Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 02:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b94572e17b5f93b711d37087eda456ef93c5ca8bbf05ae8d355a09ebbe41f1c5.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
-
Target
b94572e17b5f93b711d37087eda456ef93c5ca8bbf05ae8d355a09ebbe41f1c5.exe
-
Size
75KB
-
MD5
a78ca02feaf82b30f52efe14c47b5a36
-
SHA1
c4ca8ff2f4a86a0172e92fac5d31e2ccfeacf6a6
-
SHA256
b94572e17b5f93b711d37087eda456ef93c5ca8bbf05ae8d355a09ebbe41f1c5
-
SHA512
e18433f7261fb95541b1086141fff76937c1e2bc058eb3c678e90260ae3211d73d9b8f39545b2382f33cc4500cb8a3b76d9df53a4dd01d8a1ecf7a93d2b94e63
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAX8gu3Gno9yvrjKT:ymb3NkkiQ3mdBjFo68t3Gno9Ig
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2760-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-79-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/956-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/876-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 21 IoCs
resource yara_rule behavioral1/memory/2760-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2148-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2120-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2588-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2592-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2732-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2464-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2676-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2512-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2988-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2996-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2704-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2416-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1856-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/320-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2776-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1556-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2260-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/956-224-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/876-243-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2208-296-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2148 lxxfllf.exe 2120 5ttnth.exe 2588 jdpvj.exe 2592 rlffffr.exe 2732 hhnhnh.exe 2464 tnttnn.exe 2676 vvvpd.exe 2512 vjvvp.exe 2988 ffxxllx.exe 2832 9nbntt.exe 2836 bbbhbb.exe 2996 3pddj.exe 2704 7ddjp.exe 2416 xrxllrf.exe 1856 hhbhbn.exe 320 7hbtbh.exe 2776 9djdp.exe 1556 vpddj.exe 2116 xxfxrlx.exe 2260 9btnbb.exe 1228 jddjv.exe 2044 rfxxxfl.exe 956 ffxrlrl.exe 2180 1hbhnn.exe 876 nntthn.exe 1364 djjvv.exe 1716 dpjpd.exe 2212 3lxflxf.exe 1704 nhtthh.exe 2076 1bbbhn.exe 2208 jdpdj.exe 3052 jjddv.exe 2144 3xrfrxf.exe 1712 xrxflrx.exe 2276 3bhhnt.exe 2256 bthnbn.exe 2644 vpvpv.exe 2588 3ppjp.exe 2556 llffxlx.exe 2740 lfxfxxx.exe 2724 nhntbt.exe 2480 bnbhbt.exe 2552 vpjpd.exe 2472 dvppp.exe 772 lfrrllx.exe 2848 rlflrxl.exe 2804 nnhthn.exe 2940 tnnbhn.exe 2700 9pjpv.exe 1788 vpddp.exe 2496 xrflrxl.exe 2528 lxlrlll.exe 2788 7nbnbh.exe 2772 nhnbnb.exe 1528 3ppdd.exe 1448 llflrrf.exe 3016 bbntbh.exe 3064 bhnbbb.exe 2232 5hhbhn.exe 2900 pjvdd.exe 596 dpjvd.exe 2080 xflrxxr.exe 956 ntnnhh.exe 2412 hbhhth.exe -
