Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/05/2024, 22:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
613d37b6990686d1e736de5831d4f1eddc02d4da14a96d61a6299e6121db7838.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
613d37b6990686d1e736de5831d4f1eddc02d4da14a96d61a6299e6121db7838.exe
-
Size
61KB
-
MD5
a97534461296a2b3717f35799cda42db
-
SHA1
75768978304ea13db6f7fc56c5894c46f93a2d45
-
SHA256
613d37b6990686d1e736de5831d4f1eddc02d4da14a96d61a6299e6121db7838
-
SHA512
9e3deef09562d0b3ea8f4208777f5b9eaddbe5777add714aab82c7cfac2c9c540bd59e819554a652edabaeaae6c384e55b131af092fcbd42f478b13b8c39d87a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDII9ZvHKEz:ymb3NkkiQ3mdBjFII9ZvHKEz
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2056-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/768-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1008-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1832-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/784-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1120-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral1/memory/2980-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2744-30-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2056-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2980-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2496-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2672-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2488-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2488-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2488-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2488-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2444-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2444-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2416-81-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2416-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2476-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2476-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/768-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1008-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2572-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1912-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1540-161-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2180-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1832-223-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/784-250-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1624-259-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1120-268-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2056 txrfbt.exe 2744 rpdtdxx.exe 2496 vxxjhrv.exe 2672 hnbfnjv.exe 2488 bxhlrll.exe 2444 rfndfh.exe 2416 ftldjp.exe 2476 nrdffj.exe 768 nlthxh.exe 1008 rfdld.exe 1216 vjfxt.exe 2340 dfdhtj.exe 2572 dldvjv.exe 1912 pxtjl.exe 1540 tpvxln.exe 2180 lbpfx.exe 1692 rtrlf.exe 1592 fvnblf.exe 2740 blxpp.exe 772 dlfxtrl.exe 