Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
21-07-2024 13:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cebc1a64a7ed0de32b33fb709138dc30N.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
120 seconds
General
-
Target
cebc1a64a7ed0de32b33fb709138dc30N.exe
-
Size
62KB
-
MD5
cebc1a64a7ed0de32b33fb709138dc30
-
SHA1
bef083eb4efc70816e6e2f659b4ca283e2fd95c6
-
SHA256
519503ec3d33c77a742a083f092a7453ec9e6c3beb683f85b9cbbeb70b95d76d
-
SHA512
5ef6ec6f54595996f54ebed70a2a4c9269cdb56773691973a66cd16c03313e4c271bba01b670b9ac46b118f8196c1f0f0e8b451d02055fc2f91b4274d4f3e9a6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+M:ymb3NkkiQ3mdBjF0y7M
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3576-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/244-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/552-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1592-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2308 bnnnnt.exe 5056 djpdd.exe 3008 3rxrlrr.exe 2368 ntbhhh.exe 3592 jjpjj.exe 548 ddppp.exe 4000 9tntbn.exe 4768 5jdvj.exe 4932 7flllrl.exe 3436 tthnbh.exe 4968 rfflllr.exe 3224 fxlllfl.exe 5104 dpvjd.exe 1400 ffrrflx.exe 2644 vdjvd.exe 2672 xxxrrff.exe 3356 tnnnnn.exe 244 btbtnn.exe 4688 pjdjj.exe 552 xxrrxff.exe 2260 3tbbtb.exe 3660 vjdvv.exe 4788 nttnbn.exe 4744 ddjjj.exe 1704 rflrlfr.exe 3744 nnnnnn.exe 1592 pvvvv.exe 4068 llllrrx.exe 1056 1nnnnn.exe 3540 7vjdp.exe 3652 5rrlllx.exe 3852 ttbthn.exe 1708 pvjjd.exe 2808 frfxlrr.exe 3732 tnthth.exe 3948 jdvjp.exe 4456 rxrxfff.exe 2080 nhnnhn.exe 2152 nnnttt.exe 4008 lrrlrrx.exe 776 lflllrl.exe 2720 vpvdj.exe 4244 dpjjd.exe 1472 xffrrxx.exe 4192 nnhtnn.exe 4624 bnhbbn.exe 4248 vvvvv.exe 2348 rlxlflx.exe 1104 9nnhbh.exe 1364 1dpjp.exe 5100 fffflrx.exe 3296 nnhhbh.exe 3884 pvppv.exe 2676 jjpjd.exe 3092 rrxffrr.exe 3312 nnnnnt.exe 676 djjpp.exe 3564 rrxxxff.exe 4048 ttnnbh.exe 1528 dvjdd.exe 3052 rrxxlrr.exe 1044 rxfffrr.exe 4996 ppjvv.exe 4132 jjppv.exe -
resource yara_rule behavioral2/memory/3576-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/244-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1592-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3576 wrote to memory of 2308 3576 cebc1a64a7ed0de32b33fb709138dc30N.exe 83 PID 3576 wrote to memory of 2308 3576 cebc1a64a7ed0de32b33fb709138dc30N.exe 83 PID 3576 wrote to memory of 2308 3576 cebc1a64a7ed0de32b33fb709138dc30N.exe 83 PID 2308 wrote to memory of 5056 2308 bnnnnt.exe 84 PID 2308 wrote to memory of 5056 2308 bnnnnt.exe 84 PID 2308 wrote to memory of 5056 2308 bnnnnt.exe 84 