Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 18:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1198ab6e258aa45e004de731c9b027ed412120cad1b0f3b2d3c52e111a15c317.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
1198ab6e258aa45e004de731c9b027ed412120cad1b0f3b2d3c52e111a15c317.exe
-
Size
460KB
-
MD5
05614c8e267c7d6f56705b58d2d89b2e
-
SHA1
0e7f5fac319def89a96f1439cd749f068afc7c70
-
SHA256
1198ab6e258aa45e004de731c9b027ed412120cad1b0f3b2d3c52e111a15c317
-
SHA512
77b38f29c407e15c3bbd77bdf67c5403c3e6cb7f6d7c0e2f49c2a4d2f468fed9f47a3e4a654a411f8e58d2692046849bd384c86b18215141030627b2bc70cb70
-
SSDEEP
6144:n3C9BRo7tvnJ9Fywhk/TJTaYvMmr3C9BRo7tvnJ9Fywhk/Tkh:n3C9ytvn8whkbJTaFmr3C9ytvn8whkbW
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2196-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1216-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/932-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/688-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/280-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 24 IoCs
resource yara_rule behavioral1/memory/2196-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2196-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2524-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2644-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2584-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2584-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2556-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2576-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2448-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2904-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2904-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2904-95-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2024-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2680-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1672-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1216-149-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/932-167-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1700-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/688-220-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1804-247-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/280-256-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1952-265-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2032-283-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3024-292-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2524 1fxxlfr.exe 3040 frxlxff.exe 2644 xxflxll.exe 2584 bbbtht.exe 2556 xfrfrrr.exe 2576 jvvdj.exe 2448 fxfllfx.exe 2904 jjpjj.exe 2024 nnhthn.exe 2680 vvvjp.exe 2800 xlxxrxf.exe 2392 bhhhnt.exe 1672 rfrllfr.exe 1216 frrflff.exe 2328 vjvdj.exe 932 fxxfxlx.exe 1700 bthbhh.exe 1780 pdpdd.exe 2536 hbbbnh.exe 2796 jvdpd.exe 2276 hbbttb.exe 688 dvjvp.exe 3064 lrfllrl.exe 3016 pppdj.exe 1804 3hhnnb.exe 280 jpvpd.exe 1952 tbbnht.exe 840 rrfllxx.exe 