Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
05/07/2024, 23:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
82af18e0e66e35e29ed364f78b6ca2bf8fbfc590d01426c7b205e7225fdd7c32.exe
Resource
win7-20240705-en
5 signatures
150 seconds
General
-
Target
82af18e0e66e35e29ed364f78b6ca2bf8fbfc590d01426c7b205e7225fdd7c32.exe
-
Size
64KB
-
MD5
efe4ef1cd383c678adf87d2f32ec7abe
-
SHA1
b28dc3f5cb694a1e703f889798357dfd5b14e2d6
-
SHA256
82af18e0e66e35e29ed364f78b6ca2bf8fbfc590d01426c7b205e7225fdd7c32
-
SHA512
18a9d0eaa4da17c95154ab55c5bc91f5b901b9a5f45e634e41dc507c428feed307160d9da3b8e057f1e21948cb3cd24d9c629abfcb885b010a2357807503f968
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvAEaFJL/9X:ymb3NkkiQ3mdBjFIvAvR
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral1/memory/2756-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-70-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/992-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-90-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1200-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/444-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1068-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1488-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2752 3pjjv.exe 2936 hhtbnn.exe 2860 bntbhh.exe 1900 dvjdp.exe 2584 lfffrxl.exe 2236 vvvvd.exe 992 9jpdp.exe 2384 1ffflrf.exe 1200 tnhtbn.exe 2088 3pdjp.exe 1896 ppdjj.exe 444 7ffxflr.exe 2848 fxxlxfx.exe 1068 nnnnbb.exe 2924 ppvjp.exe 592 rrlrxxf.exe 2412 fxxrllf.exe 2228 thtbhn.exe 2268 3jdpv.exe 2416 lfrxlrf.exe 1132 lxrrxxf.exe 1852 9hbtbb.exe 1576 9ttbht.exe 2016 ddpdj.exe 1560 rlfxffl.exe 1488 rlffrfr.exe 328 nbtttn.exe 2288 vvpjv.exe 896 xrffllx.exe 3004 ffrxrfx.exe 2768 nnbbhh.exe 2368 jvvjv.exe 2140 ppppv.exe 2724 xxlrxfl.exe 2884 rlrfllr.exe 2572 1nhhnn.exe 2568 tnhbhn.exe 1940 pjvdj.exe 3020 jvpdp.exe 3028 fxrxfrf.exe 2384 lfxflll.exe 2168 5bbnnn.exe 1268 htbbnn.exe 2640 pjjjp.exe 2040 3pjjv.exe 2304 xlllflx.exe 868 rlrxrrf.exe 1748 hhthnt.exe 1404 5htnth.exe 2960 pjvpv.exe 344 3rxfllr.exe 1252 1lflxfr.exe 1784 hbnntb.exe 1724 nbtbnt.exe 920 dvpvd.exe 1228 vpvjj.exe 2456 1rlrflx.exe 840 fxlxrrf.exe 960 btntht.exe 700 nttnhn.exe 2500 dvpdj.exe 1544 1vdjj.exe 2100 rfxxffl.exe 768 rrrxxfx.exe -
resource yara_rule behavioral1/memory/2756-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/992-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/444-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1068-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-252-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2752 2756 82af18e0e66e35e29ed364f78b6ca2bf8fbfc590d01426c7b205e7225fdd7c32.exe 31 PID 