- Executes dropped EXE
PID:2500 -
\??\c:\5bhhbb.exec:\5bhhbb.exe42⤵
- Executes dropped EXE
PID:1732 -
\??\c:\dvdvp.exec:\dvdvp.exe43⤵
- Executes dropped EXE
PID:4836 -
\??\c:\7xfrrlr.exec:\7xfrrlr.exe44⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xfrllll.exec:\xfrllll.exe45⤵
- Executes dropped EXE
PID:2900 -
\??\c:\nhthbb.exec:\nhthbb.exe46⤵
- Executes dropped EXE
PID:456 -
\??\c:\pdpdd.exec:\pdpdd.exe47⤵
- Executes dropped EXE
PID:4516 -
\??\c:\9ppdv.exec:\9ppdv.exe48⤵
- Executes dropped EXE
PID:1532 -
\??\c:\lfxfrll.exec:\lfxfrll.exe49⤵
- Executes dropped EXE
PID:2112 -
\??\c:\1lrrlrr.exec:\1lrrlrr.exe50⤵
- Executes dropped EXE
PID:1720 -
\??\c:\1tbtbt.exec:\1tbtbt.exe51⤵
- Executes dropped EXE
PID:1900 -
\??\c:\jvvpd.exec:\jvvpd.exe52⤵
- Executes dropped EXE
PID:1408 -
\??\c:\vjjdp.exec:\vjjdp.exe53⤵
- Executes dropped EXE
PID:1088 -
\??\c:\3xrfrrf.exec:\3xrfrrf.exe54⤵
- Executes dropped EXE
PID:4468 -
\??\c:\lfxrfxx.exec:\lfxrfxx.exe55⤵
- Executes dropped EXE
PID:4364 -
\??\c:\nbthtn.exec:\nbthtn.exe56⤵
- Executes dropped EXE
PID:696 -
\??\c:\9pdvj.exec:\9pdvj.exe57⤵
- Executes dropped EXE
PID:2796 -
\??\c:\9djdv.exec:\9djdv.exe58⤵
- Executes dropped EXE
PID:3508 -
\??\c:\1lrffxx.exec:\1lrffxx.exe59⤵
- Executes dropped EXE
PID:3260 -
\??\c:\rlrrllf.exec:\rlrrllf.exe60⤵
- Executes dropped EXE
PID:3296 -
\??\c:\5ttnhb.exec:\5ttnhb.exe61⤵
- Executes dropped EXE
PID:1436 -
\??\c:\vvdvj.exec:\vvdvj.exe62⤵
- Executes dropped EXE
PID:3092 -
\??\c:\jjdvp.exec:\jjdvp.exe63⤵
- Executes dropped EXE
PID:1396 -
\??\c:\lffxllx.exec:\lffxllx.exe64⤵
- Executes dropped EXE
PID:3936 -
\??\c:\hbnhbn.exec:\hbnhbn.exe65⤵
- Executes dropped EXE
PID:2548 -
\??\c:\7vjvj.exec:\7vjvj.exe66⤵PID:2776
-
\??\c:\vjpdd.exec:\vjpdd.exe67⤵PID:4988
-
\??\c:\llrflrl.exec:\llrflrl.exe68⤵PID:1728
-
\??\c:\bnbbbb.exec:\bnbbbb.exe69⤵PID:1940
-
\??\c:\5bbttt.exec:\5bbttt.exe70⤵PID:3828
-
\??\c:\vpjjd.exec:\vpjjd.exe71⤵PID:3584
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe72⤵PID:2428
-
\??\c:\rxfrllx.exec:\rxfrllx.exe73⤵PID:4456
-
\??\c:\bbhhnt.exec:\bbhhnt.exe74⤵PID:4180
-
\??\c:\tbhthb.exec:\tbhthb.exe75⤵PID:4168
-
