Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 10:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
54e9621b7292296660360a6710a18d9458a77e21348b0a21d8446d6a6a31da89.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
54e9621b7292296660360a6710a18d9458a77e21348b0a21d8446d6a6a31da89.exe
-
Size
80KB
-
MD5
d21cc6347c13b05e708970b2272b9b00
-
SHA1
14e0ef66dd1aec7e4f02e51223e823b5c4745fb2
-
SHA256
54e9621b7292296660360a6710a18d9458a77e21348b0a21d8446d6a6a31da89
-
SHA512
c02022af7768403a44f18ea9a3e4d7d295f2f2186cf8090e9e79b808b04ce81bbf59d753d6dd3d2e4817a71ec19a49f40b139ba6fa23b18380271b31a088166b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLU1gxm1S3PQ7CnPRKiir5A:ymb3NkkiQ3mdBjFoLkmx/g8ZKzA
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/1048-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1048-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-71-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/772-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/904-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/496-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
3vddd.exelrflfxx.exe3rrxxrx.exetnbhnb.exe9pppv.exerlxxlrl.exe5bnthh.exehbntnn.exevpjdd.exe1rlxffl.exexrxrrrx.exethnnnn.exe1hntbb.exenhtbht.exejvjpj.exexlrxflx.exefrrxfxf.exe3thhnt.exehbbntt.exebhnhnb.exepjvdp.exe7rfllrf.exefrxrrrx.exethbtnn.exenhbnnh.exedpjvv.exejddjp.exe5lffxxl.exebtnbhb.exe3vjdd.exe5vddj.exexflflfl.exebnhhnt.exe3btnnh.exevjdjp.exepdjjd.exerfxxrrx.exelxlffrr.exenbnthn.exehnnnhh.exevpjjp.exejjddj.exerlrlrrx.exelxfxfff.exenhnthb.exepvvpp.exe1jpjj.exe9jvpj.exelfrrlll.exebnhhbt.exe5nbhnn.exebnbntb.exejdvdj.exelfrxxxx.exe3lrrrff.exe3tnnhh.exehbbbbt.exepjvdv.exepdvpd.exepjddp.exe9fxrxfr.exexffffff.exehtbhnn.exevjppj.exepid process 2960 3vddd.exe 2708 lrflfxx.exe 2536 3rrxxrx.exe 2696 tnbhnb.exe 2772 9pppv.exe 2620 rlxxlrl.exe 1720 5bnthh.exe 2504 hbntnn.exe 2856 vpjdd.exe 1620 1rlxffl.exe 1508 xrxrrrx.exe 2736 thnnnn.exe 1520 1hntbb.exe 380 nhtbht.exe 2160 jvjpj.exe 996 xlrxflx.exe 2380 frrxfxf.exe 632 3thhnt.exe 2072 hbbntt.exe 2404 bhnhnb.exe 2136 pjvdp.exe 336 7rfllrf.exe 772 frxrrrx.exe 1160 thbtnn.exe 904 nhbnnh.exe 1948 dpjvv.exe 496 jddjp.exe 1996 5lffxxl.exe 1952 btnbhb.exe 1960 3vjdd.exe 1504 5vddj.exe 2280 xflflfl.exe 2872 bnhhnt.exe 2992 3btnnh.exe 2612 vjdjp.exe 2536 pdjjd.exe 1604 rfxxrrx.exe 2432 lxlffrr.exe 2656 nbnthn.exe 2704 hnnnhh.exe 2564 vpjjp.exe 2420 jjddj.exe 2444 rlrlrrx.exe 2600 lxfxfff.exe 300 nhnthb.exe 1672 pvvpp.exe 2412 1jpjj.exe 1508 9jvpj.exe 1576 lfrrlll.exe 1784 bnhhbt.exe 768 5nbhnn.exe 2216 bnbntb.exe 2160 jdvdj.exe 996 lfrxxxx.exe 2316 3lrrrff.exe 848 3tnnhh.exe 2524 hbbbbt.exe 1916 pjvdv.exe 3036 pdvpd.exe 2124 pjddp.exe 776 9fxrxfr.exe 1480 xffffff.exe 1052 htbhnn.exe 1736 vjppj.exe -
