Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/06/2024, 02:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dc4bad1ed1a84fca94a1d51e0767be48cba058ad13922ab22e16a50afbc4fea0.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
dc4bad1ed1a84fca94a1d51e0767be48cba058ad13922ab22e16a50afbc4fea0.exe
-
Size
84KB
-
MD5
050d66a107476f0c60cc65afe7735220
-
SHA1
d64aded6691ec2b451bb2495f91808af08af1d64
-
SHA256
dc4bad1ed1a84fca94a1d51e0767be48cba058ad13922ab22e16a50afbc4fea0
-
SHA512
4fa995783ddc5484ffca75a6b1b57d9bfb4be5fe5ada2f1ca0e8116e37ea11ad14db8106e052dceb754961e49a45a0e7d30f6cdb80bd8b97cecfb976f1eb2698
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAXPfgr2hKmdbcPi2vK:ymb3NkkiQ3mdBjFo6Pfgy3dbc/K
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2628-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-50-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1448-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1084-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/596-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-1208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2628 tbhnnn.exe 3044 7vdpp.exe 3004 pjdjp.exe 2652 9rllrfl.exe 2572 lfrlfrl.exe 2272 dpddj.exe 2488 xllfxrx.exe 2492 nbhhbb.exe 3028 tbhbbb.exe 1908 jdpdd.exe 1396 3lxxxrx.exe 2184 rlrffxf.exe 2764 hthnnb.exe 1448 nhttnh.exe 2784 pdpvd.exe 2832 lfrflff.exe 1084 xlrrxxf.exe 2964 tbhbth.exe 1740 9jvvv.exe 2240 7jpjp.exe 596 lfllrrr.exe 1352 lfffrxf.exe 1820 btnthn.exe 1536 ddvjv.exe 1316 vjjjp.exe 1148 lxfffff.exe 1704 hhbnbn.exe 1172 1tnthn.exe 2868 jdjpd.exe 2896 rlflxfr.exe 532 fxrxflr.exe 892 1bbttn.exe 1752 htbnhn.exe 3032 dvjpv.exe 2176 jdvjj.exe 2268 lfffffl.exe 2052 fxffrxl.exe 2716 nhnnbt.exe 2712 djppp.exe 2644 vjpvd.exe 2724 fxrxllx.exe 2696 9lrxflf.exe 1672 xlfflxl.exe 2460 ttnhtt.exe 2796 7nhbhh.exe 2492 htttnh.exe 1996 dvjjp.exe 2780 vppvj.exe 2320 ffxxfff.exe 1308 lxllxxf.exe 1460 nthbnh.exe 2688 5bnnth.exe 2800 1pddv.exe 1640 5vdjp.exe 1100 7lrxllr.exe 2932 rfrrxxx.exe 2948 htnhnt.exe 2300 9nnhtt.exe 1876 dddjd.exe 1656 pvjvv.exe 824 9fxrxxf.exe 1636 3frfrfr.exe 108 tnhnbh.exe 2040 9thbbt.exe -
resource yara_rule behavioral1/memory/2628-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1448-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1084-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/596-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-1208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1752 wrote to memory of 2628 1752 dc4bad1ed1a84fca94a1d51e0767be48cba058ad13922ab22e16a50afbc4fea0.exe 28 PID 1752 wrote to memory of 2628 1752 dc4bad1ed1a84fca94a1d51e0767be48cba058ad13922ab22e16a50afbc4fea0.exe 