resource yara_rule behavioral1/memory/2760-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/956-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/876-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-296-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2760 wrote to memory of 2148 2760 b94572e17b5f93b711d37087eda456ef93c5ca8bbf05ae8d355a09ebbe41f1c5.exe 28 PID 2760 wrote to memory of 2148 2760 b94572e17b5f93b711d37087eda456ef93c5ca8bbf05ae8d355a09ebbe41f1c5.exe 28 PID 2760 wrote to memory of 2148 2760 b94572e17b5f93b711d37087eda456ef93c5ca8bbf05ae8d355a09ebbe41f1c5.exe 28 PID 2760 wrote to memory of 2148 2760 b94572e17b5f93b711d37087eda456ef93c5ca8bbf05ae8d355a09ebbe41f1c5.exe 28 PID 2148 wrote to memory of 2120 2148 lxxfllf.exe 29 PID 2148 wrote to memory of 2120 2148 lxxfllf.exe 29 PID 2148 wrote to memory of 2120 2148 lxxfllf.exe 29 PID 2148 wrote to memory of 2120 2148 lxxfllf.exe 29 PID 2120 wrote to memory of 2588 2120 5ttnth.exe 30 PID 2120 wrote to memory of 2588 2120 5ttnth.exe 30 PID 2120 wrote to memory of 2588 2120 5ttnth.exe 30 PID 2120 wrote to memory of 2588 2120 5ttnth.exe 30 PID 2588 wrote to memory of 2592 2588 jdpvj.exe 31 PID 2588 wrote to memory of 2592 2588 jdpvj.exe 31 PID 2588 wrote to memory of 2592 2588 jdpvj.exe 31 PID 2588 wrote to memory of 2592 2588 jdpvj.exe 31 PID 2592 wrote to memory of 2732 2592 rlffffr.exe 32 PID 2592 wrote to memory of 2732 2592 rlffffr.exe 32 PID 2592 wrote to memory of 2732 2592 rlffffr.exe 32 PID 2592 wrote to memory of 2732 2592 rlffffr.exe 32 PID 2732 wrote to memory of 2464 2732 hhnhnh.exe 33 PID 2732 wrote to memory of 2464 2732 hhnhnh.exe 33 PID 2732 wrote to memory of 2464 2732 hhnhnh.exe 33 PID 2732 wrote to memory of 2464 2732 hhnhnh.exe 33 PID 2464 wrote to memory of 2676 2464 tnttnn.exe 34 PID 2464 wrote to memory of 2676 2464 tnttnn.exe 34 PID 2464 wrote to memory of 2676 2464 tnttnn.exe 34 PID 2464 wrote to memory of 2676 2464 tnttnn.exe 34 PID 2676 wrote to memory of 2512 2676 vvvpd.exe 35 PID 2676 wrote to memory of 2512 2676 vvvpd.exe 35 PID 2676 wrote to memory of 2512 2676 vvvpd.exe 35 PID 2676 wrote to memory of 2512 2676 vvvpd.exe 35 PID 2512 wrote to memory of 2988 2512 vjvvp.exe 36 PID 2512 wrote to memory of 2988 2512 vjvvp.exe 36 PID 2512 wrote to memory of 2988 2512 vjvvp.exe 36 PID 2512 wrote to memory of 2988 2512 vjvvp.exe 36 PID 2988 wrote to memory of 2832 2988 ffxxllx.exe 37 PID 2988 wrote to memory of 2832 2988 ffxxllx.exe 