Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23-07-2024 05:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
71072d8f8f07db6cb7c9d200b0f0fdb6ad6ef0dc957320c8d0c492c0eca5eecc.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
General
-
Target
71072d8f8f07db6cb7c9d200b0f0fdb6ad6ef0dc957320c8d0c492c0eca5eecc.exe
-
Size
364KB
-
MD5
6fd395a34161f3224bf2f4d70f42dff0
-
SHA1
b6bdbdf3f4986ab9b44d8538821635a9e5505936
-
SHA256
71072d8f8f07db6cb7c9d200b0f0fdb6ad6ef0dc957320c8d0c492c0eca5eecc
-
SHA512
fc529ac8f24a55c772fecb17ce7529fdb601de778faabfb9220c17ca9ced6e4e242c41a41080a3c7efc04e6cc5caa82a488b943215c5a00f56cab12f4c3c3e43
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjD8296gnzeZhBuB:n3C9ytvngQj429nnzeZhBk
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/3992-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1252-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/984-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4556 1pppj.exe 3224 lxllfrr.exe 2324 1htntt.exe 3656 rfxlxlr.exe 4968 nhnhbt.exe 4272 vjdjj.exe 3520 fllfffl.exe 2992 jjvdp.exe 1252 htntbt.exe 5052 dddvp.exe 408 rxlxxrr.exe 3600 bbtnbt.exe 3740 flffffx.exe 2300 hnbthb.exe 4760 djjjj.exe 4924 lxrlfxr.exe 4592 7hhbtt.exe 3516 rrllfff.exe 984 djppp.exe 3368 lrffxxr.exe 2864 vvvvp.exe 4168 ffllfff.exe 3744 hthhhh.exe 3768 jjdvv.exe 628 btbnhb.exe 1676 vpppp.exe 2336 rlrrlrr.exe 4396 ddjdd.exe 4740 rffxxff.exe 4056 1lrrffx.exe 960 hnhhbh.exe 4548 nbhbbt.exe 1188 ddjdj.exe 4896 frxxrxx.exe 2292 5hhhhn.exe 4440 jvppv.exe 864 xlrrrxx.exe 3920 bbhhhh.exe 3644 dpvvv.exe 2816 5rrfxrf.exe 4352 nththb.exe 468 tnnnnt.exe 2044 9rrfrlx.exe 1876 rrrxlfr.exe 5116 ntthth.exe 4032 xxxrlfl.exe 4516 nnhhbh.exe 4608 3thhnt.exe 3300 vjjjj.exe 5040 lxxrrxx.exe 1192 9nnnhh.exe 1072 pvjdv.exe 4748 1vvpj.exe 4776 fxfrlrr.exe 4224 nhbhbn.exe 4924 pvddv.exe 5032 vdjdv.exe 3516 xlllrlx.exe 4920 bnnnnn.exe 2788 bthhhn.exe 3368 vvddd.exe 2864 dvjjp.exe 4620 3rfrrrl.exe 4904 tbbbtb.exe -
resource yara_rule behavioral2/memory/3992-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1252-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/984-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3992 wrote to memory of 4556 3992 71072d8f8f07db6cb7c9d200b0f0fdb6ad6ef0dc957320c8d0c492c0eca5eecc.exe 86 PID 3992 wrote to memory of 4556 3992 71072d8f8f07db6cb7c9d200b0f0fdb6ad6ef0dc957320c8d0c492c0eca5eecc.exe 86 PID 3992 wrote to memory of 4556 3992 71072d8f8f07db6cb7c9d200b0f0fdb6ad6ef0dc957320c8d0c492c0eca5eecc.exe 86 PID 4556 wrote to memory of 3224 4556 1pppj.exe 87 PID 4556 wrote