Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 18:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0458b00aab79fb5b37fc6bfd7e3f801e561b80451999bf61204b28423e956930.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
0458b00aab79fb5b37fc6bfd7e3f801e561b80451999bf61204b28423e956930.exe
-
Size
267KB
-
MD5
b068f431035f289630302b4987e0ec28
-
SHA1
0cb6c58ffd397a4af95ef4d09fae9a41e1d667e0
-
SHA256
0458b00aab79fb5b37fc6bfd7e3f801e561b80451999bf61204b28423e956930
-
SHA512
394233116f4f3b5c304d0c11b570f5ddd2dc86d550a4e7226171b89be77f9a4ed42d05c388317c1c67b78108ed77119b986239797101baab391f5d541d12a6d1
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmPzTkV2y/QTa9RBZydZbf83pnzgmmIMX:n3C9BRIG0asYFm71mPfkVB8dKwaWn
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/2984-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/796-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1044-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1304-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 22 IoCs
resource yara_rule behavioral1/memory/2984-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3056-15-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3056-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3056-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2172-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2728-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2944-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2556-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2556-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2556-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2696-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2536-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3032-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2816-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2892-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/796-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1516-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2780-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1044-238-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1304-256-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2040-292-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2428-302-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3056 dvjjp.exe 2172 dvppj.exe 2728 hbhntb.exe 2944 vpdjv.exe 2556 hhbnbb.exe 2696 pdddp.exe 2536 hhnbth.exe 3032 vpddj.exe 1916 7bbhtb.exe 2816 9pddj.exe 2892 llfflrf.exe 1572 tthtnt.exe 1780 lffrxfr.exe 348 hbbbhn.exe 796 jjdjv.exe 2508 flllrff.exe 1516 ddvdp.exe 2964 9frrflx.exe 2780 5jvvj.exe 1092 llflxlr.exe 588 nnnbbn.exe 1816 fxxlrfl.exe 2284 tbhnbn.exe 1044 pddpv.exe 1360 ntbbtt.exe 1304 vppdp.exe 1820 bbbhbh.exe 1636 vvddd.exe 2104 llflrrf.exe 2040 nnhthn.exe 2428 1fxlrrf.exe 2400 7hhbhb.exe 3048 lllrfrf.exe 2996 bbhtht.exe 3052 