Processes:
resource yara_rule behavioral1/memory/1048-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/772-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/904-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/496-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-271-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
54e9621b7292296660360a6710a18d9458a77e21348b0a21d8446d6a6a31da89.exe3vddd.exelrflfxx.exe3rrxxrx.exetnbhnb.exe9pppv.exerlxxlrl.exe5bnthh.exehbntnn.exevpjdd.exe1rlxffl.exexrxrrrx.exethnnnn.exe1hntbb.exenhtbht.exejvjpj.exedescription pid process target process PID 1048 wrote to memory of 2960 1048 54e9621b7292296660360a6710a18d9458a77e21348b0a21d8446d6a6a31da89.exe 3vddd.exe PID 1048 wrote to memory of 2960 1048 54e9621b7292296660360a6710a18d9458a77e21348b0a21d8446d6a6a31da89.exe 3vddd.exe PID 1048 wrote to memory of 2960 1048 54e9621b7292296660360a6710a18d9458a77e21348b0a21d8446d6a6a31da89.exe 3vddd.exe PID 1048 wrote to memory of 2960 1048 54e9621b7292296660360a6710a18d9458a77e21348b0a21d8446d6a6a31da89.exe 3vddd.exe PID 2960 wrote to memory of 2708 2960 3vddd.exe lrflfxx.exe PID 2960 wrote to memory of 2708 2960 3vddd.exe lrflfxx.exe PID 2960 wrote to memory of 2708 2960 3vddd.exe lrflfxx.exe PID 2960 wrote to memory of 2708 2960 3vddd.exe lrflfxx.exe PID 2708 wrote to memory of 2536 2708 lrflfxx.exe 3rrxxrx.exe PID 2708 wrote to memory of 2536 2708 lrflfxx.exe 3rrxxrx.exe PID 2708 wrote to memory of 2536 2708 lrflfxx.exe 3rrxxrx.exe PID 2708 wrote to memory of 2536 2708 lrflfxx.exe 3rrxxrx.exe PID 2536 wrote to memory of 2696 2536 3rrxxrx.exe tnbhnb.exe PID 2536 wrote to memory of 2696 2536 3rrxxrx.exe tnbhnb.exe PID 2536 wrote to memory of 2696 2536 3rrxxrx.exe tnbhnb.exe PID 2536 wrote to memory of 2696 2536 3rrxxrx.exe tnbhnb.exe PID 2696 wrote to memory of 2772 2696 tnbhnb.exe 9pppv.exe PID 2696 wrote to memory of 2772 2696 tnbhnb.exe 9pppv.exe PID 2696 wrote to memory of 2772 2696 tnbhnb.exe 9pppv.exe PID 2696 wrote to memory of 2772 2696 tnbhnb.exe 9pppv.exe PID 2772 wrote to memory of 2620 2772 9pppv.exe rlxxlrl.exe PID 2772 wrote to memory of 2620 2772 9pppv.exe rlxxlrl.exe PID 2772 wrote to memory of 2620 2772 9pppv.exe rlxxlrl.exe PID 2772 wrote