Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 07:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f96809f4e951a76b376f5aedff45f5cbc5344fec653ab0a54facace8a67effa7.exe
Resource
win7-20240704-en
5 signatures
150 seconds
General
-
Target
f96809f4e951a76b376f5aedff45f5cbc5344fec653ab0a54facace8a67effa7.exe
-
Size
135KB
-
MD5
fb39ae543ec5a1c3e3055cf557889955
-
SHA1
0996d9ed929f82c5db5ba6aba85325fe42e4dfe6
-
SHA256
f96809f4e951a76b376f5aedff45f5cbc5344fec653ab0a54facace8a67effa7
-
SHA512
b0f7df4e729609ea6672feb735c0a321938462a1583094ad76b6c030fc5c6cb720696839b8548ebdf6a4c4a229708e1006339df5f2ac8f371393d29aa990082d
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73HUoMsAbrF3BTUwFr:n3C9BRo7HCsAbhxYE
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2144-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1320-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/876-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/536-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1488-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/692-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/304-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2144 rrrxllf.exe 2200 bbntnt.exe 3056 nntbnb.exe 2744 jvpdp.exe 2692 3hbhth.exe 2792 btthnb.exe 2740 jjjvp.exe 2564 5hbntt.exe 3012 nnttbh.exe 1012 pjjvj.exe 1320 jpvpp.exe 1792 rrxfxxr.exe 876 hhbnbn.exe 1976 7nhnbh.exe 536 7pvvd.exe 2636 xxxlrfl.exe 3016 lfxlxlr.exe 2860 tttttt.exe 2188 vddpj.exe 1488 9lxlxfx.exe 1724 flflxlr.exe 760 vpjpd.exe 1648 dvvjp.exe 2244 ffxllxl.exe 692 3thnnn.exe 1420 7htnhh.exe 304 pjddp.exe 900 tttbbn.exe 2484 btbnhh.exe 2208 jdvdj.exe 2200 lflrrrr.exe 2656 rlffrrx.exe 2324 hhnhbh.exe 2732 vvvvv.exe 2704 dvpdv.exe 2172 lfrrrrx.exe 2692 3rfflrx.exe 2712 nhtntt.exe 2784 tbhbhh.exe 2620 1nhnnh.exe 2716 jpddv.exe 796 rfllrfl.exe 1584 frrxffr.exe 2536 tnnbtt.exe 1996 bthbtt.exe 2448 pvvvv.exe 2012 lxrxxfl.exe 1668 xxlrrfl.exe 2852 hthnht.exe 544 bnbbbb.exe 2844 pdpvj.exe 2984 rrlxrfx.exe 2104 llflxfr.exe 2432 ththtn.exe 448 jjddj.exe 2900 1ppvv.exe 964 1fxflfx.exe 2452 llxlrrx.exe 1752 9bbbbt.exe 852 7nbhnn.exe 892 ppdpd.exe 2444 7jvpd.exe 1732 xlrflrr.exe 904 fxxrlfr.exe -
resource yara_rule behavioral1/memory/2144-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1320-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/876-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/536-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/692-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/304-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2144 2460 f96809f4e951a76b376f5aedff45f5cbc5344fec653ab0a54facace8a67effa7.exe 31 PID 2460 wrote to