Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 23:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8acf3652893078346407037d5f726b1d66bbc8d3e214b0400948c13e8ebfb57c.exe
Resource
win7-20240708-en
5 signatures
150 seconds
General
-
Target
8acf3652893078346407037d5f726b1d66bbc8d3e214b0400948c13e8ebfb57c.exe
-
Size
57KB
-
MD5
0f59e461eeaa9d0122338045698677cc
-
SHA1
5577a6b527423bde55add3bbafc1ae41f0a87908
-
SHA256
8acf3652893078346407037d5f726b1d66bbc8d3e214b0400948c13e8ebfb57c
-
SHA512
5884162ad70c6057788baf580a4d83c5d0d7188f7e420f63d4be8c0a0cc09c45f50b69afc81f03d202e735cfc483b24215013f56c53ef7e02b492fdb97438195
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsI0Vl:ymb3NkkiQ3mdBjFIsI0/
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/4828-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/984-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4828 ppppj.exe 2644 ffllxxf.exe 3428 btbbtt.exe 1512 7tnnbh.exe 4108 pjvpv.exe 3908 lxrlxxr.exe 1976 hhnhhh.exe 4272 7dddd.exe 4980 xlxxrxr.exe 1636 5hnbbn.exe 3936 tnnhht.exe 776 5pvvv.exe 3236 lxlxrlr.exe 1608 hntbbb.exe 512 btnhhn.exe 4924 9dvpj.exe 2436 lfxrrrl.exe 3984 hbnhnn.exe 984 jddvj.exe 2816 flxxxfl.exe 2068 hhhtnh.exe 4092 dvdvp.exe 1148 dvjdp.exe 1704 fflxfrr.exe 4832 xffxxfr.exe 4756 9nnhhb.exe 3836 1jpjp.exe 4152 9fxrxff.exe 2540 lrrrfxr.exe 4064 hhthnh.exe 3368 1dpjd.exe 3756 fxxrllf.exe 4644 hhtnnh.exe 4240 5ddvp.exe 4968 dvvpv.exe 4036 1xxrlrx.exe 4552 hhbbhh.exe 4372 7ppjd.exe 3932 pjjdv.exe 3844 9ffxrlf.exe 2644 ntbtnh.exe 1248 ddddv.exe 4444 pjdvj.exe 2496 rfxrlfx.exe 2684 bbntth.exe 1520 9tttnn.exe 2720 dvppp.exe 3740 vdddd.exe 1728 rllfrlf.exe 2832 hnnbtt.exe 4396 nhbnhh.exe 540 dvjdp.exe 2988 jdvpj.exe 2316 xlrlfff.exe 2220 fxxxrrl.exe 3112 nbbbtt.exe 2416 pvddj.exe 2828 bhnhbh.exe 512 dvdvp.exe 4924 3vdvv.exe 976 5jvdj.exe 3200 lrrlfff.exe 1236 hbhnbt.exe 4728 httnhh.exe -
resource yara_rule behavioral2/memory/3960-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/984-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3960 wrote to memory of 4828 3960 8acf3652893078346407037d5f726b1d66bbc8d3e214b0400948c13e8ebfb57c.exe 86 PID 3960 wrote to memory of 4828 3960 8acf3652893078346407037d5f726b1d66bbc8d3e214b0400948c13e8ebfb57c.exe 86 PID 3960 wrote to memory of 4828 3960 8acf3652893078346407037d5f726b1d66bbc8d3e214b0400948c13e8ebfb57c.exe 86 PID 4828 wrote to memory of 2644 4828 ppppj.exe 87 PID 4828 wrote to memory of 2644 4828 ppppj.exe 87 PID 4828 wrote to memory of 2644 4828 ppppj.exe 87 PID 2644 wrote to memory of 3428 2644 ffllxxf.exe 88 