Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 04:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f367c91f98c51f2d1948423ac5bb782dcd115c5921f3e6b967f4c74c2997efd4.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
-
Target
f367c91f98c51f2d1948423ac5bb782dcd115c5921f3e6b967f4c74c2997efd4.exe
-
Size
401KB
-
MD5
ad1e65d88eebaa8f9152117f73d86bd0
-
SHA1
ddc72518437323000bab885855c7ef2795c4a658
-
SHA256
f367c91f98c51f2d1948423ac5bb782dcd115c5921f3e6b967f4c74c2997efd4
-
SHA512
3ac9fca64a11486766d444da9b8a4f3082818eda7afd8f57be737d9a356df0c0ef3f29a07df6d82bb6cd28975e7050bd941926e64bd2e75f4214bf7bf4495466
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmX5kr+uIBpkJITEEuR9XTVyXm+:n3C9BRIG0asYFm71mJkr+uIBe1T8N
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/2220-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/240-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/356-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/680-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/908-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 23 IoCs
resource yara_rule behavioral1/memory/2220-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3056-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2504-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2648-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2644-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2380-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2380-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1648-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/884-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2624-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1976-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/240-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1576-137-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2040-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2704-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/356-219-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/680-209-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/908-237-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1620-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3056 lfffrxr.exe 2568 dvjvd.exe 2504 flflxxl.exe 2648 3hbbhn.exe 2644 pjvdv.exe 2380 lflrlrl.exe 1648 btnthn.exe 2352 vpdjv.exe 884 3rffxxr.exe 2624 1hthtb.exe 1976 bhbnbh.exe 240 jdpdv.exe 1576 frffllr.exe 2308 jvdpd.exe 2284 fxrflrx.exe 2040 xrlxlrl.exe 2016 hthnhn.exe 2704 jvjvj.exe 1620 rfxxllx.exe 1972 nnnhbb.exe 680 vpjdp.exe 356 lffrxlf.exe 828 btntnb.exe 908 3jvdp.exe 952 rrlxlrr.exe 832 5bnbbh.exe 3064 7jjpp.exe 1824 3lxfflr.exe 1956 hhbhbh.exe 2856 9pvpp.exe 2348 rlffrfr.exe 1872 hhhtbh.exe 2720 jpvdj.exe 3056 dpjjj.exe 2528 rflxfff.exe 2572 btbhtt.exe 2504 ddvjv.exe 2516 3dvjd.exe 2492 frrxlfr.exe 2408 bbbnht.exe 2816 3nnbhh.exe 1564 rfrlflx.exe 2500 vdpvj.exe 2364 ppjjd.exe 884 lrflrrx.exe 2624 hthhnn.exe 1752 ppdjv.exe 1796 rlrxrxr.exe 544 hbnthn.exe 1244 nhnnnb.exe 2288 jvjpv.exe 2712 7rfflrf.exe 1688 frflfff.exe 2832 bthtbh.exe 2044 pjpjp.exe 2192 xlrrxxf.exe 2012 bnbhnt.exe 2064 btnnbh.exe 592 pjvpd.exe 1172 ffxlrxf.exe 904 lfrrxrl.exe 2912 bttbhn.exe 908 1jddd.exe 896 lfllflr.exe -
