Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-05-2024 23:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
793632157603644d1b23242a491db899720d4625393f18e3360fa70a604e84b3.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
793632157603644d1b23242a491db899720d4625393f18e3360fa70a604e84b3.exe
-
Size
94KB
-
MD5
97441b8669bdeebe70131d85721081e0
-
SHA1
89b2573357fce1c3928d91d0371965b67979c798
-
SHA256
793632157603644d1b23242a491db899720d4625393f18e3360fa70a604e84b3
-
SHA512
a8167dda9c6621077c04d88c156ca6564f3b4211f8fc2c0bfbc45337d6855c538d9da9ae6ead38e14528d73784ad43d7da02d03c1c904c3fd7ebd1663beba732
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7NANTBuQG1np24+2OXRY:ymb3NkkiQ3mdBjFo7NguQG1n0USu
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2100-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1836-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/780-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1880-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1316-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1916-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 19 IoCs
resource yara_rule behavioral1/memory/2100-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2588-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2476-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2560-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2644-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2332-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2956-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1836-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2084-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1604-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2300-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/764-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2792-178-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2212-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/780-214-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1880-240-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1316-249-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1916-258-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1676-294-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2588 7lflllr.exe 2476 tnhnhn.exe 2560 jpvpj.exe 2676 rflxrrr.exe 2644 rlllfff.exe 2332 3btnnn.exe 2404 nbntbt.exe 2956 jdppv.exe 1836 1jjjd.exe 2648 7rxxrll.exe 2764 1bnntn.exe 996 7bthhb.exe 2084 dvjjj.exe 1604 dpvpp.exe 2300 lfrlrrr.exe 1372 5bhnnt.exe 764 nhtbbb.exe 2792 pvjdp.exe 2460 rfllrrr.exe 2212 1lrrlrx.exe 1344 bbntnh.exe 780 bnhhhb.exe 1416 1vjjp.exe 1436 jpjjd.exe 1880 ffxlxfx.exe 1316 xlxrxxx.exe 1916 tnnnnn.exe 608 3dppv.exe 2232 fxlrxfl.exe 1592 rffxxxx.exe 1676 1hnttb.exe 1944 pjdpp.exe 2088 pjvjj.exe 1624 lxllfff.exe 1244 7xlfffl.exe 2576 9btntn.exe 2476 ntbnhb.exe 2696 jvvpj.exe 2788 dpdjd.exe 2828 jpvpp.exe 2372 fflxxlf.exe 2428 hnnbhb.exe 2420 hbhhnh.exe 2540 1htntn.exe 2660 vdpdv.exe 2664 3pppd.exe 2648 3ffxfxx.exe 2748 lfrrxxf.exe 2024 tbhbnh.exe 1864 ntttnb.exe 1844 jvvvv.exe 2264 vpvjv.exe 2760 xlrffrx.exe 1224 flfllfx.exe 2784 bhnbbn.exe 2888 7nbbbt.exe 2176 dvdjd.exe 2852 1pppv.exe 2228 lrfflll.exe 2196 3rxxxxx.exe 592 hthbht.exe 1884 7bbhhb.exe 1728 5jddv.exe 572 9jddv.exe -
