Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 01:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
41e6e4899d212578ef8ac005908330c0.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
41e6e4899d212578ef8ac005908330c0.exe
-
Size
68KB
-
MD5
41e6e4899d212578ef8ac005908330c0
-
SHA1
0f00659260342edc5775d9ca7a901f284dcc8a38
-
SHA256
92de4763d29a69f2860c169e4eb8b1d35e9ecdba000f6e3a7f03e3b14bd6bea2
-
SHA512
e9291975f6fbeb3949cc5e72cb6f0f7d29f3263849c2a2421f17909b99611946d14ca222b833aadb7b18d1f36d0aac8490fb72dfd20ca332a415cc79d5d70957
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89JgVj:ymb3NkkiQ3mdBjFIvl358nLA89m5
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1868-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-82-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1544-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/108-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/532-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1308-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1372-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1996 1hbhbh.exe 2952 ddvvd.exe 2712 lrfxrfx.exe 2620 nhnbtt.exe 1152 vdvdj.exe 2656 lfrrrrf.exe 2500 3tntbh.exe 2888 jjdpj.exe 2192 jddpj.exe 1544 rrxflrx.exe 1596 nhhhnn.exe 108 7vpdj.exe 2420 7jvvv.exe 768 ffxrfrr.exe 1864 7lflxlf.exe 2044 nbnbnt.exe 1372 9nnbbb.exe 2788 9pjdj.exe 2368 jdjpd.exe 2016 pppdd.exe 532 lrlxlrf.exe 872 fffrflx.exe 1060 bthhnt.exe 1732 nhthtt.exe 3048 5jjjv.exe 1308 vpddj.exe 1720 lxlrfxl.exe 564 llxxfff.exe 1904 tthhbb.exe 352 7nbntb.exe 2776 pjjvd.exe 1552 dvpdp.exe 2928 vvvdp.exe 2164 fxxflfl.exe 1996 rxflfll.exe 1584 rfxrffr.exe 2824 nnthnt.exe 2612 nhtbhn.exe 2992 1nbttt.exe 2744 vdpvv.exe 1152 ddppj.exe 2688 jjdpd.exe 2544 vpvdj.exe 2920 lfxxfxl.exe 3060 xfflflf.exe 1892 hbnbnb.exe 2376 bnthnt.exe 1544 3btttt.exe 1968 jdjpj.exe 2460 dvdjp.exe 1520 pjppd.exe 1016 fxllrrl.exe 2208 7lflrrx.exe 868 rlfrrfl.exe 2796 hhttbh.exe 2336 nththh.exe 1848 nnbnth.exe 2372 jpppv.exe 700 dvjvd.exe 580 pjvvj.exe 2464 lfrrrrf.exe 2764 fflrfrl.exe 2392 fxxxxxl.exe 1680 ttthth.exe -
resource yara_rule behavioral1/memory/1868-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1544-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/108-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1308-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1372-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-165-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1868 wrote to memory of 1996 1868 41e6e4899d212578ef8ac005908330c0.exe 28 PID 1868 wrote to memory of 1996 1868 41e6e4899d212578ef8ac005908330c0.exe 