Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 23:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7037e920982dad4bdc081538e5cf92c6cbfee2889e8d0e77de5b23522a0c79b9.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
7037e920982dad4bdc081538e5cf92c6cbfee2889e8d0e77de5b23522a0c79b9.exe
-
Size
83KB
-
MD5
7aff5e75a3477642fc6a928189343a72
-
SHA1
05ff9b5b7bbfb5194e09b5111f15d014ac91c58d
-
SHA256
7037e920982dad4bdc081538e5cf92c6cbfee2889e8d0e77de5b23522a0c79b9
-
SHA512
9fe3c8b7695026d6b49d01adeb7ddf285f7a46f7fbc7151ef2910bbb055acf02944927682fdfd270f95b48fc611a030af8e550d4852be49293fa11a8e0cf8159
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73yqKH/KjvHo+WdNV:ymb3NkkiQ3mdBjFo73yX+vI+qX
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/1912-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1376-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/816-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/936-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1468-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/752-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 21 IoCs
resource yara_rule behavioral1/memory/1912-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1912-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2648-15-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2036-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2728-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2632-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2392-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2640-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2436-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2812-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1376-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2588-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/888-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1824-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1252-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2744-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/816-217-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/936-225-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1468-243-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/752-261-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2316-289-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2648 pppdv.exe 2036 fxllllr.exe 2728 hnbntn.exe 2632 jpdjv.exe 2392 rrxllxr.exe 2640 bthhtt.exe 2436 9hntbh.exe 2812 5pddd.exe 1376 fxflrxf.exe 2588 lfrxlll.exe 2256 9btttb.exe 888 pdjvv.exe 1824 5jvjp.exe 2296 xfxrrrl.exe 1648 9rflrxl.exe 1596 nhntbt.exe 864 7nhhnn.exe 2008 9jvvd.exe 1252 7rxfllx.exe 2744 9rflllr.exe 2208 7nnbhn.exe 816 nbhhhn.exe 936 3pppj.exe 1744 vjjvv.exe 1468 xrffllr.exe 360 7bbbhh.exe 752 3pvvd.exe 572 pjpjj.exe 2300 rlrxflr.exe 2316 rlxllrx.exe 996 tthntb.exe 2152 pjvvd.exe 1912 3dvpp.exe 1528 