Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22-07-2024 23:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f2c51eba5ae61116938ba2fe364a15ccb5d44a1c9b8e41d01a447ad492718cd.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
General
-
Target
7f2c51eba5ae61116938ba2fe364a15ccb5d44a1c9b8e41d01a447ad492718cd.exe
-
Size
77KB
-
MD5
3485efd7a42275af204a25f917fa035a
-
SHA1
74d46bb397dd0ea0c66f761ad4f66ff647e6c819
-
SHA256
7f2c51eba5ae61116938ba2fe364a15ccb5d44a1c9b8e41d01a447ad492718cd
-
SHA512
18fe7d02d02d0fa66154c2d011569d247543e7131fc8e05db7436619375c519ef79057f248879785d2dd42fab1c23f96257d0213ce5b5d0eb370c585eafb069b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2iJvRirE0DmvK:ymb3NkkiQ3mdBjF+3TU2iBRioS9
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4860-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/680-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3868-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/848-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3164-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/716-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 680 lxrlrff.exe 3448 nhbhbt.exe 1196 dvdvv.exe 4276 dvpjv.exe 4400 9xxlfxl.exe 1396 hhbnhb.exe 2236 5tbttn.exe 212 rfrfrlx.exe 4672 nbtnth.exe 2024 thnhtn.exe 3904 vjvjd.exe 3500 rllfrlx.exe 4588 hhttnh.exe 4956 nbhbtn.exe 4372 vjddp.exe 3868 flfxlll.exe 848 bnnhht.exe 4988 5vvjj.exe 3164 rrxrrxr.exe 716 5lxrllx.exe 2336 tnbtnn.exe 1980 hbnhnh.exe 3924 ddvvv.exe 4044 bhtttt.exe 2432 dvjjj.exe 2396 flfxlll.exe 4024 bthbth.exe 3392 bttbbb.exe 4544 dvvpd.exe 652 9xrfrlf.exe 3576 ntthnb.exe 2700 1vvdp.exe 2548 vjpjv.exe 4520 frxlrff.exe 4224 xrxffrr.exe 2936 hhnhbh.exe 4316 pvdjj.exe 1688 dvjvd.exe 3568 xxxlflf.exe 696 5thbtb.exe 3520 nbhbbb.exe 2768 pvddv.exe 4688 vpjdd.exe 3976 xrxffxf.exe 1604 hhhhbh.exe 1008 9jppj.exe 3356 jjvvv.exe 2340 xlrrlrl.exe 1736 thhnhh.exe 1552 3vdvp.exe 3012 rfxrlrr.exe 2820 rxfflxr.exe 1028 vvjpp.exe 3384 lfxlfff.exe 1172 rflllll.exe 3620 hntttb.exe 4372 5vpvv.exe 4980 7pppj.exe 5080 lfffxxr.exe 368 xflrxxf.exe 2100 nnthnh.exe 3488 1pvpp.exe 1760 pvdvp.exe 4656 fxfxfxx.exe -
resource yara_rule behavioral2/memory/4860-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/680-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3868-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/848-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3164-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/716-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4860 wrote to memory of 680 4860 7f2c51eba5ae61116938ba2fe364a15ccb5d44a1c9b8e41d01a447ad492718cd.exe 84 PID 4860 wrote to memory