3hnhbn.exe 1732 ddvjv.exe 2724 rrlxlxf.exe 2676 ffrxxrr.exe 2300 bbbbnt.exe 2944 vdppv.exe 2660 lrlxrxl.exe 2576 hbnbnt.exe 2696 vjddj.exe 3024 9xrxlrf.exe 3060 3xrxrxl.exe 2792 1bbhtb.exe 2840 vpvvj.exe 2916 5rrlflr.exe 1440 rlfrffl.exe 1924 nhthnn.exe 1736 3vvdp.exe 1780 9lfrffl.exe 2592 rxlffxf.exe 1184 tnhthh.exe 1188 djjpd.exe 1388 llfrfrl.exe 2504 tnhntb.exe 2964 bbtntt.exe 1160 jdjdd.exe 1484 fxlxlxr.exe 1092 bhhhbn.exe 1492 jjdpj.exe 1816 ddvdj.exe 1156 7xrllxl.exe -
resource yara_rule behavioral1/memory/2984-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/796-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1044-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1304-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2984 wrote to memory of 3056 2984 0458b00aab79fb5b37fc6bfd7e3f801e561b80451999bf61204b28423e956930.exe 28 PID 2984 wrote to memory of 3056 2984 0458b00aab79fb5b37fc6bfd7e3f801e561b80451999bf61204b28423e956930.exe 28 PID 2984 wrote to memory of 3056 2984 0458b00aab79fb5b37fc6bfd7e3f801e561b80451999bf61204b28423e956930.exe 28 PID 2984 wrote to memory of 3056 2984 0458b00aab79fb5b37fc6bfd7e3f801e561b80451999bf61204b28423e956930.exe 28 PID 3056 wrote to memory of 2172 3056 dvjjp.exe 29 PID 3056 wrote to memory of 2172 3056 dvjjp.exe 29 PID 3056 wrote to memory of 2172 3056 dvjjp.exe 29 PID 3056 wrote to memory of 2172 3056 dvjjp.exe 29 PID 2172 wrote to memory of 2728 2172 dvppj.exe 30 PID 2172 wrote to memory of 2728 2172 dvppj.exe 30 PID 2172 wrote to memory of 2728 2172 dvppj.exe 30 PID 2172 wrote to memory of 2728 2172 dvppj.exe 30 PID 2728 wrote to memory of 2944 2728 hbhntb.exe 31 PID 2728 wrote to memory of 2944 2728 hbhntb.exe 31 PID 2728 wrote to memory of 2944 2728 hbhntb.exe 31 PID 2728 wrote to memory of 2944 2728 hbhntb.exe 31 PID 2944 wrote to memory of 2556 2944 vpdjv.exe 32 PID 2944 wrote to memory of 2556 2944 vpdjv.exe 32 PID 2944 wrote to memory of 2556 2944 vpdjv.exe 32 PID 2944 wrote to memory of 2556 2944 vpdjv.exe 32 PID 2556 wrote to memory of 2696 2556 hhbnbb.exe 33 PID 2556 wrote to memory of 2696 2556 hhbnbb.exe 33 PID 2556 wrote to memory of 2696 2556 hhbnbb.exe 33 PID 2556 wrote to memory of 2696 2556 hhbnbb.exe 33 PID 2696 wrote to memory of 2536 2696 pdddp.exe 34 PID 2696 wrote to memory of 2536 2696 pdddp.exe 34 PID 2696 wrote to memory of 2536 2696 pdddp.exe 34 PID 2696 wrote to memory of 2536 2696 pdddp.exe 34 PID 2536 wrote to memory of 3032 2536 hhnbth.exe 35 PID 2536 wrote to memory of 3032 2536 hhnbth.exe 35 PID 2536 wrote to memory of 3032 2536 hhnbth.exe 35 PID 2536 wrote to memory of 3032 2536 hhnbth.exe 35 PID 3032 wrote to memory of 1916 3032 vpddj.exe 36 PID 3032 wrote to memory of 1916 3032 vpddj.exe 36 PID 3032 wrote to memory of 1916 3032 vpddj.exe 36 PID 3032 wrote to memory of 1916 3032 vpddj.exe 36 PID 1916 wrote to memory of 2816 1916 7bbhtb.exe 37 PID 1916 wrote