Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 04:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a8a98c20f1e25f16f2be197063fd689de49ea950efccfa24a51b7c9065571135.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a8a98c20f1e25f16f2be197063fd689de49ea950efccfa24a51b7c9065571135.exe
-
Size
128KB
-
MD5
d85f88f4b1bb117749b203a50f5661a0
-
SHA1
be9aec9d7eb327a4c94f25ca55e2c57b9bc9e0cc
-
SHA256
a8a98c20f1e25f16f2be197063fd689de49ea950efccfa24a51b7c9065571135
-
SHA512
86b70645ac614be816fceb5b9a95b4ba453082c6cf88b309587bfb4702421bda5c8d8940d36267d185007c125baa37e7262805c4d5c9ca65dff98cbb9c39181b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHvmQ+EZMYX/x6gtn:n3C9BRW0j/uVEZFJvZ
Malware Config
Signatures
-
Detect Blackmoon payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/860-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/628-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1868-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dpvvv.exeffxxxlf.exenhbnht.exepdjdj.exejpjvd.exexxxfrxl.exetnbbnn.exenhbbtt.exevpvpj.exexlxfrxx.exerfrxfll.exenbtntb.exehbhhnt.exevpvjv.exe3pddv.exe9xfffll.exe1nbttn.exe5hhnnt.exenhnnbh.exedvjjp.exefxrfrfx.exefxlflfl.exexlrrrrr.exe9bbtnn.exehnbhtb.exejddvd.exe1llxxxx.exe9xrflxx.exetbntbb.exevpvdd.exeppjpj.exe1xfrxrl.exebtntht.exetnbhhb.exedvdpd.exevvjvj.exelfrrxxx.exelffxflr.exetnbtbb.exennbhtt.exebbhttb.exepjvpd.exeddvdp.exe9rlrxxf.exexxrfllx.exenhntht.exe3nbttt.exehtttbb.exejvjjv.exevpvvp.exerrlxlrf.exefxrrffl.exe1ttbtb.exe1hhbbb.exe9hbbtt.exe1dvjp.exe1pddp.exefxxxxxf.exe5jpdp.exerrrfxll.exenhbhnn.exejddjj.exe3rrxrxf.exejdpvj.exepid process 2464 dpvvv.exe 2556 ffxxxlf.exe 2496 nhbnht.exe 2692 pdjdj.exe 2952 jpjvd.exe 2368 xxxfrxl.exe 2912 tnbbnn.exe 1868 nhbbtt.exe 2648 vpvpj.exe 2772 xlxfrxx.exe 2612 rfrxfll.exe 2252 nbtntb.exe 1852 hbhhnt.exe 2296 vpvjv.exe 2360 3pddv.exe 1212 9xfffll.exe 2412 1nbttn.exe 2636 5hhnnt.exe 2852 nhnnbh.exe 1192 dvjjp.exe 472 fxrfrfx.exe 908 fxlflfl.exe 572 xlrrrrr.exe 1904 9bbtnn.exe 448 hnbhtb.exe 2272 jddvd.exe 2156 1llxxxx.exe 628 9xrflxx.exe 1412 tbntbb.exe 1648 vpvdd.exe 1432 ppjpj.exe 1272 1xfrxrl.exe 1988 btntht.exe 2964 tnbhhb.exe 2604 dvdpd.exe 2564 vvjvj.exe 2832 lfrrxxx.exe 2396 lffxflr.exe 2332 tnbtbb.exe 2436 nnbhtt.exe 2996 bbhttb.exe 2908 pjvpd.exe 1836 ddvdp.exe 2748 9rlrxxf.exe 2492 xxrfllx.exe 2008 nhntht.exe 1012 3nbttt.exe 2928 htttbb.exe 2092 jvjjv.exe 2028 vpvvp.exe 2660 rrlxlrf.exe 2360 fxrrffl.exe 1212 1ttbtb.exe 2240 1hhbbb.exe 2204 9hbbtt.exe 2472 1dvjp.exe 2852 1pddp.exe 592 fxxxxxf.exe 1884 5jpdp.exe 1728 rrrfxll.exe 612 nhbhnn.exe 3044 jddjj.exe 3020 3rrxrxf.exe 2460 jdpvj.exe -