xlffllr.exe 2720 rlxfffr.exe 2868 nhhhnh.exe 2496 hbhhnn.exe 2524 ddpvd.exe 2480 xrxxlxf.exe 1940 3xrlllr.exe 2368 bnntth.exe 1712 tttbbn.exe 2396 1ddpd.exe 1504 ppdpj.exe 2988 xxxlxll.exe 1380 llrrrlr.exe 2544 thntbh.exe 1784 bnttbb.exe 1584 dvdpd.exe 276 3vpvp.exe 1824 1lfxrxx.exe 2104 fxlrrrr.exe 1568 nhbhhh.exe 3036 vpvjv.exe 836 vpvvp.exe 864 3rrlllr.exe 1884 lxlfrrx.exe 3052 nhbtbh.exe 2188 bbhnth.exe 2696 vvdpv.exe 1420 rlxfrfr.exe 876 5thnnn.exe 2012 nnntbb.exe 3068 7jdpj.exe -
resource yara_rule behavioral1/memory/1912-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1376-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/816-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/936-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1468-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/752-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1912 wrote to memory of 2648 1912 7037e920982dad4bdc081538e5cf92c6cbfee2889e8d0e77de5b23522a0c79b9.exe 28 PID 1912 wrote to memory of 2648 1912 7037e920982dad4bdc081538e5cf92c6cbfee2889e8d0e77de5b23522a0c79b9.exe 28 PID 1912 wrote to memory of 2648 1912 7037e920982dad4bdc081538e5cf92c6cbfee2889e8d0e77de5b23522a0c79b9.exe 28 PID 1912 wrote to memory of 2648 1912 7037e920982dad4bdc081538e5cf92c6cbfee2889e8d0e77de5b23522a0c79b9.exe 28 PID 2648 wrote to memory of 2036 2648 pppdv.exe 29 PID 2648 wrote to memory of 2036 2648 pppdv.exe 29 PID 2648 wrote to memory of 2036 2648 pppdv.exe 29 PID 2648 wrote to memory of 2036 2648 pppdv.exe 29 PID 2036 wrote to memory of 2728 2036 fxllllr.exe 30 PID 2036 wrote to memory of 2728 2036 fxllllr.exe 30 PID 2036 wrote to memory of 2728 2036 fxllllr.exe 30 PID 2036 wrote to memory of 2728 2036 fxllllr.exe 30 PID 2728 wrote to memory of 2632 2728 hnbntn.exe 31 PID 2728 wrote to memory of 2632 2728 hnbntn.exe 31 PID 2728 wrote to memory of 2632 2728 hnbntn.exe 31 PID 2728 wrote to memory of 2632 2728 hnbntn.exe 31 PID 2632 wrote to memory of 2392 2632 jpdjv.exe 32 PID 2632 wrote to memory of 2392 2632 jpdjv.exe 32 PID 2632 wrote to memory of 2392 2632 jpdjv.exe 32 PID 2632 wrote to memory of 2392 2632 jpdjv.exe 32 PID 2392 wrote to memory of 2640 2392 rrxllxr.exe 33 PID 2392 wrote to memory of 2640 2392 rrxllxr.exe 33 PID 2392 wrote to memory of 2640 2392 rrxllxr.exe 33 PID 2392 wrote to memory of 2640 2392 rrxllxr.exe 33 PID 2640 wrote to memory of 2436 2640 bthhtt.exe 34 PID 2640 wrote to memory of 2436 2640 bthhtt.exe 34 PID 2640 wrote to memory of 2436 2640 bthhtt.exe 34 PID 2640 wrote to memory of 2436 2640 bthhtt.exe 34 PID 2436 wrote to memory of 2812 2436 9hntbh.exe 35 PID 2436 wrote to memory of 2812 2436 9hntbh.exe 35 PID 2436 wrote to memory of 2812 2436 9hntbh.exe 35 PID 2436 wrote to memory of 2812 2436 9hntbh.exe 35 PID 2812 wrote to memory of 1376 2812 5pddd.exe 36 PID 2812 wrote to memory of 1376 2812 5pddd.exe 36 PID 2812 wrote to memory of 1376 2812 5pddd.exe 36 PID 2812 