2212 rjlldnx.exe 1832 ptjddlr.exe 436 llrpfhv.exe 1264 npvnt.exe 784 nlbxb.exe 1624 pttjl.exe 1120 hnnxrtr.exe 1048 hjfhrt.exe 2300 xtfpf.exe 1848 pvpjdh.exe 3056 vdhhxl.exe 884 pnfdfl.exe 2292 nfpln.exe 2276 vjpjxlx.exe 1608 hdhjf.exe 2464 ppdll.exe 2620 bxrhnv.exe 2632 trlbrj.exe 2656 vxpld.exe 2472 vbhfdp.exe 2548 rlrph.exe 2380 tpnlphh.exe 2368 fddxb.exe 2468 nxlppt.exe 2396 xphpxv.exe 1056 jfdnrl.exe 2432 ntpbpp.exe 696 npllvr.exe 2400 jnbbh.exe 1012 xtvnvvf.exe 2588 jvtddp.exe 2556 tbpldjl.exe 1252 jlnvlp.exe 636 njhnnjx.exe 2000 xhnrbv.exe 1696 vpthxph.exe 1692 dvvtxvt.exe 3028 dpxbl.exe 1112 jjtddl.exe 592 xdbjn.exe 2452 hfflnjj.exe 2212 brdjj.exe 2232 xdhrnhd.exe 1244 nptbfj.exe -
resource yara_rule behavioral1/memory/2980-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1008-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1832-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/784-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1120-268-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2056 2980 613d37b6990686d1e736de5831d4f1eddc02d4da14a96d61a6299e6121db7838.exe 28 PID 2980 wrote to memory of 2056 2980 613d37b6990686d1e736de5831d4f1eddc02d4da14a96d61a6299e6121db7838.exe 28 PID 2980 wrote to memory of 2056 2980 613d37b6990686d1e736de5831d4f1eddc02d4da14a96d61a6299e6121db7838.exe 28 PID 2980 wrote to memory of 2056 2980 613d37b6990686d1e736de5831d4f1eddc02d4da14a96d61a6299e6121db7838.exe 28 PID 2056 wrote to memory of 2744 2056 txrfbt.exe 29 PID 2056 wrote to memory of 2744 2056 txrfbt.exe 29 PID 2056 wrote to memory of 2744 2056 txrfbt.exe 29 PID 2056 wrote to memory of 2744 2056 txrfbt.exe 29 PID 2744 wrote to memory of 2496 2744 rpdtdxx.exe 30 PID 2744 wrote to memory of 2496 2744 rpdtdxx.exe 30 PID 2744 wrote to memory of 2496 2744 rpdtdxx.exe 30 PID 2744 wrote to memory of 2496 2744 rpdtdxx.exe 30 PID 2496 wrote to memory of 2672 2496 vxxjhrv.exe 31 PID 2496 wrote to memory of 2672 2496 vxxjhrv.exe 31 PID 2496 wrote to memory of 2672 2496 vxxjhrv.exe 31 PID 2496 wrote to memory of 2672 2496 vxxjhrv.exe 31 PID 2672 wrote to memory of 2488 2672 hnbfnjv.exe 32 PID 2672 wrote to memory of 2488 2672 hnbfnjv.exe 32 PID 2672 wrote to memory of 2488 2672 hnbfnjv.exe 32 PID 2672 wrote to memory of 2488 2672 hnbfnjv.exe 32 PID 2488 wrote to memory of 2444 2488 bxhlrll.exe 33 PID 2488 wrote to memory of 2444 2488 bxhlrll.exe 33 PID 2488 wrote to memory of 2444 2488 bxhlrll.exe 33 PID 2488 wrote to memory of 2444 2488 bxhlrll.exe 33 PID 2444 wrote to memory of 2416 2444 rfndfh.exe 34 PID 2444 wrote to memory of 2416 2444 rfndfh.exe 34 PID 2444 wrote to memory of 2416 2444 rfndfh.exe 34 PID 2444 wrote to memory of 2416 2444 rfndfh.exe 34 PID 2416 wrote to memory of 2476 2416 ftldjp.exe 35 PID 2416 wrote to memory of 2476 2416 ftldjp.exe 35 PID 2416 wrote to memory of 2476 2416 ftldjp.exe 35 PID 2416 wrote to memory of 2476 2416 ftldjp.exe 35 PID 2476 wrote to memory of 768 2476 nrdffj.exe 36 PID 2476 