Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 02:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4a04b995c76bea63aa5506ef207b14c0N.exe
Resource
win7-20240705-en
5 signatures
120 seconds
General
-
Target
4a04b995c76bea63aa5506ef207b14c0N.exe
-
Size
84KB
-
MD5
4a04b995c76bea63aa5506ef207b14c0
-
SHA1
6a3d17bf13b1c9bf56c77a402601180794a88fa7
-
SHA256
d4ebf26331f099007e4a8a76193ec05e22e059d56c1b15640e03103afe361e31
-
SHA512
025415cb187ef3c4dfa67b7db3e6b73bbf144b37f996efd0eeec7e3b5a2bfe9c2f0fb70c2d08f1fc23a889726606ac5afddc7edec38644854c2b30d9551b2d26
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JkZPsv8t5:ymb3NkkiQ3mdBjFIWeFGyA9Pzt5
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/3040-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-70-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1160-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/952-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-835-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2384 xrxfrlf.exe 3052 htnbhh.exe 2680 vppdv.exe 2716 rrrfflr.exe 2796 nhbbnn.exe 2704 ddjvd.exe 2916 rrfrlxr.exe 2644 5bbhtb.exe 1744 tnbnbh.exe 2044 ppppj.exe 1588 rlxrflf.exe 1160 xrlxrrf.exe 1952 xxrlrfl.exe 1648 vvjjp.exe 1712 fxxfflx.exe 1872 fxrlrrl.exe 2880 bnnhtn.exe 2248 dvppv.exe 2436 5rlllxl.exe 1584 nbnntb.exe 952 hbnbhh.exe 2428 dvpvj.exe 1272 jjvvj.exe 2540 9ffrfrx.exe 2068 tnbhtb.exe 2528 btnnbh.exe 1492 1vjpj.exe 2940 xxrxlxf.exe 1612 5ttttb.exe 2476 hbhhhb.exe 588 pjvdj.exe 2316 lxrlrlx.exe 1604 5rfxxfx.exe 2692 9tttnt.exe 2836 tntthh.exe 2232 3vjjp.exe 2828 rlffxxf.exe 2624 5rrlflf.exe 2704 9nbhtt.exe 2756 tnbnbn.exe 2604 pjdjp.exe 3064 jdjpj.exe 3016 xlllrrx.exe 680 5xxflrl.exe 1972 tthhtb.exe 1688 3hbhnh.exe 1936 vppdj.exe 1748 3fxlllr.exe 2484 5lrflrf.exe 1060 hthhhh.exe 1712 7hbbnh.exe 2656 5jjpd.exe 528 1dpvd.exe 3060 rlfllrf.exe 2252 lxxxlff.exe 2452 btbhtt.exe 408 5vppv.exe 1444 vpdjp.exe 2920 xlffllr.exe 2148 rfxrlff.exe 1272 hnhhht.exe 1784 thtbbb.exe 1320 vdppp.exe 2536 pdvpv.exe -
resource yara_rule behavioral1/memory/3040-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1160-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/952-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-835-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2384 3040 4a04b995c76bea63aa5506ef207b14c0N.exe 31 PID 3040 wrote to memory of 2384 3040 4a04b995c76bea63aa5506ef207b14c0N.exe 31 PID 3040 wrote to memory of 2384 3040 4a04b995c76bea63aa5506ef207b14c0N.exe 31 PID 3040 wrote to memory of 2384 3040 4a04b995c76bea63aa5506ef207b14c0N.exe 31 PID 