Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 23:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
804be22d746b5283009a3f1d2f1b7b9e7b777918be77dae2db7d9460c0608527.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
804be22d746b5283009a3f1d2f1b7b9e7b777918be77dae2db7d9460c0608527.exe
-
Size
393KB
-
MD5
66aec11d1bf222f301c43affc4c05ea3
-
SHA1
e715e421572a511a91c95cc58180bd77821c8f24
-
SHA256
804be22d746b5283009a3f1d2f1b7b9e7b777918be77dae2db7d9460c0608527
-
SHA512
b5b8b6c2e3787d3064c56a923bbcae9155d6cbcd29edd9b129015ca99c17ac0fc7a02abcd44e42a5f3e9f53d177d0bd9f09afa70fc1c53d1d162459bc5deb147
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwOs:n3C9uYA7okVqdKwaO5CVm
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/1212-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1140-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1132-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1532-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/556-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1416-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 23 IoCs
resource yara_rule behavioral1/memory/1212-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2464-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2784-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2656-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2768-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1536-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2540-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2680-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2532-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2688-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2400-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1704-143-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1764-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2988-161-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2148-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2240-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1140-224-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1132-233-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1740-242-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1532-251-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/556-260-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1048-278-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1416-287-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2464 xrxxlrl.exe 2784 dvdpj.exe 2656 nnhhnt.exe 2768 fxlfxfr.exe 1536 jpvdv.exe 2540 rlllrfr.exe 2680 3bnbbb.exe 2532 jjdpd.exe 3004 jvjpd.exe 1860 5vjpp.exe 2812 hbbnhh.exe 2688 vpjpd.exe 2400 lrfxxxx.exe 1704 nnnbnn.exe 1764 rrffllx.exe 2988 jpdpd.exe 2148 3xrxxlx.exe 2608 jvdjp.exe 2240 hnhbnh.exe 2228 5frrxxx.exe 1012 5ttnnh.exe 2000 vpppp.exe 1140 nbhtnt.exe 1132 jdvvp.exe 1740 tnhnbh.exe 1532 3jdpd.exe 556 nnbnbh.exe 1612 vvppj.exe 