to memory of 3224 4556 1pppj.exe 87 PID 4556 wrote to memory of 3224 4556 1pppj.exe 87 PID 3224 wrote to memory of 2324 3224 lxllfrr.exe 88 PID 3224 wrote to memory of 2324 3224 lxllfrr.exe 88 PID 3224 wrote to memory of 2324 3224 lxllfrr.exe 88 PID 2324 wrote to memory of 3656 2324 1htntt.exe 89 PID 2324 wrote to memory of 3656 2324 1htntt.exe 89 PID 2324 wrote to memory of 3656 2324 1htntt.exe 89 PID 3656 wrote to memory of 4968 3656 rfxlxlr.exe 90 PID 3656 wrote to memory of 4968 3656 rfxlxlr.exe 90 PID 3656 wrote to memory of 4968 3656 rfxlxlr.exe 90 PID 4968 wrote to memory of 4272 4968 nhnhbt.exe 91 PID 4968 wrote to memory of 4272 4968 nhnhbt.exe 91 PID 4968 wrote to memory of 4272 4968 nhnhbt.exe 91 PID 4272 wrote to memory of 3520 4272 vjdjj.exe 92 PID 4272 wrote to memory of 3520 4272 vjdjj.exe 92 PID 4272 wrote to memory of 3520 4272 vjdjj.exe 92 PID 3520 wrote to memory of 2992 3520 fllfffl.exe 93 PID 3520 wrote to memory of 2992 3520 fllfffl.exe 93 PID 3520 wrote to memory of 2992 3520 fllfffl.exe 93 PID 2992 wrote to memory of 1252 2992 jjvdp.exe 94 PID 2992 wrote to memory of 1252 2992 jjvdp.exe 94 PID 2992 wrote to memory of 1252 2992 jjvdp.exe 94 PID 1252 wrote to memory of 5052 1252 htntbt.exe 178 PID 1252 wrote to memory of 5052 1252 htntbt.exe 178 PID 1252 wrote to memory of 5052 1252 htntbt.exe 178 PID 5052 wrote to memory of 408 5052 dddvp.exe 96 PID 5052 wrote to memory of 408 5052 dddvp.exe 96 PID 5052 wrote to memory of 408 5052 dddvp.exe 96 PID 408 wrote to memory of 3600 408 rxlxxrr.exe 260 PID 408 wrote to memory of 3600 408 rxlxxrr.exe 260 PID 408 wrote to memory of 3600 408 rxlxxrr.exe 260 PID 3600 wrote to memory of 3740 3600 bbtnbt.exe 100 PID 3600 wrote to memory of 3740 3600 bbtnbt.exe 100 PID 3600 wrote to memory of 3740 3600 bbtnbt.exe 100 PID 3740 wrote to memory of 2300 3740 flffffx.exe 101 PID 3740 wrote to memory of 2300 3740 flffffx.exe 101 PID 3740 wrote to memory of 2300 3740 flffffx.exe 101 PID 2300 wrote to memory of 4760 2300 hnbthb.exe 103 PID 2300 wrote to memory of 4760 2300 hnbthb.exe 103 PID 2300 wrote to memory of 4760 2300 hnbthb.exe 103 PID 4760 wrote to memory of 4924 4760 djjjj.exe 266 PID 4760 wrote to memory of 4924 4760 djjjj.exe 266 PID 4760 wrote to memory of 4924 4760 djjjj.exe 266 PID 4924 wrote to memory of 4592 4924 lxrlfxr.exe 105 PID 4924 wrote to memory of 4592 4924 lxrlfxr.exe 105 PID 4924 wrote to memory of 4592 4924 lxrlfxr.exe 105 PID 4592 wrote to memory of 3516 4592 7hhbtt.exe 146 PID 4592 wrote to memory of 3516 4592 7hhbtt.exe 146 PID 4592 wrote to memory of 