PID 5056 wrote to memory of 3008 5056 djpdd.exe 85 PID 5056 wrote to memory of 3008 5056 djpdd.exe 85 PID 5056 wrote to memory of 3008 5056 djpdd.exe 85 PID 3008 wrote to memory of 2368 3008 3rxrlrr.exe 86 PID 3008 wrote to memory of 2368 3008 3rxrlrr.exe 86 PID 3008 wrote to memory of 2368 3008 3rxrlrr.exe 86 PID 2368 wrote to memory of 3592 2368 ntbhhh.exe 87 PID 2368 wrote to memory of 3592 2368 ntbhhh.exe 87 PID 2368 wrote to memory of 3592 2368 ntbhhh.exe 87 PID 3592 wrote to memory of 548 3592 jjpjj.exe 88 PID 3592 wrote to memory of 548 3592 jjpjj.exe 88 PID 3592 wrote to memory of 548 3592 jjpjj.exe 88 PID 548 wrote to memory of 4000 548 ddppp.exe 89 PID 548 wrote to memory of 4000 548 ddppp.exe 89 PID 548 wrote to memory of 4000 548 ddppp.exe 89 PID 4000 wrote to memory of 4768 4000 9tntbn.exe 90 PID 4000 wrote to memory of 4768 4000 9tntbn.exe 90 PID 4000 wrote to memory of 4768 4000 9tntbn.exe 90 PID 4768 wrote to memory of 4932 4768 5jdvj.exe 91 PID 4768 wrote to memory of 4932 4768 5jdvj.exe 91 PID 4768 wrote to memory of 4932 4768 5jdvj.exe 91 PID 4932 wrote to memory of 3436 4932 7flllrl.exe 92 PID 4932 wrote to memory of 3436 4932 7flllrl.exe 92 PID 4932 wrote to memory of 3436 4932 7flllrl.exe 92 PID 3436 wrote to memory of 4968 3436 tthnbh.exe 93 PID 3436 wrote to memory of 4968 3436 tthnbh.exe 93 PID 3436 wrote to memory of 4968 3436 tthnbh.exe 93 PID 4968 wrote to memory of 3224 4968 rfflllr.exe 94 PID 4968 wrote to memory of 3224 4968 rfflllr.exe 94 PID 4968 wrote to memory of 3224 4968 rfflllr.exe 94 PID 3224 wrote to memory of 5104 3224 fxlllfl.exe 95 PID 3224 wrote to memory of 5104 3224 fxlllfl.exe 95 PID 3224 wrote to memory of 5104 3224 fxlllfl.exe 95 PID 5104 wrote to memory of 1400 5104 dpvjd.exe 96 PID 5104 wrote to memory of 1400 5104 dpvjd.exe 96 PID 5104 wrote to memory of 1400 5104 dpvjd.exe 96 PID 1400 wrote to memory of 2644 1400 ffrrflx.exe 97 PID 1400 wrote to memory of 2644 1400 ffrrflx.exe 97 PID 1400 wrote to memory of 2644 1400 ffrrflx.exe 97 PID 2644 wrote to memory of 2672 2644 vdjvd.exe 98 PID 2644 wrote to memory of 2672 2644 vdjvd.exe 98 PID 2644 wrote to memory of 2672 2644 vdjvd.exe 98 PID 2672 wrote to memory of 3356 2672 xxxrrff.exe 99 PID 2672 wrote to memory of 3356 2672 xxxrrff.exe 99 PID 2672 wrote to memory of 3356 2672 xxxrrff.exe 99 PID 3356 wrote to memory of 244 3356 tnnnnn.exe 100 PID 3356 wrote to memory of 244 3356 tnnnnn.exe 100 PID 3356 wrote to memory of 244 3356 tnnnnn.exe 100 PID 244 wrote to memory of 4688 244 btbtnn.exe 101 PID 244 wrote to memory of 