Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 19:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
097c152c6cd4b8b5afabe3bb3fd7c1b0_NEAS.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
097c152c6cd4b8b5afabe3bb3fd7c1b0_NEAS.exe
-
Size
334KB
-
MD5
097c152c6cd4b8b5afabe3bb3fd7c1b0
-
SHA1
d2c4b0d7c6ec58e8c67d5cb3a7b2687916a9309d
-
SHA256
f624e1b231ed994cc85337ee6f550e98c8316cfbd97228a8a1b123036117d093
-
SHA512
33738db857653e7dc0d69add084603efee7a2a2ca16a88db9f20dc9c471aa03a14db3f99763c9d6c7393080f6a1a4bf205a7767a812c9391a3462099900459ee
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LCgnilBxBqwZK2q6sYTsmZDSFdBE0rXE4efi:n3C9BRo/CEilXBG2qZSlSFdBXExi
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1204-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1940-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1192-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1600-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1292-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/296-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1328-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1204 9frflff.exe 2796 tntnbh.exe 2556 dpvjd.exe 2728 9frrlff.exe 2456 5tbtbt.exe 2808 1hnntb.exe 2560 dvjpv.exe 2512 lllxffr.exe 2944 bthnbb.exe 2660 jjvvp.exe 2680 pvjdd.exe 2812 nnnhbh.exe 1192 vppvj.exe 1448 9btttt.exe 1784 vjjpv.exe 1696 9xffrll.exe 1964 bnbbhb.exe 1600 1vddv.exe 1292 5rfffrx.exe 2876 3bbnnh.exe 664 htbbbt.exe 2204 1vdjp.exe 1104 3flfxll.exe 3032 nhbtht.exe 296 jpvjd.exe 1328 3flxxxf.exe 1664 tnttnh.exe 2224 1dvjp.exe 836 xxrrffr.exe 1316 fxllxxf.exe 2120 bbthtt.exe 3016 fxllxfr.exe 3036 ffxfxlx.exe 3064 5bntbb.exe 1604 vjvpj.exe 1408 jvddj.exe 2392 lxxlfxx.exe 2596 bnthnh.exe 2564 hbhttn.exe 2964 7vdpp.exe 2476 5fllfrr.exe 2440 lxfrrll.exe 2736 nhnbhn.exe 2740 ththnb.exe 2060 7jvvd.exe 2676 ffllxff.exe 2752 xflflfr.exe 2636 5htttn.exe 1816 bnhhhb.exe 1936 pjddj.exe 2332 ppvvv.exe 1672 5nhhnt.exe 1216 bnthhb.exe 2420 ddjjp.exe 1660 9lxrlff.exe 1964 7flrxxx.exe 1600 7hhttn.exe 2424 jjvjd.exe 1256 jvpjj.exe 1924 lllrrxf.exe 688 rfrxfrr.exe 1492 nbhnnt.exe 3052 1tnhnn.exe 1860 jjdjv.exe -
resource yara_rule behavioral1/memory/1204-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1192-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1600-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1292-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/296-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1328-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1940 wrote to memory of 1204 1940 097c152c6cd4b8b5afabe3bb3fd7c1b0_NEAS.exe 28 PID 1940 wrote to memory of 