28 PID 1868 wrote to memory of 1996 1868 41e6e4899d212578ef8ac005908330c0.exe 28 PID 1868 wrote to memory of 1996 1868 41e6e4899d212578ef8ac005908330c0.exe 28 PID 1996 wrote to memory of 2952 1996 1hbhbh.exe 29 PID 1996 wrote to memory of 2952 1996 1hbhbh.exe 29 PID 1996 wrote to memory of 2952 1996 1hbhbh.exe 29 PID 1996 wrote to memory of 2952 1996 1hbhbh.exe 29 PID 2952 wrote to memory of 2712 2952 ddvvd.exe 30 PID 2952 wrote to memory of 2712 2952 ddvvd.exe 30 PID 2952 wrote to memory of 2712 2952 ddvvd.exe 30 PID 2952 wrote to memory of 2712 2952 ddvvd.exe 30 PID 2712 wrote to memory of 2620 2712 lrfxrfx.exe 31 PID 2712 wrote to memory of 2620 2712 lrfxrfx.exe 31 PID 2712 wrote to memory of 2620 2712 lrfxrfx.exe 31 PID 2712 wrote to memory of 2620 2712 lrfxrfx.exe 31 PID 2620 wrote to memory of 1152 2620 nhnbtt.exe 32 PID 2620 wrote to memory of 1152 2620 nhnbtt.exe 32 PID 2620 wrote to memory of 1152 2620 nhnbtt.exe 32 PID 2620 wrote to memory of 1152 2620 nhnbtt.exe 32 PID 1152 wrote to memory of 2656 1152 vdvdj.exe 33 PID 1152 wrote to memory of 2656 1152 vdvdj.exe 33 PID 1152 wrote to memory of 2656 1152 vdvdj.exe 33 PID 1152 wrote to memory of 2656 1152 vdvdj.exe 33 PID 2656 wrote to memory of 2500 2656 lfrrrrf.exe 34 PID 2656 wrote to memory of 2500 2656 lfrrrrf.exe 34 PID 2656 wrote to memory of 2500 2656 lfrrrrf.exe 34 PID 2656 wrote to memory of 2500 2656 lfrrrrf.exe 34 PID 2500 wrote to memory of 2888 2500 3tntbh.exe 35 PID 2500 wrote to memory of 2888 2500 3tntbh.exe 35 PID 2500 wrote to memory of 2888 2500 3tntbh.exe 35 PID 2500 wrote to memory of 2888 2500 3tntbh.exe 35 PID 2888 wrote to memory of 2192 2888 jjdpj.exe 36 PID 2888 wrote to memory of 2192 2888 jjdpj.exe 36 PID 2888 wrote to memory of 2192 2888 jjdpj.exe 36 PID 2888 wrote to memory of 2192 2888 jjdpj.exe 36 PID 2192 wrote to memory of 1544 2192 jddpj.exe 37 PID 2192 wrote to memory of 1544 2192 jddpj.exe 37 PID 2192 wrote to memory of 1544 2192 jddpj.exe 37 PID 2192 wrote to memory of 1544 2192 jddpj.exe 37 PID 1544 wrote to memory of 1596 1544 rrxflrx.exe 38 PID 1544 wrote to memory of 1596 1544 rrxflrx.exe 38 PID 1544 wrote to memory of 1596 1544 rrxflrx.exe 38 PID 1544 wrote to memory of 1596 1544 rrxflrx.exe 38 PID 1596 wrote to memory of 108 1596 nhhhnn.exe 39 PID 1596 wrote to memory of 108 1596 nhhhnn.exe 39 PID 1596 wrote to memory of 108 1596 nhhhnn.exe 39 PID 1596 wrote to memory of 108 1596 nhhhnn.exe 39 PID 108 wrote to memory of 2420 108 7vpdj.exe 40 PID 108 wrote to memory of 2420 108 7vpdj.exe 40 PID 108 wrote to memory of 2420 108 7vpdj.exe 40 PID 108 wrote to memory of 2420 108 