memory of 2144 2460 f96809f4e951a76b376f5aedff45f5cbc5344fec653ab0a54facace8a67effa7.exe 31 PID 2460 wrote to memory of 2144 2460 f96809f4e951a76b376f5aedff45f5cbc5344fec653ab0a54facace8a67effa7.exe 31 PID 2460 wrote to memory of 2144 2460 f96809f4e951a76b376f5aedff45f5cbc5344fec653ab0a54facace8a67effa7.exe 31 PID 2144 wrote to memory of 2200 2144 rrrxllf.exe 32 PID 2144 wrote to memory of 2200 2144 rrrxllf.exe 32 PID 2144 wrote to memory of 2200 2144 rrrxllf.exe 32 PID 2144 wrote to memory of 2200 2144 rrrxllf.exe 32 PID 2200 wrote to memory of 3056 2200 bbntnt.exe 33 PID 2200 wrote to memory of 3056 2200 bbntnt.exe 33 PID 2200 wrote to memory of 3056 2200 bbntnt.exe 33 PID 2200 wrote to memory of 3056 2200 bbntnt.exe 33 PID 3056 wrote to memory of 2744 3056 nntbnb.exe 34 PID 3056 wrote to memory of 2744 3056 nntbnb.exe 34 PID 3056 wrote to memory of 2744 3056 nntbnb.exe 34 PID 3056 wrote to memory of 2744 3056 nntbnb.exe 34 PID 2744 wrote to memory of 2692 2744 jvpdp.exe 35 PID 2744 wrote to memory of 2692 2744 jvpdp.exe 35 PID 2744 wrote to memory of 2692 2744 jvpdp.exe 35 PID 2744 wrote to memory of 2692 2744 jvpdp.exe 35 PID 2692 wrote to memory of 2792 2692 3hbhth.exe 36 PID 2692 wrote to memory of 2792 2692 3hbhth.exe 36 PID 2692 wrote to memory of 2792 2692 3hbhth.exe 36 PID 2692 wrote to memory of 2792 2692 3hbhth.exe 36 PID 2792 wrote to memory of 2740 2792 btthnb.exe 37 PID 2792 wrote to memory of 2740 2792 btthnb.exe 37 PID 2792 wrote to memory of 2740 2792 btthnb.exe 37 PID 2792 wrote to memory of 2740 2792 btthnb.exe 37 PID 2740 wrote to memory of 2564 2740 jjjvp.exe 38 PID 2740 wrote to memory of 2564 2740 jjjvp.exe 38 PID 2740 wrote to memory of 2564 2740 jjjvp.exe 38 PID 2740 wrote to memory of 2564 2740 jjjvp.exe 38 PID 2564 wrote to memory of 3012 2564 5hbntt.exe 39 PID 2564 wrote to memory of 3012 2564 5hbntt.exe 39 PID 2564 wrote to memory of 3012 2564 5hbntt.exe 39 PID 2564 wrote to memory of 3012 2564 5hbntt.exe 39 PID 3012 wrote to memory of 1012 3012 nnttbh.exe 40 PID 3012 wrote to memory of 1012 3012 nnttbh.exe 40 PID 3012 wrote to memory of 1012 3012 nnttbh.exe 40 PID 3012 wrote to memory of 1012 3012 nnttbh.exe 40 PID 1012 wrote to memory of 1320 1012 pjjvj.exe 41 PID 1012 wrote to memory of 1320 1012 pjjvj.exe 41 PID 1012 wrote to memory of 1320 1012 pjjvj.exe 41 PID 1012 wrote to memory of 1320 1012 pjjvj.exe 41 PID 1320 wrote to memory of 1792 1320 jpvpp.exe 42 PID 1320 wrote to memory of 1792 1320 jpvpp.exe 42 PID 1320 wrote to memory of 1792 1320 jpvpp.exe 42 PID 1320 wrote to memory of 1792 1320 jpvpp.exe 42 PID 1792 wrote to memory of 876 1792 rrxfxxr.exe 43 PID 1792 wrote to memory of 876 1792 rrxfxxr.exe 