3516 4592 7hhbtt.exe 146 PID 3516 wrote to memory of 984 3516 rrllfff.exe 107 PID 3516 wrote to memory of 984 3516 rrllfff.exe 107 PID 3516 wrote to memory of 984 3516 rrllfff.exe 107 PID 984 wrote to memory of 3368 984 djppp.exe 149 PID 984 wrote to memory of 3368 984 djppp.exe 149 PID 984 wrote to memory of 3368 984 djppp.exe 149 PID 3368 wrote to memory of 2864 3368 lrffxxr.exe 311 PID 3368 wrote to memory of 2864 3368 lrffxxr.exe 311 PID 3368 wrote to memory of 2864 3368 lrffxxr.exe 311 PID 2864 wrote to memory of 4168 2864 vvvvp.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\71072d8f8f07db6cb7c9d200b0f0fdb6ad6ef0dc957320c8d0c492c0eca5eecc.exe"C:\Users\Admin\AppData\Local\Temp\71072d8f8f07db6cb7c9d200b0f0fdb6ad6ef0dc957320c8d0c492c0eca5eecc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\1pppj.exec:\1pppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\lxllfrr.exec:\lxllfrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\1htntt.exec:\1htntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\rfxlxlr.exec:\rfxlxlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\nhnhbt.exec:\nhnhbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\vjdjj.exec:\vjdjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\fllfffl.exec:\fllfffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\jjvdp.exec:\jjvdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\htntbt.exec:\htntbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\dddvp.exec:\dddvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\rxlxxrr.exec:\rxlxxrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\bbtnbt.exec:\bbtnbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\flffffx.exec:\flffffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\hnbthb.exec:\hnbthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\djjjj.exec:\djjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\7hhbtt.exec:\7hhbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\rrllfff.exec:\rrllfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\djppp.exec:\djppp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\lrffxxr.exec:\lrffxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\vvvvp.exec:\vvvvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\ffllfff.exec:\ffllfff.exe23⤵
- Executes dropped EXE
PID:4168 -
\??\c:\hthhhh.exec:\hthhhh.exe24⤵
- Executes dropped EXE
PID:3744 -
\??\c:\jjdvv.exec:\jjdvv.exe25⤵
- Executes dropped EXE
PID:3768 -
\??\c:\btbnhb.exec:\btbnhb.exe26⤵
- Executes dropped EXE
PID:628 -
\??\c:\vpppp.exec:\vpppp.exe27⤵
- Executes dropped EXE
PID:1676 -