37 PID 2988 wrote to memory of 2832 2988 ffxxllx.exe 37 PID 2988 wrote to memory of 2832 2988 ffxxllx.exe 37 PID 2832 wrote to memory of 2836 2832 9nbntt.exe 38 PID 2832 wrote to memory of 2836 2832 9nbntt.exe 38 PID 2832 wrote to memory of 2836 2832 9nbntt.exe 38 PID 2832 wrote to memory of 2836 2832 9nbntt.exe 38 PID 2836 wrote to memory of 2996 2836 bbbhbb.exe 39 PID 2836 wrote to memory of 2996 2836 bbbhbb.exe 39 PID 2836 wrote to memory of 2996 2836 bbbhbb.exe 39 PID 2836 wrote to memory of 2996 2836 bbbhbb.exe 39 PID 2996 wrote to memory of 2704 2996 3pddj.exe 40 PID 2996 wrote to memory of 2704 2996 3pddj.exe 40 PID 2996 wrote to memory of 2704 2996 3pddj.exe 40 PID 2996 wrote to memory of 2704 2996 3pddj.exe 40 PID 2704 wrote to memory of 2416 2704 7ddjp.exe 41 PID 2704 wrote to memory of 2416 2704 7ddjp.exe 41 PID 2704 wrote to memory of 2416 2704 7ddjp.exe 41 PID 2704 wrote to memory of 2416 2704 7ddjp.exe 41 PID 2416 wrote to memory of 1856 2416 xrxllrf.exe 42 PID 2416 wrote to memory of 1856 2416 xrxllrf.exe 42 PID 2416 wrote to memory of 1856 2416 xrxllrf.exe 42 PID 2416 wrote to memory of 1856 2416 xrxllrf.exe 42 PID 1856 wrote to memory of 320 1856 hhbhbn.exe 43 PID 1856 wrote to memory of 320 1856 hhbhbn.exe 43 PID 1856 wrote to memory of 320 1856 hhbhbn.exe 43 PID 1856 wrote to memory of 320 1856 hhbhbn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\b94572e17b5f93b711d37087eda456ef93c5ca8bbf05ae8d355a09ebbe41f1c5.exe"C:\Users\Admin\AppData\Local\Temp\b94572e17b5f93b711d37087eda456ef93c5ca8bbf05ae8d355a09ebbe41f1c5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\lxxfllf.exec:\lxxfllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\5ttnth.exec:\5ttnth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\jdpvj.exec:\jdpvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\rlffffr.exec:\rlffffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\hhnhnh.exec:\hhnhnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\tnttnn.exec:\tnttnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\vvvpd.exec:\vvvpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\vjvvp.exec:\vjvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\ffxxllx.exec:\ffxxllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\9nbntt.exec:\9nbntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\bbbhbb.exec:\bbbhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\3pddj.exec:\3pddj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\7ddjp.exec:\7ddjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\xrxllrf.exec:\xrxllrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\hhbhbn.exec:\hhbhbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\7hbtbh.exec:\7hbtbh.exe17⤵
- Executes dropped EXE
PID:320 -
\??\c:\9djdp.exec:\9djdp.exe18⤵
- Executes dropped EXE
PID:2776 -
\??\c:\vpddj.exec:\vpddj.exe19⤵
- Executes dropped EXE