resource yara_rule behavioral1/memory/2100-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1836-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/780-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1316-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-294-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2588 2100 793632157603644d1b23242a491db899720d4625393f18e3360fa70a604e84b3.exe 28 PID 2100 wrote to memory of 2588 2100 793632157603644d1b23242a491db899720d4625393f18e3360fa70a604e84b3.exe 28 PID 2100 wrote to memory of 2588 2100 793632157603644d1b23242a491db899720d4625393f18e3360fa70a604e84b3.exe 28 PID 2100 wrote to memory of 2588 2100 793632157603644d1b23242a491db899720d4625393f18e3360fa70a604e84b3.exe 28 PID 2588 wrote to memory of 2476 2588 7lflllr.exe 29 PID 2588 wrote to memory of 2476 2588 7lflllr.exe 29 PID 2588 wrote to memory of 2476 2588 7lflllr.exe 29 PID 2588 wrote to memory of 2476 2588 7lflllr.exe 29 PID 2476 wrote to memory of 2560 2476 tnhnhn.exe 30 PID 2476 wrote to memory of 2560 2476 tnhnhn.exe 30 PID 2476 wrote to memory of 2560 2476 tnhnhn.exe 30 PID 2476 wrote to memory of 2560 2476 tnhnhn.exe 30 PID 2560 wrote to memory of 2676 2560 jpvpj.exe 31 PID 2560 wrote to memory of 2676 2560 jpvpj.exe 31 PID 2560 wrote to memory of 2676 2560 jpvpj.exe 31 PID 2560 wrote to memory of 2676 2560 jpvpj.exe 31 PID 2676 wrote to memory of 2644 2676 rflxrrr.exe 32 PID 2676 wrote to memory of 2644 2676 rflxrrr.exe 32 PID 2676 wrote to memory of 2644 2676 rflxrrr.exe 32 PID 2676 wrote to memory of 2644 2676 rflxrrr.exe 32 PID 2644 wrote to memory of 2332 2644 rlllfff.exe 33 PID 2644 wrote to memory of 2332 2644 rlllfff.exe 33 PID 2644 wrote to memory of 2332 2644 rlllfff.exe 33 PID 2644 wrote to memory of 2332 2644 rlllfff.exe 33 PID 2332 wrote to memory of 2404 2332 3btnnn.exe 34 PID 2332 wrote to memory of 2404 2332 3btnnn.exe 34 PID 2332 wrote to memory of 2404 2332 3btnnn.exe 34 PID 2332 wrote to memory of 2404 2332 3btnnn.exe 34 PID 2404 wrote to memory of 2956 2404 nbntbt.exe 35 PID 2404 wrote to memory of 2956 2404 nbntbt.exe 35 PID 2404 wrote to memory of 2956 2404 nbntbt.exe 35 PID 2404 wrote to memory of 2956 2404 nbntbt.exe 35 PID 2956 wrote to memory of 1836 2956 jdppv.exe 36 PID 2956 wrote to memory of 1836 2956 jdppv.exe 36 PID 2956 wrote to memory of 1836 2956 jdppv.exe 36 PID 2956 wrote to memory of 1836 2956 jdppv.exe 36 PID 1836 wrote to memory of 2648 1836 1jjjd.exe 37 PID 1836 wrote to memory of 