Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 19:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1c14ddbae36b721c5e1165ac622e65731b7e756075a9168dec666ac0976007e6.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
1c14ddbae36b721c5e1165ac622e65731b7e756075a9168dec666ac0976007e6.exe
-
Size
96KB
-
MD5
737d4f2be92988f2cd2280e52b65a53a
-
SHA1
083778f72a64a345f9dd17be3ddb070d9b011981
-
SHA256
1c14ddbae36b721c5e1165ac622e65731b7e756075a9168dec666ac0976007e6
-
SHA512
de5fecf9abc1ac94598928069c5a9d067ce45186daac3593bfc25c2395a254dd78e22cdebb294034d815993bad72ba8b7cdb8b20f659f14e752d27f12090f0f2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIS7/b9EUeWpEC3alBlwtn8BLnnl:ymb3NkkiQ3mdBjFIi/REUZnKlbnv9
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/3068-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1836-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1552-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1316-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/752-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 23 IoCs
resource yara_rule behavioral1/memory/1836-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3068-6-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1836-21-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2612-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2144-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2688-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2828-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2828-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2828-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2828-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3060-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2540-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2968-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2416-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1552-156-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2620-173-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1316-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2628-245-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1760-254-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2128-263-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/752-272-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2424-281-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2308-290-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1836 ffrflxl.exe 2612 jjpjj.exe 2144 rrlrfrl.exe 2688 bhhbbt.exe 2828 ppvjp.exe 2692 llxffrx.exe 3060 1nhhtt.exe 2540 vpvdj.exe 2992 ffrxlxl.exe 1928 nnbhtb.exe 2968 ddvpd.exe 3012 lllxlrf.exe 2416 fxlxllx.exe 2156 nhbhbh.exe 1552 vvvpj.exe 352 lllflxr.exe 2620 ntntbh.exe 824 bbbnbh.exe 1316 vddjp.exe 2092 lfrxrxf.exe 760 nhbnbb.exe 2056 hbthbn.exe 2112 pdvpv.exe 1620 lrflfxx.exe 2628 7hbhtb.exe 1760 bbntht.exe 2128 xrflrrx.exe 752 nhthtt.exe 