Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 04:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
611f830c43df40801bec26042ca23d10N.exe
Resource
win7-20240708-en
5 signatures
120 seconds
General
-
Target
611f830c43df40801bec26042ca23d10N.exe
-
Size
91KB
-
MD5
611f830c43df40801bec26042ca23d10
-
SHA1
6b8f774cee9934c71909dbfe47927e02472ba1f4
-
SHA256
9d09bfefcc2649a47237579d147468e751151853c51b628a25fe9ed815ebdfe5
-
SHA512
b2f9a18a4be28d69b156684bdcbbe833181a3f7c4c7761204807471a9462a7c24507c2450ec8403cb391e01e899aedfd3c5aef5be90a0431f133038ed914f965
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73t6MlYqn+jMp9jb+5C/ihfR:ymb3NkkiQ3mdBjFo73tvn+Yp9jb+5C/G
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/1992-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2076-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-63-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1232-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1544-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1164-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1732 xrflxfr.exe 2076 hbnbnt.exe 2064 9pjdp.exe 2720 xlffxrf.exe 2888 nhtbnt.exe 2920 djvvp.exe 2956 llxlflf.exe 2840 xfxfrxl.exe 2676 btntbn.exe 2484 jdvjp.exe 2392 vjvpv.exe 1144 fxxlllx.exe 2940 nhhthb.exe 1516 ntnhht.exe 2040 dvppv.exe 2864 vvjjv.exe 1232 lxrfrxl.exe 2988 1ttntb.exe 2964 vvvjp.exe 2236 jpjdd.exe 2196 5rllrfx.exe 1544 ttnnhn.exe 3060 pdjvj.exe 1388 pjjdv.exe 1800 xfrxxxr.exe 1648 hhttnn.exe 2032 9pjjv.exe 1164 lfrxlxf.exe 1756 ffrffrx.exe 1952 5nbbhb.exe 1580 9vdvj.exe 2092 jjjjj.exe 2400 rrflrrx.exe 3028 hbntbb.exe 112 nnntnb.exe 2760 7vvvp.exe 2812 1xxlflf.exe 2620 xrlxxxl.exe 2772 7tnbth.exe 2640 bbnbnn.exe 2852 jjpvv.exe 2632 7pjvj.exe 1312 1fxxxfr.exe 2148 fflrrrf.exe 1628 bbtbbb.exe 2868 7nbbht.exe 1584 3jjdj.exe 292 lrxxffx.exe 636 5rxrflx.exe 1296 rrrrrxl.exe 1948 ttntbh.exe 1812 dvvjv.exe 492 7jvdd.exe 2976 lxlflfl.exe 2056 3xxrllf.exe 2244 nhbtnn.exe 2708 tnhnbn.exe 2308 1pjvd.exe 2592 5pdpv.exe 1204 3pjdd.exe 352 xflxlxl.exe 1388 xrfllxr.exe 2788 ddvdv.exe 952 djvjv.exe -
resource yara_rule behavioral1/memory/1992-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1544-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1164-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1732 1992 611f830c43df40801bec26042ca23d10N.exe 30 PID 1992 wrote to memory of 1732 1992 611f830c43df40801bec26042ca23d10N.exe 30 PID 1992 wrote to memory of 1732 1992 611f830c43df40801bec26042ca23d10N.exe 30 PID 1992 wrote to memory of 1732 1992 611f830c43df40801bec26042ca23d10N.exe 