4688 244 btbtnn.exe 101 PID 244 wrote to memory of 4688 244 btbtnn.exe 101 PID 4688 wrote to memory of 552 4688 pjdjj.exe 102 PID 4688 wrote to memory of 552 4688 pjdjj.exe 102 PID 4688 wrote to memory of 552 4688 pjdjj.exe 102 PID 552 wrote to memory of 2260 552 xxrrxff.exe 103 PID 552 wrote to memory of 2260 552 xxrrxff.exe 103 PID 552 wrote to memory of 2260 552 xxrrxff.exe 103 PID 2260 wrote to memory of 3660 2260 3tbbtb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\cebc1a64a7ed0de32b33fb709138dc30N.exe"C:\Users\Admin\AppData\Local\Temp\cebc1a64a7ed0de32b33fb709138dc30N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\bnnnnt.exec:\bnnnnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\djpdd.exec:\djpdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\3rxrlrr.exec:\3rxrlrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\ntbhhh.exec:\ntbhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\jjpjj.exec:\jjpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\ddppp.exec:\ddppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\9tntbn.exec:\9tntbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\5jdvj.exec:\5jdvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\7flllrl.exec:\7flllrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\tthnbh.exec:\tthnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\rfflllr.exec:\rfflllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\fxlllfl.exec:\fxlllfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\dpvjd.exec:\dpvjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\ffrrflx.exec:\ffrrflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\vdjvd.exec:\vdjvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\xxxrrff.exec:\xxxrrff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\tnnnnn.exec:\tnnnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\btbtnn.exec:\btbtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
\??\c:\pjdjj.exec:\pjdjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\xxrrxff.exec:\xxrrxff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\3tbbtb.exec:\3tbbtb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\vjdvv.exec:\vjdvv.exe23⤵
- Executes dropped EXE
PID:3660 -
\??\c:\nttnbn.exec:\nttnbn.exe24⤵
- Executes dropped EXE
PID:4788 -
\??\c:\ddjjj.exec:\ddjjj.exe25⤵
- Executes dropped EXE
PID:4744 -
\??\c:\rflrlfr.exec:\rflrlfr.exe26⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nnnnnn.exec:\nnnnnn.exe27⤵
- Executes dropped EXE
PID:3744 -
\??\c:\pvvvv.exec:\pvvvv.exe28⤵
- Executes dropped EXE
PID:1592 -
