Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
05-07-2024 08:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
42339071b3834f5cb04d38dddb282f4f17309ee3be98e38514ff3707f8fca940.exe
Resource
win7-20240611-en
windows7-x64
5 signatures
150 seconds
General
-
Target
42339071b3834f5cb04d38dddb282f4f17309ee3be98e38514ff3707f8fca940.exe
-
Size
73KB
-
MD5
0fc08261466da61d4b57a7d9e344ac50
-
SHA1
24a9145bb510b486d544d6442a8cb7ab715fdcc8
-
SHA256
42339071b3834f5cb04d38dddb282f4f17309ee3be98e38514ff3707f8fca940
-
SHA512
16d2ccc42ee2a73159e00fca4aa40490361db34da90e116732aec722a6d9e461a9176daaf9c3001d7cbc97e0870cd9ffbd8ad46ab3cd80790723f1cfb49e6d3c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUwcsbYsGv+:ymb3NkkiQ3mdBjF0yjcsMsA+
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/1176-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1216-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/300-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/684-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/984-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2824 vjvpj.exe 2572 lfllrlr.exe 2728 nhbhnt.exe 2468 5dpjp.exe 2776 rflflll.exe 2636 nbttbt.exe 2480 jvpdd.exe 2940 frrxxrx.exe 1600 thbbtn.exe 1540 vjppv.exe 2036 pjdjv.exe 1216 xrlrxxf.exe 324 7rfxrrl.exe 2436 bhnhbn.exe 300 1jppv.exe 2368 dpddj.exe 628 lllrxfl.exe 2796 9tthnn.exe 684 jddvp.exe 1828 frlrffl.exe 1356 nbhhnt.exe 2216 vdjpp.exe 2872 lrlrrxr.exe 2408 bbtbnh.exe 2156 dvddp.exe 492 rrrxflr.exe 896 hnthnh.exe 708 5ppvp.exe 1620 jvppv.exe 984 3fllrlx.exe 1636 htttth.exe 2116 nbhbbb.exe 2124 vdddj.exe 2920 fxfxfff.exe 2992 ffllrrx.exe 3012 btbntb.exe 2768 bbtttb.exe 2712 jdvpp.exe 2580 xrrrlxf.exe 2832 rrllrrx.exe 2660 hhtnbb.exe 2716 ddppj.exe 2540 pvdpp.exe 2492 fxllllr.exe 1036 xfxlrrf.exe 1528 nhhhnn.exe 2520 nhtttb.exe 1716 pvdpp.exe 1724 djpjj.exe 1580 flxrlfx.exe 2108 ttnbbh.exe 544 hnnhnt.exe 2204 ppjdp.exe 1420 jvvvv.exe 1352 fflrxll.exe 2780 thntnt.exe 2752 tbttbt.exe 524 pvvvp.exe 2440 fxrflrx.exe 2840 tttnnt.exe 1400 bbtthn.exe 1396 djjvj.exe 784 xfrrlll.exe 2320 fflxfxf.exe -
resource yara_rule behavioral1/memory/1176-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1216-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/300-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/684-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/984-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1176 wrote to memory of 2824 1176 42339071b3834f5cb04d38dddb282f4f17309ee3be98e38514ff3707f8fca940.exe 28 PID 1176 wrote to memory of 2824 1176 42339071b3834f5cb04d38dddb282f4f17309ee3be98e38514ff3707f8fca940.exe 28 PID 1176 