Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 20:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
00d7389dd9b77d3d9e312d2bef23c118bc0a48e96a1021edea4c6b9936aad852.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
00d7389dd9b77d3d9e312d2bef23c118bc0a48e96a1021edea4c6b9936aad852.exe
-
Size
81KB
-
MD5
f6cd42cc135918e8e9426d15822fd560
-
SHA1
93296eb05d4846f4ec12747a72e039bd5ea670c4
-
SHA256
00d7389dd9b77d3d9e312d2bef23c118bc0a48e96a1021edea4c6b9936aad852
-
SHA512
c1c8263ffbda854e0b4ac841192fbfca9ff59562cde58cdeb70069aa0c8af681db9300a33b441ae54c9a39bf54844f74e70317f985bca21cc2aa26d72ce22164
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7xCkTsIwtOa2dYS8nj+:ymb3NkkiQ3mdBjFo7LAIbT6j+
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2968-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/956-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/668-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/240-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/948-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2792 lfxfrxl.exe 2060 1tntnt.exe 2608 1hhhtt.exe 2940 1ppvd.exe 2628 9lfxfll.exe 2840 nnhtbh.exe 2472 dvjvd.exe 2032 vpddj.exe 2112 pjjpp.exe 3040 7rrxrlf.exe 2336 xrlrxfl.exe 2832 btbhnt.exe 2740 nnhhbb.exe 2864 tnbntb.exe 3008 pjjdv.exe 956 9rfllxl.exe 1552 fxrxllr.exe 3060 3tnhtt.exe 2708 hbtbhb.exe 1456 ttnhnb.exe 792 vpjvd.exe 592 9pvjv.exe 240 3pjpv.exe 668 fxxfrxl.exe 2432 fffxllx.exe 2004 hbntht.exe 920 ddvvp.exe 948 xrlxxlx.exe 1772 thhhth.exe 2284 3dddp.exe 1208 5rrlrfl.exe 2656 fxrrxfr.exe 2104 dvpvj.exe 2920 7llrxlr.exe 2980 fxlxlrx.exe 2020 hbhntb.exe 2576 3bbhhh.exe 2676 dpjdd.exe 2688 7jpvv.exe 2780 5rrrrlr.exe 2480 hbbhtt.exe 2636 dddjj.exe 2580 vppdv.exe 2756 pvpvd.exe 2508 xlrfxxf.exe 1956 ffxxrff.exe 2908 3bbnbh.exe 2832 nhhhnt.exe 2704 jjdjp.exe 2916 pjpvd.exe 2276 rrlxlrx.exe 952 lffrxxl.exe 2760 1bnthn.exe 3036 nbbhnn.exe 2388 jdjjp.exe 1896 vvjjp.exe 1796 1lfrflf.exe 1456 xffxrrr.exe 2452 9hbbhh.exe 1604 hbhhtb.exe 1080 3dpvj.exe 564 jdppv.exe 2440 ffxfrfr.exe 572 xrxxrrf.exe -
resource yara_rule behavioral1/memory/2968-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/956-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/668-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/240-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/948-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2284-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2792 2968 00d7389dd9b77d3d9e312d2bef23c118bc0a48e96a1021edea4c6b9936aad852.exe 28 PID 2968 wrote to memory of 2792 2968 00d7389dd9b77d3d9e312d2bef23c118bc0a48e96a1021edea4c6b9936aad852.exe 