to memory of 2620 2772 9pppv.exe rlxxlrl.exe PID 2620 wrote to memory of 1720 2620 rlxxlrl.exe 5bnthh.exe PID 2620 wrote to memory of 1720 2620 rlxxlrl.exe 5bnthh.exe PID 2620 wrote to memory of 1720 2620 rlxxlrl.exe 5bnthh.exe PID 2620 wrote to memory of 1720 2620 rlxxlrl.exe 5bnthh.exe PID 1720 wrote to memory of 2504 1720 5bnthh.exe hbntnn.exe PID 1720 wrote to memory of 2504 1720 5bnthh.exe hbntnn.exe PID 1720 wrote to memory of 2504 1720 5bnthh.exe hbntnn.exe PID 1720 wrote to memory of 2504 1720 5bnthh.exe hbntnn.exe PID 2504 wrote to memory of 2856 2504 hbntnn.exe vpjdd.exe PID 2504 wrote to memory of 2856 2504 hbntnn.exe vpjdd.exe PID 2504 wrote to memory of 2856 2504 hbntnn.exe vpjdd.exe PID 2504 wrote to memory of 2856 2504 hbntnn.exe vpjdd.exe PID 2856 wrote to memory of 1620 2856 vpjdd.exe 1rlxffl.exe PID 2856 wrote to memory of 1620 2856 vpjdd.exe 1rlxffl.exe PID 2856 wrote to memory of 1620 2856 vpjdd.exe 1rlxffl.exe PID 2856 wrote to memory of 1620 2856 vpjdd.exe 1rlxffl.exe PID 1620 wrote to memory of 1508 1620 1rlxffl.exe xrxrrrx.exe PID 1620 wrote to memory of 1508 1620 1rlxffl.exe xrxrrrx.exe PID 1620 wrote to memory of 1508 1620 1rlxffl.exe xrxrrrx.exe PID 1620 wrote to memory of 1508 1620 1rlxffl.exe xrxrrrx.exe PID 1508 wrote to memory of 2736 1508 xrxrrrx.exe thnnnn.exe PID 1508 wrote to memory of 2736 1508 xrxrrrx.exe thnnnn.exe PID 1508 wrote to memory of 2736 1508 xrxrrrx.exe thnnnn.exe PID 1508 wrote to memory of 2736 1508 xrxrrrx.exe thnnnn.exe PID 2736 wrote to memory of 1520 2736 thnnnn.exe 1hntbb.exe PID 2736 wrote to memory of 1520 2736 thnnnn.exe 1hntbb.exe PID 2736 wrote to memory of 1520 2736 thnnnn.exe 1hntbb.exe PID 2736 wrote to memory of 1520 2736 thnnnn.exe 1hntbb.exe PID 1520 wrote to memory of 380 1520 1hntbb.exe nhtbht.exe PID 1520 wrote to memory of 380 1520 1hntbb.exe nhtbht.exe PID 1520 wrote to memory of 380 1520 1hntbb.exe nhtbht.exe PID 1520 wrote to memory of 380 1520 1hntbb.exe nhtbht.exe PID 380 wrote to memory of 2160 380 nhtbht.exe jvjpj.exe PID 380 wrote to memory of 2160 380 nhtbht.exe jvjpj.exe PID 380 wrote to memory of 2160 380 nhtbht.exe jvjpj.exe PID 380 wrote to memory of 2160 380 nhtbht.exe jvjpj.exe PID 2160 wrote to memory of 996 2160 jvjpj.exe xlrxflx.exe PID 2160 wrote to memory of 996 2160 jvjpj.exe xlrxflx.exe PID 2160 wrote to memory of 996 2160 jvjpj.exe xlrxflx.exe PID 2160 wrote to memory of 996 2160 jvjpj.exe xlrxflx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54e9621b7292296660360a6710a18d9458a77e21348b0a21d8446d6a6a31da89.exe"C:\Users\Admin\AppData\Local\Temp\54e9621b7292296660360a6710a18d9458a77e21348b0a21d8446d6a6a31da89.