Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 02:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1dfc3c455520865c51ba9cccc3ae4ba0.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
1dfc3c455520865c51ba9cccc3ae4ba0.exe
-
Size
395KB
-
MD5
1dfc3c455520865c51ba9cccc3ae4ba0
-
SHA1
5d91cd0183b7db711e7e06c2956b61a356504c4c
-
SHA256
c5beca852b52c594771e5bc75740a1d4e3c5dfd54e5826a05ad499b4164fea2c
-
SHA512
46c515138f8e030736a104945bae716908ecf9e229fc8bc2f1ccc8d6abd1b6570fcfc4ed1e09084e497d594dcc487726085ffe9d87830fb0c7e4243980f6f848
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjkobjcSbcY+CaQdaFOY4iGFYtRdul:n3C9ytvngQjZbz+xt4vFBl
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/1680-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/788-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/860-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1368-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1504-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3052 jjjpd.exe 2596 jdvjv.exe 2548 xxrlxrf.exe 2512 hhbhtb.exe 1680 hhbhnn.exe 2396 ppjdj.exe 2516 jjvdj.exe 2800 xxflxrf.exe 1664 9nhhhn.exe 1504 vpjjd.exe 1580 jjdpd.exe 2304 lrrxflr.exe 2300 tthtbh.exe 1368 jjjpd.exe 1764 1jdvj.exe 860 xrffrxl.exe 1284 hthbth.exe 1700 5vppj.exe 2768 vvvdv.exe 2128 xxxfxxl.exe 2120 hnhhnt.exe 336 hbhthn.exe 1416 ppjdp.exe 564 fxrrflr.exe 240 fxrxlrl.exe 788 bnthbh.exe 2760 pjdjd.exe 2072 jjvdd.exe 2476 lrxlrfl.exe 1012 bthnbb.exe 2064 pppdp.exe 1920 pjdjp.exe 2172 fflrflx.exe 1540 3nbbhn.exe 2608 hbtbhh.exe 2520 5jddp.exe 2552 ffrxlrl.exe 2644 flflxlx.exe 2412 bnntbh.exe 2788 tbbtht.exe 2516 9jjdj.exe 2800 rlllrxr.exe 1896 rrlrllr.exe 1476 bnnttb.exe 968 hhbhnb.exe 2184 jjvvd.exe 1488 vpddj.exe 876 lfxfflr.exe 2204 tnhhtb.exe 1360 hhhnhh.exe 2684 dvjpd.exe 2640 1pvdj.exe 2344 1rfffrf.exe 2116 fxxlrxl.exe 592 bnbntb.exe 580 jdddp.exe 632 dvppv.exe 1204 ffflxfr.exe 2924 ffxfrxl.exe 2312 nntnhb.exe 556 1nhhtb.exe 816 7pvdd.exe 2760 ffrrxrf.exe 2944 xffrflf.exe -
resource yara_rule behavioral1/memory/1680-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/788-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/860-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-3-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1992 wrote to memory of 3052 1992 1dfc3c455520865c51ba9cccc3ae4ba0.exe 28 PID 1992 wrote to memory of 3052 1992 1dfc3c455520865c51ba9cccc3ae4ba0.exe 28 PID 1992 wrote to memory of 3052 1992 1dfc3c455520865c51ba9cccc3ae4ba0.exe 28 PID 1992 wrote to memory of 3052 1992 1dfc3c455520865c51ba9cccc3ae4ba0.exe 28 PID 