28 PID 2968 wrote to memory of 2792 2968 00d7389dd9b77d3d9e312d2bef23c118bc0a48e96a1021edea4c6b9936aad852.exe 28 PID 2968 wrote to memory of 2792 2968 00d7389dd9b77d3d9e312d2bef23c118bc0a48e96a1021edea4c6b9936aad852.exe 28 PID 2792 wrote to memory of 2060 2792 lfxfrxl.exe 29 PID 2792 wrote to memory of 2060 2792 lfxfrxl.exe 29 PID 2792 wrote to memory of 2060 2792 lfxfrxl.exe 29 PID 2792 wrote to memory of 2060 2792 lfxfrxl.exe 29 PID 2060 wrote to memory of 2608 2060 1tntnt.exe 30 PID 2060 wrote to memory of 2608 2060 1tntnt.exe 30 PID 2060 wrote to memory of 2608 2060 1tntnt.exe 30 PID 2060 wrote to memory of 2608 2060 1tntnt.exe 30 PID 2608 wrote to memory of 2940 2608 1hhhtt.exe 31 PID 2608 wrote to memory of 2940 2608 1hhhtt.exe 31 PID 2608 wrote to memory of 2940 2608 1hhhtt.exe 31 PID 2608 wrote to memory of 2940 2608 1hhhtt.exe 31 PID 2940 wrote to memory of 2628 2940 1ppvd.exe 32 PID 2940 wrote to memory of 2628 2940 1ppvd.exe 32 PID 2940 wrote to memory of 2628 2940 1ppvd.exe 32 PID 2940 wrote to memory of 2628 2940 1ppvd.exe 32 PID 2628 wrote to memory of 2840 2628 9lfxfll.exe 33 PID 2628 wrote to memory of 2840 2628 9lfxfll.exe 33 PID 2628 wrote to memory of 2840 2628 9lfxfll.exe 33 PID 2628 wrote to memory of 2840 2628 9lfxfll.exe 33 PID 2840 wrote to memory of 2472 2840 nnhtbh.exe 34 PID 2840 wrote to memory of 2472 2840 nnhtbh.exe 34 PID 2840 wrote to memory of 2472 2840 nnhtbh.exe 34 PID 2840 wrote to memory of 2472 2840 nnhtbh.exe 34 PID 2472 wrote to memory of 2032 2472 dvjvd.exe 35 PID 2472 wrote to memory of 2032 2472 dvjvd.exe 35 PID 2472 wrote to memory of 2032 2472 dvjvd.exe 35 PID 2472 wrote to memory of 2032 2472 dvjvd.exe 35 PID 2032 wrote to memory of 2112 2032 vpddj.exe 36 PID 2032 wrote to memory of 2112 2032 vpddj.exe 36 PID 2032 wrote to memory of 2112 2032 vpddj.exe 36 PID 2032 wrote to memory of 2112 2032 vpddj.exe 36 PID 2112 wrote to memory of 3040 2112 pjjpp.exe 37 PID 2112 wrote to memory of 3040 2112 pjjpp.exe 37 PID 2112 wrote to memory of 3040 2112 pjjpp.exe 37 PID 2112 wrote to memory of 3040 2112 pjjpp.exe 37 PID 3040 wrote to memory of 2336 3040 7rrxrlf.exe 38 PID 3040 wrote to memory of 2336 3040 7rrxrlf.exe 38 PID 3040 wrote to memory of 2336 3040 7rrxrlf.exe 38 PID 3040 wrote to memory of 2336 3040 7rrxrlf.exe 38 PID 2336 wrote to memory of 2832 2336 xrlrxfl.exe 39 PID 2336 wrote to memory of 2832 2336 xrlrxfl.exe 39 PID 2336 wrote to memory of 2832 2336 xrlrxfl.exe 39 PID 2336 wrote to memory of 2832 2336 xrlrxfl.exe 39 PID 2832 wrote to memory of 2740 2832 btbhnt.exe 40 PID 2832 wrote to memory of 2740 2832 btbhnt.exe 40 