wrote to memory of 768 2476 nrdffj.exe 36 PID 2476 wrote to memory of 768 2476 nrdffj.exe 36 PID 2476 wrote to memory of 768 2476 nrdffj.exe 36 PID 768 wrote to memory of 1008 768 nlthxh.exe 37 PID 768 wrote to memory of 1008 768 nlthxh.exe 37 PID 768 wrote to memory of 1008 768 nlthxh.exe 37 PID 768 wrote to memory of 1008 768 nlthxh.exe 37 PID 1008 wrote to memory of 1216 1008 rfdld.exe 38 PID 1008 wrote to memory of 1216 1008 rfdld.exe 38 PID 1008 wrote to memory of 1216 1008 rfdld.exe 38 PID 1008 wrote to memory of 1216 1008 rfdld.exe 38 PID 1216 wrote to memory of 2340 1216 vjfxt.exe 39 PID 1216 wrote to memory of 2340 1216 vjfxt.exe 39 PID 1216 wrote to memory of 2340 1216 vjfxt.exe 39 PID 1216 wrote to memory of 2340 1216 vjfxt.exe 39 PID 2340 wrote to memory of 2572 2340 dfdhtj.exe 40 PID 2340 wrote to memory of 2572 2340 dfdhtj.exe 40 PID 2340 wrote to memory of 2572 2340 dfdhtj.exe 40 PID 2340 wrote to memory of 2572 2340 dfdhtj.exe 40 PID 2572 wrote to memory of 1912 2572 dldvjv.exe 41 PID 2572 wrote to memory of 1912 2572 dldvjv.exe 41 PID 2572 wrote to memory of 1912 2572 dldvjv.exe 41 PID 2572 wrote to memory of 1912 2572 dldvjv.exe 41 PID 1912 wrote to memory of 1540 1912 pxtjl.exe 42 PID 1912 wrote to memory of 1540 1912 pxtjl.exe 42 PID 1912 wrote to memory of 1540 1912 pxtjl.exe 42 PID 1912 wrote to memory of 1540 1912 pxtjl.exe 42 PID 1540 wrote to memory of 2180 1540 tpvxln.exe 43 PID 1540 wrote to memory of 2180 1540 tpvxln.exe 43 PID 1540 wrote to memory of 2180 1540 tpvxln.exe 43 PID 1540 wrote to memory of 2180 1540 tpvxln.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\613d37b6990686d1e736de5831d4f1eddc02d4da14a96d61a6299e6121db7838.exe"C:\Users\Admin\AppData\Local\Temp\613d37b6990686d1e736de5831d4f1eddc02d4da14a96d61a6299e6121db7838.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\txrfbt.exec:\txrfbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\rpdtdxx.exec:\rpdtdxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\vxxjhrv.exec:\vxxjhrv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\hnbfnjv.exec:\hnbfnjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\bxhlrll.exec:\bxhlrll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\rfndfh.exec:\rfndfh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\ftldjp.exec:\ftldjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\nrdffj.exec:\nrdffj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\nlthxh.exec:\nlthxh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\rfdld.exec:\rfdld.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\vjfxt.exec:\vjfxt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\dfdhtj.exec:\dfdhtj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\dldvjv.exec:\dldvjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\pxtjl.exec:\pxtjl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\tpvxln.exec:\tpvxln.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\lbpfx.exec:\lbpfx.exe17⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rtrlf.exec:\rtrlf.exe18⤵
