Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
20-07-2024 21:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0dad4f633f78f484a1ea2a594390e0d0N.exe
Resource
win7-20240705-en
windows7-x64
5 signatures
120 seconds
General
-
Target
0dad4f633f78f484a1ea2a594390e0d0N.exe
-
Size
73KB
-
MD5
0dad4f633f78f484a1ea2a594390e0d0
-
SHA1
3383f5d0814c2b145de1776469d587908139138f
-
SHA256
afcb9bfae5f1828dd65598dc4f86e7a74494a2306742ced2e94986aeadc62dc1
-
SHA512
66ef6ee536fac779d1d11a1978de43d5c5d0476b41da32d3f194ceaabe5d81b6f0f47ef765c398934e0445d48c07c2fe8755c37ad0fa9656f95b76bd06c9cb07
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7tAHEqSCkKWSf:ymb3NkkiQ3mdBjFIynIKnf
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2028-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-63-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-74-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1592-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/796-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1428-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1100-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1832-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/748-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2140 rlxfrrx.exe 2484 llrfxrf.exe 592 7vjpd.exe 2860 lxlllrx.exe 2608 3rflrxl.exe 2936 9hhhbb.exe 2636 vpjjp.exe 2620 dpdvd.exe 3036 fflrlrf.exe 2004 lfxrffr.exe 1628 tttnnh.exe 1592 jjvpv.exe 1932 xxlxxrr.exe 1988 fxlflrf.exe 796 3btbbh.exe 2920 5bbhbh.exe 2788 7pppj.exe 2460 lflffrx.exe 2448 lfrrxxf.exe 1428 nnnbnb.exe 1100 vjjvp.exe 1896 vdpvp.exe 1104 lfffrrx.exe 1976 lxfxllx.exe 884 nhthnn.exe 1496 dpjjp.exe 1832 jvvvd.exe 748 xrflxll.exe 2028 fxrxffl.exe 1604 3hbnnb.exe 2156 dppvd.exe 1648 jjjjd.exe 2424 xxlfrxr.exe 2752 5lfrxrl.exe 2812 1bhnnn.exe 2940 7thnnh.exe 2412 3pvjj.exe 2780 vpjvd.exe 2664 1lxfllr.exe 2656 rxxrrlx.exe 2604 tnhntt.exe 2816 3nbbhh.exe 532 jjdvv.exe 1632 dvjdp.exe 1540 fxxxflr.exe 1168 rxxrlxl.exe 1440 nbbhbh.exe 1924 nnhhtt.exe 796 tnnhbb.exe 2920 vdpvd.exe 2476 vddvj.exe 2444 lxlffxf.exe 880 xrflfff.exe 1352 1htbhh.exe 1108 nhbnnn.exe 2176 3jdvd.exe 2284 7jvdp.exe 1312 vjjjp.exe 1768 xlfxlfl.exe 1580 rlxrlrf.exe 1660 5hhbhn.exe 660 nhttbh.exe 2056 ppjpp.exe 2312 jvjdd.exe -