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\3vddd.exec:\3vddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\lrflfxx.exec:\lrflfxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\3rrxxrx.exec:\3rrxxrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\tnbhnb.exec:\tnbhnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\9pppv.exec:\9pppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\rlxxlrl.exec:\rlxxlrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\5bnthh.exec:\5bnthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\hbntnn.exec:\hbntnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\vpjdd.exec:\vpjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\1rlxffl.exec:\1rlxffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\xrxrrrx.exec:\xrxrrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\thnnnn.exec:\thnnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\1hntbb.exec:\1hntbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\nhtbht.exec:\nhtbht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\jvjpj.exec:\jvjpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\xlrxflx.exec:\xlrxflx.exe17⤵
- Executes dropped EXE
PID:996 -
\??\c:\frrxfxf.exec:\frrxfxf.exe18⤵
- Executes dropped EXE
PID:2380 -
\??\c:\3thhnt.exec:\3thhnt.exe19⤵
- Executes dropped EXE
PID:632 -
\??\c:\hbbntt.exec:\hbbntt.exe20⤵
- Executes dropped EXE
PID:2072 -
\??\c:\bhnhnb.exec:\bhnhnb.exe21⤵
- Executes dropped EXE
PID:2404 -
\??\c:\pjvdp.exec:\pjvdp.exe22⤵
- Executes dropped EXE
PID:2136 -
\??\c:\7rfllrf.exec:\7rfllrf.exe23⤵
- Executes dropped EXE
PID:336 -
\??\c:\frxrrrx.exec:\frxrrrx.exe24⤵
- Executes dropped EXE
PID:772 -
\??\c:\thbtnn.exec:\thbtnn.exe25⤵
- Executes dropped EXE
PID:1160 -
\??\c:\nhbnnh.exec:\nhbnnh.exe26⤵
- Executes dropped EXE
PID:904 -
\??\c:\dpjvv.exec:\dpjvv.exe27⤵
- Executes dropped EXE
PID:1948 -
\??\c:\jddjp.exec:\jddjp.exe28⤵
- Executes dropped EXE
PID:496 -
\??\c:\5lffxxl.exec:\5lffxxl.exe29⤵
- Executes dropped EXE
PID:1996 -
\??\c:\btnbhb.exec:\btnbhb.exe30⤵
- Executes dropped EXE
PID:1952 -
\??\c:\3vjdd.exec:\3vjdd.exe31⤵
- Executes dropped EXE
PID:1960 -
\??\c:\5vddj.exec:\5vddj.exe32⤵
- Executes dropped EXE
PID:1504 -
\??\c:\xflflfl.exec:\xflflfl.exe33⤵
- Executes dropped EXE
PID:2280 -
\??\c:\bnhhnt.exec:\bnhhnt.exe34⤵
- Executes dropped EXE
PID:2872 -