Processes:
resource yara_rule behavioral1/memory/860-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/628-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1868-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1868-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-53-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a8a98c20f1e25f16f2be197063fd689de49ea950efccfa24a51b7c9065571135.exedpvvv.exeffxxxlf.exenhbnht.exepdjdj.exejpjvd.exexxxfrxl.exetnbbnn.exenhbbtt.exevpvpj.exexlxfrxx.exerfrxfll.exenbtntb.exehbhhnt.exevpvjv.exe3pddv.exedescription pid process target process PID 860 wrote to memory of 2464 860 a8a98c20f1e25f16f2be197063fd689de49ea950efccfa24a51b7c9065571135.exe dpvvv.exe PID 860 wrote to memory of 2464 860 a8a98c20f1e25f16f2be197063fd689de49ea950efccfa24a51b7c9065571135.exe dpvvv.exe PID 860 wrote to memory of 2464 860 a8a98c20f1e25f16f2be197063fd689de49ea950efccfa24a51b7c9065571135.exe dpvvv.exe PID 860 wrote to memory of 2464 860 a8a98c20f1e25f16f2be197063fd689de49ea950efccfa24a51b7c9065571135.exe dpvvv.exe PID 2464 wrote to memory of 2556 2464 dpvvv.exe ffxxxlf.exe PID 2464 wrote to memory of 2556 2464 dpvvv.exe ffxxxlf.exe PID 2464 wrote to memory of 2556 2464 dpvvv.exe ffxxxlf.exe PID 2464 wrote to memory of 2556 2464 dpvvv.exe ffxxxlf.exe PID 2556 wrote to memory of 2496 2556 ffxxxlf.exe nhbnht.exe PID 2556 wrote to memory of 2496 2556 ffxxxlf.exe nhbnht.exe PID 2556 wrote to memory of 2496 2556 ffxxxlf.exe nhbnht.exe PID 2556 wrote to memory of 2496 2556 ffxxxlf.exe nhbnht.exe PID 2496 wrote to memory of 2692 2496 nhbnht.exe pdjdj.exe PID 2496 wrote to memory of 2692 2496 nhbnht.exe pdjdj.exe PID 2496 wrote to memory of 2692 2496 nhbnht.exe pdjdj.exe PID 2496 wrote to memory of 2692 2496 nhbnht.exe pdjdj.exe PID 2692 wrote to memory of 2952 2692 pdjdj.exe jpjvd.exe PID 2692 wrote to memory of 2952 2692 pdjdj.exe jpjvd.exe PID 2692 wrote to memory of 2952 2692 pdjdj.exe jpjvd.exe PID 2692 wrote to memory of 2952 2692 pdjdj.exe jpjvd.exe PID 2952 wrote to memory of 2368 2952 jpjvd.exe xxxfrxl.exe PID 2952 wrote to memory of 2368 2952 jpjvd.exe xxxfrxl.exe PID 2952 wrote to memory of 2368 2952 jpjvd.exe xxxfrxl.exe PID 2952 wrote to memory of 2368 2952 jpjvd.exe xxxfrxl.exe PID 2368 wrote to memory of 2912 2368 xxxfrxl.exe tnbbnn.exe PID 2368 wrote to memory of 2912 2368 