Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 05:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fcde640288f351db48f40205e5a0b97e3541a0bd7034d3e41cd24048c3e2e732.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
-
Target
fcde640288f351db48f40205e5a0b97e3541a0bd7034d3e41cd24048c3e2e732.exe
-
Size
100KB
-
MD5
4f6a7c7213f94ca1bc7b1f8ae5f7265a
-
SHA1
008de2cbb1653addd6f4597723cce96adcda8546
-
SHA256
fcde640288f351db48f40205e5a0b97e3541a0bd7034d3e41cd24048c3e2e732
-
SHA512
60d5fe62c99f750dafc660ab1926728216d17faa0c562c6e53a2c7f97e5ed83fc4d80893ec60ff4ca0a556eb16799999f9da51aff0f9a012b35d0ddf1471e5eb
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDodtzn6zDaE0R5l:ymb3NkkiQ3mdBjFodt2zE3l
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral1/memory/1756-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-79-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/292-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1888-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1492-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/532-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/820-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 24 IoCs
resource yara_rule behavioral1/memory/1756-5-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2064-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2560-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2624-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2624-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2872-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2496-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2724-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2520-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2188-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2836-108-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2840-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2964-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1432-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/292-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1888-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2244-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2304-206-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1492-224-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/532-234-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/820-242-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1656-269-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3012-287-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2120-296-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2064 vjvvv.exe 2560 3vdjp.exe 2624 ffflfrf.exe 2872 hbhnnt.exe 2728 jvjjj.exe 2496 vjvpp.exe 2724 ffffffl.exe 2520 tntbbb.exe 2188 nhtbbb.exe 2836 9pvpd.exe 2840 3fxfxrx.exe 2964 bhhttb.exe 1676 hbbhhn.exe 1432 pjjjv.exe 292 1vdvv.exe 2556 rrrlxxr.exe 1888 bthnth.exe 1528 bthhnn.exe 2112 vpdjd.exe 2244 