Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 11:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d0d07b2d481fcde273d83aac535426b0N.exe
Resource
win7-20240705-en
5 signatures
120 seconds
General
-
Target
d0d07b2d481fcde273d83aac535426b0N.exe
-
Size
260KB
-
MD5
d0d07b2d481fcde273d83aac535426b0
-
SHA1
883d0e138cbd3672ae195e0340083b5d8a3dda28
-
SHA256
4ac6e26494d84696f8eb156d3b6a2b8bf525efce893f43d80e2505424cbb74e0
-
SHA512
43fcad8ab52e3a8796bf3d2cbe0a05f41653ec22f09b960984e0a7a35db197ef4043e3a2611d97c41294905857e4ba4dd10434a4d9795d1621730d4c0d48f3c3
-
SSDEEP
6144:n3C9BRo7tvnJ9Fywhk/T4i37K3BoKg0q1:n3C9ytvn8whkb4i3e3GF/1
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1768-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/996-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/996-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/992-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/868-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1456-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1416-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/740-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1768 dvpjv.exe 996 fflrfxr.exe 2964 vppjd.exe 3008 ffxlffr.exe 2980 7rflxfx.exe 2872 3ddvv.exe 2712 rrxllrl.exe 992 bbtbnt.exe 1720 fllxrxr.exe 740 hnhbbt.exe 2176 hhhtnt.exe 2876 5vjvp.exe 2024 xfffffx.exe 2884 ntthhh.exe 1416 9ppjp.exe 1628 nbnbhh.exe 1808 tbhbhh.exe 2276 jjvdv.exe 2208 rxrxxfr.exe 2068 9bhbbn.exe 1972 ddvjv.exe 2404 9vvvj.exe 1944 bnbhbn.exe 2448 dpjdv.exe 968 fllfrxr.exe 1804 nnthbn.exe 2504 jjdpj.exe 640 xxxrlxl.exe 1456 hnhbbt.exe 2500 xfrxflx.exe 868 nnnthb.exe 828 dpjjd.exe 2136 xrlfrrl.exe 1700 ttnthh.exe 1768 jjjpj.exe 3016 rxlxllx.exe 2828 9xrrffr.exe 2540 3dpdd.exe 2720 pvdvj.exe 2952 ffxlflf.exe 2896 nbbnbt.exe 2872 tbhbth.exe 2424 jpvdd.exe 2224 fxrlxxx.exe 1932 fllfxlx.exe 2128 hhthbn.exe 1608 vjpjj.exe 2676 djdjd.exe 660 rxrllll.exe 2684 fflrlxx.exe 1868 bnbhbn.exe 1416 7jjdp.exe 3060 1jdjp.exe 584 lfrxfrf.exe 572 rfxlrlf.exe 2196 1hbbbh.exe 856 hnnhbt.exe 2456 vvjdv.exe 1436 1vpvd.exe 2228 ffxlxxr.exe 808 hbhtbn.exe 888 ntnnbb.exe 1752 jvvdv.exe 764 3xxllxr.exe -
resource yara_rule behavioral1/memory/1768-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/996-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/996-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/996-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/996-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/992-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/868-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1456-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1416-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/740-111-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 