2384 wrote to memory of 3052 2384 xrxfrlf.exe 32 PID 2384 wrote to memory of 3052 2384 xrxfrlf.exe 32 PID 2384 wrote to memory of 3052 2384 xrxfrlf.exe 32 PID 2384 wrote to memory of 3052 2384 xrxfrlf.exe 32 PID 3052 wrote to memory of 2680 3052 htnbhh.exe 33 PID 3052 wrote to memory of 2680 3052 htnbhh.exe 33 PID 3052 wrote to memory of 2680 3052 htnbhh.exe 33 PID 3052 wrote to memory of 2680 3052 htnbhh.exe 33 PID 2680 wrote to memory of 2716 2680 vppdv.exe 34 PID 2680 wrote to memory of 2716 2680 vppdv.exe 34 PID 2680 wrote to memory of 2716 2680 vppdv.exe 34 PID 2680 wrote to memory of 2716 2680 vppdv.exe 34 PID 2716 wrote to memory of 2796 2716 rrrfflr.exe 35 PID 2716 wrote to memory of 2796 2716 rrrfflr.exe 35 PID 2716 wrote to memory of 2796 2716 rrrfflr.exe 35 PID 2716 wrote to memory of 2796 2716 rrrfflr.exe 35 PID 2796 wrote to memory of 2704 2796 nhbbnn.exe 36 PID 2796 wrote to memory of 2704 2796 nhbbnn.exe 36 PID 2796 wrote to memory of 2704 2796 nhbbnn.exe 36 PID 2796 wrote to memory of 2704 2796 nhbbnn.exe 36 PID 2704 wrote to memory of 2916 2704 ddjvd.exe 37 PID 2704 wrote to memory of 2916 2704 ddjvd.exe 37 PID 2704 wrote to memory of 2916 2704 ddjvd.exe 37 PID 2704 wrote to memory of 2916 2704 ddjvd.exe 37 PID 2916 wrote to memory of 2644 2916 rrfrlxr.exe 38 PID 2916 wrote to memory of 2644 2916 rrfrlxr.exe 38 PID 2916 wrote to memory of 2644 2916 rrfrlxr.exe 38 PID 2916 wrote to memory of 2644 2916 rrfrlxr.exe 38 PID 2644 wrote to memory of 1744 2644 5bbhtb.exe 39 PID 2644 wrote to memory of 1744 2644 5bbhtb.exe 39 PID 2644 wrote to memory of 1744 2644 5bbhtb.exe 39 PID 2644 wrote to memory of 1744 2644 5bbhtb.exe 39 PID 1744 wrote to memory of 2044 1744 tnbnbh.exe 40 PID 1744 wrote to memory of 2044 1744 tnbnbh.exe 40 PID 1744 wrote to memory of 2044 1744 tnbnbh.exe 40 PID 1744 wrote to memory of 2044 1744 tnbnbh.exe 40 PID 2044 wrote to memory of 1588 2044 ppppj.exe 41 PID 2044 wrote to memory of 1588 2044 ppppj.exe 41 PID 2044 wrote to memory of 1588 2044 ppppj.exe 41 PID 2044 wrote to memory of 1588 2044 ppppj.exe 41 PID 1588 wrote to memory of 1160 1588 rlxrflf.exe 42 PID 1588 wrote to memory of 1160 1588 rlxrflf.exe 42 PID 1588 wrote to memory of 1160 1588 rlxrflf.exe 42 PID 1588 wrote to memory of 1160 1588 rlxrflf.exe 42 PID 1160 wrote to memory of 1952 1160 xrlxrrf.exe 43 PID 1160 wrote to memory of 1952 1160 xrlxrrf.exe 43 PID 1160 wrote to memory of 1952 1160 xrlxrrf.exe 43 PID 1160 wrote to memory of 1952 1160 xrlxrrf.exe 43 PID 1952 wrote to memory of 1648 1952 xxrlrfl.exe 44 PID 1952 wrote to memory of 