wrote to memory of 2824 1176 42339071b3834f5cb04d38dddb282f4f17309ee3be98e38514ff3707f8fca940.exe 28 PID 1176 wrote to memory of 2824 1176 42339071b3834f5cb04d38dddb282f4f17309ee3be98e38514ff3707f8fca940.exe 28 PID 2824 wrote to memory of 2572 2824 vjvpj.exe 29 PID 2824 wrote to memory of 2572 2824 vjvpj.exe 29 PID 2824 wrote to memory of 2572 2824 vjvpj.exe 29 PID 2824 wrote to memory of 2572 2824 vjvpj.exe 29 PID 2572 wrote to memory of 2728 2572 lfllrlr.exe 30 PID 2572 wrote to memory of 2728 2572 lfllrlr.exe 30 PID 2572 wrote to memory of 2728 2572 lfllrlr.exe 30 PID 2572 wrote to memory of 2728 2572 lfllrlr.exe 30 PID 2728 wrote to memory of 2468 2728 nhbhnt.exe 31 PID 2728 wrote to memory of 2468 2728 nhbhnt.exe 31 PID 2728 wrote to memory of 2468 2728 nhbhnt.exe 31 PID 2728 wrote to memory of 2468 2728 nhbhnt.exe 31 PID 2468 wrote to memory of 2776 2468 5dpjp.exe 32 PID 2468 wrote to memory of 2776 2468 5dpjp.exe 32 PID 2468 wrote to memory of 2776 2468 5dpjp.exe 32 PID 2468 wrote to memory of 2776 2468 5dpjp.exe 32 PID 2776 wrote to memory of 2636 2776 rflflll.exe 33 PID 2776 wrote to memory of 2636 2776 rflflll.exe 33 PID 2776 wrote to memory of 2636 2776 rflflll.exe 33 PID 2776 wrote to memory of 2636 2776 rflflll.exe 33 PID 2636 wrote to memory of 2480 2636 nbttbt.exe 34 PID 2636 wrote to memory of 2480 2636 nbttbt.exe 34 PID 2636 wrote to memory of 2480 2636 nbttbt.exe 34 PID 2636 wrote to memory of 2480 2636 nbttbt.exe 34 PID 2480 wrote to memory of 2940 2480 jvpdd.exe 35 PID 2480 wrote to memory of 2940 2480 jvpdd.exe 35 PID 2480 wrote to memory of 2940 2480 jvpdd.exe 35 PID 2480 wrote to memory of 2940 2480 jvpdd.exe 35 PID 2940 wrote to memory of 1600 2940 frrxxrx.exe 36 PID 2940 wrote to memory of 1600 2940 frrxxrx.exe 36 PID 2940 wrote to memory of 1600 2940 frrxxrx.exe 36 PID 2940 wrote to memory of 1600 2940 frrxxrx.exe 36 PID 1600 wrote to memory of 1540 1600 thbbtn.exe 37 PID 1600 wrote to memory of 1540 1600 thbbtn.exe 37 PID 1600 wrote to memory of 1540 1600 thbbtn.exe 37 PID 1600 wrote to memory of 1540 1600 thbbtn.exe 37 PID 1540 wrote to memory of 2036 1540 vjppv.exe 38 PID 1540 wrote to memory of 2036 1540 vjppv.exe 38 PID 1540 wrote to memory of 2036 1540 vjppv.exe 38 PID 1540 wrote to memory of 2036 1540 vjppv.exe 38 PID 2036 wrote to memory of 1216 2036 pjdjv.exe 39 PID 2036 wrote to memory of 1216 2036 pjdjv.exe 39 PID 2036 wrote to memory of 1216 2036 pjdjv.exe 39 PID 2036 wrote to memory of 1216 2036 pjdjv.exe 39 PID 1216 wrote to memory of 324 1216 xrlrxxf.exe 40 PID 1216 wrote to memory of 324 1216 xrlrxxf.exe 40 PID 1216 wrote to memory of 324 1216 xrlrxxf.exe 40 