28 PID 1752 wrote to memory of 2628 1752 dc4bad1ed1a84fca94a1d51e0767be48cba058ad13922ab22e16a50afbc4fea0.exe 28 PID 1752 wrote to memory of 2628 1752 dc4bad1ed1a84fca94a1d51e0767be48cba058ad13922ab22e16a50afbc4fea0.exe 28 PID 2628 wrote to memory of 3044 2628 tbhnnn.exe 29 PID 2628 wrote to memory of 3044 2628 tbhnnn.exe 29 PID 2628 wrote to memory of 3044 2628 tbhnnn.exe 29 PID 2628 wrote to memory of 3044 2628 tbhnnn.exe 29 PID 3044 wrote to memory of 3004 3044 7vdpp.exe 30 PID 3044 wrote to memory of 3004 3044 7vdpp.exe 30 PID 3044 wrote to memory of 3004 3044 7vdpp.exe 30 PID 3044 wrote to memory of 3004 3044 7vdpp.exe 30 PID 3004 wrote to memory of 2652 3004 pjdjp.exe 31 PID 3004 wrote to memory of 2652 3004 pjdjp.exe 31 PID 3004 wrote to memory of 2652 3004 pjdjp.exe 31 PID 3004 wrote to memory of 2652 3004 pjdjp.exe 31 PID 2652 wrote to memory of 2572 2652 9rllrfl.exe 32 PID 2652 wrote to memory of 2572 2652 9rllrfl.exe 32 PID 2652 wrote to memory of 2572 2652 9rllrfl.exe 32 PID 2652 wrote to memory of 2572 2652 9rllrfl.exe 32 PID 2572 wrote to memory of 2272 2572 lfrlfrl.exe 33 PID 2572 wrote to memory of 2272 2572 lfrlfrl.exe 33 PID 2572 wrote to memory of 2272 2572 lfrlfrl.exe 33 PID 2572 wrote to memory of 2272 2572 lfrlfrl.exe 33 PID 2272 wrote to memory of 2488 2272 dpddj.exe 34 PID 2272 wrote to memory of 2488 2272 dpddj.exe 34 PID 2272 wrote to memory of 2488 2272 dpddj.exe 34 PID 2272 wrote to memory of 2488 2272 dpddj.exe 34 PID 2488 wrote to memory of 2492 2488 xllfxrx.exe 35 PID 2488 wrote to memory of 2492 2488 xllfxrx.exe 35 PID 2488 wrote to memory of 2492 2488 xllfxrx.exe 35 PID 2488 wrote to memory of 2492 2488 xllfxrx.exe 35 PID 2492 wrote to memory of 3028 2492 nbhhbb.exe 36 PID 2492 wrote to memory of 3028 2492 nbhhbb.exe 36 PID 2492 wrote to memory of 3028 2492 nbhhbb.exe 36 PID 2492 wrote to memory of 3028 2492 nbhhbb.exe 36 PID 3028 wrote to memory of 1908 3028 tbhbbb.exe 37 PID 3028 wrote to memory of 1908 3028 tbhbbb.exe 37 PID 3028 wrote to memory of 1908 3028 tbhbbb.exe 37 PID 3028 wrote to memory of 1908 3028 tbhbbb.exe 37 PID 1908 wrote to memory of 1396 1908 jdpdd.exe 38 PID 1908 wrote to memory of 1396 1908 jdpdd.exe 38 PID 1908 wrote to memory of 1396 1908 jdpdd.exe 38 PID 1908 wrote to memory of 1396 1908 jdpdd.exe 38 PID 1396 wrote to memory of 2184 1396 3lxxxrx.exe 39 PID 1396 wrote to memory of 2184 1396 3lxxxrx.exe 39 PID 1396 wrote to memory of 2184 1396 3lxxxrx.exe 39 PID 1396 wrote to memory of 2184 1396 3lxxxrx.exe 39 PID 2184 wrote to memory of 2764 2184 rlrffxf.exe 40 PID 2184 wrote to memory of 2764 2184 rlrffxf.exe 40 PID 2184 wrote to