1648 1952 xxrlrfl.exe 44 PID 1952 wrote to memory of 1648 1952 xxrlrfl.exe 44 PID 1952 wrote to memory of 1648 1952 xxrlrfl.exe 44 PID 1648 wrote to memory of 1712 1648 vvjjp.exe 45 PID 1648 wrote to memory of 1712 1648 vvjjp.exe 45 PID 1648 wrote to memory of 1712 1648 vvjjp.exe 45 PID 1648 wrote to memory of 1712 1648 vvjjp.exe 45 PID 1712 wrote to memory of 1872 1712 fxxfflx.exe 46 PID 1712 wrote to memory of 1872 1712 fxxfflx.exe 46 PID 1712 wrote to memory of 1872 1712 fxxfflx.exe 46 PID 1712 wrote to memory of 1872 1712 fxxfflx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a04b995c76bea63aa5506ef207b14c0N.exe"C:\Users\Admin\AppData\Local\Temp\4a04b995c76bea63aa5506ef207b14c0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\xrxfrlf.exec:\xrxfrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\htnbhh.exec:\htnbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\vppdv.exec:\vppdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\rrrfflr.exec:\rrrfflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\nhbbnn.exec:\nhbbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\ddjvd.exec:\ddjvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\rrfrlxr.exec:\rrfrlxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\5bbhtb.exec:\5bbhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\tnbnbh.exec:\tnbnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\ppppj.exec:\ppppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\rlxrflf.exec:\rlxrflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\xrlxrrf.exec:\xrlxrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\xxrlrfl.exec:\xxrlrfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\vvjjp.exec:\vvjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\fxxfflx.exec:\fxxfflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\fxrlrrl.exec:\fxrlrrl.exe17⤵
- Executes dropped EXE
PID:1872 -
\??\c:\bnnhtn.exec:\bnnhtn.exe18⤵
- Executes dropped EXE
PID:2880 -
\??\c:\dvppv.exec:\dvppv.exe19⤵
- Executes dropped EXE
PID:2248 -
\??\c:\5rlllxl.exec:\5rlllxl.exe20⤵
- Executes dropped EXE
PID:2436 -
\??\c:\nbnntb.exec:\nbnntb.exe21⤵
- Executes dropped EXE
PID:1584 -
\??\c:\hbnbhh.exec:\hbnbhh.exe22⤵
- Executes dropped EXE
PID:952 -
\??\c:\dvpvj.exec:\dvpvj.exe23⤵
- Executes dropped EXE
PID:2428 -
\??\c:\jjvvj.exec:\jjvvj.exe24⤵
- Executes dropped EXE
PID:1272 -
\??\c:\9ffrfrx.exec:\9ffrfrx.exe25⤵
- Executes dropped EXE
PID:2540 -
\??\c:\tnbhtb.exec:\tnbhtb.exe26⤵
- Executes dropped EXE
PID:2068 -
\??\c:\btnnbh.exec:\btnnbh.exe27⤵
- Executes dropped EXE
PID:2528 -
\??\c:\1vjpj.exec:\1vjpj.exe28⤵
