Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
21-07-2024 06:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7afe244e4d9e3fe4f2877bb8e6006b60N.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
120 seconds
General
-
Target
7afe244e4d9e3fe4f2877bb8e6006b60N.exe
-
Size
374KB
-
MD5
7afe244e4d9e3fe4f2877bb8e6006b60
-
SHA1
bbb06d8c9f030cbdcb3ecb0494148aeb6609757f
-
SHA256
3cc19b7342f5f1f7baef77cddc1ba266dc36910407d4578c20a9608fc626200b
-
SHA512
baa354a94853c24fc4eb4e902850b4054ad44d44f7abb7ba58c247a8a0d751749b89b0935802fd875663017c534805e0214b8b51bf8d9727f51781bd583e1845
-
SSDEEP
6144:n3C9BRIG0asYFm71mJl3/X8mak5gNv9rC8IwLaYNUvtTxTKMMd:n3C9uYA7i3/stR9HGYyvtTxTKMW
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/936-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1340-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1240-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1340 xllfxrr.exe 3968 dvdpd.exe 4864 lxfxrlf.exe 4620 5jjvj.exe 548 fxxlxlf.exe 4876 thhtnb.exe 4248 xrrxrlf.exe 4808 hbbtht.exe 4056 3fxlrlf.exe 1240 hnnbnh.exe 4776 3vjdj.exe 5100 fxrrlrr.exe 3712 fllxrfx.exe 4836 pvddv.exe 4292 9nnbtn.exe 4192 9jpdv.exe 1016 djpdp.exe 1956 flrlxxl.exe 3172 pvpjv.exe 4400 rxfrffr.exe 3916 pjjvp.exe 1952 xxfrfxl.exe 3992 3nhbnh.exe 1004 7dpvd.exe 1884 xlrfxlx.exe 2880 hbtbnt.exe 1700 btntht.exe 768 djpvj.exe 2892 xxxlxrl.exe 3628 httnhb.exe 1728 vdpvd.exe 4912 lxrlfxr.exe 4748 xllrflx.exe 4364 5bbttt.exe 1444 xfflxrf.exe 2176 xlfxlfr.exe 4760 ttnnhb.exe 1900 xllxlfx.exe 3904 hbbntn.exe 3876 9vvpd.exe 3516 rxxlxrf.exe 2732 rrrflxr.exe 1216 htbnnh.exe 1536 pdjvj.exe 3944 jvdvd.exe 2568 3lfrfxr.exe 4048 rllfllf.exe 2300 bttnhb.exe 3608 vjjvj.exe 184 pddpj.exe 2696 xflrlll.exe 3988 1tnnhh.exe 4480 1jvvj.exe 1200 5vvdp.exe 4716 xllflfx.exe 1032 nnnhbb.exe 3044 bbbbht.exe 1640 pdvjd.exe 4292 rxxxlfx.exe 3264 nbhbbh.exe 5004 bbhbbt.exe 4252 vddpd.exe 748 jvdvp.exe 2024 lrrflfx.exe -
resource yara_rule behavioral2/memory/936-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1340-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1884-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/768-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 936 wrote to memory of 1340 936 7afe244e4d9e3fe4f2877bb8e6006b60N.exe 84 PID 936 wrote to memory of 1340 936 7afe244e4d9e3fe4f2877bb8e6006b60N.exe 84 PID 936 wrote to memory of 1340 936 7afe244e4d9e3fe4f2877bb8e6006b60N.exe 84 PID 1340 wrote to memory of 3968 1340 xllfxrr.exe 85 PID 1340 wrote to memory of 3968 1340 xllfxrr.exe 85 PID 1340 wrote to memory