1048 hnhnht.exe 1416 bttbnt.exe 628 xrffrxr.exe 2256 7dvvd.exe 2288 ffrrrlr.exe 1688 9bntbt.exe 2156 pvjdp.exe 856 9lxxflr.exe 2116 flxlxlx.exe 2784 9hbntn.exe 2640 pdvjp.exe 2644 rxxxfrx.exe 2672 ttthth.exe 2536 btbthn.exe 2560 djjvj.exe 2524 lrrxrfr.exe 2436 bhtnth.exe 2428 vpvjd.exe 2336 1ppdv.exe 2696 lfxrfrl.exe 2820 hhbnbn.exe 2800 vpjpj.exe 1968 3lfflrr.exe 2400 xxflxlr.exe 756 tbttbt.exe 1748 jdvdp.exe 236 3flrlxr.exe 2988 thhtnb.exe 3032 hthbnn.exe 2064 pppdp.exe 2016 7rlrxxl.exe 484 3hbbnb.exe 1468 bbbnbb.exe 1012 vpdjv.exe 1516 fxlrxxl.exe 1484 xrxxflx.exe -
resource yara_rule behavioral1/memory/1212-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1140-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1132-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1532-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/556-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1416-287-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1212 wrote to memory of 2464 1212 804be22d746b5283009a3f1d2f1b7b9e7b777918be77dae2db7d9460c0608527.exe 28 PID 1212 wrote to memory of 2464 1212 804be22d746b5283009a3f1d2f1b7b9e7b777918be77dae2db7d9460c0608527.exe 28 PID 1212 wrote to memory of 2464 1212 804be22d746b5283009a3f1d2f1b7b9e7b777918be77dae2db7d9460c0608527.exe 28 PID 1212 wrote to memory of 2464 1212 804be22d746b5283009a3f1d2f1b7b9e7b777918be77dae2db7d9460c0608527.exe 28 PID 2464 wrote to memory of 2784 2464 xrxxlrl.exe 29 PID 2464 wrote to memory of 2784 2464 xrxxlrl.exe 29 PID 2464 wrote to memory of 2784 2464 xrxxlrl.exe 29 PID 2464 wrote to memory of 2784 2464 xrxxlrl.exe 29 PID 2784 wrote to memory of 2656 2784 dvdpj.exe 30 PID 2784 wrote to memory of 2656 2784 dvdpj.exe 30 PID 2784 wrote to memory of 2656 2784 dvdpj.exe 30 PID 2784 wrote to memory of 2656 2784 dvdpj.exe 30 PID 2656 wrote to memory of 2768 2656 nnhhnt.exe 31 PID 2656 wrote to memory of 2768 2656 nnhhnt.exe 31 PID 2656 wrote to memory of 2768 2656 nnhhnt.exe 31 PID 2656 wrote to memory of 2768 2656 nnhhnt.exe 31 PID 2768 wrote to memory of 1536 2768 fxlfxfr.exe 32 PID 2768 wrote to memory of 1536 2768 fxlfxfr.exe 32 PID 2768 wrote to memory of 1536 2768 fxlfxfr.exe 32 PID 2768 wrote to memory of 1536 2768 fxlfxfr.exe 32 PID 1536 wrote to memory of 2540 1536 jpvdv.exe 33 PID 1536 wrote to memory of 2540 1536 jpvdv.exe 33 PID 1536 wrote to memory of 2540 1536 jpvdv.exe 33 PID 1536 wrote to memory of 2540 1536 jpvdv.exe 33 PID 2540 wrote to memory of 2680 2540 rlllrfr.exe 34 PID 2540 wrote to memory of 2680 2540 rlllrfr.exe 34 PID 2540 wrote to memory of 2680 2540 rlllrfr.exe 34 PID 2540 wrote to memory of 2680 2540 rlllrfr.exe 34 PID 2680 wrote to memory of 2532 2680 3bnbbb.exe 35 PID 2680 wrote to memory of 2532 2680 3bnbbb.exe 35 PID 2680 wrote to memory of 2532 2680 3bnbbb.exe 35 PID 2680 wrote to memory of 2532 2680 3bnbbb.exe 35 PID 2532 wrote to memory of 3004 2532 jjdpd.exe 36 PID 2532 wrote to memory of 3004 2532 