rrffrll.exe 2304 xlxxllr.exe 392 tnnbnt.exe 1492 7vddd.exe 532 5djpp.exe 820 llxllfl.exe 1344 nhbbnn.exe 2308 djdpp.exe 1656 dvvvj.exe 2312 llrxrrl.exe 3012 5tbbnh.exe 2120 nbhbnn.exe 2328 3djjj.exe 2256 frxxfxf.exe 1712 llxlrxl.exe 2084 nhttbt.exe 2672 bbtbnt.exe 3048 7pjjp.exe 2692 jjjjj.exe 1976 nhtttt.exe 2628 7btbnt.exe 2604 ppddj.exe 2496 jdppj.exe 2724 jddjv.exe 2712 fxflxxl.exe 2024 xlfflrf.exe 2776 hbtbtt.exe 2760 pjpjp.exe 1156 dvpvv.exe 1652 dpjjj.exe 1884 rlxfrrx.exe 2360 fxxflll.exe 1432 3ffflrf.exe 2764 nnbhth.exe 1304 tthhth.exe 1636 pjvpp.exe 1500 5djjj.exe 2296 rrxfllf.exe 2112 1xfrffx.exe 1680 rlrrxxl.exe 1252 hbbhtb.exe 2452 hbtttb.exe 1484 vjvvd.exe 1772 jdvpv.exe 2508 5pdpd.exe -
resource yara_rule behavioral1/memory/1756-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/292-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/820-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-296-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1756 wrote to memory of 2064 1756 fcde640288f351db48f40205e5a0b97e3541a0bd7034d3e41cd24048c3e2e732.exe 28 PID 1756 wrote to memory of 2064 1756 fcde640288f351db48f40205e5a0b97e3541a0bd7034d3e41cd24048c3e2e732.exe 28 PID 1756 wrote to memory of 2064 1756 fcde640288f351db48f40205e5a0b97e3541a0bd7034d3e41cd24048c3e2e732.exe 28 PID 1756 wrote to memory of 2064 1756 fcde640288f351db48f40205e5a0b97e3541a0bd7034d3e41cd24048c3e2e732.exe 28 PID 2064 wrote to memory of 2560 2064 vjvvv.exe 29 PID 2064 wrote to memory of 2560 2064 vjvvv.exe 29 PID 2064 wrote to memory of 2560 2064 vjvvv.exe 29 PID 2064 wrote to memory of 2560 2064 vjvvv.exe 29 PID 2560 wrote to memory of 2624 2560 3vdjp.exe 30 PID 2560 wrote to memory of 2624 2560 3vdjp.exe 30 PID 2560 wrote to memory of 2624 2560 3vdjp.exe 30 PID 2560 wrote to memory of 2624 2560 3vdjp.exe 30 PID 2624 wrote to memory of 2872 2624 ffflfrf.exe 31 PID 2624 wrote to memory of 2872 2624 ffflfrf.exe 31 PID 2624 wrote to memory of 2872 2624 ffflfrf.exe 31 PID 2624 wrote to memory of 2872 2624 ffflfrf.exe 31 PID 2872 wrote to memory of 2728 2872 hbhnnt.exe 32 PID 2872 wrote to memory of 2728 2872 hbhnnt.exe 32 PID 2872 wrote to memory of 2728 2872 hbhnnt.exe 32 PID 2872 wrote to memory of 2728 2872 hbhnnt.exe 32 PID 2728 wrote to memory of 2496 2728 jvjjj.exe 33 PID 2728 wrote to memory of 2496 2728 jvjjj.exe 33 PID 2728 wrote to memory of 2496 2728 jvjjj.exe 33 PID 2728 wrote to memory of 2496 2728 jvjjj.exe 33 PID 2496 wrote to memory of 2724 2496 vjvpp.exe 34 PID 2496 wrote to memory of 2724 2496 vjvpp.exe 34 PID 2496 wrote to memory of 2724 2496 vjvpp.exe 34 PID 2496 wrote to memory of 2724 2496 vjvpp.exe 34 PID 2724 wrote to memory of 2520 2724 ffffffl.exe 35 PID 2724 wrote to memory of 2520 2724 ffffffl.exe 35 PID 2724 wrote to memory of 2520 2724 ffffffl.exe 35 PID 2724 wrote to memory of 2520 2724 ffffffl.exe 35 PID 2520 wrote to memory of 2188 2520 tntbbb.exe 36 PID 2520 wrote to memory of 2188 2520 tntbbb.exe 