2424 5djvp.exe 2308 lrxlffr.exe 2432 hnbbnh.exe 1716 ppjdj.exe 1016 flxfrxl.exe 1272 xxllflf.exe 2420 btnbnt.exe 2040 dvjjv.exe 812 jdpjp.exe 2728 rfrxrrf.exe 2800 ffxrfff.exe 2676 5bntbh.exe 2816 ddvpp.exe 2704 jvjvd.exe 2584 xflrxrf.exe 3060 9lfrlrl.exe 2580 bttthn.exe 2440 1ddjd.exe 2872 ddjdj.exe 3016 5llrxfr.exe 3036 ttnthh.exe 3020 bbhbnn.exe 2232 jjddv.exe 1440 vddpp.exe 2156 lrrlrrx.exe 2632 9lflrxf.exe 380 btnhbt.exe 2776 hhbhth.exe 852 pvvdp.exe 776 rxrfllf.exe 1240 nnhbtn.exe 2512 5hnttb.exe 292 vppjd.exe 2020 vvpjj.exe 1044 3lfxffl.exe 2372 hnttbn.exe -
resource yara_rule behavioral1/memory/1836-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1836-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1316-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/752-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3068 wrote to memory of 1836 3068 1c14ddbae36b721c5e1165ac622e65731b7e756075a9168dec666ac0976007e6.exe 28 PID 3068 wrote to memory of 1836 3068 1c14ddbae36b721c5e1165ac622e65731b7e756075a9168dec666ac0976007e6.exe 28 PID 3068 wrote to memory of 1836 3068 1c14ddbae36b721c5e1165ac622e65731b7e756075a9168dec666ac0976007e6.exe 28 PID 3068 wrote to memory of 1836 3068 1c14ddbae36b721c5e1165ac622e65731b7e756075a9168dec666ac0976007e6.exe 28 PID 1836 wrote to memory of 2612 1836 ffrflxl.exe 29 PID 1836 wrote to memory of 2612 1836 ffrflxl.exe 29 PID 1836 wrote to memory of 2612 1836 ffrflxl.exe 29 PID 1836 wrote to memory of 2612 1836 ffrflxl.exe 29 PID 2612 wrote to memory of 2144 2612 jjpjj.exe 30 PID 2612 wrote to memory of 2144 2612 jjpjj.exe 30 PID 2612 wrote to memory of 2144 2612 jjpjj.exe 30 PID 2612 wrote to memory of 2144 2612 jjpjj.exe 30 PID 2144 wrote to memory of 2688 2144 rrlrfrl.exe 31 PID 2144 wrote to memory of 2688 2144 rrlrfrl.exe 31 PID 2144 wrote to memory of 2688 2144 rrlrfrl.exe 31 PID 2144 wrote to memory of 2688 2144 rrlrfrl.exe 31 PID 2688 wrote to memory of 2828 2688 bhhbbt.exe 32 PID 2688 wrote to memory of 2828 2688 bhhbbt.exe 32 PID 2688 wrote to memory of 2828 2688 bhhbbt.exe 32 PID 2688 wrote to memory of 2828 2688 bhhbbt.exe 32 PID 2828 wrote to memory of 2692 2828 ppvjp.exe 33 PID 2828 wrote to memory of 2692 2828 ppvjp.exe 33 PID 2828 wrote to memory of 2692 2828 ppvjp.exe 33 PID 2828 wrote to memory of 2692 2828 ppvjp.exe 33 PID 2692 wrote to memory of 3060 2692 llxffrx.exe 34 PID 2692 wrote to memory of 3060 2692 llxffrx.exe 34 PID 2692 wrote to memory of 3060 2692 llxffrx.exe 34 PID 2692 wrote to memory of 3060 2692 llxffrx.exe 34 PID 3060 wrote to memory of 2540 3060 1nhhtt.exe 35 PID 3060 wrote to memory of 2540 3060 1nhhtt.exe 35 PID 3060 wrote to memory of 2540 3060 1nhhtt.exe 35 PID 3060 wrote to memory of 2540 3060 1nhhtt.exe 35 PID 2540 wrote to memory of 2992 2540 vpvdj.exe 36 PID 2540 wrote to memory of 2992 2540 vpvdj.exe 36 PID 2540 wrote to memory of 2992 2540 vpvdj.exe 36 PID 2540 wrote to memory of 2992 