jjdpd.exe 36 PID 2532 wrote to memory of 3004 2532 jjdpd.exe 36 PID 2532 wrote to memory of 3004 2532 jjdpd.exe 36 PID 3004 wrote to memory of 1860 3004 jvjpd.exe 37 PID 3004 wrote to memory of 1860 3004 jvjpd.exe 37 PID 3004 wrote to memory of 1860 3004 jvjpd.exe 37 PID 3004 wrote to memory of 1860 3004 jvjpd.exe 37 PID 1860 wrote to memory of 2812 1860 5vjpp.exe 38 PID 1860 wrote to memory of 2812 1860 5vjpp.exe 38 PID 1860 wrote to memory of 2812 1860 5vjpp.exe 38 PID 1860 wrote to memory of 2812 1860 5vjpp.exe 38 PID 2812 wrote to memory of 2688 2812 hbbnhh.exe 39 PID 2812 wrote to memory of 2688 2812 hbbnhh.exe 39 PID 2812 wrote to memory of 2688 2812 hbbnhh.exe 39 PID 2812 wrote to memory of 2688 2812 hbbnhh.exe 39 PID 2688 wrote to memory of 2400 2688 vpjpd.exe 40 PID 2688 wrote to memory of 2400 2688 vpjpd.exe 40 PID 2688 wrote to memory of 2400 2688 vpjpd.exe 40 PID 2688 wrote to memory of 2400 2688 vpjpd.exe 40 PID 2400 wrote to memory of 1704 2400 lrfxxxx.exe 41 PID 2400 wrote to memory of 1704 2400 lrfxxxx.exe 41 PID 2400 wrote to memory of 1704 2400 lrfxxxx.exe 41 PID 2400 wrote to memory of 1704 2400 lrfxxxx.exe 41 PID 1704 wrote to memory of 1764 1704 nnnbnn.exe 42 PID 1704 wrote to memory of 1764 1704 nnnbnn.exe 42 PID 1704 wrote to memory of 1764 1704 nnnbnn.exe 42 PID 1704 wrote to memory of 1764 1704 nnnbnn.exe 42 PID 1764 wrote to memory of 2988 1764 rrffllx.exe 43 PID 1764 wrote to memory of 2988 1764 rrffllx.exe 43 PID 1764 wrote to memory of 2988 1764 rrffllx.exe 43 PID 1764 wrote to memory of 2988 1764 rrffllx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\804be22d746b5283009a3f1d2f1b7b9e7b777918be77dae2db7d9460c0608527.exe"C:\Users\Admin\AppData\Local\Temp\804be22d746b5283009a3f1d2f1b7b9e7b777918be77dae2db7d9460c0608527.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\xrxxlrl.exec:\xrxxlrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\dvdpj.exec:\dvdpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\nnhhnt.exec:\nnhhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\fxlfxfr.exec:\fxlfxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\jpvdv.exec:\jpvdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\rlllrfr.exec:\rlllrfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\3bnbbb.exec:\3bnbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\jjdpd.exec:\jjdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jvjpd.exec:\jvjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\5vjpp.exec:\5vjpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\hbbnhh.exec:\hbbnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\vpjpd.exec:\vpjpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\lrfxxxx.exec:\lrfxxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\nnnbnn.exec:\nnnbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\rrffllx.exec:\rrffllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\jpdpd.exec:\jpdpd.exe17⤵
- Executes dropped EXE
PID:2988 -
