Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 19:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
239210abc4256bc3a364e247df25e2acc30623eec22827ea6413adcdc257fb0d.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
239210abc4256bc3a364e247df25e2acc30623eec22827ea6413adcdc257fb0d.exe
-
Size
122KB
-
MD5
0acb514e6baa9b09bf85cdcd364881bb
-
SHA1
092a2df9dba16508aecf60fb99deb0e2334612b7
-
SHA256
239210abc4256bc3a364e247df25e2acc30623eec22827ea6413adcdc257fb0d
-
SHA512
cdbdc46bd473b908b0b420f0313366d43769028f42ecacb8a2860ed391591f5c17b2f93f9ec92646a2b5f902be4ad68b68c4fc41a02a9d7be038fcf0c888e82e
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHvmQ+EZMYX90Ifcp:n3C9BRW0j/uVEZFmIkp
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/796-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/948-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1396-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/284-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 592 nnvbhrn.exe 2396 rfplrlf.exe 284 bpxbv.exe 2792 nnfprpn.exe 2872 rbxphb.exe 1824 hphdjrl.exe 2696 rhhjprl.exe 2640 xvtljnn.exe 3024 xxpjr.exe 2576 hlvrft.exe 2416 tbpndh.exe 2536 jnxdrn.exe 2844 xvllvt.exe 2256 jnndrb.exe 844 ttlbl.exe 2312 rtvjnjh.exe 1064 lphtb.exe 1684 jtbtlx.exe 1612 tfhpnn.exe 1788 fhvpt.exe 2160 nfndjxn.exe 904 ndjhr.exe 1812 fvvdh.exe 1396 xfjtp.exe 1856 jrvhp.exe 696 lpnrvv.exe 1972 fnrnvrl.exe 1792 bvftvd.exe 948 jhbbbx.exe 2028 jjnnf.exe 796 pvxxfj.exe 1752 bdbnjth.exe 1288 tfvlpx.exe 3048 nvjvfht.exe 1572 rlprrn.exe 784 rnflrp.exe 1332 vrhjndb.exe 1716 pnlhxj.exe 2800 ljjlbrt.exe 2864 dnjnjb.exe 364 bnnvhrj.exe 2692 vblvlpr.exe 2880 ldvrtfn.exe 2888 jrtrf.exe 2696 tbnnpv.exe 2636 nlxrtxh.exe 2572 frxplnh.exe 2612 jhfvbxp.exe 2576 bxpljv.exe 2488 hrvbdvh.exe 2840 dvjldb.exe 1496 htldjl.exe 2208 lhrpn.exe 2044 vbffdnb.exe 2188 jbppj.exe 2316 xlhdrl.exe 1976 tdpvt.exe 888 ftlvbj.exe 1760 dllbhn.exe 2212 bxlrv.exe 1836 tfdtj.exe 2388 jvjfpj.exe 280 dfbnpv.exe 1696 phtlhl.exe -
resource yara_rule behavioral1/memory/796-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/948-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/284-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-4-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 592 2180 239210abc4256bc3a364e247df25e2acc30623eec22827ea6413adcdc257fb0d.exe 28 PID 2180 wrote to memory of 592 2180 239210abc4256bc3a364e247df25e2acc30623eec22827ea6413adcdc257fb0d.exe 28 PID 2180 wrote to memory of 592 2180 239210abc4256bc3a364e247df25e2acc30623eec22827ea6413adcdc257fb0d.exe 28 PID 2180 wrote to memory of 592 2180 