2756 wrote to memory of 2752 2756 82af18e0e66e35e29ed364f78b6ca2bf8fbfc590d01426c7b205e7225fdd7c32.exe 31 PID 2756 wrote to memory of 2752 2756 82af18e0e66e35e29ed364f78b6ca2bf8fbfc590d01426c7b205e7225fdd7c32.exe 31 PID 2756 wrote to memory of 2752 2756 82af18e0e66e35e29ed364f78b6ca2bf8fbfc590d01426c7b205e7225fdd7c32.exe 31 PID 2752 wrote to memory of 2936 2752 3pjjv.exe 32 PID 2752 wrote to memory of 2936 2752 3pjjv.exe 32 PID 2752 wrote to memory of 2936 2752 3pjjv.exe 32 PID 2752 wrote to memory of 2936 2752 3pjjv.exe 32 PID 2936 wrote to memory of 2860 2936 hhtbnn.exe 33 PID 2936 wrote to memory of 2860 2936 hhtbnn.exe 33 PID 2936 wrote to memory of 2860 2936 hhtbnn.exe 33 PID 2936 wrote to memory of 2860 2936 hhtbnn.exe 33 PID 2860 wrote to memory of 1900 2860 bntbhh.exe 34 PID 2860 wrote to memory of 1900 2860 bntbhh.exe 34 PID 2860 wrote to memory of 1900 2860 bntbhh.exe 34 PID 2860 wrote to memory of 1900 2860 bntbhh.exe 34 PID 1900 wrote to memory of 2584 1900 dvjdp.exe 35 PID 1900 wrote to memory of 2584 1900 dvjdp.exe 35 PID 1900 wrote to memory of 2584 1900 dvjdp.exe 35 PID 1900 wrote to memory of 2584 1900 dvjdp.exe 35 PID 2584 wrote to memory of 2236 2584 lfffrxl.exe 36 PID 2584 wrote to memory of 2236 2584 lfffrxl.exe 36 PID 2584 wrote to memory of 2236 2584 lfffrxl.exe 36 PID 2584 wrote to memory of 2236 2584 lfffrxl.exe 36 PID 2236 wrote to memory of 992 2236 vvvvd.exe 37 PID 2236 wrote to memory of 992 2236 vvvvd.exe 37 PID 2236 wrote to memory of 992 2236 vvvvd.exe 37 PID 2236 wrote to memory of 992 2236 vvvvd.exe 37 PID 992 wrote to memory of 2384 992 9jpdp.exe 38 PID 992 wrote to memory of 2384 992 9jpdp.exe 38 PID 992 wrote to memory of 2384 992 9jpdp.exe 38 PID 992 wrote to memory of 2384 992 9jpdp.exe 38 PID 2384 wrote to memory of 1200 2384 1ffflrf.exe 39 PID 2384 wrote to memory of 1200 2384 1ffflrf.exe 39 PID 2384 wrote to memory of 1200 2384 1ffflrf.exe 39 PID 2384 wrote to memory of 1200 2384 1ffflrf.exe 39 PID 1200 wrote to memory of 2088 1200 tnhtbn.exe 40 PID 1200 wrote to memory of 2088 1200 tnhtbn.exe 40 PID 1200 wrote to memory of 2088 1200 tnhtbn.exe 40 PID 1200 wrote to memory of 2088 1200 tnhtbn.exe 40 PID 2088 wrote to memory of 1896 2088 3pdjp.exe 41 PID 2088 wrote to memory of 1896 2088 3pdjp.exe 41 PID 2088 wrote to memory of 1896 2088 3pdjp.exe 41 PID 2088 wrote to memory of 1896 2088 3pdjp.exe 41 PID 1896 wrote to memory of 444 1896 ppdjj.exe 42 PID 1896 wrote to memory of 444 1896 ppdjj.exe 42 PID 1896 wrote to memory of 444 1896 ppdjj.exe 42 PID 1896 wrote to memory of 444 1896 ppdjj.exe 42 PID 444 wrote to memory of 2848 444 7ffxflr.exe 43 PID 444 wrote to memory of 2848 444 7ffxflr.exe 43 