3052 wrote to memory of 2596 3052 jjjpd.exe 29 PID 3052 wrote to memory of 2596 3052 jjjpd.exe 29 PID 3052 wrote to memory of 2596 3052 jjjpd.exe 29 PID 3052 wrote to memory of 2596 3052 jjjpd.exe 29 PID 2596 wrote to memory of 2548 2596 jdvjv.exe 30 PID 2596 wrote to memory of 2548 2596 jdvjv.exe 30 PID 2596 wrote to memory of 2548 2596 jdvjv.exe 30 PID 2596 wrote to memory of 2548 2596 jdvjv.exe 30 PID 2548 wrote to memory of 2512 2548 xxrlxrf.exe 511 PID 2548 wrote to memory of 2512 2548 xxrlxrf.exe 511 PID 2548 wrote to memory of 2512 2548 xxrlxrf.exe 511 PID 2548 wrote to memory of 2512 2548 xxrlxrf.exe 511 PID 2512 wrote to memory of 1680 2512 hhbhtb.exe 32 PID 2512 wrote to memory of 1680 2512 hhbhtb.exe 32 PID 2512 wrote to memory of 1680 2512 hhbhtb.exe 32 PID 2512 wrote to memory of 1680 2512 hhbhtb.exe 32 PID 1680 wrote to memory of 2396 1680 hhbhnn.exe 33 PID 1680 wrote to memory of 2396 1680 hhbhnn.exe 33 PID 1680 wrote to memory of 2396 1680 hhbhnn.exe 33 PID 1680 wrote to memory of 2396 1680 hhbhnn.exe 33 PID 2396 wrote to memory of 2516 2396 ppjdj.exe 68 PID 2396 wrote to memory of 2516 2396 ppjdj.exe 68 PID 2396 wrote to memory of 2516 2396 ppjdj.exe 68 PID 2396 wrote to memory of 2516 2396 ppjdj.exe 68 PID 2516 wrote to memory of 2800 2516 jjvdj.exe 35 PID 2516 wrote to memory of 2800 2516 jjvdj.exe 35 PID 2516 wrote to memory of 2800 2516 jjvdj.exe 35 PID 2516 wrote to memory of 2800 2516 jjvdj.exe 35 PID 2800 wrote to memory of 1664 2800 xxflxrf.exe 36 PID 2800 wrote to memory of 1664 2800 xxflxrf.exe 36 PID 2800 wrote to memory of 1664 2800 xxflxrf.exe 36 PID 2800 wrote to memory of 1664 2800 xxflxrf.exe 36 PID 1664 wrote to memory of 1504 1664 9nhhhn.exe 37 PID 1664 wrote to memory of 1504 1664 9nhhhn.exe 37 PID 1664 wrote to memory of 1504 1664 9nhhhn.exe 37 PID 1664 wrote to memory of 1504 1664 9nhhhn.exe 37 PID 1504 wrote to memory of 1580 1504 vpjjd.exe 38 PID 1504 wrote to memory of 1580 1504 vpjjd.exe 38 PID 1504 wrote to memory of 1580 1504 vpjjd.exe 38 PID 1504 wrote to memory of 1580 1504 vpjjd.exe 38 PID 1580 wrote to memory of 2304 1580 jjdpd.exe 39 PID 1580 wrote to memory of 2304 1580 jjdpd.exe 39 PID 1580 wrote to memory of 2304 1580 jjdpd.exe 39 PID 1580 wrote to memory of 2304 1580 jjdpd.exe 39 PID 2304 wrote to memory of 2300 2304 lrrxflr.exe 40 PID 2304 wrote to memory of 2300 2304 lrrxflr.exe 40 PID 2304 wrote to memory of 2300 2304 lrrxflr.exe 40 PID 2304 wrote to memory of 2300 2304 lrrxflr.exe 40 PID 2300 wrote to memory of 1368 2300 tthtbh.exe 41 PID 2300 wrote to memory of 1368 2300 tthtbh.exe 