239210abc4256bc3a364e247df25e2acc30623eec22827ea6413adcdc257fb0d.exe 28 PID 592 wrote to memory of 2396 592 nnvbhrn.exe 29 PID 592 wrote to memory of 2396 592 nnvbhrn.exe 29 PID 592 wrote to memory of 2396 592 nnvbhrn.exe 29 PID 592 wrote to memory of 2396 592 nnvbhrn.exe 29 PID 2396 wrote to memory of 284 2396 rfplrlf.exe 30 PID 2396 wrote to memory of 284 2396 rfplrlf.exe 30 PID 2396 wrote to memory of 284 2396 rfplrlf.exe 30 PID 2396 wrote to memory of 284 2396 rfplrlf.exe 30 PID 284 wrote to memory of 2792 284 bpxbv.exe 31 PID 284 wrote to memory of 2792 284 bpxbv.exe 31 PID 284 wrote to memory of 2792 284 bpxbv.exe 31 PID 284 wrote to memory of 2792 284 bpxbv.exe 31 PID 2792 wrote to memory of 2872 2792 nnfprpn.exe 32 PID 2792 wrote to memory of 2872 2792 nnfprpn.exe 32 PID 2792 wrote to memory of 2872 2792 nnfprpn.exe 32 PID 2792 wrote to memory of 2872 2792 nnfprpn.exe 32 PID 2872 wrote to memory of 1824 2872 rbxphb.exe 33 PID 2872 wrote to memory of 1824 2872 rbxphb.exe 33 PID 2872 wrote to memory of 1824 2872 rbxphb.exe 33 PID 2872 wrote to memory of 1824 2872 rbxphb.exe 33 PID 1824 wrote to memory of 2696 1824 hphdjrl.exe 34 PID 1824 wrote to memory of 2696 1824 hphdjrl.exe 34 PID 1824 wrote to memory of 2696 1824 hphdjrl.exe 34 PID 1824 wrote to memory of 2696 1824 hphdjrl.exe 34 PID 2696 wrote to memory of 2640 2696 rhhjprl.exe 35 PID 2696 wrote to memory of 2640 2696 rhhjprl.exe 35 PID 2696 wrote to memory of 2640 2696 rhhjprl.exe 35 PID 2696 wrote to memory of 2640 2696 rhhjprl.exe 35 PID 2640 wrote to memory of 3024 2640 xvtljnn.exe 36 PID 2640 wrote to memory of 3024 2640 xvtljnn.exe 36 PID 2640 wrote to memory of 3024 2640 xvtljnn.exe 36 PID 2640 wrote to memory of 3024 2640 xvtljnn.exe 36 PID 3024 wrote to memory of 2576 3024 xxpjr.exe 37 PID 3024 wrote to memory of 2576 3024 xxpjr.exe 37 PID 3024 wrote to memory of 2576 3024 xxpjr.exe 37 PID 3024 wrote to memory of 2576 3024 xxpjr.exe 37 PID 2576 wrote to memory of 2416 2576 hlvrft.exe 38 PID 2576 wrote to memory of 2416 2576 hlvrft.exe 38 PID 2576 wrote to memory of 2416 2576 hlvrft.exe 38 PID 2576 wrote to memory of 2416 2576 hlvrft.exe 38 PID 2416 wrote to memory of 2536 2416 tbpndh.exe 39 PID 2416 wrote to memory of 2536 2416 tbpndh.exe 39 PID 2416 wrote to memory of 2536 2416 tbpndh.exe 39 PID 2416 wrote to memory of 2536 2416 tbpndh.exe 39 PID 2536 wrote to memory of 2844 2536 jnxdrn.exe 40 PID 2536 wrote to memory of 2844 2536 jnxdrn.exe 40 PID 2536 wrote to memory of 2844 2536 jnxdrn.exe 40 PID 2536 wrote to memory of 2844 2536 jnxdrn.exe 40 PID 2844 wrote to memory of 2256 2844 xvllvt.exe 41 PID 