wrote to memory of 1376 2812 5pddd.exe 36 PID 1376 wrote to memory of 2588 1376 fxflrxf.exe 37 PID 1376 wrote to memory of 2588 1376 fxflrxf.exe 37 PID 1376 wrote to memory of 2588 1376 fxflrxf.exe 37 PID 1376 wrote to memory of 2588 1376 fxflrxf.exe 37 PID 2588 wrote to memory of 2256 2588 lfrxlll.exe 38 PID 2588 wrote to memory of 2256 2588 lfrxlll.exe 38 PID 2588 wrote to memory of 2256 2588 lfrxlll.exe 38 PID 2588 wrote to memory of 2256 2588 lfrxlll.exe 38 PID 2256 wrote to memory of 888 2256 9btttb.exe 39 PID 2256 wrote to memory of 888 2256 9btttb.exe 39 PID 2256 wrote to memory of 888 2256 9btttb.exe 39 PID 2256 wrote to memory of 888 2256 9btttb.exe 39 PID 888 wrote to memory of 1824 888 pdjvv.exe 40 PID 888 wrote to memory of 1824 888 pdjvv.exe 40 PID 888 wrote to memory of 1824 888 pdjvv.exe 40 PID 888 wrote to memory of 1824 888 pdjvv.exe 40 PID 1824 wrote to memory of 2296 1824 5jvjp.exe 41 PID 1824 wrote to memory of 2296 1824 5jvjp.exe 41 PID 1824 wrote to memory of 2296 1824 5jvjp.exe 41 PID 1824 wrote to memory of 2296 1824 5jvjp.exe 41 PID 2296 wrote to memory of 1648 2296 xfxrrrl.exe 42 PID 2296 wrote to memory of 1648 2296 xfxrrrl.exe 42 PID 2296 wrote to memory of 1648 2296 xfxrrrl.exe 42 PID 2296 wrote to memory of 1648 2296 xfxrrrl.exe 42 PID 1648 wrote to memory of 1596 1648 9rflrxl.exe 43 PID 1648 wrote to memory of 1596 1648 9rflrxl.exe 43 PID 1648 wrote to memory of 1596 1648 9rflrxl.exe 43 PID 1648 wrote to memory of 1596 1648 9rflrxl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\7037e920982dad4bdc081538e5cf92c6cbfee2889e8d0e77de5b23522a0c79b9.exe"C:\Users\Admin\AppData\Local\Temp\7037e920982dad4bdc081538e5cf92c6cbfee2889e8d0e77de5b23522a0c79b9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\pppdv.exec:\pppdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\fxllllr.exec:\fxllllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\hnbntn.exec:\hnbntn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\jpdjv.exec:\jpdjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\rrxllxr.exec:\rrxllxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\bthhtt.exec:\bthhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\9hntbh.exec:\9hntbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\5pddd.exec:\5pddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\fxflrxf.exec:\fxflrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\lfrxlll.exec:\lfrxlll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\9btttb.exec:\9btttb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\pdjvv.exec:\pdjvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\5jvjp.exec:\5jvjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\xfxrrrl.exec:\xfxrrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\9rflrxl.exec:\9rflrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\nhntbt.exec:\nhntbt.exe17⤵
- Executes dropped EXE
PID:1596 -
\??\c:\7nhhnn.exec:\7nhhnn.exe18⤵