\??\c:\llllrrx.exec:\llllrrx.exe29⤵
- Executes dropped EXE
PID:4068 -
\??\c:\1nnnnn.exec:\1nnnnn.exe30⤵
- Executes dropped EXE
PID:1056 -
\??\c:\7vjdp.exec:\7vjdp.exe31⤵
- Executes dropped EXE
PID:3540 -
\??\c:\5rrlllx.exec:\5rrlllx.exe32⤵
- Executes dropped EXE
PID:3652 -
\??\c:\ttbthn.exec:\ttbthn.exe33⤵
- Executes dropped EXE
PID:3852 -
\??\c:\pvjjd.exec:\pvjjd.exe34⤵
- Executes dropped EXE
PID:1708 -
\??\c:\frfxlrr.exec:\frfxlrr.exe35⤵
- Executes dropped EXE
PID:2808 -
\??\c:\tnthth.exec:\tnthth.exe36⤵
- Executes dropped EXE
PID:3732 -
\??\c:\jdvjp.exec:\jdvjp.exe37⤵
- Executes dropped EXE
PID:3948 -
\??\c:\rxrxfff.exec:\rxrxfff.exe38⤵
- Executes dropped EXE
PID:4456 -
\??\c:\nhnnhn.exec:\nhnnhn.exe39⤵
- Executes dropped EXE
PID:2080 -
\??\c:\nnnttt.exec:\nnnttt.exe40⤵
- Executes dropped EXE
PID:2152 -
\??\c:\lrrlrrx.exec:\lrrlrrx.exe41⤵
- Executes dropped EXE
PID:4008 -
\??\c:\lflllrl.exec:\lflllrl.exe42⤵
- Executes dropped EXE
PID:776 -
\??\c:\vpvdj.exec:\vpvdj.exe43⤵
- Executes dropped EXE
PID:2720 -
\??\c:\dpjjd.exec:\dpjjd.exe44⤵
- Executes dropped EXE
PID:4244 -
\??\c:\xffrrxx.exec:\xffrrxx.exe45⤵
- Executes dropped EXE
PID:1472 -
\??\c:\nnhtnn.exec:\nnhtnn.exe46⤵
- Executes dropped EXE
PID:4192 -
\??\c:\bnhbbn.exec:\bnhbbn.exe47⤵
- Executes dropped EXE
PID:4624 -
\??\c:\vvvvv.exec:\vvvvv.exe48⤵
- Executes dropped EXE
PID:4248 -
\??\c:\rlxlflx.exec:\rlxlflx.exe49⤵
- Executes dropped EXE
PID:2348 -
\??\c:\9nnhbh.exec:\9nnhbh.exe50⤵
- Executes dropped EXE
PID:1104 -
\??\c:\1dpjp.exec:\1dpjp.exe51⤵
- Executes dropped EXE
PID:1364 -
\??\c:\fffflrx.exec:\fffflrx.exe52⤵
- Executes dropped EXE
PID:5100 -
\??\c:\nnhhbh.exec:\nnhhbh.exe53⤵
- Executes dropped EXE
PID:3296 -
\??\c:\pvppv.exec:\pvppv.exe54⤵
- Executes dropped EXE
PID:3884 -
\??\c:\jjpjd.exec:\jjpjd.exe55⤵
- Executes dropped EXE
PID:2676 -
\??\c:\rrxffrr.exec:\rrxffrr.exe56⤵
- Executes dropped EXE
PID:3092 -
\??\c:\nnnnnt.exec:\nnnnnt.exe57⤵
- Executes dropped EXE
PID:3312 -
\??\c:\djjpp.exec:\djjpp.exe58⤵
- Executes dropped EXE
PID:676 -
\??\c:\rrxxxff.exec:\rrxxxff.exe59⤵
- Executes dropped EXE
PID:3564 -
\??\c:\ttnnbh.exec:\ttnnbh.exe60⤵
- Executes dropped EXE
PID:4048 -
\??\c:\dvjdd.exec:\dvjdd.exe61⤵
- Executes dropped EXE
PID:1528 -
\??\c:\rrxxlrr.exec:\rrxxlrr.exe62⤵
- Executes dropped EXE
PID:3052 -
\??\c:\rxfffrr.exec:\rxfffrr.exe63⤵
- Executes dropped EXE
PID:1044 -
\??\c:\ppjvv.exec:\ppjvv.exe64⤵
- Executes dropped EXE
PID:4996 -
\??\c:\jjppv.exec:\jjppv.exe65⤵
- Executes dropped EXE
PID:4132 -
\??\c:\rxflrxr.exec:\rxflrxr.exe66⤵PID:856
-