- Executes dropped EXE
PID:1492 -
\??\c:\xxrxlxf.exec:\xxrxlxf.exe29⤵
- Executes dropped EXE
PID:2940 -
\??\c:\5ttttb.exec:\5ttttb.exe30⤵
- Executes dropped EXE
PID:1612 -
\??\c:\hbhhhb.exec:\hbhhhb.exe31⤵
- Executes dropped EXE
PID:2476 -
\??\c:\pjvdj.exec:\pjvdj.exe32⤵
- Executes dropped EXE
PID:588 -
\??\c:\lxrlrlx.exec:\lxrlrlx.exe33⤵
- Executes dropped EXE
PID:2316 -
\??\c:\5rfxxfx.exec:\5rfxxfx.exe34⤵
- Executes dropped EXE
PID:1604 -
\??\c:\9tttnt.exec:\9tttnt.exe35⤵
- Executes dropped EXE
PID:2692 -
\??\c:\tntthh.exec:\tntthh.exe36⤵
- Executes dropped EXE
PID:2836 -
\??\c:\3vjjp.exec:\3vjjp.exe37⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rlffxxf.exec:\rlffxxf.exe38⤵
- Executes dropped EXE
PID:2828 -
\??\c:\5rrlflf.exec:\5rrlflf.exe39⤵
- Executes dropped EXE
PID:2624 -
\??\c:\9nbhtt.exec:\9nbhtt.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\tnbnbn.exec:\tnbnbn.exe41⤵
- Executes dropped EXE
PID:2756 -
\??\c:\pjdjp.exec:\pjdjp.exe42⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jdjpj.exec:\jdjpj.exe43⤵
- Executes dropped EXE
PID:3064 -
\??\c:\xlllrrx.exec:\xlllrrx.exe44⤵
- Executes dropped EXE
PID:3016 -
\??\c:\5xxflrl.exec:\5xxflrl.exe45⤵
- Executes dropped EXE
PID:680 -
\??\c:\tthhtb.exec:\tthhtb.exe46⤵
- Executes dropped EXE
PID:1972 -
\??\c:\3hbhnh.exec:\3hbhnh.exe47⤵
- Executes dropped EXE
PID:1688 -
\??\c:\vppdj.exec:\vppdj.exe48⤵
- Executes dropped EXE
PID:1936 -
\??\c:\3fxlllr.exec:\3fxlllr.exe49⤵
- Executes dropped EXE
PID:1748 -
\??\c:\5lrflrf.exec:\5lrflrf.exe50⤵
- Executes dropped EXE
PID:2484 -
\??\c:\hthhhh.exec:\hthhhh.exe51⤵
- Executes dropped EXE
PID:1060 -
\??\c:\7hbbnh.exec:\7hbbnh.exe52⤵
- Executes dropped EXE
PID:1712 -
\??\c:\5jjpd.exec:\5jjpd.exe53⤵
- Executes dropped EXE
PID:2656 -
\??\c:\1dpvd.exec:\1dpvd.exe54⤵
- Executes dropped EXE
PID:528 -
\??\c:\rlfllrf.exec:\rlfllrf.exe55⤵
- Executes dropped EXE
PID:3060 -
\??\c:\lxxxlff.exec:\lxxxlff.exe56⤵
- Executes dropped EXE
PID:2252 -
\??\c:\btbhtt.exec:\btbhtt.exe57⤵
- Executes dropped EXE
PID:2452 -
\??\c:\5vppv.exec:\5vppv.exe58⤵
- Executes dropped EXE
PID:408 -
\??\c:\vpdjp.exec:\vpdjp.exe59⤵
- Executes dropped EXE
PID:1444 -
\??\c:\xlffllr.exec:\xlffllr.exe60⤵
- Executes dropped EXE
PID:2920 -
\??\c:\rfxrlff.exec:\rfxrlff.exe61⤵
- Executes dropped EXE
PID:2148 -
\??\c:\hnhhht.exec:\hnhhht.exe62⤵
- Executes dropped EXE
PID:1272 -
\??\c:\thtbbb.exec:\thtbbb.exe63⤵
- Executes dropped EXE
PID:1784 -
\??\c:\vdppp.exec:\vdppp.exe64⤵
- Executes dropped EXE
PID:1320 -
\??\c:\pdvpv.exec:\pdvpv.exe65⤵
- Executes dropped EXE