resource yara_rule behavioral1/memory/2220-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/240-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/356-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/680-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/908-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-191-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2220 wrote to memory of 3056 2220 f367c91f98c51f2d1948423ac5bb782dcd115c5921f3e6b967f4c74c2997efd4.exe 28 PID 2220 wrote to memory of 3056 2220 f367c91f98c51f2d1948423ac5bb782dcd115c5921f3e6b967f4c74c2997efd4.exe 28 PID 2220 wrote to memory of 3056 2220 f367c91f98c51f2d1948423ac5bb782dcd115c5921f3e6b967f4c74c2997efd4.exe 28 PID 2220 wrote to memory of 3056 2220 f367c91f98c51f2d1948423ac5bb782dcd115c5921f3e6b967f4c74c2997efd4.exe 28 PID 3056 wrote to memory of 2568 3056 lfffrxr.exe 29 PID 3056 wrote to memory of 2568 3056 lfffrxr.exe 29 PID 3056 wrote to memory of 2568 3056 lfffrxr.exe 29 PID 3056 wrote to memory of 2568 3056 lfffrxr.exe 29 PID 2568 wrote to memory of 2504 2568 dvjvd.exe 30 PID 2568 wrote to memory of 2504 2568 dvjvd.exe 30 PID 2568 wrote to memory of 2504 2568 dvjvd.exe 30 PID 2568 wrote to memory of 2504 2568 dvjvd.exe 30 PID 2504 wrote to memory of 2648 2504 flflxxl.exe 31 PID 2504 wrote to memory of 2648 2504 flflxxl.exe 31 PID 2504 wrote to memory of 2648 2504 flflxxl.exe 31 PID 2504 wrote to memory of 2648 2504 flflxxl.exe 31 PID 2648 wrote to memory of 2644 2648 3hbbhn.exe 32 PID 2648 wrote to memory of 2644 2648 3hbbhn.exe 32 PID 2648 wrote to memory of 2644 2648 3hbbhn.exe 32 PID 2648 wrote to memory of 2644 2648 3hbbhn.exe 32 PID 2644 wrote to memory of 2380 2644 pjvdv.exe 33 PID 2644 wrote to memory of 2380 2644 pjvdv.exe 33 PID 2644 wrote to memory of 2380 2644 pjvdv.exe 33 PID 2644 wrote to memory of 2380 2644 pjvdv.exe 33 PID 2380 wrote to memory of 1648 2380 lflrlrl.exe 34 PID 2380 wrote to memory of 1648 2380 lflrlrl.exe 34 PID 2380 wrote to memory of 1648 2380 lflrlrl.exe 34 PID 2380 wrote to memory of 1648 2380 lflrlrl.exe 34 PID 1648 wrote to memory of 2352 1648 btnthn.exe 35 PID 1648 wrote to memory of 2352 1648 btnthn.exe 35 PID 1648 wrote to memory of 2352 1648 btnthn.exe 35 PID 1648 wrote to memory of 2352 1648 btnthn.exe 35 PID 2352 wrote to memory of 884 2352 vpdjv.exe 36 PID 2352 wrote to memory of 884 2352 vpdjv.exe 36 PID 2352 wrote to memory of 884 2352 vpdjv.exe 36 PID 2352 wrote to memory of 884 2352 vpdjv.exe 36 PID 884 wrote to memory of 2624 884 3rffxxr.exe 37 PID 