PID 2832 wrote to memory of 2740 2832 btbhnt.exe 40 PID 2832 wrote to memory of 2740 2832 btbhnt.exe 40 PID 2740 wrote to memory of 2864 2740 nnhhbb.exe 41 PID 2740 wrote to memory of 2864 2740 nnhhbb.exe 41 PID 2740 wrote to memory of 2864 2740 nnhhbb.exe 41 PID 2740 wrote to memory of 2864 2740 nnhhbb.exe 41 PID 2864 wrote to memory of 3008 2864 tnbntb.exe 42 PID 2864 wrote to memory of 3008 2864 tnbntb.exe 42 PID 2864 wrote to memory of 3008 2864 tnbntb.exe 42 PID 2864 wrote to memory of 3008 2864 tnbntb.exe 42 PID 3008 wrote to memory of 956 3008 pjjdv.exe 43 PID 3008 wrote to memory of 956 3008 pjjdv.exe 43 PID 3008 wrote to memory of 956 3008 pjjdv.exe 43 PID 3008 wrote to memory of 956 3008 pjjdv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\00d7389dd9b77d3d9e312d2bef23c118bc0a48e96a1021edea4c6b9936aad852.exe"C:\Users\Admin\AppData\Local\Temp\00d7389dd9b77d3d9e312d2bef23c118bc0a48e96a1021edea4c6b9936aad852.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\1tntnt.exec:\1tntnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\1hhhtt.exec:\1hhhtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\1ppvd.exec:\1ppvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\9lfxfll.exec:\9lfxfll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\nnhtbh.exec:\nnhtbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\dvjvd.exec:\dvjvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\vpddj.exec:\vpddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\pjjpp.exec:\pjjpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\7rrxrlf.exec:\7rrxrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\btbhnt.exec:\btbhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\nnhhbb.exec:\nnhhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\tnbntb.exec:\tnbntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\pjjdv.exec:\pjjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\9rfllxl.exec:\9rfllxl.exe17⤵
- Executes dropped EXE
PID:956 -
\??\c:\fxrxllr.exec:\fxrxllr.exe18⤵
- Executes dropped EXE
PID:1552 -
\??\c:\3tnhtt.exec:\3tnhtt.exe19⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hbtbhb.exec:\hbtbhb.exe20⤵
- Executes dropped EXE
PID:2708 -
\??\c:\ttnhnb.exec:\ttnhnb.exe21⤵
- Executes dropped EXE
PID:1456 -
\??\c:\vpjvd.exec:\vpjvd.exe22⤵
- Executes dropped EXE
PID:792 -
\??\c:\9pvjv.exec:\9pvjv.exe23⤵
- Executes dropped EXE
PID:592 -
\??\c:\3pjpv.exec:\3pjpv.exe24⤵
- Executes dropped EXE
PID:240 -
\??\c:\fxxfrxl.exec:\fxxfrxl.exe25⤵
- Executes dropped EXE
PID:668 -
\??\c:\fffxllx.exec:\fffxllx.exe26⤵
- Executes dropped EXE
PID:2432 -
\??\c:\hbntht.exec:\hbntht.exe27⤵