2032 hntnhb.exe 3024 xxffxlr.exe 2108 bbbbbb.exe 2092 ddpjj.exe 1620 bbhhhh.exe 2768 vvppv.exe 2912 jvjjj.exe 2632 lxfrrfl.exe 2592 bhnhnb.exe 2724 vddpj.exe 2748 rrrflrx.exe 2460 hbttht.exe 2664 vvddp.exe 2604 xxlfflr.exe 2896 bhbthb.exe 2916 pjvpj.exe 2488 flrllff.exe 2696 bbntnn.exe 2776 jdppd.exe 2752 lrxlrlx.exe 2332 xlrrfxl.exe 472 hnbbtn.exe 1888 vpjjp.exe 1940 xrrxffl.exe 780 nhnthn.exe 1028 jpppp.exe 552 rxxxrfl.exe 2116 lfflxlf.exe 1556 3bbhtb.exe 2848 jdjvv.exe 2308 rrlxrff.exe 2796 5rxlfff.exe 2276 nntnbh.exe 1100 jjdpp.exe 2956 rlxxfxf.exe 1800 flfrrxx.exe -
resource yara_rule behavioral1/memory/2196-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1216-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/932-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/688-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/280-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-292-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2524 2196 1198ab6e258aa45e004de731c9b027ed412120cad1b0f3b2d3c52e111a15c317.exe 28 PID 2196 wrote to memory of 2524 2196 1198ab6e258aa45e004de731c9b027ed412120cad1b0f3b2d3c52e111a15c317.exe 28 PID 2196 wrote to memory of 2524 2196 1198ab6e258aa45e004de731c9b027ed412120cad1b0f3b2d3c52e111a15c317.exe 28 PID 2196 wrote to memory of 2524 2196 1198ab6e258aa45e004de731c9b027ed412120cad1b0f3b2d3c52e111a15c317.exe 28 PID 2524 wrote to memory of 3040 2524 1fxxlfr.exe 29 PID 2524 wrote to memory of 3040 2524 1fxxlfr.exe 29 PID 2524 wrote to memory of 3040 2524 1fxxlfr.exe 29 PID 2524 wrote to memory of 3040 2524 1fxxlfr.exe 29 PID 3040 wrote to memory of 2644 3040 frxlxff.exe 30 PID 3040 wrote to memory of 2644 3040 frxlxff.exe 30 PID 3040 wrote to memory of 2644 3040 frxlxff.exe 30 PID 3040 wrote to memory of 2644 3040 frxlxff.exe 30 PID 2644 wrote to memory of 2584 2644 xxflxll.exe 31 PID 2644 wrote to memory of 2584 2644 xxflxll.exe 31 PID 2644 wrote to memory of 2584 2644 xxflxll.exe 31 PID 2644 wrote to memory of 2584 2644 xxflxll.exe 31 PID 2584 wrote to memory of 2556 2584 bbbtht.exe 32 PID 2584 wrote to memory of 2556 2584 bbbtht.exe 32 PID 2584 wrote to memory of 2556 2584 bbbtht.exe 32 PID 2584 wrote to memory of 2556 2584 bbbtht.exe 32 PID 2556 wrote to memory of 2576 2556 xfrfrrr.exe 33 PID 2556 wrote to memory of 2576 2556 xfrfrrr.exe 33 PID 2556 wrote to memory of 2576 2556 xfrfrrr.exe 33 PID 2556 wrote to memory of 2576 2556 xfrfrrr.exe 33 PID 2576 wrote to memory of 2448 2576 jvvdj.exe 34 PID 2576 wrote to memory of 2448 2576 jvvdj.exe 34 PID 2576 wrote to memory of 2448 2576 jvvdj.exe 34 PID 2576 wrote to memory of 2448 2576 jvvdj.exe 34 PID 2448 wrote to memory of 2904 2448 fxfllfx.exe 35 PID 2448 wrote to memory of 2904 2448 fxfllfx.exe 35 PID 2448 wrote to memory of 2904 2448 fxfllfx.exe 35 PID 2448 wrote to memory of 2904 2448 fxfllfx.exe 35 PID 2904 wrote to memory of 2024 2904 jjpjj.exe 36 PID 2904 wrote to memory of 2024 2904 jjpjj.exe 36 PID 2904 wrote to