of 3968 1340 xllfxrr.exe 85 PID 3968 wrote to memory of 4864 3968 dvdpd.exe 86 PID 3968 wrote to memory of 4864 3968 dvdpd.exe 86 PID 3968 wrote to memory of 4864 3968 dvdpd.exe 86 PID 4864 wrote to memory of 4620 4864 lxfxrlf.exe 87 PID 4864 wrote to memory of 4620 4864 lxfxrlf.exe 87 PID 4864 wrote to memory of 4620 4864 lxfxrlf.exe 87 PID 4620 wrote to memory of 548 4620 5jjvj.exe 88 PID 4620 wrote to memory of 548 4620 5jjvj.exe 88 PID 4620 wrote to memory of 548 4620 5jjvj.exe 88 PID 548 wrote to memory of 4876 548 fxxlxlf.exe 89 PID 548 wrote to memory of 4876 548 fxxlxlf.exe 89 PID 548 wrote to memory of 4876 548 fxxlxlf.exe 89 PID 4876 wrote to memory of 4248 4876 thhtnb.exe 91 PID 4876 wrote to memory of 4248 4876 thhtnb.exe 91 PID 4876 wrote to memory of 4248 4876 thhtnb.exe 91 PID 4248 wrote to memory of 4808 4248 xrrxrlf.exe 92 PID 4248 wrote to memory of 4808 4248 xrrxrlf.exe 92 PID 4248 wrote to memory of 4808 4248 xrrxrlf.exe 92 PID 4808 wrote to memory of 4056 4808 hbbtht.exe 93 PID 4808 wrote to memory of 4056 4808 hbbtht.exe 93 PID 4808 wrote to memory of 4056 4808 hbbtht.exe 93 PID 4056 wrote to memory of 1240 4056 3fxlrlf.exe 95 PID 4056 wrote to memory of 1240 4056 3fxlrlf.exe 95 PID 4056 wrote to memory of 1240 4056 3fxlrlf.exe 95 PID 1240 wrote to memory of 4776 1240 hnnbnh.exe 96 PID 1240 wrote to memory of 4776 1240 hnnbnh.exe 96 PID 1240 wrote to memory of 4776 1240 hnnbnh.exe 96 PID 4776 wrote to memory of 5100 4776 3vjdj.exe 97 PID 4776 wrote to memory of 5100 4776 3vjdj.exe 97 PID 4776 wrote to memory of 5100 4776 3vjdj.exe 97 PID 5100 wrote to memory of 3712 5100 fxrrlrr.exe 98 PID 5100 wrote to memory of 3712 5100 fxrrlrr.exe 98 PID 5100 wrote to memory of 3712 5100 fxrrlrr.exe 98 PID 3712 wrote to memory of 4836 3712 fllxrfx.exe 100 PID 3712 wrote to memory of 4836 3712 fllxrfx.exe 100 PID 3712 wrote to memory of 4836 3712 fllxrfx.exe 100 PID 4836 wrote to memory of 4292 4836 pvddv.exe 101 PID 4836 wrote to memory of 4292 4836 pvddv.exe 101 PID 4836 wrote to memory of 4292 4836 pvddv.exe 101 PID 4292 wrote to memory of 4192 4292 9nnbtn.exe 102 PID 4292 wrote to memory of 4192 4292 9nnbtn.exe 102 PID 4292 wrote to memory of 4192 4292 9nnbtn.exe 102 PID 4192 wrote to memory of 1016 4192 9jpdv.exe 103 PID 4192 wrote to memory of 1016 4192 9jpdv.exe 103 PID 4192 wrote to memory of 1016 4192 9jpdv.exe 103 PID 1016 wrote to memory of 1956 1016 djpdp.exe 104 PID 1016 wrote to memory of 1956 1016 djpdp.exe 104 PID 1016 wrote to memory of 1956 1016 djpdp.exe 104 PID 1956 wrote to memory of 