36 PID 2520 wrote to memory of 2188 2520 tntbbb.exe 36 PID 2520 wrote to memory of 2188 2520 tntbbb.exe 36 PID 2188 wrote to memory of 2836 2188 nhtbbb.exe 37 PID 2188 wrote to memory of 2836 2188 nhtbbb.exe 37 PID 2188 wrote to memory of 2836 2188 nhtbbb.exe 37 PID 2188 wrote to memory of 2836 2188 nhtbbb.exe 37 PID 2836 wrote to memory of 2840 2836 9pvpd.exe 38 PID 2836 wrote to memory of 2840 2836 9pvpd.exe 38 PID 2836 wrote to memory of 2840 2836 9pvpd.exe 38 PID 2836 wrote to memory of 2840 2836 9pvpd.exe 38 PID 2840 wrote to memory of 2964 2840 3fxfxrx.exe 39 PID 2840 wrote to memory of 2964 2840 3fxfxrx.exe 39 PID 2840 wrote to memory of 2964 2840 3fxfxrx.exe 39 PID 2840 wrote to memory of 2964 2840 3fxfxrx.exe 39 PID 2964 wrote to memory of 1676 2964 bhhttb.exe 40 PID 2964 wrote to memory of 1676 2964 bhhttb.exe 40 PID 2964 wrote to memory of 1676 2964 bhhttb.exe 40 PID 2964 wrote to memory of 1676 2964 bhhttb.exe 40 PID 1676 wrote to memory of 1432 1676 hbbhhn.exe 41 PID 1676 wrote to memory of 1432 1676 hbbhhn.exe 41 PID 1676 wrote to memory of 1432 1676 hbbhhn.exe 41 PID 1676 wrote to memory of 1432 1676 hbbhhn.exe 41 PID 1432 wrote to memory of 292 1432 pjjjv.exe 42 PID 1432 wrote to memory of 292 1432 pjjjv.exe 42 PID 1432 wrote to memory of 292 1432 pjjjv.exe 42 PID 1432 wrote to memory of 292 1432 pjjjv.exe 42 PID 292 wrote to memory of 2556 292 1vdvv.exe 43 PID 292 wrote to memory of 2556 292 1vdvv.exe 43 PID 292 wrote to memory of 2556 292 1vdvv.exe 43 PID 292 wrote to memory of 2556 292 1vdvv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcde640288f351db48f40205e5a0b97e3541a0bd7034d3e41cd24048c3e2e732.exe"C:\Users\Admin\AppData\Local\Temp\fcde640288f351db48f40205e5a0b97e3541a0bd7034d3e41cd24048c3e2e732.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\vjvvv.exec:\vjvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\3vdjp.exec:\3vdjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\ffflfrf.exec:\ffflfrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\hbhnnt.exec:\hbhnnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\jvjjj.exec:\jvjjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\vjvpp.exec:\vjvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\ffffffl.exec:\ffffffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\tntbbb.exec:\tntbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\nhtbbb.exec:\nhtbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\9pvpd.exec:\9pvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\3fxfxrx.exec:\3fxfxrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\bhhttb.exec:\bhhttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\hbbhhn.exec:\hbbhhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\pjjjv.exec:\pjjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\1vdvv.exec:\1vdvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:292 -
\??\c:\rrrlxxr.exec:\rrrlxxr.exe17⤵
- Executes dropped EXE
PID:2556 -
