Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 22:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
72e60c10220d3647422ce82d911913b4947894c017e4d4c10a66294fc41dda17.exe
Resource
win7-20240708-en
5 signatures
150 seconds
General
-
Target
72e60c10220d3647422ce82d911913b4947894c017e4d4c10a66294fc41dda17.exe
-
Size
417KB
-
MD5
a5895bb9b19158aaa414fc12c7576f5c
-
SHA1
4bbf4aba14ea02c1bf4fe04ab97c0facefcd1924
-
SHA256
72e60c10220d3647422ce82d911913b4947894c017e4d4c10a66294fc41dda17
-
SHA512
61762519aa458bf8ecc8664491d0ed2fb76c356781c8e908a03cf2dcdf225d3201d18515add4aab3e3a385f9d802d6956ea6c391c615fee58e6f039320fab374
-
SSDEEP
12288:n3C9ytvngQj4DtvnV9wLn9UTfC8eieJNBNIsYPj:SgdnJUdnV9D
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/752-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/344-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1596-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/948-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3008 vdddd.exe 4968 fxrrlff.exe 4812 lxrfrfr.exe 1872 jvvvv.exe 1612 xxrlffx.exe 4828 nhbtnb.exe 2784 rrlfrrf.exe 3476 bnbbnn.exe 344 dpvpj.exe 4984 rffxlfx.exe 640 hhnhhb.exe 1980 lrfxrrf.exe 3884 nbbnnt.exe 2812 bhbnnn.exe 1596 dvvdv.exe 528 rllxxrl.exe 4516 vvjdv.exe 2332 rxrlxrl.exe 764 1jdpj.exe 4444 9rxlffr.exe 4856 9nbttt.exe 948 xxlrfff.exe 3952 tbhbtb.exe 4824 vvddj.exe 2824 lrxxxll.exe 232 tbhhbb.exe 4648 flfxrrl.exe 3108 ttnnhn.exe 2336 xflfxxl.exe 3100 jjvpd.exe 5060 hbbhbb.exe 4740 ttbthb.exe 3276 lllrlxl.exe 4392 htnbtn.exe 3732 lxrrffx.exe 1224 5ntntt.exe 828 ddvjj.exe 2888 5thttn.exe 3472 ddvpj.exe 4884 bnnhbb.exe 1200 pdjpd.exe 4552 frfllll.exe 2804 bnhtth.exe 2128 jpppp.exe 4964 lxlflxl.exe 3192 xflffll.exe 1716 nnhbbt.exe 1392 pvvpp.exe 3476 jjvpj.exe 4180 xlfxlfx.exe 3984 tthhnt.exe 1792 5dvpd.exe 4308 djjjj.exe 3216 5llfrrl.exe 2632 ntnhnh.exe 1980 5vpvp.exe 3316 ffllffx.exe 2364 fxxlrff.exe 748 tnhnth.exe 4032 vpddv.exe 2256 vvvvj.exe 4492 xxlfrll.exe 1480 3hnbtn.exe 4264 ntbnhh.exe -
resource yara_rule behavioral2/memory/752-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/344-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1596-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/948-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 752 wrote to memory of 3008 752 72e60c10220d3647422ce82d911913b4947894c017e4d4c10a66294fc41dda17.exe 84 PID 752 wrote to memory of 3008 752 72e60c10220d3647422ce82d911913b4947894c017e4d4c10a66294fc41dda17.exe 84 PID 752 wrote to memory of 3008 752 72e60c10220d3647422ce82d911913b4947894c017e4d4c10a66294fc41dda17.exe 84 PID 3008 wrote to memory