xxxfrxl.exe tnbbnn.exe PID 2368 wrote to memory of 2912 2368 xxxfrxl.exe tnbbnn.exe PID 2368 wrote to memory of 2912 2368 xxxfrxl.exe tnbbnn.exe PID 2912 wrote to memory of 1868 2912 tnbbnn.exe nhbbtt.exe PID 2912 wrote to memory of 1868 2912 tnbbnn.exe nhbbtt.exe PID 2912 wrote to memory of 1868 2912 tnbbnn.exe nhbbtt.exe PID 2912 wrote to memory of 1868 2912 tnbbnn.exe nhbbtt.exe PID 1868 wrote to memory of 2648 1868 nhbbtt.exe vpvpj.exe PID 1868 wrote to memory of 2648 1868 nhbbtt.exe vpvpj.exe PID 1868 wrote to memory of 2648 1868 nhbbtt.exe vpvpj.exe PID 1868 wrote to memory of 2648 1868 nhbbtt.exe vpvpj.exe PID 2648 wrote to memory of 2772 2648 vpvpj.exe xlxfrxx.exe PID 2648 wrote to memory of 2772 2648 vpvpj.exe xlxfrxx.exe PID 2648 wrote to memory of 2772 2648 vpvpj.exe xlxfrxx.exe PID 2648 wrote to memory of 2772 2648 vpvpj.exe xlxfrxx.exe PID 2772 wrote to memory of 2612 2772 xlxfrxx.exe rfrxfll.exe PID 2772 wrote to memory of 2612 2772 xlxfrxx.exe rfrxfll.exe PID 2772 wrote to memory of 2612 2772 xlxfrxx.exe rfrxfll.exe PID 2772 wrote to memory of 2612 2772 xlxfrxx.exe rfrxfll.exe PID 2612 wrote to memory of 2252 2612 rfrxfll.exe nbtntb.exe PID 2612 wrote to memory of 2252 2612 rfrxfll.exe nbtntb.exe PID 2612 wrote to memory of 2252 2612 rfrxfll.exe nbtntb.exe PID 2612 wrote to memory of 2252 2612 rfrxfll.exe nbtntb.exe PID 2252 wrote to memory of 1852 2252 nbtntb.exe hbhhnt.exe PID 2252 wrote to memory of 1852 2252 nbtntb.exe hbhhnt.exe PID 2252 wrote to memory of 1852 2252 nbtntb.exe hbhhnt.exe PID 2252 wrote to memory of 1852 2252 nbtntb.exe hbhhnt.exe PID 1852 wrote to memory of 2296 1852 hbhhnt.exe vpvjv.exe PID 1852 wrote to memory of 2296 1852 hbhhnt.exe vpvjv.exe PID 1852 wrote to memory of 2296 1852 hbhhnt.exe vpvjv.exe PID 1852 wrote to memory of 2296 1852 hbhhnt.exe vpvjv.exe PID 2296 wrote to memory of 2360 2296 vpvjv.exe fxrrffl.exe PID 2296 wrote to memory of 2360 2296 vpvjv.exe fxrrffl.exe PID 2296 wrote to memory of 2360 2296 vpvjv.exe fxrrffl.exe PID 2296 wrote to memory of 2360 2296 vpvjv.exe fxrrffl.exe PID 2360 wrote to memory of 1212 2360 3pddv.exe 9xfffll.exe PID 2360 wrote to memory of 1212 2360 3pddv.exe 9xfffll.exe PID 2360 wrote to memory of 1212 2360 3pddv.exe 9xfffll.exe PID 2360 wrote to memory of 1212 2360 3pddv.exe 9xfffll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8a98c20f1e25f16f2be197063fd689de49ea950efccfa24a51b7c9065571135.exe"C:\Users\Admin\AppData\Local\Temp\a8a98c20f1e25f16f2be197063fd689de49ea950efccfa24a51b7c9065571135.