\??\c:\bthnth.exec:\bthnth.exe18⤵
- Executes dropped EXE
PID:1888 -
\??\c:\bthhnn.exec:\bthhnn.exe19⤵
- Executes dropped EXE
PID:1528 -
\??\c:\vpdjd.exec:\vpdjd.exe20⤵
- Executes dropped EXE
PID:2112 -
\??\c:\rrffrll.exec:\rrffrll.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xlxxllr.exec:\xlxxllr.exe22⤵
- Executes dropped EXE
PID:2304 -
\??\c:\tnnbnt.exec:\tnnbnt.exe23⤵
- Executes dropped EXE
PID:392 -
\??\c:\7vddd.exec:\7vddd.exe24⤵
- Executes dropped EXE
PID:1492 -
\??\c:\5djpp.exec:\5djpp.exe25⤵
- Executes dropped EXE
PID:532 -
\??\c:\llxllfl.exec:\llxllfl.exe26⤵
- Executes dropped EXE
PID:820 -
\??\c:\nhbbnn.exec:\nhbbnn.exe27⤵
- Executes dropped EXE
PID:1344 -
\??\c:\djdpp.exec:\djdpp.exe28⤵
- Executes dropped EXE
PID:2308 -
\??\c:\dvvvj.exec:\dvvvj.exe29⤵
- Executes dropped EXE
PID:1656 -
\??\c:\llrxrrl.exec:\llrxrrl.exe30⤵
- Executes dropped EXE
PID:2312 -
\??\c:\5tbbnh.exec:\5tbbnh.exe31⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nbhbnn.exec:\nbhbnn.exe32⤵
- Executes dropped EXE
PID:2120 -
\??\c:\3djjj.exec:\3djjj.exe33⤵
- Executes dropped EXE
PID:2328 -
\??\c:\frxxfxf.exec:\frxxfxf.exe34⤵
- Executes dropped EXE
PID:2256 -
\??\c:\llxlrxl.exec:\llxlrxl.exe35⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nhttbt.exec:\nhttbt.exe36⤵
- Executes dropped EXE
PID:2084 -
\??\c:\bbtbnt.exec:\bbtbnt.exe37⤵
- Executes dropped EXE
PID:2672 -
\??\c:\7pjjp.exec:\7pjjp.exe38⤵
- Executes dropped EXE
PID:3048 -
\??\c:\jjjjj.exec:\jjjjj.exe39⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nhtttt.exec:\nhtttt.exe40⤵
- Executes dropped EXE
PID:1976 -
\??\c:\7btbnt.exec:\7btbnt.exe41⤵
- Executes dropped EXE
PID:2628 -
\??\c:\ppddj.exec:\ppddj.exe42⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jdppj.exec:\jdppj.exe43⤵
- Executes dropped EXE
PID:2496 -
\??\c:\jddjv.exec:\jddjv.exe44⤵
- Executes dropped EXE
PID:2724 -
\??\c:\fxflxxl.exec:\fxflxxl.exe45⤵
- Executes dropped EXE
PID:2712 -
\??\c:\xlfflrf.exec:\xlfflrf.exe46⤵
- Executes dropped EXE
PID:2024 -
\??\c:\hbtbtt.exec:\hbtbtt.exe47⤵
- Executes dropped EXE
PID:2776 -
\??\c:\pjpjp.exec:\pjpjp.exe48⤵
- Executes dropped EXE
PID:2760 -
\??\c:\dvpvv.exec:\dvpvv.exe49⤵
- Executes dropped EXE
PID:1156 -
\??\c:\dpjjj.exec:\dpjjj.exe50⤵
- Executes dropped EXE
PID:1652 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe51⤵
- Executes dropped EXE
PID:1884 -
\??\c:\fxxflll.exec:\fxxflll.exe52⤵
- Executes dropped EXE
PID:2360 -
\??\c:\3ffflrf.exec:\3ffflrf.exe53⤵
- Executes dropped EXE
PID:1432 -
\??\c:\nnbhth.exec:\nnbhth.exe54⤵
- Executes dropped EXE
PID:2764 -
\??\c:\tthhth.exec:\tthhth.exe55⤵
- Executes dropped EXE
PID:1304 -
\??\c:\pjvpp.exec:\pjvpp.exe56⤵
- Executes dropped EXE
PID:1636 -
\??\c:\5djjj.exec:\5djjj.exe57⤵
- Executes dropped EXE
PID:1500 -
\??\c:\rrxfllf.exec:\rrxfllf.exe58⤵
- Executes dropped EXE
PID:2296 -
\??\c:\1xfrffx.exec:\1xfrffx.exe59⤵
- Executes dropped EXE
PID:2112 -
\??\c:\rlrrxxl.exec:\rlrrxxl.exe60⤵
- Executes dropped EXE