\??\c:\3btnnh.exec:\3btnnh.exe35⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vjdjp.exec:\vjdjp.exe36⤵
- Executes dropped EXE
PID:2612 -
\??\c:\pdjjd.exec:\pdjjd.exe37⤵
- Executes dropped EXE
PID:2536 -
\??\c:\rfxxrrx.exec:\rfxxrrx.exe38⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lxlffrr.exec:\lxlffrr.exe39⤵
- Executes dropped EXE
PID:2432 -
\??\c:\nbnthn.exec:\nbnthn.exe40⤵
- Executes dropped EXE
PID:2656 -
\??\c:\hnnnhh.exec:\hnnnhh.exe41⤵
- Executes dropped EXE
PID:2704 -
\??\c:\vpjjp.exec:\vpjjp.exe42⤵
- Executes dropped EXE
PID:2564 -
\??\c:\jjddj.exec:\jjddj.exe43⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe44⤵
- Executes dropped EXE
PID:2444 -
\??\c:\lxfxfff.exec:\lxfxfff.exe45⤵
- Executes dropped EXE
PID:2600 -
\??\c:\nhnthb.exec:\nhnthb.exe46⤵
- Executes dropped EXE
PID:300 -
\??\c:\pvvpp.exec:\pvvpp.exe47⤵
- Executes dropped EXE
PID:1672 -
\??\c:\1jpjj.exec:\1jpjj.exe48⤵
- Executes dropped EXE
PID:2412 -
\??\c:\9jvpj.exec:\9jvpj.exe49⤵
- Executes dropped EXE
PID:1508 -
\??\c:\lfrrlll.exec:\lfrrlll.exe50⤵
- Executes dropped EXE
PID:1576 -
\??\c:\bnhhbt.exec:\bnhhbt.exe51⤵
- Executes dropped EXE
PID:1784 -
\??\c:\5nbhnn.exec:\5nbhnn.exe52⤵
- Executes dropped EXE
PID:768 -
\??\c:\bnbntb.exec:\bnbntb.exe53⤵
- Executes dropped EXE
PID:2216 -
\??\c:\jdvdj.exec:\jdvdj.exe54⤵
- Executes dropped EXE
PID:2160 -
\??\c:\lfrxxxx.exec:\lfrxxxx.exe55⤵
- Executes dropped EXE
PID:996 -
\??\c:\3lrrrff.exec:\3lrrrff.exe56⤵
- Executes dropped EXE
PID:2316 -
\??\c:\3tnnhh.exec:\3tnnhh.exe57⤵
- Executes dropped EXE
PID:848 -
\??\c:\hbbbbt.exec:\hbbbbt.exe58⤵
- Executes dropped EXE
PID:2524 -
\??\c:\pjvdv.exec:\pjvdv.exe59⤵
- Executes dropped EXE
PID:1916 -
\??\c:\pdvpd.exec:\pdvpd.exe60⤵
- Executes dropped EXE
PID:3036 -
\??\c:\pjddp.exec:\pjddp.exe61⤵
- Executes dropped EXE
PID:2124 -
\??\c:\9fxrxfr.exec:\9fxrxfr.exe62⤵
- Executes dropped EXE
PID:776 -
\??\c:\xffffff.exec:\xffffff.exe63⤵
- Executes dropped EXE
PID:1480 -
\??\c:\htbhnn.exec:\htbhnn.exe64⤵
- Executes dropped EXE
PID:1052 -
\??\c:\vjppj.exec:\vjppj.exe65⤵
- Executes dropped EXE
PID:1736 -
\??\c:\pddvd.exec:\pddvd.exe66⤵PID:1820
-
\??\c:\vjvdv.exec:\vjvdv.exe67⤵PID:1356
-
\??\c:\lxrrxxr.exec:\lxrrxxr.exe68⤵PID:1276
-
\??\c:\rlxlffx.exec:\rlxlffx.exe69⤵PID:1124
-
\??\c:\thnntt.exec:\thnntt.exe70⤵PID:1996
-
\??\c:\hbhnhn.exec:\hbhnhn.exe71⤵PID:2032
-
\??\c:\3djvp.exec:\3djvp.exe72⤵PID:1792
-
\??\c:\jvdvd.exec:\jvdvd.exe73⤵PID:1252
-
\??\c:\1rfxffl.exec:\1rfxffl.exe74⤵PID:1504
-
