Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 04:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a1dd0b0af2d9c7e40a9dd1651461d0d02e5d0e326b2eb96bcaac844e88aba736.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a1dd0b0af2d9c7e40a9dd1651461d0d02e5d0e326b2eb96bcaac844e88aba736.exe
-
Size
56KB
-
MD5
1119de8e6d435ad08c4fa3f56724df80
-
SHA1
788c1cfdd35597b5aa8b1b951618ea286bd537e6
-
SHA256
a1dd0b0af2d9c7e40a9dd1651461d0d02e5d0e326b2eb96bcaac844e88aba736
-
SHA512
1406225dba4a79c0ee943e02aeaeb08e2ac685f96e2add54b81ff5c747e896ef9033699d64863cc3f84b0fd0335b323b9bf93ca2be7be826f71e15ba31e9f8e0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb6tZ9bA:ymb3NkkiQ3mdBjFIb6tZNA
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2288-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-30-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-83-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1332-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1496-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/556-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/892-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dvdjv.exeddvjj.exenhtbhh.exe7jpdp.exebthbtt.exejdjpj.exe5jddd.exe1xxfflf.exebtnnth.exevjpvd.exejdjdj.exe1rlllfr.exethnhnh.exentnttt.exedvdpd.exejdvdj.exefxrxffr.exenhtthh.exebtnhnh.exejdpjp.exefxlrffr.exerfrxflr.exe1tbtbh.exevjvvj.exevvvjv.exe7lflrxf.exe1bhnnt.exedvpvv.exerlfrxfl.exebthntt.exebbhtbn.exejjvdv.exe1rrrffr.exe1frxlxf.exe5bbthh.exe5nbbhb.exejdpvp.exelxfflfl.exefxlrfrx.exehbnbnn.exe7htbhb.exepjpvj.exedvvvj.exe7xlrrfl.exexrflxxf.exe3tnntt.exebnbttn.exepdpvp.exe3fflffr.exexrrxfxl.exetnnnnn.exehbtbnt.exedvvdj.exejjdjp.exexrflrfl.exerlrxfll.exebtbhnn.exehtbbnn.exepdpdv.exevpjvd.exexrlrxrx.exerlxxffr.exenhtbnt.exebnbhhh.exepid process 1708 dvdjv.exe 2996 ddvjj.exe 2680 nhtbhh.exe 2688 7jpdp.exe 2812 bthbtt.exe 2432 jdjpj.exe 2536 5jddd.exe 2612 1xxfflf.exe 2424 btnnth.exe 2624 vjpvd.exe 2876 jdjdj.exe 1292 1rlllfr.exe 1332 thnhnh.exe 2500 ntnttt.exe 2340 dvdpd.exe 2412 jdvdj.exe 1984 fxrxffr.exe 1696 nhtthh.exe 1336 btnhnh.exe 2516 jdpjp.exe 2384 fxlrffr.exe 320 rfrxflr.exe 1028 1tbtbh.exe 1496 vjvvj.exe 556 vvvjv.exe 1780 7lflrxf.exe 1172 1bhnnt.exe 1632 dvpvv.exe 892 rlfrxfl.exe 2908 bthntt.exe 756 bbhtbn.exe 888 jjvdv.exe 1724 1rrrffr.exe 2252 1frxlxf.exe 2268 5bbthh.exe 2748 5nbbhb.exe 1628 jdpvp.exe 2280 lxfflfl.exe 2928 fxlrfrx.exe 2104 hbnbnn.exe 2692 7htbhb.exe 2752 pjpvj.exe 2820 dvvvj.exe 2536 7xlrrfl.exe 3004 xrflxxf.exe 3028 3tnntt.exe 2804 bnbttn.exe 2856 pdpvp.exe 2636 3fflffr.exe 2980 xrrxfxl.exe 2024 tnnnnn.exe 812 hbtbnt.exe 1704 dvvdj.exe 1064 jjdjp.exe 1716 xrflrfl.exe 1652 rlrxfll.exe 316 btbhnn.exe 2068 htbbnn.exe 2488 pdpdv.exe 2140 vpjvd.exe 2944 xrlrxrx.exe 1756 rlxxffr.exe 992 nhtbnt.exe 1660 bnbhhh.exe -
Processes:
