Analysis
-
max time kernel
120s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
21/07/2024, 16:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ef0e83b9f1a08caa96b86bb1533f7520N.exe
Resource
win7-20240704-en
5 signatures
120 seconds
General
-
Target
ef0e83b9f1a08caa96b86bb1533f7520N.exe
-
Size
89KB
-
MD5
ef0e83b9f1a08caa96b86bb1533f7520
-
SHA1
6ec87152e18a015335f72296751b9e682ee080e5
-
SHA256
97440b385a89b6fcc1ede473978fa40bf72cd0eb6c5b455ee4ea20a00e4a4eab
-
SHA512
4a2811fdf19e5b8f253ad7577523ca8a40fdd272c7f253c18f4f8687e5551a6f32f33c18a0c3655bfc5af907378ef5815f27d1f62b4eeba8f792f4c9dfa48638
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2wV3jaCJ5jH3ebSt:ymb3NkkiQ3mdBjF+3TU2K3bJZXjt
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/1172-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/672-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/688-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2568-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3888-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 228 rfxxxfl.exe 2388 nhttbb.exe 672 dvdvj.exe 3744 xrfxrxr.exe 688 1hbtnh.exe 3812 vjppv.exe 3972 lfrfrxr.exe 1804 thtnth.exe 2568 jdppd.exe 2028 lrxxrrr.exe 1060 3hbbhn.exe 3680 9dddj.exe 4284 jjddv.exe 3968 ffrrrrr.exe 4268 nnhnnt.exe 1224 hnnhhn.exe 3716 jpdjp.exe 3960 lrllrxl.exe 2980 pdvpj.exe 3888 llfllll.exe 1604 bbbbbt.exe 2436 1pvdd.exe 4520 vdpjp.exe 4144 xffxrrl.exe 3424 thtnhb.exe 1124 pvdjj.exe 516 fxxxrrf.exe 3836 rlxxffr.exe 4380 thnnnh.exe 1172 bbtttb.exe 1056 1vvdj.exe 264 nttnhb.exe 1308 pjpjd.exe 2668 pjjpp.exe 3744 rflrllx.exe 2744 lrflxxr.exe 4688 bbttnt.exe 1872 pvdpd.exe 380 frrfxlf.exe 4912 rxlllrf.exe 4700 bnhbbb.exe 4896 dpjdd.exe 1396 xfffxxl.exe 4312 tbbtnn.exe 3992 pvppv.exe 1512 pjdvv.exe 4008 lllfxxx.exe 4596 fxlffff.exe 4616 tntbbb.exe 4864 hnhhhh.exe 1212 vdvvj.exe 3828 xxffffl.exe 2384 xrlrxll.exe 5064 hhhhhn.exe 2980 dvddj.exe 3556 1xlxxff.exe 4556 htbbbt.exe 2276 vvvvv.exe 2460 vjdvv.exe 4520 rxrrlrx.exe 2180 bntbbb.exe 4448 bhhbbb.exe 1384 ppjjd.exe 3424 jjvpp.exe -
resource yara_rule behavioral2/memory/1172-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/672-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1224-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4144-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1172 wrote to memory of 228 1172 ef0e83b9f1a08caa96b86bb1533f7520N.exe 86 PID 1172 wrote to memory of 228 1172 ef0e83b9f1a08caa96b86bb1533f7520N.exe 86 PID 1172 wrote to memory of 228 1172 ef0e83b9f1a08caa96b86bb1533f7520N.exe 86 PID 228 wrote to