30 PID 1732 wrote to memory of 2076 1732 xrflxfr.exe 31 PID 1732 wrote to memory of 2076 1732 xrflxfr.exe 31 PID 1732 wrote to memory of 2076 1732 xrflxfr.exe 31 PID 1732 wrote to memory of 2076 1732 xrflxfr.exe 31 PID 2076 wrote to memory of 2064 2076 hbnbnt.exe 32 PID 2076 wrote to memory of 2064 2076 hbnbnt.exe 32 PID 2076 wrote to memory of 2064 2076 hbnbnt.exe 32 PID 2076 wrote to memory of 2064 2076 hbnbnt.exe 32 PID 2064 wrote to memory of 2720 2064 9pjdp.exe 33 PID 2064 wrote to memory of 2720 2064 9pjdp.exe 33 PID 2064 wrote to memory of 2720 2064 9pjdp.exe 33 PID 2064 wrote to memory of 2720 2064 9pjdp.exe 33 PID 2720 wrote to memory of 2888 2720 xlffxrf.exe 34 PID 2720 wrote to memory of 2888 2720 xlffxrf.exe 34 PID 2720 wrote to memory of 2888 2720 xlffxrf.exe 34 PID 2720 wrote to memory of 2888 2720 xlffxrf.exe 34 PID 2888 wrote to memory of 2920 2888 nhtbnt.exe 35 PID 2888 wrote to memory of 2920 2888 nhtbnt.exe 35 PID 2888 wrote to memory of 2920 2888 nhtbnt.exe 35 PID 2888 wrote to memory of 2920 2888 nhtbnt.exe 35 PID 2920 wrote to memory of 2956 2920 djvvp.exe 36 PID 2920 wrote to memory of 2956 2920 djvvp.exe 36 PID 2920 wrote to memory of 2956 2920 djvvp.exe 36 PID 2920 wrote to memory of 2956 2920 djvvp.exe 36 PID 2956 wrote to memory of 2840 2956 llxlflf.exe 37 PID 2956 wrote to memory of 2840 2956 llxlflf.exe 37 PID 2956 wrote to memory of 2840 2956 llxlflf.exe 37 PID 2956 wrote to memory of 2840 2956 llxlflf.exe 37 PID 2840 wrote to memory of 2676 2840 xfxfrxl.exe 38 PID 2840 wrote to memory of 2676 2840 xfxfrxl.exe 38 PID 2840 wrote to memory of 2676 2840 xfxfrxl.exe 38 PID 2840 wrote to memory of 2676 2840 xfxfrxl.exe 38 PID 2676 wrote to memory of 2484 2676 btntbn.exe 39 PID 2676 wrote to memory of 2484 2676 btntbn.exe 39 PID 2676 wrote to memory of 2484 2676 btntbn.exe 39 PID 2676 wrote to memory of 2484 2676 btntbn.exe 39 PID 2484 wrote to memory of 2392 2484 jdvjp.exe 40 PID 2484 wrote to memory of 2392 2484 jdvjp.exe 40 PID 2484 wrote to memory of 2392 2484 jdvjp.exe 40 PID 2484 wrote to memory of 2392 2484 jdvjp.exe 40 PID 2392 wrote to memory of 1144 2392 vjvpv.exe 41 PID 2392 wrote to memory of 1144 2392 vjvpv.exe 41 PID 2392 wrote to memory of 1144 2392 vjvpv.exe 41 PID 2392 wrote to memory of 1144 2392 vjvpv.exe 41 PID 1144 wrote to memory of 2940 1144 fxxlllx.exe 42 PID 1144 wrote to memory of 2940 1144 fxxlllx.exe 42 PID 1144 wrote to memory of 2940 1144 fxxlllx.exe 42 PID 1144 wrote to memory of 2940 1144 fxxlllx.exe 42 PID 2940 wrote to memory of 1516 2940 nhhthb.exe 43 PID 2940 wrote to memory