2844 wrote to memory of 2256 2844 xvllvt.exe 41 PID 2844 wrote to memory of 2256 2844 xvllvt.exe 41 PID 2844 wrote to memory of 2256 2844 xvllvt.exe 41 PID 2256 wrote to memory of 844 2256 jnndrb.exe 42 PID 2256 wrote to memory of 844 2256 jnndrb.exe 42 PID 2256 wrote to memory of 844 2256 jnndrb.exe 42 PID 2256 wrote to memory of 844 2256 jnndrb.exe 42 PID 844 wrote to memory of 2312 844 ttlbl.exe 43 PID 844 wrote to memory of 2312 844 ttlbl.exe 43 PID 844 wrote to memory of 2312 844 ttlbl.exe 43 PID 844 wrote to memory of 2312 844 ttlbl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\239210abc4256bc3a364e247df25e2acc30623eec22827ea6413adcdc257fb0d.exe"C:\Users\Admin\AppData\Local\Temp\239210abc4256bc3a364e247df25e2acc30623eec22827ea6413adcdc257fb0d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\nnvbhrn.exec:\nnvbhrn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\rfplrlf.exec:\rfplrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\bpxbv.exec:\bpxbv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:284 -
\??\c:\nnfprpn.exec:\nnfprpn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\rbxphb.exec:\rbxphb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\hphdjrl.exec:\hphdjrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\rhhjprl.exec:\rhhjprl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\xvtljnn.exec:\xvtljnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\xxpjr.exec:\xxpjr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\hlvrft.exec:\hlvrft.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\tbpndh.exec:\tbpndh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\jnxdrn.exec:\jnxdrn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\xvllvt.exec:\xvllvt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\jnndrb.exec:\jnndrb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\ttlbl.exec:\ttlbl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\rtvjnjh.exec:\rtvjnjh.exe17⤵
- Executes dropped EXE
PID:2312 -
\??\c:\lphtb.exec:\lphtb.exe18⤵
- Executes dropped EXE
PID:1064 -
\??\c:\jtbtlx.exec:\jtbtlx.exe19⤵
- Executes dropped EXE
PID:1684 -
\??\c:\tfhpnn.exec:\tfhpnn.exe20⤵
- Executes dropped EXE
PID:1612 -
\??\c:\fhvpt.exec:\fhvpt.exe21⤵
- Executes dropped EXE
PID:1788 -
\??\c:\nfndjxn.exec:\nfndjxn.exe22⤵
- Executes dropped EXE
PID:2160 -
\??\c:\ndjhr.exec:\ndjhr.exe23⤵
- Executes dropped EXE
PID:904 -
\??\c:\fvvdh.exec:\fvvdh.exe24⤵
- Executes dropped EXE
PID:1812 -
\??\c:\xfjtp.exec:\xfjtp.exe25⤵
- Executes dropped EXE
PID:1396 -
\??\c:\jrvhp.exec:\jrvhp.exe26⤵
- Executes dropped EXE
PID:1856 -
\??\c:\lpnrvv.exec:\lpnrvv.exe27⤵
