Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 23:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5e915b79cbcc298d64330eef6a9e84571da0af3f27dac48eb357e9d7f03cf288.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
5e915b79cbcc298d64330eef6a9e84571da0af3f27dac48eb357e9d7f03cf288.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
5e915b79cbcc298d64330eef6a9e84571da0af3f27dac48eb357e9d7f03cf288.exe
-
Size
133KB
-
MD5
1e8f1b3fe27fbc0912784a85bd02f3a1
-
SHA1
f09b3133311cf1de8d1c95cbe7653b40378ff124
-
SHA256
5e915b79cbcc298d64330eef6a9e84571da0af3f27dac48eb357e9d7f03cf288
-
SHA512
a4b95582772a635c12f7215595d2132e437a2ce1ea5ca2f7f43e8ccd27c3758dce871b570fd217086a0ad177edb273ab07ef40c3a1ea2e8cf7190e3c29d76898
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73HUoMsAbrF3BTUwFU:n3C9BRo7HCsAbhxYp
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/2180-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1184-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1424-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1476-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1088-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 20 IoCs
resource yara_rule behavioral1/memory/2180-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1184-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2160-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2664-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1424-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1424-61-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1424-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2600-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2512-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2484-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1644-108-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1444-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1708-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1808-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3068-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1476-234-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1536-252-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2528-243-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1088-226-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2012-297-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1184 bbhtth.exe 2160 pjjvp.exe 2996 lrxxfxr.exe 2664 tnnhnn.exe 2600 dvvvj.exe 1424 7btbtb.exe 2512 jjdjv.exe 2484 xrlrlrx.exe 2904 bbthth.exe 1644 xrrlxrx.exe 1444 hnnnbt.exe 2768 vdddv.exe 1692 fflxfrf.exe 1708 rllrxlx.exe 1968 9httbh.exe 1808 7jpjj.exe 808 lfxlrxf.exe 1508 9frrxxf.exe 2260 hthbnt.exe 3068 thhnbb.exe 2856 pjjpd.exe 2200 xxrllrf.exe 1088 9tntbh.exe 1476 djjjd.exe 2528 vvvjd.exe 1536 fllrxrr.exe 3040 xlxxllx.exe 2836 jjvdp.exe 1240 7lflfrf.exe 304 hnnhbn.exe 2012 hbnnnt.exe 2180 jdpvd.exe 1184 rrlxrrf.exe 2932 btnntt.exe 2940 