Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 12:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
53b99d9981c3f8a9dabedad9fb48a8a7f42d556d4d3a038bc414c995653dfa06.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
53b99d9981c3f8a9dabedad9fb48a8a7f42d556d4d3a038bc414c995653dfa06.exe
-
Size
67KB
-
MD5
27f62cea5756bb1ad3dfb2e24561f032
-
SHA1
8aeb2d3c3bb3110e9be182705cc5f85331620d64
-
SHA256
53b99d9981c3f8a9dabedad9fb48a8a7f42d556d4d3a038bc414c995653dfa06
-
SHA512
bfcfc16c3639980b788c64906a273d0c9bddfce41e05b4b2fc9c2cc4615ce72121b981ec537b7d9ebabde3339202a8f8d0154adbd089188e6ad587bd357b225d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJ/RWPqBR:ymb3NkkiQ3mdBjFIqsR
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/1152-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1292-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-1250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2216 rhbpd.exe 2244 pblrlp.exe 2836 tvtdt.exe 2240 tjpptbx.exe 2660 dnxbpv.exe 2972 vblhbd.exe 2644 nxprnt.exe 2512 vpfbb.exe 2548 jxlfbfr.exe 2424 rvnbx.exe 2420 xfxhhhp.exe 2872 tftvjll.exe 1568 vxnhtj.exe 1292 rfrbf.exe 2024 rhrrdb.exe 1640 xvvjdbx.exe 1340 dxbbj.exe 852 lfxnj.exe 580 xhlflxp.exe 2748 dbdjvnr.exe 1928 tdxbl.exe 1948 ldjtdrl.exe 596 vvxxp.exe 836 rvrnj.exe 1204 ljjpn.exe 1700 dnblxr.exe 1252 tdptljf.exe 1972 lxjrj.exe 2152 brhpprn.exe 2680 xbtlfnd.exe 2104 trfbhrj.exe 2924 hlbhx.exe 2204 tdfjbdl.exe 1884 vtpvnb.exe 1580 fjrjxjv.exe 1924 jrtff.exe 1680 xldpjvx.exe 2888 vdpvfr.exe 3000 dbtbj.exe 2472 xnnbt.exe 2524 rjvlxl.exe 2584 jvdlljx.exe 2484 tfnhhx.exe 2300 drrrpr.exe 2624 fjjdx.exe 2736 fxrtp.exe 2492 pfpxrt.exe 2396 tvdpddd.exe 2848 flnvl.exe 1904 tfpln.exe 2176 jjrvth.exe 1568 fhphrvr.exe 944 jdhhn.exe 1632 xhtxdh.exe 1656 vljbl.exe 1452 trlxp.exe 1492 brplb.exe 1104 lnbjn.exe 2840 vpdhdhx.exe 2720 vrbdltp.exe 2672 bthdtn.exe 2664 dtbnth.exe 1948 rfhfp.exe 1808 tfptt.exe -
resource yara_rule behavioral1/memory/1152-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1292-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-1250-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1152 wrote to memory of 2216 1152 53b99d9981c3f8a9dabedad9fb48a8a7f42d556d4d3a038bc414c995653dfa06.exe 28 PID 1152 wrote to memory of 2216 1152 53b99d9981c3f8a9dabedad9fb48a8a7f42d556d4d3a038bc414c995653dfa06.exe 28 PID 1152 wrote to memory of 2216 1152 53b99d9981c3f8a9dabedad9fb48a8a7f42d556d4d3a038bc414c995653dfa06.exe 28 PID 1152 wrote to memory of 2216 1152 53b99d9981c3f8a9dabedad9fb48a8a7f42d556d4d3a038bc414c995653dfa06.exe 28 PID 2216 wrote to memory