PID:1556 -
\??\c:\xxfxrlx.exec:\xxfxrlx.exe20⤵
- Executes dropped EXE
PID:2116 -
\??\c:\9btnbb.exec:\9btnbb.exe21⤵
- Executes dropped EXE
PID:2260 -
\??\c:\jddjv.exec:\jddjv.exe22⤵
- Executes dropped EXE
PID:1228 -
\??\c:\rfxxxfl.exec:\rfxxxfl.exe23⤵
- Executes dropped EXE
PID:2044 -
\??\c:\ffxrlrl.exec:\ffxrlrl.exe24⤵
- Executes dropped EXE
PID:956 -
\??\c:\1hbhnn.exec:\1hbhnn.exe25⤵
- Executes dropped EXE
PID:2180 -
\??\c:\nntthn.exec:\nntthn.exe26⤵
- Executes dropped EXE
PID:876 -
\??\c:\djjvv.exec:\djjvv.exe27⤵
- Executes dropped EXE
PID:1364 -
\??\c:\dpjpd.exec:\dpjpd.exe28⤵
- Executes dropped EXE
PID:1716 -
\??\c:\3lxflxf.exec:\3lxflxf.exe29⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nhtthh.exec:\nhtthh.exe30⤵
- Executes dropped EXE
PID:1704 -
\??\c:\1bbbhn.exec:\1bbbhn.exe31⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jdpdj.exec:\jdpdj.exe32⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jjddv.exec:\jjddv.exe33⤵
- Executes dropped EXE
PID:3052 -
\??\c:\3xrfrxf.exec:\3xrfrxf.exe34⤵
- Executes dropped EXE
PID:2144 -
\??\c:\xrxflrx.exec:\xrxflrx.exe35⤵
- Executes dropped EXE
PID:1712 -
\??\c:\3bhhnt.exec:\3bhhnt.exe36⤵
- Executes dropped EXE
PID:2276 -
\??\c:\bthnbn.exec:\bthnbn.exe37⤵
- Executes dropped EXE
PID:2256 -
\??\c:\vpvpv.exec:\vpvpv.exe38⤵
- Executes dropped EXE
PID:2644 -
\??\c:\3ppjp.exec:\3ppjp.exe39⤵
- Executes dropped EXE
PID:2588 -
\??\c:\llffxlx.exec:\llffxlx.exe40⤵
- Executes dropped EXE
PID:2556 -
\??\c:\lfxfxxx.exec:\lfxfxxx.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nhntbt.exec:\nhntbt.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\bnbhbt.exec:\bnbhbt.exe43⤵
- Executes dropped EXE
PID:2480 -
\??\c:\vpjpd.exec:\vpjpd.exe44⤵
- Executes dropped EXE
PID:2552 -
\??\c:\dvppp.exec:\dvppp.exe45⤵
- Executes dropped EXE
PID:2472 -
\??\c:\lfrrllx.exec:\lfrrllx.exe46⤵
- Executes dropped EXE
PID:772 -
\??\c:\rlflrxl.exec:\rlflrxl.exe47⤵
- Executes dropped EXE
PID:2848 -
\??\c:\nnhthn.exec:\nnhthn.exe48⤵
- Executes dropped EXE
PID:2804 -
\??\c:\tnnbhn.exec:\tnnbhn.exe49⤵
- Executes dropped EXE
PID:2940 -
\??\c:\9pjpv.exec:\9pjpv.exe50⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vpddp.exec:\vpddp.exe51⤵
- Executes dropped EXE
PID:1788 -
\??\c:\xrflrxl.exec:\xrflrxl.exe52⤵
- Executes dropped EXE
PID:2496 -
\??\c:\lxlrlll.exec:\lxlrlll.exe53⤵
- Executes dropped EXE
PID:2528 -
\??\c:\7nbnbh.exec:\7nbnbh.exe54⤵
- Executes dropped EXE
PID:2788 -
\??\c:\nhnbnb.exec:\nhnbnb.exe55⤵
- Executes dropped EXE
PID:2772 -
\??\c:\3ppdd.exec:\3ppdd.exe56⤵
- Executes dropped EXE
PID:1528 -
\??\c:\llflrrf.exec:\llflrrf.exe57⤵
- Executes dropped EXE
PID:1448 -
\??\c:\bbntbh.exec:\bbntbh.exe58⤵
- Executes dropped EXE
PID:3016 -
\??\c:\bhnbbb.exec:\bhnbbb.exe59⤵
- Executes dropped EXE
PID:3064 -
\??\c:\5hhbhn.exec:\5hhbhn.exe60⤵
- Executes dropped EXE
PID:2232 -
\??\c:\pjvdd.exec:\pjvdd.exe61⤵