2540 vpvdj.exe 36 PID 2992 wrote to memory of 1928 2992 ffrxlxl.exe 37 PID 2992 wrote to memory of 1928 2992 ffrxlxl.exe 37 PID 2992 wrote to memory of 1928 2992 ffrxlxl.exe 37 PID 2992 wrote to memory of 1928 2992 ffrxlxl.exe 37 PID 1928 wrote to memory of 2968 1928 nnbhtb.exe 38 PID 1928 wrote to memory of 2968 1928 nnbhtb.exe 38 PID 1928 wrote to memory of 2968 1928 nnbhtb.exe 38 PID 1928 wrote to memory of 2968 1928 nnbhtb.exe 38 PID 2968 wrote to memory of 3012 2968 ddvpd.exe 39 PID 2968 wrote to memory of 3012 2968 ddvpd.exe 39 PID 2968 wrote to memory of 3012 2968 ddvpd.exe 39 PID 2968 wrote to memory of 3012 2968 ddvpd.exe 39 PID 3012 wrote to memory of 2416 3012 lllxlrf.exe 40 PID 3012 wrote to memory of 2416 3012 lllxlrf.exe 40 PID 3012 wrote to memory of 2416 3012 lllxlrf.exe 40 PID 3012 wrote to memory of 2416 3012 lllxlrf.exe 40 PID 2416 wrote to memory of 2156 2416 fxlxllx.exe 41 PID 2416 wrote to memory of 2156 2416 fxlxllx.exe 41 PID 2416 wrote to memory of 2156 2416 fxlxllx.exe 41 PID 2416 wrote to memory of 2156 2416 fxlxllx.exe 41 PID 2156 wrote to memory of 1552 2156 nhbhbh.exe 42 PID 2156 wrote to memory of 1552 2156 nhbhbh.exe 42 PID 2156 wrote to memory of 1552 2156 nhbhbh.exe 42 PID 2156 wrote to memory of 1552 2156 nhbhbh.exe 42 PID 1552 wrote to memory of 352 1552 vvvpj.exe 43 PID 1552 wrote to memory of 352 1552 vvvpj.exe 43 PID 1552 wrote to memory of 352 1552 vvvpj.exe 43 PID 1552 wrote to memory of 352 1552 vvvpj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c14ddbae36b721c5e1165ac622e65731b7e756075a9168dec666ac0976007e6.exe"C:\Users\Admin\AppData\Local\Temp\1c14ddbae36b721c5e1165ac622e65731b7e756075a9168dec666ac0976007e6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\ffrflxl.exec:\ffrflxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\jjpjj.exec:\jjpjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\rrlrfrl.exec:\rrlrfrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\bhhbbt.exec:\bhhbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\ppvjp.exec:\ppvjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\llxffrx.exec:\llxffrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\1nhhtt.exec:\1nhhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\vpvdj.exec:\vpvdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\ffrxlxl.exec:\ffrxlxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\nnbhtb.exec:\nnbhtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\ddvpd.exec:\ddvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\lllxlrf.exec:\lllxlrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\fxlxllx.exec:\fxlxllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\nhbhbh.exec:\nhbhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\vvvpj.exec:\vvvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\lllflxr.exec:\lllflxr.exe17⤵
- Executes dropped EXE
PID:352 -
\??\c:\ntntbh.exec:\ntntbh.exe18⤵
- Executes dropped EXE