41 PID 2300 wrote to memory of 1368 2300 tthtbh.exe 41 PID 2300 wrote to memory of 1368 2300 tthtbh.exe 41 PID 1368 wrote to memory of 1764 1368 jjjpd.exe 42 PID 1368 wrote to memory of 1764 1368 jjjpd.exe 42 PID 1368 wrote to memory of 1764 1368 jjjpd.exe 42 PID 1368 wrote to memory of 1764 1368 jjjpd.exe 42 PID 1764 wrote to memory of 860 1764 1jdvj.exe 43 PID 1764 wrote to memory of 860 1764 1jdvj.exe 43 PID 1764 wrote to memory of 860 1764 1jdvj.exe 43 PID 1764 wrote to memory of 860 1764 1jdvj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dfc3c455520865c51ba9cccc3ae4ba0.exe"C:\Users\Admin\AppData\Local\Temp\1dfc3c455520865c51ba9cccc3ae4ba0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\jjjpd.exec:\jjjpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\jdvjv.exec:\jdvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\xxrlxrf.exec:\xxrlxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\hhbhtb.exec:\hhbhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\hhbhnn.exec:\hhbhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\ppjdj.exec:\ppjdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\jjvdj.exec:\jjvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\xxflxrf.exec:\xxflxrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\9nhhhn.exec:\9nhhhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\vpjjd.exec:\vpjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\jjdpd.exec:\jjdpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\lrrxflr.exec:\lrrxflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\tthtbh.exec:\tthtbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\jjjpd.exec:\jjjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\1jdvj.exec:\1jdvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\xrffrxl.exec:\xrffrxl.exe17⤵
- Executes dropped EXE
PID:860 -
\??\c:\hthbth.exec:\hthbth.exe18⤵
- Executes dropped EXE
PID:1284 -
\??\c:\5vppj.exec:\5vppj.exe19⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vvvdv.exec:\vvvdv.exe20⤵
- Executes dropped EXE
PID:2768 -
\??\c:\xxxfxxl.exec:\xxxfxxl.exe21⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hnhhnt.exec:\hnhhnt.exe22⤵
- Executes dropped EXE
PID:2120 -
\??\c:\hbhthn.exec:\hbhthn.exe23⤵
- Executes dropped EXE
PID:336 -
\??\c:\ppjdp.exec:\ppjdp.exe24⤵
- Executes dropped EXE
PID:1416 -
\??\c:\fxrrflr.exec:\fxrrflr.exe25⤵
- Executes dropped EXE
PID:564 -
\??\c:\fxrxlrl.exec:\fxrxlrl.exe26⤵
- Executes dropped EXE
PID:240 -
\??\c:\bnthbh.exec:\bnthbh.exe27⤵
- Executes dropped EXE
PID:788 -
\??\c:\pjdjd.exec:\pjdjd.exe28⤵
- Executes dropped EXE