memory of 2024 2904 jjpjj.exe 36 PID 2904 wrote to memory of 2024 2904 jjpjj.exe 36 PID 2024 wrote to memory of 2680 2024 nnhthn.exe 37 PID 2024 wrote to memory of 2680 2024 nnhthn.exe 37 PID 2024 wrote to memory of 2680 2024 nnhthn.exe 37 PID 2024 wrote to memory of 2680 2024 nnhthn.exe 37 PID 2680 wrote to memory of 2800 2680 vvvjp.exe 38 PID 2680 wrote to memory of 2800 2680 vvvjp.exe 38 PID 2680 wrote to memory of 2800 2680 vvvjp.exe 38 PID 2680 wrote to memory of 2800 2680 vvvjp.exe 38 PID 2800 wrote to memory of 2392 2800 xlxxrxf.exe 39 PID 2800 wrote to memory of 2392 2800 xlxxrxf.exe 39 PID 2800 wrote to memory of 2392 2800 xlxxrxf.exe 39 PID 2800 wrote to memory of 2392 2800 xlxxrxf.exe 39 PID 2392 wrote to memory of 1672 2392 bhhhnt.exe 40 PID 2392 wrote to memory of 1672 2392 bhhhnt.exe 40 PID 2392 wrote to memory of 1672 2392 bhhhnt.exe 40 PID 2392 wrote to memory of 1672 2392 bhhhnt.exe 40 PID 1672 wrote to memory of 1216 1672 rfrllfr.exe 41 PID 1672 wrote to memory of 1216 1672 rfrllfr.exe 41 PID 1672 wrote to memory of 1216 1672 rfrllfr.exe 41 PID 1672 wrote to memory of 1216 1672 rfrllfr.exe 41 PID 1216 wrote to memory of 2328 1216 frrflff.exe 42 PID 1216 wrote to memory of 2328 1216 frrflff.exe 42 PID 1216 wrote to memory of 2328 1216 frrflff.exe 42 PID 1216 wrote to memory of 2328 1216 frrflff.exe 42 PID 2328 wrote to memory of 932 2328 vjvdj.exe 43 PID 2328 wrote to memory of 932 2328 vjvdj.exe 43 PID 2328 wrote to memory of 932 2328 vjvdj.exe 43 PID 2328 wrote to memory of 932 2328 vjvdj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1198ab6e258aa45e004de731c9b027ed412120cad1b0f3b2d3c52e111a15c317.exe"C:\Users\Admin\AppData\Local\Temp\1198ab6e258aa45e004de731c9b027ed412120cad1b0f3b2d3c52e111a15c317.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\1fxxlfr.exec:\1fxxlfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\frxlxff.exec:\frxlxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\xxflxll.exec:\xxflxll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\bbbtht.exec:\bbbtht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\xfrfrrr.exec:\xfrfrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\jvvdj.exec:\jvvdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\fxfllfx.exec:\fxfllfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\jjpjj.exec:\jjpjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\nnhthn.exec:\nnhthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\vvvjp.exec:\vvvjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\xlxxrxf.exec:\xlxxrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\bhhhnt.exec:\bhhhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\rfrllfr.exec:\rfrllfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\frrflff.exec:\frrflff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\vjvdj.exec:\vjvdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\fxxfxlx.exec:\fxxfxlx.exe17⤵
- Executes dropped EXE
PID:932 -