2648 1836 1jjjd.exe 37 PID 1836 wrote to memory of 2648 1836 1jjjd.exe 37 PID 1836 wrote to memory of 2648 1836 1jjjd.exe 37 PID 2648 wrote to memory of 2764 2648 7rxxrll.exe 38 PID 2648 wrote to memory of 2764 2648 7rxxrll.exe 38 PID 2648 wrote to memory of 2764 2648 7rxxrll.exe 38 PID 2648 wrote to memory of 2764 2648 7rxxrll.exe 38 PID 2764 wrote to memory of 996 2764 1bnntn.exe 39 PID 2764 wrote to memory of 996 2764 1bnntn.exe 39 PID 2764 wrote to memory of 996 2764 1bnntn.exe 39 PID 2764 wrote to memory of 996 2764 1bnntn.exe 39 PID 996 wrote to memory of 2084 996 7bthhb.exe 40 PID 996 wrote to memory of 2084 996 7bthhb.exe 40 PID 996 wrote to memory of 2084 996 7bthhb.exe 40 PID 996 wrote to memory of 2084 996 7bthhb.exe 40 PID 2084 wrote to memory of 1604 2084 dvjjj.exe 41 PID 2084 wrote to memory of 1604 2084 dvjjj.exe 41 PID 2084 wrote to memory of 1604 2084 dvjjj.exe 41 PID 2084 wrote to memory of 1604 2084 dvjjj.exe 41 PID 1604 wrote to memory of 2300 1604 dpvpp.exe 42 PID 1604 wrote to memory of 2300 1604 dpvpp.exe 42 PID 1604 wrote to memory of 2300 1604 dpvpp.exe 42 PID 1604 wrote to memory of 2300 1604 dpvpp.exe 42 PID 2300 wrote to memory of 1372 2300 lfrlrrr.exe 43 PID 2300 wrote to memory of 1372 2300 lfrlrrr.exe 43 PID 2300 wrote to memory of 1372 2300 lfrlrrr.exe 43 PID 2300 wrote to memory of 1372 2300 lfrlrrr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\793632157603644d1b23242a491db899720d4625393f18e3360fa70a604e84b3.exe"C:\Users\Admin\AppData\Local\Temp\793632157603644d1b23242a491db899720d4625393f18e3360fa70a604e84b3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\7lflllr.exec:\7lflllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\tnhnhn.exec:\tnhnhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\jpvpj.exec:\jpvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\rflxrrr.exec:\rflxrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\rlllfff.exec:\rlllfff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\3btnnn.exec:\3btnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\nbntbt.exec:\nbntbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\jdppv.exec:\jdppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\1jjjd.exec:\1jjjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\7rxxrll.exec:\7rxxrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\1bnntn.exec:\1bnntn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\7bthhb.exec:\7bthhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\dvjjj.exec:\dvjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\dpvpp.exec:\dpvpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\lfrlrrr.exec:\lfrlrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\5bhnnt.exec:\5bhnnt.exe17⤵
- Executes dropped EXE
PID:1372 -
\??\c:\nhtbbb.exec:\nhtbbb.exe18⤵
- Executes dropped EXE
PID:764 -
\??\c:\pvjdp.exec:\pvjdp.exe19⤵
- Executes dropped EXE
PID:2792 -