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\dpvvv.exec:\dpvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\ffxxxlf.exec:\ffxxxlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\nhbnht.exec:\nhbnht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\pdjdj.exec:\pdjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\jpjvd.exec:\jpjvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\xxxfrxl.exec:\xxxfrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\tnbbnn.exec:\tnbbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\nhbbtt.exec:\nhbbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\vpvpj.exec:\vpvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\xlxfrxx.exec:\xlxfrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\rfrxfll.exec:\rfrxfll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\nbtntb.exec:\nbtntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\hbhhnt.exec:\hbhhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\vpvjv.exec:\vpvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\3pddv.exec:\3pddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\9xfffll.exec:\9xfffll.exe17⤵
- Executes dropped EXE
PID:1212 -
\??\c:\1nbttn.exec:\1nbttn.exe18⤵
- Executes dropped EXE
PID:2412 -
\??\c:\5hhnnt.exec:\5hhnnt.exe19⤵
- Executes dropped EXE
PID:2636 -
\??\c:\nhnnbh.exec:\nhnnbh.exe20⤵
- Executes dropped EXE
PID:2852 -
\??\c:\dvjjp.exec:\dvjjp.exe21⤵
- Executes dropped EXE
PID:1192 -
\??\c:\fxrfrfx.exec:\fxrfrfx.exe22⤵
- Executes dropped EXE
PID:472 -
\??\c:\fxlflfl.exec:\fxlflfl.exe23⤵
- Executes dropped EXE
PID:908 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe24⤵
- Executes dropped EXE
PID:572 -
\??\c:\9bbtnn.exec:\9bbtnn.exe25⤵
- Executes dropped EXE
PID:1904 -
\??\c:\hnbhtb.exec:\hnbhtb.exe26⤵
- Executes dropped EXE
PID:448 -
\??\c:\jddvd.exec:\jddvd.exe27⤵
- Executes dropped EXE
PID:2272 -
\??\c:\1llxxxx.exec:\1llxxxx.exe28⤵
- Executes dropped EXE
PID:2156 -
\??\c:\9xrflxx.exec:\9xrflxx.exe29⤵
- Executes dropped EXE
PID:628 -
\??\c:\tbntbb.exec:\tbntbb.exe30⤵
- Executes dropped EXE
PID:1412 -
\??\c:\vpvdd.exec:\vpvdd.exe31⤵
- Executes dropped EXE
PID:1648 -
\??\c:\ppjpj.exec:\ppjpj.exe32⤵
- Executes dropped EXE
PID:1432 -
\??\c:\1xfrxrl.exec:\1xfrxrl.exe33⤵
- Executes dropped EXE
PID:1272 -
\??\c:\btntht.exec:\btntht.exe34⤵
- Executes dropped EXE
PID:1988 -
\??\c:\tnbhhb.exec:\tnbhhb.exe35⤵
- Executes dropped EXE
PID:2964 -
\??\c:\dvdpd.exec:\dvdpd.exe36⤵