resource yara_rule behavioral1/memory/2028-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1592-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/796-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1428-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1100-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1832-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/748-273-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2140 2028 0dad4f633f78f484a1ea2a594390e0d0N.exe 31 PID 2028 wrote to memory of 2140 2028 0dad4f633f78f484a1ea2a594390e0d0N.exe 31 PID 2028 wrote to memory of 2140 2028 0dad4f633f78f484a1ea2a594390e0d0N.exe 31 PID 2028 wrote to memory of 2140 2028 0dad4f633f78f484a1ea2a594390e0d0N.exe 31 PID 2140 wrote to memory of 2484 2140 rlxfrrx.exe 32 PID 2140 wrote to memory of 2484 2140 rlxfrrx.exe 32 PID 2140 wrote to memory of 2484 2140 rlxfrrx.exe 32 PID 2140 wrote to memory of 2484 2140 rlxfrrx.exe 32 PID 2484 wrote to memory of 592 2484 llrfxrf.exe 33 PID 2484 wrote to memory of 592 2484 llrfxrf.exe 33 PID 2484 wrote to memory of 592 2484 llrfxrf.exe 33 PID 2484 wrote to memory of 592 2484 llrfxrf.exe 33 PID 592 wrote to memory of 2860 592 7vjpd.exe 34 PID 592 wrote to memory of 2860 592 7vjpd.exe 34 PID 592 wrote to memory of 2860 592 7vjpd.exe 34 PID 592 wrote to memory of 2860 592 7vjpd.exe 34 PID 2860 wrote to memory of 2608 2860 lxlllrx.exe 35 PID 2860 wrote to memory of 2608 2860 lxlllrx.exe 35 PID 2860 wrote to memory of 2608 2860 lxlllrx.exe 35 PID 2860 wrote to memory of 2608 2860 lxlllrx.exe 35 PID 2608 wrote to memory of 2936 2608 3rflrxl.exe 36 PID 2608 wrote to memory of 2936 2608 3rflrxl.exe 36 PID 2608 wrote to memory of 2936 2608 3rflrxl.exe 36 PID 2608 wrote to memory of 2936 2608 3rflrxl.exe 36 PID 2936 wrote to memory of 2636 2936 9hhhbb.exe 37 PID 2936 wrote to memory of 2636 2936 9hhhbb.exe 37 PID 2936 wrote to memory of 2636 2936 9hhhbb.exe 37 PID 2936 wrote to memory of 2636 2936 9hhhbb.exe 37 PID 2636 wrote to memory of 2620 2636 vpjjp.exe 38 PID 2636 wrote to memory of 2620 2636 vpjjp.exe 38 PID 2636 wrote to memory of 2620 2636 vpjjp.exe 38 PID 2636 wrote to memory of 2620 2636 vpjjp.exe 38 PID 2620 wrote to memory of 3036 2620 dpdvd.exe 39 PID 2620 wrote to memory of 3036 2620 dpdvd.exe 39 PID 2620 wrote to memory of 3036 2620 dpdvd.exe 39 PID 2620 wrote to memory of 3036 2620 dpdvd.exe 39 PID 3036 wrote to memory of 2004 3036 fflrlrf.exe 40 PID 3036 wrote to memory of 2004 3036 fflrlrf.exe 40 PID 3036 wrote to memory of 2004 3036 fflrlrf.exe 40 PID 3036 wrote to memory of 2004 3036 fflrlrf.exe 40 PID 2004 wrote to memory of 1628 2004 lfxrffr.exe 41 PID 2004 wrote to memory of 1628 2004 lfxrffr.exe 41 PID 2004 wrote to memory of 1628 2004 lfxrffr.exe 41 PID 2004 wrote to memory of 1628 2004 lfxrffr.exe 41 PID 1628 wrote to memory of 1592 1628 tttnnh.exe 42 PID 1628 wrote to memory of 1592 1628 tttnnh.exe 42 PID 1628 wrote to memory of 1592 1628 tttnnh.exe 42 PID 1628 wrote to memory of 1592 1628 tttnnh.exe 42 PID 1592 wrote to memory of 