Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 04:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b.exe
-
Size
122KB
-
MD5
d4fc4182c3eb642461b64c107ecc3200
-
SHA1
3fefe16296f825cf7c9e8ef9a485f99ef6aa8967
-
SHA256
aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b
-
SHA512
6faf5009c7d489ae52c932f09c13c74ae9a324bce146a3bac1454729914f5aa020d288a3c8c306ce8283961ca09439ecc4630323d6d7b0709ecd272e9fbaca12
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHvmQ+EZMYX90Ifcr:n3C9BRW0j/uVEZFmIkr
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/3008-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-78-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1044-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1396-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/752-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/648-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/344-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tbtbnb.exe9pppv.exelxlrxxf.exebthhtb.exepjpvj.exe7rrrffr.exexrlrxlx.exe9hnhnt.exevpjvd.exellxxffr.exe1rrxflx.exe5thntb.exevpjjd.exeddpdp.exellflflx.exe3bnnnt.exebbhbhh.exejjddj.exerrlrxfr.exebbtbnt.exevpddp.exedvjjv.exelfllxff.exexlxxfxx.exe3dpdp.exepjppv.exerrflxfr.exelrrlrrx.exevpjpj.exelflrllr.exerlxrrrx.exehnhbth.exevpjjp.exe9pdjv.exexxffxfl.exellrflrf.exefxrxffl.exebtbbnn.exehhhbbb.exe7pjdd.exefxffrrf.exerflffxx.exetnbbth.exebtbhth.exejvjpp.exe5vjjj.exexrfllrx.exelfxrxlx.exenhnthh.exe7dppj.exe5ppdp.exexrflrrx.exeflxxfxf.exe5tttnt.exe9bntbb.exerrxrrll.exexrrxfff.exe9nnttb.exe1nnhbn.exe1jdjp.exe3vjpv.exe3rxflrf.exexrlrffx.exehbbbtn.exepid process 2148 tbtbnb.exe 2288 9pppv.exe 2656 lxlrxxf.exe 2720 bthhtb.exe 2844 pjpvj.exe 2920 7rrrffr.exe 2840 xrlrxlx.exe 2588 9hnhnt.exe 2248 vpjvd.exe 2616 llxxffr.exe 2928 1rrxflx.exe 1044 5thntb.exe 2088 vpjjd.exe 1860 ddpdp.exe 1396 llflflx.exe 2704 3bnnnt.exe 2420 bbhbhh.exe 2624 jjddj.exe 2104 rrlrxfr.exe 2504 bbtbnt.exe 2228 vpddp.exe 2976 dvjjv.exe 752 lfllxff.exe 648 xlxxfxx.exe 1612 3dpdp.exe 1328 pjppv.exe 344 rrflxfr.exe 908 lrrlrrx.exe 2160 vpjpj.exe 812 lflrllr.exe 840 rlxrrrx.exe 2044 hnhbth.exe 2084 vpjjp.exe 1604 9pdjv.exe 2712 xxffxfl.exe 3044 llrflrf.exe 2372 fxrxffl.exe 2676 btbbnn.exe 2956 hhhbbb.exe 2896 7pjdd.exe 2564 fxffrrf.exe 2748 rflffxx.exe 2544 tnbbth.exe 1220 btbhth.exe 3052 jvjpp.exe 2760 5vjjj.exe 2908 xrfllrx.exe 3060 lfxrxlx.exe 3064 nhnthh.exe 1752 7dppj.exe 1632 5ppdp.exe 1852 xrflrrx.exe 2868 flxxfxf.exe 2780 5tttnt.exe 1436 9bntbb.exe 2280 rrxrrll.exe 2624 xrrxfff.exe 2984 9nnttb.exe 768 1nnhbn.exe 2488 1jdjp.exe 332 3vjpv.exe 2380 3rxflrf.exe 1648 xrlrffx.exe 1640 hbbbtn.exe -