of 2244 2216 rhbpd.exe 29 PID 2216 wrote to memory of 2244 2216 rhbpd.exe 29 PID 2216 wrote to memory of 2244 2216 rhbpd.exe 29 PID 2216 wrote to memory of 2244 2216 rhbpd.exe 29 PID 2244 wrote to memory of 2836 2244 pblrlp.exe 30 PID 2244 wrote to memory of 2836 2244 pblrlp.exe 30 PID 2244 wrote to memory of 2836 2244 pblrlp.exe 30 PID 2244 wrote to memory of 2836 2244 pblrlp.exe 30 PID 2836 wrote to memory of 2240 2836 tvtdt.exe 31 PID 2836 wrote to memory of 2240 2836 tvtdt.exe 31 PID 2836 wrote to memory of 2240 2836 tvtdt.exe 31 PID 2836 wrote to memory of 2240 2836 tvtdt.exe 31 PID 2240 wrote to memory of 2660 2240 tjpptbx.exe 32 PID 2240 wrote to memory of 2660 2240 tjpptbx.exe 32 PID 2240 wrote to memory of 2660 2240 tjpptbx.exe 32 PID 2240 wrote to memory of 2660 2240 tjpptbx.exe 32 PID 2660 wrote to memory of 2972 2660 dnxbpv.exe 33 PID 2660 wrote to memory of 2972 2660 dnxbpv.exe 33 PID 2660 wrote to memory of 2972 2660 dnxbpv.exe 33 PID 2660 wrote to memory of 2972 2660 dnxbpv.exe 33 PID 2972 wrote to memory of 2644 2972 vblhbd.exe 34 PID 2972 wrote to memory of 2644 2972 vblhbd.exe 34 PID 2972 wrote to memory of 2644 2972 vblhbd.exe 34 PID 2972 wrote to memory of 2644 2972 vblhbd.exe 34 PID 2644 wrote to memory of 2512 2644 nxprnt.exe 35 PID 2644 wrote to memory of 2512 2644 nxprnt.exe 35 PID 2644 wrote to memory of 2512 2644 nxprnt.exe 35 PID 2644 wrote to memory of 2512 2644 nxprnt.exe 35 PID 2512 wrote to memory of 2548 2512 vpfbb.exe 36 PID 2512 wrote to memory of 2548 2512 vpfbb.exe 36 PID 2512 wrote to memory of 2548 2512 vpfbb.exe 36 PID 2512 wrote to memory of 2548 2512 vpfbb.exe 36 PID 2548 wrote to memory of 2424 2548 jxlfbfr.exe 37 PID 2548 wrote to memory of 2424 2548 jxlfbfr.exe 37 PID 2548 wrote to memory of 2424 2548 jxlfbfr.exe 37 PID 2548 wrote to memory of 2424 2548 jxlfbfr.exe 37 PID 2424 wrote to memory of 2420 2424 rvnbx.exe 38 PID 2424 wrote to memory of 2420 2424 rvnbx.exe 38 PID 2424 wrote to memory of 2420 2424 rvnbx.exe 38 PID 2424 wrote to memory of 2420 2424 rvnbx.exe 38 PID 2420 wrote to memory of 2872 2420 xfxhhhp.exe 39 PID 2420 wrote to memory of 2872 2420 xfxhhhp.exe 39 PID 2420 wrote to memory of 2872 2420 xfxhhhp.exe 39 PID 2420 wrote to memory of 2872 2420 xfxhhhp.exe 39 PID 2872 wrote to memory of 1568 2872 tftvjll.exe 40 PID 2872 wrote to memory of 1568 2872 tftvjll.exe 40 PID 2872 wrote to memory of 1568 2872 tftvjll.exe 40 PID 2872 wrote to memory of 1568 2872 tftvjll.exe 40 PID 1568 wrote to memory of 1292 1568 vxnhtj.exe 41 PID 1568 wrote to memory of 1292 1568 vxnhtj.exe 41 PID 1568 wrote to memory of 1292 