- Executes dropped EXE
PID:696 -
\??\c:\fnrnvrl.exec:\fnrnvrl.exe28⤵
- Executes dropped EXE
PID:1972 -
\??\c:\bvftvd.exec:\bvftvd.exe29⤵
- Executes dropped EXE
PID:1792 -
\??\c:\jhbbbx.exec:\jhbbbx.exe30⤵
- Executes dropped EXE
PID:948 -
\??\c:\jjnnf.exec:\jjnnf.exe31⤵
- Executes dropped EXE
PID:2028 -
\??\c:\pvxxfj.exec:\pvxxfj.exe32⤵
- Executes dropped EXE
PID:796 -
\??\c:\bdbnjth.exec:\bdbnjth.exe33⤵
- Executes dropped EXE
PID:1752 -
\??\c:\tfvlpx.exec:\tfvlpx.exe34⤵
- Executes dropped EXE
PID:1288 -
\??\c:\nvjvfht.exec:\nvjvfht.exe35⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rlprrn.exec:\rlprrn.exe36⤵
- Executes dropped EXE
PID:1572 -
\??\c:\rnflrp.exec:\rnflrp.exe37⤵
- Executes dropped EXE
PID:784 -
\??\c:\vrhjndb.exec:\vrhjndb.exe38⤵
- Executes dropped EXE
PID:1332 -
\??\c:\pnlhxj.exec:\pnlhxj.exe39⤵
- Executes dropped EXE
PID:1716 -
\??\c:\ljjlbrt.exec:\ljjlbrt.exe40⤵
- Executes dropped EXE
PID:2800 -
\??\c:\dnjnjb.exec:\dnjnjb.exe41⤵
- Executes dropped EXE
PID:2864 -
\??\c:\bnnvhrj.exec:\bnnvhrj.exe42⤵
- Executes dropped EXE
PID:364 -
\??\c:\vblvlpr.exec:\vblvlpr.exe43⤵
- Executes dropped EXE
PID:2692 -
\??\c:\ldvrtfn.exec:\ldvrtfn.exe44⤵
- Executes dropped EXE
PID:2880 -
\??\c:\jrtrf.exec:\jrtrf.exe45⤵
- Executes dropped EXE
PID:2888 -
\??\c:\tbnnpv.exec:\tbnnpv.exe46⤵
- Executes dropped EXE
PID:2696 -
\??\c:\nlxrtxh.exec:\nlxrtxh.exe47⤵
- Executes dropped EXE
PID:2636 -
\??\c:\frxplnh.exec:\frxplnh.exe48⤵
- Executes dropped EXE
PID:2572 -
\??\c:\jhfvbxp.exec:\jhfvbxp.exe49⤵
- Executes dropped EXE
PID:2612 -
\??\c:\bxpljv.exec:\bxpljv.exe50⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hrvbdvh.exec:\hrvbdvh.exe51⤵
- Executes dropped EXE
PID:2488 -
\??\c:\dvjldb.exec:\dvjldb.exe52⤵
- Executes dropped EXE
PID:2840 -
\??\c:\htldjl.exec:\htldjl.exe53⤵
- Executes dropped EXE
PID:1496 -
\??\c:\lhrpn.exec:\lhrpn.exe54⤵
- Executes dropped EXE
PID:2208 -
\??\c:\vbffdnb.exec:\vbffdnb.exe55⤵
- Executes dropped EXE
PID:2044 -
\??\c:\jbppj.exec:\jbppj.exe56⤵
- Executes dropped EXE
PID:2188 -
\??\c:\xlhdrl.exec:\xlhdrl.exe57⤵
- Executes dropped EXE
PID:2316 -
\??\c:\tdpvt.exec:\tdpvt.exe58⤵
- Executes dropped EXE
PID:1976 -
\??\c:\ftlvbj.exec:\ftlvbj.exe59⤵
- Executes dropped EXE
PID:888 -
\??\c:\dllbhn.exec:\dllbhn.exe60⤵
- Executes dropped EXE
PID:1760 -
\??\c:\bxlrv.exec:\bxlrv.exe61⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tfdtj.exec:\tfdtj.exe62⤵
- Executes dropped EXE
PID:1836 -
\??\c:\jvjfpj.exec:\jvjfpj.exe63⤵
- Executes dropped EXE
PID:2388 -
\??\c:\dfbnpv.exec:\dfbnpv.exe64⤵
- Executes dropped EXE
PID:280 -