of 680 4860 7f2c51eba5ae61116938ba2fe364a15ccb5d44a1c9b8e41d01a447ad492718cd.exe 84 PID 4860 wrote to memory of 680 4860 7f2c51eba5ae61116938ba2fe364a15ccb5d44a1c9b8e41d01a447ad492718cd.exe 84 PID 680 wrote to memory of 3448 680 lxrlrff.exe 85 PID 680 wrote to memory of 3448 680 lxrlrff.exe 85 PID 680 wrote to memory of 3448 680 lxrlrff.exe 85 PID 3448 wrote to memory of 1196 3448 nhbhbt.exe 86 PID 3448 wrote to memory of 1196 3448 nhbhbt.exe 86 PID 3448 wrote to memory of 1196 3448 nhbhbt.exe 86 PID 1196 wrote to memory of 4276 1196 dvdvv.exe 87 PID 1196 wrote to memory of 4276 1196 dvdvv.exe 87 PID 1196 wrote to memory of 4276 1196 dvdvv.exe 87 PID 4276 wrote to memory of 4400 4276 dvpjv.exe 88 PID 4276 wrote to memory of 4400 4276 dvpjv.exe 88 PID 4276 wrote to memory of 4400 4276 dvpjv.exe 88 PID 4400 wrote to memory of 1396 4400 9xxlfxl.exe 89 PID 4400 wrote to memory of 1396 4400 9xxlfxl.exe 89 PID 4400 wrote to memory of 1396 4400 9xxlfxl.exe 89 PID 1396 wrote to memory of 2236 1396 hhbnhb.exe 90 PID 1396 wrote to memory of 2236 1396 hhbnhb.exe 90 PID 1396 wrote to memory of 2236 1396 hhbnhb.exe 90 PID 2236 wrote to memory of 212 2236 5tbttn.exe 91 PID 2236 wrote to memory of 212 2236 5tbttn.exe 91 PID 2236 wrote to memory of 212 2236 5tbttn.exe 91 PID 212 wrote to memory of 4672 212 rfrfrlx.exe 92 PID 212 wrote to memory of 4672 212 rfrfrlx.exe 92 PID 212 wrote to memory of 4672 212 rfrfrlx.exe 92 PID 4672 wrote to memory of 2024 4672 nbtnth.exe 93 PID 4672 wrote to memory of 2024 4672 nbtnth.exe 93 PID 4672 wrote to memory of 2024 4672 nbtnth.exe 93 PID 2024 wrote to memory of 3904 2024 thnhtn.exe 94 PID 2024 wrote to memory of 3904 2024 thnhtn.exe 94 PID 2024 wrote to memory of 3904 2024 thnhtn.exe 94 PID 3904 wrote to memory of 3500 3904 vjvjd.exe 95 PID 3904 wrote to memory of 3500 3904 vjvjd.exe 95 PID 3904 wrote to memory of 3500 3904 vjvjd.exe 95 PID 3500 wrote to memory of 4588 3500 rllfrlx.exe 96 PID 3500 wrote to memory of 4588 3500 rllfrlx.exe 96 PID 3500 wrote to memory of 4588 3500 rllfrlx.exe 96 PID 4588 wrote to memory of 4956 4588 hhttnh.exe 97 PID 4588 wrote to memory of 4956 4588 hhttnh.exe 97 PID 4588 wrote to memory of 4956 4588 hhttnh.exe 97 PID 4956 wrote to memory of 4372 4956 nbhbtn.exe 98 PID 4956 wrote to memory of 4372 4956 nbhbtn.exe 98 PID 4956 wrote to memory of 4372 4956 nbhbtn.exe 98 PID 4372 wrote to memory of 3868 4372 vjddp.exe 99 PID 4372 wrote to memory of 3868 4372 vjddp.exe 99 PID 4372 wrote to memory of 3868 4372 vjddp.exe 99 PID 3868 wrote to memory of 848 3868 flfxlll.exe 100 PID 3868 wrote to memory of 848 3868 flfxlll.exe 100 PID 3868 wrote to memory of 848 3868 