resource yara_rule behavioral1/memory/2288-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1332-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/556-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/892-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a1dd0b0af2d9c7e40a9dd1651461d0d02e5d0e326b2eb96bcaac844e88aba736.exedvdjv.exeddvjj.exenhtbhh.exe7jpdp.exebthbtt.exejdjpj.exe5jddd.exe1xxfflf.exebtnnth.exevjpvd.exejdjdj.exe1rlllfr.exethnhnh.exentnttt.exedvdpd.exedescription pid process target process PID 2288 wrote to memory of 1708 2288 a1dd0b0af2d9c7e40a9dd1651461d0d02e5d0e326b2eb96bcaac844e88aba736.exe dvdjv.exe PID 2288 wrote to memory of 1708 2288 a1dd0b0af2d9c7e40a9dd1651461d0d02e5d0e326b2eb96bcaac844e88aba736.exe dvdjv.exe PID 2288 wrote to memory of 1708 2288 a1dd0b0af2d9c7e40a9dd1651461d0d02e5d0e326b2eb96bcaac844e88aba736.exe dvdjv.exe PID 2288 wrote to memory of 1708 2288 a1dd0b0af2d9c7e40a9dd1651461d0d02e5d0e326b2eb96bcaac844e88aba736.exe dvdjv.exe PID 1708 wrote to memory of 2996 1708 dvdjv.exe ddvjj.exe PID 1708 wrote to memory of 2996 1708 dvdjv.exe ddvjj.exe PID 1708 wrote to memory of 2996 1708 dvdjv.exe ddvjj.exe PID 1708 wrote to memory of 2996 1708 dvdjv.exe ddvjj.exe PID 2996 wrote to memory of 2680 2996 ddvjj.exe nhtbhh.exe PID 2996 wrote to memory of 2680 2996 ddvjj.exe nhtbhh.exe PID 2996 wrote to memory of 2680 2996 ddvjj.exe nhtbhh.exe PID 2996 wrote to memory of 2680 2996 ddvjj.exe nhtbhh.exe PID 2680 wrote to memory of 2688 2680 nhtbhh.exe 7jpdp.exe PID 2680 wrote to memory of 2688 2680 nhtbhh.exe 7jpdp.exe PID 2680 wrote to memory of 2688 2680 nhtbhh.exe 7jpdp.exe PID 2680 wrote to memory of 2688 2680 nhtbhh.exe 7jpdp.exe PID 2688 wrote to memory of 2812 2688 7jpdp.exe bthbtt.exe PID 2688 wrote to memory of 2812 2688 7jpdp.exe bthbtt.exe PID 2688 wrote to memory of 2812 2688 7jpdp.exe bthbtt.exe PID 2688 wrote to memory of 2812 2688 7jpdp.exe bthbtt.exe PID 2812 wrote to memory of 2432 2812 bthbtt.exe jdjpj.exe PID 2812 wrote to memory of 2432 2812 bthbtt.exe jdjpj.exe PID 2812 wrote to memory of 2432 2812 bthbtt.exe jdjpj.exe PID 2812 wrote to memory of 2432 2812 bthbtt.exe jdjpj.exe PID 2432 wrote to memory of 2536 2432 jdjpj.exe 5jddd.exe PID 2432 wrote to memory of 2536 2432 jdjpj.exe 5jddd.exe PID 2432 wrote to memory of 2536 2432 jdjpj.exe 5jddd.exe PID 2432 wrote to memory of 2536 2432 jdjpj.exe 5jddd.exe PID 2536 wrote to memory of 2612 2536 5jddd.exe 1xxfflf.exe PID 2536 wrote to memory of 2612 2536 5jddd.exe 1xxfflf.exe PID 2536 wrote to memory of 2612 2536 5jddd.exe 1xxfflf.exe PID 2536 wrote to memory of 2612 2536 5jddd.exe 1xxfflf.exe PID 2612 wrote to memory of 2424 2612 1xxfflf.exe btnnth.exe PID 2612 wrote to memory of 2424 2612 1xxfflf.exe btnnth.exe PID 2612 wrote to memory of 2424 2612 1xxfflf.exe btnnth.exe PID 2612 wrote to memory of 2424 2612 1xxfflf.exe btnnth.exe PID 2424 wrote to memory of 2624 2424 btnnth.exe vjpvd.exe PID 2424 wrote to memory of 2624 2424 btnnth.exe vjpvd.exe PID 2424 wrote to memory of 2624 2424 btnnth.exe