- Executes dropped EXE
PID:864 -
\??\c:\9jvvd.exec:\9jvvd.exe19⤵
- Executes dropped EXE
PID:2008 -
\??\c:\7rxfllx.exec:\7rxfllx.exe20⤵
- Executes dropped EXE
PID:1252 -
\??\c:\9rflllr.exec:\9rflllr.exe21⤵
- Executes dropped EXE
PID:2744 -
\??\c:\7nnbhn.exec:\7nnbhn.exe22⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nbhhhn.exec:\nbhhhn.exe23⤵
- Executes dropped EXE
PID:816 -
\??\c:\3pppj.exec:\3pppj.exe24⤵
- Executes dropped EXE
PID:936 -
\??\c:\vjjvv.exec:\vjjvv.exe25⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xrffllr.exec:\xrffllr.exe26⤵
- Executes dropped EXE
PID:1468 -
\??\c:\7bbbhh.exec:\7bbbhh.exe27⤵
- Executes dropped EXE
PID:360 -
\??\c:\3pvvd.exec:\3pvvd.exe28⤵
- Executes dropped EXE
PID:752 -
\??\c:\pjpjj.exec:\pjpjj.exe29⤵
- Executes dropped EXE
PID:572 -
\??\c:\rlrxflr.exec:\rlrxflr.exe30⤵
- Executes dropped EXE
PID:2300 -
\??\c:\rlxllrx.exec:\rlxllrx.exe31⤵
- Executes dropped EXE
PID:2316 -
\??\c:\tthntb.exec:\tthntb.exe32⤵
- Executes dropped EXE
PID:996 -
\??\c:\pjvvd.exec:\pjvvd.exe33⤵
- Executes dropped EXE
PID:2152 -
\??\c:\3dvpp.exec:\3dvpp.exe34⤵
- Executes dropped EXE
PID:1912 -
\??\c:\xlffllr.exec:\xlffllr.exe35⤵
- Executes dropped EXE
PID:1528 -
\??\c:\rlxfffr.exec:\rlxfffr.exe36⤵
- Executes dropped EXE
PID:2720 -
\??\c:\nhhhnh.exec:\nhhhnh.exe37⤵
- Executes dropped EXE
PID:2868 -
\??\c:\hbhhnn.exec:\hbhhnn.exe38⤵
- Executes dropped EXE
PID:2496 -
\??\c:\ddpvd.exec:\ddpvd.exe39⤵
- Executes dropped EXE
PID:2524 -
\??\c:\xrxxlxf.exec:\xrxxlxf.exe40⤵
- Executes dropped EXE
PID:2480 -
\??\c:\3xrlllr.exec:\3xrlllr.exe41⤵
- Executes dropped EXE
PID:1940 -
\??\c:\bnntth.exec:\bnntth.exe42⤵
- Executes dropped EXE
PID:2368 -
\??\c:\tttbbn.exec:\tttbbn.exe43⤵
- Executes dropped EXE
PID:1712 -
\??\c:\1ddpd.exec:\1ddpd.exe44⤵
- Executes dropped EXE
PID:2396 -
\??\c:\ppdpj.exec:\ppdpj.exe45⤵
- Executes dropped EXE
PID:1504 -
\??\c:\xxxlxll.exec:\xxxlxll.exe46⤵
- Executes dropped EXE
PID:2988 -
\??\c:\llrrrlr.exec:\llrrrlr.exe47⤵
- Executes dropped EXE
PID:1380 -
\??\c:\thntbh.exec:\thntbh.exe48⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bnttbb.exec:\bnttbb.exe49⤵
- Executes dropped EXE
PID:1784 -
\??\c:\dvdpd.exec:\dvdpd.exe50⤵
- Executes dropped EXE
PID:1584 -
\??\c:\3vpvp.exec:\3vpvp.exe51⤵
- Executes dropped EXE
PID:276 -
\??\c:\1lfxrxx.exec:\1lfxrxx.exe52⤵
- Executes dropped EXE
PID:1824 -
\??\c:\fxlrrrr.exec:\fxlrrrr.exe53⤵
- Executes dropped EXE
PID:2104 -
\??\c:\nhbhhh.exec:\nhbhhh.exe54⤵
- Executes dropped EXE
PID:1568 -
\??\c:\vpvjv.exec:\vpvjv.exe55⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vpvvp.exec:\vpvvp.exe56⤵
- Executes dropped EXE
PID:836 -
\??\c:\3rrlllr.exec:\3rrlllr.exe57⤵
- Executes dropped EXE
PID:864 -
\??\c:\lxlfrrx.exec:\lxlfrrx.exe58⤵
- Executes dropped EXE
PID:1884 -
\??\c:\nhbtbh.exec:\nhbtbh.exe59⤵
- Executes dropped EXE
PID:3052 -
\??\c:\bbhnth.exec:\bbhnth.exe60⤵
- Executes dropped EXE
