Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 22:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
47b9c3634b0669661c256df10be741fecb613eaafa379bc17e400f282ea63711.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
47b9c3634b0669661c256df10be741fecb613eaafa379bc17e400f282ea63711.exe
-
Size
88KB
-
MD5
cc9941d010fe2642e7168bd2eed14266
-
SHA1
dded130601d6a64b3d798a1c2cb760866132b8f7
-
SHA256
47b9c3634b0669661c256df10be741fecb613eaafa379bc17e400f282ea63711
-
SHA512
3d194cbc5319b52d5f4118f079b624a07397f28e538735eb21a8e5cb475b227ceef098ca33e1ca7c6f7de7bda0c54e417099511fd647600621bc29fdf7c321d9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2iJvRirE0DmmdL2jqWkgo:ymb3NkkiQ3mdBjF+3TU2iBRioSumWuF
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2896-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/520-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/968-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1440-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/776-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/268-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 23 IoCs
resource yara_rule behavioral1/memory/2896-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3020-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3020-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2784-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2292-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2668-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2748-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2684-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2684-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2684-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2384-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/520-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/968-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2724-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1440-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1708-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/776-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/268-209-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2920-218-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1616-245-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1992-263-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1584-282-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3012-291-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2784 hlxjxdj.exe 3020 hnbph.exe 2668 tlxffpp.exe 2292 tlfprv.exe 2748 hjfnvd.exe 2684 pbptvd.exe 2384 xjjlxl.exe 2984 bdxtl.exe 520 plrnl.exe 968 xjtvfhp.exe 880 pjnph.exe 2724 jhdfx.exe 2340 brdbx.exe 1536 rlrbhn.exe 1100 xhtlrht.exe 1440 fvtplx.exe 952 tjhfdrb.exe 2256 njnhxfd.exe 1708 fjtljt.exe 776 jvxph.exe 268 bjjhnht.exe 2920 rffhd.exe 1060 nhhfr.exe 1732 vdvhn.exe 1616 bnjpvhj.exe 2448 fvrbrvb.exe 1992 pnhhdtx.exe 1640 ddhplp.exe 1584 llthn.exe 3012 lnllt.exe 3000 hnbpn.exe 1564 pvxtr.exe 1516 tphxdr.exe 3032 fhxdj.exe 2620 httrfr.exe 1960 hlltf.exe 2996 dddtrd.exe 2616 pfdxn.exe 2668 xdttx.exe 2964 rjhhh.exe 2536 fdjtfh.exe 2380 bftpr.exe 2484 ldvfht.exe 2396 hrftll.exe 2876 prlphj.exe 1264 thdfht.exe 572 lxxvrfl.exe 2344 rhlnx.exe 2728 hptprb.exe 2168 njfnrd.exe 864 dflxhvf.exe 1224 lnhnptl.exe 1088 bnjjfnd.exe 2352 rppbd.exe 2464 bptvtr.exe 1768 frhxp.exe 2460 nxnhr.exe 2972 lntrprj.exe 2312 jnhtl.exe 588 pvnbl.exe 2296 fbfxdnd.exe 1888 rrjxf.exe 1808 prdjbhx.exe 1060 rxltr.exe -