1768 2116 d0d07b2d481fcde273d83aac535426b0N.exe 64 PID 2116 wrote to memory of 1768 2116 d0d07b2d481fcde273d83aac535426b0N.exe 64 PID 2116 wrote to memory of 1768 2116 d0d07b2d481fcde273d83aac535426b0N.exe 64 PID 2116 wrote to memory of 1768 2116 d0d07b2d481fcde273d83aac535426b0N.exe 64 PID 1768 wrote to memory of 996 1768 dvpjv.exe 31 PID 1768 wrote to memory of 996 1768 dvpjv.exe 31 PID 1768 wrote to memory of 996 1768 dvpjv.exe 31 PID 1768 wrote to memory of 996 1768 dvpjv.exe 31 PID 996 wrote to memory of 2964 996 fflrfxr.exe 32 PID 996 wrote to memory of 2964 996 fflrfxr.exe 32 PID 996 wrote to memory of 2964 996 fflrfxr.exe 32 PID 996 wrote to memory of 2964 996 fflrfxr.exe 32 PID 2964 wrote to memory of 3008 2964 vppjd.exe 33 PID 2964 wrote to memory of 3008 2964 vppjd.exe 33 PID 2964 wrote to memory of 3008 2964 vppjd.exe 33 PID 2964 wrote to memory of 3008 2964 vppjd.exe 33 PID 3008 wrote to memory of 2980 3008 ffxlffr.exe 34 PID 3008 wrote to memory of 2980 3008 ffxlffr.exe 34 PID 3008 wrote to memory of 2980 3008 ffxlffr.exe 34 PID 3008 wrote to memory of 2980 3008 ffxlffr.exe 34 PID 2980 wrote to memory of 2872 2980 7rflxfx.exe 71 PID 2980 wrote to memory of 2872 2980 7rflxfx.exe 71 PID 2980 wrote to memory of 2872 2980 7rflxfx.exe 71 PID 2980 wrote to memory of 2872 2980 7rflxfx.exe 71 PID 2872 wrote to memory of 2712 2872 3ddvv.exe 36 PID 2872 wrote to memory of 2712 2872 3ddvv.exe 36 PID 2872 wrote to memory of 2712 2872 3ddvv.exe 36 PID 2872 wrote to memory of 2712 2872 3ddvv.exe 36 PID 2712 wrote to memory of 992 2712 rrxllrl.exe 37 PID 2712 wrote to memory of 992 2712 rrxllrl.exe 37 PID 2712 wrote to memory of 992 2712 rrxllrl.exe 37 PID 2712 wrote to memory of 992 2712 rrxllrl.exe 37 PID 992 wrote to memory of 1720 992 bbtbnt.exe 38 PID 992 wrote to memory of 1720 992 bbtbnt.exe 38 PID 992 wrote to memory of 1720 992 bbtbnt.exe 38 PID 992 wrote to memory of 1720 992 bbtbnt.exe 38 PID 1720 wrote to memory of 740 1720 fllxrxr.exe 39 PID 1720 wrote to memory of 740 1720 fllxrxr.exe 39 PID 1720 wrote to memory of 740 1720 fllxrxr.exe 39 PID 1720 wrote to memory of 740 1720 fllxrxr.exe 39 PID 740 wrote to memory of 2176 740 hnhbbt.exe 40 PID 740 wrote to memory of 2176 740 hnhbbt.exe 40 PID 740 wrote to memory of 2176 740 hnhbbt.exe 40 PID 740 wrote to memory of 2176 740 hnhbbt.exe 40 PID 2176 wrote to memory of 2876 2176 hhhtnt.exe 41 PID 2176 wrote to memory of 2876 2176 hhhtnt.exe 41 PID 2176 wrote to memory of 2876 2176 hhhtnt.exe 41 PID 2176 wrote to memory of 2876 2176 hhhtnt.exe 41 PID 2876 wrote to memory