1204 1940 097c152c6cd4b8b5afabe3bb3fd7c1b0_NEAS.exe 28 PID 1940 wrote to memory of 1204 1940 097c152c6cd4b8b5afabe3bb3fd7c1b0_NEAS.exe 28 PID 1940 wrote to memory of 1204 1940 097c152c6cd4b8b5afabe3bb3fd7c1b0_NEAS.exe 28 PID 1204 wrote to memory of 2796 1204 9frflff.exe 29 PID 1204 wrote to memory of 2796 1204 9frflff.exe 29 PID 1204 wrote to memory of 2796 1204 9frflff.exe 29 PID 1204 wrote to memory of 2796 1204 9frflff.exe 29 PID 2796 wrote to memory of 2556 2796 tntnbh.exe 30 PID 2796 wrote to memory of 2556 2796 tntnbh.exe 30 PID 2796 wrote to memory of 2556 2796 tntnbh.exe 30 PID 2796 wrote to memory of 2556 2796 tntnbh.exe 30 PID 2556 wrote to memory of 2728 2556 dpvjd.exe 31 PID 2556 wrote to memory of 2728 2556 dpvjd.exe 31 PID 2556 wrote to memory of 2728 2556 dpvjd.exe 31 PID 2556 wrote to memory of 2728 2556 dpvjd.exe 31 PID 2728 wrote to memory of 2456 2728 9frrlff.exe 32 PID 2728 wrote to memory of 2456 2728 9frrlff.exe 32 PID 2728 wrote to memory of 2456 2728 9frrlff.exe 32 PID 2728 wrote to memory of 2456 2728 9frrlff.exe 32 PID 2456 wrote to memory of 2808 2456 5tbtbt.exe 33 PID 2456 wrote to memory of 2808 2456 5tbtbt.exe 33 PID 2456 wrote to memory of 2808 2456 5tbtbt.exe 33 PID 2456 wrote to memory of 2808 2456 5tbtbt.exe 33 PID 2808 wrote to memory of 2560 2808 1hnntb.exe 34 PID 2808 wrote to memory of 2560 2808 1hnntb.exe 34 PID 2808 wrote to memory of 2560 2808 1hnntb.exe 34 PID 2808 wrote to memory of 2560 2808 1hnntb.exe 34 PID 2560 wrote to memory of 2512 2560 dvjpv.exe 35 PID 2560 wrote to memory of 2512 2560 dvjpv.exe 35 PID 2560 wrote to memory of 2512 2560 dvjpv.exe 35 PID 2560 wrote to memory of 2512 2560 dvjpv.exe 35 PID 2512 wrote to memory of 2944 2512 lllxffr.exe 36 PID 2512 wrote to memory of 2944 2512 lllxffr.exe 36 PID 2512 wrote to memory of 2944 2512 lllxffr.exe 36 PID 2512 wrote to memory of 2944 2512 lllxffr.exe 36 PID 2944 wrote to memory of 2660 2944 bthnbb.exe 37 PID 2944 wrote to memory of 2660 2944 bthnbb.exe 37 PID 2944 wrote to memory of 2660 2944 bthnbb.exe 37 PID 2944 wrote to memory of 2660 2944 bthnbb.exe 37 PID 2660 wrote to memory of 2680 2660 jjvvp.exe 38 PID 2660 wrote to memory of 2680 2660 jjvvp.exe 38 PID 2660 wrote to memory of 2680 2660 jjvvp.exe 38 PID 2660 wrote to memory of 2680 2660 jjvvp.exe 38 PID 2680 wrote to memory of 2812 2680 pvjdd.exe 39 PID 2680 wrote to memory of 2812 2680 pvjdd.exe 39 PID 2680 wrote to memory of 2812 2680 pvjdd.exe 39 PID 2680 wrote to memory of 2812 2680 pvjdd.exe 39 PID 2812 wrote to memory of 1192 2812 nnnhbh.exe 40 PID 2812 wrote to memory of 1192 2812 nnnhbh.exe 40 PID 2812 wrote to memory of 1192 2812 