to memory of 2816 1916 7bbhtb.exe 37 PID 1916 wrote to memory of 2816 1916 7bbhtb.exe 37 PID 1916 wrote to memory of 2816 1916 7bbhtb.exe 37 PID 2816 wrote to memory of 2892 2816 9pddj.exe 38 PID 2816 wrote to memory of 2892 2816 9pddj.exe 38 PID 2816 wrote to memory of 2892 2816 9pddj.exe 38 PID 2816 wrote to memory of 2892 2816 9pddj.exe 38 PID 2892 wrote to memory of 1572 2892 llfflrf.exe 39 PID 2892 wrote to memory of 1572 2892 llfflrf.exe 39 PID 2892 wrote to memory of 1572 2892 llfflrf.exe 39 PID 2892 wrote to memory of 1572 2892 llfflrf.exe 39 PID 1572 wrote to memory of 1780 1572 tthtnt.exe 40 PID 1572 wrote to memory of 1780 1572 tthtnt.exe 40 PID 1572 wrote to memory of 1780 1572 tthtnt.exe 40 PID 1572 wrote to memory of 1780 1572 tthtnt.exe 40 PID 1780 wrote to memory of 348 1780 lffrxfr.exe 41 PID 1780 wrote to memory of 348 1780 lffrxfr.exe 41 PID 1780 wrote to memory of 348 1780 lffrxfr.exe 41 PID 1780 wrote to memory of 348 1780 lffrxfr.exe 41 PID 348 wrote to memory of 796 348 hbbbhn.exe 42 PID 348 wrote to memory of 796 348 hbbbhn.exe 42 PID 348 wrote to memory of 796 348 hbbbhn.exe 42 PID 348 wrote to memory of 796 348 hbbbhn.exe 42 PID 796 wrote to memory of 2508 796 jjdjv.exe 43 PID 796 wrote to memory of 2508 796 jjdjv.exe 43 PID 796 wrote to memory of 2508 796 jjdjv.exe 43 PID 796 wrote to memory of 2508 796 jjdjv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0458b00aab79fb5b37fc6bfd7e3f801e561b80451999bf61204b28423e956930.exe"C:\Users\Admin\AppData\Local\Temp\0458b00aab79fb5b37fc6bfd7e3f801e561b80451999bf61204b28423e956930.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\dvjjp.exec:\dvjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\dvppj.exec:\dvppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\hbhntb.exec:\hbhntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\vpdjv.exec:\vpdjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\hhbnbb.exec:\hhbnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\pdddp.exec:\pdddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\hhnbth.exec:\hhnbth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\vpddj.exec:\vpddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\7bbhtb.exec:\7bbhtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\9pddj.exec:\9pddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\llfflrf.exec:\llfflrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\tthtnt.exec:\tthtnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\lffrxfr.exec:\lffrxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\hbbbhn.exec:\hbbbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\jjdjv.exec:\jjdjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\flllrff.exec:\flllrff.exe17⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ddvdp.exec:\ddvdp.exe18⤵
- Executes dropped EXE
PID:1516 -
\??\c:\9frrflx.exec:\9frrflx.exe19⤵
- Executes dropped EXE