- Executes dropped EXE
PID:2004 -
\??\c:\ddvvp.exec:\ddvvp.exe28⤵
- Executes dropped EXE
PID:920 -
\??\c:\xrlxxlx.exec:\xrlxxlx.exe29⤵
- Executes dropped EXE
PID:948 -
\??\c:\thhhth.exec:\thhhth.exe30⤵
- Executes dropped EXE
PID:1772 -
\??\c:\3dddp.exec:\3dddp.exe31⤵
- Executes dropped EXE
PID:2284 -
\??\c:\5rrlrfl.exec:\5rrlrfl.exe32⤵
- Executes dropped EXE
PID:1208 -
\??\c:\fxrrxfr.exec:\fxrrxfr.exe33⤵
- Executes dropped EXE
PID:2656 -
\??\c:\dvpvj.exec:\dvpvj.exe34⤵
- Executes dropped EXE
PID:2104 -
\??\c:\7llrxlr.exec:\7llrxlr.exe35⤵
- Executes dropped EXE
PID:2920 -
\??\c:\fxlxlrx.exec:\fxlxlrx.exe36⤵
- Executes dropped EXE
PID:2980 -
\??\c:\hbhntb.exec:\hbhntb.exe37⤵
- Executes dropped EXE
PID:2020 -
\??\c:\3bbhhh.exec:\3bbhhh.exe38⤵
- Executes dropped EXE
PID:2576 -
\??\c:\dpjdd.exec:\dpjdd.exe39⤵
- Executes dropped EXE
PID:2676 -
\??\c:\7jpvv.exec:\7jpvv.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\5rrrrlr.exec:\5rrrrlr.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\hbbhtt.exec:\hbbhtt.exe42⤵
- Executes dropped EXE
PID:2480 -
\??\c:\dddjj.exec:\dddjj.exe43⤵
- Executes dropped EXE
PID:2636 -
\??\c:\vppdv.exec:\vppdv.exe44⤵
- Executes dropped EXE
PID:2580 -
\??\c:\pvpvd.exec:\pvpvd.exe45⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xlrfxxf.exec:\xlrfxxf.exe46⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ffxxrff.exec:\ffxxrff.exe47⤵
- Executes dropped EXE
PID:1956 -
\??\c:\3bbnbh.exec:\3bbnbh.exe48⤵
- Executes dropped EXE
PID:2908 -
\??\c:\nhhhnt.exec:\nhhhnt.exe49⤵
- Executes dropped EXE
PID:2832 -
\??\c:\jjdjp.exec:\jjdjp.exe50⤵
- Executes dropped EXE
PID:2704 -
\??\c:\pjpvd.exec:\pjpvd.exe51⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rrlxlrx.exec:\rrlxlrx.exe52⤵
- Executes dropped EXE
PID:2276 -
\??\c:\lffrxxl.exec:\lffrxxl.exe53⤵
- Executes dropped EXE
PID:952 -
\??\c:\1bnthn.exec:\1bnthn.exe54⤵
- Executes dropped EXE
PID:2760 -
\??\c:\nbbhnn.exec:\nbbhnn.exe55⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jdjjp.exec:\jdjjp.exe56⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vvjjp.exec:\vvjjp.exe57⤵
- Executes dropped EXE
PID:1896 -
\??\c:\1lfrflf.exec:\1lfrflf.exe58⤵
- Executes dropped EXE
PID:1796 -
\??\c:\xffxrrr.exec:\xffxrrr.exe59⤵
- Executes dropped EXE
PID:1456 -
\??\c:\9hbbhh.exec:\9hbbhh.exe60⤵
- Executes dropped EXE
PID:2452 -
\??\c:\hbhhtb.exec:\hbhhtb.exe61⤵
- Executes dropped EXE
PID:1604 -
\??\c:\3dpvj.exec:\3dpvj.exe62⤵
- Executes dropped EXE
PID:1080 -
\??\c:\jdppv.exec:\jdppv.exe63⤵
- Executes dropped EXE
PID:564 -
\??\c:\ffxfrfr.exec:\ffxfrfr.exe64⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xrxxrrf.exec:\xrxxrrf.exe65⤵