- Executes dropped EXE
PID:1692 -
\??\c:\fvnblf.exec:\fvnblf.exe19⤵
- Executes dropped EXE
PID:1592 -
\??\c:\blxpp.exec:\blxpp.exe20⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dlfxtrl.exec:\dlfxtrl.exe21⤵
- Executes dropped EXE
PID:772 -
\??\c:\rjlldnx.exec:\rjlldnx.exe22⤵
- Executes dropped EXE
PID:2212 -
\??\c:\ptjddlr.exec:\ptjddlr.exe23⤵
- Executes dropped EXE
PID:1832 -
\??\c:\llrpfhv.exec:\llrpfhv.exe24⤵
- Executes dropped EXE
PID:436 -
\??\c:\npvnt.exec:\npvnt.exe25⤵
- Executes dropped EXE
PID:1264 -
\??\c:\nlbxb.exec:\nlbxb.exe26⤵
- Executes dropped EXE
PID:784 -
\??\c:\pttjl.exec:\pttjl.exe27⤵
- Executes dropped EXE
PID:1624 -
\??\c:\hnnxrtr.exec:\hnnxrtr.exe28⤵
- Executes dropped EXE
PID:1120 -
\??\c:\hjfhrt.exec:\hjfhrt.exe29⤵
- Executes dropped EXE
PID:1048 -
\??\c:\xtfpf.exec:\xtfpf.exe30⤵
- Executes dropped EXE
PID:2300 -
\??\c:\pvpjdh.exec:\pvpjdh.exe31⤵
- Executes dropped EXE
PID:1848 -
\??\c:\vdhhxl.exec:\vdhhxl.exe32⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pnfdfl.exec:\pnfdfl.exe33⤵
- Executes dropped EXE
PID:884 -
\??\c:\nfpln.exec:\nfpln.exe34⤵
- Executes dropped EXE
PID:2292 -
\??\c:\vjpjxlx.exec:\vjpjxlx.exe35⤵
- Executes dropped EXE
PID:2276 -
\??\c:\hdhjf.exec:\hdhjf.exe36⤵
- Executes dropped EXE
PID:1608 -
\??\c:\ppdll.exec:\ppdll.exe37⤵
- Executes dropped EXE
PID:2464 -
\??\c:\bxrhnv.exec:\bxrhnv.exe38⤵
- Executes dropped EXE
PID:2620 -
\??\c:\trlbrj.exec:\trlbrj.exe39⤵
- Executes dropped EXE
PID:2632 -
\??\c:\vxpld.exec:\vxpld.exe40⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vbhfdp.exec:\vbhfdp.exe41⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rlrph.exec:\rlrph.exe42⤵
- Executes dropped EXE
PID:2548 -
\??\c:\tpnlphh.exec:\tpnlphh.exe43⤵
- Executes dropped EXE
PID:2380 -
\??\c:\fddxb.exec:\fddxb.exe44⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nxlppt.exec:\nxlppt.exe45⤵
- Executes dropped EXE
PID:2468 -
\??\c:\xphpxv.exec:\xphpxv.exe46⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jfdnrl.exec:\jfdnrl.exe47⤵
- Executes dropped EXE
PID:1056 -
\??\c:\ntpbpp.exec:\ntpbpp.exe48⤵
- Executes dropped EXE
PID:2432 -
\??\c:\npllvr.exec:\npllvr.exe49⤵
- Executes dropped EXE
PID:696 -
\??\c:\jnbbh.exec:\jnbbh.exe50⤵
- Executes dropped EXE
PID:2400 -
\??\c:\xtvnvvf.exec:\xtvnvvf.exe51⤵
- Executes dropped EXE
PID:1012 -
\??\c:\jvtddp.exec:\jvtddp.exe52⤵
- Executes dropped EXE
PID:2588 -
\??\c:\tbpldjl.exec:\tbpldjl.exe53⤵
- Executes dropped EXE
PID:2556 -
\??\c:\jlnvlp.exec:\jlnvlp.exe54⤵
- Executes dropped EXE
PID:1252 -
\??\c:\njhnnjx.exec:\njhnnjx.exe55⤵
- Executes dropped EXE
PID:636 -
\??\c:\xhnrbv.exec:\xhnrbv.exe56⤵
- Executes dropped EXE
PID:2000 -
\??\c:\vpthxph.exec:\vpthxph.exe57⤵
- Executes dropped EXE
PID:1696 -
\??\c:\dvvtxvt.exec:\dvvtxvt.exe58⤵
- Executes dropped EXE
PID:1692 -
\??\c:\dpxbl.exec:\dpxbl.exe59⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jjtddl.exec:\jjtddl.exe60⤵