nnnhbh.exe 40 PID 2812 wrote to memory of 1192 2812 nnnhbh.exe 40 PID 1192 wrote to memory of 1448 1192 vppvj.exe 41 PID 1192 wrote to memory of 1448 1192 vppvj.exe 41 PID 1192 wrote to memory of 1448 1192 vppvj.exe 41 PID 1192 wrote to memory of 1448 1192 vppvj.exe 41 PID 1448 wrote to memory of 1784 1448 9btttt.exe 42 PID 1448 wrote to memory of 1784 1448 9btttt.exe 42 PID 1448 wrote to memory of 1784 1448 9btttt.exe 42 PID 1448 wrote to memory of 1784 1448 9btttt.exe 42 PID 1784 wrote to memory of 1696 1784 vjjpv.exe 43 PID 1784 wrote to memory of 1696 1784 vjjpv.exe 43 PID 1784 wrote to memory of 1696 1784 vjjpv.exe 43 PID 1784 wrote to memory of 1696 1784 vjjpv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\097c152c6cd4b8b5afabe3bb3fd7c1b0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\097c152c6cd4b8b5afabe3bb3fd7c1b0_NEAS.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\9frflff.exec:\9frflff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\tntnbh.exec:\tntnbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\dpvjd.exec:\dpvjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\9frrlff.exec:\9frrlff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\5tbtbt.exec:\5tbtbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\1hnntb.exec:\1hnntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\dvjpv.exec:\dvjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\lllxffr.exec:\lllxffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\bthnbb.exec:\bthnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\jjvvp.exec:\jjvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\pvjdd.exec:\pvjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\nnnhbh.exec:\nnnhbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\vppvj.exec:\vppvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\9btttt.exec:\9btttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\vjjpv.exec:\vjjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\9xffrll.exec:\9xffrll.exe17⤵
- Executes dropped EXE
PID:1696 -
\??\c:\bnbbhb.exec:\bnbbhb.exe18⤵
- Executes dropped EXE
PID:1964 -
\??\c:\1vddv.exec:\1vddv.exe19⤵
- Executes dropped EXE
PID:1600 -
\??\c:\5rfffrx.exec:\5rfffrx.exe20⤵
- Executes dropped EXE
PID:1292 -
\??\c:\3bbnnh.exec:\3bbnnh.exe21⤵
- Executes dropped EXE
PID:2876 -
\??\c:\htbbbt.exec:\htbbbt.exe22⤵
- Executes dropped EXE
PID:664 -
\??\c:\1vdjp.exec:\1vdjp.exe23⤵
- Executes dropped EXE
PID:2204 -
\??\c:\3flfxll.exec:\3flfxll.exe24⤵
- Executes dropped EXE
PID:1104 -
\??\c:\nhbtht.exec:\nhbtht.exe25⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jpvjd.exec:\jpvjd.exe26⤵
- Executes dropped EXE
PID:296 -