bhnthh.exe 2680 jvjpv.exe 2684 dpdvd.exe 1584 xffxflf.exe 2824 nbhtth.exe 2804 9ddvd.exe 2980 ppjpd.exe 2640 xrfllrl.exe 2512 tnnbnb.exe 2304 pvjdj.exe 496 ddpvd.exe 1612 lfrffrr.exe 1616 3nnnnn.exe 2792 jvpvp.exe 760 llxxrrr.exe 884 5hhthh.exe 1964 ttntbb.exe 1756 vpjvd.exe 1208 flrlxlr.exe 2384 bbbhbt.exe 1540 jdvpv.exe 856 9xrfrxr.exe 2320 hbbhth.exe 2256 htnhth.exe 2448 vvvjj.exe 2856 5flxrrl.exe 2252 ttnhhh.exe 2724 pjppj.exe 1476 3fllxxf.exe 1072 hhtbnt.exe -
resource yara_rule behavioral1/memory/2180-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1184-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1424-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1424-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1424-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1476-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1088-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-297-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 1184 2180 5e915b79cbcc298d64330eef6a9e84571da0af3f27dac48eb357e9d7f03cf288.exe 29 PID 2180 wrote to memory of 1184 2180 5e915b79cbcc298d64330eef6a9e84571da0af3f27dac48eb357e9d7f03cf288.exe 29 PID 2180 wrote to memory of 1184 2180 5e915b79cbcc298d64330eef6a9e84571da0af3f27dac48eb357e9d7f03cf288.exe 29 PID 2180 wrote to memory of 1184 2180 5e915b79cbcc298d64330eef6a9e84571da0af3f27dac48eb357e9d7f03cf288.exe 29 PID 1184 wrote to memory of 2160 1184 bbhtth.exe 30 PID 1184 wrote to memory of 2160 1184 bbhtth.exe 30 PID 1184 wrote to memory of 2160 1184 bbhtth.exe 30 PID 1184 wrote to memory of 2160 1184 bbhtth.exe 30 PID 2160 wrote to memory of 2996 2160 pjjvp.exe 31 PID 2160 wrote to memory of 2996 2160 pjjvp.exe 31 PID 2160 wrote to memory of 2996 2160 pjjvp.exe 31 PID 2160 wrote to memory of 2996 2160 pjjvp.exe 31 PID 2996 wrote to memory of 2664 2996 lrxxfxr.exe 32 PID 2996 wrote to memory of 2664 2996 lrxxfxr.exe 32 PID 2996 wrote to memory of 2664 2996 lrxxfxr.exe 32 PID 2996 wrote to memory of 2664 2996 lrxxfxr.exe 32 PID 2664 wrote to memory of 2600 2664 tnnhnn.exe 33 PID 2664 wrote to memory of 2600 2664 tnnhnn.exe 33 PID 2664 wrote to memory of 2600 2664 tnnhnn.exe 33 PID 2664 wrote to memory of 2600 2664 tnnhnn.exe 33 PID 2600 wrote to memory of 1424 2600 dvvvj.exe 34 PID 2600 wrote to memory of 1424 2600 dvvvj.exe 34 PID 2600 wrote to memory of 1424 2600 dvvvj.exe 34 PID 2600 wrote to memory of 1424 2600 dvvvj.exe 34 PID 1424 wrote to memory of 2512 1424 7btbtb.exe 35 PID 1424 wrote to memory of 2512 1424 7btbtb.exe 35 PID 1424 wrote to memory of 2512 1424 7btbtb.exe 35 PID 1424 wrote to memory of 2512 1424 7btbtb.exe 35 PID 2512 wrote to memory of 2484 2512 jjdjv.exe 36 PID 2512 wrote to memory of 2484 2512 jjdjv.exe 36 PID 2512 wrote to memory of 2484 2512 jjdjv.exe 36 PID 2512 wrote to memory of 2484 2512 jjdjv.exe 36 PID 2484 wrote to memory of 2904 2484 xrlrlrx.exe 37 PID 2484 wrote to memory of 2904 2484 xrlrlrx.exe 37 PID 