Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 03:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dda15f82aadc4edac833dd32fd66d2b9dac10a34e21b918c4d8d937b01a836e6.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
dda15f82aadc4edac833dd32fd66d2b9dac10a34e21b918c4d8d937b01a836e6.exe
-
Size
67KB
-
MD5
a80e634de8e51a464fd354299098f1fd
-
SHA1
494417d36dfe792e50f0bdd44dac8cbc528d61a5
-
SHA256
dda15f82aadc4edac833dd32fd66d2b9dac10a34e21b918c4d8d937b01a836e6
-
SHA512
58e5bdfce3dc88e5b0efbda676b515ae4c881d077abdf8175934444464638a70278ea6ce162b0ad1a82c27f700b22e93038bff6478efc966c120cc34c06f2907
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJUDbAIu:ymb3NkkiQ3mdBjFIFdJ8bG
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/1964-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-83-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1480-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1324-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1260-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/676-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 21 IoCs
resource yara_rule behavioral1/memory/2096-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1964-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2096-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3056-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2688-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2852-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2852-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2852-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2852-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2536-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2500-81-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2952-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2920-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1480-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1520-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1324-173-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1260-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2344-210-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/676-219-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2316-263-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1748-299-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1964 vdvjv.exe 3056 lrxlrlf.exe 2688 ddvvv.exe 2852 lrlxrfr.exe 2704 9hhhtb.exe 2536 jvjjp.exe 2500 xxrfrfr.exe 2952 hbhhnn.exe 1792 9vpvp.exe 2668 lxxlrrf.exe 2920 tbhhhh.exe 1480 jjvjp.exe 1824 7vvpd.exe 1520 xxxlrfr.exe 1672 9nttnt.exe 2476 tnbbtt.exe 1324 ddvvj.exe 1260 lllrlxf.exe 2008 ffffrfx.exe 2468 3tnnhb.exe 2344 dpvdp.exe 676 7dpdp.exe 600 xrxrrrl.exe 1476 bbnntt.exe 1060 ppjvd.exe 548 3dpjp.exe 2316 xlffrlr.exe 1648 hhnnhn.exe 2732 1jdjv.exe 2040 fxlrlrf.exe 1748 ffxflrl.exe 2220 9fffrfx.exe 3040 dvvdj.exe 1972 pvjdv.exe 1984 