7vpdj.exe 40 PID 2420 wrote to memory of 768 2420 7jvvv.exe 41 PID 2420 wrote to memory of 768 2420 7jvvv.exe 41 PID 2420 wrote to memory of 768 2420 7jvvv.exe 41 PID 2420 wrote to memory of 768 2420 7jvvv.exe 41 PID 768 wrote to memory of 1864 768 ffxrfrr.exe 42 PID 768 wrote to memory of 1864 768 ffxrfrr.exe 42 PID 768 wrote to memory of 1864 768 ffxrfrr.exe 42 PID 768 wrote to memory of 1864 768 ffxrfrr.exe 42 PID 1864 wrote to memory of 2044 1864 7lflxlf.exe 166 PID 1864 wrote to memory of 2044 1864 7lflxlf.exe 166 PID 1864 wrote to memory of 2044 1864 7lflxlf.exe 166 PID 1864 wrote to memory of 2044 1864 7lflxlf.exe 166
Processes
-
C:\Users\Admin\AppData\Local\Temp\41e6e4899d212578ef8ac005908330c0.exe"C:\Users\Admin\AppData\Local\Temp\41e6e4899d212578ef8ac005908330c0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\1hbhbh.exec:\1hbhbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\ddvvd.exec:\ddvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\lrfxrfx.exec:\lrfxrfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\nhnbtt.exec:\nhnbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\vdvdj.exec:\vdvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\lfrrrrf.exec:\lfrrrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\3tntbh.exec:\3tntbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\jjdpj.exec:\jjdpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\jddpj.exec:\jddpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\rrxflrx.exec:\rrxflrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\nhhhnn.exec:\nhhhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\7vpdj.exec:\7vpdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
\??\c:\7jvvv.exec:\7jvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\ffxrfrr.exec:\ffxrfrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\7lflxlf.exec:\7lflxlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\nbnbnt.exec:\nbnbnt.exe17⤵
- Executes dropped EXE
PID:2044 -
\??\c:\9nnbbb.exec:\9nnbbb.exe18⤵
- Executes dropped EXE
PID:1372 -
\??\c:\9pjdj.exec:\9pjdj.exe19⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jdjpd.exec:\jdjpd.exe20⤵
- Executes dropped EXE
PID:2368 -
\??\c:\pppdd.exec:\pppdd.exe21⤵
- Executes dropped EXE
PID:2016 -
\??\c:\lrlxlrf.exec:\lrlxlrf.exe22⤵
- Executes dropped EXE
PID:532 -
\??\c:\fffrflx.exec:\fffrflx.exe23⤵
- Executes dropped EXE
PID:872 -
\??\c:\bthhnt.exec:\bthhnt.exe24⤵
- Executes dropped EXE
PID:1060 -
\??\c:\nhthtt.exec:\nhthtt.exe25⤵
- Executes dropped EXE
PID:1732 -
\??\c:\5jjjv.exec:\5jjjv.exe26⤵
- Executes dropped EXE
PID:3048 -
\??\c:\vpddj.exec:\vpddj.exe27⤵
- Executes dropped EXE