884 wrote to memory of 2624 884 3rffxxr.exe 37 PID 884 wrote to memory of 2624 884 3rffxxr.exe 37 PID 884 wrote to memory of 2624 884 3rffxxr.exe 37 PID 2624 wrote to memory of 1976 2624 1hthtb.exe 38 PID 2624 wrote to memory of 1976 2624 1hthtb.exe 38 PID 2624 wrote to memory of 1976 2624 1hthtb.exe 38 PID 2624 wrote to memory of 1976 2624 1hthtb.exe 38 PID 1976 wrote to memory of 240 1976 bhbnbh.exe 39 PID 1976 wrote to memory of 240 1976 bhbnbh.exe 39 PID 1976 wrote to memory of 240 1976 bhbnbh.exe 39 PID 1976 wrote to memory of 240 1976 bhbnbh.exe 39 PID 240 wrote to memory of 1576 240 jdpdv.exe 40 PID 240 wrote to memory of 1576 240 jdpdv.exe 40 PID 240 wrote to memory of 1576 240 jdpdv.exe 40 PID 240 wrote to memory of 1576 240 jdpdv.exe 40 PID 1576 wrote to memory of 2308 1576 frffllr.exe 41 PID 1576 wrote to memory of 2308 1576 frffllr.exe 41 PID 1576 wrote to memory of 2308 1576 frffllr.exe 41 PID 1576 wrote to memory of 2308 1576 frffllr.exe 41 PID 2308 wrote to memory of 2284 2308 jvdpd.exe 42 PID 2308 wrote to memory of 2284 2308 jvdpd.exe 42 PID 2308 wrote to memory of 2284 2308 jvdpd.exe 42 PID 2308 wrote to memory of 2284 2308 jvdpd.exe 42 PID 2284 wrote to memory of 2040 2284 fxrflrx.exe 43 PID 2284 wrote to memory of 2040 2284 fxrflrx.exe 43 PID 2284 wrote to memory of 2040 2284 fxrflrx.exe 43 PID 2284 wrote to memory of 2040 2284 fxrflrx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\f367c91f98c51f2d1948423ac5bb782dcd115c5921f3e6b967f4c74c2997efd4.exe"C:\Users\Admin\AppData\Local\Temp\f367c91f98c51f2d1948423ac5bb782dcd115c5921f3e6b967f4c74c2997efd4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\lfffrxr.exec:\lfffrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\dvjvd.exec:\dvjvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\flflxxl.exec:\flflxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\3hbbhn.exec:\3hbbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\pjvdv.exec:\pjvdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\lflrlrl.exec:\lflrlrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\btnthn.exec:\btnthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\vpdjv.exec:\vpdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\3rffxxr.exec:\3rffxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\1hthtb.exec:\1hthtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\bhbnbh.exec:\bhbnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\jdpdv.exec:\jdpdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
\??\c:\frffllr.exec:\frffllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\jvdpd.exec:\jvdpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\fxrflrx.exec:\fxrflrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\xrlxlrl.exec:\xrlxlrl.exe17⤵
- Executes dropped EXE
PID:2040 -
\??\c:\hthnhn.exec:\hthnhn.exe18⤵
- Executes dropped EXE
PID:2016 -