5llfrxf.exe 2716 1frfrll.exe 3044 nbttbb.exe 2740 bbthnb.exe 2996 dvpvv.exe 2544 djdjp.exe 2520 7rrxlfr.exe 2180 3tnhnb.exe 2356 bnnnnb.exe 2768 pjpjj.exe 1840 jpjjv.exe 2908 frflrfr.exe 1196 hbnhhh.exe 1652 nnbnth.exe 1288 dpvdp.exe 1684 1dvvp.exe 1812 fxlrffl.exe 2556 nhbbnh.exe 1632 3hhbth.exe 1328 ddvvp.exe 2080 3pdjv.exe 2076 rrlrlxx.exe 1716 rrxxrxx.exe 2300 hthhnt.exe 2860 bhtntt.exe 2260 pppdv.exe 676 xxlxffl.exe 1092 rfxxffl.exe 2028 thntbh.exe 2244 tbhbbt.exe -
resource yara_rule behavioral1/memory/2096-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1480-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1324-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1260-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/676-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2096 wrote to memory of 1964 2096 dda15f82aadc4edac833dd32fd66d2b9dac10a34e21b918c4d8d937b01a836e6.exe 28 PID 2096 wrote to memory of 1964 2096 dda15f82aadc4edac833dd32fd66d2b9dac10a34e21b918c4d8d937b01a836e6.exe 28 PID 2096 wrote to memory of 1964 2096 dda15f82aadc4edac833dd32fd66d2b9dac10a34e21b918c4d8d937b01a836e6.exe 28 PID 2096 wrote to memory of 1964 2096 dda15f82aadc4edac833dd32fd66d2b9dac10a34e21b918c4d8d937b01a836e6.exe 28 PID 1964 wrote to memory of 3056 1964 vdvjv.exe 29 PID 1964 wrote to memory of 3056 1964 vdvjv.exe 29 PID 1964 wrote to memory of 3056 1964 vdvjv.exe 29 PID 1964 wrote to memory of 3056 1964 vdvjv.exe 29 PID 3056 wrote to memory of 2688 3056 lrxlrlf.exe 30 PID 3056 wrote to memory of 2688 3056 lrxlrlf.exe 30 PID 3056 wrote to memory of 2688 3056 lrxlrlf.exe 30 PID 3056 wrote to memory of 2688 3056 lrxlrlf.exe 30 PID 2688 wrote to memory of 2852 2688 ddvvv.exe 31 PID 2688 wrote to memory of 2852 2688 ddvvv.exe 31 PID 2688 wrote to memory of 2852 2688 ddvvv.exe 31 PID 2688 wrote to memory of 2852 2688 ddvvv.exe 31 PID 2852 wrote to memory of 2704 2852 lrlxrfr.exe 32 PID 2852 wrote to memory of 2704 2852 lrlxrfr.exe 32 PID 2852 wrote to memory of 2704 2852 lrlxrfr.exe 32 PID 2852 wrote to memory of 2704 2852 lrlxrfr.exe 32 PID 2704 wrote to memory of 2536 2704 9hhhtb.exe 33 PID 2704 wrote to memory of 2536 2704 9hhhtb.exe 33 PID 2704 wrote to memory of 2536 2704 9hhhtb.exe 33 PID 2704 wrote to memory of 2536 2704 9hhhtb.exe 33 PID 2536 wrote to memory of 2500 2536 jvjjp.exe 34 PID 2536 wrote to memory of 2500 2536 jvjjp.exe 34 PID 2536 wrote to memory of 2500 2536 jvjjp.exe 34 PID 2536 wrote to memory of 2500 2536 jvjjp.exe 34 PID 2500 wrote to memory of 2952 2500 xxrfrfr.exe 35 PID 2500 wrote to memory of 2952 2500 xxrfrfr.exe 35 PID 2500 wrote to memory of 2952 2500 xxrfrfr.exe 35 PID 2500 wrote to memory of 2952 2500 xxrfrfr.exe 35 PID 2952 wrote to memory of 1792 2952 hbhhnn.exe 36 PID 2952 wrote to memory of 1792 2952 hbhhnn.exe 36 PID 2952 wrote to memory of 1792 2952 hbhhnn.exe 36 PID 2952 wrote to memory of 1792 2952 hbhhnn.exe 36 PID 1792 wrote to memory