\??\c:\bthbhh.exec:\bthbhh.exe18⤵
- Executes dropped EXE
PID:1700 -
\??\c:\pdpdd.exec:\pdpdd.exe19⤵
- Executes dropped EXE
PID:1780 -
\??\c:\hbbbnh.exec:\hbbbnh.exe20⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jvdpd.exec:\jvdpd.exe21⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hbbttb.exec:\hbbttb.exe22⤵
- Executes dropped EXE
PID:2276 -
\??\c:\dvjvp.exec:\dvjvp.exe23⤵
- Executes dropped EXE
PID:688 -
\??\c:\lrfllrl.exec:\lrfllrl.exe24⤵
- Executes dropped EXE
PID:3064 -
\??\c:\pppdj.exec:\pppdj.exe25⤵
- Executes dropped EXE
PID:3016 -
\??\c:\3hhnnb.exec:\3hhnnb.exe26⤵
- Executes dropped EXE
PID:1804 -
\??\c:\jpvpd.exec:\jpvpd.exe27⤵
- Executes dropped EXE
PID:280 -
\??\c:\tbbnht.exec:\tbbnht.exe28⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rrfllxx.exec:\rrfllxx.exe29⤵
- Executes dropped EXE
PID:840 -
\??\c:\hntnhb.exec:\hntnhb.exe30⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xxffxlr.exec:\xxffxlr.exe31⤵
- Executes dropped EXE
PID:3024 -
\??\c:\bbbbbb.exec:\bbbbbb.exe32⤵
- Executes dropped EXE
PID:2108 -
\??\c:\ddpjj.exec:\ddpjj.exe33⤵
- Executes dropped EXE
PID:2092 -
\??\c:\bbhhhh.exec:\bbhhhh.exe34⤵
- Executes dropped EXE
PID:1620 -
\??\c:\vvppv.exec:\vvppv.exe35⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jvjjj.exec:\jvjjj.exe36⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lxfrrfl.exec:\lxfrrfl.exe37⤵
- Executes dropped EXE
PID:2632 -
\??\c:\bhnhnb.exec:\bhnhnb.exe38⤵
- Executes dropped EXE
PID:2592 -
\??\c:\vddpj.exec:\vddpj.exe39⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rrrflrx.exec:\rrrflrx.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\hbttht.exec:\hbttht.exe41⤵
- Executes dropped EXE
PID:2460 -
\??\c:\vvddp.exec:\vvddp.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\xxlfflr.exec:\xxlfflr.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\bhbthb.exec:\bhbthb.exe44⤵
- Executes dropped EXE
PID:2896 -
\??\c:\pjvpj.exec:\pjvpj.exe45⤵
- Executes dropped EXE
PID:2916 -
\??\c:\flrllff.exec:\flrllff.exe46⤵
- Executes dropped EXE
PID:2488 -
\??\c:\bbntnn.exec:\bbntnn.exe47⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jdppd.exec:\jdppd.exe48⤵
- Executes dropped EXE
PID:2776 -
\??\c:\lrxlrlx.exec:\lrxlrlx.exe49⤵
- Executes dropped EXE
PID:2752 -
\??\c:\xlrrfxl.exec:\xlrrfxl.exe50⤵
- Executes dropped EXE
PID:2332 -
\??\c:\hnbbtn.exec:\hnbbtn.exe51⤵
- Executes dropped EXE
PID:472 -
\??\c:\vpjjp.exec:\vpjjp.exe52⤵
- Executes dropped EXE
PID:1888 -
\??\c:\xrrxffl.exec:\xrrxffl.exe53⤵
- Executes dropped EXE
PID:1940 -
\??\c:\nhnthn.exec:\nhnthn.exe54⤵
- Executes dropped EXE
PID:780 -
\??\c:\jpppp.exec:\jpppp.exe55⤵
- Executes dropped EXE
PID:1028 -
\??\c:\rxxxrfl.exec:\rxxxrfl.exe56⤵
- Executes dropped EXE
PID:552 -
\??\c:\lfflxlf.exec:\lfflxlf.exe57⤵
- Executes dropped EXE
PID:2116 -
\??\c:\3bbhtb.exec:\3bbhtb.exe58⤵
- Executes dropped EXE
PID:1556 -
\??\c:\jdjvv.exec:\jdjvv.exe59⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rrlxrff.exec:\rrlxrff.exe60⤵