PID 2644 wrote to memory of 3428 2644 ffllxxf.exe 88 PID 2644 wrote to memory of 3428 2644 ffllxxf.exe 88 PID 3428 wrote to memory of 1512 3428 btbbtt.exe 89 PID 3428 wrote to memory of 1512 3428 btbbtt.exe 89 PID 3428 wrote to memory of 1512 3428 btbbtt.exe 89 PID 1512 wrote to memory of 4108 1512 7tnnbh.exe 90 PID 1512 wrote to memory of 4108 1512 7tnnbh.exe 90 PID 1512 wrote to memory of 4108 1512 7tnnbh.exe 90 PID 4108 wrote to memory of 3908 4108 pjvpv.exe 91 PID 4108 wrote to memory of 3908 4108 pjvpv.exe 91 PID 4108 wrote to memory of 3908 4108 pjvpv.exe 91 PID 3908 wrote to memory of 1976 3908 lxrlxxr.exe 92 PID 3908 wrote to memory of 1976 3908 lxrlxxr.exe 92 PID 3908 wrote to memory of 1976 3908 lxrlxxr.exe 92 PID 1976 wrote to memory of 4272 1976 hhnhhh.exe 93 PID 1976 wrote to memory of 4272 1976 hhnhhh.exe 93 PID 1976 wrote to memory of 4272 1976 hhnhhh.exe 93 PID 4272 wrote to memory of 4980 4272 7dddd.exe 94 PID 4272 wrote to memory of 4980 4272 7dddd.exe 94 PID 4272 wrote to memory of 4980 4272 7dddd.exe 94 PID 4980 wrote to memory of 1636 4980 xlxxrxr.exe 95 PID 4980 wrote to memory of 1636 4980 xlxxrxr.exe 95 PID 4980 wrote to memory of 1636 4980 xlxxrxr.exe 95 PID 1636 wrote to memory of 3936 1636 5hnbbn.exe 96 PID 1636 wrote to memory of 3936 1636 5hnbbn.exe 96 PID 1636 wrote to memory of 3936 1636 5hnbbn.exe 96 PID 3936 wrote to memory of 776 3936 tnnhht.exe 97 PID 3936 wrote to memory of 776 3936 tnnhht.exe 97 PID 3936 wrote to memory of 776 3936 tnnhht.exe 97 PID 776 wrote to memory of 3236 776 5pvvv.exe 98 PID 776 wrote to memory of 3236 776 5pvvv.exe 98 PID 776 wrote to memory of 3236 776 5pvvv.exe 98 PID 3236 wrote to memory of 1608 3236 lxlxrlr.exe 100 PID 3236 wrote to memory of 1608 3236 lxlxrlr.exe 100 PID 3236 wrote to memory of 1608 3236 lxlxrlr.exe 100 PID 1608 wrote to memory of 512 1608 hntbbb.exe 101 PID 1608 wrote to memory of 512 1608 hntbbb.exe 101 PID 1608 wrote to memory of 512 1608 hntbbb.exe 101 PID 512 wrote to memory of 4924 512 btnhhn.exe 102 PID 512 wrote to memory of 4924 512 btnhhn.exe 102 PID 512 wrote to memory of 4924 512 btnhhn.exe 102 PID 4924 wrote to memory of 2436 4924 9dvpj.exe 103 PID 4924 wrote to memory of 2436 4924 9dvpj.exe 103 PID 4924 wrote to memory of 2436 4924 9dvpj.exe 103 PID 2436 wrote to memory of 3984 2436 lfxrrrl.exe 104 PID 2436 wrote to memory of 3984 2436 lfxrrrl.exe 104 PID 2436 wrote to memory of 3984 2436 lfxrrrl.exe 104 PID 3984 wrote to memory of 984 3984 hbnhnn.exe 105 PID 3984 wrote to memory of 984 3984 hbnhnn.exe 105 PID 3984 wrote to memory of 984 3984 hbnhnn.exe 105 PID 984 wrote to memory of 2816 984 jddvj.exe 106 PID 984 wrote to memory of 2816 984 jddvj.exe 106 PID 984 wrote to memory of 2816 984 jddvj.exe 106 PID 2816 wrote to memory of 2068 2816 flxxxfl.exe 107 PID 2816 wrote to memory of 2068 2816 flxxxfl.exe 107 PID 2816 wrote to memory of 2068 2816 flxxxfl.exe 107 PID 2068 wrote to memory of 4092 2068 hhhtnh.