memory of 2388 228 rfxxxfl.exe 87 PID 228 wrote to memory of 2388 228 rfxxxfl.exe 87 PID 228 wrote to memory of 2388 228 rfxxxfl.exe 87 PID 2388 wrote to memory of 672 2388 nhttbb.exe 88 PID 2388 wrote to memory of 672 2388 nhttbb.exe 88 PID 2388 wrote to memory of 672 2388 nhttbb.exe 88 PID 672 wrote to memory of 3744 672 dvdvj.exe 89 PID 672 wrote to memory of 3744 672 dvdvj.exe 89 PID 672 wrote to memory of 3744 672 dvdvj.exe 89 PID 3744 wrote to memory of 688 3744 xrfxrxr.exe 90 PID 3744 wrote to memory of 688 3744 xrfxrxr.exe 90 PID 3744 wrote to memory of 688 3744 xrfxrxr.exe 90 PID 688 wrote to memory of 3812 688 1hbtnh.exe 91 PID 688 wrote to memory of 3812 688 1hbtnh.exe 91 PID 688 wrote to memory of 3812 688 1hbtnh.exe 91 PID 3812 wrote to memory of 3972 3812 vjppv.exe 92 PID 3812 wrote to memory of 3972 3812 vjppv.exe 92 PID 3812 wrote to memory of 3972 3812 vjppv.exe 92 PID 3972 wrote to memory of 1804 3972 lfrfrxr.exe 93 PID 3972 wrote to memory of 1804 3972 lfrfrxr.exe 93 PID 3972 wrote to memory of 1804 3972 lfrfrxr.exe 93 PID 1804 wrote to memory of 2568 1804 thtnth.exe 94 PID 1804 wrote to memory of 2568 1804 thtnth.exe 94 PID 1804 wrote to memory of 2568 1804 thtnth.exe 94 PID 2568 wrote to memory of 2028 2568 jdppd.exe 95 PID 2568 wrote to memory of 2028 2568 jdppd.exe 95 PID 2568 wrote to memory of 2028 2568 jdppd.exe 95 PID 2028 wrote to memory of 1060 2028 lrxxrrr.exe 96 PID 2028 wrote to memory of 1060 2028 lrxxrrr.exe 96 PID 2028 wrote to memory of 1060 2028 lrxxrrr.exe 96 PID 1060 wrote to memory of 3680 1060 3hbbhn.exe 97 PID 1060 wrote to memory of 3680 1060 3hbbhn.exe 97 PID 1060 wrote to memory of 3680 1060 3hbbhn.exe 97 PID 3680 wrote to memory of 4284 3680 9dddj.exe 98 PID 3680 wrote to memory of 4284 3680 9dddj.exe 98 PID 3680 wrote to memory of 4284 3680 9dddj.exe 98 PID 4284 wrote to memory of 3968 4284 jjddv.exe 99 PID 4284 wrote to memory of 3968 4284 jjddv.exe 99 PID 4284 wrote to memory of 3968 4284 jjddv.exe 99 PID 3968 wrote to memory of 4268 3968 ffrrrrr.exe 100 PID 3968 wrote to memory of 4268 3968 ffrrrrr.exe 100 PID 3968 wrote to memory of 4268 3968 ffrrrrr.exe 100 PID 4268 wrote to memory of 1224 4268 nnhnnt.exe 101 PID 4268 wrote to memory of 1224 4268 nnhnnt.exe 101 PID 4268 wrote to memory of 1224 4268 nnhnnt.exe 101 PID 1224 wrote to memory of 3716 1224 hnnhhn.exe 102 PID 1224 wrote to memory of 3716 1224 hnnhhn.exe 102 PID 1224 wrote to memory of 3716 1224 hnnhhn.exe 102 PID 3716 wrote to memory of 3960 3716 jpdjp.exe 104 PID 3716 wrote to memory of 3960 3716 jpdjp.exe 104 PID 3716 wrote to memory