2484 wrote to memory of 2904 2484 xrlrlrx.exe 37 PID 2484 wrote to memory of 2904 2484 xrlrlrx.exe 37 PID 2904 wrote to memory of 1644 2904 bbthth.exe 38 PID 2904 wrote to memory of 1644 2904 bbthth.exe 38 PID 2904 wrote to memory of 1644 2904 bbthth.exe 38 PID 2904 wrote to memory of 1644 2904 bbthth.exe 38 PID 1644 wrote to memory of 1444 1644 xrrlxrx.exe 39 PID 1644 wrote to memory of 1444 1644 xrrlxrx.exe 39 PID 1644 wrote to memory of 1444 1644 xrrlxrx.exe 39 PID 1644 wrote to memory of 1444 1644 xrrlxrx.exe 39 PID 1444 wrote to memory of 2768 1444 hnnnbt.exe 40 PID 1444 wrote to memory of 2768 1444 hnnnbt.exe 40 PID 1444 wrote to memory of 2768 1444 hnnnbt.exe 40 PID 1444 wrote to memory of 2768 1444 hnnnbt.exe 40 PID 2768 wrote to memory of 1692 2768 vdddv.exe 41 PID 2768 wrote to memory of 1692 2768 vdddv.exe 41 PID 2768 wrote to memory of 1692 2768 vdddv.exe 41 PID 2768 wrote to memory of 1692 2768 vdddv.exe 41 PID 1692 wrote to memory of 1708 1692 fflxfrf.exe 42 PID 1692 wrote to memory of 1708 1692 fflxfrf.exe 42 PID 1692 wrote to memory of 1708 1692 fflxfrf.exe 42 PID 1692 wrote to memory of 1708 1692 fflxfrf.exe 42 PID 1708 wrote to memory of 1968 1708 rllrxlx.exe 43 PID 1708 wrote to memory of 1968 1708 rllrxlx.exe 43 PID 1708 wrote to memory of 1968 1708 rllrxlx.exe 43 PID 1708 wrote to memory of 1968 1708 rllrxlx.exe 43 PID 1968 wrote to memory of 1808 1968 9httbh.exe 44 PID 1968 wrote to memory of 1808 1968 9httbh.exe 44 PID 1968 wrote to memory of 1808 1968 9httbh.exe 44 PID 1968 wrote to memory of 1808 1968 9httbh.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e915b79cbcc298d64330eef6a9e84571da0af3f27dac48eb357e9d7f03cf288.exe"C:\Users\Admin\AppData\Local\Temp\5e915b79cbcc298d64330eef6a9e84571da0af3f27dac48eb357e9d7f03cf288.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\bbhtth.exec:\bbhtth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\pjjvp.exec:\pjjvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\lrxxfxr.exec:\lrxxfxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\tnnhnn.exec:\tnnhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\dvvvj.exec:\dvvvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\7btbtb.exec:\7btbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\jjdjv.exec:\jjdjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\xrlrlrx.exec:\xrlrlrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\bbthth.exec:\bbthth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\xrrlxrx.exec:\xrrlxrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\hnnnbt.exec:\hnnnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\vdddv.exec:\vdddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\fflxfrf.exec:\fflxfrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\rllrxlx.exec:\rllrxlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\9httbh.exec:\9httbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\7jpjj.exec:\7jpjj.exe17⤵