\??\c:\rlrrlrr.exec:\rlrrlrr.exe28⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ddjdd.exec:\ddjdd.exe29⤵
- Executes dropped EXE
PID:4396 -
\??\c:\rffxxff.exec:\rffxxff.exe30⤵
- Executes dropped EXE
PID:4740 -
\??\c:\1lrrffx.exec:\1lrrffx.exe31⤵
- Executes dropped EXE
PID:4056 -
\??\c:\hnhhbh.exec:\hnhhbh.exe32⤵
- Executes dropped EXE
PID:960 -
\??\c:\nbhbbt.exec:\nbhbbt.exe33⤵
- Executes dropped EXE
PID:4548 -
\??\c:\ddjdj.exec:\ddjdj.exe34⤵
- Executes dropped EXE
PID:1188 -
\??\c:\frxxrxx.exec:\frxxrxx.exe35⤵
- Executes dropped EXE
PID:4896 -
\??\c:\5hhhhn.exec:\5hhhhn.exe36⤵
- Executes dropped EXE
PID:2292 -
\??\c:\jvppv.exec:\jvppv.exe37⤵
- Executes dropped EXE
PID:4440 -
\??\c:\xlrrrxx.exec:\xlrrrxx.exe38⤵
- Executes dropped EXE
PID:864 -
\??\c:\bbhhhh.exec:\bbhhhh.exe39⤵
- Executes dropped EXE
PID:3920 -
\??\c:\dpvvv.exec:\dpvvv.exe40⤵
- Executes dropped EXE
PID:3644 -
\??\c:\5rrfxrf.exec:\5rrfxrf.exe41⤵
- Executes dropped EXE
PID:2816 -
\??\c:\nththb.exec:\nththb.exe42⤵
- Executes dropped EXE
PID:4352 -
\??\c:\tnnnnt.exec:\tnnnnt.exe43⤵
- Executes dropped EXE
PID:468 -
\??\c:\9rrfrlx.exec:\9rrfrlx.exe44⤵
- Executes dropped EXE
PID:2044 -
\??\c:\rrrxlfr.exec:\rrrxlfr.exe45⤵
- Executes dropped EXE
PID:1876 -
\??\c:\ntthth.exec:\ntthth.exe46⤵
- Executes dropped EXE
PID:5116 -
\??\c:\xxxrlfl.exec:\xxxrlfl.exe47⤵
- Executes dropped EXE
PID:4032 -
\??\c:\nnhhbh.exec:\nnhhbh.exe48⤵
- Executes dropped EXE
PID:4516 -
\??\c:\3thhnt.exec:\3thhnt.exe49⤵
- Executes dropped EXE
PID:4608 -
\??\c:\vjjjj.exec:\vjjjj.exe50⤵
- Executes dropped EXE
PID:3300 -
\??\c:\lxxrrxx.exec:\lxxrrxx.exe51⤵
- Executes dropped EXE
PID:5040 -
\??\c:\9nnnhh.exec:\9nnnhh.exe52⤵
- Executes dropped EXE
PID:1192 -
\??\c:\pvjdv.exec:\pvjdv.exe53⤵
- Executes dropped EXE
PID:1072 -
\??\c:\1vvpj.exec:\1vvpj.exe54⤵
- Executes dropped EXE
PID:4748 -
\??\c:\fxfrlrr.exec:\fxfrlrr.exe55⤵
- Executes dropped EXE
PID:4776 -
\??\c:\nhbhbn.exec:\nhbhbn.exe56⤵
- Executes dropped EXE
PID:4224 -
\??\c:\pvddv.exec:\pvddv.exe57⤵
- Executes dropped EXE
PID:4924 -
\??\c:\vdjdv.exec:\vdjdv.exe58⤵
- Executes dropped EXE
PID:5032 -
\??\c:\xlllrlx.exec:\xlllrlx.exe59⤵
- Executes dropped EXE
PID:3516 -
\??\c:\bnnnnn.exec:\bnnnnn.exe60⤵
- Executes dropped EXE
PID:4920 -
\??\c:\bthhhn.exec:\bthhhn.exe61⤵
- Executes dropped EXE
PID:2788 -
\??\c:\vvddd.exec:\vvddd.exe62⤵
- Executes dropped EXE
PID:3368 -
\??\c:\dvjjp.exec:\dvjjp.exe63⤵
- Executes dropped EXE
PID:2864 -
\??\c:\3rfrrrl.exec:\3rfrrrl.exe64⤵
- Executes dropped EXE
PID:4620 -
\??\c:\tbbbtb.exec:\tbbbtb.exe65⤵
- Executes dropped EXE