of 3960 3716 jpdjp.exe 104 PID 3960 wrote to memory of 2980 3960 lrllrxl.exe 105 PID 3960 wrote to memory of 2980 3960 lrllrxl.exe 105 PID 3960 wrote to memory of 2980 3960 lrllrxl.exe 105 PID 2980 wrote to memory of 3888 2980 pdvpj.exe 106 PID 2980 wrote to memory of 3888 2980 pdvpj.exe 106 PID 2980 wrote to memory of 3888 2980 pdvpj.exe 106 PID 3888 wrote to memory of 1604 3888 llfllll.exe 107 PID 3888 wrote to memory of 1604 3888 llfllll.exe 107 PID 3888 wrote to memory of 1604 3888 llfllll.exe 107 PID 1604 wrote to memory of 2436 1604 bbbbbt.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef0e83b9f1a08caa96b86bb1533f7520N.exe"C:\Users\Admin\AppData\Local\Temp\ef0e83b9f1a08caa96b86bb1533f7520N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\rfxxxfl.exec:\rfxxxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\nhttbb.exec:\nhttbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\dvdvj.exec:\dvdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\xrfxrxr.exec:\xrfxrxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\1hbtnh.exec:\1hbtnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\vjppv.exec:\vjppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\lfrfrxr.exec:\lfrfrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\thtnth.exec:\thtnth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\jdppd.exec:\jdppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\lrxxrrr.exec:\lrxxrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\3hbbhn.exec:\3hbbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\9dddj.exec:\9dddj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\jjddv.exec:\jjddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\ffrrrrr.exec:\ffrrrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\nnhnnt.exec:\nnhnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\hnnhhn.exec:\hnnhhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\jpdjp.exec:\jpdjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\lrllrxl.exec:\lrllrxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\pdvpj.exec:\pdvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\llfllll.exec:\llfllll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\bbbbbt.exec:\bbbbbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\1pvdd.exec:\1pvdd.exe23⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vdpjp.exec:\vdpjp.exe24⤵
- Executes dropped EXE
PID:4520 -
\??\c:\xffxrrl.exec:\xffxrrl.exe25⤵
- Executes dropped EXE
PID:4144 -
\??\c:\thtnhb.exec:\thtnhb.exe26⤵
- Executes dropped EXE
PID:3424 -
\??\c:\pvdjj.exec:\pvdjj.exe27⤵