- Executes dropped EXE
PID:1808 -
\??\c:\lfxlrxf.exec:\lfxlrxf.exe18⤵
- Executes dropped EXE
PID:808 -
\??\c:\9frrxxf.exec:\9frrxxf.exe19⤵
- Executes dropped EXE
PID:1508 -
\??\c:\hthbnt.exec:\hthbnt.exe20⤵
- Executes dropped EXE
PID:2260 -
\??\c:\thhnbb.exec:\thhnbb.exe21⤵
- Executes dropped EXE
PID:3068 -
\??\c:\pjjpd.exec:\pjjpd.exe22⤵
- Executes dropped EXE
PID:2856 -
\??\c:\xxrllrf.exec:\xxrllrf.exe23⤵
- Executes dropped EXE
PID:2200 -
\??\c:\9tntbh.exec:\9tntbh.exe24⤵
- Executes dropped EXE
PID:1088 -
\??\c:\djjjd.exec:\djjjd.exe25⤵
- Executes dropped EXE
PID:1476 -
\??\c:\vvvjd.exec:\vvvjd.exe26⤵
- Executes dropped EXE
PID:2528 -
\??\c:\fllrxrr.exec:\fllrxrr.exe27⤵
- Executes dropped EXE
PID:1536 -
\??\c:\xlxxllx.exec:\xlxxllx.exe28⤵
- Executes dropped EXE
PID:3040 -
\??\c:\jjvdp.exec:\jjvdp.exe29⤵
- Executes dropped EXE
PID:2836 -
\??\c:\7lflfrf.exec:\7lflfrf.exe30⤵
- Executes dropped EXE
PID:1240 -
\??\c:\hnnhbn.exec:\hnnhbn.exe31⤵
- Executes dropped EXE
PID:304 -
\??\c:\hbnnnt.exec:\hbnnnt.exe32⤵
- Executes dropped EXE
PID:2012 -
\??\c:\jdpvd.exec:\jdpvd.exe33⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rrlxrrf.exec:\rrlxrrf.exe34⤵
- Executes dropped EXE
PID:1184 -
\??\c:\btnntt.exec:\btnntt.exe35⤵
- Executes dropped EXE
PID:2932 -
\??\c:\bhnthh.exec:\bhnthh.exe36⤵
- Executes dropped EXE
PID:2940 -
\??\c:\jvjpv.exec:\jvjpv.exe37⤵
- Executes dropped EXE
PID:2680 -
\??\c:\dpdvd.exec:\dpdvd.exe38⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xffxflf.exec:\xffxflf.exe39⤵
- Executes dropped EXE
PID:1584 -
\??\c:\nbhtth.exec:\nbhtth.exe40⤵
- Executes dropped EXE
PID:2824 -
\??\c:\9ddvd.exec:\9ddvd.exe41⤵
- Executes dropped EXE
PID:2804 -
\??\c:\ppjpd.exec:\ppjpd.exe42⤵
- Executes dropped EXE
PID:2980 -
\??\c:\xrfllrl.exec:\xrfllrl.exe43⤵
- Executes dropped EXE
PID:2640 -
\??\c:\tnnbnb.exec:\tnnbnb.exe44⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pvjdj.exec:\pvjdj.exe45⤵
- Executes dropped EXE
PID:2304 -
\??\c:\ddpvd.exec:\ddpvd.exe46⤵
- Executes dropped EXE
PID:496 -
\??\c:\lfrffrr.exec:\lfrffrr.exe47⤵
- Executes dropped EXE
PID:1612 -
\??\c:\3nnnnn.exec:\3nnnnn.exe48⤵
- Executes dropped EXE
PID:1616 -
\??\c:\jvpvp.exec:\jvpvp.exe49⤵
- Executes dropped EXE
PID:2792 -
\??\c:\llxxrrr.exec:\llxxrrr.exe50⤵
- Executes dropped EXE
PID:760 -
\??\c:\5hhthh.exec:\5hhthh.exe51⤵
- Executes dropped EXE
PID:884 -
\??\c:\ttntbb.exec:\ttntbb.exe52⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vpjvd.exec:\vpjvd.exe53⤵
- Executes dropped EXE
PID:1756 -
\??\c:\flrlxlr.exec:\flrlxlr.exe54⤵
- Executes dropped EXE
PID:1208 -
\??\c:\bbbhbt.exec:\bbbhbt.exe55⤵
- Executes dropped EXE
PID:2384 -
\??\c:\jdvpv.exec:\jdvpv.exe56⤵
- Executes dropped EXE
PID:1540 -
\??\c:\9xrfrxr.exec:\9xrfrxr.exe57⤵
- Executes dropped EXE
PID:856 -
\??\c:\hbbhth.exec:\hbbhth.exe58⤵
- Executes dropped EXE
PID:2320 -
\??\c:\htnhth.exec:\htnhth.exe59⤵
- Executes dropped EXE
PID:2256 -
\??\c:\vvvjj.exec:\vvvjj.exe60⤵