1568 vxnhtj.exe 41 PID 1568 wrote to memory of 1292 1568 vxnhtj.exe 41 PID 1292 wrote to memory of 2024 1292 rfrbf.exe 42 PID 1292 wrote to memory of 2024 1292 rfrbf.exe 42 PID 1292 wrote to memory of 2024 1292 rfrbf.exe 42 PID 1292 wrote to memory of 2024 1292 rfrbf.exe 42 PID 2024 wrote to memory of 1640 2024 rhrrdb.exe 43 PID 2024 wrote to memory of 1640 2024 rhrrdb.exe 43 PID 2024 wrote to memory of 1640 2024 rhrrdb.exe 43 PID 2024 wrote to memory of 1640 2024 rhrrdb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\53b99d9981c3f8a9dabedad9fb48a8a7f42d556d4d3a038bc414c995653dfa06.exe"C:\Users\Admin\AppData\Local\Temp\53b99d9981c3f8a9dabedad9fb48a8a7f42d556d4d3a038bc414c995653dfa06.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\rhbpd.exec:\rhbpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\pblrlp.exec:\pblrlp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\tvtdt.exec:\tvtdt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\tjpptbx.exec:\tjpptbx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\dnxbpv.exec:\dnxbpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\vblhbd.exec:\vblhbd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\nxprnt.exec:\nxprnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\vpfbb.exec:\vpfbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\jxlfbfr.exec:\jxlfbfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\rvnbx.exec:\rvnbx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\xfxhhhp.exec:\xfxhhhp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\tftvjll.exec:\tftvjll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\vxnhtj.exec:\vxnhtj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\rfrbf.exec:\rfrbf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\rhrrdb.exec:\rhrrdb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\xvvjdbx.exec:\xvvjdbx.exe17⤵
- Executes dropped EXE
PID:1640 -
\??\c:\dxbbj.exec:\dxbbj.exe18⤵
- Executes dropped EXE
PID:1340 -
\??\c:\lfxnj.exec:\lfxnj.exe19⤵
- Executes dropped EXE
PID:852 -
\??\c:\xhlflxp.exec:\xhlflxp.exe20⤵
- Executes dropped EXE
PID:580 -
\??\c:\dbdjvnr.exec:\dbdjvnr.exe21⤵
- Executes dropped EXE
PID:2748 -
\??\c:\tdxbl.exec:\tdxbl.exe22⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ldjtdrl.exec:\ldjtdrl.exe23⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vvxxp.exec:\vvxxp.exe24⤵
- Executes dropped EXE
PID:596 -
\??\c:\rvrnj.exec:\rvrnj.exe25⤵
- Executes dropped EXE
PID:836 -
\??\c:\ljjpn.exec:\ljjpn.exe26⤵
- Executes dropped EXE
PID:1204 -
\??\c:\dnblxr.exec:\dnblxr.exe27⤵
- Executes dropped EXE
PID:1700 -