\??\c:\3flxxxf.exec:\3flxxxf.exe27⤵
- Executes dropped EXE
PID:1328 -
\??\c:\tnttnh.exec:\tnttnh.exe28⤵
- Executes dropped EXE
PID:1664 -
\??\c:\1dvjp.exec:\1dvjp.exe29⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xxrrffr.exec:\xxrrffr.exe30⤵
- Executes dropped EXE
PID:836 -
\??\c:\fxllxxf.exec:\fxllxxf.exe31⤵
- Executes dropped EXE
PID:1316 -
\??\c:\bbthtt.exec:\bbthtt.exe32⤵
- Executes dropped EXE
PID:2120 -
\??\c:\fxllxfr.exec:\fxllxfr.exe33⤵
- Executes dropped EXE
PID:3016 -
\??\c:\ffxfxlx.exec:\ffxfxlx.exe34⤵
- Executes dropped EXE
PID:3036 -
\??\c:\5bntbb.exec:\5bntbb.exe35⤵
- Executes dropped EXE
PID:3064 -
\??\c:\vjvpj.exec:\vjvpj.exe36⤵
- Executes dropped EXE
PID:1604 -
\??\c:\jvddj.exec:\jvddj.exe37⤵
- Executes dropped EXE
PID:1408 -
\??\c:\lxxlfxx.exec:\lxxlfxx.exe38⤵
- Executes dropped EXE
PID:2392 -
\??\c:\bnthnh.exec:\bnthnh.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\hbhttn.exec:\hbhttn.exe40⤵
- Executes dropped EXE
PID:2564 -
\??\c:\7vdpp.exec:\7vdpp.exe41⤵
- Executes dropped EXE
PID:2964 -
\??\c:\5fllfrr.exec:\5fllfrr.exe42⤵
- Executes dropped EXE
PID:2476 -
\??\c:\lxfrrll.exec:\lxfrrll.exe43⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nhnbhn.exec:\nhnbhn.exe44⤵
- Executes dropped EXE
PID:2736 -
\??\c:\ththnb.exec:\ththnb.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\7jvvd.exec:\7jvvd.exe46⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ffllxff.exec:\ffllxff.exe47⤵
- Executes dropped EXE
PID:2676 -
\??\c:\xflflfr.exec:\xflflfr.exe48⤵
- Executes dropped EXE
PID:2752 -
\??\c:\5htttn.exec:\5htttn.exe49⤵
- Executes dropped EXE
PID:2636 -
\??\c:\bnhhhb.exec:\bnhhhb.exe50⤵
- Executes dropped EXE
PID:1816 -
\??\c:\pjddj.exec:\pjddj.exe51⤵
- Executes dropped EXE
PID:1936 -
\??\c:\ppvvv.exec:\ppvvv.exe52⤵
- Executes dropped EXE
PID:2332 -
\??\c:\5nhhnt.exec:\5nhhnt.exe53⤵
- Executes dropped EXE
PID:1672 -
\??\c:\bnthhb.exec:\bnthhb.exe54⤵
- Executes dropped EXE
PID:1216 -
\??\c:\ddjjp.exec:\ddjjp.exe55⤵
- Executes dropped EXE
PID:2420 -
\??\c:\9lxrlff.exec:\9lxrlff.exe56⤵
- Executes dropped EXE
PID:1660 -
\??\c:\7flrxxx.exec:\7flrxxx.exe57⤵
- Executes dropped EXE
PID:1964 -
\??\c:\7hhttn.exec:\7hhttn.exe58⤵
- Executes dropped EXE
PID:1600 -
\??\c:\jjvjd.exec:\jjvjd.exe59⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jvpjj.exec:\jvpjj.exe60⤵
- Executes dropped EXE
PID:1256 -
\??\c:\lllrrxf.exec:\lllrrxf.exe61⤵
- Executes dropped EXE
PID:1924 -
\??\c:\rfrxfrr.exec:\rfrxfrr.exe62⤵
- Executes dropped EXE
PID:688 -
\??\c:\nbhnnt.exec:\nbhnnt.exe63⤵
- Executes dropped EXE
PID:1492 -
\??\c:\1tnhnn.exec:\1tnhnn.exe64⤵
- Executes dropped EXE
PID:3052 -