PID:2760 -
\??\c:\jjvdd.exec:\jjvdd.exe29⤵
- Executes dropped EXE
PID:2072 -
\??\c:\lrxlrfl.exec:\lrxlrfl.exe30⤵
- Executes dropped EXE
PID:2476 -
\??\c:\bthnbb.exec:\bthnbb.exe31⤵
- Executes dropped EXE
PID:1012 -
\??\c:\pppdp.exec:\pppdp.exe32⤵
- Executes dropped EXE
PID:2064 -
\??\c:\pjdjp.exec:\pjdjp.exe33⤵
- Executes dropped EXE
PID:1920 -
\??\c:\fflrflx.exec:\fflrflx.exe34⤵
- Executes dropped EXE
PID:2172 -
\??\c:\3nbbhn.exec:\3nbbhn.exe35⤵
- Executes dropped EXE
PID:1540 -
\??\c:\hbtbhh.exec:\hbtbhh.exe36⤵
- Executes dropped EXE
PID:2608 -
\??\c:\5jddp.exec:\5jddp.exe37⤵
- Executes dropped EXE
PID:2520 -
\??\c:\ffrxlrl.exec:\ffrxlrl.exe38⤵
- Executes dropped EXE
PID:2552 -
\??\c:\flflxlx.exec:\flflxlx.exe39⤵
- Executes dropped EXE
PID:2644 -
\??\c:\bnntbh.exec:\bnntbh.exe40⤵
- Executes dropped EXE
PID:2412 -
\??\c:\tbbtht.exec:\tbbtht.exe41⤵
- Executes dropped EXE
PID:2788 -
\??\c:\9jjdj.exec:\9jjdj.exe42⤵
- Executes dropped EXE
PID:2516 -
\??\c:\rlllrxr.exec:\rlllrxr.exe43⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rrlrllr.exec:\rrlrllr.exe44⤵
- Executes dropped EXE
PID:1896 -
\??\c:\bnnttb.exec:\bnnttb.exe45⤵
- Executes dropped EXE
PID:1476 -
\??\c:\hhbhnb.exec:\hhbhnb.exe46⤵
- Executes dropped EXE
PID:968 -
\??\c:\jjvvd.exec:\jjvvd.exe47⤵
- Executes dropped EXE
PID:2184 -
\??\c:\vpddj.exec:\vpddj.exe48⤵
- Executes dropped EXE
PID:1488 -
\??\c:\lfxfflr.exec:\lfxfflr.exe49⤵
- Executes dropped EXE
PID:876 -
\??\c:\tnhhtb.exec:\tnhhtb.exe50⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hhhnhh.exec:\hhhnhh.exe51⤵
- Executes dropped EXE
PID:1360 -
\??\c:\dvjpd.exec:\dvjpd.exe52⤵
- Executes dropped EXE
PID:2684 -
\??\c:\1pvdj.exec:\1pvdj.exe53⤵
- Executes dropped EXE
PID:2640 -
\??\c:\1rfffrf.exec:\1rfffrf.exe54⤵
- Executes dropped EXE
PID:2344 -
\??\c:\fxxlrxl.exec:\fxxlrxl.exe55⤵
- Executes dropped EXE
PID:2116 -
\??\c:\bnbntb.exec:\bnbntb.exe56⤵
- Executes dropped EXE
PID:592 -
\??\c:\jdddp.exec:\jdddp.exe57⤵
- Executes dropped EXE
PID:580 -
\??\c:\dvppv.exec:\dvppv.exe58⤵
- Executes dropped EXE
PID:632 -
\??\c:\ffflxfr.exec:\ffflxfr.exe59⤵
- Executes dropped EXE
PID:1204 -
\??\c:\ffxfrxl.exec:\ffxfrxl.exe60⤵
- Executes dropped EXE
PID:2924 -
\??\c:\nntnhb.exec:\nntnhb.exe61⤵
- Executes dropped EXE
PID:2312 -
\??\c:\1nhhtb.exec:\1nhhtb.exe62⤵
- Executes dropped EXE
PID:556 -
\??\c:\7pvdd.exec:\7pvdd.exe63⤵
- Executes dropped EXE
PID:816 -
\??\c:\ffrrxrf.exec:\ffrrxrf.exe64⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xffrflf.exec:\xffrflf.exe65⤵
- Executes dropped EXE
PID:2944 -
\??\c:\1bnntb.exec:\1bnntb.exe66⤵PID:2168