\??\c:\tdptljf.exec:\tdptljf.exe28⤵
- Executes dropped EXE
PID:1252 -
\??\c:\lxjrj.exec:\lxjrj.exe29⤵
- Executes dropped EXE
PID:1972 -
\??\c:\brhpprn.exec:\brhpprn.exe30⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xbtlfnd.exec:\xbtlfnd.exe31⤵
- Executes dropped EXE
PID:2680 -
\??\c:\trfbhrj.exec:\trfbhrj.exe32⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hlbhx.exec:\hlbhx.exe33⤵
- Executes dropped EXE
PID:2924 -
\??\c:\tdfjbdl.exec:\tdfjbdl.exe34⤵
- Executes dropped EXE
PID:2204 -
\??\c:\dfvvh.exec:\dfvvh.exe35⤵PID:2196
-
\??\c:\vtpvnb.exec:\vtpvnb.exe36⤵
- Executes dropped EXE
PID:1884 -
\??\c:\fjrjxjv.exec:\fjrjxjv.exe37⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jrtff.exec:\jrtff.exe38⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xldpjvx.exec:\xldpjvx.exe39⤵
- Executes dropped EXE
PID:1680 -
\??\c:\vdpvfr.exec:\vdpvfr.exe40⤵
- Executes dropped EXE
PID:2888 -
\??\c:\dbtbj.exec:\dbtbj.exe41⤵
- Executes dropped EXE
PID:3000 -
\??\c:\xnnbt.exec:\xnnbt.exe42⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rjvlxl.exec:\rjvlxl.exe43⤵
- Executes dropped EXE
PID:2524 -
\??\c:\jvdlljx.exec:\jvdlljx.exe44⤵
- Executes dropped EXE
PID:2584 -
\??\c:\tfnhhx.exec:\tfnhhx.exe45⤵
- Executes dropped EXE
PID:2484 -
\??\c:\drrrpr.exec:\drrrpr.exe46⤵
- Executes dropped EXE
PID:2300 -
\??\c:\fjjdx.exec:\fjjdx.exe47⤵
- Executes dropped EXE
PID:2624 -
\??\c:\fxrtp.exec:\fxrtp.exe48⤵
- Executes dropped EXE
PID:2736 -
\??\c:\pfpxrt.exec:\pfpxrt.exe49⤵
- Executes dropped EXE
PID:2492 -
\??\c:\tvdpddd.exec:\tvdpddd.exe50⤵
- Executes dropped EXE
PID:2396 -
\??\c:\flnvl.exec:\flnvl.exe51⤵
- Executes dropped EXE
PID:2848 -
\??\c:\tfpln.exec:\tfpln.exe52⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jjrvth.exec:\jjrvth.exe53⤵
- Executes dropped EXE
PID:2176 -
\??\c:\fhphrvr.exec:\fhphrvr.exe54⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jdhhn.exec:\jdhhn.exe55⤵
- Executes dropped EXE
PID:944 -
\??\c:\xhtxdh.exec:\xhtxdh.exe56⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vljbl.exec:\vljbl.exe57⤵
- Executes dropped EXE
PID:1656 -
\??\c:\trlxp.exec:\trlxp.exe58⤵
- Executes dropped EXE
PID:1452 -
\??\c:\brplb.exec:\brplb.exe59⤵
- Executes dropped EXE
PID:1492 -
\??\c:\lnbjn.exec:\lnbjn.exe60⤵
- Executes dropped EXE
PID:1104 -
\??\c:\vpdhdhx.exec:\vpdhdhx.exe61⤵
- Executes dropped EXE
PID:2840 -
\??\c:\vrbdltp.exec:\vrbdltp.exe62⤵
- Executes dropped EXE
PID:2720 -
\??\c:\bthdtn.exec:\bthdtn.exe63⤵
- Executes dropped EXE
PID:2672 -
\??\c:\dtbnth.exec:\dtbnth.exe64⤵
- Executes dropped EXE
PID:2664 -
\??\c:\rfhfp.exec:\rfhfp.exe65⤵
- Executes dropped EXE