1932 1592 jjvpv.exe 43 PID 1592 wrote to memory of 1932 1592 jjvpv.exe 43 PID 1592 wrote to memory of 1932 1592 jjvpv.exe 43 PID 1592 wrote to memory of 1932 1592 jjvpv.exe 43 PID 1932 wrote to memory of 1988 1932 xxlxxrr.exe 44 PID 1932 wrote to memory of 1988 1932 xxlxxrr.exe 44 PID 1932 wrote to memory of 1988 1932 xxlxxrr.exe 44 PID 1932 wrote to memory of 1988 1932 xxlxxrr.exe 44 PID 1988 wrote to memory of 796 1988 fxlflrf.exe 45 PID 1988 wrote to memory of 796 1988 fxlflrf.exe 45 PID 1988 wrote to memory of 796 1988 fxlflrf.exe 45 PID 1988 wrote to memory of 796 1988 fxlflrf.exe 45 PID 796 wrote to memory of 2920 796 3btbbh.exe 46 PID 796 wrote to memory of 2920 796 3btbbh.exe 46 PID 796 wrote to memory of 2920 796 3btbbh.exe 46 PID 796 wrote to memory of 2920 796 3btbbh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dad4f633f78f484a1ea2a594390e0d0N.exe"C:\Users\Admin\AppData\Local\Temp\0dad4f633f78f484a1ea2a594390e0d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\llrfxrf.exec:\llrfxrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\7vjpd.exec:\7vjpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\lxlllrx.exec:\lxlllrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\3rflrxl.exec:\3rflrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\9hhhbb.exec:\9hhhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\vpjjp.exec:\vpjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\dpdvd.exec:\dpdvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\fflrlrf.exec:\fflrlrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\lfxrffr.exec:\lfxrffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\tttnnh.exec:\tttnnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\jjvpv.exec:\jjvpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\xxlxxrr.exec:\xxlxxrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\fxlflrf.exec:\fxlflrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\3btbbh.exec:\3btbbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\5bbhbh.exec:\5bbhbh.exe17⤵
- Executes dropped EXE
PID:2920 -
\??\c:\7pppj.exec:\7pppj.exe18⤵
- Executes dropped EXE
PID:2788 -
\??\c:\lflffrx.exec:\lflffrx.exe19⤵
- Executes dropped EXE
PID:2460 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe20⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nnnbnb.exec:\nnnbnb.exe21⤵
- Executes dropped EXE
PID:1428 -
\??\c:\vjjvp.exec:\vjjvp.exe22⤵
- Executes dropped EXE
PID:1100 -
\??\c:\vdpvp.exec:\vdpvp.exe23⤵
- Executes dropped EXE
PID:1896 -
\??\c:\lfffrrx.exec:\lfffrrx.exe24⤵
- Executes dropped EXE
PID:1104 -
\??\c:\lxfxllx.exec:\lxfxllx.exe25⤵
- Executes dropped EXE
PID:1976 -
\??\c:\nhthnn.exec:\nhthnn.exe26⤵