-
\??\c:\nbtntt.exec:\nbtntt.exe67⤵PID:628
-
\??\c:\vdpjj.exec:\vdpjj.exe68⤵PID:2816
-
\??\c:\9jddj.exec:\9jddj.exe69⤵PID:1920
-
\??\c:\llflflf.exec:\llflflf.exe70⤵PID:1992
-
\??\c:\lxrlrrx.exec:\lxrlrrx.exe71⤵PID:2624
-
\??\c:\9btbnh.exec:\9btbnh.exe72⤵PID:2596
-
\??\c:\jdppd.exec:\jdppd.exe73⤵PID:2108
-
\??\c:\rrxxxxf.exec:\rrxxxxf.exe74⤵PID:2668
-
\??\c:\rflffff.exec:\rflffff.exe75⤵PID:2392
-
\??\c:\nnbnbb.exec:\nnbnbb.exe76⤵PID:2784
-
\??\c:\nhbbnh.exec:\nhbbnh.exe77⤵PID:2584
-
\??\c:\7dppd.exec:\7dppd.exe78⤵PID:1760
-
\??\c:\vpdvd.exec:\vpdvd.exe79⤵PID:2292
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe80⤵PID:1984
-
\??\c:\ttnhth.exec:\ttnhth.exe81⤵PID:2696
-
\??\c:\hbtbbh.exec:\hbtbbh.exe82⤵PID:312
-
\??\c:\pdpvd.exec:\pdpvd.exe83⤵PID:2508
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe84⤵PID:1568
-
\??\c:\llflrxf.exec:\llflrxf.exe85⤵PID:1488
-
\??\c:\1tnntt.exec:\1tnntt.exe86⤵PID:1600
-
\??\c:\3nbttn.exec:\3nbttn.exe87⤵PID:2728
-
\??\c:\9jvdd.exec:\9jvdd.exe88⤵PID:3056
-
\??\c:\pjdjp.exec:\pjdjp.exe89⤵PID:1672
-
\??\c:\7xlrxxx.exec:\7xlrxxx.exe90⤵PID:2380
-
\??\c:\xlrxlll.exec:\xlrxlll.exe91⤵PID:1696
-
\??\c:\7nhbhn.exec:\7nhbhn.exe92⤵PID:324
-
\??\c:\1bhhhn.exec:\1bhhhn.exe93⤵PID:2120
-
\??\c:\dpvvv.exec:\dpvvv.exe94⤵PID:336
-
\??\c:\3pjdj.exec:\3pjdj.exe95⤵PID:1448
-
\??\c:\rlffrxf.exec:\rlffrxf.exe96⤵PID:632
-
\??\c:\5tnnbh.exec:\5tnnbh.exe97⤵PID:2960
-
\??\c:\3ththn.exec:\3ththn.exe98⤵PID:240
-
\??\c:\pjdjp.exec:\pjdjp.exe99⤵PID:924
-
\??\c:\7dpjv.exec:\7dpjv.exe100⤵PID:556
-
\??\c:\5xxxxfr.exec:\5xxxxfr.exe101⤵PID:2676
-
\??\c:\rlfrflf.exec:\rlfrflf.exe102⤵PID:2748
-
\??\c:\9bhhnh.exec:\9bhhnh.exe103⤵PID:2944
-
\??\c:\bthhtt.exec:\bthhtt.exe104⤵PID:2240
-
\??\c:\9pdjp.exec:\9pdjp.exe105⤵PID:1916
-
\??\c:\rlrfxrl.exec:\rlrfxrl.exe106⤵PID:2880
-
\??\c:\xfrrfxf.exec:\xfrrfxf.exe107⤵PID:880
-
\??\c:\5nhntt.exec:\5nhntt.exe108⤵PID:1540
-
\??\c:\hthhtt.exec:\hthhtt.exe109⤵PID:2604
-
\??\c:\ppvdv.exec:\ppvdv.exe110⤵PID:1596
-
\??\c:\1djjp.exec:\1djjp.exe111⤵PID:2876
-
\??\c:\fxrflrx.exec:\fxrflrx.exe112⤵PID:2580
-
\??\c:\frffrrx.exec:\frffrrx.exe113⤵PID:2668
-
\??\c:\bnbbnt.exec:\bnbbnt.exe114⤵PID:1988
-
\??\c:\htnhhn.exec:\htnhhn.exe115⤵PID:2784
-
\??\c:\jjpdd.exec:\jjpdd.exe116⤵PID:1652
-
\??\c:\pjvvd.exec:\pjvvd.exe117⤵PID:284
-
\??\c:\rllrrxf.exec:\rllrrxf.exe118⤵PID:1472
-
\??\c:\7ntntt.exec:\7ntntt.exe119⤵PID:1724
-
\??\c:\tnbbnn.exec:\tnbbnn.exe120⤵PID:1476
-
\??\c:\1ppdp.exec:\1ppdp.exe121⤵PID:968
-
\??\c:\jvjjp.exec:\jvjjp.exe122⤵PID:2328
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-