Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 20:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
40222ae5ee8a5066aab732ddd1a899aa4951056b57c5f7fc6931564be1577770.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
40222ae5ee8a5066aab732ddd1a899aa4951056b57c5f7fc6931564be1577770.exe
-
Size
128KB
-
MD5
358c11d5bdb5f6e34897a1912dea5013
-
SHA1
05d6f838712f4350a08d977aa05eecd8d60cf553
-
SHA256
40222ae5ee8a5066aab732ddd1a899aa4951056b57c5f7fc6931564be1577770
-
SHA512
c9b52ed5414a770d8eaa98eb9b7317a5d3ab7d5e2d61d7332273525c3820c0ca7b8d2437ef0a89e656140c56c0803ec6b987ab9f09c02c9be04b04639a0bf322
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDWiekja1br3GGBxfot3MsVpKFHqZ:ymb3NkkiQ3mdBjFWXkj7afoHVpx+dGoc
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1968-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1552-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/600-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1188-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1056-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/712-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 25 IoCs
resource yara_rule behavioral1/memory/1968-1-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1968-8-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2892-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2512-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2672-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2616-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2532-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2660-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2472-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2024-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2024-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2024-81-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2024-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2700-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2760-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1864-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1552-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1520-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/600-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1852-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1188-218-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2392-227-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1056-244-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/712-272-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3020-290-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2892 tnnthh.exe 2512 5vjjp.exe 2672 1xlfllr.exe 2616 fflffxl.exe 2532 thtbbh.exe 2660 jvvvv.exe 2472 fxlrxxf.exe 2024 xlrlxxx.exe 2700 tnbnnt.exe 2760 vvppp.exe 1864 9rxflrx.exe 1568 nhnbnh.exe 1552 vjjpp.exe 1520 vvppv.exe 2896 xrfflrf.exe 600 lllxlxr.exe 2920 nbnhnn.exe 688 pvdvv.exe 2904 rfffrlx.exe 