- Executes dropped EXE
PID:2604 -
\??\c:\vvjvj.exec:\vvjvj.exe37⤵
- Executes dropped EXE
PID:2564 -
\??\c:\lfrrxxx.exec:\lfrrxxx.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\lffxflr.exec:\lffxflr.exe39⤵
- Executes dropped EXE
PID:2396 -
\??\c:\tnbtbb.exec:\tnbtbb.exe40⤵
- Executes dropped EXE
PID:2332 -
\??\c:\nnbhtt.exec:\nnbhtt.exe41⤵
- Executes dropped EXE
PID:2436 -
\??\c:\bbhttb.exec:\bbhttb.exe42⤵
- Executes dropped EXE
PID:2996 -
\??\c:\pjvpd.exec:\pjvpd.exe43⤵
- Executes dropped EXE
PID:2908 -
\??\c:\ddvdp.exec:\ddvdp.exe44⤵
- Executes dropped EXE
PID:1836 -
\??\c:\9rlrxxf.exec:\9rlrxxf.exe45⤵
- Executes dropped EXE
PID:2748 -
\??\c:\xxrfllx.exec:\xxrfllx.exe46⤵
- Executes dropped EXE
PID:2492 -
\??\c:\nhntht.exec:\nhntht.exe47⤵
- Executes dropped EXE
PID:2008 -
\??\c:\3nbttt.exec:\3nbttt.exe48⤵
- Executes dropped EXE
PID:1012 -
\??\c:\htttbb.exec:\htttbb.exe49⤵
- Executes dropped EXE
PID:2928 -
\??\c:\jvjjv.exec:\jvjjv.exe50⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vpvvp.exec:\vpvvp.exe51⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rrlxlrf.exec:\rrlxlrf.exe52⤵
- Executes dropped EXE
PID:2660 -
\??\c:\fxrrffl.exec:\fxrrffl.exe53⤵
- Executes dropped EXE
PID:2360 -
\??\c:\1ttbtb.exec:\1ttbtb.exe54⤵
- Executes dropped EXE
PID:1212 -
\??\c:\1hhbbb.exec:\1hhbbb.exe55⤵
- Executes dropped EXE
PID:2240 -
\??\c:\9hbbtt.exec:\9hbbtt.exe56⤵
- Executes dropped EXE
PID:2204 -
\??\c:\1dvjp.exec:\1dvjp.exe57⤵
- Executes dropped EXE
PID:2472 -
\??\c:\1pddp.exec:\1pddp.exe58⤵
- Executes dropped EXE
PID:2852 -
\??\c:\fxxxxxf.exec:\fxxxxxf.exe59⤵
- Executes dropped EXE
PID:592 -
\??\c:\5jpdp.exec:\5jpdp.exe60⤵
- Executes dropped EXE
PID:1884 -
\??\c:\rrrfxll.exec:\rrrfxll.exe61⤵
- Executes dropped EXE
PID:1728 -
\??\c:\nhbhnn.exec:\nhbhnn.exe62⤵
- Executes dropped EXE
PID:612 -
\??\c:\jddjj.exec:\jddjj.exe63⤵
- Executes dropped EXE
PID:3044 -
\??\c:\3rrxrxf.exec:\3rrxrxf.exe64⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jdpvj.exec:\jdpvj.exe65⤵
- Executes dropped EXE
PID:2460 -
\??\c:\rrrlrrl.exec:\rrrlrrl.exe66⤵PID:2184
-
\??\c:\hthhhn.exec:\hthhhn.exe67⤵PID:764
-
\??\c:\dvpvp.exec:\dvpvp.exe68⤵PID:1752
-
\??\c:\lflffll.exec:\lflffll.exe69⤵PID:2820
-
\??\c:\rlflllr.exec:\rlflllr.exe70⤵PID:560
-
\??\c:\tnnttt.exec:\tnnttt.exe71⤵PID:292
-
\??\c:\3nhnnh.exec:\3nhnnh.exe72⤵PID:1148
-
\??\c:\jddvv.exec:\jddvv.exe73⤵PID:1532
-
\??\c:\pjvpp.exec:\pjvpp.exe74⤵PID:2060
-
\??\c:\rfrrfxr.exec:\rfrrfxr.exe75⤵PID:2572
-
\??\c:\5rxfxxl.exec:\5rxfxxl.exe76⤵PID:2516