PID:1308 -
\??\c:\lxlrfxl.exec:\lxlrfxl.exe28⤵
- Executes dropped EXE
PID:1720 -
\??\c:\llxxfff.exec:\llxxfff.exe29⤵
- Executes dropped EXE
PID:564 -
\??\c:\tthhbb.exec:\tthhbb.exe30⤵
- Executes dropped EXE
PID:1904 -
\??\c:\7nbntb.exec:\7nbntb.exe31⤵
- Executes dropped EXE
PID:352 -
\??\c:\pjjvd.exec:\pjjvd.exe32⤵
- Executes dropped EXE
PID:2776 -
\??\c:\dvpdp.exec:\dvpdp.exe33⤵
- Executes dropped EXE
PID:1552 -
\??\c:\vvvdp.exec:\vvvdp.exe34⤵
- Executes dropped EXE
PID:2928 -
\??\c:\fxxflfl.exec:\fxxflfl.exe35⤵
- Executes dropped EXE
PID:2164 -
\??\c:\rxflfll.exec:\rxflfll.exe36⤵
- Executes dropped EXE
PID:1996 -
\??\c:\rfxrffr.exec:\rfxrffr.exe37⤵
- Executes dropped EXE
PID:1584 -
\??\c:\nnthnt.exec:\nnthnt.exe38⤵
- Executes dropped EXE
PID:2824 -
\??\c:\nhtbhn.exec:\nhtbhn.exe39⤵
- Executes dropped EXE
PID:2612 -
\??\c:\1nbttt.exec:\1nbttt.exe40⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vdpvv.exec:\vdpvv.exe41⤵
- Executes dropped EXE
PID:2744 -
\??\c:\ddppj.exec:\ddppj.exe42⤵
- Executes dropped EXE
PID:1152 -
\??\c:\jjdpd.exec:\jjdpd.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\vpvdj.exec:\vpvdj.exe44⤵
- Executes dropped EXE
PID:2544 -
\??\c:\lfxxfxl.exec:\lfxxfxl.exe45⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xfflflf.exec:\xfflflf.exe46⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hbnbnb.exec:\hbnbnb.exe47⤵
- Executes dropped EXE
PID:1892 -
\??\c:\bnthnt.exec:\bnthnt.exe48⤵
- Executes dropped EXE
PID:2376 -
\??\c:\3btttt.exec:\3btttt.exe49⤵
- Executes dropped EXE
PID:1544 -
\??\c:\jdjpj.exec:\jdjpj.exe50⤵
- Executes dropped EXE
PID:1968 -
\??\c:\dvdjp.exec:\dvdjp.exe51⤵
- Executes dropped EXE
PID:2460 -
\??\c:\pjppd.exec:\pjppd.exe52⤵
- Executes dropped EXE
PID:1520 -
\??\c:\fxllrrl.exec:\fxllrrl.exe53⤵
- Executes dropped EXE
PID:1016 -
\??\c:\7lflrrx.exec:\7lflrrx.exe54⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rlfrrfl.exec:\rlfrrfl.exe55⤵
- Executes dropped EXE
PID:868 -
\??\c:\hhttbh.exec:\hhttbh.exe56⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nththh.exec:\nththh.exe57⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nnbnth.exec:\nnbnth.exe58⤵
- Executes dropped EXE
PID:1848 -
\??\c:\jpppv.exec:\jpppv.exe59⤵
- Executes dropped EXE
PID:2372 -
\??\c:\dvjvd.exec:\dvjvd.exe60⤵
- Executes dropped EXE
PID:700 -
\??\c:\pjvvj.exec:\pjvvj.exe61⤵
- Executes dropped EXE
PID:580 -
\??\c:\lfrrrrf.exec:\lfrrrrf.exe62⤵
- Executes dropped EXE
PID:2464 -
\??\c:\fflrfrl.exec:\fflrfrl.exe63⤵
- Executes dropped EXE
PID:2764 -
\??\c:\fxxxxxl.exec:\fxxxxxl.exe64⤵
- Executes dropped EXE
PID:2392 -
\??\c:\ttthth.exec:\ttthth.exe65⤵