1852 rlfxlxl.exe 1976 frxllfx.exe 1188 tnbbhn.exe 2392 dvddv.exe 1740 vjjdj.exe 1056 fxrrxfr.exe 1236 bbbttn.exe 108 nhhntn.exe 712 vjjjv.exe 1600 rlxrrrx.exe 3020 lfrrxfl.exe 1652 7hbbhh.exe 2188 vpdjp.exe 2684 vjvdd.exe 2192 xrfxlrx.exe 2624 3ttnnh.exe 1936 bthhnh.exe 2640 9ddjj.exe 2672 pvjdv.exe 2736 xrfxlfl.exe 2544 xrxrrlx.exe 2432 9rfrfll.exe 2200 ttbttb.exe 2884 nhntbb.exe 2876 dpdvd.exe 2024 jvddd.exe 2756 rflllrf.exe 1460 rlrfffl.exe 2864 hnhhhb.exe 1368 vpjpv.exe 876 vjvvd.exe 868 xlxrxxl.exe 1808 xrxfrxr.exe 604 1nbttt.exe 1356 vjpjj.exe 2044 dvdvd.exe 2504 rrrfrfl.exe 2448 tnbbhh.exe 2236 9btthb.exe 2068 1jvdd.exe 2744 jvpvj.exe 1420 xfrfxxl.exe 1796 fxlrrxr.exe 2796 nbtthh.exe 1220 7pjdj.exe -
resource yara_rule behavioral1/memory/1968-1-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/600-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1188-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/712-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2892 1968 40222ae5ee8a5066aab732ddd1a899aa4951056b57c5f7fc6931564be1577770.exe 28 PID 1968 wrote to memory of 2892 1968 40222ae5ee8a5066aab732ddd1a899aa4951056b57c5f7fc6931564be1577770.exe 28 PID 1968 wrote to memory of 2892 1968 40222ae5ee8a5066aab732ddd1a899aa4951056b57c5f7fc6931564be1577770.exe 28 PID 1968 wrote to memory of 2892 1968 40222ae5ee8a5066aab732ddd1a899aa4951056b57c5f7fc6931564be1577770.exe 28 PID 2892 wrote to memory of 2512 2892 tnnthh.exe 29 PID 2892 wrote to memory of 2512 2892 tnnthh.exe 29 PID 2892 wrote to memory of 2512 2892 tnnthh.exe 29 PID 2892 wrote to memory of 2512 2892 tnnthh.exe 29 PID 2512 wrote to memory of 2672 2512 5vjjp.exe 30 PID 2512 wrote to memory of 2672 2512 5vjjp.exe 30 PID 2512 wrote to memory of 2672 2512 5vjjp.exe 30 PID 2512 wrote to memory of 2672 2512 5vjjp.exe 30 PID 2672 wrote to memory of 2616 2672 1xlfllr.exe 31 PID 2672 wrote to memory of 2616 2672 1xlfllr.exe 31 PID 2672 wrote to memory of 2616 2672 1xlfllr.exe 31 PID 2672 wrote to memory of 2616 2672 1xlfllr.exe 31 PID 2616 wrote to memory of 2532 2616 fflffxl.exe 32 PID 2616 wrote to memory of 2532 2616 fflffxl.exe 32 PID 2616 wrote to memory of 2532 2616 fflffxl.exe 32 PID 2616 wrote to memory of 2532 2616 fflffxl.exe 32 PID 2532 wrote to memory of 2660 2532 thtbbh.exe 33 PID 2532 wrote to memory of 2660 2532 thtbbh.exe 33 PID 2532 wrote to memory of 2660 2532 thtbbh.exe 33 PID 2532 wrote to memory of 2660 2532 thtbbh.exe 33 PID 2660 wrote to memory of 2472 2660 jvvvv.exe 34 PID 2660 wrote to memory of 2472 2660 jvvvv.exe 34 PID 2660 wrote to memory of 2472 2660 jvvvv.exe 34 PID 2660 wrote to memory of 2472 2660 jvvvv.exe 34 PID 2472 wrote to memory of 2024 2472 fxlrxxf.exe 35 PID 2472 wrote to memory of 2024 2472 fxlrxxf.exe 35 PID 2472 wrote to memory of 2024 2472 fxlrxxf.exe 35 PID 2472 wrote to memory of 2024 2472 fxlrxxf.exe 35 PID 2024 wrote to memory of 2700 2024 xlrlxxx.exe 36 PID 2024 wrote to memory of 2700 2024 