\??\c:\rfllrrr.exec:\rfllrrr.exe20⤵
- Executes dropped EXE
PID:2460 -
\??\c:\1lrrlrx.exec:\1lrrlrx.exe21⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bbntnh.exec:\bbntnh.exe22⤵
- Executes dropped EXE
PID:1344 -
\??\c:\bnhhhb.exec:\bnhhhb.exe23⤵
- Executes dropped EXE
PID:780 -
\??\c:\1vjjp.exec:\1vjjp.exe24⤵
- Executes dropped EXE
PID:1416 -
\??\c:\jpjjd.exec:\jpjjd.exe25⤵
- Executes dropped EXE
PID:1436 -
\??\c:\ffxlxfx.exec:\ffxlxfx.exe26⤵
- Executes dropped EXE
PID:1880 -
\??\c:\xlxrxxx.exec:\xlxrxxx.exe27⤵
- Executes dropped EXE
PID:1316 -
\??\c:\tnnnnn.exec:\tnnnnn.exe28⤵
- Executes dropped EXE
PID:1916 -
\??\c:\3dppv.exec:\3dppv.exe29⤵
- Executes dropped EXE
PID:608 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe30⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rffxxxx.exec:\rffxxxx.exe31⤵
- Executes dropped EXE
PID:1592 -
\??\c:\1hnttb.exec:\1hnttb.exe32⤵
- Executes dropped EXE
PID:1676 -
\??\c:\pjdpp.exec:\pjdpp.exe33⤵
- Executes dropped EXE
PID:1944 -
\??\c:\pjvjj.exec:\pjvjj.exe34⤵
- Executes dropped EXE
PID:2088 -
\??\c:\lxllfff.exec:\lxllfff.exe35⤵
- Executes dropped EXE
PID:1624 -
\??\c:\7xlfffl.exec:\7xlfffl.exe36⤵
- Executes dropped EXE
PID:1244 -
\??\c:\9btntn.exec:\9btntn.exe37⤵
- Executes dropped EXE
PID:2576 -
\??\c:\ntbnhb.exec:\ntbnhb.exe38⤵
- Executes dropped EXE
PID:2476 -
\??\c:\jvvpj.exec:\jvvpj.exe39⤵
- Executes dropped EXE
PID:2696 -
\??\c:\dpdjd.exec:\dpdjd.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jpvpp.exec:\jpvpp.exe41⤵
- Executes dropped EXE
PID:2828 -
\??\c:\fflxxlf.exec:\fflxxlf.exe42⤵
- Executes dropped EXE
PID:2372 -
\??\c:\hnnbhb.exec:\hnnbhb.exe43⤵
- Executes dropped EXE
PID:2428 -
\??\c:\hbhhnh.exec:\hbhhnh.exe44⤵
- Executes dropped EXE
PID:2420 -
\??\c:\1htntn.exec:\1htntn.exe45⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vdpdv.exec:\vdpdv.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\3pppd.exec:\3pppd.exe47⤵
- Executes dropped EXE
PID:2664 -
\??\c:\3ffxfxx.exec:\3ffxfxx.exe48⤵
- Executes dropped EXE
PID:2648 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe49⤵
- Executes dropped EXE
PID:2748 -
\??\c:\tbhbnh.exec:\tbhbnh.exe50⤵
- Executes dropped EXE
PID:2024 -
\??\c:\ntttnb.exec:\ntttnb.exe51⤵
- Executes dropped EXE
PID:1864 -
\??\c:\jvvvv.exec:\jvvvv.exe52⤵
- Executes dropped EXE
PID:1844 -
\??\c:\vpvjv.exec:\vpvjv.exe53⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xlrffrx.exec:\xlrffrx.exe54⤵
- Executes dropped EXE
PID:2760 -
\??\c:\flfllfx.exec:\flfllfx.exe55⤵
- Executes dropped EXE
PID:1224 -
\??\c:\bhnbbn.exec:\bhnbbn.exe56⤵
- Executes dropped EXE
PID:2784 -
\??\c:\7nbbbt.exec:\7nbbbt.exe57⤵
- Executes dropped EXE
PID:2888 -
\??\c:\dvdjd.exec:\dvdjd.exe58⤵
- Executes dropped EXE
PID:2176 -
\??\c:\1pppv.exec:\1pppv.exe59⤵
- Executes dropped EXE
PID:2852 -
\??\c:\lrfflll.exec:\lrfflll.exe60⤵
- Executes dropped EXE
PID:2228 -
\??\c:\3rxxxxx.exec:\3rxxxxx.exe61⤵