PID 1216 wrote to memory of 324 1216 xrlrxxf.exe 40 PID 324 wrote to memory of 2436 324 7rfxrrl.exe 41 PID 324 wrote to memory of 2436 324 7rfxrrl.exe 41 PID 324 wrote to memory of 2436 324 7rfxrrl.exe 41 PID 324 wrote to memory of 2436 324 7rfxrrl.exe 41 PID 2436 wrote to memory of 300 2436 bhnhbn.exe 42 PID 2436 wrote to memory of 300 2436 bhnhbn.exe 42 PID 2436 wrote to memory of 300 2436 bhnhbn.exe 42 PID 2436 wrote to memory of 300 2436 bhnhbn.exe 42 PID 300 wrote to memory of 2368 300 1jppv.exe 43 PID 300 wrote to memory of 2368 300 1jppv.exe 43 PID 300 wrote to memory of 2368 300 1jppv.exe 43 PID 300 wrote to memory of 2368 300 1jppv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\42339071b3834f5cb04d38dddb282f4f17309ee3be98e38514ff3707f8fca940.exe"C:\Users\Admin\AppData\Local\Temp\42339071b3834f5cb04d38dddb282f4f17309ee3be98e38514ff3707f8fca940.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\vjvpj.exec:\vjvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\lfllrlr.exec:\lfllrlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\nhbhnt.exec:\nhbhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\5dpjp.exec:\5dpjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\rflflll.exec:\rflflll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\nbttbt.exec:\nbttbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\jvpdd.exec:\jvpdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\frrxxrx.exec:\frrxxrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\thbbtn.exec:\thbbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\vjppv.exec:\vjppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\pjdjv.exec:\pjdjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\xrlrxxf.exec:\xrlrxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\7rfxrrl.exec:\7rfxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\bhnhbn.exec:\bhnhbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\1jppv.exec:\1jppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
\??\c:\dpddj.exec:\dpddj.exe17⤵
- Executes dropped EXE
PID:2368 -
\??\c:\lllrxfl.exec:\lllrxfl.exe18⤵
- Executes dropped EXE
PID:628 -
\??\c:\9tthnn.exec:\9tthnn.exe19⤵
- Executes dropped EXE
PID:2796 -
\??\c:\jddvp.exec:\jddvp.exe20⤵
- Executes dropped EXE
PID:684 -
\??\c:\frlrffl.exec:\frlrffl.exe21⤵
- Executes dropped EXE
PID:1828 -
\??\c:\nbhhnt.exec:\nbhhnt.exe22⤵
- Executes dropped EXE
PID:1356 -
\??\c:\vdjpp.exec:\vdjpp.exe23⤵
- Executes dropped EXE
PID:2216 -
\??\c:\lrlrrxr.exec:\lrlrrxr.exe24⤵
- Executes dropped EXE
PID:2872 -
\??\c:\bbtbnh.exec:\bbtbnh.exe25⤵
- Executes dropped EXE
PID:2408 -
\??\c:\dvddp.exec:\dvddp.exe26⤵