xlrlxxx.exe 36 PID 2024 wrote to memory of 2700 2024 xlrlxxx.exe 36 PID 2024 wrote to memory of 2700 2024 xlrlxxx.exe 36 PID 2700 wrote to memory of 2760 2700 tnbnnt.exe 37 PID 2700 wrote to memory of 2760 2700 tnbnnt.exe 37 PID 2700 wrote to memory of 2760 2700 tnbnnt.exe 37 PID 2700 wrote to memory of 2760 2700 tnbnnt.exe 37 PID 2760 wrote to memory of 1864 2760 vvppp.exe 38 PID 2760 wrote to memory of 1864 2760 vvppp.exe 38 PID 2760 wrote to memory of 1864 2760 vvppp.exe 38 PID 2760 wrote to memory of 1864 2760 vvppp.exe 38 PID 1864 wrote to memory of 1568 1864 9rxflrx.exe 39 PID 1864 wrote to memory of 1568 1864 9rxflrx.exe 39 PID 1864 wrote to memory of 1568 1864 9rxflrx.exe 39 PID 1864 wrote to memory of 1568 1864 9rxflrx.exe 39 PID 1568 wrote to memory of 1552 1568 nhnbnh.exe 40 PID 1568 wrote to memory of 1552 1568 nhnbnh.exe 40 PID 1568 wrote to memory of 1552 1568 nhnbnh.exe 40 PID 1568 wrote to memory of 1552 1568 nhnbnh.exe 40 PID 1552 wrote to memory of 1520 1552 vjjpp.exe 41 PID 1552 wrote to memory of 1520 1552 vjjpp.exe 41 PID 1552 wrote to memory of 1520 1552 vjjpp.exe 41 PID 1552 wrote to memory of 1520 1552 vjjpp.exe 41 PID 1520 wrote to memory of 2896 1520 vvppv.exe 42 PID 1520 wrote to memory of 2896 1520 vvppv.exe 42 PID 1520 wrote to memory of 2896 1520 vvppv.exe 42 PID 1520 wrote to memory of 2896 1520 vvppv.exe 42 PID 2896 wrote to memory of 600 2896 xrfflrf.exe 43 PID 2896 wrote to memory of 600 2896 xrfflrf.exe 43 PID 2896 wrote to memory of 600 2896 xrfflrf.exe 43 PID 2896 wrote to memory of 600 2896 xrfflrf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\40222ae5ee8a5066aab732ddd1a899aa4951056b57c5f7fc6931564be1577770.exe"C:\Users\Admin\AppData\Local\Temp\40222ae5ee8a5066aab732ddd1a899aa4951056b57c5f7fc6931564be1577770.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\tnnthh.exec:\tnnthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\5vjjp.exec:\5vjjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\1xlfllr.exec:\1xlfllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\fflffxl.exec:\fflffxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\thtbbh.exec:\thtbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jvvvv.exec:\jvvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\xlrlxxx.exec:\xlrlxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\tnbnnt.exec:\tnbnnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\vvppp.exec:\vvppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\9rxflrx.exec:\9rxflrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\nhnbnh.exec:\nhnbnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\vjjpp.exec:\vjjpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\vvppv.exec:\vvppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\xrfflrf.exec:\xrfflrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\lllxlxr.exec:\lllxlxr.exe17⤵
- Executes dropped EXE
PID:600 -
\??\c:\nbnhnn.exec:\nbnhnn.exe18⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pvdvv.exec:\pvdvv.exe19⤵