PID:2536 -
\??\c:\rfrlxxf.exec:\rfrlxxf.exe66⤵PID:1728
-
\??\c:\xlxlrxf.exec:\xlxlrxf.exe67⤵PID:2380
-
\??\c:\bhbtbb.exec:\bhbtbb.exe68⤵PID:900
-
\??\c:\thhntb.exec:\thhntb.exe69⤵PID:2196
-
\??\c:\vdvdd.exec:\vdvdd.exe70⤵PID:1724
-
\??\c:\pjdjj.exec:\pjdjj.exe71⤵PID:2496
-
\??\c:\rfrllll.exec:\rfrllll.exe72⤵PID:3052
-
\??\c:\xrxllxf.exec:\xrxllxf.exe73⤵PID:1608
-
\??\c:\3hnbhb.exec:\3hnbhb.exe74⤵PID:2368
-
\??\c:\3jjvj.exec:\3jjvj.exe75⤵PID:2692
-
\??\c:\ddppv.exec:\ddppv.exe76⤵PID:2812
-
\??\c:\xffxxlx.exec:\xffxxlx.exe77⤵PID:2744
-
\??\c:\llrfxxf.exec:\llrfxxf.exe78⤵PID:2844
-
\??\c:\bbnttb.exec:\bbnttb.exe79⤵PID:2624
-
\??\c:\3htthh.exec:\3htthh.exe80⤵PID:2820
-
\??\c:\dvjvd.exec:\dvjvd.exe81⤵PID:2756
-
\??\c:\pdjpv.exec:\pdjpv.exe82⤵PID:2200
-
\??\c:\pdjpp.exec:\pdjpp.exe83⤵PID:3064
-
\??\c:\3rfflrx.exec:\3rfflrx.exe84⤵PID:1744
-
\??\c:\xrrrfxf.exec:\xrrrfxf.exe85⤵PID:680
-
\??\c:\btnntt.exec:\btnntt.exe86⤵PID:1116
-
\??\c:\hbttbb.exec:\hbttbb.exe87⤵PID:2264
-
\??\c:\9djjv.exec:\9djjv.exe88⤵PID:1676
-
\??\c:\7rlfrrr.exec:\7rlfrrr.exe89⤵PID:1748
-
\??\c:\rlxlxlr.exec:\rlxlxlr.exe90⤵PID:1932
-
\??\c:\nhtthn.exec:\nhtthn.exe91⤵PID:1060
-
\??\c:\bnhbnh.exec:\bnhbnh.exe92⤵PID:2904
-
\??\c:\1dvvd.exec:\1dvvd.exe93⤵PID:2656
-
\??\c:\5jjjp.exec:\5jjjp.exe94⤵PID:2468
-
\??\c:\vjjjv.exec:\vjjjv.exe95⤵PID:3060
-
\??\c:\lxfxlfr.exec:\lxfxlfr.exe96⤵PID:2240
-
\??\c:\nbhhnh.exec:\nbhhnh.exe97⤵PID:2216
-
\??\c:\hthntn.exec:\hthntn.exe98⤵PID:448
-
\??\c:\1djpp.exec:\1djpp.exe99⤵PID:1444
-
\??\c:\ppdpv.exec:\ppdpv.exe100⤵PID:2428
-
\??\c:\vjvpp.exec:\vjvpp.exe101⤵PID:1620
-
\??\c:\rlxxlrf.exec:\rlxxlrf.exe102⤵PID:2272
-
\??\c:\3fxrlfx.exec:\3fxrlfx.exe103⤵PID:1784
-
\??\c:\5bntbh.exec:\5bntbh.exe104⤵PID:2068
-
\??\c:\3hntnh.exec:\3hntnh.exe105⤵PID:2536
-
\??\c:\jvjjp.exec:\jvjjp.exe106⤵PID:2024
-
\??\c:\jdjdj.exec:\jdjdj.exe107⤵PID:2380
-
\??\c:\frrrrrx.exec:\frrrrrx.exe108⤵PID:3040
-
\??\c:\1rlxfll.exec:\1rlxfll.exe109⤵PID:2196
-
\??\c:\nbnhhn.exec:\nbnhhn.exe110⤵PID:1992
-
\??\c:\5bhtth.exec:\5bhtth.exe111⤵PID:2336
-
\??\c:\5jvdd.exec:\5jvdd.exe112⤵PID:3052
-
\??\c:\dpdvd.exec:\dpdvd.exe113⤵PID:2792
-
\??\c:\frflrxf.exec:\frflrxf.exe114⤵PID:2368
-
\??\c:\9xllrrx.exec:\9xllrrx.exe115⤵PID:2736
-
\??\c:\htbtbb.exec:\htbtbb.exe116⤵PID:2812
-
\??\c:\3tthtt.exec:\3tthtt.exe117⤵PID:2816
-
\??\c:\5tnhhn.exec:\5tnhhn.exe118⤵PID:2852
-
\??\c:\1dpvd.exec:\1dpvd.exe119⤵PID:2592
-
\??\c:\5dpjp.exec:\5dpjp.exe120⤵PID:2820
-
\??\c:\xlllrlx.exec:\xlllrlx.exe121⤵PID:2604
-
\??\c:\rfxxfll.exec:\rfxxfll.exe122⤵PID:2200
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-