\??\c:\xflfffx.exec:\xflfffx.exe75⤵PID:2960
-
\??\c:\hthnbt.exec:\hthnbt.exe76⤵PID:2016
-
\??\c:\nbntbn.exec:\nbntbn.exe77⤵PID:1280
-
\??\c:\pjppv.exec:\pjppv.exe78⤵PID:2568
-
\??\c:\vpvvv.exec:\vpvvv.exe79⤵PID:1596
-
\??\c:\rlfxrxf.exec:\rlfxrxf.exe80⤵PID:1712
-
\??\c:\xlfxxfr.exec:\xlfxxfr.exe81⤵PID:2980
-
\??\c:\7bhbtt.exec:\7bhbtt.exe82⤵PID:2744
-
\??\c:\pdvpv.exec:\pdvpv.exe83⤵PID:2228
-
\??\c:\jvddp.exec:\jvddp.exe84⤵PID:2428
-
\??\c:\1lllrrf.exec:\1lllrrf.exe85⤵PID:2456
-
\??\c:\frfxflr.exec:\frfxflr.exe86⤵PID:3056
-
\??\c:\bnnhhh.exec:\bnnhhh.exe87⤵PID:1668
-
\??\c:\hbhhhb.exec:\hbhhhb.exe88⤵PID:2164
-
\??\c:\pvvvd.exec:\pvvvd.exe89⤵PID:1696
-
\??\c:\vjvvp.exec:\vjvvp.exe90⤵PID:2488
-
\??\c:\xlxxxfl.exec:\xlxxxfl.exe91⤵PID:2716
-
\??\c:\1xxrxrl.exec:\1xxrxrl.exe92⤵PID:1652
-
\??\c:\9htnnh.exec:\9htnnh.exe93⤵PID:1980
-
\??\c:\bthbnn.exec:\bthbnn.exe94⤵PID:2348
-
\??\c:\5dvdv.exec:\5dvdv.exe95⤵PID:2212
-
\??\c:\jdpjj.exec:\jdpjj.exe96⤵PID:2748
-
\??\c:\lfflrrf.exec:\lfflrrf.exe97⤵PID:1496
-
\??\c:\rlxrffr.exec:\rlxrffr.exe98⤵PID:1324
-
\??\c:\5hhtbb.exec:\5hhtbb.exe99⤵PID:2968
-
\??\c:\hbbbnn.exec:\hbbbnn.exe100⤵PID:2064
-
\??\c:\dpdjj.exec:\dpdjj.exe101⤵PID:1756
-
\??\c:\ppdjv.exec:\ppdjv.exe102⤵PID:1912
-
\??\c:\xlfflll.exec:\xlfflll.exe103⤵PID:560
-
\??\c:\fxxrflr.exec:\fxxrflr.exe104⤵PID:1476
-
\??\c:\5tnntt.exec:\5tnntt.exe105⤵PID:1856
-
\??\c:\bbnnbb.exec:\bbnnbb.exe106⤵PID:1108
-
\??\c:\dpdvv.exec:\dpdvv.exe107⤵PID:1420
-
\??\c:\1rrrxfr.exec:\1rrrxfr.exe108⤵PID:1872
-
\??\c:\frfxrxl.exec:\frfxrxl.exe109⤵PID:936
-
\??\c:\9tnthn.exec:\9tnthn.exe110⤵PID:1344
-
\??\c:\5bnhnb.exec:\5bnhnb.exe111⤵PID:1248
-
\??\c:\vvvjd.exec:\vvvjd.exe112⤵PID:3000
-
\??\c:\jjdjp.exec:\jjdjp.exe113⤵PID:2176
-
\??\c:\lxfrxrx.exec:\lxfrxrx.exe114⤵PID:876
-
\??\c:\xlrrflr.exec:\xlrrflr.exe115⤵PID:2024
-
\??\c:\nbnttt.exec:\nbnttt.exe116⤵PID:2280
-
\??\c:\bntntt.exec:\bntntt.exe117⤵PID:2964
-
\??\c:\vvpdj.exec:\vvpdj.exe118⤵PID:2112
-
\??\c:\pdppv.exec:\pdppv.exe119⤵PID:2100
-
\??\c:\7llxxff.exec:\7llxxff.exe120⤵PID:1600
-
\??\c:\fxfrxxf.exec:\fxfrxxf.exe121⤵PID:2556
-
\??\c:\thnthh.exec:\thnthh.exe122⤵PID:2460
-
\??\c:\bbnbnt.exec:\bbnbnt.exe123⤵PID:2628
-
\??\c:\rrlxrlr.exec:\rrlxrlr.exe124⤵PID:2452
-
\??\c:\rlxflrf.exec:\rlxflrf.exe125⤵PID:2424
-
\??\c:\7bnntt.exec:\7bnntt.exe126⤵PID:2440
-
\??\c:\hthnnt.exec:\hthnnt.exe127⤵PID:3024
-
\??\c:\1vjpv.exec:\1vjpv.exe128⤵PID:2324
-
\??\c:\jvjpp.exec:\jvjpp.exe129⤵PID:2856
-
\??\c:\1fffrxf.exec:\1fffrxf.exe130⤵PID:1220
-