\??\c:\vvpdv.exec:\vvpdv.exe76⤵PID:4432
-
\??\c:\llrlxrl.exec:\llrlxrl.exe77⤵PID:2556
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe78⤵PID:1452
-
\??\c:\hbbthh.exec:\hbbthh.exe79⤵PID:5060
-
\??\c:\vvvjv.exec:\vvvjv.exe80⤵PID:4684
-
\??\c:\1pjvp.exec:\1pjvp.exe81⤵PID:2616
-
\??\c:\rffrlfl.exec:\rffrlfl.exe82⤵PID:644
-
\??\c:\1nttbn.exec:\1nttbn.exe83⤵PID:4600
-
\??\c:\vpvjp.exec:\vpvjp.exe84⤵PID:3288
-
\??\c:\vdjdv.exec:\vdjdv.exe85⤵PID:4032
-
\??\c:\rxfrfxl.exec:\rxfrfxl.exe86⤵PID:1308
-
\??\c:\xllfrlf.exec:\xllfrlf.exe87⤵PID:4656
-
\??\c:\ntnnhn.exec:\ntnnhn.exe88⤵PID:2316
-
\??\c:\jdpdv.exec:\jdpdv.exe89⤵PID:432
-
\??\c:\rllxrlf.exec:\rllxrlf.exe90⤵PID:4616
-
\??\c:\1fflxrf.exec:\1fflxrf.exe91⤵PID:728
-
\??\c:\bbbhhb.exec:\bbbhhb.exe92⤵PID:380
-
\??\c:\jdvpj.exec:\jdvpj.exe93⤵PID:4164
-
\??\c:\dddvj.exec:\dddvj.exe94⤵PID:1612
-
\??\c:\llxxrrr.exec:\llxxrrr.exe95⤵PID:2760
-
\??\c:\ttntbn.exec:\ttntbn.exe96⤵PID:3400
-
\??\c:\hthtnb.exec:\hthtnb.exe97⤵PID:556
-
\??\c:\djpjd.exec:\djpjd.exe98⤵PID:3392
-
\??\c:\lfxrxrx.exec:\lfxrxrx.exe99⤵PID:1204
-
\??\c:\lffxxrf.exec:\lffxxrf.exe100⤵PID:1408
-
\??\c:\tnnnhb.exec:\tnnnhb.exe101⤵PID:624
-
\??\c:\dvppj.exec:\dvppj.exe102⤵PID:3304
-
\??\c:\lxxlxxr.exec:\lxxlxxr.exe103⤵PID:668
-
\??\c:\rffxrrl.exec:\rffxrrl.exe104⤵PID:696
-
\??\c:\7hnhbt.exec:\7hnhbt.exe105⤵PID:1972
-
\??\c:\djpjp.exec:\djpjp.exe106⤵PID:3412
-
\??\c:\5lllffx.exec:\5lllffx.exe107⤵PID:3260
-
\??\c:\9ttnhh.exec:\9ttnhh.exe108⤵PID:1372
-
\??\c:\hhnhbt.exec:\hhnhbt.exe109⤵PID:1020
-
\??\c:\7pvpj.exec:\7pvpj.exe110⤵PID:3988
-
\??\c:\rllfrrl.exec:\rllfrrl.exe111⤵PID:3292
-
\??\c:\fxrlllf.exec:\fxrlllf.exe112⤵PID:2708
-
\??\c:\tntnnh.exec:\tntnnh.exe113⤵PID:4048
-
\??\c:\bhbnhb.exec:\bhbnhb.exe114⤵PID:4920
-
\??\c:\dddvj.exec:\dddvj.exe115⤵PID:1044
-
\??\c:\fxlfxxl.exec:\fxlfxxl.exe116⤵PID:1500
-
\??\c:\hnnbnh.exec:\hnnbnh.exe117⤵PID:3596
-
\??\c:\hbnbtb.exec:\hbnbtb.exe118⤵PID:2576
-
\??\c:\jppjj.exec:\jppjj.exe119⤵PID:2404
-
\??\c:\rxfrlxr.exec:\rxfrlxr.exe120⤵PID:1808
-
\??\c:\5lfxrfx.exec:\5lfxrfx.exe121⤵PID:3268
-
\??\c:\nbtnhb.exec:\nbtnhb.exe122⤵PID:2672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-