-
\??\c:\5ttntt.exec:\5ttntt.exe77⤵PID:2480
-
\??\c:\jdpjv.exec:\jdpjv.exe78⤵PID:2688
-
\??\c:\dpvvd.exec:\dpvvd.exe79⤵PID:2560
-
\??\c:\rlrrxfl.exec:\rlrrxfl.exe80⤵PID:2416
-
\??\c:\fxrxflr.exec:\fxrxflr.exe81⤵PID:2396
-
\??\c:\tttntb.exec:\tttntb.exe82⤵PID:2332
-
\??\c:\7vjdj.exec:\7vjdj.exe83⤵PID:2956
-
\??\c:\9jppd.exec:\9jppd.exe84⤵PID:856
-
\??\c:\lfffxxx.exec:\lfffxxx.exe85⤵PID:2640
-
\??\c:\frxxfff.exec:\frxxfff.exe86⤵PID:2708
-
\??\c:\nbbhhh.exec:\nbbhhh.exe87⤵PID:2648
-
\??\c:\pppvp.exec:\pppvp.exe88⤵PID:2736
-
\??\c:\jjdvd.exec:\jjdvd.exe89⤵PID:2216
-
\??\c:\5ffffxf.exec:\5ffffxf.exe90⤵PID:2484
-
\??\c:\frxxflr.exec:\frxxflr.exe91⤵PID:1932
-
\??\c:\bnbntn.exec:\bnbntn.exe92⤵PID:2284
-
\??\c:\tbnntt.exec:\tbnntt.exe93⤵PID:1952
-
\??\c:\dvdvv.exec:\dvdvv.exe94⤵PID:616
-
\??\c:\rlxxfff.exec:\rlxxfff.exe95⤵PID:1688
-
\??\c:\xlxfflf.exec:\xlxfflf.exe96⤵PID:2808
-
\??\c:\9bnhhb.exec:\9bnhhb.exe97⤵PID:1212
-
\??\c:\tnhnnn.exec:\tnhnnn.exe98⤵PID:2356
-
\??\c:\3jjvd.exec:\3jjvd.exe99⤵PID:3028
-
\??\c:\rlrfllr.exec:\rlrfllr.exe100⤵PID:780
-
\??\c:\lxflxrx.exec:\lxflxrx.exe101⤵PID:956
-
\??\c:\nhtbnb.exec:\nhtbnb.exe102⤵PID:1400
-
\??\c:\bnttbh.exec:\bnttbh.exe103⤵PID:2212
-
\??\c:\pjpvd.exec:\pjpvd.exe104⤵PID:572
-
\??\c:\dpvvv.exec:\dpvvv.exe105⤵PID:832
-
\??\c:\xrfffff.exec:\xrfffff.exe106⤵PID:1104
-
\??\c:\9frxxfl.exec:\9frxxfl.exe107⤵PID:1568
-
\??\c:\bbhttb.exec:\bbhttb.exe108⤵PID:2976
-
\??\c:\btnnbn.exec:\btnnbn.exe109⤵PID:2148
-
\??\c:\dvjdj.exec:\dvjdj.exe110⤵PID:1736
-
\??\c:\rlrrrlr.exec:\rlrrrlr.exe111⤵PID:332
-
\??\c:\rlxxfff.exec:\rlxxfff.exe112⤵PID:276
-
\??\c:\hbthnt.exec:\hbthnt.exe113⤵PID:1648
-
\??\c:\hhbbbh.exec:\hhbbbh.exe114⤵PID:888
-
\??\c:\djvpd.exec:\djvpd.exe115⤵PID:3008
-
\??\c:\5dvjv.exec:\5dvjv.exe116⤵PID:860
-
\??\c:\rfrxrrf.exec:\rfrxrrf.exe117⤵PID:1232
-
\??\c:\xrlxfll.exec:\xrlxfll.exe118⤵PID:2504
-
\??\c:\bhhtbn.exec:\bhhtbn.exe119⤵PID:2220
-
\??\c:\pdvjp.exec:\pdvjp.exe120⤵PID:2900
-
\??\c:\1djpv.exec:\1djpv.exe121⤵PID:2812
-
\??\c:\fxrrxxx.exec:\fxrrxxx.exe122⤵PID:2592
-
\??\c:\lxfllrx.exec:\lxfllrx.exe123⤵PID:2952
-
\??\c:\ttnthn.exec:\ttnthn.exe124⤵PID:2488
-
\??\c:\pdpjv.exec:\pdpjv.exe125⤵PID:2332
-
\??\c:\5vjjp.exec:\5vjjp.exe126⤵PID:2996
-
\??\c:\rrllxlx.exec:\rrllxlx.exe127⤵PID:2400
-
\??\c:\llxflrf.exec:\llxflrf.exe128⤵PID:1868
-
\??\c:\nnbhbh.exec:\nnbhbh.exe129⤵PID:348
-
\??\c:\hhhthh.exec:\hhhthh.exe130⤵PID:2780
-
\??\c:\ppvvj.exec:\ppvvj.exe131⤵PID:2040
-
\??\c:\rlxxflx.exec:\rlxxflx.exe132⤵PID:1604