of 2668 1792 9vpvp.exe 37 PID 1792 wrote to memory of 2668 1792 9vpvp.exe 37 PID 1792 wrote to memory of 2668 1792 9vpvp.exe 37 PID 1792 wrote to memory of 2668 1792 9vpvp.exe 37 PID 2668 wrote to memory of 2920 2668 lxxlrrf.exe 38 PID 2668 wrote to memory of 2920 2668 lxxlrrf.exe 38 PID 2668 wrote to memory of 2920 2668 lxxlrrf.exe 38 PID 2668 wrote to memory of 2920 2668 lxxlrrf.exe 38 PID 2920 wrote to memory of 1480 2920 tbhhhh.exe 39 PID 2920 wrote to memory of 1480 2920 tbhhhh.exe 39 PID 2920 wrote to memory of 1480 2920 tbhhhh.exe 39 PID 2920 wrote to memory of 1480 2920 tbhhhh.exe 39 PID 1480 wrote to memory of 1824 1480 jjvjp.exe 40 PID 1480 wrote to memory of 1824 1480 jjvjp.exe 40 PID 1480 wrote to memory of 1824 1480 jjvjp.exe 40 PID 1480 wrote to memory of 1824 1480 jjvjp.exe 40 PID 1824 wrote to memory of 1520 1824 7vvpd.exe 41 PID 1824 wrote to memory of 1520 1824 7vvpd.exe 41 PID 1824 wrote to memory of 1520 1824 7vvpd.exe 41 PID 1824 wrote to memory of 1520 1824 7vvpd.exe 41 PID 1520 wrote to memory of 1672 1520 xxxlrfr.exe 42 PID 1520 wrote to memory of 1672 1520 xxxlrfr.exe 42 PID 1520 wrote to memory of 1672 1520 xxxlrfr.exe 42 PID 1520 wrote to memory of 1672 1520 xxxlrfr.exe 42 PID 1672 wrote to memory of 2476 1672 9nttnt.exe 43 PID 1672 wrote to memory of 2476 1672 9nttnt.exe 43 PID 1672 wrote to memory of 2476 1672 9nttnt.exe 43 PID 1672 wrote to memory of 2476 1672 9nttnt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\dda15f82aadc4edac833dd32fd66d2b9dac10a34e21b918c4d8d937b01a836e6.exe"C:\Users\Admin\AppData\Local\Temp\dda15f82aadc4edac833dd32fd66d2b9dac10a34e21b918c4d8d937b01a836e6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\vdvjv.exec:\vdvjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\lrxlrlf.exec:\lrxlrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\ddvvv.exec:\ddvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\lrlxrfr.exec:\lrlxrfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\9hhhtb.exec:\9hhhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\jvjjp.exec:\jvjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\xxrfrfr.exec:\xxrfrfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\hbhhnn.exec:\hbhhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\9vpvp.exec:\9vpvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\lxxlrrf.exec:\lxxlrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\tbhhhh.exec:\tbhhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\jjvjp.exec:\jjvjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\7vvpd.exec:\7vvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\xxxlrfr.exec:\xxxlrfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\9nttnt.exec:\9nttnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\tnbbtt.exec:\tnbbtt.exe17⤵
- Executes dropped EXE
PID:2476 -
\??\c:\ddvvj.exec:\ddvvj.exe18⤵
- Executes dropped EXE
PID:1324 -
\??\c:\lllrlxf.exec:\lllrlxf.exe19⤵