- Executes dropped EXE
PID:884 -
\??\c:\dpjjp.exec:\dpjjp.exe27⤵
- Executes dropped EXE
PID:1496 -
\??\c:\jvvvd.exec:\jvvvd.exe28⤵
- Executes dropped EXE
PID:1832 -
\??\c:\xrflxll.exec:\xrflxll.exe29⤵
- Executes dropped EXE
PID:748 -
\??\c:\fxrxffl.exec:\fxrxffl.exe30⤵
- Executes dropped EXE
PID:2028 -
\??\c:\3hbnnb.exec:\3hbnnb.exe31⤵
- Executes dropped EXE
PID:1604 -
\??\c:\dppvd.exec:\dppvd.exe32⤵
- Executes dropped EXE
PID:2156 -
\??\c:\jjjjd.exec:\jjjjd.exe33⤵
- Executes dropped EXE
PID:1648 -
\??\c:\xxlfrxr.exec:\xxlfrxr.exe34⤵
- Executes dropped EXE
PID:2424 -
\??\c:\5lfrxrl.exec:\5lfrxrl.exe35⤵
- Executes dropped EXE
PID:2752 -
\??\c:\1bhnnn.exec:\1bhnnn.exe36⤵
- Executes dropped EXE
PID:2812 -
\??\c:\7thnnh.exec:\7thnnh.exe37⤵
- Executes dropped EXE
PID:2940 -
\??\c:\3pvjj.exec:\3pvjj.exe38⤵
- Executes dropped EXE
PID:2412 -
\??\c:\vpjvd.exec:\vpjvd.exe39⤵
- Executes dropped EXE
PID:2780 -
\??\c:\1lxfllr.exec:\1lxfllr.exe40⤵
- Executes dropped EXE
PID:2664 -
\??\c:\rxxrrlx.exec:\rxxrrlx.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\tnhntt.exec:\tnhntt.exe42⤵
- Executes dropped EXE
PID:2604 -
\??\c:\3nbbhh.exec:\3nbbhh.exe43⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jjdvv.exec:\jjdvv.exe44⤵
- Executes dropped EXE
PID:532 -
\??\c:\dvjdp.exec:\dvjdp.exe45⤵
- Executes dropped EXE
PID:1632 -
\??\c:\fxxxflr.exec:\fxxxflr.exe46⤵
- Executes dropped EXE
PID:1540 -
\??\c:\rxxrlxl.exec:\rxxrlxl.exe47⤵
- Executes dropped EXE
PID:1168 -
\??\c:\nbbhbh.exec:\nbbhbh.exe48⤵
- Executes dropped EXE
PID:1440 -
\??\c:\nnhhtt.exec:\nnhhtt.exe49⤵
- Executes dropped EXE
PID:1924 -
\??\c:\tnnhbb.exec:\tnnhbb.exe50⤵
- Executes dropped EXE
PID:796 -
\??\c:\vdpvd.exec:\vdpvd.exe51⤵
- Executes dropped EXE
PID:2920 -
\??\c:\vddvj.exec:\vddvj.exe52⤵
- Executes dropped EXE
PID:2476 -
\??\c:\lxlffxf.exec:\lxlffxf.exe53⤵
- Executes dropped EXE
PID:2444 -
\??\c:\xrflfff.exec:\xrflfff.exe54⤵
- Executes dropped EXE
PID:880 -
\??\c:\1htbhh.exec:\1htbhh.exe55⤵
- Executes dropped EXE
PID:1352 -
\??\c:\nhbnnn.exec:\nhbnnn.exe56⤵
- Executes dropped EXE
PID:1108 -
\??\c:\3jdvd.exec:\3jdvd.exe57⤵
- Executes dropped EXE
PID:2176 -
\??\c:\7jvdp.exec:\7jvdp.exe58⤵
- Executes dropped EXE
PID:2284 -
\??\c:\vjjjp.exec:\vjjjp.exe59⤵
- Executes dropped EXE
PID:1312 -
\??\c:\xlfxlfl.exec:\xlfxlfl.exe60⤵
- Executes dropped EXE
PID:1768 -
\??\c:\rlxrlrf.exec:\rlxrlrf.exe61⤵
- Executes dropped EXE
PID:1580 -
\??\c:\5hhbhn.exec:\5hhbhn.exe62⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nhttbh.exec:\nhttbh.exe63⤵
- Executes dropped EXE
PID:660 -
\??\c:\ppjpp.exec:\ppjpp.exe64⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jvjdd.exec:\jvjdd.exe65⤵