Processes:
resource yara_rule behavioral1/memory/3008-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1044-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/752-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/648-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/344-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-295-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b.exetbtbnb.exe9pppv.exelxlrxxf.exebthhtb.exepjpvj.exe7rrrffr.exexrlrxlx.exe9hnhnt.exevpjvd.exellxxffr.exe1rrxflx.exe5thntb.exevpjjd.exeddpdp.exellflflx.exedescription pid process target process PID 3008 wrote to memory of 2148 3008 aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b.exe tbtbnb.exe PID 3008 wrote to memory of 2148 3008 aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b.exe tbtbnb.exe PID 3008 wrote to memory of 2148 3008 aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b.exe tbtbnb.exe PID 3008 wrote to memory of 2148 3008 aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b.exe tbtbnb.exe PID 2148 wrote to memory of 2288 2148 tbtbnb.exe 9pppv.exe PID 2148 wrote to memory of 2288 2148 tbtbnb.exe 9pppv.exe PID 2148 wrote to memory of 2288 2148 tbtbnb.exe 9pppv.exe PID 2148 wrote to memory of 2288 2148 tbtbnb.exe 9pppv.exe PID 2288 wrote to memory of 2656 2288 9pppv.exe lxlrxxf.exe PID 2288 wrote to memory of 2656 2288 9pppv.exe lxlrxxf.exe PID 2288 wrote to memory of 2656 2288 9pppv.exe lxlrxxf.exe PID 2288 wrote to memory of 2656 2288 9pppv.exe lxlrxxf.exe PID 2656 wrote to memory of 2720 2656 lxlrxxf.exe bthhtb.exe PID 2656 wrote to memory of 2720 2656 lxlrxxf.exe bthhtb.exe PID 2656 wrote to memory of 2720 2656 lxlrxxf.exe bthhtb.exe PID 2656 wrote to memory of 2720 2656 lxlrxxf.exe bthhtb.exe PID 2720 wrote to memory of 2844 2720 bthhtb.exe pjpvj.exe PID 2720 wrote to memory of 2844 2720 bthhtb.exe pjpvj.exe PID 2720 wrote to memory of 2844 2720 bthhtb.exe pjpvj.exe PID 2720 wrote to memory of 2844 2720 bthhtb.exe pjpvj.exe PID 2844 wrote to memory of 2920 2844 pjpvj.exe 7rrrffr.exe PID 2844 wrote to memory of 2920 2844 pjpvj.exe 7rrrffr.exe PID 2844 wrote to memory of 2920 2844 pjpvj.exe 7rrrffr.exe PID 2844 wrote to memory of 2920 2844 pjpvj.exe 7rrrffr.exe PID 2920 wrote to memory of 2840 2920 7rrrffr.exe xrlrxlx.exe PID 2920 wrote to memory