\??\c:\phtlhl.exec:\phtlhl.exe65⤵
- Executes dropped EXE
PID:1696 -
\??\c:\fvtbxvt.exec:\fvtbxvt.exe66⤵PID:1140
-
\??\c:\dpftbdv.exec:\dpftbdv.exe67⤵PID:972
-
\??\c:\jxxxrpj.exec:\jxxxrpj.exe68⤵PID:768
-
\??\c:\lvprfh.exec:\lvprfh.exe69⤵PID:1972
-
\??\c:\vllljf.exec:\vllljf.exe70⤵PID:1792
-
\??\c:\plrhbn.exec:\plrhbn.exe71⤵PID:1328
-
\??\c:\dlrldrr.exec:\dlrldrr.exe72⤵PID:1584
-
\??\c:\xbxljd.exec:\xbxljd.exe73⤵PID:2156
-
\??\c:\bnpvdhl.exec:\bnpvdhl.exe74⤵PID:2036
-
\??\c:\brtld.exec:\brtld.exe75⤵PID:2928
-
\??\c:\bltrr.exec:\bltrr.exe76⤵PID:476
-
\??\c:\ntvxrrr.exec:\ntvxrrr.exe77⤵PID:2084
-
\??\c:\vxbtdb.exec:\vxbtdb.exe78⤵PID:668
-
\??\c:\pjdrnt.exec:\pjdrnt.exe79⤵PID:2392
-
\??\c:\bhftvv.exec:\bhftvv.exe80⤵PID:2948
-
\??\c:\nfxlvrx.exec:\nfxlvrx.exe81⤵PID:284
-
\??\c:\ltxnlh.exec:\ltxnlh.exe82⤵PID:2936
-
\??\c:\htnnl.exec:\htnnl.exe83⤵PID:2824
-
\??\c:\bxdfr.exec:\bxdfr.exe84⤵PID:1872
-
\??\c:\rjjjhd.exec:\rjjjhd.exe85⤵PID:2692
-
\??\c:\dnjbv.exec:\dnjbv.exe86⤵PID:2988
-
\??\c:\jtdpvp.exec:\jtdpvp.exe87⤵PID:2656
-
\??\c:\dhvxdn.exec:\dhvxdn.exe88⤵PID:2520
-
\??\c:\jbnvp.exec:\jbnvp.exe89⤵PID:2532
-
\??\c:\nbtndlv.exec:\nbtndlv.exe90⤵PID:2440
-
\??\c:\dppdbf.exec:\dppdbf.exe91⤵PID:2464
-
\??\c:\nfnvrdd.exec:\nfnvrdd.exe92⤵PID:2416
-
\??\c:\xrlhb.exec:\xrlhb.exe93⤵PID:2128
-
\??\c:\fjjvn.exec:\fjjvn.exe94⤵PID:2216
-
\??\c:\pbbjxpl.exec:\pbbjxpl.exe95⤵PID:1944
-
\??\c:\rxjxl.exec:\rxjxl.exe96⤵PID:1080
-
\??\c:\bplbhl.exec:\bplbhl.exe97⤵PID:1292
-
\??\c:\jdpbxjf.exec:\jdpbxjf.exe98⤵PID:2260
-
\??\c:\lljljh.exec:\lljljh.exe99⤵PID:928
-
\??\c:\nffnj.exec:\nffnj.exe100⤵PID:1756
-
\??\c:\vddxl.exec:\vddxl.exe101⤵PID:1652
-
\??\c:\ppthvnx.exec:\ppthvnx.exe102⤵PID:2356
-
\??\c:\bpvlp.exec:\bpvlp.exe103⤵PID:1048
-
\??\c:\djrvp.exec:\djrvp.exe104⤵PID:2240
-
\??\c:\xfjld.exec:\xfjld.exe105⤵PID:2012
-
\??\c:\hjxnn.exec:\hjxnn.exe106⤵PID:632
-
\??\c:\ntblplx.exec:\ntblplx.exe107⤵PID:1672
-
\??\c:\hflpvh.exec:\hflpvh.exe108⤵PID:1508
-
\??\c:\tlhhxvp.exec:\tlhhxvp.exe109⤵PID:1880
-
\??\c:\txdvjv.exec:\txdvjv.exe110⤵PID:2452
-
\??\c:\ltfxx.exec:\ltfxx.exe111⤵PID:1232
-
\??\c:\vtbhdd.exec:\vtbhdd.exe112⤵PID:1996
-
\??\c:\bnttrb.exec:\bnttrb.exe113⤵PID:1328
-
\??\c:\vjxbjl.exec:\vjxbjl.exe114⤵PID:2112
-
\??\c:\nrjhn.exec:\nrjhn.exe115⤵PID:2732
-
\??\c:\tjxpxjd.exec:\tjxpxjd.exe116⤵PID:2728
-
\??\c:\xhfxx.exec:\xhfxx.exe117⤵PID:528
-
\??\c:\ttnnvh.exec:\ttnnvh.exe118⤵PID:1664
-
\??\c:\hbjjj.exec:\hbjjj.exe119⤵PID:988
-
\??\c:\vptxn.exec:\vptxn.exe120⤵PID:2736
-
\??\c:\vvptbvl.exec:\vvptbvl.exe121⤵PID:1364
-
\??\c:\bnhjbt.exec:\bnhjbt.exe122⤵PID:1724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-