- Executes dropped EXE
PID:688 -
\??\c:\rfffrlx.exec:\rfffrlx.exe20⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rlfxlxl.exec:\rlfxlxl.exe21⤵
- Executes dropped EXE
PID:1852 -
\??\c:\frxllfx.exec:\frxllfx.exe22⤵
- Executes dropped EXE
PID:1976 -
\??\c:\tnbbhn.exec:\tnbbhn.exe23⤵
- Executes dropped EXE
PID:1188 -
\??\c:\dvddv.exec:\dvddv.exe24⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vjjdj.exec:\vjjdj.exe25⤵
- Executes dropped EXE
PID:1740 -
\??\c:\fxrrxfr.exec:\fxrrxfr.exe26⤵
- Executes dropped EXE
PID:1056 -
\??\c:\bbbttn.exec:\bbbttn.exe27⤵
- Executes dropped EXE
PID:1236 -
\??\c:\nhhntn.exec:\nhhntn.exe28⤵
- Executes dropped EXE
PID:108 -
\??\c:\vjjjv.exec:\vjjjv.exe29⤵
- Executes dropped EXE
PID:712 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe30⤵
- Executes dropped EXE
PID:1600 -
\??\c:\lfrrxfl.exec:\lfrrxfl.exe31⤵
- Executes dropped EXE
PID:3020 -
\??\c:\7hbbhh.exec:\7hbbhh.exe32⤵
- Executes dropped EXE
PID:1652 -
\??\c:\vpdjp.exec:\vpdjp.exe33⤵
- Executes dropped EXE
PID:2188 -
\??\c:\vjvdd.exec:\vjvdd.exe34⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xrfxlrx.exec:\xrfxlrx.exe35⤵
- Executes dropped EXE
PID:2192 -
\??\c:\3ttnnh.exec:\3ttnnh.exe36⤵
- Executes dropped EXE
PID:2624 -
\??\c:\bthhnh.exec:\bthhnh.exe37⤵
- Executes dropped EXE
PID:1936 -
\??\c:\9ddjj.exec:\9ddjj.exe38⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pvjdv.exec:\pvjdv.exe39⤵
- Executes dropped EXE
PID:2672 -
\??\c:\xrfxlfl.exec:\xrfxlfl.exe40⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xrxrrlx.exec:\xrxrrlx.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\9rfrfll.exec:\9rfrfll.exe42⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ttbttb.exec:\ttbttb.exe43⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nhntbb.exec:\nhntbb.exe44⤵
- Executes dropped EXE
PID:2884 -
\??\c:\dpdvd.exec:\dpdvd.exe45⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jvddd.exec:\jvddd.exe46⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rflllrf.exec:\rflllrf.exe47⤵
- Executes dropped EXE
PID:2756 -
\??\c:\rlrfffl.exec:\rlrfffl.exe48⤵
- Executes dropped EXE
PID:1460 -
\??\c:\hnhhhb.exec:\hnhhhb.exe49⤵
- Executes dropped EXE
PID:2864 -
\??\c:\vpjpv.exec:\vpjpv.exe50⤵
- Executes dropped EXE
PID:1368 -
\??\c:\vjvvd.exec:\vjvvd.exe51⤵
- Executes dropped EXE
PID:876 -
\??\c:\xlxrxxl.exec:\xlxrxxl.exe52⤵
- Executes dropped EXE
PID:868 -
\??\c:\xrxfrxr.exec:\xrxfrxr.exe53⤵
- Executes dropped EXE
PID:1808 -
\??\c:\1nbttt.exec:\1nbttt.exe54⤵
- Executes dropped EXE
PID:604 -
\??\c:\vjpjj.exec:\vjpjj.exe55⤵
- Executes dropped EXE
PID:1356 -
\??\c:\dvdvd.exec:\dvdvd.exe56⤵
- Executes dropped EXE
PID:2044 -
\??\c:\rrrfrfl.exec:\rrrfrfl.exe57⤵
- Executes dropped EXE
PID:2504 -
\??\c:\tnbbhh.exec:\tnbbhh.exe58⤵
- Executes dropped EXE
PID:2448 -
\??\c:\9btthb.exec:\9btthb.exe59⤵
- Executes dropped EXE
PID:2236 -
\??\c:\1jvdd.exec:\1jvdd.exe60⤵