\??\c:\jvjvj.exec:\jvjvj.exe19⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rfxxllx.exec:\rfxxllx.exe20⤵
- Executes dropped EXE
PID:1620 -
\??\c:\nnnhbb.exec:\nnnhbb.exe21⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vpjdp.exec:\vpjdp.exe22⤵
- Executes dropped EXE
PID:680 -
\??\c:\lffrxlf.exec:\lffrxlf.exe23⤵
- Executes dropped EXE
PID:356 -
\??\c:\btntnb.exec:\btntnb.exe24⤵
- Executes dropped EXE
PID:828 -
\??\c:\3jvdp.exec:\3jvdp.exe25⤵
- Executes dropped EXE
PID:908 -
\??\c:\rrlxlrr.exec:\rrlxlrr.exe26⤵
- Executes dropped EXE
PID:952 -
\??\c:\5bnbbh.exec:\5bnbbh.exe27⤵
- Executes dropped EXE
PID:832 -
\??\c:\7jjpp.exec:\7jjpp.exe28⤵
- Executes dropped EXE
PID:3064 -
\??\c:\3lxfflr.exec:\3lxfflr.exe29⤵
- Executes dropped EXE
PID:1824 -
\??\c:\hhbhbh.exec:\hhbhbh.exe30⤵
- Executes dropped EXE
PID:1956 -
\??\c:\9pvpp.exec:\9pvpp.exe31⤵
- Executes dropped EXE
PID:2856 -
\??\c:\rlffrfr.exec:\rlffrfr.exe32⤵
- Executes dropped EXE
PID:2348 -
\??\c:\hhhtbh.exec:\hhhtbh.exe33⤵
- Executes dropped EXE
PID:1872 -
\??\c:\jpvdj.exec:\jpvdj.exe34⤵
- Executes dropped EXE
PID:2720 -
\??\c:\dpjjj.exec:\dpjjj.exe35⤵
- Executes dropped EXE
PID:3056 -
\??\c:\rflxfff.exec:\rflxfff.exe36⤵
- Executes dropped EXE
PID:2528 -
\??\c:\btbhtt.exec:\btbhtt.exe37⤵
- Executes dropped EXE
PID:2572 -
\??\c:\ddvjv.exec:\ddvjv.exe38⤵
- Executes dropped EXE
PID:2504 -
\??\c:\3dvjd.exec:\3dvjd.exe39⤵
- Executes dropped EXE
PID:2516 -
\??\c:\frrxlfr.exec:\frrxlfr.exe40⤵
- Executes dropped EXE
PID:2492 -
\??\c:\bbbnht.exec:\bbbnht.exe41⤵
- Executes dropped EXE
PID:2408 -
\??\c:\3nnbhh.exec:\3nnbhh.exe42⤵
- Executes dropped EXE
PID:2816 -
\??\c:\rfrlflx.exec:\rfrlflx.exe43⤵
- Executes dropped EXE
PID:1564 -
\??\c:\vdpvj.exec:\vdpvj.exe44⤵
- Executes dropped EXE
PID:2500 -
\??\c:\ppjjd.exec:\ppjjd.exe45⤵
- Executes dropped EXE
PID:2364 -
\??\c:\lrflrrx.exec:\lrflrrx.exe46⤵
- Executes dropped EXE
PID:884 -
\??\c:\hthhnn.exec:\hthhnn.exe47⤵
- Executes dropped EXE
PID:2624 -
\??\c:\ppdjv.exec:\ppdjv.exe48⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rlrxrxr.exec:\rlrxrxr.exe49⤵
- Executes dropped EXE
PID:1796 -
\??\c:\hbnthn.exec:\hbnthn.exe50⤵
- Executes dropped EXE
PID:544 -
\??\c:\nhnnnb.exec:\nhnnnb.exe51⤵
- Executes dropped EXE
PID:1244 -
\??\c:\jvjpv.exec:\jvjpv.exe52⤵
- Executes dropped EXE
PID:2288 -
\??\c:\7rfflrf.exec:\7rfflrf.exe53⤵
- Executes dropped EXE
PID:2712 -
\??\c:\frflfff.exec:\frflfff.exe54⤵
- Executes dropped EXE
PID:1688 -
\??\c:\bthtbh.exec:\bthtbh.exe55⤵
- Executes dropped EXE
PID:2832 -
\??\c:\pjpjp.exec:\pjpjp.exe56⤵
- Executes dropped EXE
PID:2044 -
\??\c:\xlrrxxf.exec:\xlrrxxf.exe57⤵
- Executes dropped EXE
PID:2192 -
\??\c:\bnbhnt.exec:\bnbhnt.exe58⤵
- Executes dropped EXE
PID:2012 -
\??\c:\btnnbh.exec:\btnnbh.exe59⤵
- Executes dropped EXE
PID:2064 -
\??\c:\pjvpd.exec:\pjvpd.exe60⤵
- Executes dropped EXE
PID:592 -
\??\c:\ffxlrxf.exec:\ffxlrxf.exe61⤵
- Executes dropped EXE