flfxlll.exe 100 PID 848 wrote to memory of 4988 848 bnnhht.exe 102 PID 848 wrote to memory of 4988 848 bnnhht.exe 102 PID 848 wrote to memory of 4988 848 bnnhht.exe 102 PID 4988 wrote to memory of 3164 4988 5vvjj.exe 103 PID 4988 wrote to memory of 3164 4988 5vvjj.exe 103 PID 4988 wrote to memory of 3164 4988 5vvjj.exe 103 PID 3164 wrote to memory of 716 3164 rrxrrxr.exe 104 PID 3164 wrote to memory of 716 3164 rrxrrxr.exe 104 PID 3164 wrote to memory of 716 3164 rrxrrxr.exe 104 PID 716 wrote to memory of 2336 716 5lxrllx.exe 105 PID 716 wrote to memory of 2336 716 5lxrllx.exe 105 PID 716 wrote to memory of 2336 716 5lxrllx.exe 105 PID 2336 wrote to memory of 1980 2336 tnbtnn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f2c51eba5ae61116938ba2fe364a15ccb5d44a1c9b8e41d01a447ad492718cd.exe"C:\Users\Admin\AppData\Local\Temp\7f2c51eba5ae61116938ba2fe364a15ccb5d44a1c9b8e41d01a447ad492718cd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\lxrlrff.exec:\lxrlrff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\nhbhbt.exec:\nhbhbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\dvdvv.exec:\dvdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\dvpjv.exec:\dvpjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\9xxlfxl.exec:\9xxlfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\hhbnhb.exec:\hhbnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\5tbttn.exec:\5tbttn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\rfrfrlx.exec:\rfrfrlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\nbtnth.exec:\nbtnth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\thnhtn.exec:\thnhtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\vjvjd.exec:\vjvjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\rllfrlx.exec:\rllfrlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\hhttnh.exec:\hhttnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\nbhbtn.exec:\nbhbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\vjddp.exec:\vjddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\flfxlll.exec:\flfxlll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\bnnhht.exec:\bnnhht.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\5vvjj.exec:\5vvjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\rrxrrxr.exec:\rrxrrxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\5lxrllx.exec:\5lxrllx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\tnbtnn.exec:\tnbtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\hbnhnh.exec:\hbnhnh.exe23⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ddvvv.exec:\ddvvv.exe24⤵
- Executes dropped EXE
PID:3924 -
\??\c:\bhtttt.exec:\bhtttt.exe25⤵
- Executes dropped EXE