PID:2620 -
\??\c:\bbbnbh.exec:\bbbnbh.exe19⤵
- Executes dropped EXE
PID:824 -
\??\c:\vddjp.exec:\vddjp.exe20⤵
- Executes dropped EXE
PID:1316 -
\??\c:\lfrxrxf.exec:\lfrxrxf.exe21⤵
- Executes dropped EXE
PID:2092 -
\??\c:\nhbnbb.exec:\nhbnbb.exe22⤵
- Executes dropped EXE
PID:760 -
\??\c:\hbthbn.exec:\hbthbn.exe23⤵
- Executes dropped EXE
PID:2056 -
\??\c:\pdvpv.exec:\pdvpv.exe24⤵
- Executes dropped EXE
PID:2112 -
\??\c:\lrflfxx.exec:\lrflfxx.exe25⤵
- Executes dropped EXE
PID:1620 -
\??\c:\7hbhtb.exec:\7hbhtb.exe26⤵
- Executes dropped EXE
PID:2628 -
\??\c:\bbntht.exec:\bbntht.exe27⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xrflrrx.exec:\xrflrrx.exe28⤵
- Executes dropped EXE
PID:2128 -
\??\c:\nhthtt.exec:\nhthtt.exe29⤵
- Executes dropped EXE
PID:752 -
\??\c:\5djvp.exec:\5djvp.exe30⤵
- Executes dropped EXE
PID:2424 -
\??\c:\lrxlffr.exec:\lrxlffr.exe31⤵
- Executes dropped EXE
PID:2308 -
\??\c:\hnbbnh.exec:\hnbbnh.exe32⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ppjdj.exec:\ppjdj.exe33⤵
- Executes dropped EXE
PID:1716 -
\??\c:\flxfrxl.exec:\flxfrxl.exe34⤵
- Executes dropped EXE
PID:1016 -
\??\c:\xxllflf.exec:\xxllflf.exe35⤵
- Executes dropped EXE
PID:1272 -
\??\c:\btnbnt.exec:\btnbnt.exe36⤵
- Executes dropped EXE
PID:2420 -
\??\c:\dvjjv.exec:\dvjjv.exe37⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jdpjp.exec:\jdpjp.exe38⤵
- Executes dropped EXE
PID:812 -
\??\c:\rfrxrrf.exec:\rfrxrrf.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\ffxrfff.exec:\ffxrfff.exe40⤵
- Executes dropped EXE
PID:2800 -
\??\c:\5bntbh.exec:\5bntbh.exe41⤵
- Executes dropped EXE
PID:2676 -
\??\c:\ddvpp.exec:\ddvpp.exe42⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jvjvd.exec:\jvjvd.exe43⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xflrxrf.exec:\xflrxrf.exe44⤵
- Executes dropped EXE
PID:2584 -
\??\c:\9lfrlrl.exec:\9lfrlrl.exe45⤵
- Executes dropped EXE
PID:3060 -
\??\c:\bttthn.exec:\bttthn.exe46⤵
- Executes dropped EXE
PID:2580 -
\??\c:\1ddjd.exec:\1ddjd.exe47⤵
- Executes dropped EXE
PID:2440 -
\??\c:\ddjdj.exec:\ddjdj.exe48⤵
- Executes dropped EXE
PID:2872 -
\??\c:\5llrxfr.exec:\5llrxfr.exe49⤵
- Executes dropped EXE
PID:3016 -
\??\c:\ttnthh.exec:\ttnthh.exe50⤵
- Executes dropped EXE
PID:3036 -
\??\c:\bbhbnn.exec:\bbhbnn.exe51⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jjddv.exec:\jjddv.exe52⤵
- Executes dropped EXE
PID:2232 -
\??\c:\vddpp.exec:\vddpp.exe53⤵
- Executes dropped EXE
PID:1440 -
\??\c:\lrrlrrx.exec:\lrrlrrx.exe54⤵
- Executes dropped EXE
PID:2156 -
\??\c:\9lflrxf.exec:\9lflrxf.exe55⤵
- Executes dropped EXE
PID:2632 -
\??\c:\btnhbt.exec:\btnhbt.exe56⤵
- Executes dropped EXE
PID:380 -
\??\c:\hhbhth.exec:\hhbhth.exe57⤵
- Executes dropped EXE
PID:2776 -
\??\c:\pvvdp.exec:\pvvdp.exe58⤵
- Executes dropped EXE
PID:852 -
\??\c:\rxrfllf.exec:\rxrfllf.exe59⤵
- Executes dropped EXE
PID:776 -
\??\c:\nnhbtn.exec:\nnhbtn.exe60⤵
- Executes dropped EXE