of 4968 3008 vdddd.exe 85 PID 3008 wrote to memory of 4968 3008 vdddd.exe 85 PID 3008 wrote to memory of 4968 3008 vdddd.exe 85 PID 4968 wrote to memory of 4812 4968 fxrrlff.exe 86 PID 4968 wrote to memory of 4812 4968 fxrrlff.exe 86 PID 4968 wrote to memory of 4812 4968 fxrrlff.exe 86 PID 4812 wrote to memory of 1872 4812 lxrfrfr.exe 87 PID 4812 wrote to memory of 1872 4812 lxrfrfr.exe 87 PID 4812 wrote to memory of 1872 4812 lxrfrfr.exe 87 PID 1872 wrote to memory of 1612 1872 jvvvv.exe 88 PID 1872 wrote to memory of 1612 1872 jvvvv.exe 88 PID 1872 wrote to memory of 1612 1872 jvvvv.exe 88 PID 1612 wrote to memory of 4828 1612 xxrlffx.exe 89 PID 1612 wrote to memory of 4828 1612 xxrlffx.exe 89 PID 1612 wrote to memory of 4828 1612 xxrlffx.exe 89 PID 4828 wrote to memory of 2784 4828 nhbtnb.exe 90 PID 4828 wrote to memory of 2784 4828 nhbtnb.exe 90 PID 4828 wrote to memory of 2784 4828 nhbtnb.exe 90 PID 2784 wrote to memory of 3476 2784 rrlfrrf.exe 91 PID 2784 wrote to memory of 3476 2784 rrlfrrf.exe 91 PID 2784 wrote to memory of 3476 2784 rrlfrrf.exe 91 PID 3476 wrote to memory of 344 3476 bnbbnn.exe 92 PID 3476 wrote to memory of 344 3476 bnbbnn.exe 92 PID 3476 wrote to memory of 344 3476 bnbbnn.exe 92 PID 344 wrote to memory of 4984 344 dpvpj.exe 94 PID 344 wrote to memory of 4984 344 dpvpj.exe 94 PID 344 wrote to memory of 4984 344 dpvpj.exe 94 PID 4984 wrote to memory of 640 4984 rffxlfx.exe 95 PID 4984 wrote to memory of 640 4984 rffxlfx.exe 95 PID 4984 wrote to memory of 640 4984 rffxlfx.exe 95 PID 640 wrote to memory of 1980 640 hhnhhb.exe 96 PID 640 wrote to memory of 1980 640 hhnhhb.exe 96 PID 640 wrote to memory of 1980 640 hhnhhb.exe 96 PID 1980 wrote to memory of 3884 1980 lrfxrrf.exe 97 PID 1980 wrote to memory of 3884 1980 lrfxrrf.exe 97 PID 1980 wrote to memory of 3884 1980 lrfxrrf.exe 97 PID 3884 wrote to memory of 2812 3884 nbbnnt.exe 98 PID 3884 wrote to memory of 2812 3884 nbbnnt.exe 98 PID 3884 wrote to memory of 2812 3884 nbbnnt.exe 98 PID 2812 wrote to memory of 1596 2812 bhbnnn.exe 99 PID 2812 wrote to memory of 1596 2812 bhbnnn.exe 99 PID 2812 wrote to memory of 1596 2812 bhbnnn.exe 99 PID 1596 wrote to memory of 528 1596 dvvdv.exe 100 PID 1596 wrote to memory of 528 1596 dvvdv.exe 100 PID 1596 wrote to memory of 528 1596 dvvdv.exe 100 PID 528 wrote to memory of 4516 528 rllxxrl.exe 101 PID 528 wrote to memory of 4516 528 rllxxrl.exe 101 PID 528 wrote to memory of 4516 528 rllxxrl.exe 101 PID 4516 wrote to memory of 2332 4516 vvjdv.exe 102 PID 4516 wrote to memory of 2332 4516 vvjdv.exe 102 PID 4516 wrote to memory of 2332 4516 vvjdv.exe 102 PID 