- Executes dropped EXE
PID:1112 -
\??\c:\xdbjn.exec:\xdbjn.exe61⤵
- Executes dropped EXE
PID:592 -
\??\c:\hfflnjj.exec:\hfflnjj.exe62⤵
- Executes dropped EXE
PID:2452 -
\??\c:\brdjj.exec:\brdjj.exe63⤵
- Executes dropped EXE
PID:2212 -
\??\c:\xdhrnhd.exec:\xdhrnhd.exe64⤵
- Executes dropped EXE
PID:2232 -
\??\c:\nptbfj.exec:\nptbfj.exe65⤵
- Executes dropped EXE
PID:1244 -
\??\c:\ttnhl.exec:\ttnhl.exe66⤵PID:436
-
\??\c:\vhlhhff.exec:\vhlhhff.exe67⤵PID:1708
-
\??\c:\nrvdn.exec:\nrvdn.exe68⤵PID:784
-
\??\c:\fdvtrlj.exec:\fdvtrlj.exe69⤵PID:2808
-
\??\c:\hpnpp.exec:\hpnpp.exe70⤵PID:1044
-
\??\c:\rxnnf.exec:\rxnnf.exe71⤵PID:2904
-
\??\c:\ttjxlbj.exec:\ttjxlbj.exe72⤵PID:2308
-
\??\c:\vvnhjx.exec:\vvnhjx.exe73⤵PID:2868
-
\??\c:\vhrxfh.exec:\vhrxfh.exe74⤵PID:3060
-
\??\c:\rrppv.exec:\rrppv.exe75⤵PID:2008
-
\??\c:\pfpvd.exec:\pfpvd.exe76⤵PID:2884
-
\??\c:\vxfnrb.exec:\vxfnrb.exe77⤵PID:2872
-
\??\c:\dpbppv.exec:\dpbppv.exe78⤵PID:2900
-
\??\c:\vdppll.exec:\vdppll.exe79⤵PID:1612
-
\??\c:\jllbfjn.exec:\jllbfjn.exe80⤵PID:2504
-
\??\c:\fpvfpxh.exec:\fpvfpxh.exe81⤵PID:2636
-
\??\c:\jpxtj.exec:\jpxtj.exe82⤵PID:2500
-
\??\c:\jbrfrdb.exec:\jbrfrdb.exe83⤵PID:2360
-
\??\c:\hjdbd.exec:\hjdbd.exe84⤵PID:2760
-
\??\c:\djtrrvx.exec:\djtrrvx.exe85⤵PID:2532
-
\??\c:\bthln.exec:\bthln.exe86⤵PID:2444
-
\??\c:\hxlvx.exec:\hxlvx.exe87⤵PID:2520
-
\??\c:\htpjnpf.exec:\htpjnpf.exe88⤵PID:2408
-
\??\c:\rrfvdv.exec:\rrfvdv.exe89⤵PID:2208
-
\??\c:\bnxlvp.exec:\bnxlvp.exe90⤵PID:1384
-
\??\c:\bvdplh.exec:\bvdplh.exe91⤵PID:1972
-
\??\c:\npxfxpb.exec:\npxfxpb.exe92⤵PID:836
-
\??\c:\dprhlf.exec:\dprhlf.exe93⤵PID:2568
-
\??\c:\txprdp.exec:\txprdp.exe94⤵PID:756
-
\??\c:\bttjnv.exec:\bttjnv.exe95⤵PID:2240
-
\??\c:\hvftvft.exec:\hvftvft.exe96⤵PID:2572
-
\??\c:\drpbrfv.exec:\drpbrfv.exe97⤵PID:1524
-
\??\c:\jphbvnl.exec:\jphbvnl.exe98⤵PID:692
-
\??\c:\jxbnjjh.exec:\jxbnjjh.exe99⤵PID:1172
-
\??\c:\xrnhlrl.exec:\xrnhlrl.exe100⤵PID:1768
-
\??\c:\xbnntd.exec:\xbnntd.exe101⤵PID:932
-
\??\c:\vxxrpf.exec:\vxxrpf.exe102⤵PID:1644
-
\??\c:\vfbth.exec:\vfbth.exe103⤵PID:2712
-
\??\c:\djnrjj.exec:\djnrjj.exe104⤵PID:580
-
\??\c:\jhddbt.exec:\jhddbt.exe105⤵PID:2296
-
\??\c:\jnhjnr.exec:\jnhjnr.exe106⤵PID:628
-
\??\c:\nbfbl.exec:\nbfbl.exe107⤵PID:3020
-
\??\c:\fpxhl.exec:\fpxhl.exe108⤵PID:1060
-
\??\c:\hdbbvr.exec:\hdbbvr.exe109⤵PID:1960
-
\??\c:\jhrxhd.exec:\jhrxhd.exe110⤵PID:2064
-
\??\c:\fhpfbvl.exec:\fhpfbvl.exe111⤵PID:1200
-
\??\c:\bbxvj.exec:\bbxvj.exe112⤵PID:1944
-
\??\c:\bhftvlb.exec:\bhftvlb.exe113⤵PID:1844
-
\??\c:\hfbfvbr.exec:\hfbfvbr.exe114⤵PID:1120
-
\??\c:\hxvpbrx.exec:\hxvpbrx.exe115⤵PID:2060
-
\??\c:\bdnrp.exec:\bdnrp.exe116⤵PID:2888
-
\??\c:\dxjdpt.exec:\dxjdpt.exe117⤵PID:2764
-
\??\c:\drlxphh.exec:\drlxphh.exe118⤵PID:892
-
\??\c:\pntxdxf.exec:\pntxdxf.exe119⤵PID:884
-
\??\c:\ljptdb.exec:\ljptdb.exe120⤵PID:1072
-
\??\c:\xxddh.exec:\xxddh.exe121⤵PID:2292
-
\??\c:\dxhnv.exec:\dxhnv.exe122⤵PID:2448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-