PID 444 wrote to memory of 2848 444 7ffxflr.exe 43 PID 444 wrote to memory of 2848 444 7ffxflr.exe 43 PID 2848 wrote to memory of 1068 2848 fxxlxfx.exe 44 PID 2848 wrote to memory of 1068 2848 fxxlxfx.exe 44 PID 2848 wrote to memory of 1068 2848 fxxlxfx.exe 44 PID 2848 wrote to memory of 1068 2848 fxxlxfx.exe 44 PID 1068 wrote to memory of 2924 1068 nnnnbb.exe 45 PID 1068 wrote to memory of 2924 1068 nnnnbb.exe 45 PID 1068 wrote to memory of 2924 1068 nnnnbb.exe 45 PID 1068 wrote to memory of 2924 1068 nnnnbb.exe 45 PID 2924 wrote to memory of 592 2924 ppvjp.exe 46 PID 2924 wrote to memory of 592 2924 ppvjp.exe 46 PID 2924 wrote to memory of 592 2924 ppvjp.exe 46 PID 2924 wrote to memory of 592 2924 ppvjp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\82af18e0e66e35e29ed364f78b6ca2bf8fbfc590d01426c7b205e7225fdd7c32.exe"C:\Users\Admin\AppData\Local\Temp\82af18e0e66e35e29ed364f78b6ca2bf8fbfc590d01426c7b205e7225fdd7c32.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\3pjjv.exec:\3pjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\hhtbnn.exec:\hhtbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\bntbhh.exec:\bntbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\dvjdp.exec:\dvjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\lfffrxl.exec:\lfffrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\vvvvd.exec:\vvvvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\9jpdp.exec:\9jpdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\1ffflrf.exec:\1ffflrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\tnhtbn.exec:\tnhtbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\3pdjp.exec:\3pdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\ppdjj.exec:\ppdjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\7ffxflr.exec:\7ffxflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\fxxlxfx.exec:\fxxlxfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\nnnnbb.exec:\nnnnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\ppvjp.exec:\ppvjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\rrlrxxf.exec:\rrlrxxf.exe17⤵
- Executes dropped EXE
PID:592 -
\??\c:\fxxrllf.exec:\fxxrllf.exe18⤵
- Executes dropped EXE
PID:2412 -
\??\c:\thtbhn.exec:\thtbhn.exe19⤵
- Executes dropped EXE
PID:2228 -
\??\c:\3jdpv.exec:\3jdpv.exe20⤵
- Executes dropped EXE
PID:2268 -
\??\c:\lfrxlrf.exec:\lfrxlrf.exe21⤵
- Executes dropped EXE
PID:2416 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe22⤵
- Executes dropped EXE
PID:1132 -
\??\c:\9hbtbb.exec:\9hbtbb.exe23⤵
- Executes dropped EXE
PID:1852 -
\??\c:\9ttbht.exec:\9ttbht.exe24⤵
- Executes dropped EXE
PID:1576 -
\??\c:\ddpdj.exec:\ddpdj.exe25⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rlfxffl.exec:\rlfxffl.exe26⤵