2332 wrote to memory of 764 2332 rxrlxrl.exe 103 PID 2332 wrote to memory of 764 2332 rxrlxrl.exe 103 PID 2332 wrote to memory of 764 2332 rxrlxrl.exe 103 PID 764 wrote to memory of 4444 764 1jdpj.exe 104 PID 764 wrote to memory of 4444 764 1jdpj.exe 104 PID 764 wrote to memory of 4444 764 1jdpj.exe 104 PID 4444 wrote to memory of 4856 4444 9rxlffr.exe 105 PID 4444 wrote to memory of 4856 4444 9rxlffr.exe 105 PID 4444 wrote to memory of 4856 4444 9rxlffr.exe 105 PID 4856 wrote to memory of 948 4856 9nbttt.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\72e60c10220d3647422ce82d911913b4947894c017e4d4c10a66294fc41dda17.exe"C:\Users\Admin\AppData\Local\Temp\72e60c10220d3647422ce82d911913b4947894c017e4d4c10a66294fc41dda17.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\vdddd.exec:\vdddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\fxrrlff.exec:\fxrrlff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\lxrfrfr.exec:\lxrfrfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\jvvvv.exec:\jvvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\xxrlffx.exec:\xxrlffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\nhbtnb.exec:\nhbtnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\rrlfrrf.exec:\rrlfrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\bnbbnn.exec:\bnbbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\dpvpj.exec:\dpvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\rffxlfx.exec:\rffxlfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\hhnhhb.exec:\hhnhhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\lrfxrrf.exec:\lrfxrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\nbbnnt.exec:\nbbnnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\bhbnnn.exec:\bhbnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\dvvdv.exec:\dvvdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\rllxxrl.exec:\rllxxrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\vvjdv.exec:\vvjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\rxrlxrl.exec:\rxrlxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\1jdpj.exec:\1jdpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\9rxlffr.exec:\9rxlffr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\9nbttt.exec:\9nbttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\xxlrfff.exec:\xxlrfff.exe23⤵
- Executes dropped EXE
PID:948 -
\??\c:\tbhbtb.exec:\tbhbtb.exe24⤵
- Executes dropped EXE
PID:3952 -
\??\c:\vvddj.exec:\vvddj.exe25⤵
- Executes dropped EXE
PID:4824 -
\??\c:\lrxxxll.exec:\lrxxxll.exe26⤵
- Executes dropped EXE
PID:2824 -
\??\c:\tbhhbb.exec:\tbhhbb.exe27⤵
- Executes dropped EXE