- Executes dropped EXE
PID:572 -
\??\c:\tnhtnn.exec:\tnhtnn.exe66⤵PID:1784
-
\??\c:\5thttt.exec:\5thttt.exe67⤵PID:1048
-
\??\c:\ppdpd.exec:\ppdpd.exe68⤵PID:892
-
\??\c:\dvpvd.exec:\dvpvd.exe69⤵PID:1340
-
\??\c:\rrrfrxl.exec:\rrrfrxl.exe70⤵PID:948
-
\??\c:\ffxxxlx.exec:\ffxxxlx.exe71⤵PID:1724
-
\??\c:\frxxrll.exec:\frxxrll.exe72⤵PID:904
-
\??\c:\btbbbh.exec:\btbbbh.exe73⤵PID:2360
-
\??\c:\nhbbbn.exec:\nhbbbn.exe74⤵PID:2240
-
\??\c:\dvjdd.exec:\dvjdd.exe75⤵PID:2656
-
\??\c:\vjppj.exec:\vjppj.exe76⤵PID:1636
-
\??\c:\rlrrrxl.exec:\rlrrrxl.exe77⤵PID:1596
-
\??\c:\rlxfffr.exec:\rlxfffr.exe78⤵PID:2672
-
\??\c:\1nhntt.exec:\1nhntt.exe79⤵PID:2060
-
\??\c:\7nbntb.exec:\7nbntb.exe80⤵PID:2776
-
\??\c:\jdvdd.exec:\jdvdd.exe81⤵PID:2492
-
\??\c:\3pppp.exec:\3pppp.exe82⤵PID:2584
-
\??\c:\7fffflf.exec:\7fffflf.exe83⤵PID:2840
-
\??\c:\ffxflrx.exec:\ffxflrx.exe84⤵PID:2868
-
\??\c:\9btbnh.exec:\9btbnh.exe85⤵PID:2128
-
\??\c:\ntnbhn.exec:\ntnbhn.exe86⤵PID:3028
-
\??\c:\jvvpd.exec:\jvvpd.exe87⤵PID:2112
-
\??\c:\dvjvd.exec:\dvjvd.exe88⤵PID:3040
-
\??\c:\rlxxlrl.exec:\rlxxlrl.exe89⤵PID:1540
-
\??\c:\5xllrxf.exec:\5xllrxf.exe90⤵PID:2860
-
\??\c:\tntbhn.exec:\tntbhn.exe91⤵PID:2988
-
\??\c:\nhthhb.exec:\nhthhb.exe92⤵PID:2316
-
\??\c:\hththn.exec:\hththn.exe93⤵PID:844
-
\??\c:\dvdjj.exec:\dvdjj.exe94⤵PID:916
-
\??\c:\9pdjv.exec:\9pdjv.exe95⤵PID:1792
-
\??\c:\lfxxfff.exec:\lfxxfff.exe96⤵PID:2760
-
\??\c:\7rrfrxr.exec:\7rrfrxr.exe97⤵PID:2904
-
\??\c:\nbhnbb.exec:\nbhnbb.exe98⤵PID:1276
-
\??\c:\htttnb.exec:\htttnb.exe99⤵PID:580
-
\??\c:\thtnhb.exec:\thtnhb.exe100⤵PID:1204
-
\??\c:\3ddjp.exec:\3ddjp.exe101⤵PID:812
-
\??\c:\jdpjp.exec:\jdpjp.exe102⤵PID:1476
-
\??\c:\3fxffrr.exec:\3fxffrr.exe103⤵PID:2044
-
\??\c:\5fffffr.exec:\5fffffr.exe104⤵PID:1616
-
\??\c:\tthnhh.exec:\tthnhh.exe105⤵PID:668
-
\??\c:\hbbtbt.exec:\hbbtbt.exe106⤵PID:1480
-
\??\c:\1pjvv.exec:\1pjvv.exe107⤵PID:1060
-
\??\c:\jdvvd.exec:\jdvvd.exe108⤵PID:1852
-
\??\c:\7jvpp.exec:\7jvpp.exe109⤵PID:604
-
\??\c:\flrflfl.exec:\flrflfl.exe110⤵PID:972
-
\??\c:\xrflflf.exec:\xrflflf.exe111⤵PID:2216
-
\??\c:\hbttbb.exec:\hbttbb.exe112⤵PID:1664
-
\??\c:\tnhthn.exec:\tnhthn.exe113⤵PID:900
-
\??\c:\3vpdd.exec:\3vpdd.exe114⤵PID:1468
-
\??\c:\dvjjj.exec:\dvjjj.exe115⤵PID:2912
-
\??\c:\lrflfrl.exec:\lrflfrl.exe116⤵PID:2972
-
\??\c:\9rlrrlr.exec:\9rlrrlr.exe117⤵PID:2996
-
\??\c:\5lrxlrf.exec:\5lrxlrf.exe118⤵PID:1632
-
\??\c:\9btnbt.exec:\9btnbt.exe119⤵PID:2984
-
\??\c:\hthntb.exec:\hthntb.exe120⤵PID:2616
-
\??\c:\vjjdd.exec:\vjjdd.exe121⤵PID:2576
-
\??\c:\pjdjv.exec:\pjdjv.exe122⤵PID:2612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-