of 2024 2876 5vjvp.exe 42 PID 2876 wrote to memory of 2024 2876 5vjvp.exe 42 PID 2876 wrote to memory of 2024 2876 5vjvp.exe 42 PID 2876 wrote to memory of 2024 2876 5vjvp.exe 42 PID 2024 wrote to memory of 2884 2024 xfffffx.exe 43 PID 2024 wrote to memory of 2884 2024 xfffffx.exe 43 PID 2024 wrote to memory of 2884 2024 xfffffx.exe 43 PID 2024 wrote to memory of 2884 2024 xfffffx.exe 43 PID 2884 wrote to memory of 1416 2884 ntthhh.exe 81 PID 2884 wrote to memory of 1416 2884 ntthhh.exe 81 PID 2884 wrote to memory of 1416 2884 ntthhh.exe 81 PID 2884 wrote to memory of 1416 2884 ntthhh.exe 81 PID 1416 wrote to memory of 1628 1416 9ppjp.exe 45 PID 1416 wrote to memory of 1628 1416 9ppjp.exe 45 PID 1416 wrote to memory of 1628 1416 9ppjp.exe 45 PID 1416 wrote to memory of 1628 1416 9ppjp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0d07b2d481fcde273d83aac535426b0N.exe"C:\Users\Admin\AppData\Local\Temp\d0d07b2d481fcde273d83aac535426b0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\dvpjv.exec:\dvpjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\fflrfxr.exec:\fflrfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\vppjd.exec:\vppjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\ffxlffr.exec:\ffxlffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\7rflxfx.exec:\7rflxfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\3ddvv.exec:\3ddvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\rrxllrl.exec:\rrxllrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\bbtbnt.exec:\bbtbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\fllxrxr.exec:\fllxrxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\hnhbbt.exec:\hnhbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\hhhtnt.exec:\hhhtnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\5vjvp.exec:\5vjvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\xfffffx.exec:\xfffffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\ntthhh.exec:\ntthhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\9ppjp.exec:\9ppjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\nbnbhh.exec:\nbnbhh.exe17⤵
- Executes dropped EXE
PID:1628 -
\??\c:\tbhbhh.exec:\tbhbhh.exe18⤵
- Executes dropped EXE
PID:1808 -
\??\c:\jjvdv.exec:\jjvdv.exe19⤵
- Executes dropped EXE
PID:2276 -
\??\c:\rxrxxfr.exec:\rxrxxfr.exe20⤵
- Executes dropped EXE
PID:2208 -
\??\c:\9bhbbn.exec:\9bhbbn.exe21⤵
- Executes dropped EXE
PID:2068 -
\??\c:\ddvjv.exec:\ddvjv.exe22⤵
- Executes dropped EXE
PID:1972 -
\??\c:\9vvvj.exec:\9vvvj.exe23⤵
- Executes dropped EXE
PID:2404 -
\??\c:\bnbhbn.exec:\bnbhbn.exe24⤵
- Executes dropped EXE
PID:1944 -
\??\c:\dpjdv.exec:\dpjdv.exe25⤵
- Executes dropped EXE