PID:2964 -
\??\c:\5jvvj.exec:\5jvvj.exe20⤵
- Executes dropped EXE
PID:2780 -
\??\c:\llflxlr.exec:\llflxlr.exe21⤵
- Executes dropped EXE
PID:1092 -
\??\c:\nnnbbn.exec:\nnnbbn.exe22⤵
- Executes dropped EXE
PID:588 -
\??\c:\fxxlrfl.exec:\fxxlrfl.exe23⤵
- Executes dropped EXE
PID:1816 -
\??\c:\tbhnbn.exec:\tbhnbn.exe24⤵
- Executes dropped EXE
PID:2284 -
\??\c:\pddpv.exec:\pddpv.exe25⤵
- Executes dropped EXE
PID:1044 -
\??\c:\ntbbtt.exec:\ntbbtt.exe26⤵
- Executes dropped EXE
PID:1360 -
\??\c:\vppdp.exec:\vppdp.exe27⤵
- Executes dropped EXE
PID:1304 -
\??\c:\bbbhbh.exec:\bbbhbh.exe28⤵
- Executes dropped EXE
PID:1820 -
\??\c:\vvddd.exec:\vvddd.exe29⤵
- Executes dropped EXE
PID:1636 -
\??\c:\llflrrf.exec:\llflrrf.exe30⤵
- Executes dropped EXE
PID:2104 -
\??\c:\nnhthn.exec:\nnhthn.exe31⤵
- Executes dropped EXE
PID:2040 -
\??\c:\1fxlrrf.exec:\1fxlrrf.exe32⤵
- Executes dropped EXE
PID:2428 -
\??\c:\7hhbhb.exec:\7hhbhb.exe33⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lllrfrf.exec:\lllrfrf.exe34⤵
- Executes dropped EXE
PID:3048 -
\??\c:\bbhtht.exec:\bbhtht.exe35⤵
- Executes dropped EXE
PID:2996 -
\??\c:\3hnhbn.exec:\3hnhbn.exe36⤵
- Executes dropped EXE
PID:3052 -
\??\c:\ddvjv.exec:\ddvjv.exe37⤵
- Executes dropped EXE
PID:1732 -
\??\c:\rrlxlxf.exec:\rrlxlxf.exe38⤵
- Executes dropped EXE
PID:2724 -
\??\c:\ffrxxrr.exec:\ffrxxrr.exe39⤵
- Executes dropped EXE
PID:2676 -
\??\c:\bbbbnt.exec:\bbbbnt.exe40⤵
- Executes dropped EXE
PID:2300 -
\??\c:\vdppv.exec:\vdppv.exe41⤵
- Executes dropped EXE
PID:2944 -
\??\c:\lrlxrxl.exec:\lrlxrxl.exe42⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hbnbnt.exec:\hbnbnt.exe43⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vjddj.exec:\vjddj.exe44⤵
- Executes dropped EXE
PID:2696 -
\??\c:\9xrxlrf.exec:\9xrxlrf.exe45⤵
- Executes dropped EXE
PID:3024 -
\??\c:\3xrxrxl.exec:\3xrxrxl.exe46⤵
- Executes dropped EXE
PID:3060 -
\??\c:\1bbhtb.exec:\1bbhtb.exe47⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vpvvj.exec:\vpvvj.exe48⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5rrlflr.exec:\5rrlflr.exe49⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rlfrffl.exec:\rlfrffl.exe50⤵
- Executes dropped EXE
PID:1440 -
\??\c:\nhthnn.exec:\nhthnn.exe51⤵
- Executes dropped EXE
PID:1924 -
\??\c:\3vvdp.exec:\3vvdp.exe52⤵
- Executes dropped EXE
PID:1736 -
\??\c:\9lfrffl.exec:\9lfrffl.exe53⤵
- Executes dropped EXE
PID:1780 -
\??\c:\rxlffxf.exec:\rxlffxf.exe54⤵
- Executes dropped EXE
PID:2592 -
\??\c:\tnhthh.exec:\tnhthh.exe55⤵
- Executes dropped EXE
PID:1184 -
\??\c:\djjpd.exec:\djjpd.exe56⤵
- Executes dropped EXE
PID:1188 -
\??\c:\llfrfrl.exec:\llfrfrl.exe57⤵
- Executes dropped EXE
PID:1388 -
\??\c:\tnhntb.exec:\tnhntb.exe58⤵
- Executes dropped EXE
PID:2504 -
\??\c:\bbtntt.exec:\bbtntt.exe59⤵
- Executes dropped EXE
PID:2964 -
\??\c:\jdjdd.exec:\jdjdd.exe60⤵
- Executes dropped EXE
PID:1160 -
\??\c:\fxlxlxr.exec:\fxlxlxr.exe61⤵