of 2840 2920 7rrrffr.exe xrlrxlx.exe PID 2920 wrote to memory of 2840 2920 7rrrffr.exe xrlrxlx.exe PID 2920 wrote to memory of 2840 2920 7rrrffr.exe xrlrxlx.exe PID 2840 wrote to memory of 2588 2840 xrlrxlx.exe 9hnhnt.exe PID 2840 wrote to memory of 2588 2840 xrlrxlx.exe 9hnhnt.exe PID 2840 wrote to memory of 2588 2840 xrlrxlx.exe 9hnhnt.exe PID 2840 wrote to memory of 2588 2840 xrlrxlx.exe 9hnhnt.exe PID 2588 wrote to memory of 2248 2588 9hnhnt.exe vpjvd.exe PID 2588 wrote to memory of 2248 2588 9hnhnt.exe vpjvd.exe PID 2588 wrote to memory of 2248 2588 9hnhnt.exe vpjvd.exe PID 2588 wrote to memory of 2248 2588 9hnhnt.exe vpjvd.exe PID 2248 wrote to memory of 2616 2248 vpjvd.exe llxxffr.exe PID 2248 wrote to memory of 2616 2248 vpjvd.exe llxxffr.exe PID 2248 wrote to memory of 2616 2248 vpjvd.exe llxxffr.exe PID 2248 wrote to memory of 2616 2248 vpjvd.exe llxxffr.exe PID 2616 wrote to memory of 2928 2616 llxxffr.exe 1rrxflx.exe PID 2616 wrote to memory of 2928 2616 llxxffr.exe 1rrxflx.exe PID 2616 wrote to memory of 2928 2616 llxxffr.exe 1rrxflx.exe PID 2616 wrote to memory of 2928 2616 llxxffr.exe 1rrxflx.exe PID 2928 wrote to memory of 1044 2928 1rrxflx.exe 5thntb.exe PID 2928 wrote to memory of 1044 2928 1rrxflx.exe 5thntb.exe PID 2928 wrote to memory of 1044 2928 1rrxflx.exe 5thntb.exe PID 2928 wrote to memory of 1044 2928 1rrxflx.exe 5thntb.exe PID 1044 wrote to memory of 2088 1044 5thntb.exe vpjjd.exe PID 1044 wrote to memory of 2088 1044 5thntb.exe vpjjd.exe PID 1044 wrote to memory of 2088 1044 5thntb.exe vpjjd.exe PID 1044 wrote to memory of 2088 1044 5thntb.exe vpjjd.exe PID 2088 wrote to memory of 1860 2088 vpjjd.exe ddpdp.exe PID 2088 wrote to memory of 1860 2088 vpjjd.exe ddpdp.exe PID 2088 wrote to memory of 1860 2088 vpjjd.exe ddpdp.exe PID 2088 wrote to memory of 1860 2088 vpjjd.exe ddpdp.exe PID 1860 wrote to memory of 1396 1860 ddpdp.exe llflflx.exe PID 1860 wrote to memory of 1396 1860 ddpdp.exe llflflx.exe PID 1860 wrote to memory of 1396 1860 ddpdp.exe llflflx.exe PID 1860 wrote to memory of 1396 1860 ddpdp.exe llflflx.exe PID 1396 wrote to memory of 2704 1396 llflflx.exe 3bnnnt.exe PID 1396 wrote to memory of 2704 1396 llflflx.exe 3bnnnt.exe PID 1396 wrote to memory of 2704 1396 llflflx.exe 3bnnnt.exe PID 1396 wrote to memory of 2704 1396 llflflx.exe 