43 PID 1792 wrote to memory of 876 1792 rrxfxxr.exe 43 PID 1792 wrote to memory of 876 1792 rrxfxxr.exe 43 PID 876 wrote to memory of 1976 876 hhbnbn.exe 44 PID 876 wrote to memory of 1976 876 hhbnbn.exe 44 PID 876 wrote to memory of 1976 876 hhbnbn.exe 44 PID 876 wrote to memory of 1976 876 hhbnbn.exe 44 PID 1976 wrote to memory of 536 1976 7nhnbh.exe 45 PID 1976 wrote to memory of 536 1976 7nhnbh.exe 45 PID 1976 wrote to memory of 536 1976 7nhnbh.exe 45 PID 1976 wrote to memory of 536 1976 7nhnbh.exe 45 PID 536 wrote to memory of 2636 536 7pvvd.exe 46 PID 536 wrote to memory of 2636 536 7pvvd.exe 46 PID 536 wrote to memory of 2636 536 7pvvd.exe 46 PID 536 wrote to memory of 2636 536 7pvvd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\f96809f4e951a76b376f5aedff45f5cbc5344fec653ab0a54facace8a67effa7.exe"C:\Users\Admin\AppData\Local\Temp\f96809f4e951a76b376f5aedff45f5cbc5344fec653ab0a54facace8a67effa7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\rrrxllf.exec:\rrrxllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\bbntnt.exec:\bbntnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\nntbnb.exec:\nntbnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\jvpdp.exec:\jvpdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\3hbhth.exec:\3hbhth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\btthnb.exec:\btthnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\jjjvp.exec:\jjjvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\5hbntt.exec:\5hbntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\nnttbh.exec:\nnttbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\pjjvj.exec:\pjjvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\jpvpp.exec:\jpvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\rrxfxxr.exec:\rrxfxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\hhbnbn.exec:\hhbnbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\7nhnbh.exec:\7nhnbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\7pvvd.exec:\7pvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\xxxlrfl.exec:\xxxlrfl.exe17⤵
- Executes dropped EXE
PID:2636 -
\??\c:\lfxlxlr.exec:\lfxlxlr.exe18⤵
- Executes dropped EXE
PID:3016 -
\??\c:\tttttt.exec:\tttttt.exe19⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vddpj.exec:\vddpj.exe20⤵
- Executes dropped EXE
PID:2188 -
\??\c:\9lxlxfx.exec:\9lxlxfx.exe21⤵
- Executes dropped EXE
PID:1488 -
\??\c:\flflxlr.exec:\flflxlr.exe22⤵
- Executes dropped EXE
PID:1724 -
\??\c:\vpjpd.exec:\vpjpd.exe23⤵
- Executes dropped EXE
PID:760 -
\??\c:\dvvjp.exec:\dvvjp.exe24⤵
- Executes dropped EXE
PID:1648 -
\??\c:\ffxllxl.exec:\ffxllxl.exe25⤵
- Executes dropped EXE
PID:2244 -