3172 1956 flrlxxl.exe 105 PID 1956 wrote to memory of 3172 1956 flrlxxl.exe 105 PID 1956 wrote to memory of 3172 1956 flrlxxl.exe 105 PID 3172 wrote to memory of 4400 3172 pvpjv.exe 106 PID 3172 wrote to memory of 4400 3172 pvpjv.exe 106 PID 3172 wrote to memory of 4400 3172 pvpjv.exe 106 PID 4400 wrote to memory of 3916 4400 rxfrffr.exe 107 PID 4400 wrote to memory of 3916 4400 rxfrffr.exe 107 PID 4400 wrote to memory of 3916 4400 rxfrffr.exe 107 PID 3916 wrote to memory of 1952 3916 pjjvp.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\7afe244e4d9e3fe4f2877bb8e6006b60N.exe"C:\Users\Admin\AppData\Local\Temp\7afe244e4d9e3fe4f2877bb8e6006b60N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\xllfxrr.exec:\xllfxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\dvdpd.exec:\dvdpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\5jjvj.exec:\5jjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\fxxlxlf.exec:\fxxlxlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\thhtnb.exec:\thhtnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\xrrxrlf.exec:\xrrxrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\hbbtht.exec:\hbbtht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\3fxlrlf.exec:\3fxlrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\hnnbnh.exec:\hnnbnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\3vjdj.exec:\3vjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\fxrrlrr.exec:\fxrrlrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\fllxrfx.exec:\fllxrfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\pvddv.exec:\pvddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\9nnbtn.exec:\9nnbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\9jpdv.exec:\9jpdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\djpdp.exec:\djpdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\flrlxxl.exec:\flrlxxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\pvpjv.exec:\pvpjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\rxfrffr.exec:\rxfrffr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\pjjvp.exec:\pjjvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\xxfrfxl.exec:\xxfrfxl.exe23⤵
- Executes dropped EXE
PID:1952 -
\??\c:\3nhbnh.exec:\3nhbnh.exe24⤵
- Executes dropped EXE
PID:3992 -
\??\c:\7dpvd.exec:\7dpvd.exe25⤵
- Executes dropped EXE
PID:1004 -
\??\c:\xlrfxlx.exec:\xlrfxlx.exe26⤵
- Executes dropped EXE
PID:1884 -
\??\c:\hbtbnt.exec:\hbtbnt.exe27⤵
- Executes dropped EXE
PID:2880 -
\??\c:\btntht.exec:\btntht.exe28⤵
- Executes dropped EXE
PID:1700 -