of 1516 2940 nhhthb.exe 43 PID 2940 wrote to memory of 1516 2940 nhhthb.exe 43 PID 2940 wrote to memory of 1516 2940 nhhthb.exe 43 PID 1516 wrote to memory of 2040 1516 ntnhht.exe 44 PID 1516 wrote to memory of 2040 1516 ntnhht.exe 44 PID 1516 wrote to memory of 2040 1516 ntnhht.exe 44 PID 1516 wrote to memory of 2040 1516 ntnhht.exe 44 PID 2040 wrote to memory of 2864 2040 dvppv.exe 45 PID 2040 wrote to memory of 2864 2040 dvppv.exe 45 PID 2040 wrote to memory of 2864 2040 dvppv.exe 45 PID 2040 wrote to memory of 2864 2040 dvppv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\611f830c43df40801bec26042ca23d10N.exe"C:\Users\Admin\AppData\Local\Temp\611f830c43df40801bec26042ca23d10N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\xrflxfr.exec:\xrflxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\hbnbnt.exec:\hbnbnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\9pjdp.exec:\9pjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\xlffxrf.exec:\xlffxrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\nhtbnt.exec:\nhtbnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\djvvp.exec:\djvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\llxlflf.exec:\llxlflf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\xfxfrxl.exec:\xfxfrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\btntbn.exec:\btntbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\jdvjp.exec:\jdvjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\vjvpv.exec:\vjvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\fxxlllx.exec:\fxxlllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\nhhthb.exec:\nhhthb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\ntnhht.exec:\ntnhht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\dvppv.exec:\dvppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\vvjjv.exec:\vvjjv.exe17⤵
- Executes dropped EXE
PID:2864 -
\??\c:\lxrfrxl.exec:\lxrfrxl.exe18⤵
- Executes dropped EXE
PID:1232 -
\??\c:\1ttntb.exec:\1ttntb.exe19⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vvvjp.exec:\vvvjp.exe20⤵
- Executes dropped EXE
PID:2964 -
\??\c:\jpjdd.exec:\jpjdd.exe21⤵
- Executes dropped EXE
PID:2236 -
\??\c:\5rllrfx.exec:\5rllrfx.exe22⤵
- Executes dropped EXE
PID:2196 -
\??\c:\ttnnhn.exec:\ttnnhn.exe23⤵
- Executes dropped EXE
PID:1544 -
\??\c:\pdjvj.exec:\pdjvj.exe24⤵
- Executes dropped EXE
PID:3060 -
\??\c:\pjjdv.exec:\pjjdv.exe25⤵
- Executes dropped EXE
PID:1388 -
\??\c:\xfrxxxr.exec:\xfrxxxr.exe26⤵
- Executes dropped EXE
PID:1800 -
\??\c:\hhttnn.exec:\hhttnn.exe27⤵
- Executes dropped EXE
PID:1648 -