\??\c:\jjdjv.exec:\jjdjv.exe65⤵
- Executes dropped EXE
PID:1860 -
\??\c:\rfxxrrx.exec:\rfxxrrx.exe66⤵PID:2840
-
\??\c:\frxrrll.exec:\frxrrll.exe67⤵PID:1872
-
\??\c:\bnttbt.exec:\bnttbt.exe68⤵PID:1708
-
\??\c:\ttnthb.exec:\ttnthb.exe69⤵PID:1624
-
\??\c:\jdpvd.exec:\jdpvd.exe70⤵PID:928
-
\??\c:\5lxfllr.exec:\5lxfllr.exe71⤵PID:2400
-
\??\c:\lfllrlr.exec:\lfllrlr.exe72⤵PID:1512
-
\??\c:\nhhntt.exec:\nhhntt.exe73⤵PID:944
-
\??\c:\bthntn.exec:\bthntn.exe74⤵PID:1312
-
\??\c:\7djpd.exec:\7djpd.exe75⤵PID:2896
-
\??\c:\1llfffx.exec:\1llfffx.exe76⤵PID:2540
-
\??\c:\rfffffl.exec:\rfffffl.exe77⤵PID:1244
-
\??\c:\tnhtbb.exec:\tnhtbb.exe78⤵PID:1720
-
\??\c:\9bttbh.exec:\9bttbh.exe79⤵PID:2304
-
\??\c:\7vjdd.exec:\7vjdd.exe80⤵PID:2864
-
\??\c:\7pdjp.exec:\7pdjp.exe81⤵PID:2732
-
\??\c:\lxlxrlf.exec:\lxlxrlf.exe82⤵PID:2716
-
\??\c:\htnnbb.exec:\htnnbb.exe83⤵PID:2780
-
\??\c:\3tbnnh.exec:\3tbnnh.exe84⤵PID:2216
-
\??\c:\pddvd.exec:\pddvd.exe85⤵PID:2788
-
\??\c:\xrlllll.exec:\xrlllll.exe86⤵PID:2940
-
\??\c:\5fllxxl.exec:\5fllxxl.exe87⤵PID:2512
-
\??\c:\tbthth.exec:\tbthth.exe88⤵PID:2140
-
\??\c:\thbbnt.exec:\thbbnt.exe89⤵PID:2660
-
\??\c:\pjpvv.exec:\pjpvv.exe90⤵PID:1792
-
\??\c:\lxllllr.exec:\lxllllr.exe91⤵PID:2164
-
\??\c:\rlrflff.exec:\rlrflff.exe92⤵PID:1996
-
\??\c:\9rxfxxx.exec:\9rxfxxx.exe93⤵PID:2836
-
\??\c:\9thttt.exec:\9thttt.exe94⤵PID:376
-
\??\c:\jdpvd.exec:\jdpvd.exe95⤵PID:2016
-
\??\c:\dvdjp.exec:\dvdjp.exe96⤵PID:1784
-
\??\c:\rlxxfff.exec:\rlxxfff.exe97⤵PID:2408
-
\??\c:\3ntntn.exec:\3ntntn.exe98⤵PID:2364
-
\??\c:\nhbhtn.exec:\nhbhtn.exe99⤵PID:1820
-
\??\c:\jdvvj.exec:\jdvvj.exe100⤵PID:2272
-
\??\c:\pjvdj.exec:\pjvdj.exe101⤵PID:2280
-
\??\c:\xlrfxrr.exec:\xlrfxrr.exe102⤵PID:2248
-
\??\c:\rrflxxl.exec:\rrflxxl.exe103⤵PID:2292
-
\??\c:\1ntbhn.exec:\1ntbhn.exe104⤵PID:2276
-
\??\c:\vjvdd.exec:\vjvdd.exe105⤵PID:1500
-
\??\c:\pjvpp.exec:\pjvpp.exe106⤵PID:1104
-
\??\c:\7frxxff.exec:\7frxxff.exe107⤵PID:1788
-
\??\c:\httntn.exec:\httntn.exe108⤵PID:3060
-
\??\c:\tnbbht.exec:\tnbbht.exe109⤵PID:1628
-
\??\c:\jvdvd.exec:\jvdvd.exe110⤵PID:1800
-
\??\c:\pjvvd.exec:\pjvvd.exe111⤵PID:1768
-
\??\c:\lrfffrx.exec:\lrfffrx.exe112⤵PID:1340
-
\??\c:\nhthtn.exec:\nhthtn.exe113⤵PID:612
-
\??\c:\thnbbn.exec:\thnbbn.exe114⤵PID:1516
-
\??\c:\ppddp.exec:\ppddp.exe115⤵PID:1752
-
\??\c:\vdjjd.exec:\vdjjd.exe116⤵PID:2920
-
\??\c:\rflllrr.exec:\rflllrr.exe117⤵PID:2396
-
\??\c:\rlrxxxx.exec:\rlrxxxx.exe118⤵PID:1508
-
\??\c:\thhhnh.exec:\thhhnh.exe119⤵PID:1616
-
\??\c:\bntthn.exec:\bntthn.exe120⤵PID:2592
-
\??\c:\1jdjp.exec:\1jdjp.exe121⤵PID:2712
-
\??\c:\lxfxxxl.exec:\lxfxxxl.exe122⤵PID:1412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-