\??\c:\djpvj.exec:\djpvj.exe29⤵
- Executes dropped EXE
PID:768 -
\??\c:\xxxlxrl.exec:\xxxlxrl.exe30⤵
- Executes dropped EXE
PID:2892 -
\??\c:\httnhb.exec:\httnhb.exe31⤵
- Executes dropped EXE
PID:3628 -
\??\c:\vdpvd.exec:\vdpvd.exe32⤵
- Executes dropped EXE
PID:1728 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe33⤵
- Executes dropped EXE
PID:4912 -
\??\c:\xllrflx.exec:\xllrflx.exe34⤵
- Executes dropped EXE
PID:4748 -
\??\c:\5bbttt.exec:\5bbttt.exe35⤵
- Executes dropped EXE
PID:4364 -
\??\c:\xfflxrf.exec:\xfflxrf.exe36⤵
- Executes dropped EXE
PID:1444 -
\??\c:\xlfxlfr.exec:\xlfxlfr.exe37⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ttnnhb.exec:\ttnnhb.exe38⤵
- Executes dropped EXE
PID:4760 -
\??\c:\xllxlfx.exec:\xllxlfx.exe39⤵
- Executes dropped EXE
PID:1900 -
\??\c:\hbbntn.exec:\hbbntn.exe40⤵
- Executes dropped EXE
PID:3904 -
\??\c:\9vvpd.exec:\9vvpd.exe41⤵
- Executes dropped EXE
PID:3876 -
\??\c:\rxxlxrf.exec:\rxxlxrf.exe42⤵
- Executes dropped EXE
PID:3516 -
\??\c:\rrrflxr.exec:\rrrflxr.exe43⤵
- Executes dropped EXE
PID:2732 -
\??\c:\htbnnh.exec:\htbnnh.exe44⤵
- Executes dropped EXE
PID:1216 -
\??\c:\pdjvj.exec:\pdjvj.exe45⤵
- Executes dropped EXE
PID:1536 -
\??\c:\jvdvd.exec:\jvdvd.exe46⤵
- Executes dropped EXE
PID:3944 -
\??\c:\3lfrfxr.exec:\3lfrfxr.exe47⤵
- Executes dropped EXE
PID:2568 -
\??\c:\rllfllf.exec:\rllfllf.exe48⤵
- Executes dropped EXE
PID:4048 -
\??\c:\bttnhb.exec:\bttnhb.exe49⤵
- Executes dropped EXE
PID:2300 -
\??\c:\vjjvj.exec:\vjjvj.exe50⤵
- Executes dropped EXE
PID:3608 -
\??\c:\pddpj.exec:\pddpj.exe51⤵
- Executes dropped EXE
PID:184 -
\??\c:\xflrlll.exec:\xflrlll.exe52⤵
- Executes dropped EXE
PID:2696 -
\??\c:\1tnnhh.exec:\1tnnhh.exe53⤵
- Executes dropped EXE
PID:3988 -
\??\c:\1jvvj.exec:\1jvvj.exe54⤵
- Executes dropped EXE
PID:4480 -
\??\c:\5vvdp.exec:\5vvdp.exe55⤵
- Executes dropped EXE
PID:1200 -
\??\c:\xllflfx.exec:\xllflfx.exe56⤵
- Executes dropped EXE
PID:4716 -
\??\c:\nnnhbb.exec:\nnnhbb.exe57⤵
- Executes dropped EXE
PID:1032 -
\??\c:\bbbbht.exec:\bbbbht.exe58⤵
- Executes dropped EXE
PID:3044 -
\??\c:\pdvjd.exec:\pdvjd.exe59⤵
- Executes dropped EXE
PID:1640 -
\??\c:\rxxxlfx.exec:\rxxxlfx.exe60⤵
- Executes dropped EXE
PID:4292 -
\??\c:\nbhbbh.exec:\nbhbbh.exe61⤵
- Executes dropped EXE
PID:3264 -
\??\c:\bbhbbt.exec:\bbhbbt.exe62⤵
- Executes dropped EXE
PID:5004 -
\??\c:\vddpd.exec:\vddpd.exe63⤵
- Executes dropped EXE
PID:4252 -
\??\c:\jvdvp.exec:\jvdvp.exe64⤵
- Executes dropped EXE
PID:748 -
\??\c:\lrrflfx.exec:\lrrflfx.exe65⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lrlxlfr.exec:\lrlxlfr.exe66⤵PID:3400