- Executes dropped EXE
PID:1484 -
\??\c:\bhhhbn.exec:\bhhhbn.exe62⤵
- Executes dropped EXE
PID:1092 -
\??\c:\jjdpj.exec:\jjdpj.exe63⤵
- Executes dropped EXE
PID:1492 -
\??\c:\ddvdj.exec:\ddvdj.exe64⤵
- Executes dropped EXE
PID:1816 -
\??\c:\7xrllxl.exec:\7xrllxl.exe65⤵
- Executes dropped EXE
PID:1156 -
\??\c:\ttnbhn.exec:\ttnbhn.exe66⤵PID:1380
-
\??\c:\ntnbnh.exec:\ntnbnh.exe67⤵PID:1076
-
\??\c:\dddvp.exec:\dddvp.exe68⤵PID:1868
-
\??\c:\fxfrxxl.exec:\fxfrxxl.exe69⤵PID:1788
-
\??\c:\tnhnbh.exec:\tnhnbh.exe70⤵PID:1832
-
\??\c:\dvppv.exec:\dvppv.exe71⤵PID:2128
-
\??\c:\vdjvd.exec:\vdjvd.exe72⤵PID:1496
-
\??\c:\fffxrlf.exec:\fffxrlf.exe73⤵PID:2980
-
\??\c:\bnhhtb.exec:\bnhhtb.exe74⤵PID:1688
-
\??\c:\dvppj.exec:\dvppj.exe75⤵PID:2432
-
\??\c:\ppjpd.exec:\ppjpd.exe76⤵PID:3004
-
\??\c:\3llrrfl.exec:\3llrrfl.exe77⤵PID:2204
-
\??\c:\hhthtb.exec:\hhthtb.exe78⤵PID:2712
-
\??\c:\pvpjd.exec:\pvpjd.exe79⤵PID:2812
-
\??\c:\pjjvj.exec:\pjjvj.exe80⤵PID:2744
-
\??\c:\llrxlxl.exec:\llrxlxl.exe81⤵PID:2732
-
\??\c:\nhtbhn.exec:\nhtbhn.exe82⤵PID:2940
-
\??\c:\vpdjd.exec:\vpdjd.exe83⤵PID:2148
-
\??\c:\ddjdj.exec:\ddjdj.exe84⤵PID:3068
-
\??\c:\rrlllll.exec:\rrlllll.exe85⤵PID:2344
-
\??\c:\ththth.exec:\ththth.exe86⤵PID:2572
-
\??\c:\htntnb.exec:\htntnb.exe87⤵PID:2564
-
\??\c:\pvjpp.exec:\pvjpp.exe88⤵PID:2200
-
\??\c:\llllflf.exec:\llllflf.exe89⤵PID:2828
-
\??\c:\rxrfrrl.exec:\rxrfrrl.exe90⤵PID:2856
-
\??\c:\hnhthn.exec:\hnhthn.exe91⤵PID:2848
-
\??\c:\ddvdp.exec:\ddvdp.exe92⤵PID:2904
-
\??\c:\fxlfrxf.exec:\fxlfrxf.exe93⤵PID:1796
-
\??\c:\7rffrxr.exec:\7rffrxr.exe94⤵PID:1756
-
\??\c:\hbnnht.exec:\hbnnht.exe95⤵PID:1952
-
\??\c:\1jvpd.exec:\1jvpd.exe96⤵PID:348
-
\??\c:\pjvdp.exec:\pjvdp.exe97⤵PID:1056
-
\??\c:\rrllxfl.exec:\rrllxfl.exe98⤵PID:1508
-
\??\c:\flffxxr.exec:\flffxxr.exe99⤵PID:1396
-
\??\c:\9hntbb.exec:\9hntbb.exe100⤵PID:1784
-
\??\c:\pvpdp.exec:\pvpdp.exe101⤵PID:772
-
\??\c:\rxflxrl.exec:\rxflxrl.exe102⤵PID:1308
-
\??\c:\hhttnt.exec:\hhttnt.exe103⤵PID:988
-
\??\c:\7djdp.exec:\7djdp.exe104⤵PID:2860
-
\??\c:\xxrflxl.exec:\xxrflxl.exe105⤵PID:1068
-
\??\c:\ffrrxlr.exec:\ffrrxlr.exe106⤵PID:1344
-
\??\c:\9tnnbb.exec:\9tnnbb.exe107⤵PID:2372
-
\??\c:\dpjjp.exec:\dpjjp.exe108⤵PID:1532
-
\??\c:\7lxllrl.exec:\7lxllrl.exe109⤵PID:1984
-
\??\c:\tbhnbh.exec:\tbhnbh.exe110⤵PID:1072
-
\??\c:\hhhtht.exec:\hhhtht.exe111⤵PID:2140
-
\??\c:\jpjjj.exec:\jpjjj.exe112⤵PID:556
-
\??\c:\7rrxffr.exec:\7rrxffr.exe113⤵PID:1820
-
\??\c:\tntbnn.exec:\tntbnn.exe114⤵PID:2160
-
\??\c:\pvjdj.exec:\pvjdj.exe115⤵PID:2256
-
\??\c:\rxffllr.exec:\rxffllr.exe116⤵PID:2420
-
\??\c:\hbbhnn.exec:\hbbhnn.exe117⤵PID:2428
-
\??\c:\ddpjp.exec:\ddpjp.exe118⤵PID:2432
-
\??\c:\3lxxxxf.exec:\3lxxxxf.exe119⤵PID:2228
-
\??\c:\ttnthn.exec:\ttnthn.exe120⤵PID:2108
-
\??\c:\tnntnn.exec:\tnntnn.exe121⤵PID:2712
-
\??\c:\ppdjv.exec:\ppdjv.exe122⤵PID:3052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-