3bnnnt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b.exe"C:\Users\Admin\AppData\Local\Temp\aa6e2f78ea70d985bd782a5b23130137f01e5ee9f5f60dc3d99d4f842053304b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\tbtbnb.exec:\tbtbnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\9pppv.exec:\9pppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\lxlrxxf.exec:\lxlrxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\bthhtb.exec:\bthhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\pjpvj.exec:\pjpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\7rrrffr.exec:\7rrrffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\xrlrxlx.exec:\xrlrxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\9hnhnt.exec:\9hnhnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\vpjvd.exec:\vpjvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\llxxffr.exec:\llxxffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\1rrxflx.exec:\1rrxflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\5thntb.exec:\5thntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\vpjjd.exec:\vpjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\ddpdp.exec:\ddpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\llflflx.exec:\llflflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\3bnnnt.exec:\3bnnnt.exe17⤵
- Executes dropped EXE
PID:2704 -
\??\c:\bbhbhh.exec:\bbhbhh.exe18⤵
- Executes dropped EXE
PID:2420 -
\??\c:\jjddj.exec:\jjddj.exe19⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rrlrxfr.exec:\rrlrxfr.exe20⤵
- Executes dropped EXE
PID:2104 -
\??\c:\bbtbnt.exec:\bbtbnt.exe21⤵
- Executes dropped EXE
PID:2504 -
\??\c:\vpddp.exec:\vpddp.exe22⤵
- Executes dropped EXE
PID:2228 -
\??\c:\dvjjv.exec:\dvjjv.exe23⤵
- Executes dropped EXE
PID:2976 -
\??\c:\lfllxff.exec:\lfllxff.exe24⤵
- Executes dropped EXE
PID:752 -
\??\c:\xlxxfxx.exec:\xlxxfxx.exe25⤵
- Executes dropped EXE
PID:648 -
\??\c:\3dpdp.exec:\3dpdp.exe26⤵
- Executes dropped EXE
PID:1612 -
\??\c:\pjppv.exec:\pjppv.exe27⤵
- Executes dropped EXE
PID:1328 -
\??\c:\rrflxfr.exec:\rrflxfr.exe28⤵
- Executes dropped EXE
PID:344 -
\??\c:\lrrlrrx.exec:\lrrlrrx.exe29⤵
- Executes dropped EXE
PID:908 -
\??\c:\vpjpj.exec:\vpjpj.exe30⤵
- Executes dropped EXE
PID:2160 -
\??\c:\lflrllr.exec:\lflrllr.exe31⤵
- Executes dropped EXE
PID:812 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe32⤵
- Executes dropped EXE
PID:840 -
\??\c:\hnhbth.exec:\hnhbth.exe33⤵
- Executes dropped EXE
PID:2044 -
\??\c:\vpjjp.exec:\vpjjp.exe34⤵
- Executes dropped EXE
PID:2084 -
\??\c:\9pdjv.exec:\9pdjv.exe35⤵
- Executes dropped EXE
PID:1604 -
\??\c:\xxffxfl.exec:\xxffxfl.exe36⤵