- Executes dropped EXE
PID:2068 -
\??\c:\jvpvj.exec:\jvpvj.exe61⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xfrfxxl.exec:\xfrfxxl.exe62⤵
- Executes dropped EXE
PID:1420 -
\??\c:\fxlrrxr.exec:\fxlrrxr.exe63⤵
- Executes dropped EXE
PID:1796 -
\??\c:\nbtthh.exec:\nbtthh.exe64⤵
- Executes dropped EXE
PID:2796 -
\??\c:\7pjdj.exec:\7pjdj.exe65⤵
- Executes dropped EXE
PID:1220 -
\??\c:\vppjj.exec:\vppjj.exe66⤵PID:452
-
\??\c:\3rxxxrx.exec:\3rxxxrx.exe67⤵PID:1236
-
\??\c:\rfllrlr.exec:\rfllrlr.exe68⤵PID:628
-
\??\c:\hbnntt.exec:\hbnntt.exe69⤵PID:1476
-
\??\c:\btntnh.exec:\btntnh.exe70⤵PID:1628
-
\??\c:\9jppp.exec:\9jppp.exe71⤵PID:568
-
\??\c:\rlrxffl.exec:\rlrxffl.exe72⤵PID:1004
-
\??\c:\fxfxflr.exec:\fxfxflr.exe73⤵PID:1924
-
\??\c:\hbnbnt.exec:\hbnbnt.exe74⤵PID:1652
-
\??\c:\nnnbbn.exec:\nnnbbn.exe75⤵PID:2492
-
\??\c:\dpddp.exec:\dpddp.exe76⤵PID:1648
-
\??\c:\frxrrlr.exec:\frxrrlr.exe77⤵PID:2516
-
\??\c:\flxlllr.exec:\flxlllr.exe78⤵PID:2500
-
\??\c:\nhtntt.exec:\nhtntt.exe79⤵PID:2548
-
\??\c:\7dvpp.exec:\7dvpp.exe80⤵PID:2540
-
\??\c:\9vddj.exec:\9vddj.exe81⤵PID:2416
-
\??\c:\1lllxlf.exec:\1lllxlf.exe82⤵PID:2616
-
\??\c:\fxllffx.exec:\fxllffx.exe83⤵PID:2520
-
\??\c:\tbbnbh.exec:\tbbnbh.exe84⤵PID:2484
-
\??\c:\ppdpd.exec:\ppdpd.exe85⤵PID:2440
-
\??\c:\vvpvp.exec:\vvpvp.exe86⤵PID:2472
-
\??\c:\frxfrfx.exec:\frxfrfx.exe87⤵PID:1784
-
\??\c:\bbtbth.exec:\bbtbth.exe88⤵PID:2732
-
\??\c:\tnntnh.exec:\tnntnh.exe89⤵PID:2856
-
\??\c:\vdjpv.exec:\vdjpv.exe90⤵PID:2760
-
\??\c:\5fxrxxr.exec:\5fxrxxr.exe91⤵PID:1864
-
\??\c:\hhnbth.exec:\hhnbth.exe92⤵PID:1568
-
\??\c:\9jvvj.exec:\9jvvj.exe93⤵PID:2144
-
\??\c:\1jjpd.exec:\1jjpd.exe94⤵PID:2380
-
\??\c:\jdpjj.exec:\jdpjj.exe95⤵PID:2140
-
\??\c:\vvjjv.exec:\vvjjv.exe96⤵PID:2216
-
\??\c:\flxrxxx.exec:\flxrxxx.exe97⤵PID:2212
-
\??\c:\thttbb.exec:\thttbb.exe98⤵PID:704
-
\??\c:\nnthbn.exec:\nnthbn.exe99⤵PID:2032
-
\??\c:\vpppj.exec:\vpppj.exe100⤵PID:324
-
\??\c:\dvjjp.exec:\dvjjp.exe101⤵PID:2248
-
\??\c:\xlrllll.exec:\xlrllll.exe102⤵PID:2052
-
\??\c:\xlfllfx.exec:\xlfllfx.exe103⤵PID:576
-
\??\c:\hhbnbb.exec:\hhbnbb.exe104⤵PID:2804
-
\??\c:\thbbhh.exec:\thbbhh.exe105⤵PID:2916
-
\??\c:\vjvjj.exec:\vjvjj.exe106⤵PID:328
-
\??\c:\pdjjj.exec:\pdjjj.exe107⤵PID:2056
-
\??\c:\xfxfxll.exec:\xfxfxll.exe108⤵PID:2364
-
\??\c:\btbntb.exec:\btbntb.exe109⤵PID:820
-
\??\c:\7rlrxxf.exec:\7rlrxxf.exe110⤵PID:320
-
\??\c:\frrlxrx.exec:\frrlxrx.exe111⤵PID:1668
-
\??\c:\nhnnbb.exec:\nhnnbb.exe112⤵PID:1992
-
\??\c:\vpjjp.exec:\vpjjp.exe113⤵PID:1312
-
\??\c:\vpdjv.exec:\vpdjv.exe114⤵PID:1444
-
\??\c:\rlrrxrf.exec:\rlrrxrf.exe115⤵PID:2488
-
\??\c:\lfllxrf.exec:\lfllxrf.exe116⤵PID:900
-
\??\c:\7thhhn.exec:\7thhhn.exe117⤵PID:2764
-
\??\c:\hbnntt.exec:\hbnntt.exe118⤵PID:2684
-
\??\c:\3dpjj.exec:\3dpjj.exe119⤵PID:2192
-
\??\c:\1jdjv.exec:\1jdjv.exe120⤵PID:2624
-
\??\c:\7xlrffr.exec:\7xlrffr.exe121⤵PID:2608
-
\??\c:\rlflxfl.exec:\rlflxfl.exe122⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-