\??\c:\9pjjv.exec:\9pjjv.exe28⤵
- Executes dropped EXE
PID:2032 -
\??\c:\lfrxlxf.exec:\lfrxlxf.exe29⤵
- Executes dropped EXE
PID:1164 -
\??\c:\ffrffrx.exec:\ffrffrx.exe30⤵
- Executes dropped EXE
PID:1756 -
\??\c:\5nbbhb.exec:\5nbbhb.exe31⤵
- Executes dropped EXE
PID:1952 -
\??\c:\9vdvj.exec:\9vdvj.exe32⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jjjjj.exec:\jjjjj.exe33⤵
- Executes dropped EXE
PID:2092 -
\??\c:\rrflrrx.exec:\rrflrrx.exe34⤵
- Executes dropped EXE
PID:2400 -
\??\c:\hbntbb.exec:\hbntbb.exe35⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nnntnb.exec:\nnntnb.exe36⤵
- Executes dropped EXE
PID:112 -
\??\c:\7vvvp.exec:\7vvvp.exe37⤵
- Executes dropped EXE
PID:2760 -
\??\c:\1xxlflf.exec:\1xxlflf.exe38⤵
- Executes dropped EXE
PID:2812 -
\??\c:\xrlxxxl.exec:\xrlxxxl.exe39⤵
- Executes dropped EXE
PID:2620 -
\??\c:\7tnbth.exec:\7tnbth.exe40⤵
- Executes dropped EXE
PID:2772 -
\??\c:\bbnbnn.exec:\bbnbnn.exe41⤵
- Executes dropped EXE
PID:2640 -
\??\c:\jjpvv.exec:\jjpvv.exe42⤵
- Executes dropped EXE
PID:2852 -
\??\c:\7pjvj.exec:\7pjvj.exe43⤵
- Executes dropped EXE
PID:2632 -
\??\c:\1fxxxfr.exec:\1fxxxfr.exe44⤵
- Executes dropped EXE
PID:1312 -
\??\c:\fflrrrf.exec:\fflrrrf.exe45⤵
- Executes dropped EXE
PID:2148 -
\??\c:\bbtbbb.exec:\bbtbbb.exe46⤵
- Executes dropped EXE
PID:1628 -
\??\c:\7nbbht.exec:\7nbbht.exe47⤵
- Executes dropped EXE
PID:2868 -
\??\c:\3jjdj.exec:\3jjdj.exe48⤵
- Executes dropped EXE
PID:1584 -
\??\c:\lrxxffx.exec:\lrxxffx.exe49⤵
- Executes dropped EXE
PID:292 -
\??\c:\5rxrflx.exec:\5rxrflx.exe50⤵
- Executes dropped EXE
PID:636 -
\??\c:\rrrrrxl.exec:\rrrrrxl.exe51⤵
- Executes dropped EXE
PID:1296 -
\??\c:\ttntbh.exec:\ttntbh.exe52⤵
- Executes dropped EXE
PID:1948 -
\??\c:\dvvjv.exec:\dvvjv.exe53⤵
- Executes dropped EXE
PID:1812 -
\??\c:\7jvdd.exec:\7jvdd.exe54⤵
- Executes dropped EXE
PID:492 -
\??\c:\lxlflfl.exec:\lxlflfl.exe55⤵
- Executes dropped EXE
PID:2976 -
\??\c:\3xxrllf.exec:\3xxrllf.exe56⤵
- Executes dropped EXE
PID:2056 -
\??\c:\nhbtnn.exec:\nhbtnn.exe57⤵
- Executes dropped EXE
PID:2244 -
\??\c:\tnhnbn.exec:\tnhnbn.exe58⤵
- Executes dropped EXE
PID:2708 -
\??\c:\1pjvd.exec:\1pjvd.exe59⤵
- Executes dropped EXE
PID:2308 -
\??\c:\5pdpv.exec:\5pdpv.exe60⤵
- Executes dropped EXE
PID:2592 -
\??\c:\3pjdd.exec:\3pjdd.exe61⤵
- Executes dropped EXE
PID:1204 -
\??\c:\xflxlxl.exec:\xflxlxl.exe62⤵
- Executes dropped EXE
PID:352 -
\??\c:\xrfllxr.exec:\xrfllxr.exe63⤵
- Executes dropped EXE
PID:1388 -
\??\c:\ddvdv.exec:\ddvdv.exe64⤵
- Executes dropped EXE
PID:2788 -
\??\c:\djvjv.exec:\djvjv.exe65⤵
- Executes dropped EXE
PID:952 -