PID:4044 -
\??\c:\dvjjj.exec:\dvjjj.exe26⤵
- Executes dropped EXE
PID:2432 -
\??\c:\flfxlll.exec:\flfxlll.exe27⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bthbth.exec:\bthbth.exe28⤵
- Executes dropped EXE
PID:4024 -
\??\c:\bttbbb.exec:\bttbbb.exe29⤵
- Executes dropped EXE
PID:3392 -
\??\c:\dvvpd.exec:\dvvpd.exe30⤵
- Executes dropped EXE
PID:4544 -
\??\c:\9xrfrlf.exec:\9xrfrlf.exe31⤵
- Executes dropped EXE
PID:652 -
\??\c:\ntthnb.exec:\ntthnb.exe32⤵
- Executes dropped EXE
PID:3576 -
\??\c:\1vvdp.exec:\1vvdp.exe33⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vjpjv.exec:\vjpjv.exe34⤵
- Executes dropped EXE
PID:2548 -
\??\c:\frxlrff.exec:\frxlrff.exe35⤵
- Executes dropped EXE
PID:4520 -
\??\c:\xrxffrr.exec:\xrxffrr.exe36⤵
- Executes dropped EXE
PID:4224 -
\??\c:\hhnhbh.exec:\hhnhbh.exe37⤵
- Executes dropped EXE
PID:2936 -
\??\c:\pvdjj.exec:\pvdjj.exe38⤵
- Executes dropped EXE
PID:4316 -
\??\c:\dvjvd.exec:\dvjvd.exe39⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xxxlflf.exec:\xxxlflf.exe40⤵
- Executes dropped EXE
PID:3568 -
\??\c:\5thbtb.exec:\5thbtb.exe41⤵
- Executes dropped EXE
PID:696 -
\??\c:\nbhbbb.exec:\nbhbbb.exe42⤵
- Executes dropped EXE
PID:3520 -
\??\c:\pvddv.exec:\pvddv.exe43⤵
- Executes dropped EXE
PID:2768 -
\??\c:\vpjdd.exec:\vpjdd.exe44⤵
- Executes dropped EXE
PID:4688 -
\??\c:\xrxffxf.exec:\xrxffxf.exe45⤵
- Executes dropped EXE
PID:3976 -
\??\c:\hhhhbh.exec:\hhhhbh.exe46⤵
- Executes dropped EXE
PID:1604 -
\??\c:\9jppj.exec:\9jppj.exe47⤵
- Executes dropped EXE
PID:1008 -
\??\c:\jjvvv.exec:\jjvvv.exe48⤵
- Executes dropped EXE
PID:3356 -
\??\c:\xlrrlrl.exec:\xlrrlrl.exe49⤵
- Executes dropped EXE
PID:2340 -
\??\c:\thhnhh.exec:\thhnhh.exe50⤵
- Executes dropped EXE
PID:1736 -
\??\c:\3vdvp.exec:\3vdvp.exe51⤵
- Executes dropped EXE
PID:1552 -
\??\c:\rfxrlrr.exec:\rfxrlrr.exe52⤵
- Executes dropped EXE
PID:3012 -
\??\c:\rxfflxr.exec:\rxfflxr.exe53⤵
- Executes dropped EXE
PID:2820 -
\??\c:\vvjpp.exec:\vvjpp.exe54⤵
- Executes dropped EXE
PID:1028 -
\??\c:\lfxlfff.exec:\lfxlfff.exe55⤵
- Executes dropped EXE
PID:3384 -
\??\c:\rflllll.exec:\rflllll.exe56⤵
- Executes dropped EXE
PID:1172 -
\??\c:\hntttb.exec:\hntttb.exe57⤵
- Executes dropped EXE
PID:3620 -
\??\c:\5vpvv.exec:\5vpvv.exe58⤵
- Executes dropped EXE
PID:4372 -
\??\c:\7pppj.exec:\7pppj.exe59⤵
- Executes dropped EXE
PID:4980 -
\??\c:\lfffxxr.exec:\lfffxxr.exe60⤵
- Executes dropped EXE
PID:5080 -
\??\c:\xflrxxf.exec:\xflrxxf.exe61⤵
- Executes dropped EXE
PID:368 -
\??\c:\nnthnh.exec:\nnthnh.exe62⤵
- Executes dropped EXE
PID:2100 -
\??\c:\1pvpp.exec:\1pvpp.exe63⤵
- Executes dropped EXE
PID:3488 -
\??\c:\pvdvp.exec:\pvdvp.exe64⤵