- Executes dropped EXE
PID:2156 -
\??\c:\rrrxflr.exec:\rrrxflr.exe27⤵
- Executes dropped EXE
PID:492 -
\??\c:\hnthnh.exec:\hnthnh.exe28⤵
- Executes dropped EXE
PID:896 -
\??\c:\5ppvp.exec:\5ppvp.exe29⤵
- Executes dropped EXE
PID:708 -
\??\c:\jvppv.exec:\jvppv.exe30⤵
- Executes dropped EXE
PID:1620 -
\??\c:\3fllrlx.exec:\3fllrlx.exe31⤵
- Executes dropped EXE
PID:984 -
\??\c:\htttth.exec:\htttth.exe32⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nbhbbb.exec:\nbhbbb.exe33⤵
- Executes dropped EXE
PID:2116 -
\??\c:\vdddj.exec:\vdddj.exe34⤵
- Executes dropped EXE
PID:2124 -
\??\c:\fxfxfff.exec:\fxfxfff.exe35⤵
- Executes dropped EXE
PID:2920 -
\??\c:\ffllrrx.exec:\ffllrrx.exe36⤵
- Executes dropped EXE
PID:2992 -
\??\c:\btbntb.exec:\btbntb.exe37⤵
- Executes dropped EXE
PID:3012 -
\??\c:\bbtttb.exec:\bbtttb.exe38⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jdvpp.exec:\jdvpp.exe39⤵
- Executes dropped EXE
PID:2712 -
\??\c:\xrrrlxf.exec:\xrrrlxf.exe40⤵
- Executes dropped EXE
PID:2580 -
\??\c:\rrllrrx.exec:\rrllrrx.exe41⤵
- Executes dropped EXE
PID:2832 -
\??\c:\hhtnbb.exec:\hhtnbb.exe42⤵
- Executes dropped EXE
PID:2660 -
\??\c:\ddppj.exec:\ddppj.exe43⤵
- Executes dropped EXE
PID:2716 -
\??\c:\pvdpp.exec:\pvdpp.exe44⤵
- Executes dropped EXE
PID:2540 -
\??\c:\fxllllr.exec:\fxllllr.exe45⤵
- Executes dropped EXE
PID:2492 -
\??\c:\xfxlrrf.exec:\xfxlrrf.exe46⤵
- Executes dropped EXE
PID:1036 -
\??\c:\nhhhnn.exec:\nhhhnn.exe47⤵
- Executes dropped EXE
PID:1528 -
\??\c:\nhtttb.exec:\nhtttb.exe48⤵
- Executes dropped EXE
PID:2520 -
\??\c:\pvdpp.exec:\pvdpp.exe49⤵
- Executes dropped EXE
PID:1716 -
\??\c:\djpjj.exec:\djpjj.exe50⤵
- Executes dropped EXE
PID:1724 -
\??\c:\flxrlfx.exec:\flxrlfx.exe51⤵
- Executes dropped EXE
PID:1580 -
\??\c:\ttnbbh.exec:\ttnbbh.exe52⤵
- Executes dropped EXE
PID:2108 -
\??\c:\hnnhnt.exec:\hnnhnt.exe53⤵
- Executes dropped EXE
PID:544 -
\??\c:\ppjdp.exec:\ppjdp.exe54⤵
- Executes dropped EXE
PID:2204 -
\??\c:\jvvvv.exec:\jvvvv.exe55⤵
- Executes dropped EXE
PID:1420 -
\??\c:\fflrxll.exec:\fflrxll.exe56⤵
- Executes dropped EXE
PID:1352 -
\??\c:\thntnt.exec:\thntnt.exe57⤵
- Executes dropped EXE
PID:2780 -
\??\c:\tbttbt.exec:\tbttbt.exe58⤵
- Executes dropped EXE
PID:2752 -
\??\c:\pvvvp.exec:\pvvvp.exe59⤵
- Executes dropped EXE
PID:524 -
\??\c:\fxrflrx.exec:\fxrflrx.exe60⤵
- Executes dropped EXE
PID:2440 -
\??\c:\tttnnt.exec:\tttnnt.exe61⤵
- Executes dropped EXE
PID:2840 -
\??\c:\bbtthn.exec:\bbtthn.exe62⤵
- Executes dropped EXE
PID:1400 -
\??\c:\djjvj.exec:\djjvj.exe63⤵
- Executes dropped EXE
PID:1396 -
\??\c:\xfrrlll.exec:\xfrrlll.exe64⤵
- Executes dropped EXE
PID:784 -