\??\c:\3rlrxfl.exec:\3rlrxfl.exe131⤵PID:2732
-
\??\c:\hhnthh.exec:\hhnthh.exe132⤵PID:2728
-
\??\c:\5bnttb.exec:\5bnttb.exe133⤵PID:2724
-
\??\c:\9pjjv.exec:\9pjjv.exe134⤵PID:1740
-
\??\c:\jddpv.exec:\jddpv.exe135⤵PID:380
-
\??\c:\9lfxlrr.exec:\9lfxlrr.exe136⤵PID:2044
-
\??\c:\lxxfrrx.exec:\lxxfrrx.exe137⤵PID:2196
-
\??\c:\bbtntt.exec:\bbtntt.exe138⤵PID:1432
-
\??\c:\nnhbhb.exec:\nnhbhb.exe139⤵PID:1300
-
\??\c:\pvdjv.exec:\pvdjv.exe140⤵PID:2120
-
\??\c:\5djdp.exec:\5djdp.exe141⤵PID:2864
-
\??\c:\fxxlxxl.exec:\fxxlxxl.exe142⤵PID:2404
-
\??\c:\rrfrrfl.exec:\rrfrrfl.exe143⤵PID:2308
-
\??\c:\1fxfrrx.exec:\1fxfrrx.exe144⤵PID:692
-
\??\c:\7nhnbt.exec:\7nhnbt.exe145⤵PID:1096
-
\??\c:\tnnnbh.exec:\tnnnbh.exe146⤵PID:836
-
\??\c:\ddvpd.exec:\ddvpd.exe147⤵PID:1160
-
\??\c:\1vdvj.exec:\1vdvj.exe148⤵PID:2400
-
\??\c:\lfllxxl.exec:\lfllxxl.exe149⤵PID:2808
-
\??\c:\5ffflxf.exec:\5ffflxf.exe150⤵PID:960
-
\??\c:\hntbht.exec:\hntbht.exe151⤵PID:2116
-
\??\c:\thbhnh.exec:\thbhnh.exe152⤵PID:1592
-
\??\c:\vjdjv.exec:\vjdjv.exe153⤵PID:2004
-
\??\c:\pdppd.exec:\pdppd.exe154⤵PID:2192
-
\??\c:\3xrxffl.exec:\3xrxffl.exe155⤵PID:2272
-
\??\c:\llfrfrr.exec:\llfrfrr.exe156⤵PID:2008
-
\??\c:\nnbhtn.exec:\nnbhtn.exe157⤵PID:2264
-
\??\c:\nbhnbh.exec:\nbhnbh.exe158⤵PID:2152
-
\??\c:\tnhhnh.exec:\tnhhnh.exe159⤵PID:2920
-
\??\c:\vppdv.exec:\vppdv.exe160⤵PID:2660
-
\??\c:\5ddpd.exec:\5ddpd.exe161⤵PID:1588
-
\??\c:\1flxfrr.exec:\1flxfrr.exe162⤵PID:2552
-
\??\c:\xrrflrx.exec:\xrrflrx.exe163⤵PID:2588
-
\??\c:\hhhhtt.exec:\hhhhtt.exe164⤵PID:2560
-
\??\c:\1hhntn.exec:\1hhntn.exe165⤵PID:2544
-
\??\c:\dvvpp.exec:\dvvpp.exe166⤵PID:2636
-
\??\c:\dddvd.exec:\dddvd.exe167⤵PID:2860
-
\??\c:\dvvjd.exec:\dvvjd.exe168⤵PID:2492
-
\??\c:\lxrfflx.exec:\lxrfflx.exe169⤵PID:2352
-
\??\c:\lfxxlxf.exec:\lfxxlxf.exe170⤵PID:1580
-
\??\c:\bthbnn.exec:\bthbnn.exe171⤵PID:1620
-
\??\c:\9btbbt.exec:\9btbbt.exe172⤵PID:2516
-
\??\c:\pdddj.exec:\pdddj.exe173⤵PID:320
-
\??\c:\5dpjj.exec:\5dpjj.exe174⤵PID:1040
-
\??\c:\jdpjj.exec:\jdpjj.exe175⤵PID:764
-
\??\c:\7rffflr.exec:\7rffflr.exe176⤵PID:2208
-
\??\c:\7rffllr.exec:\7rffllr.exe177⤵PID:2388
-
\??\c:\nnbbnh.exec:\nnbbnh.exe178⤵PID:1516
-
\??\c:\ttbhbh.exec:\ttbhbh.exe179⤵PID:860
-
\??\c:\1vppv.exec:\1vppv.exe180⤵PID:1440
-
\??\c:\vjpjp.exec:\vjpjp.exe181⤵PID:2020
-
\??\c:\rrffllr.exec:\rrffllr.exe182⤵PID:2072
-
\??\c:\ffxrlxx.exec:\ffxrlxx.exe183⤵PID:2788
-
\??\c:\bntbhh.exec:\bntbhh.exe184⤵PID:2092
-
\??\c:\nbnntn.exec:\nbnntn.exe185⤵PID:2804
-
\??\c:\htttbt.exec:\htttbt.exe186⤵PID:336
-