PID:2188 -
\??\c:\vvdpv.exec:\vvdpv.exe61⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rlxfrfr.exec:\rlxfrfr.exe62⤵
- Executes dropped EXE
PID:1420 -
\??\c:\5thnnn.exec:\5thnnn.exe63⤵
- Executes dropped EXE
PID:876 -
\??\c:\nnntbb.exec:\nnntbb.exe64⤵
- Executes dropped EXE
PID:2012 -
\??\c:\7jdpj.exec:\7jdpj.exe65⤵
- Executes dropped EXE
PID:3068 -
\??\c:\dddvv.exec:\dddvv.exe66⤵PID:992
-
\??\c:\xxllllx.exec:\xxllllx.exe67⤵PID:500
-
\??\c:\1fflxxl.exec:\1fflxxl.exe68⤵PID:360
-
\??\c:\tnhnnb.exec:\tnhnnb.exe69⤵PID:2924
-
\??\c:\nbnntn.exec:\nbnntn.exe70⤵PID:1892
-
\??\c:\ddvjd.exec:\ddvjd.exe71⤵PID:3016
-
\??\c:\rflllrx.exec:\rflllrx.exe72⤵PID:2264
-
\??\c:\lrfrflx.exec:\lrfrflx.exe73⤵PID:3000
-
\??\c:\hnnthn.exec:\hnnthn.exe74⤵PID:2032
-
\??\c:\ttttnn.exec:\ttttnn.exe75⤵PID:1980
-
\??\c:\9bhtbt.exec:\9bhtbt.exe76⤵PID:1500
-
\??\c:\ddjvv.exec:\ddjvv.exe77⤵PID:2216
-
\??\c:\pppjv.exec:\pppjv.exe78⤵PID:2560
-
\??\c:\9flflrx.exec:\9flflrx.exe79⤵PID:2492
-
\??\c:\xxrlllf.exec:\xxrlllf.exe80⤵PID:2596
-
\??\c:\nthbtt.exec:\nthbtt.exe81⤵PID:2556
-
\??\c:\5thnth.exec:\5thnth.exe82⤵PID:2500
-
\??\c:\pjpjp.exec:\pjpjp.exe83⤵PID:2688
-
\??\c:\jjvjv.exec:\jjvjv.exe84⤵PID:2384
-
\??\c:\rlffrrx.exec:\rlffrrx.exe85⤵PID:2476
-
\??\c:\nhbhhn.exec:\nhbhhn.exe86⤵PID:2436
-
\??\c:\bnbbhb.exec:\bnbbhb.exe87⤵PID:2396
-
\??\c:\ddppv.exec:\ddppv.exe88⤵PID:2432
-
\??\c:\jdjjd.exec:\jdjjd.exe89⤵PID:2540
-
\??\c:\xfxllxf.exec:\xfxllxf.exe90⤵PID:2672
-
\??\c:\lxllxfx.exec:\lxllxfx.exe91⤵PID:660
-
\??\c:\nhbhtb.exec:\nhbhtb.exe92⤵PID:1820
-
\??\c:\pdpdp.exec:\pdpdp.exe93⤵PID:2096
-
\??\c:\9vjdp.exec:\9vjdp.exe94⤵PID:1812
-
\??\c:\vvpvd.exec:\vvpvd.exe95⤵PID:1456
-
\??\c:\lllrfrr.exec:\lllrfrr.exe96⤵PID:2116
-
\??\c:\lfflxxl.exec:\lfflxxl.exe97⤵PID:1344
-
\??\c:\nhnnbb.exec:\nhnnbb.exe98⤵PID:2460
-
\??\c:\hbntbh.exec:\hbntbh.exe99⤵PID:1180
-
\??\c:\vjpjj.exec:\vjpjj.exe100⤵PID:1888
-
\??\c:\pdjjj.exec:\pdjjj.exe101⤵PID:1252
-
\??\c:\xrxlrfl.exec:\xrxlrfl.exe102⤵PID:324
-
\??\c:\7lxxlxr.exec:\7lxxlxr.exe103⤵PID:812
-
\??\c:\btbhnn.exec:\btbhnn.exe104⤵PID:672
-
\??\c:\7nhhhb.exec:\7nhhhb.exe105⤵PID:1412
-
\??\c:\vjppv.exec:\vjppv.exe106⤵PID:1564
-
\??\c:\dvvvj.exec:\dvvvj.exe107⤵PID:1768
-
\??\c:\fxllrrf.exec:\fxllrrf.exe108⤵PID:1080
-
\??\c:\ntbbbt.exec:\ntbbbt.exe109⤵PID:1256
-
\??\c:\bnbntt.exec:\bnbntt.exe110⤵PID:1580
-
\??\c:\djvpd.exec:\djvpd.exe111⤵PID:756
-
\??\c:\dvddp.exec:\dvddp.exe112⤵PID:556
-
\??\c:\rlrlrll.exec:\rlrlrll.exe113⤵PID:2132
-
\??\c:\rrlrrfl.exec:\rrlrrfl.exe114⤵PID:844
-
\??\c:\nhbbhh.exec:\nhbbhh.exe115⤵PID:1436
-
\??\c:\thnnhn.exec:\thnnhn.exe116⤵PID:2016
-
\??\c:\pdvvj.exec:\pdvvj.exe117⤵PID:892
-
\??\c:\jjvdj.exec:\jjvdj.exe118⤵PID:2456
-
\??\c:\3rfrfrr.exec:\3rfrfrr.exe119⤵PID:2576
-
\??\c:\lfrflfl.exec:\lfrflfl.exe120⤵PID:2600
-
\??\c:\3nhbhn.exec:\3nhbhn.exe121⤵PID:2520
-
\??\c:\btbhhh.exec:\btbhhh.exe122⤵PID:2468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-