- Executes dropped EXE
PID:2900 -
\??\c:\dpjvd.exec:\dpjvd.exe62⤵
- Executes dropped EXE
PID:596 -
\??\c:\xflrxxr.exec:\xflrxxr.exe63⤵
- Executes dropped EXE
PID:2080 -
\??\c:\ntnnhh.exec:\ntnnhh.exe64⤵
- Executes dropped EXE
PID:956 -
\??\c:\hbhhth.exec:\hbhhth.exe65⤵
- Executes dropped EXE
PID:2412 -
\??\c:\pppvv.exec:\pppvv.exe66⤵PID:3000
-
\??\c:\5vddj.exec:\5vddj.exe67⤵PID:292
-
\??\c:\xxlxrxl.exec:\xxlxrxl.exe68⤵PID:1048
-
\??\c:\3ffrflr.exec:\3ffrflr.exe69⤵PID:1836
-
\??\c:\hhntbb.exec:\hhntbb.exe70⤵PID:3036
-
\??\c:\bbnttb.exec:\bbnttb.exe71⤵PID:2520
-
\??\c:\jddpv.exec:\jddpv.exe72⤵PID:2084
-
\??\c:\jdvvj.exec:\jdvvj.exe73⤵PID:1744
-
\??\c:\3jvvd.exec:\3jvvd.exe74⤵PID:2296
-
\??\c:\fxffrxf.exec:\fxffrxf.exe75⤵PID:328
-
\??\c:\9xlfflx.exec:\9xlfflx.exe76⤵PID:1720
-
\??\c:\1tttbb.exec:\1tttbb.exe77⤵PID:1732
-
\??\c:\bbtttb.exec:\bbtttb.exe78⤵PID:1256
-
\??\c:\vppvp.exec:\vppvp.exe79⤵PID:2532
-
\??\c:\llxxfrf.exec:\llxxfrf.exe80⤵PID:2580
-
\??\c:\xlxfxrf.exec:\xlxfxrf.exe81⤵PID:872
-
\??\c:\fxlrflx.exec:\fxlrflx.exe82⤵PID:2624
-
\??\c:\hhnnbh.exec:\hhnnbh.exe83⤵PID:2404
-
\??\c:\nhnbnb.exec:\nhnbnb.exe84⤵PID:2608
-
\??\c:\jdpjv.exec:\jdpjv.exe85⤵PID:1656
-
\??\c:\ppddv.exec:\ppddv.exe86⤵PID:2560
-
\??\c:\rrfrfll.exec:\rrfrfll.exe87⤵PID:2516
-
\??\c:\5lllrxf.exec:\5lllrxf.exe88⤵PID:2400
-
\??\c:\3bnhbb.exec:\3bnhbb.exe89⤵PID:2792
-
\??\c:\ppvvv.exec:\ppvvv.exe90⤵PID:2972
-
\??\c:\ppjjp.exec:\ppjjp.exe91⤵PID:2428
-
\??\c:\xrlrflr.exec:\xrlrflr.exe92⤵PID:2696
-
\??\c:\7frrxxf.exec:\7frrxxf.exe93⤵PID:1684
-
\??\c:\llxfllx.exec:\llxfllx.exe94⤵PID:1632
-
\??\c:\htbhhn.exec:\htbhhn.exe95⤵PID:1432
-
\??\c:\bbtntb.exec:\bbtntb.exe96⤵PID:2680
-
\??\c:\pjdjp.exec:\pjdjp.exe97⤵PID:1652
-
\??\c:\vpjdp.exec:\vpjdp.exe98⤵PID:1532
-
\??\c:\lffxlll.exec:\lffxlll.exe99⤵PID:644
-
\??\c:\frfxffl.exec:\frfxffl.exe100⤵PID:1768
-
\??\c:\bbbnbh.exec:\bbbnbh.exe101⤵PID:3040
-
\??\c:\bthnbn.exec:\bthnbn.exe102⤵PID:2260
-
\??\c:\vpjjp.exec:\vpjjp.exe103⤵PID:324
-
\??\c:\3dvvd.exec:\3dvvd.exe104⤵PID:2088
-
\??\c:\lxffxxl.exec:\lxffxxl.exe105⤵PID:584
-
\??\c:\rrflrfl.exec:\rrflrfl.exe106⤵PID:1112
-
\??\c:\9tttbh.exec:\9tttbh.exe107⤵PID:1400
-
\??\c:\hbnttt.exec:\hbnttt.exe108⤵PID:1624
-
\??\c:\nbhbbb.exec:\nbhbbb.exe109⤵PID:1364
-
\??\c:\9vppp.exec:\9vppp.exe110⤵PID:716
-
\??\c:\jvjjd.exec:\jvjjd.exe111⤵PID:888
-
\??\c:\rlffffr.exec:\rlffffr.exe112⤵PID:2204
-
\??\c:\rfllffl.exec:\rfllffl.exe113⤵PID:2264
-
\??\c:\hbbtbb.exec:\hbbtbb.exe114⤵PID:384
-
\??\c:\nhtbhn.exec:\nhtbhn.exe115⤵PID:1792
-
\??\c:\ppvdd.exec:\ppvdd.exe116⤵PID:2164
-
\??\c:\vvdvd.exec:\vvdvd.exe117⤵PID:1756
-
\??\c:\pdjvp.exec:\pdjvp.exe118⤵PID:2756
-
\??\c:\rfxrlll.exec:\rfxrlll.exe119⤵PID:2148
-
\??\c:\hbnthh.exec:\hbnthh.exe120⤵PID:2640
-
\??\c:\nhnnnt.exec:\nhnnnt.exe121⤵PID:2568
-
\??\c:\vvjjv.exec:\vvjjv.exe122⤵PID:2644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-