PID:232 -
\??\c:\flfxrrl.exec:\flfxrrl.exe28⤵
- Executes dropped EXE
PID:4648 -
\??\c:\ttnnhn.exec:\ttnnhn.exe29⤵
- Executes dropped EXE
PID:3108 -
\??\c:\xflfxxl.exec:\xflfxxl.exe30⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jjvpd.exec:\jjvpd.exe31⤵
- Executes dropped EXE
PID:3100 -
\??\c:\hbbhbb.exec:\hbbhbb.exe32⤵
- Executes dropped EXE
PID:5060 -
\??\c:\ttbthb.exec:\ttbthb.exe33⤵
- Executes dropped EXE
PID:4740 -
\??\c:\lllrlxl.exec:\lllrlxl.exe34⤵
- Executes dropped EXE
PID:3276 -
\??\c:\htnbtn.exec:\htnbtn.exe35⤵
- Executes dropped EXE
PID:4392 -
\??\c:\lxrrffx.exec:\lxrrffx.exe36⤵
- Executes dropped EXE
PID:3732 -
\??\c:\5ntntt.exec:\5ntntt.exe37⤵
- Executes dropped EXE
PID:1224 -
\??\c:\ddvjj.exec:\ddvjj.exe38⤵
- Executes dropped EXE
PID:828 -
\??\c:\5thttn.exec:\5thttn.exe39⤵
- Executes dropped EXE
PID:2888 -
\??\c:\ddvpj.exec:\ddvpj.exe40⤵
- Executes dropped EXE
PID:3472 -
\??\c:\bnnhbb.exec:\bnnhbb.exe41⤵
- Executes dropped EXE
PID:4884 -
\??\c:\pdjpd.exec:\pdjpd.exe42⤵
- Executes dropped EXE
PID:1200 -
\??\c:\frfllll.exec:\frfllll.exe43⤵
- Executes dropped EXE
PID:4552 -
\??\c:\bnhtth.exec:\bnhtth.exe44⤵
- Executes dropped EXE
PID:2804 -
\??\c:\jpppp.exec:\jpppp.exe45⤵
- Executes dropped EXE
PID:2128 -
\??\c:\lxlflxl.exec:\lxlflxl.exe46⤵
- Executes dropped EXE
PID:4964 -
\??\c:\xflffll.exec:\xflffll.exe47⤵
- Executes dropped EXE
PID:3192 -
\??\c:\nnhbbt.exec:\nnhbbt.exe48⤵
- Executes dropped EXE
PID:1716 -
\??\c:\pvvpp.exec:\pvvpp.exe49⤵
- Executes dropped EXE
PID:1392 -
\??\c:\jjvpj.exec:\jjvpj.exe50⤵
- Executes dropped EXE
PID:3476 -
\??\c:\xlfxlfx.exec:\xlfxlfx.exe51⤵
- Executes dropped EXE
PID:4180 -
\??\c:\tthhnt.exec:\tthhnt.exe52⤵
- Executes dropped EXE
PID:3984 -
\??\c:\5dvpd.exec:\5dvpd.exe53⤵
- Executes dropped EXE
PID:1792 -
\??\c:\djjjj.exec:\djjjj.exe54⤵
- Executes dropped EXE
PID:4308 -
\??\c:\5llfrrl.exec:\5llfrrl.exe55⤵
- Executes dropped EXE
PID:3216 -
\??\c:\ntnhnh.exec:\ntnhnh.exe56⤵
- Executes dropped EXE
PID:2632 -
\??\c:\5vpvp.exec:\5vpvp.exe57⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ffllffx.exec:\ffllffx.exe58⤵
- Executes dropped EXE
PID:3316 -
\??\c:\fxxlrff.exec:\fxxlrff.exe59⤵
- Executes dropped EXE
PID:2364 -
\??\c:\tnhnth.exec:\tnhnth.exe60⤵
- Executes dropped EXE
PID:748 -
\??\c:\vpddv.exec:\vpddv.exe61⤵
- Executes dropped EXE
PID:4032 -
\??\c:\vvvvj.exec:\vvvvj.exe62⤵
- Executes dropped EXE
PID:2256 -
\??\c:\xxlfrll.exec:\xxlfrll.exe63⤵
- Executes dropped EXE
PID:4492 -
\??\c:\3hnbtn.exec:\3hnbtn.exe64⤵
- Executes dropped EXE
PID:1480 -
\??\c:\ntbnhh.exec:\ntbnhh.exe65⤵
- Executes dropped EXE
PID:4264 -