\??\c:\fflxfxf.exec:\fflxfxf.exe65⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nnhthn.exec:\nnhthn.exe66⤵PID:2408
-
\??\c:\nbbtnh.exec:\nbbtnh.exe67⤵PID:2276
-
\??\c:\vjdjv.exec:\vjdjv.exe68⤵PID:2228
-
\??\c:\xrxxrlf.exec:\xrxxrlf.exe69⤵PID:1532
-
\??\c:\rrxxffr.exec:\rrxxffr.exe70⤵PID:1472
-
\??\c:\nbtthh.exec:\nbtthh.exe71⤵PID:2144
-
\??\c:\ddpvp.exec:\ddpvp.exe72⤵PID:2044
-
\??\c:\flxxllf.exec:\flxxllf.exe73⤵PID:1424
-
\??\c:\frfffll.exec:\frfffll.exe74⤵PID:876
-
\??\c:\nbnnnn.exec:\nbnnnn.exe75⤵PID:2848
-
\??\c:\djvpd.exec:\djvpd.exe76⤵PID:2004
-
\??\c:\rxxxrrf.exec:\rxxxrrf.exe77⤵PID:2608
-
\??\c:\frffllr.exec:\frffllr.exe78⤵PID:2592
-
\??\c:\nnthbn.exec:\nnthbn.exe79⤵PID:2724
-
\??\c:\pdddp.exec:\pdddp.exe80⤵PID:2616
-
\??\c:\dvddj.exec:\dvddj.exe81⤵PID:2852
-
\??\c:\7rfxxrx.exec:\7rfxxrx.exe82⤵PID:2488
-
\??\c:\tnnhbn.exec:\tnnhbn.exe83⤵PID:2484
-
\??\c:\5vvvj.exec:\5vvvj.exe84⤵PID:2776
-
\??\c:\vjdvj.exec:\vjdvj.exe85⤵PID:2660
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe86⤵PID:2972
-
\??\c:\btbhhb.exec:\btbhhb.exe87⤵PID:1624
-
\??\c:\bthhht.exec:\bthhht.exe88⤵PID:2940
-
\??\c:\vpdpd.exec:\vpdpd.exe89⤵PID:764
-
\??\c:\jpdpd.exec:\jpdpd.exe90⤵PID:1528
-
\??\c:\5llrfff.exec:\5llrfff.exe91⤵PID:268
-
\??\c:\nntthb.exec:\nntthb.exe92⤵PID:1576
-
\??\c:\jdpvd.exec:\jdpvd.exe93⤵PID:2384
-
\??\c:\pvpdp.exec:\pvpdp.exe94⤵PID:324
-
\??\c:\xfrflxf.exec:\xfrflxf.exe95⤵PID:2436
-
\??\c:\flfxllx.exec:\flfxllx.exe96⤵PID:2208
-
\??\c:\htnhnh.exec:\htnhnh.exe97⤵PID:1432
-
\??\c:\hnntnb.exec:\hnntnb.exe98⤵PID:2744
-
\??\c:\pvvjj.exec:\pvvjj.exe99⤵PID:1444
-
\??\c:\xrfrrfr.exec:\xrfrrfr.exe100⤵PID:2836
-
\??\c:\hnbhtt.exec:\hnbhtt.exe101⤵PID:2244
-
\??\c:\nhhbnn.exec:\nhhbnn.exe102⤵PID:524
-
\??\c:\vvjdv.exec:\vvjdv.exe103⤵PID:2324
-
\??\c:\frxffrr.exec:\frxffrr.exe104⤵PID:1832
-
\??\c:\htntth.exec:\htntth.exe105⤵PID:1776
-
\??\c:\nbbtht.exec:\nbbtht.exe106⤵PID:2804
-
\??\c:\vdpjd.exec:\vdpjd.exe107⤵PID:1468
-
\??\c:\lrxrxrx.exec:\lrxrxrx.exe108⤵PID:1692
-
\??\c:\lxxlfff.exec:\lxxlfff.exe109⤵PID:2408
-
\??\c:\hbbbhn.exec:\hbbbhn.exe110⤵PID:752
-
\??\c:\djpvv.exec:\djpvv.exe111⤵PID:2060
-
\??\c:\jvddv.exec:\jvddv.exe112⤵PID:1232
-
\??\c:\lxfxxrf.exec:\lxfxxrf.exe113⤵PID:1952
-
\??\c:\nbnnhh.exec:\nbnnhh.exe114⤵PID:1620
-
\??\c:\nbhttt.exec:\nbhttt.exe115⤵PID:1936
-
\??\c:\vjpjd.exec:\vjpjd.exe116⤵PID:2172
-
\??\c:\xfrflll.exec:\xfrflll.exe117⤵PID:2008
-
\??\c:\hhtbbh.exec:\hhtbbh.exe118⤵PID:2116
-
\??\c:\hthhtn.exec:\hthhtn.exe119⤵PID:2688
-
\??\c:\vpddd.exec:\vpddd.exe120⤵PID:2608
-
\??\c:\dpddd.exec:\dpddd.exe121⤵PID:2676
-
\??\c:\xfxxfff.exec:\xfxxfff.exe122⤵PID:2724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-