\??\c:\bttnbb.exec:\bttnbb.exe67⤵PID:4516
-
\??\c:\rlrrrxx.exec:\rlrrrxx.exe68⤵PID:1344
-
\??\c:\tbhhtb.exec:\tbhhtb.exe69⤵PID:4660
-
\??\c:\hhbhhn.exec:\hhbhhn.exe70⤵PID:3728
-
\??\c:\vpjpp.exec:\vpjpp.exe71⤵PID:2316
-
\??\c:\1xxfffl.exec:\1xxfffl.exe72⤵PID:2596
-
\??\c:\hbtttb.exec:\hbtttb.exe73⤵PID:4832
-
\??\c:\5pvvp.exec:\5pvvp.exe74⤵PID:4156
-
\??\c:\ffxlxlx.exec:\ffxlxlx.exe75⤵PID:4648
-
\??\c:\hhnhbn.exec:\hhnhbn.exe76⤵PID:3112
-
\??\c:\pjvvv.exec:\pjvvv.exe77⤵PID:1240
-
\??\c:\rfrrfll.exec:\rfrrfll.exe78⤵PID:4536
-
\??\c:\jpjpj.exec:\jpjpj.exe79⤵PID:4912
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe80⤵PID:3948
-
\??\c:\flrxrff.exec:\flrxrff.exe81⤵PID:5076
-
\??\c:\vddpj.exec:\vddpj.exe82⤵PID:928
-
\??\c:\jpvvp.exec:\jpvvp.exe83⤵PID:4760
-
\??\c:\hthhnh.exec:\hthhnh.exe84⤵PID:2436
-
\??\c:\pvpjp.exec:\pvpjp.exe85⤵PID:1664
-
\??\c:\ffflrxr.exec:\ffflrxr.exe86⤵PID:2368
-
\??\c:\5nbbhn.exec:\5nbbhn.exe87⤵PID:2720
-
\??\c:\vvvdv.exec:\vvvdv.exe88⤵PID:4244
-
\??\c:\lrffrrf.exec:\lrffrrf.exe89⤵PID:2608
-
\??\c:\hbntnn.exec:\hbntnn.exe90⤵PID:3680
-
\??\c:\pvjjv.exec:\pvjjv.exe91⤵PID:4000
-
\??\c:\frllllf.exec:\frllllf.exe92⤵PID:4624
-
\??\c:\nbnhbh.exec:\nbnhbh.exe93⤵PID:4248
-
\??\c:\pdvvv.exec:\pdvvv.exe94⤵PID:2348
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe95⤵PID:456
-
\??\c:\tnbbbh.exec:\tnbbbh.exe96⤵PID:4468
-
\??\c:\bbhtbt.exec:\bbhtbt.exe97⤵PID:1844
-
\??\c:\jjddv.exec:\jjddv.exe98⤵PID:2924
-
\??\c:\rxxxxxf.exec:\rxxxxxf.exe99⤵PID:736
-
\??\c:\tbtbth.exec:\tbtbth.exe100⤵PID:3832
-
\??\c:\jpvpj.exec:\jpvpj.exe101⤵PID:5104
-
\??\c:\1fxrrll.exec:\1fxrrll.exe102⤵PID:4948
-
\??\c:\xfrfffr.exec:\xfrfffr.exe103⤵PID:1164
-
\??\c:\9bnntb.exec:\9bnntb.exe104⤵PID:2480
-
\??\c:\dpjjj.exec:\dpjjj.exe105⤵PID:3944
-
\??\c:\lfllrxx.exec:\lfllrxx.exe106⤵PID:4344
-
\??\c:\rrffrxl.exec:\rrffrxl.exe107⤵PID:552
-
\??\c:\hhbttt.exec:\hhbttt.exe108⤵PID:3912
-
\??\c:\dddjd.exec:\dddjd.exe109⤵PID:2376
-
\??\c:\rrxrrxr.exec:\rrxrrxr.exe110⤵PID:3908
-
\??\c:\nhthhb.exec:\nhthhb.exe111⤵PID:1620
-
\??\c:\vpjdp.exec:\vpjdp.exe112⤵PID:4576
-
\??\c:\vpvpp.exec:\vpvpp.exe113⤵PID:2748
-
\??\c:\xffrlff.exec:\xffrlff.exe114⤵PID:1592
-
\??\c:\rxllrrx.exec:\rxllrrx.exe115⤵PID:4052
-
\??\c:\nnnnhn.exec:\nnnnhn.exe116⤵PID:4148
-
\??\c:\ppdvv.exec:\ppdvv.exe117⤵PID:4156
-
\??\c:\pdjjj.exec:\pdjjj.exe118⤵PID:3152
-
\??\c:\rrrrrfr.exec:\rrrrrfr.exe119⤵PID:4496
-
\??\c:\llxxxxx.exec:\llxxxxx.exe120⤵PID:3768
-
\??\c:\thnnhh.exec:\thnnhh.exe121⤵PID:2144
-
\??\c:\jddjv.exec:\jddjv.exe122⤵PID:3600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-