- Executes dropped EXE
PID:2712 -
\??\c:\llrflrf.exec:\llrflrf.exe37⤵
- Executes dropped EXE
PID:3044 -
\??\c:\fxrxffl.exec:\fxrxffl.exe38⤵
- Executes dropped EXE
PID:2372 -
\??\c:\btbbnn.exec:\btbbnn.exe39⤵
- Executes dropped EXE
PID:2676 -
\??\c:\hhhbbb.exec:\hhhbbb.exe40⤵
- Executes dropped EXE
PID:2956 -
\??\c:\7pjdd.exec:\7pjdd.exe41⤵
- Executes dropped EXE
PID:2896 -
\??\c:\fxffrrf.exec:\fxffrrf.exe42⤵
- Executes dropped EXE
PID:2564 -
\??\c:\rflffxx.exec:\rflffxx.exe43⤵
- Executes dropped EXE
PID:2748 -
\??\c:\tnbbth.exec:\tnbbth.exe44⤵
- Executes dropped EXE
PID:2544 -
\??\c:\btbhth.exec:\btbhth.exe45⤵
- Executes dropped EXE
PID:1220 -
\??\c:\jvjpp.exec:\jvjpp.exe46⤵
- Executes dropped EXE
PID:3052 -
\??\c:\5vjjj.exec:\5vjjj.exe47⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xrfllrx.exec:\xrfllrx.exe48⤵
- Executes dropped EXE
PID:2908 -
\??\c:\lfxrxlx.exec:\lfxrxlx.exe49⤵
- Executes dropped EXE
PID:3060 -
\??\c:\nhnthh.exec:\nhnthh.exe50⤵
- Executes dropped EXE
PID:3064 -
\??\c:\7dppj.exec:\7dppj.exe51⤵
- Executes dropped EXE
PID:1752 -
\??\c:\5ppdp.exec:\5ppdp.exe52⤵
- Executes dropped EXE
PID:1632 -
\??\c:\xrflrrx.exec:\xrflrrx.exe53⤵
- Executes dropped EXE
PID:1852 -
\??\c:\flxxfxf.exec:\flxxfxf.exe54⤵
- Executes dropped EXE
PID:2868 -
\??\c:\5tttnt.exec:\5tttnt.exe55⤵
- Executes dropped EXE
PID:2780 -
\??\c:\9bntbb.exec:\9bntbb.exe56⤵
- Executes dropped EXE
PID:1436 -
\??\c:\rrxrrll.exec:\rrxrrll.exe57⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xrrxfff.exec:\xrrxfff.exe58⤵
- Executes dropped EXE
PID:2624 -
\??\c:\9nnttb.exec:\9nnttb.exe59⤵
- Executes dropped EXE
PID:2984 -
\??\c:\1nnhbn.exec:\1nnhbn.exe60⤵
- Executes dropped EXE
PID:768 -
\??\c:\1jdjp.exec:\1jdjp.exe61⤵
- Executes dropped EXE
PID:2488 -
\??\c:\3vjpv.exec:\3vjpv.exe62⤵
- Executes dropped EXE
PID:332 -
\??\c:\3rxflrf.exec:\3rxflrf.exe63⤵
- Executes dropped EXE
PID:2380 -
\??\c:\xrlrffx.exec:\xrlrffx.exe64⤵
- Executes dropped EXE
PID:1648 -
\??\c:\hbbbtn.exec:\hbbbtn.exe65⤵
- Executes dropped EXE
PID:1640 -
\??\c:\hbnthn.exec:\hbnthn.exe66⤵PID:1552
-
\??\c:\ddpvp.exec:\ddpvp.exe67⤵PID:1896
-
\??\c:\vpdpv.exec:\vpdpv.exe68⤵PID:2508
-
\??\c:\fxfrrrx.exec:\fxfrrrx.exe69⤵PID:1976
-
\??\c:\fxrrffr.exec:\fxrrffr.exe70⤵PID:1756
-
\??\c:\btbbnn.exec:\btbbnn.exe71⤵PID:2168
-
\??\c:\bhtthn.exec:\bhtthn.exe72⤵PID:2964
-
\??\c:\vvpjd.exec:\vvpjd.exe73⤵PID:884
-
\??\c:\vjdjj.exec:\vjdjj.exe74⤵PID:840
-
\??\c:\lfrxfff.exec:\lfrxfff.exe75⤵PID:2004
-