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\8acf3652893078346407037d5f726b1d66bbc8d3e214b0400948c13e8ebfb57c.exe"C:\Users\Admin\AppData\Local\Temp\8acf3652893078346407037d5f726b1d66bbc8d3e214b0400948c13e8ebfb57c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\ppppj.exec:\ppppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\ffllxxf.exec:\ffllxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\btbbtt.exec:\btbbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\7tnnbh.exec:\7tnnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\pjvpv.exec:\pjvpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\lxrlxxr.exec:\lxrlxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\hhnhhh.exec:\hhnhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\7dddd.exec:\7dddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\xlxxrxr.exec:\xlxxrxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\5hnbbn.exec:\5hnbbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\tnnhht.exec:\tnnhht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\5pvvv.exec:\5pvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\lxlxrlr.exec:\lxlxrlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\hntbbb.exec:\hntbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\btnhhn.exec:\btnhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\9dvpj.exec:\9dvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\lfxrrrl.exec:\lfxrrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\hbnhnn.exec:\hbnhnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\jddvj.exec:\jddvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\flxxxfl.exec:\flxxxfl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\hhhtnh.exec:\hhhtnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\dvdvp.exec:\dvdvp.exe23⤵
- Executes dropped EXE
PID:4092 -
\??\c:\dvjdp.exec:\dvjdp.exe24⤵
- Executes dropped EXE
PID:1148 -
\??\c:\fflxfrr.exec:\fflxfrr.exe25⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xffxxfr.exec:\xffxxfr.exe26⤵
- Executes dropped EXE
PID:4832 -
\??\c:\9nnhhb.exec:\9nnhhb.exe27⤵
- Executes dropped EXE
PID:4756 -
\??\c:\1jpjp.exec:\1jpjp.exe28⤵
- Executes dropped EXE
PID:3836 -