PID:4904 -
\??\c:\ttbbtb.exec:\ttbbtb.exe66⤵PID:3536
-
\??\c:\vpjjj.exec:\vpjjj.exe67⤵PID:2068
-
\??\c:\jpvjd.exec:\jpvjd.exe68⤵PID:3680
-
\??\c:\rrxxrxx.exec:\rrxxrxx.exe69⤵PID:4364
-
\??\c:\1tthbt.exec:\1tthbt.exe70⤵PID:4876
-
\??\c:\bnhhht.exec:\bnhhht.exe71⤵PID:4740
-
\??\c:\vdppd.exec:\vdppd.exe72⤵PID:2716
-
\??\c:\9xxxxff.exec:\9xxxxff.exe73⤵PID:1956
-
\??\c:\7xrrrrr.exec:\7xrrrrr.exe74⤵PID:1536
-
\??\c:\bbnnth.exec:\bbnnth.exe75⤵PID:5096
-
\??\c:\dvddd.exec:\dvddd.exe76⤵PID:1864
-
\??\c:\djdvp.exec:\djdvp.exe77⤵PID:2176
-
\??\c:\thbhbn.exec:\thbhbn.exe78⤵PID:4896
-
\??\c:\ppvpp.exec:\ppvpp.exe79⤵PID:1424
-
\??\c:\fflxrrl.exec:\fflxrrl.exe80⤵PID:380
-
\??\c:\frrlrrx.exec:\frrlrrx.exe81⤵PID:4012
-
\??\c:\hhtttb.exec:\hhtttb.exe82⤵PID:3920
-
\??\c:\jpjjp.exec:\jpjjp.exe83⤵PID:4972
-
\??\c:\jpvpp.exec:\jpvpp.exe84⤵PID:3496
-
\??\c:\rlxrxxl.exec:\rlxrxxl.exe85⤵PID:2004
-
\??\c:\btntnb.exec:\btntnb.exe86⤵PID:468
-
\??\c:\vdpjv.exec:\vdpjv.exe87⤵PID:100
-
\??\c:\pvpjd.exec:\pvpjd.exe88⤵PID:1876
-
\??\c:\lrfxrfx.exec:\lrfxrfx.exe89⤵PID:5052
-
\??\c:\bbnhbt.exec:\bbnhbt.exe90⤵PID:5060
-
\??\c:\jdvpd.exec:\jdvpd.exe91⤵PID:4892
-
\??\c:\pjjjd.exec:\pjjjd.exe92⤵PID:3684
-
\??\c:\lxllxlf.exec:\lxllxlf.exe93⤵PID:3300
-
\??\c:\1bnnhh.exec:\1bnnhh.exe94⤵PID:4204
-
\??\c:\hbhbbb.exec:\hbhbbb.exe95⤵PID:4884
-
\??\c:\ddjvv.exec:\ddjvv.exe96⤵PID:2752
-
\??\c:\xllrlrr.exec:\xllrlrr.exe97⤵PID:860
-
\??\c:\lxrllxf.exec:\lxrllxf.exe98⤵PID:640
-
\??\c:\thnnnt.exec:\thnnnt.exe99⤵PID:4276
-
\??\c:\jpjdp.exec:\jpjdp.exe100⤵PID:4804
-
\??\c:\xxrrrxx.exec:\xxrrrxx.exe101⤵PID:3096
-
\??\c:\1xfflll.exec:\1xfflll.exe102⤵PID:2040
-
\??\c:\nbhhnn.exec:\nbhhnn.exe103⤵PID:3736
-
\??\c:\vjdvp.exec:\vjdvp.exe104⤵PID:1592
-
\??\c:\lxrlfxr.exec:\lxrlfxr.exe105⤵PID:4664
-
\??\c:\rllllll.exec:\rllllll.exe106⤵PID:2068
-
\??\c:\bnbbbt.exec:\bnbbbt.exe107⤵PID:2420
-
\??\c:\7vdvv.exec:\7vdvv.exe108⤵PID:3672
-
\??\c:\lfrllrr.exec:\lfrllrr.exe109⤵PID:3136
-
\??\c:\xfxxffr.exec:\xfxxffr.exe110⤵PID:688
-
\??\c:\tbnnhn.exec:\tbnnhn.exe111⤵PID:4292
-
\??\c:\djppj.exec:\djppj.exe112⤵PID:1536
-
\??\c:\jjppp.exec:\jjppp.exe113⤵PID:5096
-
\??\c:\nthnhn.exec:\nthnhn.exe114⤵PID:4256
-
\??\c:\7vjdd.exec:\7vjdd.exe115⤵PID:4076
-
\??\c:\ffffxfl.exec:\ffffxfl.exe116⤵PID:4440
-
\??\c:\xxrxfxx.exec:\xxrxfxx.exe117⤵PID:1424
-
\??\c:\ththnb.exec:\ththnb.exe118⤵PID:4996
-
\??\c:\dvvpj.exec:\dvvpj.exe119⤵PID:3644
-
\??\c:\vjvdv.exec:\vjvdv.exe120⤵PID:3920
-
\??\c:\llxxflx.exec:\llxxflx.exe121⤵PID:4972
-
\??\c:\nbhhhh.exec:\nbhhhh.exe122⤵PID:3496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-