\??\c:\xlrxlrx.exec:\xlrxlrx.exe76⤵PID:1592
-
\??\c:\bthhnt.exec:\bthhnt.exe77⤵PID:2848
-
\??\c:\hhntbb.exec:\hhntbb.exe78⤵PID:2948
-
\??\c:\9dppj.exec:\9dppj.exe79⤵PID:2732
-
\??\c:\dpddj.exec:\dpddj.exe80⤵PID:2972
-
\??\c:\9rrrflx.exec:\9rrrflx.exe81⤵PID:1616
-
\??\c:\fxflrxf.exec:\fxflrxf.exe82⤵PID:2756
-
\??\c:\9tnthn.exec:\9tnthn.exe83⤵PID:2828
-
\??\c:\9nnnhn.exec:\9nnnhn.exe84⤵PID:2056
-
\??\c:\7dvdv.exec:\7dvdv.exe85⤵PID:2528
-
\??\c:\vpdpd.exec:\vpdpd.exe86⤵PID:2696
-
\??\c:\vvdpd.exec:\vvdpd.exe87⤵PID:3040
-
\??\c:\xlxfllr.exec:\xlxfllr.exe88⤵PID:2860
-
\??\c:\xlrxffr.exec:\xlrxffr.exe89⤵PID:2768
-
\??\c:\btntbb.exec:\btntbb.exe90⤵PID:3012
-
\??\c:\nnbbht.exec:\nnbbht.exe91⤵PID:2596
-
\??\c:\vjjpv.exec:\vjjpv.exe92⤵PID:1848
-
\??\c:\xlxffll.exec:\xlxffll.exe93⤵PID:2032
-
\??\c:\xlrrflx.exec:\xlrrflx.exe94⤵PID:1156
-
\??\c:\rflrrrl.exec:\rflrrrl.exe95⤵PID:1396
-
\??\c:\tntbtt.exec:\tntbtt.exe96⤵PID:2804
-
\??\c:\btbbht.exec:\btbbht.exe97⤵PID:844
-
\??\c:\pjdjj.exec:\pjdjj.exe98⤵PID:1252
-
\??\c:\jdpdd.exec:\jdpdd.exe99⤵PID:1256
-
\??\c:\xlfxffl.exec:\xlfxffl.exe100⤵PID:1736
-
\??\c:\fxflxxl.exec:\fxflxxl.exe101⤵PID:2464
-
\??\c:\1hbnbb.exec:\1hbnbb.exe102⤵PID:2220
-
\??\c:\httntt.exec:\httntt.exe103⤵PID:668
-
\??\c:\5htnnt.exec:\5htnnt.exe104⤵PID:688
-
\??\c:\9vvjj.exec:\9vvjj.exe105⤵PID:376
-
\??\c:\jdpvd.exec:\jdpvd.exe106⤵PID:1792
-
\??\c:\frrxflr.exec:\frrxflr.exe107⤵PID:2416
-
\??\c:\xxlflrx.exec:\xxlflrx.exe108⤵PID:912
-
\??\c:\nbnntb.exec:\nbnntb.exe109⤵PID:1212
-
\??\c:\hbhntb.exec:\hbhntb.exe110⤵PID:1052
-
\??\c:\nhbnbh.exec:\nhbnbh.exe111⤵PID:2944
-
\??\c:\jdpvd.exec:\jdpvd.exe112⤵PID:1692
-
\??\c:\vpjpv.exec:\vpjpv.exe113⤵PID:2360
-
\??\c:\3xlrxxl.exec:\3xlrxxl.exe114⤵PID:812
-
\??\c:\xrxfffl.exec:\xrxfffl.exe115⤵PID:1676
-
\??\c:\hbbbhh.exec:\hbbbhh.exe116⤵PID:3004
-
\??\c:\nhthbn.exec:\nhthbn.exe117⤵PID:2084
-
\??\c:\jjjvp.exec:\jjjvp.exe118⤵PID:1600
-
\??\c:\dvpdj.exec:\dvpdj.exe119⤵PID:2712
-
\??\c:\jdvvd.exec:\jdvvd.exe120⤵PID:2636
-
\??\c:\lxlflxx.exec:\lxlflxx.exe121⤵PID:2744
-
\??\c:\7hhthh.exec:\7hhthh.exe122⤵PID:2532
-
\??\c:\btnttt.exec:\btnttt.exe123⤵PID:2560
-
\??\c:\bbnthh.exec:\bbnthh.exe124⤵PID:2844
-
\??\c:\pjvjj.exec:\pjvjj.exe125⤵PID:2640
-
\??\c:\pjvdp.exec:\pjvdp.exe126⤵PID:2840
-
\??\c:\1frrrxx.exec:\1frrrxx.exe127⤵PID:3032
-
\??\c:\rrxxllf.exec:\rrxxllf.exe128⤵PID:2588
-
\??\c:\hhbtbh.exec:\hhbtbh.exe129⤵PID:2864
-
\??\c:\btbbhh.exec:\btbbhh.exe130⤵PID:2876
-
\??\c:\ddpvj.exec:\ddpvj.exe131⤵PID:2940
-