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe133⤵PID:2304
-
\??\c:\bthhhn.exec:\bthhhn.exe134⤵PID:2292
-
\??\c:\3htttt.exec:\3htttt.exe135⤵PID:2784
-
\??\c:\vvvvv.exec:\vvvvv.exe136⤵PID:108
-
\??\c:\flllfll.exec:\flllfll.exe137⤵PID:616
-
\??\c:\rlfxlrl.exec:\rlfxlrl.exe138⤵PID:2412
-
\??\c:\bbnhhn.exec:\bbnhhn.exe139⤵PID:1720
-
\??\c:\nbthbn.exec:\nbthbn.exe140⤵PID:2196
-
\??\c:\vppdp.exec:\vppdp.exe141⤵PID:2356
-
\??\c:\pjjpd.exec:\pjjpd.exe142⤵PID:992
-
\??\c:\xxlrffr.exec:\xxlrffr.exe143⤵PID:1416
-
\??\c:\fxlxllx.exec:\fxlxllx.exe144⤵PID:2752
-
\??\c:\tnhhhb.exec:\tnhhhb.exe145⤵PID:788
-
\??\c:\tbbtth.exec:\tbbtth.exe146⤵PID:2468
-
\??\c:\pjvjj.exec:\pjvjj.exe147⤵PID:572
-
\??\c:\3pppv.exec:\3pppv.exe148⤵PID:3020
-
\??\c:\llffffr.exec:\llffffr.exe149⤵PID:1928
-
\??\c:\7lllxff.exec:\7lllxff.exe150⤵PID:864
-
\??\c:\hnttnn.exec:\hnttnn.exe151⤵PID:1664
-
\??\c:\jpjvd.exec:\jpjvd.exe152⤵PID:2836
-
\??\c:\frffllx.exec:\frffllx.exe153⤵PID:2876
-
\??\c:\lfllxfl.exec:\lfllxfl.exe154⤵PID:1412
-
\??\c:\btbbhh.exec:\btbbhh.exe155⤵PID:276
-
\??\c:\thnnbb.exec:\thnnbb.exe156⤵PID:2720
-
\??\c:\nnbbbb.exec:\nnbbbb.exe157⤵PID:2588
-
\??\c:\ddpvj.exec:\ddpvj.exe158⤵PID:2208
-
\??\c:\3rlxffr.exec:\3rlxffr.exe159⤵PID:2500
-
\??\c:\7xffflr.exec:\7xffflr.exe160⤵PID:2868
-
\??\c:\9ntnbb.exec:\9ntnbb.exe161⤵PID:1592
-
\??\c:\9vdvv.exec:\9vdvv.exe162⤵PID:2564
-
\??\c:\dvvjd.exec:\dvvjd.exe163⤵PID:2832
-
\??\c:\xxxrrlx.exec:\xxxrrlx.exe164⤵PID:2584
-
\??\c:\lxrlrxl.exec:\lxrlrxl.exe165⤵PID:2988
-
\??\c:\rlfflrl.exec:\rlfflrl.exe166⤵PID:1456
-
\??\c:\ntthht.exec:\ntthht.exe167⤵PID:2032
-
\??\c:\vvjdj.exec:\vvjdj.exe168⤵PID:2580
-
\??\c:\lllxxlf.exec:\lllxxlf.exe169⤵PID:2664
-
\??\c:\rxlrfrl.exec:\rxlrfrl.exe170⤵PID:2712
-
\??\c:\ththtb.exec:\ththtb.exe171⤵PID:2748
-
\??\c:\tbtthh.exec:\tbtthh.exe172⤵PID:2736
-
\??\c:\9jjdj.exec:\9jjdj.exe173⤵PID:2008
-
\??\c:\pppvj.exec:\pppvj.exe174⤵PID:1844
-
\??\c:\rrxllxf.exec:\rrxllxf.exe175⤵PID:2760
-
\??\c:\hthhhn.exec:\hthhhn.exe176⤵PID:2092
-
\??\c:\hnnntb.exec:\hnnntb.exe177⤵PID:2028
-
\??\c:\rxrfrxf.exec:\rxrfrxf.exe178⤵PID:320
-
\??\c:\tbtnht.exec:\tbtnht.exe179⤵PID:2904
-
\??\c:\tnhnhn.exec:\tnhnhn.exe180⤵PID:2228
-
\??\c:\dpddp.exec:\dpddp.exe181⤵PID:2848
-
\??\c:\fxxrffr.exec:\fxxrffr.exe182⤵PID:2004
-
\??\c:\7fxfrfr.exec:\7fxfrfr.exe183⤵PID:2288
-
\??\c:\tnhnhh.exec:\tnhnhh.exe184⤵PID:2724
-
\??\c:\llxfllf.exec:\llxfllf.exe185⤵PID:592
-
\??\c:\xfflfxr.exec:\xfflfxr.exe186⤵PID:1436
-