\??\c:\flrxflx.exec:\flrxflx.exe66⤵PID:2312
-
\??\c:\rlrxxxl.exec:\rlrxxxl.exe67⤵PID:2032
-
\??\c:\bbthth.exec:\bbthth.exe68⤵PID:2256
-
\??\c:\hbthnb.exec:\hbthnb.exe69⤵PID:1960
-
\??\c:\jjdjv.exec:\jjdjv.exe70⤵PID:2088
-
\??\c:\vvjdj.exec:\vvjdj.exe71⤵PID:2368
-
\??\c:\frlfrlf.exec:\frlfrlf.exe72⤵PID:1732
-
\??\c:\rlrxlrf.exec:\rlrxlrf.exe73⤵PID:2092
-
\??\c:\5thbhn.exec:\5thbhn.exe74⤵PID:2400
-
\??\c:\bbnnnn.exec:\bbnnnn.exe75⤵PID:3028
-
\??\c:\ddjjp.exec:\ddjjp.exe76⤵PID:2816
-
\??\c:\ppjjp.exec:\ppjjp.exe77⤵PID:2760
-
\??\c:\llrrffr.exec:\llrrffr.exe78⤵PID:2888
-
\??\c:\xlfrflx.exec:\xlfrflx.exe79⤵PID:2620
-
\??\c:\bnbbbt.exec:\bnbbbt.exe80⤵PID:2916
-
\??\c:\tththn.exec:\tththn.exe81⤵PID:2640
-
\??\c:\ppvpj.exec:\ppvpj.exe82⤵PID:2356
-
\??\c:\vdjdj.exec:\vdjdj.exe83⤵PID:2632
-
\??\c:\fxfflll.exec:\fxfflll.exe84⤵PID:1312
-
\??\c:\lxlxlrf.exec:\lxlxlrf.exe85⤵PID:2148
-
\??\c:\bbtbnt.exec:\bbtbnt.exe86⤵PID:1628
-
\??\c:\bthhtb.exec:\bthhtb.exe87⤵PID:2868
-
\??\c:\jvpvv.exec:\jvpvv.exe88⤵PID:2004
-
\??\c:\dpjpd.exec:\dpjpd.exe89⤵PID:1860
-
\??\c:\xlflrxf.exec:\xlflrxf.exe90⤵PID:1516
-
\??\c:\rfrxffr.exec:\rfrxffr.exe91⤵PID:1296
-
\??\c:\thhnht.exec:\thhnht.exe92⤵PID:1948
-
\??\c:\hnhhnt.exec:\hnhhnt.exe93⤵PID:1812
-
\??\c:\pdpvj.exec:\pdpvj.exe94⤵PID:2960
-
\??\c:\dvddd.exec:\dvddd.exe95⤵PID:2976
-
\??\c:\ddpjd.exec:\ddpjd.exe96⤵PID:2116
-
\??\c:\xxffrxr.exec:\xxffrxr.exe97⤵PID:2244
-
\??\c:\9ffrxxr.exec:\9ffrxxr.exe98⤵PID:2236
-
\??\c:\7hbhnb.exec:\7hbhnb.exe99⤵PID:2308
-
\??\c:\7hthnn.exec:\7hthnn.exe100⤵PID:1364
-
\??\c:\dvdpd.exec:\dvdpd.exe101⤵PID:1716
-
\??\c:\pjppp.exec:\pjppp.exe102⤵PID:1620
-
\??\c:\3xrrrrf.exec:\3xrrrrf.exe103⤵PID:2992
-
\??\c:\1lflxfl.exec:\1lflxfl.exe104⤵PID:2788
-
\??\c:\ntnbht.exec:\ntnbht.exe105⤵PID:952
-
\??\c:\hhhtbh.exec:\hhhtbh.exe106⤵PID:1492
-
\??\c:\dpjjp.exec:\dpjjp.exe107⤵PID:2296
-
\??\c:\pjvpd.exec:\pjvpd.exe108⤵PID:2256
-
\??\c:\xrfflrl.exec:\xrfflrl.exe109⤵PID:3036
-
\??\c:\5rllllx.exec:\5rllllx.exe110⤵PID:2088
-
\??\c:\tthhbb.exec:\tthhbb.exe111⤵PID:1328
-
\??\c:\tnhtnn.exec:\tnhtnn.exe112⤵PID:1732
-
\??\c:\jdvdv.exec:\jdvdv.exe113⤵PID:2092
-
\??\c:\ppdjp.exec:\ppdjp.exe114⤵PID:2704
-
\??\c:\3ffrllx.exec:\3ffrllx.exe115⤵PID:3028
-
\??\c:\xrflxfl.exec:\xrflxfl.exe116⤵PID:2816
-
\??\c:\7llrrxl.exec:\7llrrxl.exe117⤵PID:2760
-
\??\c:\tbbnbh.exec:\tbbnbh.exe118⤵PID:2804
-
\??\c:\pdvvv.exec:\pdvvv.exe119⤵PID:3008
-
\??\c:\jjjjv.exec:\jjjjv.exe120⤵PID:2916
-
\??\c:\1xrxrrl.exec:\1xrxrrl.exe121⤵PID:2640
-
\??\c:\ffrxlrf.exec:\ffrxlrf.exe122⤵PID:2688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-