\??\c:\3thnnn.exec:\3thnnn.exe26⤵
- Executes dropped EXE
PID:692 -
\??\c:\7htnhh.exec:\7htnhh.exe27⤵
- Executes dropped EXE
PID:1420 -
\??\c:\pjddp.exec:\pjddp.exe28⤵
- Executes dropped EXE
PID:304 -
\??\c:\tttbbn.exec:\tttbbn.exe29⤵
- Executes dropped EXE
PID:900 -
\??\c:\btbnhh.exec:\btbnhh.exe30⤵
- Executes dropped EXE
PID:2484 -
\??\c:\jdvdj.exec:\jdvdj.exe31⤵
- Executes dropped EXE
PID:2208 -
\??\c:\lflrrrr.exec:\lflrrrr.exe32⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rlffrrx.exec:\rlffrrx.exe33⤵
- Executes dropped EXE
PID:2656 -
\??\c:\hhnhbh.exec:\hhnhbh.exe34⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vvvvv.exec:\vvvvv.exe35⤵
- Executes dropped EXE
PID:2732 -
\??\c:\dvpdv.exec:\dvpdv.exe36⤵
- Executes dropped EXE
PID:2704 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe37⤵
- Executes dropped EXE
PID:2172 -
\??\c:\3rfflrx.exec:\3rfflrx.exe38⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nhtntt.exec:\nhtntt.exe39⤵
- Executes dropped EXE
PID:2712 -
\??\c:\tbhbhh.exec:\tbhbhh.exe40⤵
- Executes dropped EXE
PID:2784 -
\??\c:\1nhnnh.exec:\1nhnnh.exe41⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jpddv.exec:\jpddv.exe42⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rfllrfl.exec:\rfllrfl.exe43⤵
- Executes dropped EXE
PID:796 -
\??\c:\frrxffr.exec:\frrxffr.exe44⤵
- Executes dropped EXE
PID:1584 -
\??\c:\tnnbtt.exec:\tnnbtt.exe45⤵
- Executes dropped EXE
PID:2536 -
\??\c:\bthbtt.exec:\bthbtt.exe46⤵
- Executes dropped EXE
PID:1996 -
\??\c:\pvvvv.exec:\pvvvv.exe47⤵
- Executes dropped EXE
PID:2448 -
\??\c:\lxrxxfl.exec:\lxrxxfl.exe48⤵
- Executes dropped EXE
PID:2012 -
\??\c:\xxlrrfl.exec:\xxlrrfl.exe49⤵
- Executes dropped EXE
PID:1668 -
\??\c:\hthnht.exec:\hthnht.exe50⤵
- Executes dropped EXE
PID:2852 -
\??\c:\bnbbbb.exec:\bnbbbb.exe51⤵
- Executes dropped EXE
PID:544 -
\??\c:\pdpvj.exec:\pdpvj.exe52⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rrlxrfx.exec:\rrlxrfx.exe53⤵
- Executes dropped EXE
PID:2984 -
\??\c:\llflxfr.exec:\llflxfr.exe54⤵
- Executes dropped EXE
PID:2104 -
\??\c:\ththtn.exec:\ththtn.exe55⤵
- Executes dropped EXE
PID:2432 -
\??\c:\jjddj.exec:\jjddj.exe56⤵
- Executes dropped EXE
PID:448 -
\??\c:\1ppvv.exec:\1ppvv.exe57⤵
- Executes dropped EXE
PID:2900 -
\??\c:\1fxflfx.exec:\1fxflfx.exe58⤵
- Executes dropped EXE
PID:964 -
\??\c:\llxlrrx.exec:\llxlrrx.exe59⤵
- Executes dropped EXE
PID:2452 -
\??\c:\9bbbbt.exec:\9bbbbt.exe60⤵
- Executes dropped EXE
PID:1752 -
\??\c:\7nbhnn.exec:\7nbhnn.exe61⤵
- Executes dropped EXE
PID:852 -
\??\c:\ppdpd.exec:\ppdpd.exe62⤵
- Executes dropped EXE
PID:892 -
\??\c:\7jvpd.exec:\7jvpd.exe63⤵
- Executes dropped EXE
PID:2444 -
\??\c:\xlrflrr.exec:\xlrflrr.exe64⤵