memory of 2764 2184 rlrffxf.exe 40 PID 2184 wrote to memory of 2764 2184 rlrffxf.exe 40 PID 2764 wrote to memory of 1448 2764 hthnnb.exe 41 PID 2764 wrote to memory of 1448 2764 hthnnb.exe 41 PID 2764 wrote to memory of 1448 2764 hthnnb.exe 41 PID 2764 wrote to memory of 1448 2764 hthnnb.exe 41 PID 1448 wrote to memory of 2784 1448 nhttnh.exe 42 PID 1448 wrote to memory of 2784 1448 nhttnh.exe 42 PID 1448 wrote to memory of 2784 1448 nhttnh.exe 42 PID 1448 wrote to memory of 2784 1448 nhttnh.exe 42 PID 2784 wrote to memory of 2832 2784 pdpvd.exe 43 PID 2784 wrote to memory of 2832 2784 pdpvd.exe 43 PID 2784 wrote to memory of 2832 2784 pdpvd.exe 43 PID 2784 wrote to memory of 2832 2784 pdpvd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc4bad1ed1a84fca94a1d51e0767be48cba058ad13922ab22e16a50afbc4fea0.exe"C:\Users\Admin\AppData\Local\Temp\dc4bad1ed1a84fca94a1d51e0767be48cba058ad13922ab22e16a50afbc4fea0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\tbhnnn.exec:\tbhnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\7vdpp.exec:\7vdpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\pjdjp.exec:\pjdjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\9rllrfl.exec:\9rllrfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\lfrlfrl.exec:\lfrlfrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\dpddj.exec:\dpddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\xllfxrx.exec:\xllfxrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\nbhhbb.exec:\nbhhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\tbhbbb.exec:\tbhbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\jdpdd.exec:\jdpdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\3lxxxrx.exec:\3lxxxrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\rlrffxf.exec:\rlrffxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\hthnnb.exec:\hthnnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\nhttnh.exec:\nhttnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\pdpvd.exec:\pdpvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\lfrflff.exec:\lfrflff.exe17⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xlrrxxf.exec:\xlrrxxf.exe18⤵
- Executes dropped EXE
PID:1084 -
\??\c:\tbhbth.exec:\tbhbth.exe19⤵
- Executes dropped EXE
PID:2964 -
\??\c:\9jvvv.exec:\9jvvv.exe20⤵
- Executes dropped EXE
PID:1740 -
\??\c:\7jpjp.exec:\7jpjp.exe21⤵
- Executes dropped EXE
PID:2240 -
\??\c:\lfllrrr.exec:\lfllrrr.exe22⤵
- Executes dropped EXE
PID:596 -
\??\c:\lfffrxf.exec:\lfffrxf.exe23⤵
- Executes dropped EXE
PID:1352 -
\??\c:\btnthn.exec:\btnthn.exe24⤵
- Executes dropped EXE
PID:1820 -
\??\c:\ddvjv.exec:\ddvjv.exe25⤵
- Executes dropped EXE