\??\c:\jjvpj.exec:\jjvpj.exe66⤵PID:2320
-
\??\c:\fflfxrf.exec:\fflfxrf.exe67⤵PID:4200
-
\??\c:\ffxxlrf.exec:\ffxxlrf.exe68⤵PID:2488
-
\??\c:\7nhbtn.exec:\7nhbtn.exe69⤵PID:4796
-
\??\c:\pjjdj.exec:\pjjdj.exe70⤵PID:3952
-
\??\c:\lffxxrr.exec:\lffxxrr.exe71⤵PID:3936
-
\??\c:\7hnnhh.exec:\7hnnhh.exe72⤵PID:4396
-
\??\c:\hbthnn.exec:\hbthnn.exe73⤵PID:2404
-
\??\c:\7vpdj.exec:\7vpdj.exe74⤵PID:4948
-
\??\c:\lffxxxr.exec:\lffxxxr.exe75⤵PID:3844
-
\??\c:\xfxllxx.exec:\xfxllxx.exe76⤵PID:5024
-
\??\c:\hbnnnn.exec:\hbnnnn.exe77⤵PID:3416
-
\??\c:\jdppp.exec:\jdppp.exe78⤵PID:1264
-
\??\c:\xffxrxr.exec:\xffxrxr.exe79⤵PID:1420
-
\??\c:\hntnbb.exec:\hntnbb.exe80⤵PID:3996
-
\??\c:\frfffxf.exec:\frfffxf.exe81⤵PID:3496
-
\??\c:\fxlfxlr.exec:\fxlfxlr.exe82⤵PID:3188
-
\??\c:\tnbhtb.exec:\tnbhtb.exe83⤵PID:4472
-
\??\c:\ppdvj.exec:\ppdvj.exe84⤵PID:4208
-
\??\c:\ddvdv.exec:\ddvdv.exe85⤵PID:3056
-
\??\c:\ffrlxrx.exec:\ffrlxrx.exe86⤵PID:1204
-
\??\c:\bhbhhb.exec:\bhbhhb.exe87⤵PID:4456
-
\??\c:\7hhbbb.exec:\7hhbbb.exe88⤵PID:3836
-
\??\c:\vjpjd.exec:\vjpjd.exe89⤵PID:2888
-
\??\c:\1lxlxrf.exec:\1lxlxrf.exe90⤵PID:4904
-
\??\c:\nhbttt.exec:\nhbttt.exe91⤵PID:1872
-
\??\c:\btbnbt.exec:\btbnbt.exe92⤵PID:2992
-
\??\c:\pvvpp.exec:\pvvpp.exe93⤵PID:2804
-
\??\c:\lffrrrf.exec:\lffrrrf.exe94⤵PID:2628
-
\??\c:\lfrlffx.exec:\lfrlffx.exe95⤵PID:2976
-
\??\c:\nnthbt.exec:\nnthbt.exe96⤵PID:1460
-
\??\c:\5jpjv.exec:\5jpjv.exe97⤵PID:3692
-
\??\c:\dvdvv.exec:\dvdvv.exe98⤵PID:4108
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe99⤵PID:4308
-
\??\c:\9bbtnn.exec:\9bbtnn.exe100⤵PID:844
-
\??\c:\djdvj.exec:\djdvj.exe101⤵PID:3644
-
\??\c:\vvpjv.exec:\vvpjv.exe102⤵PID:2312
-
\??\c:\1xfxffl.exec:\1xfxffl.exe103⤵PID:2964
-
\??\c:\tbhthb.exec:\tbhthb.exe104⤵PID:3740
-
\??\c:\pjjpp.exec:\pjjpp.exe105⤵PID:2348
-
\??\c:\ffffxrf.exec:\ffffxrf.exe106⤵PID:3720
-
\??\c:\bthbtt.exec:\bthbtt.exe107⤵PID:2332
-
\??\c:\btthbh.exec:\btthbh.exe108⤵PID:764
-
\??\c:\jvdpp.exec:\jvdpp.exe109⤵PID:2120
-
\??\c:\xffxxxr.exec:\xffxxxr.exe110⤵PID:4896
-
\??\c:\tbhtnh.exec:\tbhtnh.exe111⤵PID:1400
-
\??\c:\vdjdv.exec:\vdjdv.exe112⤵PID:2592
-
\??\c:\pdjjv.exec:\pdjjv.exe113⤵PID:2732
-
\??\c:\rfrlffr.exec:\rfrlffr.exe114⤵PID:3448
-
\??\c:\nbtnhh.exec:\nbtnhh.exe115⤵PID:452
-
\??\c:\jddvv.exec:\jddvv.exe116⤵PID:2896
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe117⤵PID:232
-
\??\c:\lflxxrr.exec:\lflxxrr.exe118⤵PID:1924
-
\??\c:\nttnbb.exec:\nttnbb.exe119⤵PID:1456
-
\??\c:\djpvd.exec:\djpvd.exe120⤵PID:5000
-
\??\c:\5xlxrlf.exec:\5xlxrlf.exe121⤵PID:3664
-
\??\c:\nbhhhh.exec:\nbhhhh.exe122⤵PID:3580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-