\??\c:\tnhhtt.exec:\tnhhtt.exe187⤵PID:1728
-
\??\c:\hhbnht.exec:\hhbnht.exe188⤵PID:2336
-
\??\c:\pvdjj.exec:\pvdjj.exe189⤵PID:296
-
\??\c:\vpjjj.exec:\vpjjj.exe190⤵PID:1916
-
\??\c:\lxllrrx.exec:\lxllrrx.exe191⤵PID:2272
-
\??\c:\lfxrxxl.exec:\lfxrxxl.exe192⤵PID:2944
-
\??\c:\bbthtt.exec:\bbthtt.exe193⤵PID:672
-
\??\c:\bthntt.exec:\bthntt.exe194⤵PID:1752
-
\??\c:\jvjpv.exec:\jvjpv.exe195⤵PID:836
-
\??\c:\ppdpd.exec:\ppdpd.exe196⤵PID:1616
-
\??\c:\lfxfrrr.exec:\lfxfrrr.exe197⤵PID:1520
-
\??\c:\bbnhnb.exec:\bbnhnb.exe198⤵PID:3068
-
\??\c:\hthnnn.exec:\hthnnn.exe199⤵PID:2568
-
\??\c:\ddvdp.exec:\ddvdp.exe200⤵PID:2520
-
\??\c:\xxxfrxl.exec:\xxxfrxl.exe201⤵PID:2380
-
\??\c:\lfrxllx.exec:\lfrxllx.exe202⤵PID:2516
-
\??\c:\1rrlrxf.exec:\1rrlrxf.exe203⤵PID:2868
-
\??\c:\bbnhth.exec:\bbnhth.exe204⤵PID:2524
-
\??\c:\hbbhnn.exec:\hbbhnn.exe205⤵PID:2692
-
\??\c:\5ppdd.exec:\5ppdd.exe206⤵PID:2388
-
\??\c:\vvjjv.exec:\vvjjv.exe207⤵PID:2396
-
\??\c:\rlrxxxf.exec:\rlrxxxf.exe208⤵PID:2916
-
\??\c:\rlrrfrr.exec:\rlrrfrr.exe209⤵PID:2668
-
\??\c:\ttnntt.exec:\ttnntt.exe210⤵PID:2372
-
\??\c:\hbthhh.exec:\hbthhh.exe211⤵PID:2420
-
\??\c:\vvpvj.exec:\vvpvj.exe212⤵PID:2764
-
\??\c:\djpdp.exec:\djpdp.exe213⤵PID:2728
-
\??\c:\lxfxrlr.exec:\lxfxrlr.exe214⤵PID:2772
-
\??\c:\xrxxflr.exec:\xrxxflr.exe215⤵PID:1864
-
\??\c:\btbhnt.exec:\btbhnt.exe216⤵PID:1948
-
\??\c:\pjdjv.exec:\pjdjv.exe217⤵PID:2440
-
\??\c:\pdjjj.exec:\pdjjj.exe218⤵PID:2760
-
\??\c:\7frxxfr.exec:\7frxxfr.exe219⤵PID:1712
-
\??\c:\tbnnhh.exec:\tbnnhh.exe220⤵PID:2776
-
\??\c:\nhhnhh.exec:\nhhnhh.exe221⤵PID:616
-
\??\c:\djppj.exec:\djppj.exe222⤵PID:2300
-
\??\c:\jpjjp.exec:\jpjjp.exe223⤵PID:2140
-
\??\c:\rfxfrfl.exec:\rfxfrfl.exe224⤵PID:1720
-
\??\c:\frlrrfr.exec:\frlrrfr.exe225⤵PID:2000
-
\??\c:\9tnbbn.exec:\9tnbbn.exe226⤵PID:2356
-
\??\c:\hhbhhn.exec:\hhbhhn.exe227⤵PID:1192
-
\??\c:\vvpvj.exec:\vvpvj.exe228⤵PID:1784
-
\??\c:\jjjpd.exec:\jjjpd.exe229⤵PID:2448
-
\??\c:\xrflxfr.exec:\xrflxfr.exe230⤵PID:788
-
\??\c:\rfrrxxl.exec:\rfrrxxl.exe231⤵PID:688
-
\??\c:\ntnbht.exec:\ntnbht.exe232⤵PID:572
-
\??\c:\ttnbnt.exec:\ttnbnt.exe233⤵PID:608
-
\??\c:\dvpvj.exec:\dvpvj.exe234⤵PID:1928
-
\??\c:\fxfrrfx.exec:\fxfrrfx.exe235⤵PID:864
-
\??\c:\9ffxlrf.exec:\9ffxlrf.exe236⤵PID:1664
-
\??\c:\bbthnn.exec:\bbthnn.exe237⤵PID:628
-
\??\c:\jpvjv.exec:\jpvjv.exe238⤵PID:2876
-
\??\c:\vvddj.exec:\vvddj.exe239⤵PID:1504
-
\??\c:\rrxlxfr.exec:\rrxlxfr.exe240⤵PID:276
-
\??\c:\lfrrllx.exec:\lfrrllx.exe241⤵PID:2744
-
\??\c:\xrlxfxl.exec:\xrlxfxl.exe242⤵PID:2588