PID:1536 -
\??\c:\vjjjp.exec:\vjjjp.exe26⤵
- Executes dropped EXE
PID:1316 -
\??\c:\lxfffff.exec:\lxfffff.exe27⤵
- Executes dropped EXE
PID:1148 -
\??\c:\hhbnbn.exec:\hhbnbn.exe28⤵
- Executes dropped EXE
PID:1704 -
\??\c:\1tnthn.exec:\1tnthn.exe29⤵
- Executes dropped EXE
PID:1172 -
\??\c:\jdjpd.exec:\jdjpd.exe30⤵
- Executes dropped EXE
PID:2868 -
\??\c:\rlflxfr.exec:\rlflxfr.exe31⤵
- Executes dropped EXE
PID:2896 -
\??\c:\fxrxflr.exec:\fxrxflr.exe32⤵
- Executes dropped EXE
PID:532 -
\??\c:\1bbttn.exec:\1bbttn.exe33⤵
- Executes dropped EXE
PID:892 -
\??\c:\htbnhn.exec:\htbnhn.exe34⤵
- Executes dropped EXE
PID:1752 -
\??\c:\dvjpv.exec:\dvjpv.exe35⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jdvjj.exec:\jdvjj.exe36⤵
- Executes dropped EXE
PID:2176 -
\??\c:\lfffffl.exec:\lfffffl.exe37⤵
- Executes dropped EXE
PID:2268 -
\??\c:\fxffrxl.exec:\fxffrxl.exe38⤵
- Executes dropped EXE
PID:2052 -
\??\c:\nhnnbt.exec:\nhnnbt.exe39⤵
- Executes dropped EXE
PID:2716 -
\??\c:\djppp.exec:\djppp.exe40⤵
- Executes dropped EXE
PID:2712 -
\??\c:\vjpvd.exec:\vjpvd.exe41⤵
- Executes dropped EXE
PID:2644 -
\??\c:\fxrxllx.exec:\fxrxllx.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\9lrxflf.exec:\9lrxflf.exe43⤵
- Executes dropped EXE
PID:2696 -
\??\c:\xlfflxl.exec:\xlfflxl.exe44⤵
- Executes dropped EXE
PID:1672 -
\??\c:\ttnhtt.exec:\ttnhtt.exe45⤵
- Executes dropped EXE
PID:2460 -
\??\c:\7nhbhh.exec:\7nhbhh.exe46⤵
- Executes dropped EXE
PID:2796 -
\??\c:\htttnh.exec:\htttnh.exe47⤵
- Executes dropped EXE
PID:2492 -
\??\c:\dvjjp.exec:\dvjjp.exe48⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vppvj.exec:\vppvj.exe49⤵
- Executes dropped EXE
PID:2780 -
\??\c:\ffxxfff.exec:\ffxxfff.exe50⤵
- Executes dropped EXE
PID:2320 -
\??\c:\lxllxxf.exec:\lxllxxf.exe51⤵
- Executes dropped EXE
PID:1308 -
\??\c:\nthbnh.exec:\nthbnh.exe52⤵
- Executes dropped EXE
PID:1460 -
\??\c:\5bnnth.exec:\5bnnth.exe53⤵
- Executes dropped EXE
PID:2688 -
\??\c:\1pddv.exec:\1pddv.exe54⤵
- Executes dropped EXE
PID:2800 -
\??\c:\5vdjp.exec:\5vdjp.exe55⤵
- Executes dropped EXE
PID:1640 -
\??\c:\7lrxllr.exec:\7lrxllr.exe56⤵
- Executes dropped EXE
PID:1100 -
\??\c:\rfrrxxx.exec:\rfrrxxx.exe57⤵
- Executes dropped EXE
PID:2932 -
\??\c:\htnhnt.exec:\htnhnt.exe58⤵
- Executes dropped EXE
PID:2948 -
\??\c:\9nnhtt.exec:\9nnhtt.exe59⤵
- Executes dropped EXE
PID:2300 -
\??\c:\dddjd.exec:\dddjd.exe60⤵
- Executes dropped EXE
PID:1876 -
\??\c:\pvjvv.exec:\pvjvv.exe61⤵
- Executes dropped EXE
PID:1656 -
\??\c:\9fxrxxf.exec:\9fxrxxf.exe62⤵
- Executes dropped EXE
PID:824 -
\??\c:\3frfrfr.exec:\3frfrfr.exe63⤵
- Executes dropped EXE
PID:1636 -
\??\c:\tnhnbh.exec:\tnhnbh.exe64⤵