\??\c:\3xrxxlx.exec:\3xrxxlx.exe18⤵
- Executes dropped EXE
PID:2148 -
\??\c:\jvdjp.exec:\jvdjp.exe19⤵
- Executes dropped EXE
PID:2608 -
\??\c:\hnhbnh.exec:\hnhbnh.exe20⤵
- Executes dropped EXE
PID:2240 -
\??\c:\5frrxxx.exec:\5frrxxx.exe21⤵
- Executes dropped EXE
PID:2228 -
\??\c:\5ttnnh.exec:\5ttnnh.exe22⤵
- Executes dropped EXE
PID:1012 -
\??\c:\vpppp.exec:\vpppp.exe23⤵
- Executes dropped EXE
PID:2000 -
\??\c:\nbhtnt.exec:\nbhtnt.exe24⤵
- Executes dropped EXE
PID:1140 -
\??\c:\jdvvp.exec:\jdvvp.exe25⤵
- Executes dropped EXE
PID:1132 -
\??\c:\tnhnbh.exec:\tnhnbh.exe26⤵
- Executes dropped EXE
PID:1740 -
\??\c:\3jdpd.exec:\3jdpd.exe27⤵
- Executes dropped EXE
PID:1532 -
\??\c:\nnbnbh.exec:\nnbnbh.exe28⤵
- Executes dropped EXE
PID:556 -
\??\c:\vvppj.exec:\vvppj.exe29⤵
- Executes dropped EXE
PID:1612 -
\??\c:\hnhnht.exec:\hnhnht.exe30⤵
- Executes dropped EXE
PID:1048 -
\??\c:\bttbnt.exec:\bttbnt.exe31⤵
- Executes dropped EXE
PID:1416 -
\??\c:\xrffrxr.exec:\xrffrxr.exe32⤵
- Executes dropped EXE
PID:628 -
\??\c:\7dvvd.exec:\7dvvd.exe33⤵
- Executes dropped EXE
PID:2256 -
\??\c:\ffrrrlr.exec:\ffrrrlr.exe34⤵
- Executes dropped EXE
PID:2288 -
\??\c:\9bntbt.exec:\9bntbt.exe35⤵
- Executes dropped EXE
PID:1688 -
\??\c:\pvjdp.exec:\pvjdp.exe36⤵
- Executes dropped EXE
PID:2156 -
\??\c:\9lxxflr.exec:\9lxxflr.exe37⤵
- Executes dropped EXE
PID:856 -
\??\c:\flxlxlx.exec:\flxlxlx.exe38⤵
- Executes dropped EXE
PID:2116 -
\??\c:\9hbntn.exec:\9hbntn.exe39⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pdvjp.exec:\pdvjp.exe40⤵
- Executes dropped EXE
PID:2640 -
\??\c:\rxxxfrx.exec:\rxxxfrx.exe41⤵
- Executes dropped EXE
PID:2644 -
\??\c:\ttthth.exec:\ttthth.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\btbthn.exec:\btbthn.exe43⤵
- Executes dropped EXE
PID:2536 -
\??\c:\djjvj.exec:\djjvj.exe44⤵
- Executes dropped EXE
PID:2560 -
\??\c:\lrrxrfr.exec:\lrrxrfr.exe45⤵
- Executes dropped EXE
PID:2524 -
\??\c:\bhtnth.exec:\bhtnth.exe46⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vpvjd.exec:\vpvjd.exe47⤵
- Executes dropped EXE
PID:2428 -
\??\c:\1ppdv.exec:\1ppdv.exe48⤵
- Executes dropped EXE
PID:2336 -
\??\c:\lfxrfrl.exec:\lfxrfrl.exe49⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hhbnbn.exec:\hhbnbn.exe50⤵
- Executes dropped EXE
PID:2820 -
\??\c:\vpjpj.exec:\vpjpj.exe51⤵
- Executes dropped EXE
PID:2800 -
\??\c:\3lfflrr.exec:\3lfflrr.exe52⤵
- Executes dropped EXE
PID:1968 -
\??\c:\xxflxlr.exec:\xxflxlr.exe53⤵
- Executes dropped EXE
PID:2400 -
\??\c:\tbttbt.exec:\tbttbt.exe54⤵
- Executes dropped EXE
PID:756 -
\??\c:\jdvdp.exec:\jdvdp.exe55⤵
- Executes dropped EXE
PID:1748 -
\??\c:\3flrlxr.exec:\3flrlxr.exe56⤵
- Executes dropped EXE
PID:236 -
\??\c:\thhtnb.exec:\thhtnb.exe57⤵
- Executes dropped EXE
PID:2988 -
\??\c:\hthbnn.exec:\hthbnn.exe58⤵
- Executes dropped EXE
PID:3032 -
\??\c:\pppdp.exec:\pppdp.exe59⤵
- Executes dropped EXE
PID:2064 -
\??\c:\7rlrxxl.exec:\7rlrxxl.exe60⤵
- Executes dropped EXE