vjpvd.exe PID 2424 wrote to memory of 2624 2424 btnnth.exe vjpvd.exe PID 2624 wrote to memory of 2876 2624 vjpvd.exe jdjdj.exe PID 2624 wrote to memory of 2876 2624 vjpvd.exe jdjdj.exe PID 2624 wrote to memory of 2876 2624 vjpvd.exe jdjdj.exe PID 2624 wrote to memory of 2876 2624 vjpvd.exe jdjdj.exe PID 2876 wrote to memory of 1292 2876 jdjdj.exe 1rlllfr.exe PID 2876 wrote to memory of 1292 2876 jdjdj.exe 1rlllfr.exe PID 2876 wrote to memory of 1292 2876 jdjdj.exe 1rlllfr.exe PID 2876 wrote to memory of 1292 2876 jdjdj.exe 1rlllfr.exe PID 1292 wrote to memory of 1332 1292 1rlllfr.exe thnhnh.exe PID 1292 wrote to memory of 1332 1292 1rlllfr.exe thnhnh.exe PID 1292 wrote to memory of 1332 1292 1rlllfr.exe thnhnh.exe PID 1292 wrote to memory of 1332 1292 1rlllfr.exe thnhnh.exe PID 1332 wrote to memory of 2500 1332 thnhnh.exe ntnttt.exe PID 1332 wrote to memory of 2500 1332 thnhnh.exe ntnttt.exe PID 1332 wrote to memory of 2500 1332 thnhnh.exe ntnttt.exe PID 1332 wrote to memory of 2500 1332 thnhnh.exe ntnttt.exe PID 2500 wrote to memory of 2340 2500 ntnttt.exe dvdpd.exe PID 2500 wrote to memory of 2340 2500 ntnttt.exe dvdpd.exe PID 2500 wrote to memory of 2340 2500 ntnttt.exe dvdpd.exe PID 2500 wrote to memory of 2340 2500 ntnttt.exe dvdpd.exe PID 2340 wrote to memory of 2412 2340 dvdpd.exe jdvdj.exe PID 2340 wrote to memory of 2412 2340 dvdpd.exe jdvdj.exe PID 2340 wrote to memory of 2412 2340 dvdpd.exe jdvdj.exe PID 2340 wrote to memory of 2412 2340 dvdpd.exe jdvdj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1dd0b0af2d9c7e40a9dd1651461d0d02e5d0e326b2eb96bcaac844e88aba736.exe"C:\Users\Admin\AppData\Local\Temp\a1dd0b0af2d9c7e40a9dd1651461d0d02e5d0e326b2eb96bcaac844e88aba736.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\dvdjv.exec:\dvdjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\ddvjj.exec:\ddvjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\nhtbhh.exec:\nhtbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\7jpdp.exec:\7jpdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\bthbtt.exec:\bthbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\jdjpj.exec:\jdjpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\5jddd.exec:\5jddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\1xxfflf.exec:\1xxfflf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\btnnth.exec:\btnnth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\vjpvd.exec:\vjpvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\jdjdj.exec:\jdjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\1rlllfr.exec:\1rlllfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\thnhnh.exec:\thnhnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\ntnttt.exec:\ntnttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\dvdpd.exec:\dvdpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\jdvdj.exec:\jdvdj.exe17⤵
- Executes dropped EXE
PID:2412 -
\??\c:\fxrxffr.exec:\fxrxffr.exe18⤵