- Executes dropped EXE
PID:108 -
\??\c:\9thbbt.exec:\9thbbt.exe65⤵
- Executes dropped EXE
PID:2040 -
\??\c:\bbnthn.exec:\bbnthn.exe66⤵PID:844
-
\??\c:\3ppdj.exec:\3ppdj.exe67⤵PID:320
-
\??\c:\3jpdj.exec:\3jpdj.exe68⤵PID:780
-
\??\c:\nnttnn.exec:\nnttnn.exe69⤵PID:1612
-
\??\c:\hbthtn.exec:\hbthtn.exe70⤵PID:916
-
\??\c:\vvjpv.exec:\vvjpv.exe71⤵PID:2260
-
\??\c:\vpddv.exec:\vpddv.exe72⤵PID:2396
-
\??\c:\ffxxlrx.exec:\ffxxlrx.exe73⤵PID:2904
-
\??\c:\9ffrrrf.exec:\9ffrrrf.exe74⤵PID:2896
-
\??\c:\tntthn.exec:\tntthn.exe75⤵PID:1616
-
\??\c:\1bnnnn.exec:\1bnnnn.exe76⤵PID:1892
-
\??\c:\nhttbb.exec:\nhttbb.exe77⤵PID:1580
-
\??\c:\jvpvv.exec:\jvpvv.exe78⤵PID:3008
-
\??\c:\vvjjv.exec:\vvjjv.exe79⤵PID:2152
-
\??\c:\1llrffl.exec:\1llrffl.exe80⤵PID:2576
-
\??\c:\lfxrlrx.exec:\lfxrlrx.exe81⤵PID:2592
-
\??\c:\hthhnb.exec:\hthhnb.exe82⤵PID:2648
-
\??\c:\9tnbbh.exec:\9tnbbh.exe83⤵PID:1732
-
\??\c:\hhttbh.exec:\hhttbh.exe84⤵PID:2664
-
\??\c:\jdppd.exec:\jdppd.exe85⤵PID:2816
-
\??\c:\dvjvj.exec:\dvjvj.exe86⤵PID:2620
-
\??\c:\vpjdp.exec:\vpjdp.exe87⤵PID:2676
-
\??\c:\3lffxfl.exec:\3lffxfl.exe88⤵PID:2568
-
\??\c:\1fxlrxf.exec:\1fxlrxf.exe89⤵PID:2952
-
\??\c:\nhtbhn.exec:\nhtbhn.exe90⤵PID:2228
-
\??\c:\5bnhhn.exec:\5bnhhn.exe91⤵PID:2804
-
\??\c:\dvdpd.exec:\dvdpd.exe92⤵PID:1668
-
\??\c:\9dppv.exec:\9dppv.exe93⤵PID:1396
-
\??\c:\frffrxl.exec:\frffrxl.exe94⤵PID:704
-
\??\c:\ffxllrf.exec:\ffxllrf.exe95⤵PID:1756
-
\??\c:\lffrxfr.exec:\lffrxfr.exe96⤵PID:1068
-
\??\c:\btbnth.exec:\btbnth.exe97⤵PID:2768
-
\??\c:\tnbhnn.exec:\tnbhnn.exe98⤵PID:2784
-
\??\c:\dvjpv.exec:\dvjpv.exe99⤵PID:1048
-
\??\c:\jdddj.exec:\jdddj.exe100⤵PID:2032
-
\??\c:\ffflxxl.exec:\ffflxxl.exe101⤵PID:2284
-
\??\c:\rrfrlxl.exec:\rrfrlxl.exe102⤵PID:3048
-
\??\c:\tnbbtt.exec:\tnbbtt.exe103⤵PID:1888
-
\??\c:\ttbhnn.exec:\ttbhnn.exe104⤵PID:2240
-
\??\c:\9hhtnt.exec:\9hhtnt.exe105⤵PID:884
-
\??\c:\vpdjd.exec:\vpdjd.exe106⤵PID:2428
-
\??\c:\1vpjp.exec:\1vpjp.exe107⤵PID:2544
-
\??\c:\ffflxxr.exec:\ffflxxr.exe108⤵PID:448
-
\??\c:\rrflrrf.exec:\rrflrrf.exe109⤵PID:2292
-
\??\c:\nnbhtt.exec:\nnbhtt.exe110⤵PID:988
-
\??\c:\nnhnhh.exec:\nnhnhh.exe111⤵PID:304
-
\??\c:\tthnth.exec:\tthnth.exe112⤵PID:952
-
\??\c:\ddvdv.exec:\ddvdv.exe113⤵PID:984
-
\??\c:\9pjvd.exec:\9pjvd.exe114⤵PID:2008
-
\??\c:\lxxflxf.exec:\lxxflxf.exe115⤵PID:2260
-
\??\c:\5ffxffr.exec:\5ffxffr.exe116⤵PID:2128
-
\??\c:\5tbhtb.exec:\5tbhtb.exe117⤵PID:1792
-
\??\c:\tnhhhn.exec:\tnhhhn.exe118⤵PID:1976
-
\??\c:\pjddj.exec:\pjddj.exe119⤵PID:892
-
\??\c:\pjvdd.exec:\pjvdd.exe120⤵PID:2528
-
\??\c:\frxxflx.exec:\frxxflx.exe121⤵PID:3032
-
\??\c:\xrfrflr.exec:\xrfrflr.exe122⤵PID:2176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-