- Executes dropped EXE
PID:2308 -
\??\c:\5rxlfff.exec:\5rxlfff.exe61⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nntnbh.exec:\nntnbh.exe62⤵
- Executes dropped EXE
PID:2276 -
\??\c:\jjdpp.exec:\jjdpp.exe63⤵
- Executes dropped EXE
PID:1100 -
\??\c:\rlxxfxf.exec:\rlxxfxf.exe64⤵
- Executes dropped EXE
PID:2956 -
\??\c:\flfrrxx.exec:\flfrrxx.exe65⤵
- Executes dropped EXE
PID:1800 -
\??\c:\hbnnnn.exec:\hbnnnn.exe66⤵PID:1760
-
\??\c:\vjvvj.exec:\vjvvj.exe67⤵PID:1564
-
\??\c:\rxxlffx.exec:\rxxlffx.exe68⤵PID:1916
-
\??\c:\hnbbhn.exec:\hnbbhn.exe69⤵PID:960
-
\??\c:\pvpvp.exec:\pvpvp.exe70⤵PID:2260
-
\??\c:\vjjdd.exec:\vjjdd.exe71⤵PID:2160
-
\??\c:\xxflxxr.exec:\xxflxxr.exe72⤵PID:1252
-
\??\c:\7thbht.exec:\7thbht.exe73⤵PID:2076
-
\??\c:\vjdvv.exec:\vjdvv.exe74⤵PID:2868
-
\??\c:\5rxrxxf.exec:\5rxrxxf.exe75⤵PID:2196
-
\??\c:\bthbhn.exec:\bthbhn.exe76⤵PID:1624
-
\??\c:\djdvv.exec:\djdvv.exe77⤵PID:2828
-
\??\c:\lfxrllf.exec:\lfxrllf.exe78⤵PID:2544
-
\??\c:\5xlrxxf.exec:\5xlrxxf.exe79⤵PID:2736
-
\??\c:\hnnnnh.exec:\hnnnnh.exe80⤵PID:2548
-
\??\c:\vdpdd.exec:\vdpdd.exe81⤵PID:2728
-
\??\c:\5lxxxfl.exec:\5lxxxfl.exe82⤵PID:2472
-
\??\c:\hbbtnt.exec:\hbbtnt.exe83⤵PID:2480
-
\??\c:\htnbtb.exec:\htnbtb.exe84⤵PID:2740
-
\??\c:\djjvp.exec:\djjvp.exe85⤵PID:2492
-
\??\c:\lfflfrl.exec:\lfflfrl.exe86⤵PID:2608
-
\??\c:\nbhbtn.exec:\nbhbtn.exe87⤵PID:2220
-
\??\c:\dvdjj.exec:\dvdjj.exe88⤵PID:2700
-
\??\c:\9fxxrrx.exec:\9fxxrrx.exe89⤵PID:2024
-
\??\c:\htbhbh.exec:\htbhbh.exe90⤵PID:2688
-
\??\c:\tnnhnh.exec:\tnnhnh.exe91⤵PID:2780
-
\??\c:\7vpjp.exec:\7vpjp.exe92⤵PID:2012
-
\??\c:\vpdvd.exec:\vpdvd.exe93⤵PID:2392
-
\??\c:\xrrxllf.exec:\xrrxllf.exe94⤵PID:1972
-
\??\c:\hhbnhn.exec:\hhbnhn.exe95⤵PID:1888
-
\??\c:\vvpdd.exec:\vvpdd.exe96⤵PID:1060
-
\??\c:\ppjpd.exec:\ppjpd.exe97⤵PID:2940
-
\??\c:\fxxllfx.exec:\fxxllfx.exe98⤵PID:1704
-
\??\c:\bbtbbn.exec:\bbtbbn.exe99⤵PID:2304
-
\??\c:\jjpjd.exec:\jjpjd.exe100⤵PID:2300
-
\??\c:\xrlrxrl.exec:\xrlrxrl.exe101⤵PID:2536
-
\??\c:\flxllxf.exec:\flxllxf.exe102⤵PID:2656
-
\??\c:\5tbhbt.exec:\5tbhbt.exe103⤵PID:608
-
\??\c:\pjvdd.exec:\pjvdd.exe104⤵PID:592
-
\??\c:\rlxrxfl.exec:\rlxrxfl.exe105⤵PID:412
-
\??\c:\ttthbn.exec:\ttthbn.exe106⤵PID:1928
-
\??\c:\pvppj.exec:\pvppj.exe107⤵PID:300
-
\??\c:\vvjpv.exec:\vvjpv.exe108⤵PID:1324
-
\??\c:\httbhh.exec:\httbhh.exe109⤵PID:1180
-
\??\c:\9vvdp.exec:\9vvdp.exe110⤵PID:1892
-
\??\c:\5rrrxfr.exec:\5rrrxfr.exe111⤵PID:572
-
\??\c:\rlffxxl.exec:\rlffxxl.exe112⤵PID:2000
-
\??\c:\nhbbhn.exec:\nhbbhn.exe113⤵PID:2060
-
\??\c:\jdjdp.exec:\jdjdp.exe114⤵PID:2168
-
\??\c:\xrrffrx.exec:\xrrffrx.exe115⤵PID:1464
-
\??\c:\bhnhhh.exec:\bhnhhh.exe116⤵PID:2144
-
\??\c:\pjdvj.exec:\pjdvj.exe117⤵PID:1628
-
\??\c:\lfxxfrf.exec:\lfxxfrf.exe118⤵PID:1632
-
\??\c:\hbntbt.exec:\hbntbt.exe119⤵PID:2384
-
\??\c:\9pvpp.exec:\9pvpp.exe120⤵PID:2716
-
\??\c:\dddvp.exec:\dddvp.exe121⤵PID:2636
-
\??\c:\xlxrxrr.exec:\xlxrxrr.exe122⤵PID:2592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-