PID:1948 -
\??\c:\tfptt.exec:\tfptt.exe66⤵
- Executes dropped EXE
PID:1808 -
\??\c:\pblxd.exec:\pblxd.exe67⤵PID:1556
-
\??\c:\rvfhd.exec:\rvfhd.exe68⤵PID:1652
-
\??\c:\lfvrntp.exec:\lfvrntp.exe69⤵PID:1560
-
\??\c:\ppxvnn.exec:\ppxvnn.exe70⤵PID:1120
-
\??\c:\jrvvx.exec:\jrvvx.exe71⤵PID:2788
-
\??\c:\xxbdnj.exec:\xxbdnj.exe72⤵PID:1268
-
\??\c:\xlvlf.exec:\xlvlf.exe73⤵PID:2904
-
\??\c:\ddlbtjp.exec:\ddlbtjp.exe74⤵PID:1248
-
\??\c:\lhtxvr.exec:\lhtxvr.exe75⤵PID:3048
-
\??\c:\dxlvnh.exec:\dxlvnh.exe76⤵PID:2764
-
\??\c:\jlttv.exec:\jlttv.exe77⤵PID:936
-
\??\c:\vhhlph.exec:\vhhlph.exe78⤵PID:2316
-
\??\c:\pfpbb.exec:\pfpbb.exe79⤵PID:2232
-
\??\c:\dfbjpv.exec:\dfbjpv.exe80⤵PID:2248
-
\??\c:\tvhdb.exec:\tvhdb.exe81⤵PID:2244
-
\??\c:\btvvj.exec:\btvvj.exe82⤵PID:1676
-
\??\c:\jlnjbfv.exec:\jlnjbfv.exe83⤵PID:2824
-
\??\c:\vptrxj.exec:\vptrxj.exe84⤵PID:2568
-
\??\c:\fnpnn.exec:\fnpnn.exe85⤵PID:3040
-
\??\c:\dnhlnvd.exec:\dnhlnvd.exe86⤵PID:2160
-
\??\c:\dnbjvpb.exec:\dnbjvpb.exe87⤵PID:2588
-
\??\c:\rtvbll.exec:\rtvbll.exe88⤵PID:2504
-
\??\c:\lrxtbnd.exec:\lrxtbnd.exe89⤵PID:2768
-
\??\c:\bvndfn.exec:\bvndfn.exe90⤵PID:2404
-
\??\c:\lhnjthb.exec:\lhnjthb.exe91⤵PID:2868
-
\??\c:\bpxdh.exec:\bpxdh.exe92⤵PID:2548
-
\??\c:\drjdx.exec:\drjdx.exe93⤵PID:2056
-
\??\c:\pjdrvjb.exec:\pjdrvjb.exe94⤵PID:1620
-
\??\c:\plvtn.exec:\plvtn.exe95⤵PID:2408
-
\??\c:\thxfn.exec:\thxfn.exe96⤵PID:948
-
\??\c:\dxhpffv.exec:\dxhpffv.exe97⤵PID:1664
-
\??\c:\bxrjhdx.exec:\bxrjhdx.exe98⤵PID:1084
-
\??\c:\fpvbvrp.exec:\fpvbvrp.exe99⤵PID:896
-
\??\c:\hxfrxpl.exec:\hxfrxpl.exe100⤵PID:1716
-
\??\c:\vvrbr.exec:\vvrbr.exe101⤵PID:1640
-
\??\c:\hvfhdhb.exec:\hvfhdhb.exe102⤵PID:2696
-
\??\c:\ndvhv.exec:\ndvhv.exe103⤵PID:780
-
\??\c:\rrlnb.exec:\rrlnb.exe104⤵PID:2700
-
\??\c:\dplhx.exec:\dplhx.exe105⤵PID:2712
-
\??\c:\tjfjf.exec:\tjfjf.exe106⤵PID:1976
-
\??\c:\xlpjn.exec:\xlpjn.exe107⤵PID:2476
-
\??\c:\vjrjf.exec:\vjrjf.exe108⤵PID:1060
-
\??\c:\fnbtxt.exec:\fnbtxt.exe109⤵PID:1224
-
\??\c:\frljhr.exec:\frljhr.exe110⤵PID:2344
-
\??\c:\tfrdbtt.exec:\tfrdbtt.exe111⤵PID:1624
-
\??\c:\pnvrfr.exec:\pnvrfr.exe112⤵PID:1200
-
\??\c:\dthtrv.exec:\dthtrv.exe113⤵PID:1144
-
\??\c:\ntvtrr.exec:\ntvtrr.exe114⤵PID:900
-
\??\c:\thdfplv.exec:\thdfplv.exe115⤵PID:2208
-
\??\c:\vhbrj.exec:\vhbrj.exe116⤵PID:2988
-
\??\c:\vdxfj.exec:\vdxfj.exe117⤵PID:2844
-
\??\c:\rpnvtnr.exec:\rpnvtnr.exe118⤵PID:2936
-
\??\c:\hrrhvbh.exec:\hrrhvbh.exe119⤵PID:2800
-
\??\c:\nlnrlv.exec:\nlnrlv.exe120⤵PID:2112
-
\??\c:\bndphl.exec:\bndphl.exe121⤵PID:1152
-
\??\c:\nlndbfx.exec:\nlndbfx.exe122⤵PID:2308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-