\??\c:\dvjjd.exec:\dvjjd.exe132⤵PID:2800
-
\??\c:\xrlrlrx.exec:\xrlrlrx.exe133⤵PID:1636
-
\??\c:\bttthh.exec:\bttthh.exe134⤵PID:624
-
\??\c:\nbhhhh.exec:\nbhhhh.exe135⤵PID:1528
-
\??\c:\dvddp.exec:\dvddp.exe136⤵PID:1392
-
\??\c:\jddjv.exec:\jddjv.exe137⤵PID:2856
-
\??\c:\rxxflff.exec:\rxxflff.exe138⤵PID:2704
-
\??\c:\hbtbht.exec:\hbtbht.exe139⤵PID:1272
-
\??\c:\7ttbtb.exec:\7ttbtb.exe140⤵PID:2052
-
\??\c:\pjvdj.exec:\pjvdj.exe141⤵PID:1980
-
\??\c:\3vppv.exec:\3vppv.exe142⤵PID:2100
-
\??\c:\1fflrlx.exec:\1fflrlx.exe143⤵PID:2980
-
\??\c:\xxlrflr.exec:\xxlrflr.exe144⤵PID:528
-
\??\c:\tttbbh.exec:\tttbbh.exe145⤵PID:484
-
\??\c:\nhnntb.exec:\nhnntb.exe146⤵PID:688
-
\??\c:\pjppd.exec:\pjppd.exe147⤵PID:1884
-
\??\c:\lxrrlrr.exec:\lxrrlrr.exe148⤵PID:604
-
\??\c:\1xflxxl.exec:\1xflxxl.exe149⤵PID:944
-
\??\c:\1tntbb.exec:\1tntbb.exe150⤵PID:304
-
\??\c:\3hnttn.exec:\3hnttn.exe151⤵PID:900
-
\??\c:\jjvvd.exec:\jjvvd.exe152⤵PID:2508
-
\??\c:\dpddp.exec:\dpddp.exe153⤵PID:2172
-
\??\c:\xrfxllr.exec:\xrfxllr.exe154⤵PID:2292
-
\??\c:\httthn.exec:\httthn.exe155⤵PID:2284
-
\??\c:\bthbbb.exec:\bthbbb.exe156⤵PID:2336
-
\??\c:\5jvpd.exec:\5jvpd.exe157⤵PID:3020
-
\??\c:\dvddp.exec:\dvddp.exe158⤵PID:3016
-
\??\c:\frxrxxf.exec:\frxrxxf.exe159⤵PID:1808
-
\??\c:\9llrflx.exec:\9llrflx.exe160⤵PID:2136
-
\??\c:\ttbbht.exec:\ttbbht.exe161⤵PID:2620
-
\??\c:\bthnbh.exec:\bthnbh.exe162⤵PID:2824
-
\??\c:\9jjdj.exec:\9jjdj.exe163⤵PID:1796
-
\??\c:\pdddp.exec:\pdddp.exe164⤵PID:2680
-
\??\c:\5lxxxxl.exec:\5lxxxxl.exe165⤵PID:2836
-
\??\c:\tnhnbb.exec:\tnhnbb.exe166⤵PID:1028
-
\??\c:\nbtnbn.exec:\nbtnbn.exe167⤵PID:2580
-
\??\c:\dvjvd.exec:\dvjvd.exe168⤵PID:2648
-
\??\c:\jdppd.exec:\jdppd.exe169⤵PID:2592
-
\??\c:\xllllrr.exec:\xllllrr.exe170⤵PID:1584
-
\??\c:\9rllxrx.exec:\9rllxrx.exe171⤵PID:2900
-
\??\c:\tnthhb.exec:\tnthhb.exe172⤵PID:2924
-
\??\c:\bthbtt.exec:\bthbtt.exe173⤵PID:2784
-
\??\c:\vvddd.exec:\vvddd.exe174⤵PID:1044
-
\??\c:\dvjjj.exec:\dvjjj.exe175⤵PID:2164
-
\??\c:\lxlrfxf.exec:\lxlrfxf.exe176⤵PID:1548
-
\??\c:\9xllxrx.exec:\9xllxrx.exe177⤵PID:2820
-
\??\c:\bthbnt.exec:\bthbnt.exe178⤵PID:2812
-
\??\c:\btnnhb.exec:\btnnhb.exe179⤵PID:2000
-
\??\c:\ppdjd.exec:\ppdjd.exe180⤵PID:1308
-
\??\c:\lfrxxxr.exec:\lfrxxxr.exe181⤵PID:1284
-
\??\c:\lfxlxfl.exec:\lfxlxfl.exe182⤵PID:1984
-
\??\c:\nhnhtt.exec:\nhnhtt.exe183⤵PID:1988
-
\??\c:\bthhtt.exec:\bthhtt.exe184⤵PID:2988
-
\??\c:\vvpdd.exec:\vvpdd.exe185⤵PID:536
-
\??\c:\1pvvv.exec:\1pvvv.exe186⤵PID:776
-
\??\c:\rlllrxf.exec:\rlllrxf.exe187⤵PID:332