-
\??\c:\htbbbt.exec:\htbbbt.exe67⤵PID:4228
-
\??\c:\jddjv.exec:\jddjv.exe68⤵PID:1644
-
\??\c:\vppjd.exec:\vppjd.exe69⤵PID:4868
-
\??\c:\rrlxlfx.exec:\rrlxlfx.exe70⤵PID:1888
-
\??\c:\tnnbbt.exec:\tnnbbt.exe71⤵PID:4304
-
\??\c:\ntthbt.exec:\ntthbt.exe72⤵PID:3568
-
\??\c:\jjddv.exec:\jjddv.exe73⤵PID:5060
-
\??\c:\pvpjv.exec:\pvpjv.exe74⤵PID:3704
-
\??\c:\xllxfxr.exec:\xllxfxr.exe75⤵PID:3632
-
\??\c:\hhnbnh.exec:\hhnbnh.exe76⤵PID:2068
-
\??\c:\nhnbnh.exec:\nhnbnh.exe77⤵PID:4440
-
\??\c:\pvvpd.exec:\pvvpd.exe78⤵PID:1872
-
\??\c:\fxrrfll.exec:\fxrrfll.exe79⤵PID:4360
-
\??\c:\1ffrllf.exec:\1ffrllf.exe80⤵PID:4352
-
\??\c:\bthhnh.exec:\bthhnh.exe81⤵PID:4936
-
\??\c:\jvjvp.exec:\jvjvp.exe82⤵PID:1972
-
\??\c:\rllfxrr.exec:\rllfxrr.exe83⤵PID:3284
-
\??\c:\lfxxrxx.exec:\lfxxrxx.exe84⤵PID:4436
-
\??\c:\nbhbnh.exec:\nbhbnh.exe85⤵PID:2196
-
\??\c:\dddpv.exec:\dddpv.exe86⤵PID:1580
-
\??\c:\pdjdj.exec:\pdjdj.exe87⤵PID:4864
-
\??\c:\lxrfrlf.exec:\lxrfrlf.exe88⤵PID:412
-
\??\c:\hnnbnn.exec:\hnnbnn.exe89⤵PID:976
-
\??\c:\bntnnt.exec:\bntnnt.exe90⤵PID:5044
-
\??\c:\dpppj.exec:\dpppj.exe91⤵PID:2644
-
\??\c:\ppvpp.exec:\ppvpp.exe92⤵PID:4876
-
\??\c:\lrrxfll.exec:\lrrxfll.exe93⤵PID:1960
-
\??\c:\9hnbbb.exec:\9hnbbb.exe94⤵PID:1432
-
\??\c:\tntthn.exec:\tntthn.exe95⤵PID:3268
-
\??\c:\pddvj.exec:\pddvj.exe96⤵PID:2172
-
\??\c:\frlxrlf.exec:\frlxrlf.exe97⤵PID:4056
-
\??\c:\nhhttn.exec:\nhhttn.exe98⤵PID:2216
-
\??\c:\hbbnbt.exec:\hbbnbt.exe99⤵PID:224
-
\??\c:\vvjdp.exec:\vvjdp.exe100⤵PID:5100
-
\??\c:\1rfrfrr.exec:\1rfrfrr.exe101⤵PID:4284
-
\??\c:\lxfxxxf.exec:\lxfxxxf.exe102⤵PID:4012
-
\??\c:\bnnhhh.exec:\bnnhhh.exe103⤵PID:3696
-
\??\c:\pvdpv.exec:\pvdpv.exe104⤵PID:4744
-
\??\c:\vjpdv.exec:\vjpdv.exe105⤵PID:1632
-
\??\c:\xlrlffx.exec:\xlrlffx.exe106⤵PID:4292
-
\??\c:\tbbtnn.exec:\tbbtnn.exe107⤵PID:3264
-
\??\c:\hhtnnn.exec:\hhtnnn.exe108⤵PID:1304
-
\??\c:\pdjdp.exec:\pdjdp.exe109⤵PID:4324
-
\??\c:\rxrlflx.exec:\rxrlflx.exe110⤵PID:1812
-
\??\c:\nbtnnh.exec:\nbtnnh.exe111⤵PID:2024
-
\??\c:\dvvvd.exec:\dvvvd.exe112⤵PID:3400
-
\??\c:\lllxrlx.exec:\lllxrlx.exe113⤵PID:876
-
\??\c:\7fxxxlf.exec:\7fxxxlf.exe114⤵PID:1644
-
\??\c:\tttnhh.exec:\tttnhh.exe115⤵PID:4888
-
\??\c:\jvvpp.exec:\jvvpp.exe116⤵PID:4152
-
\??\c:\xlrlffx.exec:\xlrlffx.exe117⤵PID:4304
-
\??\c:\lrfxxlx.exec:\lrfxxlx.exe118⤵PID:3568
-
\??\c:\nbhbbt.exec:\nbhbbt.exe119⤵PID:3088
-
\??\c:\7ddvd.exec:\7ddvd.exe120⤵PID:3704
-
\??\c:\pppvp.exec:\pppvp.exe121⤵PID:3632
-
\??\c:\xfxrfxl.exec:\xfxrfxl.exe122⤵PID:3552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-