- Executes dropped EXE
PID:1760 -
\??\c:\fxfxfxx.exec:\fxfxfxx.exe65⤵
- Executes dropped EXE
PID:4656 -
\??\c:\ttbbhh.exec:\ttbbhh.exe66⤵PID:776
-
\??\c:\9bbbtn.exec:\9bbbtn.exe67⤵PID:4404
-
\??\c:\vvvpj.exec:\vvvpj.exe68⤵PID:4028
-
\??\c:\ddjjd.exec:\ddjjd.exe69⤵PID:1224
-
\??\c:\ffllxff.exec:\ffllxff.exe70⤵PID:2528
-
\??\c:\rrxffff.exec:\rrxffff.exe71⤵PID:4708
-
\??\c:\hhhnnn.exec:\hhhnnn.exe72⤵PID:544
-
\??\c:\pvddd.exec:\pvddd.exe73⤵PID:2388
-
\??\c:\tnnbhh.exec:\tnnbhh.exe74⤵PID:5056
-
\??\c:\ddpjd.exec:\ddpjd.exe75⤵PID:4340
-
\??\c:\jpppp.exec:\jpppp.exe76⤵PID:4236
-
\??\c:\ppvpp.exec:\ppvpp.exe77⤵PID:3092
-
\??\c:\fxffrrf.exec:\fxffrrf.exe78⤵PID:4544
-
\??\c:\bhbttn.exec:\bhbttn.exe79⤵PID:1384
-
\??\c:\nthbtb.exec:\nthbtb.exe80⤵PID:2252
-
\??\c:\jvdvp.exec:\jvdvp.exe81⤵PID:3084
-
\??\c:\vvddv.exec:\vvddv.exe82⤵PID:4748
-
\??\c:\rrfxrxl.exec:\rrfxrxl.exe83⤵PID:3612
-
\??\c:\rrxxlll.exec:\rrxxlll.exe84⤵PID:3184
-
\??\c:\ttbttt.exec:\ttbttt.exe85⤵PID:3228
-
\??\c:\bbntbb.exec:\bbntbb.exe86⤵PID:1920
-
\??\c:\7jvvd.exec:\7jvvd.exe87⤵PID:1232
-
\??\c:\1pvpj.exec:\1pvpj.exe88⤵PID:4536
-
\??\c:\xlffxlx.exec:\xlffxlx.exe89⤵PID:3760
-
\??\c:\bhtttt.exec:\bhtttt.exe90⤵PID:208
-
\??\c:\bnbhhh.exec:\bnbhhh.exe91⤵PID:884
-
\??\c:\vdddp.exec:\vdddp.exe92⤵PID:2132
-
\??\c:\djppj.exec:\djppj.exe93⤵PID:2568
-
\??\c:\xxllfll.exec:\xxllfll.exe94⤵PID:1852
-
\??\c:\rlllffx.exec:\rlllffx.exe95⤵PID:4940
-
\??\c:\tnnnnt.exec:\tnnnnt.exe96⤵PID:4036
-
\??\c:\hbtttt.exec:\hbtttt.exe97⤵PID:232
-
\??\c:\ddvpv.exec:\ddvpv.exe98⤵PID:3296
-
\??\c:\fflrrfl.exec:\fflrrfl.exe99⤵PID:3196
-
\??\c:\rfrxrlf.exec:\rfrxrlf.exe100⤵PID:220
-
\??\c:\hnnhth.exec:\hnnhth.exe101⤵PID:4852
-
\??\c:\nnnhhh.exec:\nnnhhh.exe102⤵PID:4952
-
\??\c:\jpddd.exec:\jpddd.exe103⤵PID:1832
-
\??\c:\dpppj.exec:\dpppj.exe104⤵PID:4480
-
\??\c:\3lrlfff.exec:\3lrlfff.exe105⤵PID:3620
-
\??\c:\xrrxxxx.exec:\xrrxxxx.exe106⤵PID:4372
-
\??\c:\nnhnnh.exec:\nnhnnh.exe107⤵PID:4768
-
\??\c:\vdjjj.exec:\vdjjj.exe108⤵PID:2176
-
\??\c:\vdpjd.exec:\vdpjd.exe109⤵PID:848
-
\??\c:\5lrlfff.exec:\5lrlfff.exe110⤵PID:4472
-
\??\c:\xfxrffx.exec:\xfxrffx.exe111⤵PID:3608
-
\??\c:\htbtnh.exec:\htbtnh.exe112⤵PID:2112
-
\??\c:\ttnnhh.exec:\ttnnhh.exe113⤵PID:4704
-
\??\c:\vvvvd.exec:\vvvvd.exe114⤵PID:2336
-
\??\c:\vpjpj.exec:\vpjpj.exe115⤵PID:4244
-
\??\c:\lxfrlfx.exec:\lxfrlfx.exe116⤵PID:3588
-
\??\c:\nnnhtn.exec:\nnnhtn.exe117⤵PID:1228
-
\??\c:\9hbnhh.exec:\9hbnhh.exe118⤵PID:2564
-
\??\c:\vdvdv.exec:\vdvdv.exe119⤵PID:2396
-
\??\c:\ppdvd.exec:\ppdvd.exe120⤵PID:3440
-
\??\c:\lfllllf.exec:\lfllllf.exe121⤵PID:5056
-
\??\c:\rrllffr.exec:\rrllffr.exe122⤵PID:4340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-