- Executes dropped EXE
PID:2312 -
\??\c:\dpdvj.exec:\dpdvj.exe66⤵PID:2064
-
\??\c:\5rlfrfl.exec:\5rlfrfl.exe67⤵PID:1804
-
\??\c:\1flrffx.exec:\1flrffx.exe68⤵PID:2060
-
\??\c:\btbtbn.exec:\btbtbn.exe69⤵PID:2280
-
\??\c:\9nbnbn.exec:\9nbnbn.exe70⤵PID:2764
-
\??\c:\frrxrxr.exec:\frrxrxr.exe71⤵PID:2832
-
\??\c:\llrlrfx.exec:\llrlrfx.exe72⤵PID:2856
-
\??\c:\hhhnht.exec:\hhhnht.exe73⤵PID:2800
-
\??\c:\7hhtnb.exec:\7hhtnb.exe74⤵PID:2768
-
\??\c:\pvdjv.exec:\pvdjv.exe75⤵PID:2720
-
\??\c:\7ppvd.exec:\7ppvd.exe76⤵PID:2636
-
\??\c:\rfrlllr.exec:\rfrlllr.exe77⤵PID:2776
-
\??\c:\tnbhtb.exec:\tnbhtb.exe78⤵PID:3048
-
\??\c:\1btthn.exec:\1btthn.exe79⤵PID:1276
-
\??\c:\3hhhtt.exec:\3hhhtt.exe80⤵PID:2904
-
\??\c:\3ppvd.exec:\3ppvd.exe81⤵PID:1628
-
\??\c:\rlrxlrl.exec:\rlrxlrl.exe82⤵PID:352
-
\??\c:\1lfxlrl.exec:\1lfxlrl.exe83⤵PID:1200
-
\??\c:\thbhbh.exec:\thbhbh.exe84⤵PID:1236
-
\??\c:\1thhht.exec:\1thhht.exe85⤵PID:1988
-
\??\c:\hhbnbb.exec:\hhbnbb.exe86⤵PID:2452
-
\??\c:\dpjvd.exec:\dpjvd.exe87⤵PID:2944
-
\??\c:\5frrxfl.exec:\5frrxfl.exe88⤵PID:332
-
\??\c:\rlrxlrx.exec:\rlrxlrx.exe89⤵PID:2204
-
\??\c:\hbnbbh.exec:\hbnbbh.exe90⤵PID:284
-
\??\c:\bnbhbh.exec:\bnbhbh.exe91⤵PID:1088
-
\??\c:\7vjjp.exec:\7vjjp.exe92⤵PID:1132
-
\??\c:\jjvdj.exec:\jjvdj.exe93⤵PID:668
-
\??\c:\rllrlxx.exec:\rllrlxx.exe94⤵PID:1384
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe95⤵PID:1268
-
\??\c:\bbbhhb.exec:\bbbhhb.exe96⤵PID:288
-
\??\c:\hbnntb.exec:\hbnntb.exe97⤵PID:900
-
\??\c:\5dvdj.exec:\5dvdj.exe98⤵PID:1820
-
\??\c:\pjpvj.exec:\pjpvj.exe99⤵PID:1844
-
\??\c:\xfxlrff.exec:\xfxlrff.exe100⤵PID:876
-
\??\c:\nntbnt.exec:\nntbnt.exe101⤵PID:2972
-
\??\c:\hthtbh.exec:\hthtbh.exe102⤵PID:2348
-
\??\c:\vpjvp.exec:\vpjvp.exe103⤵PID:1600
-
\??\c:\jvdjv.exec:\jvdjv.exe104⤵PID:2500
-
\??\c:\vjpvj.exec:\vjpvj.exe105⤵PID:3056
-
\??\c:\rrrlfff.exec:\rrrlfff.exe106⤵PID:2484
-
\??\c:\5bnbnt.exec:\5bnbnt.exe107⤵PID:2716
-
\??\c:\bhhhnb.exec:\bhhhnb.exe108⤵PID:2732
-
\??\c:\jddjv.exec:\jddjv.exe109⤵PID:2724
-
\??\c:\vdpjv.exec:\vdpjv.exe110⤵PID:2964
-
\??\c:\rxllxxf.exec:\rxllxxf.exe111⤵PID:2624
-
\??\c:\lrrllff.exec:\lrrllff.exe112⤵PID:2616
-
\??\c:\thtnbb.exec:\thtnbb.exe113⤵PID:2680
-
\??\c:\nnhtbh.exec:\nnhtbh.exe114⤵PID:1744
-
\??\c:\9dpjp.exec:\9dpjp.exe115⤵PID:2632
-
\??\c:\lllxxrx.exec:\lllxxrx.exe116⤵PID:2604
-
\??\c:\lrffxxl.exec:\lrffxxl.exe117⤵PID:2816
-
\??\c:\nhhnbh.exec:\nhhnbh.exe118⤵PID:532
-
\??\c:\hhnttt.exec:\hhnttt.exe119⤵PID:1800
-
\??\c:\pjpdp.exec:\pjpdp.exe120⤵PID:1592
-
\??\c:\ddvpv.exec:\ddvpv.exe121⤵PID:1644
-
\??\c:\rrfrflr.exec:\rrfrflr.exe122⤵PID:1440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-