-
\??\c:\rffrllx.exec:\rffrllx.exe188⤵PID:2024
-
\??\c:\nbhhbb.exec:\nbhhbb.exe189⤵PID:2324
-
\??\c:\bnbbnn.exec:\bnbbnn.exe190⤵PID:928
-
\??\c:\ppppp.exec:\ppppp.exe191⤵PID:2224
-
\??\c:\dpvjv.exec:\dpvjv.exe192⤵PID:764
-
\??\c:\rflfllr.exec:\rflfllr.exe193⤵PID:1052
-
\??\c:\9xxrllr.exec:\9xxrllr.exe194⤵PID:1744
-
\??\c:\xfrxfxx.exec:\xfrxfxx.exe195⤵PID:2068
-
\??\c:\tthtbt.exec:\tthtbt.exe196⤵PID:972
-
\??\c:\ththtb.exec:\ththtb.exe197⤵PID:812
-
\??\c:\ppdvv.exec:\ppdvv.exe198⤵PID:2188
-
\??\c:\dddpv.exec:\dddpv.exe199⤵PID:3004
-
\??\c:\9rrxlrf.exec:\9rrxlrf.exe200⤵PID:1596
-
\??\c:\lflxlrf.exec:\lflxlrf.exe201⤵PID:1600
-
\??\c:\hbtbnt.exec:\hbtbnt.exe202⤵PID:1592
-
\??\c:\7nnhnt.exec:\7nnhnt.exe203⤵PID:2732
-
\??\c:\dvpvd.exec:\dvpvd.exe204⤵PID:2744
-
\??\c:\xrfxrrx.exec:\xrfxrrx.exe205⤵PID:2752
-
\??\c:\3lxfrfr.exec:\3lxfrfr.exe206⤵PID:2720
-
\??\c:\nnhtbt.exec:\nnhtbt.exe207⤵PID:2844
-
\??\c:\hhhbht.exec:\hhhbht.exe208⤵PID:2688
-
\??\c:\7ddpd.exec:\7ddpd.exe209⤵PID:2840
-
\??\c:\vpvvv.exec:\vpvvv.exe210⤵PID:2564
-
\??\c:\lfrxrrf.exec:\lfrxrrf.exe211⤵PID:3048
-
\??\c:\lrxflfl.exec:\lrxflfl.exe212⤵PID:1220
-
\??\c:\tnbbnh.exec:\tnbbnh.exe213⤵PID:2876
-
\??\c:\nnhnbb.exec:\nnhnbb.exe214⤵PID:2904
-
\??\c:\pjjdj.exec:\pjjdj.exe215⤵PID:3068
-
\??\c:\vpppv.exec:\vpppv.exe216⤵PID:2584
-
\??\c:\rlrrfff.exec:\rlrrfff.exe217⤵PID:624
-
\??\c:\fxllrrl.exec:\fxllrrl.exe218⤵PID:2772
-
\??\c:\7hnbtb.exec:\7hnbtb.exe219⤵PID:1392
-
\??\c:\hthhtt.exec:\hthhtt.exe220⤵PID:1424
-
\??\c:\vpdjv.exec:\vpdjv.exe221⤵PID:2704
-
\??\c:\vpvvd.exec:\vpvvd.exe222⤵PID:2788
-
\??\c:\lfrxlrx.exec:\lfrxlrx.exe223⤵PID:2052
-
\??\c:\fflxflr.exec:\fflxflr.exe224⤵PID:2020
-
\??\c:\btttbb.exec:\btttbb.exe225⤵PID:1128
-
\??\c:\1pjdj.exec:\1pjdj.exe226⤵PID:692
-
\??\c:\1vpvj.exec:\1vpvj.exe227⤵PID:528
-
\??\c:\9xrxffl.exec:\9xrxffl.exe228⤵PID:2108
-
\??\c:\xlfxrrr.exec:\xlfxrrr.exe229⤵PID:1648
-
\??\c:\tnhnbb.exec:\tnhnbb.exe230⤵PID:1476
-
\??\c:\hbttbb.exec:\hbttbb.exe231⤵PID:2416
-
\??\c:\9jdjv.exec:\9jdjv.exe232⤵PID:2496
-
\??\c:\1vpvd.exec:\1vpvd.exe233⤵PID:304
-
\??\c:\7fxlrxf.exec:\7fxlrxf.exe234⤵PID:316
-
\??\c:\lxlrxfl.exec:\lxlrxfl.exe235⤵PID:1968
-
\??\c:\5ntthn.exec:\5ntthn.exe236⤵PID:2400
-
\??\c:\pddvv.exec:\pddvv.exe237⤵PID:1892
-
\??\c:\pdjpd.exec:\pdjpd.exe238⤵PID:1656
-
\??\c:\rlffxxr.exec:\rlffxxr.exe239⤵PID:884
-
\??\c:\lfrrfxf.exec:\lfrrfxf.exe240⤵PID:1504
-
\??\c:\hbbttt.exec:\hbbttt.exe241⤵PID:2016
-
\??\c:\vpvdj.exec:\vpvdj.exe242⤵PID:1740