PID:2016 -
\??\c:\3hbbnb.exec:\3hbbnb.exe61⤵
- Executes dropped EXE
PID:484 -
\??\c:\bbbnbb.exec:\bbbnbb.exe62⤵
- Executes dropped EXE
PID:1468 -
\??\c:\vpdjv.exec:\vpdjv.exe63⤵
- Executes dropped EXE
PID:1012 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe64⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xrxxflx.exec:\xrxxflx.exe65⤵
- Executes dropped EXE
PID:1484 -
\??\c:\bbbhtb.exec:\bbbhtb.exe66⤵PID:2260
-
\??\c:\ddjvp.exec:\ddjvp.exe67⤵PID:268
-
\??\c:\rlllxll.exec:\rlllxll.exe68⤵PID:1308
-
\??\c:\fxlflll.exec:\fxlflll.exe69⤵PID:1644
-
\??\c:\1tnbhh.exec:\1tnbhh.exe70⤵PID:1952
-
\??\c:\jjjpp.exec:\jjjpp.exe71⤵PID:568
-
\??\c:\fxxlxlr.exec:\fxxlxlr.exe72⤵PID:2956
-
\??\c:\fxlxfrl.exec:\fxlxfrl.exe73⤵PID:2128
-
\??\c:\bbthbh.exec:\bbthbh.exe74⤵PID:1416
-
\??\c:\dvvjv.exec:\dvvjv.exe75⤵PID:1732
-
\??\c:\jddpv.exec:\jddpv.exe76⤵PID:1712
-
\??\c:\rllflxl.exec:\rllflxl.exe77⤵PID:1572
-
\??\c:\7nhhnt.exec:\7nhhnt.exe78⤵PID:1552
-
\??\c:\pjddj.exec:\pjddj.exe79⤵PID:3036
-
\??\c:\ddjdj.exec:\ddjdj.exe80⤵PID:2604
-
\??\c:\ffflxll.exec:\ffflxll.exe81⤵PID:2620
-
\??\c:\3tthth.exec:\3tthth.exe82⤵PID:2732
-
\??\c:\jppvj.exec:\jppvj.exe83⤵PID:2660
-
\??\c:\jvjjj.exec:\jvjjj.exe84⤵PID:2768
-
\??\c:\fllfxlr.exec:\fllfxlr.exe85⤵PID:2760
-
\??\c:\hbbhhn.exec:\hbbhhn.exe86⤵PID:2676
-
\??\c:\djvvd.exec:\djvvd.exe87⤵PID:2516
-
\??\c:\jjdjd.exec:\jjdjd.exe88⤵PID:2588
-
\??\c:\1frxrff.exec:\1frxrff.exe89⤵PID:2544
-
\??\c:\hhbnnb.exec:\hhbnnb.exe90⤵PID:2040
-
\??\c:\pvdvj.exec:\pvdvj.exe91⤵PID:2832
-
\??\c:\1vvjp.exec:\1vvjp.exe92⤵PID:2836
-
\??\c:\xllrflx.exec:\xllrflx.exe93⤵PID:1068
-
\??\c:\htnthn.exec:\htnthn.exe94⤵PID:2688
-
\??\c:\1bbbhn.exec:\1bbbhn.exe95⤵PID:1800
-
\??\c:\9vddd.exec:\9vddd.exe96⤵PID:1848
-
\??\c:\1fxlxfx.exec:\1fxlxfx.exe97⤵PID:1976
-
\??\c:\rxxflrr.exec:\rxxflrr.exe98⤵PID:888
-
\??\c:\nbhbnt.exec:\nbhbnt.exe99⤵PID:1236
-
\??\c:\dddpj.exec:\dddpj.exe100⤵PID:2984
-
\??\c:\ffxlxlf.exec:\ffxlxlf.exe101⤵PID:1920
-
\??\c:\xxrrlxf.exec:\xxrrlxf.exe102⤵PID:2932
-
\??\c:\bbbthn.exec:\bbbthn.exe103⤵PID:536
-
\??\c:\1ppjv.exec:\1ppjv.exe104⤵PID:2228
-
\??\c:\xrrxlrf.exec:\xrrxlrf.exe105⤵PID:3020
-
\??\c:\xxrfxlf.exec:\xxrfxlf.exe106⤵PID:844
-
\??\c:\tnhbnh.exec:\tnhbnh.exe107⤵PID:448
-
\??\c:\djpvd.exec:\djpvd.exe108⤵PID:2160
-
\??\c:\llxrlrl.exec:\llxrlrl.exe109⤵PID:1380
-
\??\c:\rllllxf.exec:\rllllxf.exe110⤵PID:1772
-
\??\c:\lfflrxx.exec:\lfflrxx.exe111⤵PID:1804
-
\??\c:\hhhbnb.exec:\hhhbnb.exe112⤵PID:1932
-
\??\c:\bbbbbb.exec:\bbbbbb.exe113⤵PID:944
-
\??\c:\jvpdj.exec:\jvpdj.exe114⤵PID:2940
-
\??\c:\rrlfrlx.exec:\rrlfrlx.exe115⤵PID:1668
-
\??\c:\9tthht.exec:\9tthht.exe116⤵PID:2184
-
\??\c:\vpjdd.exec:\vpjdd.exe117⤵PID:2368
-
\??\c:\dvpdv.exec:\dvpdv.exe118⤵PID:1588
-
\??\c:\rrrlrlr.exec:\rrrlrlr.exe119⤵PID:1568
-
\??\c:\bhbthn.exec:\bhbthn.exe120⤵PID:1992
-
\??\c:\ddvjv.exec:\ddvjv.exe121⤵PID:1556
-
\??\c:\vvpjv.exec:\vvpjv.exe122⤵PID:2280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-