- Executes dropped EXE
PID:1984 -
\??\c:\nhtthh.exec:\nhtthh.exe19⤵
- Executes dropped EXE
PID:1696 -
\??\c:\btnhnh.exec:\btnhnh.exe20⤵
- Executes dropped EXE
PID:1336 -
\??\c:\jdpjp.exec:\jdpjp.exe21⤵
- Executes dropped EXE
PID:2516 -
\??\c:\fxlrffr.exec:\fxlrffr.exe22⤵
- Executes dropped EXE
PID:2384 -
\??\c:\rfrxflr.exec:\rfrxflr.exe23⤵
- Executes dropped EXE
PID:320 -
\??\c:\1tbtbh.exec:\1tbtbh.exe24⤵
- Executes dropped EXE
PID:1028 -
\??\c:\vjvvj.exec:\vjvvj.exe25⤵
- Executes dropped EXE
PID:1496 -
\??\c:\vvvjv.exec:\vvvjv.exe26⤵
- Executes dropped EXE
PID:556 -
\??\c:\7lflrxf.exec:\7lflrxf.exe27⤵
- Executes dropped EXE
PID:1780 -
\??\c:\1bhnnt.exec:\1bhnnt.exe28⤵
- Executes dropped EXE
PID:1172 -
\??\c:\dvpvv.exec:\dvpvv.exe29⤵
- Executes dropped EXE
PID:1632 -
\??\c:\rlfrxfl.exec:\rlfrxfl.exe30⤵
- Executes dropped EXE
PID:892 -
\??\c:\bthntt.exec:\bthntt.exe31⤵
- Executes dropped EXE
PID:2908 -
\??\c:\bbhtbn.exec:\bbhtbn.exe32⤵
- Executes dropped EXE
PID:756 -
\??\c:\jjvdv.exec:\jjvdv.exe33⤵
- Executes dropped EXE
PID:888 -
\??\c:\1rrrffr.exec:\1rrrffr.exe34⤵
- Executes dropped EXE
PID:1724 -
\??\c:\1frxlxf.exec:\1frxlxf.exe35⤵
- Executes dropped EXE
PID:2252 -
\??\c:\5bbthh.exec:\5bbthh.exe36⤵
- Executes dropped EXE
PID:2268 -
\??\c:\5nbbhb.exec:\5nbbhb.exe37⤵
- Executes dropped EXE
PID:2748 -
\??\c:\jdpvp.exec:\jdpvp.exe38⤵
- Executes dropped EXE
PID:1628 -
\??\c:\lxfflfl.exec:\lxfflfl.exe39⤵
- Executes dropped EXE
PID:2280 -
\??\c:\fxlrfrx.exec:\fxlrfrx.exe40⤵
- Executes dropped EXE
PID:2928 -
\??\c:\hbnbnn.exec:\hbnbnn.exe41⤵
- Executes dropped EXE
PID:2104 -
\??\c:\7htbhb.exec:\7htbhb.exe42⤵
- Executes dropped EXE
PID:2692 -
\??\c:\pjpvj.exec:\pjpvj.exe43⤵
- Executes dropped EXE
PID:2752 -
\??\c:\dvvvj.exec:\dvvvj.exe44⤵
- Executes dropped EXE
PID:2820 -
\??\c:\7xlrrfl.exec:\7xlrrfl.exe45⤵
- Executes dropped EXE
PID:2536 -
\??\c:\xrflxxf.exec:\xrflxxf.exe46⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3tnntt.exec:\3tnntt.exe47⤵
- Executes dropped EXE
PID:3028 -
\??\c:\bnbttn.exec:\bnbttn.exe48⤵
- Executes dropped EXE
PID:2804 -
\??\c:\pdpvp.exec:\pdpvp.exe49⤵
- Executes dropped EXE
PID:2856 -
\??\c:\3fflffr.exec:\3fflffr.exe50⤵
- Executes dropped EXE
PID:2636 -
\??\c:\xrrxfxl.exec:\xrrxfxl.exe51⤵
- Executes dropped EXE
PID:2980 -
\??\c:\tnnnnn.exec:\tnnnnn.exe52⤵
- Executes dropped EXE
PID:2024 -
\??\c:\hbtbnt.exec:\hbtbnt.exe53⤵
- Executes dropped EXE
PID:812 -
\??\c:\dvvdj.exec:\dvvdj.exe54⤵
- Executes dropped EXE
PID:1704 -
\??\c:\jjdjp.exec:\jjdjp.exe55⤵
- Executes dropped EXE
PID:1064 -
\??\c:\xrflrfl.exec:\xrflrfl.exe56⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rlrxfll.exec:\rlrxfll.exe57⤵
- Executes dropped EXE
PID:1652 -
\??\c:\btbhnn.exec:\btbhnn.exe58⤵
- Executes dropped EXE
PID:316 -
\??\c:\htbbnn.exec:\htbbnn.exe59⤵
- Executes dropped EXE
PID:2068 -
\??\c:\pdpdv.exec:\pdpdv.exe60⤵
- Executes dropped EXE
PID:2488 -
\??\c:\vpjvd.exec:\vpjvd.exe61⤵