\??\c:\7vvdj.exec:\7vvdj.exe187⤵PID:328
-
\??\c:\dvpjv.exec:\dvpjv.exe188⤵PID:1812
-
\??\c:\vjppv.exec:\vjppv.exe189⤵PID:956
-
\??\c:\9rflllr.exec:\9rflllr.exe190⤵PID:1528
-
\??\c:\rfxflrx.exec:\rfxflrx.exe191⤵PID:952
-
\??\c:\3nthtt.exec:\3nthtt.exe192⤵PID:568
-
\??\c:\btbtbb.exec:\btbtbb.exe193⤵PID:1112
-
\??\c:\jvddp.exec:\jvddp.exe194⤵PID:1424
-
\??\c:\3pddd.exec:\3pddd.exe195⤵PID:2144
-
\??\c:\ddppj.exec:\ddppj.exe196⤵PID:892
-
\??\c:\lfxfllr.exec:\lfxfllr.exe197⤵PID:1048
-
\??\c:\frffxxl.exec:\frffxxl.exe198⤵PID:2000
-
\??\c:\7bnhhn.exec:\7bnhhn.exe199⤵PID:2096
-
\??\c:\htbthb.exec:\htbthb.exe200⤵PID:2872
-
\??\c:\htbbhn.exec:\htbbhn.exe201⤵PID:2576
-
\??\c:\1vjjv.exec:\1vjjv.exe202⤵PID:1280
-
\??\c:\vpvpv.exec:\vpvpv.exe203⤵PID:2100
-
\??\c:\xxxlrfl.exec:\xxxlrfl.exe204⤵PID:2688
-
\??\c:\xlxfxfl.exec:\xlxfxfl.exe205⤵PID:2940
-
\??\c:\3nbbnn.exec:\3nbbnn.exe206⤵PID:2772
-
\??\c:\nbttbh.exec:\nbttbh.exe207⤵PID:1320
-
\??\c:\7pvpp.exec:\7pvpp.exe208⤵PID:2472
-
\??\c:\dvjjp.exec:\dvjjp.exe209⤵PID:2484
-
\??\c:\7xlrrrx.exec:\7xlrrrx.exe210⤵PID:2852
-
\??\c:\flrxrlr.exec:\flrxrlr.exe211⤵PID:2468
-
\??\c:\1htthn.exec:\1htthn.exe212⤵PID:1524
-
\??\c:\hthntn.exec:\hthntn.exe213⤵PID:1536
-
\??\c:\nhnttb.exec:\nhnttb.exe214⤵PID:352
-
\??\c:\jdvvv.exec:\jdvvv.exe215⤵PID:2488
-
\??\c:\ppvvj.exec:\ppvvj.exe216⤵PID:1520
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe217⤵PID:1652
-
\??\c:\tbtbnh.exec:\tbtbnh.exe218⤵PID:2168
-
\??\c:\nhbbtt.exec:\nhbbtt.exe219⤵PID:2204
-
\??\c:\dpvpp.exec:\dpvpp.exe220⤵PID:2212
-
\??\c:\pjdjd.exec:\pjdjd.exe221⤵PID:2748
-
\??\c:\3frrrrf.exec:\3frrrrf.exe222⤵PID:1496
-
\??\c:\3rllrlr.exec:\3rllrlr.exe223⤵PID:1216
-
\??\c:\7hbbnh.exec:\7hbbnh.exe224⤵PID:2848
-
\??\c:\nbhhhh.exec:\nbhhhh.exe225⤵PID:2796
-
\??\c:\9dvpp.exec:\9dvpp.exe226⤵PID:676
-
\??\c:\pdpdd.exec:\pdpdd.exe227⤵PID:2076
-
\??\c:\vpjjv.exec:\vpjjv.exe228⤵PID:1164
-
\??\c:\frfxffr.exec:\frfxffr.exe229⤵PID:1860
-
\??\c:\lfflrrx.exec:\lfflrrx.exe230⤵PID:1856
-
\??\c:\btthnb.exec:\btthnb.exe231⤵PID:1736
-
\??\c:\bntbhh.exec:\bntbhh.exe232⤵PID:1820
-
\??\c:\hthhnn.exec:\hthhnn.exe233⤵PID:832
-
\??\c:\pdppp.exec:\pdppp.exe234⤵PID:1752
-
\??\c:\vjvvv.exec:\vjvvv.exe235⤵PID:496
-
\??\c:\7xrrxfl.exec:\7xrrxfl.exe236⤵PID:2292
-
\??\c:\xlxrxxf.exec:\xlxrxxf.exe237⤵PID:2812
-
\??\c:\3nbbtt.exec:\3nbbtt.exe238⤵PID:2328
-
\??\c:\bthnnn.exec:\bthnnn.exe239⤵PID:2332
-
\??\c:\ttthbb.exec:\ttthbb.exe240⤵PID:3052
-
\??\c:\jdvdp.exec:\jdvdp.exe241⤵PID:2708
-
\??\c:\ddjjp.exec:\ddjjp.exe242⤵PID:2644