PID:1172 -
\??\c:\lfrrxrl.exec:\lfrrxrl.exe62⤵
- Executes dropped EXE
PID:904 -
\??\c:\bttbhn.exec:\bttbhn.exe63⤵
- Executes dropped EXE
PID:2912 -
\??\c:\1jddd.exec:\1jddd.exe64⤵
- Executes dropped EXE
PID:908 -
\??\c:\lfllflr.exec:\lfllflr.exe65⤵
- Executes dropped EXE
PID:896 -
\??\c:\lxfffxf.exec:\lxfffxf.exe66⤵PID:1432
-
\??\c:\hthhhn.exec:\hthhhn.exe67⤵PID:2976
-
\??\c:\vvjjd.exec:\vvjjd.exe68⤵PID:1736
-
\??\c:\1rrfxlx.exec:\1rrfxlx.exe69⤵PID:1824
-
\??\c:\lxfxfll.exec:\lxfxfll.exe70⤵PID:888
-
\??\c:\1hnbnb.exec:\1hnbnb.exe71⤵PID:980
-
\??\c:\dvpvd.exec:\dvpvd.exe72⤵PID:1504
-
\??\c:\lfxxllx.exec:\lfxxllx.exe73⤵PID:2972
-
\??\c:\lfffllf.exec:\lfffllf.exe74⤵PID:2152
-
\??\c:\nhtbhn.exec:\nhtbhn.exe75⤵PID:2720
-
\??\c:\hhtbbh.exec:\hhtbbh.exe76⤵PID:2220
-
\??\c:\jpjpp.exec:\jpjpp.exe77⤵PID:1536
-
\??\c:\fxflffl.exec:\fxflffl.exe78⤵PID:2684
-
\??\c:\nbnhnn.exec:\nbnhnn.exe79⤵PID:2540
-
\??\c:\pjvvd.exec:\pjvvd.exe80⤵PID:2420
-
\??\c:\3djdd.exec:\3djdd.exe81⤵PID:2392
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe82⤵PID:2428
-
\??\c:\bnbntt.exec:\bnbntt.exe83⤵PID:2824
-
\??\c:\nbnhbh.exec:\nbnhbh.exe84⤵PID:1264
-
\??\c:\pdddj.exec:\pdddj.exe85⤵PID:1032
-
\??\c:\7lxfffl.exec:\7lxfffl.exe86⤵PID:2672
-
\??\c:\hhnbnb.exec:\hhnbnb.exe87⤵PID:1128
-
\??\c:\nbnhnn.exec:\nbnhnn.exe88⤵PID:320
-
\??\c:\pdppp.exec:\pdppp.exe89⤵PID:1540
-
\??\c:\fxlfxxf.exec:\fxlfxxf.exe90⤵PID:2700
-
\??\c:\xrxrfll.exec:\xrxrfll.exe91⤵PID:1788
-
\??\c:\bnbbhh.exec:\bnbbhh.exe92⤵PID:624
-
\??\c:\3thnnh.exec:\3thnnh.exe93⤵PID:1232
-
\??\c:\9vvpp.exec:\9vvpp.exe94⤵PID:2716
-
\??\c:\xlrrfxx.exec:\xlrrfxx.exe95⤵PID:3060
-
\??\c:\lfrrxxx.exec:\lfrrxxx.exe96⤵PID:2696
-
\??\c:\hthhnn.exec:\hthhnn.exe97⤵PID:2704
-
\??\c:\dpdpp.exec:\dpdpp.exe98⤵PID:1868
-
\??\c:\3xlxxll.exec:\3xlxxll.exe99⤵PID:536
-
\??\c:\lrfxxrr.exec:\lrfxxrr.exe100⤵PID:1292
-
\??\c:\hbnnnn.exec:\hbnnnn.exe101⤵PID:1412
-
\??\c:\3nhnnn.exec:\3nhnnn.exe102⤵PID:356
-
\??\c:\dvjpp.exec:\dvjpp.exe103⤵PID:828
-
\??\c:\lllrfrl.exec:\lllrfrl.exe104⤵PID:280
-
\??\c:\7xxxflr.exec:\7xxxflr.exe105⤵PID:1308
-
\??\c:\nhbbtn.exec:\nhbbtn.exe106⤵PID:1136
-
\??\c:\vjvjp.exec:\vjvjp.exe107⤵PID:2204
-
\??\c:\vpvpd.exec:\vpvpd.exe108⤵PID:2864
-
\??\c:\rfrxxff.exec:\rfrxxff.exe109⤵PID:1988
-
\??\c:\nbhtnh.exec:\nbhtnh.exe110⤵PID:2728
-
\??\c:\vvpjp.exec:\vvpjp.exe111⤵PID:1468
-
\??\c:\vjvdp.exec:\vjvdp.exe112⤵PID:2724
-
\??\c:\xrfxxrx.exec:\xrfxxrx.exe113⤵PID:1528
-
\??\c:\5hbhnb.exec:\5hbhnb.exe114⤵PID:2664
-
\??\c:\3bbhhh.exec:\3bbhhh.exe115⤵PID:2508
-
\??\c:\jvvvv.exec:\jvvvv.exe116⤵PID:1444
-
\??\c:\frffrxl.exec:\frffrxl.exe117⤵PID:2512
-
\??\c:\9rxrxrx.exec:\9rxrxrx.exe118⤵PID:2496
-
\??\c:\3bhhhh.exec:\3bhhhh.exe119⤵PID:2572
-
\??\c:\5dpjd.exec:\5dpjd.exe120⤵PID:2648
-
\??\c:\jdpvj.exec:\jdpvj.exe121⤵PID:2872
-
\??\c:\1llfffl.exec:\1llfffl.exe122⤵PID:2560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-