- Executes dropped EXE
PID:2140 -
\??\c:\xrlrxrx.exec:\xrlrxrx.exe62⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rlxxffr.exec:\rlxxffr.exe63⤵
- Executes dropped EXE
PID:1756 -
\??\c:\nhtbnt.exec:\nhtbnt.exe64⤵
- Executes dropped EXE
PID:992 -
\??\c:\bnbhhh.exec:\bnbhhh.exe65⤵
- Executes dropped EXE
PID:1660 -
\??\c:\3vppv.exec:\3vppv.exe66⤵PID:836
-
\??\c:\dpvpp.exec:\dpvpp.exe67⤵PID:1496
-
\??\c:\xrlfrrx.exec:\xrlfrrx.exe68⤵PID:556
-
\??\c:\xlrllrr.exec:\xlrllrr.exe69⤵PID:1880
-
\??\c:\7fxxrrl.exec:\7fxxrrl.exe70⤵PID:1276
-
\??\c:\5htbhn.exec:\5htbhn.exe71⤵PID:1856
-
\??\c:\tnbhnh.exec:\tnbhnh.exe72⤵PID:572
-
\??\c:\dvddv.exec:\dvddv.exe73⤵PID:2932
-
\??\c:\jjjjp.exec:\jjjjp.exe74⤵PID:2232
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe75⤵PID:1804
-
\??\c:\lflrxxf.exec:\lflrxxf.exe76⤵PID:2844
-
\??\c:\bnbnbn.exec:\bnbnbn.exe77⤵PID:2288
-
\??\c:\bnbnnn.exec:\bnbnnn.exe78⤵PID:2260
-
\??\c:\dvvvj.exec:\dvvvj.exe79⤵PID:2088
-
\??\c:\vjpjp.exec:\vjpjp.exe80⤵PID:1544
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe81⤵PID:1588
-
\??\c:\7thbhh.exec:\7thbhh.exe82⤵PID:1628
-
\??\c:\hbnbhh.exec:\hbnbhh.exe83⤵PID:2924
-
\??\c:\5vddp.exec:\5vddp.exe84⤵PID:2652
-
\??\c:\dvdvd.exec:\dvdvd.exe85⤵PID:2564
-
\??\c:\lfrfflr.exec:\lfrfflr.exe86⤵PID:2708
-
\??\c:\xrxfflr.exec:\xrxfflr.exe87⤵PID:2548
-
\??\c:\nhttbt.exec:\nhttbt.exe88⤵PID:2600
-
\??\c:\btttbb.exec:\btttbb.exe89⤵PID:2828
-
\??\c:\vpjjj.exec:\vpjjj.exe90⤵PID:1988
-
\??\c:\pjpvd.exec:\pjpvd.exe91⤵PID:2424
-
\??\c:\xrlllll.exec:\xrlllll.exe92⤵PID:2880
-
\??\c:\rlxfrlx.exec:\rlxfrlx.exe93⤵PID:3016
-
\??\c:\1btbnt.exec:\1btbnt.exe94⤵PID:2428
-
\??\c:\9bnnbh.exec:\9bnnbh.exe95⤵PID:2452
-
\??\c:\1vjdd.exec:\1vjdd.exe96⤵PID:2012
-
\??\c:\pdpjj.exec:\pdpjj.exe97⤵PID:1808
-
\??\c:\fxfflrf.exec:\fxfflrf.exe98⤵PID:2340
-
\??\c:\1fxfffl.exec:\1fxfffl.exe99⤵PID:2216
-
\??\c:\htbtbh.exec:\htbtbh.exe100⤵PID:1596
-
\??\c:\tnbbnn.exec:\tnbbnn.exe101⤵PID:1768
-
\??\c:\dvdjd.exec:\dvdjd.exe102⤵PID:2632
-
\??\c:\jdvpd.exec:\jdvpd.exe103⤵PID:2312
-
\??\c:\7xxffff.exec:\7xxffff.exe104⤵PID:1088
-
\??\c:\7rxxxxx.exec:\7rxxxxx.exe105⤵PID:2308
-
\??\c:\bbthtn.exec:\bbthtn.exe106⤵PID:2944
-
\??\c:\btnttb.exec:\btnttb.exe107⤵PID:1512
-
\??\c:\jdppd.exec:\jdppd.exe108⤵PID:560
-
\??\c:\vvpdv.exec:\vvpdv.exe109⤵PID:712
-
\??\c:\lxlllrx.exec:\lxlllrx.exe110⤵PID:3032
-
\??\c:\ffxlxxf.exec:\ffxlxxf.exe111⤵PID:1356
-
\??\c:\1nbhtb.exec:\1nbhtb.exe112⤵PID:1100
-
\??\c:\jdvvv.exec:\jdvvv.exe113⤵PID:1656
-
\??\c:\jvpjp.exec:\jvpjp.exe114⤵PID:848
-
\??\c:\jdjjp.exec:\jdjjp.exe115⤵PID:1644
-
\??\c:\llflrxf.exec:\llflrxf.exe116⤵PID:2472
-
\??\c:\tnhntt.exec:\tnhntt.exe117⤵PID:2908
-
\??\c:\nbnhhh.exec:\nbnhhh.exe118⤵PID:756
-
\??\c:\nhtttn.exec:\nhtttn.exe119⤵PID:2264
-
\??\c:\pjdvd.exec:\pjdvd.exe120⤵PID:2616
-
\??\c:\9vddj.exec:\9vddj.exe121⤵PID:2300
-
\??\c:\1xxrxxf.exec:\1xxrxxf.exe122⤵PID:2096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-