- Executes dropped EXE
PID:1260 -
\??\c:\ffffrfx.exec:\ffffrfx.exe20⤵
- Executes dropped EXE
PID:2008 -
\??\c:\3tnnhb.exec:\3tnnhb.exe21⤵
- Executes dropped EXE
PID:2468 -
\??\c:\dpvdp.exec:\dpvdp.exe22⤵
- Executes dropped EXE
PID:2344 -
\??\c:\7dpdp.exec:\7dpdp.exe23⤵
- Executes dropped EXE
PID:676 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe24⤵
- Executes dropped EXE
PID:600 -
\??\c:\bbnntt.exec:\bbnntt.exe25⤵
- Executes dropped EXE
PID:1476 -
\??\c:\ppjvd.exec:\ppjvd.exe26⤵
- Executes dropped EXE
PID:1060 -
\??\c:\3dpjp.exec:\3dpjp.exe27⤵
- Executes dropped EXE
PID:548 -
\??\c:\xlffrlr.exec:\xlffrlr.exe28⤵
- Executes dropped EXE
PID:2316 -
\??\c:\hhnnhn.exec:\hhnnhn.exe29⤵
- Executes dropped EXE
PID:1648 -
\??\c:\1jdjv.exec:\1jdjv.exe30⤵
- Executes dropped EXE
PID:2732 -
\??\c:\fxlrlrf.exec:\fxlrlrf.exe31⤵
- Executes dropped EXE
PID:2040 -
\??\c:\ffxflrl.exec:\ffxflrl.exe32⤵
- Executes dropped EXE
PID:1748 -
\??\c:\9fffrfx.exec:\9fffrfx.exe33⤵
- Executes dropped EXE
PID:2220 -
\??\c:\dvvdj.exec:\dvvdj.exe34⤵
- Executes dropped EXE
PID:3040 -
\??\c:\pvjdv.exec:\pvjdv.exe35⤵
- Executes dropped EXE
PID:1972 -
\??\c:\5llfrxf.exec:\5llfrxf.exe36⤵
- Executes dropped EXE
PID:1984 -
\??\c:\1frfrll.exec:\1frfrll.exe37⤵
- Executes dropped EXE
PID:2716 -
\??\c:\nbttbb.exec:\nbttbb.exe38⤵
- Executes dropped EXE
PID:3044 -
\??\c:\bbthnb.exec:\bbthnb.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dvpvv.exec:\dvpvv.exe40⤵
- Executes dropped EXE
PID:2996 -
\??\c:\djdjp.exec:\djdjp.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\7rrxlfr.exec:\7rrxlfr.exe42⤵
- Executes dropped EXE
PID:2520 -
\??\c:\3tnhnb.exec:\3tnhnb.exe43⤵
- Executes dropped EXE
PID:2180 -
\??\c:\bnnnnb.exec:\bnnnnb.exe44⤵
- Executes dropped EXE
PID:2356 -
\??\c:\pjpjj.exec:\pjpjj.exe45⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jpjjv.exec:\jpjjv.exe46⤵
- Executes dropped EXE
PID:1840 -
\??\c:\frflrfr.exec:\frflrfr.exe47⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hbnhhh.exec:\hbnhhh.exe48⤵
- Executes dropped EXE
PID:1196 -
\??\c:\nnbnth.exec:\nnbnth.exe49⤵
- Executes dropped EXE
PID:1652 -
\??\c:\dpvdp.exec:\dpvdp.exe50⤵
- Executes dropped EXE
PID:1288 -
\??\c:\1dvvp.exec:\1dvvp.exe51⤵
- Executes dropped EXE
PID:1684 -
\??\c:\fxlrffl.exec:\fxlrffl.exe52⤵
- Executes dropped EXE
PID:1812 -
\??\c:\nhbbnh.exec:\nhbbnh.exe53⤵
- Executes dropped EXE
PID:2556 -
\??\c:\3hhbth.exec:\3hhbth.exe54⤵
- Executes dropped EXE
PID:1632 -
\??\c:\ddvvp.exec:\ddvvp.exe55⤵
- Executes dropped EXE
PID:1328 -
\??\c:\3pdjv.exec:\3pdjv.exe56⤵
- Executes dropped EXE
PID:2080 -
\??\c:\rrlrlxx.exec:\rrlrlxx.exe57⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rrxxrxx.exec:\rrxxrxx.exe58⤵
- Executes dropped EXE
PID:1716 -
\??\c:\hthhnt.exec:\hthhnt.exe59⤵
- Executes dropped EXE
PID:2300 -
\??\c:\bhtntt.exec:\bhtntt.exe60⤵
- Executes dropped EXE
PID:2860 -