- Executes dropped EXE
PID:1680 -
\??\c:\3btbhn.exec:\3btbhn.exe66⤵PID:1216
-
\??\c:\tnbnbb.exec:\tnbnbb.exe67⤵PID:1220
-
\??\c:\ddjjp.exec:\ddjjp.exe68⤵PID:688
-
\??\c:\jdvdp.exec:\jdvdp.exe69⤵PID:2032
-
\??\c:\vpvvd.exec:\vpvvd.exe70⤵PID:340
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe71⤵PID:336
-
\??\c:\btnntb.exec:\btnntb.exe72⤵PID:1320
-
\??\c:\5ppdj.exec:\5ppdj.exe73⤵PID:2908
-
\??\c:\ddpjj.exec:\ddpjj.exe74⤵PID:920
-
\??\c:\djvjp.exec:\djvjp.exe75⤵PID:2808
-
\??\c:\rfxlrlx.exec:\rfxlrlx.exe76⤵PID:2748
-
\??\c:\lflxffl.exec:\lflxffl.exe77⤵PID:2164
-
\??\c:\llxrxxl.exec:\llxrxxl.exe78⤵PID:2056
-
\??\c:\bbthtb.exec:\bbthtb.exe79⤵PID:2732
-
\??\c:\tnbnhn.exec:\tnbnhn.exe80⤵PID:2280
-
\??\c:\btbhtb.exec:\btbhtb.exe81⤵PID:2492
-
\??\c:\vpvvj.exec:\vpvvj.exe82⤵PID:2720
-
\??\c:\vjpdj.exec:\vjpdj.exe83⤵PID:2784
-
\??\c:\7pjdj.exec:\7pjdj.exe84⤵PID:2620
-
\??\c:\flrrfxx.exec:\flrrfxx.exe85⤵PID:2480
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe86⤵PID:2484
-
\??\c:\lfrxxrx.exec:\lfrxxrx.exe87⤵PID:2516
-
\??\c:\btnbhh.exec:\btnbhh.exe88⤵PID:2892
-
\??\c:\3bttbt.exec:\3bttbt.exe89⤵PID:2904
-
\??\c:\ttbbhb.exec:\ttbbhb.exe90⤵PID:796
-
\??\c:\dvjpd.exec:\dvjpd.exe91⤵PID:1728
-
\??\c:\9vjjv.exec:\9vjjv.exe92⤵PID:2152
-
\??\c:\1jvdd.exec:\1jvdd.exe93⤵PID:1784
-
\??\c:\pppvd.exec:\pppvd.exe94⤵PID:108
-
\??\c:\rrflffr.exec:\rrflffr.exe95⤵PID:1640
-
\??\c:\ffllxxf.exec:\ffllxxf.exe96⤵PID:1796
-
\??\c:\xrxlrfr.exec:\xrxlrfr.exe97⤵PID:1328
-
\??\c:\5bntbb.exec:\5bntbb.exe98⤵PID:2136
-
\??\c:\bthttb.exec:\bthttb.exe99⤵PID:2028
-
\??\c:\9nntbb.exec:\9nntbb.exe100⤵PID:376
-
\??\c:\3ddpv.exec:\3ddpv.exe101⤵PID:1628
-
\??\c:\pjdpd.exec:\pjdpd.exe102⤵PID:1952
-
\??\c:\7jjdp.exec:\7jjdp.exe103⤵PID:1416
-
\??\c:\7frrrfl.exec:\7frrrfl.exe104⤵PID:2468
-
\??\c:\fxlrflx.exec:\fxlrflx.exe105⤵PID:2876
-
\??\c:\xrrfrxl.exec:\xrrfrxl.exe106⤵PID:1760
-
\??\c:\hbtnnt.exec:\hbtnnt.exe107⤵PID:960
-
\??\c:\bbthhn.exec:\bbthhn.exe108⤵PID:1948
-
\??\c:\tbbnht.exec:\tbbnht.exe109⤵PID:2976
-
\??\c:\pjpjv.exec:\pjpjv.exe110⤵PID:292
-
\??\c:\jdvdp.exec:\jdvdp.exe111⤵PID:2340
-
\??\c:\3vpvd.exec:\3vpvd.exe112⤵PID:2088
-
\??\c:\dpjvj.exec:\dpjvj.exe113⤵PID:2972
-
\??\c:\1xllxxl.exec:\1xllxxl.exe114⤵PID:836
-
\??\c:\xxrrffx.exec:\xxrrffx.exe115⤵PID:572
-
\??\c:\flxxfxr.exec:\flxxfxr.exe116⤵PID:912
-
\??\c:\bbhhbh.exec:\bbhhbh.exe117⤵PID:652
-
\??\c:\ntbbbt.exec:\ntbbbt.exe118⤵PID:1868
-
\??\c:\vpvvd.exec:\vpvvd.exe119⤵PID:2628
-
\??\c:\vvpjp.exec:\vvpjp.exe120⤵PID:1508
-
\??\c:\vjvdp.exec:\vjvdp.exe121⤵PID:2632
-
\??\c:\xrxlrxl.exec:\xrxlrxl.exe122⤵PID:2820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-