- Executes dropped EXE
PID:2196 -
\??\c:\hthbht.exec:\hthbht.exe62⤵
- Executes dropped EXE
PID:592 -
\??\c:\7bbhhb.exec:\7bbhhb.exe63⤵
- Executes dropped EXE
PID:1884 -
\??\c:\5jddv.exec:\5jddv.exe64⤵
- Executes dropped EXE
PID:1728 -
\??\c:\9jddv.exec:\9jddv.exe65⤵
- Executes dropped EXE
PID:572 -
\??\c:\lxfrrlr.exec:\lxfrrlr.exe66⤵PID:612
-
\??\c:\fxfffxf.exec:\fxfffxf.exe67⤵PID:1044
-
\??\c:\7hhbtn.exec:\7hhbtn.exe68⤵PID:1888
-
\??\c:\3htntn.exec:\3htntn.exe69⤵PID:836
-
\??\c:\7nbnnh.exec:\7nbnnh.exe70⤵PID:760
-
\??\c:\djjjj.exec:\djjjj.exe71⤵PID:628
-
\??\c:\dpjdd.exec:\dpjdd.exe72⤵PID:332
-
\??\c:\xflxffl.exec:\xflxffl.exe73⤵PID:1644
-
\??\c:\frxfffx.exec:\frxfffx.exe74⤵PID:1840
-
\??\c:\bntnhb.exec:\bntnhb.exe75⤵PID:1520
-
\??\c:\dpdpv.exec:\dpdpv.exe76⤵PID:1572
-
\??\c:\jvdjp.exec:\jvdjp.exe77⤵PID:2984
-
\??\c:\tbhtbh.exec:\tbhtbh.exe78⤵PID:2556
-
\??\c:\pddpv.exec:\pddpv.exe79⤵PID:860
-
\??\c:\7jdjj.exec:\7jdjj.exe80⤵PID:2576
-
\??\c:\fxrlrxf.exec:\fxrlrxf.exe81⤵PID:2692
-
\??\c:\xxrfrxl.exec:\xxrfrxl.exe82⤵PID:2584
-
\??\c:\7nbbht.exec:\7nbbht.exe83⤵PID:2812
-
\??\c:\tbhhnh.exec:\tbhhnh.exe84⤵PID:2592
-
\??\c:\pjvvd.exec:\pjvvd.exe85⤵PID:2132
-
\??\c:\1jvvd.exec:\1jvvd.exe86⤵PID:2072
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe87⤵PID:2956
-
\??\c:\fxfflfl.exec:\fxfflfl.exe88⤵PID:2640
-
\??\c:\ntbttn.exec:\ntbttn.exe89⤵PID:2624
-
\??\c:\1bnntb.exec:\1bnntb.exe90⤵PID:2732
-
\??\c:\3bhhnn.exec:\3bhhnn.exe91⤵PID:1012
-
\??\c:\7vvjj.exec:\7vvjj.exe92⤵PID:1144
-
\??\c:\pjvvd.exec:\pjvvd.exe93⤵PID:2024
-
\??\c:\xlxflrx.exec:\xlxflrx.exe94⤵PID:1984
-
\??\c:\frxfxxf.exec:\frxfxxf.exe95⤵PID:2000
-
\??\c:\1bnhtt.exec:\1bnhtt.exe96⤵PID:108
-
\??\c:\bnbbtn.exec:\bnbbtn.exe97⤵PID:1372
-
\??\c:\vpdjd.exec:\vpdjd.exe98⤵PID:812
-
\??\c:\1pdjj.exec:\1pdjj.exe99⤵PID:2796
-
\??\c:\rflxlrl.exec:\rflxlrl.exe100⤵PID:2240
-
\??\c:\thnttt.exec:\thnttt.exe101⤵PID:2460
-
\??\c:\tthnhh.exec:\tthnhh.exe102⤵PID:2212
-
\??\c:\7jvvv.exec:\7jvvv.exe103⤵PID:488
-
\??\c:\3vjdd.exec:\3vjdd.exe104⤵PID:384
-
\??\c:\9xrxllr.exec:\9xrxllr.exe105⤵PID:1056
-
\??\c:\lfrrffl.exec:\lfrrffl.exe106⤵PID:2340
-
\??\c:\ntbtbb.exec:\ntbtbb.exe107⤵PID:3044
-
\??\c:\nhnntb.exec:\nhnntb.exe108⤵PID:1796
-
\??\c:\1dvvv.exec:\1dvvv.exe109⤵PID:1540
-
\??\c:\5vpjp.exec:\5vpjp.exe110⤵PID:2272
-
\??\c:\dpvpv.exec:\dpvpv.exe111⤵PID:1148
-
\??\c:\lfxxxlr.exec:\lfxxxlr.exe112⤵PID:2112
-
\??\c:\lfffrxr.exec:\lfffrxr.exe113⤵PID:1736
-
\??\c:\1bthth.exec:\1bthth.exe114⤵PID:1232
-
\??\c:\hbtthh.exec:\hbtthh.exe115⤵PID:888
-
\??\c:\9dvdp.exec:\9dvdp.exe116⤵PID:1636
-
\??\c:\9pjjv.exec:\9pjjv.exe117⤵PID:3048
-
\??\c:\5frxllr.exec:\5frxllr.exe118⤵PID:1628
-
\??\c:\xlxxffl.exec:\xlxxffl.exe119⤵PID:2980
-
\??\c:\7hnntb.exec:\7hnntb.exe120⤵PID:3008
-
\??\c:\thbtbh.exec:\thbtbh.exe121⤵PID:2688
-
\??\c:\3bhtnn.exec:\3bhtnn.exe122⤵PID:2524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-