- Executes dropped EXE
PID:1732 -
\??\c:\fxxrlfr.exec:\fxxrlfr.exe65⤵
- Executes dropped EXE
PID:904 -
\??\c:\ntthht.exec:\ntthht.exe66⤵PID:2468
-
\??\c:\vpppv.exec:\vpppv.exe67⤵PID:2292
-
\??\c:\pvvjd.exec:\pvvjd.exe68⤵PID:1044
-
\??\c:\xlfxllr.exec:\xlfxllr.exe69⤵PID:2208
-
\??\c:\3frxflr.exec:\3frxflr.exe70⤵PID:3036
-
\??\c:\1nhntt.exec:\1nhntt.exe71⤵PID:2248
-
\??\c:\9vjvv.exec:\9vjvv.exe72⤵PID:2756
-
\??\c:\jdppv.exec:\jdppv.exe73⤵PID:2816
-
\??\c:\rllrxxf.exec:\rllrxxf.exe74⤵PID:2876
-
\??\c:\rfllrrf.exec:\rfllrrf.exe75⤵PID:2584
-
\??\c:\tnbbhn.exec:\tnbbhn.exe76⤵PID:2576
-
\??\c:\vvjjj.exec:\vvjjj.exe77⤵PID:2996
-
\??\c:\dvdjd.exec:\dvdjd.exe78⤵PID:2580
-
\??\c:\rlxxllx.exec:\rlxxllx.exe79⤵PID:2624
-
\??\c:\hbnbtb.exec:\hbnbtb.exe80⤵PID:2192
-
\??\c:\pjvvj.exec:\pjvvj.exe81⤵PID:2964
-
\??\c:\pjvdv.exec:\pjvdv.exe82⤵PID:1012
-
\??\c:\llflfrf.exec:\llflfrf.exe83⤵PID:556
-
\??\c:\xxxxlrf.exec:\xxxxlrf.exe84⤵PID:992
-
\??\c:\5tnntn.exec:\5tnntn.exe85⤵PID:1316
-
\??\c:\bhtnnn.exec:\bhtnnn.exe86⤵PID:1976
-
\??\c:\pdvvp.exec:\pdvvp.exe87⤵PID:1628
-
\??\c:\ppvjj.exec:\ppvjj.exe88⤵PID:1616
-
\??\c:\flxrrlx.exec:\flxrrlx.exe89⤵PID:2636
-
\??\c:\lrfrxxf.exec:\lrfrxxf.exe90⤵PID:1156
-
\??\c:\7bnhnn.exec:\7bnhnn.exe91⤵PID:2408
-
\??\c:\dvppd.exec:\dvppd.exe92⤵PID:624
-
\??\c:\jdpvv.exec:\jdpvv.exe93⤵PID:1468
-
\??\c:\fxxrlrx.exec:\fxxrlrx.exe94⤵PID:3024
-
\??\c:\frflxfx.exec:\frflxfx.exe95⤵PID:2588
-
\??\c:\3bhhtb.exec:\3bhhtb.exe96⤵PID:1592
-
\??\c:\hnnbnb.exec:\hnnbnb.exe97⤵PID:2316
-
\??\c:\3vdjd.exec:\3vdjd.exe98⤵PID:1684
-
\??\c:\dpdpp.exec:\dpdpp.exe99⤵PID:664
-
\??\c:\xxrxrfx.exec:\xxrxrfx.exe100⤵PID:2196
-
\??\c:\flfrllf.exec:\flfrllf.exe101⤵PID:1532
-
\??\c:\tnhnhh.exec:\tnhnhh.exe102⤵PID:1000
-
\??\c:\bthtbn.exec:\bthtbn.exe103⤵PID:2632
-
\??\c:\pjdjv.exec:\pjdjv.exe104⤵PID:2096
-
\??\c:\7dpdj.exec:\7dpdj.exe105⤵PID:1500
-
\??\c:\1lxlfxr.exec:\1lxlfxr.exe106⤵PID:2484
-
\??\c:\flfrflf.exec:\flfrflf.exe107⤵PID:1044
-
\??\c:\hbbthn.exec:\hbbthn.exe108⤵PID:2676
-
\??\c:\pppdd.exec:\pppdd.exe109⤵PID:3036
-
\??\c:\7djjp.exec:\7djjp.exe110⤵PID:2772
-
\??\c:\rrrxrlf.exec:\rrrxrlf.exe111⤵PID:2756
-
\??\c:\fxrllfr.exec:\fxrllfr.exe112⤵PID:2212
-
\??\c:\5btbnb.exec:\5btbnb.exe113⤵PID:2876
-
\??\c:\bntttn.exec:\bntttn.exe114⤵PID:2720
-
\??\c:\dvjjp.exec:\dvjjp.exe115⤵PID:2576
-
\??\c:\9djpd.exec:\9djpd.exe116⤵PID:2608
-
\??\c:\xlrxflf.exec:\xlrxflf.exe117⤵PID:2580
-
\??\c:\fxrfxfx.exec:\fxrfxfx.exe118⤵PID:2596
-
\??\c:\5hhtnt.exec:\5hhtnt.exe119⤵PID:2192
-
\??\c:\ddvpp.exec:\ddvpp.exe120⤵PID:1332
-
\??\c:\jvddp.exec:\jvddp.exe121⤵PID:2536
-
\??\c:\ffrfxlx.exec:\ffrfxlx.exe122⤵PID:556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-