- Executes dropped EXE
PID:2448 -
\??\c:\5flxrrl.exec:\5flxrrl.exe61⤵
- Executes dropped EXE
PID:2856 -
\??\c:\ttnhhh.exec:\ttnhhh.exe62⤵
- Executes dropped EXE
PID:2252 -
\??\c:\pjppj.exec:\pjppj.exe63⤵
- Executes dropped EXE
PID:2724 -
\??\c:\3fllxxf.exec:\3fllxxf.exe64⤵
- Executes dropped EXE
PID:1476 -
\??\c:\hhtbnt.exec:\hhtbnt.exe65⤵
- Executes dropped EXE
PID:1072 -
\??\c:\jpvvd.exec:\jpvvd.exe66⤵PID:348
-
\??\c:\7dvdj.exec:\7dvdj.exe67⤵PID:628
-
\??\c:\3ffxlxr.exec:\3ffxlxr.exe68⤵PID:3024
-
\??\c:\bbnnnn.exec:\bbnnnn.exe69⤵PID:1932
-
\??\c:\jppdd.exec:\jppdd.exe70⤵PID:2016
-
\??\c:\vjdjv.exec:\vjdjv.exe71⤵PID:2308
-
\??\c:\3xrrfrx.exec:\3xrrfrx.exe72⤵PID:304
-
\??\c:\1thnbh.exec:\1thnbh.exe73⤵PID:1720
-
\??\c:\vpjjd.exec:\vpjjd.exe74⤵PID:2892
-
\??\c:\vpjvp.exec:\vpjvp.exe75⤵PID:2744
-
\??\c:\rxxfrxl.exec:\rxxfrxl.exe76⤵PID:1080
-
\??\c:\tttthb.exec:\tttthb.exe77⤵PID:2676
-
\??\c:\5jjpj.exec:\5jjpj.exe78⤵PID:2996
-
\??\c:\xffrrll.exec:\xffrrll.exe79⤵PID:2592
-
\??\c:\5btbhh.exec:\5btbhh.exe80⤵PID:1776
-
\??\c:\nhhnbn.exec:\nhhnbn.exe81⤵PID:2748
-
\??\c:\jdpvj.exec:\jdpvj.exe82⤵PID:2712
-
\??\c:\xrllrrr.exec:\xrllrrr.exe83⤵PID:2660
-
\??\c:\nnhthn.exec:\nnhthn.exe84⤵PID:2516
-
\??\c:\hhbhbh.exec:\hhbhbh.exe85⤵PID:2176
-
\??\c:\vvvjj.exec:\vvvjj.exe86⤵PID:2928
-
\??\c:\fxxxfrf.exec:\fxxxfrf.exe87⤵PID:2124
-
\??\c:\9xxxflx.exec:\9xxxflx.exe88⤵PID:2764
-
\??\c:\nnnnnt.exec:\nnnnnt.exe89⤵PID:2760
-
\??\c:\pjvdv.exec:\pjvdv.exe90⤵PID:2752
-
\??\c:\xrlxxfx.exec:\xrlxxfx.exe91⤵PID:1640
-
\??\c:\7ttbth.exec:\7ttbth.exe92⤵PID:1972
-
\??\c:\nttbtb.exec:\nttbtb.exe93⤵PID:1708
-
\??\c:\jvpdv.exec:\jvpdv.exe94⤵PID:1660
-
\??\c:\9rrrfrf.exec:\9rrrfrf.exe95⤵PID:468
-
\??\c:\bhntnn.exec:\bhntnn.exe96⤵PID:1440
-
\??\c:\ntnhbb.exec:\ntnhbb.exe97⤵PID:808
-
\??\c:\5djvj.exec:\5djvj.exe98⤵PID:2244
-
\??\c:\9llrlrf.exec:\9llrlrf.exe99⤵PID:2316
-
\??\c:\nnhtnn.exec:\nnhtnn.exe100⤵PID:1116
-
\??\c:\jdjdv.exec:\jdjdv.exe101⤵PID:2224
-
\??\c:\ddvvp.exec:\ddvvp.exe102⤵PID:668
-
\??\c:\3rrfxlf.exec:\3rrfxlf.exe103⤵PID:864
-
\??\c:\nhbnhb.exec:\nhbnhb.exe104⤵PID:1856
-
\??\c:\vdvdp.exec:\vdvdp.exe105⤵PID:1376
-
\??\c:\vvvdv.exec:\vvvdv.exe106⤵PID:2528
-
\??\c:\llfxrrf.exec:\llfxrrf.exe107⤵PID:1072
-
\??\c:\bnhbhb.exec:\bnhbhb.exe108⤵PID:1792
-
\??\c:\hbtttb.exec:\hbtttb.exe109⤵PID:1160
-
\??\c:\ffrlfff.exec:\ffrlfff.exe110⤵PID:1480
-
\??\c:\tbnhhh.exec:\tbnhhh.exe111⤵PID:1948
-
\??\c:\ntnbnt.exec:\ntnbnt.exe112⤵PID:2112
-
\??\c:\vpdvj.exec:\vpdvj.exe113⤵PID:2308
-
\??\c:\1rrxlrf.exec:\1rrxlrf.exe114⤵PID:876
-
\??\c:\nhnhnt.exec:\nhnhnt.exe115⤵PID:1052
-
\??\c:\dvvjp.exec:\dvvjp.exe116⤵PID:2924
-
\??\c:\3vvpv.exec:\3vvpv.exe117⤵PID:2964
-
\??\c:\rrrxlrl.exec:\rrrxlrl.exe118⤵PID:2708
-
\??\c:\hbbtnt.exec:\hbbtnt.exe119⤵PID:2576
-
\??\c:\dvvjj.exec:\dvvjj.exe120⤵PID:2976
-
\??\c:\ddvvd.exec:\ddvvd.exe121⤵PID:1552
-
\??\c:\ffxrlxl.exec:\ffxrlxl.exe122⤵PID:2496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-