- Executes dropped EXE
PID:1124 -
\??\c:\fxxxrrf.exec:\fxxxrrf.exe28⤵
- Executes dropped EXE
PID:516 -
\??\c:\rlxxffr.exec:\rlxxffr.exe29⤵
- Executes dropped EXE
PID:3836 -
\??\c:\thnnnh.exec:\thnnnh.exe30⤵
- Executes dropped EXE
PID:4380 -
\??\c:\bbtttb.exec:\bbtttb.exe31⤵
- Executes dropped EXE
PID:1172 -
\??\c:\1vvdj.exec:\1vvdj.exe32⤵
- Executes dropped EXE
PID:1056 -
\??\c:\nttnhb.exec:\nttnhb.exe33⤵
- Executes dropped EXE
PID:264 -
\??\c:\pjpjd.exec:\pjpjd.exe34⤵
- Executes dropped EXE
PID:1308 -
\??\c:\pjjpp.exec:\pjjpp.exe35⤵
- Executes dropped EXE
PID:2668 -
\??\c:\rflrllx.exec:\rflrllx.exe36⤵
- Executes dropped EXE
PID:3744 -
\??\c:\lrflxxr.exec:\lrflxxr.exe37⤵
- Executes dropped EXE
PID:2744 -
\??\c:\bbttnt.exec:\bbttnt.exe38⤵
- Executes dropped EXE
PID:4688 -
\??\c:\pvdpd.exec:\pvdpd.exe39⤵
- Executes dropped EXE
PID:1872 -
\??\c:\frrfxlf.exec:\frrfxlf.exe40⤵
- Executes dropped EXE
PID:380 -
\??\c:\rxlllrf.exec:\rxlllrf.exe41⤵
- Executes dropped EXE
PID:4912 -
\??\c:\bnhbbb.exec:\bnhbbb.exe42⤵
- Executes dropped EXE
PID:4700 -
\??\c:\dpjdd.exec:\dpjdd.exe43⤵
- Executes dropped EXE
PID:4896 -
\??\c:\xfffxxl.exec:\xfffxxl.exe44⤵
- Executes dropped EXE
PID:1396 -
\??\c:\tbbtnn.exec:\tbbtnn.exe45⤵
- Executes dropped EXE
PID:4312 -
\??\c:\pvppv.exec:\pvppv.exe46⤵
- Executes dropped EXE
PID:3992 -
\??\c:\pjdvv.exec:\pjdvv.exe47⤵
- Executes dropped EXE
PID:1512 -
\??\c:\lllfxxx.exec:\lllfxxx.exe48⤵
- Executes dropped EXE
PID:4008 -
\??\c:\fxlffff.exec:\fxlffff.exe49⤵
- Executes dropped EXE
PID:4596 -
\??\c:\tntbbb.exec:\tntbbb.exe50⤵
- Executes dropped EXE
PID:4616 -
\??\c:\hnhhhh.exec:\hnhhhh.exe51⤵
- Executes dropped EXE
PID:4864 -
\??\c:\vdvvj.exec:\vdvvj.exe52⤵
- Executes dropped EXE
PID:1212 -
\??\c:\xxffffl.exec:\xxffffl.exe53⤵
- Executes dropped EXE
PID:3828 -
\??\c:\xrlrxll.exec:\xrlrxll.exe54⤵
- Executes dropped EXE
PID:2384 -
\??\c:\hhhhhn.exec:\hhhhhn.exe55⤵
- Executes dropped EXE
PID:5064 -
\??\c:\dvddj.exec:\dvddj.exe56⤵
- Executes dropped EXE
PID:2980 -
\??\c:\1xlxxff.exec:\1xlxxff.exe57⤵
- Executes dropped EXE
PID:3556 -
\??\c:\htbbbt.exec:\htbbbt.exe58⤵
- Executes dropped EXE
PID:4556 -
\??\c:\vvvvv.exec:\vvvvv.exe59⤵
- Executes dropped EXE
PID:2276 -
\??\c:\vjdvv.exec:\vjdvv.exe60⤵
- Executes dropped EXE
PID:2460 -
\??\c:\rxrrlrx.exec:\rxrrlrx.exe61⤵
- Executes dropped EXE
PID:4520 -
\??\c:\bntbbb.exec:\bntbbb.exe62⤵
- Executes dropped EXE
PID:2180 -
\??\c:\bhhbbb.exec:\bhhbbb.exe63⤵
- Executes dropped EXE
PID:4448 -
\??\c:\ppjjd.exec:\ppjjd.exe64⤵
- Executes dropped EXE
PID:1384 -
\??\c:\jjvpp.exec:\jjvpp.exe65⤵
- Executes dropped EXE