- Executes dropped EXE
PID:1560 -
\??\c:\rlffrfr.exec:\rlffrfr.exe27⤵
- Executes dropped EXE
PID:1488 -
\??\c:\nbtttn.exec:\nbtttn.exe28⤵
- Executes dropped EXE
PID:328 -
\??\c:\vvpjv.exec:\vvpjv.exe29⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xrffllx.exec:\xrffllx.exe30⤵
- Executes dropped EXE
PID:896 -
\??\c:\ffrxrfx.exec:\ffrxrfx.exe31⤵
- Executes dropped EXE
PID:3004 -
\??\c:\nnbbhh.exec:\nnbbhh.exe32⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jvvjv.exec:\jvvjv.exe33⤵
- Executes dropped EXE
PID:2368 -
\??\c:\ppppv.exec:\ppppv.exe34⤵
- Executes dropped EXE
PID:2140 -
\??\c:\xxlrxfl.exec:\xxlrxfl.exe35⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rlrfllr.exec:\rlrfllr.exe36⤵
- Executes dropped EXE
PID:2884 -
\??\c:\1nhhnn.exec:\1nhhnn.exe37⤵
- Executes dropped EXE
PID:2572 -
\??\c:\tnhbhn.exec:\tnhbhn.exe38⤵
- Executes dropped EXE
PID:2568 -
\??\c:\pjvdj.exec:\pjvdj.exe39⤵
- Executes dropped EXE
PID:1940 -
\??\c:\jvpdp.exec:\jvpdp.exe40⤵
- Executes dropped EXE
PID:3020 -
\??\c:\fxrxfrf.exec:\fxrxfrf.exe41⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lfxflll.exec:\lfxflll.exe42⤵
- Executes dropped EXE
PID:2384 -
\??\c:\5bbnnn.exec:\5bbnnn.exe43⤵
- Executes dropped EXE
PID:2168 -
\??\c:\htbbnn.exec:\htbbnn.exe44⤵
- Executes dropped EXE
PID:1268 -
\??\c:\pjjjp.exec:\pjjjp.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\3pjjv.exec:\3pjjv.exe46⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xlllflx.exec:\xlllflx.exe47⤵
- Executes dropped EXE
PID:2304 -
\??\c:\rlrxrrf.exec:\rlrxrrf.exe48⤵
- Executes dropped EXE
PID:868 -
\??\c:\hhthnt.exec:\hhthnt.exe49⤵
- Executes dropped EXE
PID:1748 -
\??\c:\5htnth.exec:\5htnth.exe50⤵
- Executes dropped EXE
PID:1404 -
\??\c:\pjvpv.exec:\pjvpv.exe51⤵
- Executes dropped EXE
PID:2960 -
\??\c:\3rxfllr.exec:\3rxfllr.exe52⤵
- Executes dropped EXE
PID:344 -
\??\c:\1lflxfr.exec:\1lflxfr.exe53⤵
- Executes dropped EXE
PID:1252 -
\??\c:\hbnntb.exec:\hbnntb.exe54⤵
- Executes dropped EXE
PID:1784 -
\??\c:\nbtbnt.exec:\nbtbnt.exe55⤵
- Executes dropped EXE
PID:1724 -
\??\c:\dvpvd.exec:\dvpvd.exe56⤵
- Executes dropped EXE
PID:920 -
\??\c:\vpvjj.exec:\vpvjj.exe57⤵
- Executes dropped EXE
PID:1228 -
\??\c:\1rlrflx.exec:\1rlrflx.exe58⤵
- Executes dropped EXE
PID:2456 -
\??\c:\fxlxrrf.exec:\fxlxrrf.exe59⤵
- Executes dropped EXE
PID:840 -
\??\c:\btntht.exec:\btntht.exe60⤵
- Executes dropped EXE
PID:960 -
\??\c:\nttnhn.exec:\nttnhn.exe61⤵
- Executes dropped EXE
PID:700 -
\??\c:\dvpdj.exec:\dvpdj.exe62⤵
- Executes dropped EXE
PID:2500 -
\??\c:\1vdjj.exec:\1vdjj.exe63⤵
- Executes dropped EXE
PID:1544 -
\??\c:\rfxxffl.exec:\rfxxffl.exe64⤵