PID:1680 -
\??\c:\hbbhtb.exec:\hbbhtb.exe61⤵
- Executes dropped EXE
PID:1252 -
\??\c:\hbtttb.exec:\hbtttb.exe62⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vjvvd.exec:\vjvvd.exe63⤵
- Executes dropped EXE
PID:1484 -
\??\c:\jdvpv.exec:\jdvpv.exe64⤵
- Executes dropped EXE
PID:1772 -
\??\c:\5pdpd.exec:\5pdpd.exe65⤵
- Executes dropped EXE
PID:2508 -
\??\c:\1xxxflr.exec:\1xxxflr.exe66⤵PID:612
-
\??\c:\llxflfr.exec:\llxflfr.exe67⤵PID:1920
-
\??\c:\hhthth.exec:\hhthth.exe68⤵PID:1344
-
\??\c:\bthttb.exec:\bthttb.exe69⤵PID:3024
-
\??\c:\hnnntt.exec:\hnnntt.exe70⤵PID:2196
-
\??\c:\3dvvj.exec:\3dvvj.exe71⤵PID:980
-
\??\c:\djddp.exec:\djddp.exe72⤵PID:2356
-
\??\c:\fxrllrl.exec:\fxrllrl.exe73⤵PID:1504
-
\??\c:\rlfxlrf.exec:\rlfxlrf.exe74⤵PID:2364
-
\??\c:\btbnbh.exec:\btbnbh.exe75⤵PID:1216
-
\??\c:\nnhbtt.exec:\nnhbtt.exe76⤵PID:1608
-
\??\c:\vpddp.exec:\vpddp.exe77⤵PID:2260
-
\??\c:\vvjpv.exec:\vvjpv.exe78⤵PID:1992
-
\??\c:\llfrrxl.exec:\llfrrxl.exe79⤵PID:2560
-
\??\c:\xxllxxf.exec:\xxllxxf.exe80⤵PID:2672
-
\??\c:\bbnthn.exec:\bbnthn.exe81⤵PID:3048
-
\??\c:\bthhhh.exec:\bthhhh.exe82⤵PID:2684
-
\??\c:\pjddp.exec:\pjddp.exe83⤵PID:1976
-
\??\c:\vpdjp.exec:\vpdjp.exe84⤵PID:2516
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe85⤵PID:2604
-
\??\c:\lfllxfl.exec:\lfllxfl.exe86⤵PID:2524
-
\??\c:\rlrlxxf.exec:\rlrlxxf.exe87⤵PID:2724
-
\??\c:\nhnhtt.exec:\nhnhtt.exe88⤵PID:2800
-
\??\c:\djvpp.exec:\djvpp.exe89⤵PID:1816
-
\??\c:\jvddp.exec:\jvddp.exe90⤵PID:2824
-
\??\c:\rfffrxx.exec:\rfffrxx.exe91⤵PID:1812
-
\??\c:\frxflll.exec:\frxflll.exe92⤵PID:1652
-
\??\c:\nbbhbh.exec:\nbbhbh.exe93⤵PID:1668
-
\??\c:\bthnnn.exec:\bthnnn.exe94⤵PID:1588
-
\??\c:\3jvvv.exec:\3jvvv.exe95⤵PID:1736
-
\??\c:\vpvdj.exec:\vpvdj.exe96⤵PID:2528
-
\??\c:\llxlxrf.exec:\llxlxrf.exe97⤵PID:2788
-
\??\c:\3xrlxfl.exec:\3xrlxfl.exe98⤵PID:1844
-
\??\c:\nhbhtt.exec:\nhbhtt.exe99⤵PID:1636
-
\??\c:\1nbtbt.exec:\1nbtbt.exe100⤵PID:2564
-
\??\c:\nhnbtn.exec:\nhnbtn.exe101⤵PID:2888
-
\??\c:\jdjvp.exec:\jdjvp.exe102⤵PID:2028
-
\??\c:\rfffffl.exec:\rfffffl.exe103⤵PID:688
-
\??\c:\9fxxffl.exec:\9fxxffl.exe104⤵PID:2108
-
\??\c:\3nbtbb.exec:\3nbtbb.exe105⤵PID:948
-
\??\c:\btbnhh.exec:\btbnhh.exe106⤵PID:608
-
\??\c:\5nbnbb.exec:\5nbnbb.exe107⤵PID:916
-
\??\c:\5vjdd.exec:\5vjdd.exe108⤵PID:576
-
\??\c:\dvjjv.exec:\dvjjv.exe109⤵PID:2876
-
\??\c:\xlxxflr.exec:\xlxxflr.exe110⤵PID:920
-
\??\c:\xxlrlxl.exec:\xxlrlxl.exe111⤵PID:1028
-
\??\c:\3hnthb.exec:\3hnthb.exe112⤵PID:1724
-
\??\c:\3nbhtn.exec:\3nbhtn.exe113⤵PID:320
-
\??\c:\jvddd.exec:\jvddd.exe114⤵PID:3052
-
\??\c:\pjddp.exec:\pjddp.exe115⤵PID:1800
-
\??\c:\9rfrxrr.exec:\9rfrxrr.exe116⤵PID:1744
-
\??\c:\5fxflrx.exec:\5fxflrx.exe117⤵PID:1604
-
\??\c:\5ffrrll.exec:\5ffrrll.exe118⤵PID:2400
-
\??\c:\bnhhbt.exec:\bnhhbt.exe119⤵PID:1712
-
\??\c:\thnnhn.exec:\thnnhn.exe120⤵PID:2680
-
\??\c:\5dpdd.exec:\5dpdd.exe121⤵PID:2608
-
\??\c:\jvvvp.exec:\jvvvp.exe122⤵PID:2660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-