\??\c:\9fxrxff.exec:\9fxrxff.exe29⤵
- Executes dropped EXE
PID:4152 -
\??\c:\lrrrfxr.exec:\lrrrfxr.exe30⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hhthnh.exec:\hhthnh.exe31⤵
- Executes dropped EXE
PID:4064 -
\??\c:\1dpjd.exec:\1dpjd.exe32⤵
- Executes dropped EXE
PID:3368 -
\??\c:\fxxrllf.exec:\fxxrllf.exe33⤵
- Executes dropped EXE
PID:3756 -
\??\c:\hhtnnh.exec:\hhtnnh.exe34⤵
- Executes dropped EXE
PID:4644 -
\??\c:\5ddvp.exec:\5ddvp.exe35⤵
- Executes dropped EXE
PID:4240 -
\??\c:\dvvpv.exec:\dvvpv.exe36⤵
- Executes dropped EXE
PID:4968 -
\??\c:\1xxrlrx.exec:\1xxrlrx.exe37⤵
- Executes dropped EXE
PID:4036 -
\??\c:\hhbbhh.exec:\hhbbhh.exe38⤵
- Executes dropped EXE
PID:4552 -
\??\c:\7ppjd.exec:\7ppjd.exe39⤵
- Executes dropped EXE
PID:4372 -
\??\c:\pjjdv.exec:\pjjdv.exe40⤵
- Executes dropped EXE
PID:3932 -
\??\c:\9ffxrlf.exec:\9ffxrlf.exe41⤵
- Executes dropped EXE
PID:3844 -
\??\c:\ntbtnh.exec:\ntbtnh.exe42⤵
- Executes dropped EXE
PID:2644 -
\??\c:\ddddv.exec:\ddddv.exe43⤵
- Executes dropped EXE
PID:1248 -
\??\c:\pjdvj.exec:\pjdvj.exe44⤵
- Executes dropped EXE
PID:4444 -
\??\c:\rfxrlfx.exec:\rfxrlfx.exe45⤵
- Executes dropped EXE
PID:2496 -
\??\c:\bbntth.exec:\bbntth.exe46⤵
- Executes dropped EXE
PID:2684 -
\??\c:\9tttnn.exec:\9tttnn.exe47⤵
- Executes dropped EXE
PID:1520 -
\??\c:\dvppp.exec:\dvppp.exe48⤵
- Executes dropped EXE
PID:2720 -
\??\c:\vdddd.exec:\vdddd.exe49⤵
- Executes dropped EXE
PID:3740 -
\??\c:\rllfrlf.exec:\rllfrlf.exe50⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hnnbtt.exec:\hnnbtt.exe51⤵
- Executes dropped EXE
PID:2832 -
\??\c:\nhbnhh.exec:\nhbnhh.exe52⤵
- Executes dropped EXE
PID:4396 -
\??\c:\dvjdp.exec:\dvjdp.exe53⤵
- Executes dropped EXE
PID:540 -
\??\c:\jdvpj.exec:\jdvpj.exe54⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xlrlfff.exec:\xlrlfff.exe55⤵
- Executes dropped EXE
PID:2316 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe56⤵
- Executes dropped EXE
PID:2220 -
\??\c:\nbbbtt.exec:\nbbbtt.exe57⤵
- Executes dropped EXE
PID:3112 -
\??\c:\pvddj.exec:\pvddj.exe58⤵
- Executes dropped EXE
PID:2416 -
\??\c:\bhnhbh.exec:\bhnhbh.exe59⤵
- Executes dropped EXE
PID:2828 -
\??\c:\dvdvp.exec:\dvdvp.exe60⤵
- Executes dropped EXE
PID:512 -
\??\c:\3vdvv.exec:\3vdvv.exe61⤵
- Executes dropped EXE
PID:4924 -
\??\c:\5jvdj.exec:\5jvdj.exe62⤵
- Executes dropped EXE
PID:976 -
\??\c:\lrrlfff.exec:\lrrlfff.exe63⤵
- Executes dropped EXE
PID:3200 -
\??\c:\hbhnbt.exec:\hbhnbt.exe64⤵
- Executes dropped EXE
PID:1236 -
\??\c:\httnhh.exec:\httnhh.exe65⤵
- Executes dropped EXE
PID:4728 -
\??\c:\jddvj.exec:\jddvj.exe66⤵PID:4956