\??\c:\pppdv.exec:\pppdv.exe61⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xxlxffl.exec:\xxlxffl.exe62⤵
- Executes dropped EXE
PID:676 -
\??\c:\rfxxffl.exec:\rfxxffl.exe63⤵
- Executes dropped EXE
PID:1092 -
\??\c:\thntbh.exec:\thntbh.exe64⤵
- Executes dropped EXE
PID:2028 -
\??\c:\tbhbbt.exec:\tbhbbt.exe65⤵
- Executes dropped EXE
PID:2244 -
\??\c:\pjdjd.exec:\pjdjd.exe66⤵PID:1060
-
\??\c:\lfflrxl.exec:\lfflrxl.exe67⤵PID:768
-
\??\c:\xxrrflx.exec:\xxrrflx.exe68⤵PID:2000
-
\??\c:\nhbbnn.exec:\nhbbnn.exe69⤵PID:1756
-
\??\c:\vjjjp.exec:\vjjjp.exe70⤵PID:2408
-
\??\c:\djpdd.exec:\djpdd.exe71⤵PID:2020
-
\??\c:\frxrrxl.exec:\frxrrxl.exe72⤵PID:2216
-
\??\c:\hhhbhn.exec:\hhhbhn.exe73⤵PID:1748
-
\??\c:\dvjpd.exec:\dvjpd.exe74⤵PID:1280
-
\??\c:\jjdvj.exec:\jjdvj.exe75⤵PID:2580
-
\??\c:\lfrrfxr.exec:\lfrrfxr.exe76⤵PID:2592
-
\??\c:\5nnthh.exec:\5nnthh.exe77⤵PID:2052
-
\??\c:\7ntttt.exec:\7ntttt.exe78⤵PID:2616
-
\??\c:\jjdjv.exec:\jjdjv.exe79⤵PID:2696
-
\??\c:\1xlfrrl.exec:\1xlfrrl.exe80⤵PID:2576
-
\??\c:\5hbhtt.exec:\5hbhtt.exe81⤵PID:2652
-
\??\c:\thtttn.exec:\thtttn.exe82⤵PID:2484
-
\??\c:\pvvpp.exec:\pvvpp.exe83⤵PID:2560
-
\??\c:\pdppd.exec:\pdppd.exe84⤵PID:2320
-
\??\c:\xxrxlfr.exec:\xxrxlfr.exe85⤵PID:2944
-
\??\c:\5nbhnh.exec:\5nbhnh.exe86⤵PID:2588
-
\??\c:\bthnht.exec:\bthnht.exe87⤵PID:2964
-
\??\c:\pjpvv.exec:\pjpvv.exe88⤵PID:1644
-
\??\c:\vpjjp.exec:\vpjjp.exe89⤵PID:1284
-
\??\c:\lfrlrxf.exec:\lfrlrxf.exe90⤵PID:1480
-
\??\c:\lfrxrxr.exec:\lfrxrxr.exe91⤵PID:1696
-
\??\c:\bnbntn.exec:\bnbntn.exe92⤵PID:1660
-
\??\c:\djvdd.exec:\djvdd.exe93⤵PID:2756
-
\??\c:\djdvv.exec:\djdvv.exe94⤵PID:1624
-
\??\c:\3xxfxll.exec:\3xxfxll.exe95⤵PID:1384
-
\??\c:\xrxxlxf.exec:\xrxxlxf.exe96⤵PID:1324
-
\??\c:\bhnnbh.exec:\bhnnbh.exe97⤵PID:1764
-
\??\c:\nhnnbb.exec:\nhnnbb.exe98⤵PID:2472
-
\??\c:\1jvpd.exec:\1jvpd.exe99⤵PID:2148
-
\??\c:\xlrrxxr.exec:\xlrrxxr.exe100⤵PID:2468
-
\??\c:\rlxllrf.exec:\rlxllrf.exe101⤵PID:988
-
\??\c:\bnhhhh.exec:\bnhhhh.exe102⤵PID:1496
-
\??\c:\9hnhnn.exec:\9hnhnn.exe103⤵PID:1072
-
\??\c:\pvjjp.exec:\pvjjp.exe104⤵PID:1880
-
\??\c:\dddpd.exec:\dddpd.exe105⤵PID:448
-
\??\c:\9fxfrxf.exec:\9fxfrxf.exe106⤵PID:316
-
\??\c:\1xlxxlr.exec:\1xlxxlr.exe107⤵PID:328
-
\??\c:\7thnhh.exec:\7thnhh.exe108⤵PID:2400
-
\??\c:\9btbbn.exec:\9btbbn.exe109⤵PID:788
-
\??\c:\ddpdp.exec:\ddpdp.exe110⤵PID:1504
-
\??\c:\xffxrff.exec:\xffxrff.exe111⤵PID:2732
-
\??\c:\5xlfrxr.exec:\5xlfrxr.exe112⤵PID:2044
-
\??\c:\thtbnb.exec:\thtbnb.exe113⤵PID:2840
-
\??\c:\nnhhbh.exec:\nnhhbh.exe114⤵PID:1724
-
\??\c:\vvjvj.exec:\vvjvj.exe115⤵PID:3028
-
\??\c:\pjdjp.exec:\pjdjp.exe116⤵PID:2112
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe117⤵PID:2720
-
\??\c:\rfxxrxf.exec:\rfxxrxf.exe118⤵PID:2496
-
\??\c:\nhnntb.exec:\nhnntb.exe119⤵PID:2744
-
\??\c:\nbthht.exec:\nbthht.exe120⤵PID:2832
-
\??\c:\jpvpv.exec:\jpvpv.exe121⤵PID:2512
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe122⤵PID:2492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-