- Executes dropped EXE
PID:2100 -
\??\c:\rrrxxfx.exec:\rrrxxfx.exe65⤵
- Executes dropped EXE
PID:768 -
\??\c:\vpdjp.exec:\vpdjp.exe66⤵PID:1644
-
\??\c:\fxxlxfr.exec:\fxxlxfr.exe67⤵PID:1664
-
\??\c:\fxlxffr.exec:\fxlxffr.exe68⤵PID:864
-
\??\c:\bttbht.exec:\bttbht.exe69⤵PID:2708
-
\??\c:\hbtthh.exec:\hbtthh.exe70⤵PID:3004
-
\??\c:\vvjjv.exec:\vvjjv.exe71⤵PID:2560
-
\??\c:\jvppv.exec:\jvppv.exe72⤵PID:2712
-
\??\c:\5rrxxfl.exec:\5rrxxfl.exe73⤵PID:2936
-
\??\c:\rlflxrx.exec:\rlflxrx.exe74⤵PID:2852
-
\??\c:\nhhthn.exec:\nhhthn.exe75⤵PID:2556
-
\??\c:\nhhhnt.exec:\nhhhnt.exe76⤵PID:1900
-
\??\c:\ppjpd.exec:\ppjpd.exe77⤵PID:3064
-
\??\c:\dvppd.exec:\dvppd.exe78⤵PID:2832
-
\??\c:\fxxxxrx.exec:\fxxxxrx.exe79⤵PID:2000
-
\??\c:\9lfrffr.exec:\9lfrffr.exe80⤵PID:848
-
\??\c:\rlflxxx.exec:\rlflxxx.exe81⤵PID:2648
-
\??\c:\tnnhnt.exec:\tnnhnt.exe82⤵PID:1732
-
\??\c:\nbnnbb.exec:\nbnnbb.exe83⤵PID:2900
-
\??\c:\pjpvv.exec:\pjpvv.exe84⤵PID:1988
-
\??\c:\dvppd.exec:\dvppd.exe85⤵PID:1632
-
\??\c:\1lxflrf.exec:\1lxflrf.exe86⤵PID:2916
-
\??\c:\lxlrrxl.exec:\lxlrrxl.exe87⤵PID:2856
-
\??\c:\hbnntt.exec:\hbnntt.exe88⤵PID:2848
-
\??\c:\thbbtt.exec:\thbbtt.exe89⤵PID:2888
-
\??\c:\jvpvv.exec:\jvpvv.exe90⤵PID:2924
-
\??\c:\jvjjd.exec:\jvjjd.exe91⤵PID:2432
-
\??\c:\9fxlffl.exec:\9fxlffl.exe92⤵PID:2244
-
\??\c:\5xlrrxf.exec:\5xlrrxf.exe93⤵PID:2160
-
\??\c:\thtnbh.exec:\thtnbh.exe94⤵PID:2124
-
\??\c:\bnhnth.exec:\bnhnth.exe95⤵PID:2220
-
\??\c:\vvpvj.exec:\vvpvj.exe96⤵PID:2416
-
\??\c:\vdvjv.exec:\vdvjv.exe97⤵PID:1800
-
\??\c:\fffrrfr.exec:\fffrrfr.exe98⤵PID:1796
-
\??\c:\9lflxxf.exec:\9lflxxf.exe99⤵PID:2528
-
\??\c:\tnbhnb.exec:\tnbhnb.exe100⤵PID:916
-
\??\c:\7thhnn.exec:\7thhnn.exe101⤵PID:1708
-
\??\c:\tnbhtn.exec:\tnbhtn.exe102⤵PID:1564
-
\??\c:\dpjjj.exec:\dpjjj.exe103⤵PID:1432
-
\??\c:\vpdjv.exec:\vpdjv.exe104⤵PID:2636
-
\??\c:\7xrrlrx.exec:\7xrrlrx.exe105⤵PID:2976
-
\??\c:\rrrlflx.exec:\rrrlflx.exe106⤵PID:2680
-
\??\c:\nbbbnb.exec:\nbbbnb.exe107⤵PID:1680
-
\??\c:\nhnnhh.exec:\nhnnhh.exe108⤵PID:2788
-
\??\c:\pdjjj.exec:\pdjjj.exe109⤵PID:2696
-
\??\c:\1jpvd.exec:\1jpvd.exe110⤵PID:2704
-
\??\c:\rllfffr.exec:\rllfffr.exe111⤵PID:1912
-
\??\c:\5xffrxx.exec:\5xffrxx.exe112⤵PID:2804
-
\??\c:\3hbttt.exec:\3hbttt.exe113⤵PID:2608
-
\??\c:\nnnbth.exec:\nnnbth.exe114⤵PID:2860
-
\??\c:\5dpjp.exec:\5dpjp.exe115⤵PID:2492
-
\??\c:\3pvvj.exec:\3pvvj.exe116⤵PID:2584
-
\??\c:\rfrrxfr.exec:\rfrrxfr.exe117⤵PID:1940
-
\??\c:\fxxxrrf.exec:\fxxxrrf.exe118⤵PID:2276
-
\??\c:\7ntbnb.exec:\7ntbnb.exe119⤵PID:3044
-
\??\c:\hbthnn.exec:\hbthnn.exe120⤵PID:2384
-
\??\c:\jvdjp.exec:\jvdjp.exe121⤵PID:2168
-
\??\c:\dvddj.exec:\dvddj.exe122⤵PID:696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-