-
\??\c:\5ntbbh.exec:\5ntbbh.exe67⤵PID:3360
-
\??\c:\httbbh.exec:\httbbh.exe68⤵PID:1352
-
\??\c:\pjjjd.exec:\pjjjd.exe69⤵PID:3052
-
\??\c:\nbbtnh.exec:\nbbtnh.exe70⤵PID:456
-
\??\c:\hbtbtn.exec:\hbtbtn.exe71⤵PID:676
-
\??\c:\jvjdd.exec:\jvjdd.exe72⤵PID:4756
-
\??\c:\lflfllr.exec:\lflfllr.exe73⤵PID:4192
-
\??\c:\3rlfrrf.exec:\3rlfrrf.exe74⤵PID:4412
-
\??\c:\bhnntt.exec:\bhnntt.exe75⤵PID:3344
-
\??\c:\bthttn.exec:\bthttn.exe76⤵PID:2540
-
\??\c:\pddvj.exec:\pddvj.exe77⤵PID:4504
-
\??\c:\jdpvj.exec:\jdpvj.exe78⤵PID:4940
-
\??\c:\5frxxll.exec:\5frxxll.exe79⤵PID:4588
-
\??\c:\3nnhbn.exec:\3nnhbn.exe80⤵PID:2636
-
\??\c:\hbhnht.exec:\hbhnht.exe81⤵PID:4336
-
\??\c:\dppjd.exec:\dppjd.exe82⤵PID:4936
-
\??\c:\pvdvv.exec:\pvdvv.exe83⤵PID:1952
-
\??\c:\rrfxxxx.exec:\rrfxxxx.exe84⤵PID:1080
-
\??\c:\nnbbbn.exec:\nnbbbn.exe85⤵PID:3496
-
\??\c:\vpvpj.exec:\vpvpj.exe86⤵PID:4480
-
\??\c:\rrffxxl.exec:\rrffxxl.exe87⤵PID:2084
-
\??\c:\rfllfll.exec:\rfllfll.exe88⤵PID:3932
-
\??\c:\tnttnn.exec:\tnttnn.exe89⤵PID:4468
-
\??\c:\vdjpj.exec:\vdjpj.exe90⤵PID:2644
-
\??\c:\vdddd.exec:\vdddd.exe91⤵PID:972
-
\??\c:\5fllxxr.exec:\5fllxxr.exe92⤵PID:4632
-
\??\c:\1nttnn.exec:\1nttnn.exe93⤵PID:1616
-
\??\c:\thhhbb.exec:\thhhbb.exe94⤵PID:1904
-
\??\c:\pvdvv.exec:\pvdvv.exe95⤵PID:5024
-
\??\c:\pdjdv.exec:\pdjdv.exe96⤵PID:4752
-
\??\c:\xxrrffx.exec:\xxrrffx.exe97⤵PID:4272
-
\??\c:\hbhbbb.exec:\hbhbbb.exe98⤵PID:2780
-
\??\c:\nttthh.exec:\nttthh.exe99⤵PID:4232
-
\??\c:\pvvpd.exec:\pvvpd.exe100⤵PID:2168
-
\??\c:\1llfrrr.exec:\1llfrrr.exe101⤵PID:3936
-
\??\c:\flxxxxx.exec:\flxxxxx.exe102⤵PID:2956
-
\??\c:\hbhnht.exec:\hbhnht.exe103⤵PID:648
-
\??\c:\7dvvv.exec:\7dvvv.exe104⤵PID:2848
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe105⤵PID:1444
-
\??\c:\5flllll.exec:\5flllll.exe106⤵PID:2964
-
\??\c:\flllfff.exec:\flllfff.exe107⤵PID:3120
-
\??\c:\hhttbb.exec:\hhttbb.exe108⤵PID:4100
-
\??\c:\bhtttb.exec:\bhtttb.exe109⤵PID:4060
-
\??\c:\1djdv.exec:\1djdv.exe110⤵PID:536
-
\??\c:\lffxrrr.exec:\lffxrrr.exe111⤵PID:3128
-
\??\c:\hhhhnn.exec:\hhhhnn.exe112⤵PID:2928
-
\??\c:\pppjd.exec:\pppjd.exe113⤵PID:4956
-
\??\c:\1rrlffr.exec:\1rrlffr.exe114⤵PID:1344
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe115⤵PID:4540
-
\??\c:\tnnntt.exec:\tnnntt.exe116⤵PID:4452
-
\??\c:\9nttnt.exec:\9nttnt.exe117⤵PID:1984
-
\??\c:\3jjdv.exec:\3jjdv.exe118⤵PID:4932
-
\??\c:\jdddd.exec:\jdddd.exe119⤵PID:3836
-
\??\c:\xxflflf.exec:\xxflflf.exe120⤵PID:3176
-
\??\c:\7nntnh.exec:\7nntnh.exe121⤵PID:4152
-
\??\c:\hnhbtt.exec:\hnhbtt.exe122⤵PID:332
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-