PID:3424 -
\??\c:\lxxflxf.exec:\lxxflxf.exe66⤵PID:4632
-
\??\c:\fxlllrx.exec:\fxlllrx.exe67⤵PID:2244
-
\??\c:\thhbbt.exec:\thhbbt.exe68⤵PID:4392
-
\??\c:\jjdvv.exec:\jjdvv.exe69⤵PID:2396
-
\??\c:\pdjjv.exec:\pdjjv.exe70⤵PID:392
-
\??\c:\ddppp.exec:\ddppp.exe71⤵PID:2820
-
\??\c:\rxlffxx.exec:\rxlffxx.exe72⤵PID:228
-
\??\c:\nhbbbh.exec:\nhbbbh.exe73⤵PID:1056
-
\??\c:\ddjjv.exec:\ddjjv.exe74⤵PID:5040
-
\??\c:\lflllrf.exec:\lflllrf.exe75⤵PID:4992
-
\??\c:\lrrrxff.exec:\lrrrxff.exe76⤵PID:1436
-
\??\c:\thbhhh.exec:\thbhhh.exe77⤵PID:3744
-
\??\c:\hbbbnn.exec:\hbbbnn.exe78⤵PID:688
-
\??\c:\pjvpp.exec:\pjvpp.exe79⤵PID:1096
-
\??\c:\jdpvv.exec:\jdpvv.exe80⤵PID:1872
-
\??\c:\rxrxxll.exec:\rxrxxll.exe81⤵PID:4932
-
\??\c:\rlfflrr.exec:\rlfflrr.exe82⤵PID:4912
-
\??\c:\hbbttt.exec:\hbbttt.exe83⤵PID:4700
-
\??\c:\tbhnht.exec:\tbhnht.exe84⤵PID:1044
-
\??\c:\vjppj.exec:\vjppj.exe85⤵PID:4000
-
\??\c:\lrllrrf.exec:\lrllrrf.exe86⤵PID:3228
-
\??\c:\rfrrxfl.exec:\rfrrxfl.exe87⤵PID:3652
-
\??\c:\3tbbhn.exec:\3tbbhn.exe88⤵PID:1616
-
\??\c:\tbbbtt.exec:\tbbbtt.exe89⤵PID:3676
-
\??\c:\jjdvv.exec:\jjdvv.exe90⤵PID:4908
-
\??\c:\7pddv.exec:\7pddv.exe91⤵PID:3692
-
\??\c:\lxrfxxr.exec:\lxrfxxr.exe92⤵PID:3984
-
\??\c:\bhbbnt.exec:\bhbbnt.exe93⤵PID:2708
-
\??\c:\jpvpj.exec:\jpvpj.exe94⤵PID:2520
-
\??\c:\pvvdp.exec:\pvvdp.exe95⤵PID:2416
-
\??\c:\llrrrxx.exec:\llrrrxx.exe96⤵PID:1636
-
\??\c:\tnbntb.exec:\tnbntb.exe97⤵PID:5064
-
\??\c:\tbhhhn.exec:\tbhhhn.exe98⤵PID:2980
-
\??\c:\vjpvj.exec:\vjpvj.exe99⤵PID:3556
-
\??\c:\jvpvp.exec:\jvpvp.exe100⤵PID:2860
-
\??\c:\9xfffll.exec:\9xfffll.exe101⤵PID:2276
-
\??\c:\tbtttt.exec:\tbtttt.exe102⤵PID:3164
-
\??\c:\dvpjp.exec:\dvpjp.exe103⤵PID:5096
-
\??\c:\ppvvv.exec:\ppvvv.exe104⤵PID:1876
-
\??\c:\fxlrrxl.exec:\fxlrrxl.exe105⤵PID:4012
-
\??\c:\btbbbh.exec:\btbbbh.exe106⤵PID:1564
-
\??\c:\htbhbb.exec:\htbhbb.exe107⤵PID:440
-
\??\c:\vvjjj.exec:\vvjjj.exe108⤵PID:4476
-
\??\c:\xllxrlf.exec:\xllxrlf.exe109⤵PID:3836
-
\??\c:\lflxrxr.exec:\lflxrxr.exe110⤵PID:1900
-
\??\c:\ntbbbb.exec:\ntbbbb.exe111⤵PID:4404
-
\??\c:\ntbhbh.exec:\ntbhbh.exe112⤵PID:4060
-
\??\c:\djpjp.exec:\djpjp.exe113⤵PID:3168
-
\??\c:\ddvvv.exec:\ddvvv.exe114⤵PID:264
-
\??\c:\llxfxff.exec:\llxfxff.exe115⤵PID:1308
-
\??\c:\htnhbb.exec:\htnhbb.exe116⤵PID:4388
-
\??\c:\ttbbbb.exec:\ttbbbb.exe117⤵PID:2668
-
\??\c:\jddpp.exec:\jddpp.exe118⤵PID:2936
-
\??\c:\rffxxxr.exec:\rffxxxr.exe119⤵PID:4308
-
\??\c:\tbttnt.exec:\tbttnt.exe120⤵PID:4688
-
\??\c:\hntbtb.exec:\hntbtb.exe121⤵PID:5092
-
\??\c:\vdddj.exec:\vdddj.exe122⤵PID:2912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-