PID:2448 -
\??\c:\fllfrxr.exec:\fllfrxr.exe26⤵
- Executes dropped EXE
PID:968 -
\??\c:\nnthbn.exec:\nnthbn.exe27⤵
- Executes dropped EXE
PID:1804 -
\??\c:\jjdpj.exec:\jjdpj.exe28⤵
- Executes dropped EXE
PID:2504 -
\??\c:\xxxrlxl.exec:\xxxrlxl.exe29⤵
- Executes dropped EXE
PID:640 -
\??\c:\hnhbbt.exec:\hnhbbt.exe30⤵
- Executes dropped EXE
PID:1456 -
\??\c:\xfrxflx.exec:\xfrxflx.exe31⤵
- Executes dropped EXE
PID:2500 -
\??\c:\nnnthb.exec:\nnnthb.exe32⤵
- Executes dropped EXE
PID:868 -
\??\c:\dpjjd.exec:\dpjjd.exe33⤵
- Executes dropped EXE
PID:828 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe34⤵
- Executes dropped EXE
PID:2136 -
\??\c:\ttnthh.exec:\ttnthh.exe35⤵
- Executes dropped EXE
PID:1700 -
\??\c:\jjjpj.exec:\jjjpj.exe36⤵
- Executes dropped EXE
PID:1768 -
\??\c:\rxlxllx.exec:\rxlxllx.exe37⤵
- Executes dropped EXE
PID:3016 -
\??\c:\9xrrffr.exec:\9xrrffr.exe38⤵
- Executes dropped EXE
PID:2828 -
\??\c:\3dpdd.exec:\3dpdd.exe39⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pvdvj.exec:\pvdvj.exe40⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ffxlflf.exec:\ffxlflf.exe41⤵
- Executes dropped EXE
PID:2952 -
\??\c:\nbbnbt.exec:\nbbnbt.exe42⤵
- Executes dropped EXE
PID:2896 -
\??\c:\tbhbth.exec:\tbhbth.exe43⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jpvdd.exec:\jpvdd.exe44⤵
- Executes dropped EXE
PID:2424 -
\??\c:\fxrlxxx.exec:\fxrlxxx.exe45⤵
- Executes dropped EXE
PID:2224 -
\??\c:\fllfxlx.exec:\fllfxlx.exe46⤵
- Executes dropped EXE
PID:1932 -
\??\c:\hhthbn.exec:\hhthbn.exe47⤵
- Executes dropped EXE
PID:2128 -
\??\c:\vjpjj.exec:\vjpjj.exe48⤵
- Executes dropped EXE
PID:1608 -
\??\c:\djdjd.exec:\djdjd.exe49⤵
- Executes dropped EXE
PID:2676 -
\??\c:\rxrllll.exec:\rxrllll.exe50⤵
- Executes dropped EXE
PID:660 -
\??\c:\fflrlxx.exec:\fflrlxx.exe51⤵
- Executes dropped EXE
PID:2684 -
\??\c:\bnbhbn.exec:\bnbhbn.exe52⤵
- Executes dropped EXE
PID:1868 -
\??\c:\7jjdp.exec:\7jjdp.exe53⤵
- Executes dropped EXE
PID:1416 -
\??\c:\1jdjp.exec:\1jdjp.exe54⤵
- Executes dropped EXE
PID:3060 -
\??\c:\lfrxfrf.exec:\lfrxfrf.exe55⤵
- Executes dropped EXE
PID:584 -
\??\c:\rfxlrlf.exec:\rfxlrlf.exe56⤵
- Executes dropped EXE
PID:572 -
\??\c:\1hbbbh.exec:\1hbbbh.exe57⤵
- Executes dropped EXE
PID:2196 -
\??\c:\hnnhbt.exec:\hnnhbt.exe58⤵
- Executes dropped EXE
PID:856 -
\??\c:\vvjdv.exec:\vvjdv.exe59⤵
- Executes dropped EXE
PID:2456 -
\??\c:\1vpvd.exec:\1vpvd.exe60⤵
- Executes dropped EXE
PID:1436 -
\??\c:\ffxlxxr.exec:\ffxlxxr.exe61⤵
- Executes dropped EXE
PID:2228 -
\??\c:\hbhtbn.exec:\hbhtbn.exe62⤵
- Executes dropped EXE
PID:808 -
\??\c:\ntnnbb.exec:\ntnnbb.exe63⤵
- Executes dropped EXE
PID:888 -
\??\c:\jvvdv.exec:\jvvdv.exe64⤵