PID:1240 -
\??\c:\5hnttb.exec:\5hnttb.exe61⤵
- Executes dropped EXE
PID:2512 -
\??\c:\vppjd.exec:\vppjd.exe62⤵
- Executes dropped EXE
PID:292 -
\??\c:\vvpjj.exec:\vvpjj.exe63⤵
- Executes dropped EXE
PID:2020 -
\??\c:\3lfxffl.exec:\3lfxffl.exe64⤵
- Executes dropped EXE
PID:1044 -
\??\c:\hnttbn.exec:\hnttbn.exe65⤵
- Executes dropped EXE
PID:2372 -
\??\c:\9bbbnb.exec:\9bbbnb.exe66⤵PID:1556
-
\??\c:\jpjvj.exec:\jpjvj.exe67⤵PID:1332
-
\??\c:\vjdpd.exec:\vjdpd.exe68⤵PID:304
-
\??\c:\lfxxrxx.exec:\lfxxrxx.exe69⤵PID:1820
-
\??\c:\fflrlrx.exec:\fflrlrx.exe70⤵PID:556
-
\??\c:\ttttht.exec:\ttttht.exe71⤵PID:1852
-
\??\c:\vvpdd.exec:\vvpdd.exe72⤵PID:2320
-
\??\c:\dpvvv.exec:\dpvvv.exe73⤵PID:2044
-
\??\c:\3lffrxl.exec:\3lffrxl.exe74⤵PID:1532
-
\??\c:\xrlxrrf.exec:\xrlxrrf.exe75⤵PID:2936
-
\??\c:\bhnbhb.exec:\bhnbhb.exe76⤵PID:1716
-
\??\c:\9dppd.exec:\9dppd.exe77⤵PID:1564
-
\??\c:\dvddp.exec:\dvddp.exe78⤵PID:1952
-
\??\c:\llfrllx.exec:\llfrllx.exe79⤵PID:2420
-
\??\c:\xfrfxff.exec:\xfrfxff.exe80⤵PID:2712
-
\??\c:\bbtnbh.exec:\bbtnbh.exe81⤵PID:2612
-
\??\c:\bhtbnt.exec:\bhtbnt.exe82⤵PID:2732
-
\??\c:\ddjvp.exec:\ddjvp.exe83⤵PID:2800
-
\??\c:\ppddj.exec:\ppddj.exe84⤵PID:2824
-
\??\c:\lfxfrxf.exec:\lfxfrxf.exe85⤵PID:2828
-
\??\c:\5nbbnt.exec:\5nbbnt.exe86⤵PID:2860
-
\??\c:\ttbbhh.exec:\ttbbhh.exe87⤵PID:2596
-
\??\c:\1dvjj.exec:\1dvjj.exe88⤵PID:2524
-
\??\c:\5frfxrf.exec:\5frfxrf.exe89⤵PID:2544
-
\??\c:\hhtnbt.exec:\hhtnbt.exe90⤵PID:1948
-
\??\c:\nnhhtt.exec:\nnhhtt.exe91⤵PID:2872
-
\??\c:\djdvj.exec:\djdvj.exe92⤵PID:3008
-
\??\c:\llffllx.exec:\llffllx.exe93⤵PID:3036
-
\??\c:\ffrxrxx.exec:\ffrxrxx.exe94⤵PID:3012
-
\??\c:\bbnnbn.exec:\bbnnbn.exe95⤵PID:2600
-
\??\c:\ttntbh.exec:\ttntbh.exe96⤵PID:800
-
\??\c:\dvvdv.exec:\dvvdv.exe97⤵PID:2156
-
\??\c:\xrflrlr.exec:\xrflrlr.exe98⤵PID:2760
-
\??\c:\rrlrllx.exec:\rrlrllx.exe99⤵PID:380
-
\??\c:\nbbbnh.exec:\nbbbnh.exe100⤵PID:2620
-
\??\c:\vpdvj.exec:\vpdvj.exe101⤵PID:852
-
\??\c:\xxfxflf.exec:\xxfxflf.exe102⤵PID:1752
-
\??\c:\tttntn.exec:\tttntn.exe103⤵PID:2076
-
\??\c:\3ttntt.exec:\3ttntt.exe104⤵PID:1996
-
\??\c:\1dvdv.exec:\1dvdv.exe105⤵PID:760
-
\??\c:\vpvjp.exec:\vpvjp.exe106⤵PID:2244
-
\??\c:\xflflff.exec:\xflflff.exe107⤵PID:1044
-
\??\c:\xrxlffl.exec:\xrxlffl.exe108⤵PID:2372
-
\??\c:\3ttnbn.exec:\3ttnbn.exe109⤵PID:2280
-
\??\c:\hnhnnb.exec:\hnhnnb.exe110⤵PID:1340
-
\??\c:\djpdv.exec:\djpdv.exe111⤵PID:1804
-
\??\c:\jjjpp.exec:\jjjpp.exe112⤵PID:1292
-
\??\c:\xrllrlr.exec:\xrllrlr.exe113⤵PID:1020
-
\??\c:\tnbhtb.exec:\tnbhtb.exe114⤵PID:2428
-
\??\c:\nnnbth.exec:\nnnbth.exe115⤵PID:1648
-
\??\c:\vpdvd.exec:\vpdvd.exe116⤵PID:1992
-
\??\c:\jjvvd.exec:\jjvvd.exe117⤵PID:1788
-
\??\c:\lfxrrfr.exec:\lfxrrfr.exe118⤵PID:1572
-
\??\c:\rlrxflx.exec:\rlrxflx.exe119⤵PID:2460
-
\??\c:\bbnbhh.exec:\bbnbhh.exe120⤵PID:2464
-
\??\c:\nbnnbh.exec:\nbnnbh.exe121⤵PID:1276
-
\??\c:\dvdvp.exec:\dvdvp.exe122⤵PID:2660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-