- Executes dropped EXE
PID:1752 -
\??\c:\3xxllxr.exec:\3xxllxr.exe65⤵
- Executes dropped EXE
PID:764 -
\??\c:\fllxxxr.exec:\fllxxxr.exe66⤵PID:2796
-
\??\c:\3tbtbt.exec:\3tbtbt.exe67⤵PID:2904
-
\??\c:\9pdvp.exec:\9pdvp.exe68⤵PID:2640
-
\??\c:\7vvjj.exec:\7vvjj.exe69⤵PID:2148
-
\??\c:\7xxllxf.exec:\7xxllxf.exe70⤵PID:2648
-
\??\c:\frxrlxr.exec:\frxrlxr.exe71⤵PID:1744
-
\??\c:\5tbnnb.exec:\5tbnnb.exe72⤵PID:1468
-
\??\c:\9thbtn.exec:\9thbtn.exe73⤵PID:868
-
\??\c:\1jjdv.exec:\1jjdv.exe74⤵PID:1364
-
\??\c:\rxxllxx.exec:\rxxllxx.exe75⤵PID:3044
-
\??\c:\xlxrxlr.exec:\xlxrxlr.exe76⤵PID:596
-
\??\c:\7btnth.exec:\7btnth.exe77⤵PID:2956
-
\??\c:\bthhtn.exec:\bthhtn.exe78⤵PID:2948
-
\??\c:\dvpvv.exec:\dvpvv.exe79⤵PID:3016
-
\??\c:\9tnhnh.exec:\9tnhnh.exe80⤵PID:2288
-
\??\c:\9tbnnb.exec:\9tbnnb.exe81⤵PID:2540
-
\??\c:\pjjjp.exec:\pjjjp.exe82⤵PID:1704
-
\??\c:\vppdv.exec:\vppdv.exe83⤵PID:2696
-
\??\c:\rrlrfrr.exec:\rrlrfrr.exe84⤵PID:2760
-
\??\c:\nthnbt.exec:\nthnbt.exe85⤵PID:1060
-
\??\c:\1htbtn.exec:\1htbtn.exe86⤵PID:2968
-
\??\c:\ppddp.exec:\ppddp.exe87⤵PID:1232
-
\??\c:\7xxrrll.exec:\7xxrrll.exe88⤵PID:1408
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe89⤵PID:1308
-
\??\c:\1nnbnn.exec:\1nnbnn.exe90⤵PID:1052
-
\??\c:\jddjp.exec:\jddjp.exe91⤵PID:2040
-
\??\c:\pdjvv.exec:\pdjvv.exe92⤵PID:2784
-
\??\c:\xrlfrfl.exec:\xrlfrfl.exe93⤵PID:1716
-
\??\c:\bbhhbt.exec:\bbhhbt.exe94⤵PID:2936
-
\??\c:\nhbntn.exec:\nhbntn.exe95⤵PID:1548
-
\??\c:\1jvvd.exec:\1jvvd.exe96⤵PID:2180
-
\??\c:\hhntnb.exec:\hhntnb.exe97⤵PID:3060
-
\??\c:\bttbnh.exec:\bttbnh.exe98⤵PID:2236
-
\??\c:\ntbbth.exec:\ntbbth.exe99⤵PID:2384
-
\??\c:\pvjvv.exec:\pvjvv.exe100⤵PID:2196
-
\??\c:\hhhtnb.exec:\hhhtnb.exe101⤵PID:2428
-
\??\c:\vdvjv.exec:\vdvjv.exe102⤵PID:2056
-
\??\c:\flxlrff.exec:\flxlrff.exe103⤵PID:532
-
\??\c:\tnhnbh.exec:\tnhnbh.exe104⤵PID:1244
-
\??\c:\pdpjp.exec:\pdpjp.exe105⤵PID:2284
-
\??\c:\jvvjv.exec:\jvvjv.exe106⤵PID:932
-
\??\c:\lxffrll.exec:\lxffrll.exe107⤵PID:968
-
\??\c:\thtbtb.exec:\thtbtb.exe108⤵PID:528
-
\??\c:\jpdjj.exec:\jpdjj.exe109⤵PID:1748
-
\??\c:\3rlrxfl.exec:\3rlrxfl.exe110⤵PID:2536
-
\??\c:\fxrrxfr.exec:\fxrrxfr.exe111⤵PID:2656
-
\??\c:\hntnnh.exec:\hntnnh.exe112⤵PID:544
-
\??\c:\ntbnnb.exec:\ntbnnb.exe113⤵PID:876
-
\??\c:\jvppd.exec:\jvppd.exe114⤵PID:1744
-
\??\c:\3rllrff.exec:\3rllrff.exe115⤵PID:1892
-
\??\c:\rxrfflx.exec:\rxrfflx.exe116⤵PID:868
-
\??\c:\thnnth.exec:\thnnth.exe117⤵PID:2136
-
\??\c:\ppjvp.exec:\ppjvp.exe118⤵PID:3044
-
\??\c:\jpvpp.exec:\jpvpp.exe119⤵PID:2216
-
\??\c:\lfrfxxr.exec:\lfrfxxr.exe120⤵PID:616
-
\??\c:\tbnhbt.exec:\tbnhbt.exe121⤵PID:2860
-
\??\c:\bttntn.exec:\bttntn.exe122⤵PID:2172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-