resource yara_rule behavioral1/memory/2896-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/520-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/968-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/776-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/268-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2896 wrote to memory of 2784 2896 47b9c3634b0669661c256df10be741fecb613eaafa379bc17e400f282ea63711.exe 28 PID 2896 wrote to memory of 2784 2896 47b9c3634b0669661c256df10be741fecb613eaafa379bc17e400f282ea63711.exe 28 PID 2896 wrote to memory of 2784 2896 47b9c3634b0669661c256df10be741fecb613eaafa379bc17e400f282ea63711.exe 28 PID 2896 wrote to memory of 2784 2896 47b9c3634b0669661c256df10be741fecb613eaafa379bc17e400f282ea63711.exe 28 PID 2784 wrote to memory of 3020 2784 hlxjxdj.exe 29 PID 2784 wrote to memory of 3020 2784 hlxjxdj.exe 29 PID 2784 wrote to memory of 3020 2784 hlxjxdj.exe 29 PID 2784 wrote to memory of 3020 2784 hlxjxdj.exe 29 PID 3020 wrote to memory of 2668 3020 hnbph.exe 30 PID 3020 wrote to memory of 2668 3020 hnbph.exe 30 PID 3020 wrote to memory of 2668 3020 hnbph.exe 30 PID 3020 wrote to memory of 2668 3020 hnbph.exe 30 PID 2668 wrote to memory of 2292 2668 tlxffpp.exe 31 PID 2668 wrote to memory of 2292 2668 tlxffpp.exe 31 PID 2668 wrote to memory of 2292 2668 tlxffpp.exe 31 PID 2668 wrote to memory of 2292 2668 tlxffpp.exe 31 PID 2292 wrote to memory of 2748 2292 tlfprv.exe 32 PID 2292 wrote to memory of 2748 2292 tlfprv.exe 32 PID 2292 wrote to memory of 2748 2292 tlfprv.exe 32 PID 2292 wrote to memory of 2748 2292 tlfprv.exe 32 PID 2748 wrote to memory of 2684 2748 hjfnvd.exe 33 PID 2748 wrote to memory of 2684 2748 hjfnvd.exe 33 PID 2748 wrote to memory of 2684 2748 hjfnvd.exe 33 PID 2748 wrote to memory of 2684 2748 hjfnvd.exe 33 PID 2684 wrote to memory of 2384 2684 pbptvd.exe 34 PID 2684 wrote to memory of 2384 2684 pbptvd.exe 34 PID 2684 wrote to memory of 2384 2684 pbptvd.exe 34 PID 2684 wrote to memory of 2384 2684 pbptvd.exe 34 PID 2384 wrote to memory of 2984 2384 xjjlxl.exe 35 PID 2384 wrote to memory of 2984 2384 xjjlxl.exe 35 PID 2384 wrote to memory of 2984 2384 xjjlxl.exe 35 PID 2384 wrote to memory of 2984 2384 xjjlxl.exe 35 PID 2984 wrote to memory of 520 2984 bdxtl.exe 36 PID 2984 wrote to memory of 520 2984 bdxtl.exe 36 PID 2984 wrote to memory of 520 2984 bdxtl.exe 36 PID 2984 wrote to memory of 520 2984 bdxtl.exe 36 PID 520 wrote to memory of 968 520 plrnl.exe 37 PID 520 wrote to memory of 968 520 plrnl.exe 37 PID 520 wrote to memory of 968 520 plrnl.exe 37 PID 520 wrote to memory of 968 520 plrnl.exe 37 PID 968 wrote to memory of 880 968 xjtvfhp.exe 38 PID 968 wrote to memory of 880 968 xjtvfhp.exe 38 PID 968 wrote to memory of 880 968 xjtvfhp.exe 38 PID 968 wrote to memory of 880 968 xjtvfhp.exe 38 PID 880 wrote to memory of 2724 880 pjnph.exe 39 PID 880 wrote to memory of 2724 880 pjnph.exe 39 PID 880 wrote to memory of 2724 880 pjnph.exe 39 PID 880 wrote to memory of 2724 880 pjnph.exe 39 PID 2724 wrote to memory of 2340 2724 jhdfx.exe 40 PID 2724 wrote to memory of 2340 2724 jhdfx.exe 40 PID 2724 wrote to memory of 2340 2724 jhdfx.exe 40 PID 2724 wrote to memory of 2340 2724 jhdfx.exe 40 PID 2340 wrote to memory of 1536 2340 brdbx.exe 41 PID 2340 wrote to memory of 1536 2340 brdbx.exe 41 PID 2340 wrote to memory of 1536 2340 brdbx.exe 41 PID 2340 wrote to memory of 1536 2340 brdbx.exe 41 PID 1536 wrote to memory of 1100 1536 rlrbhn.exe 42 PID 1536 wrote to memory of 1100 1536 rlrbhn.exe 42 PID 1536 wrote to memory of 1100 1536 rlrbhn.exe 42 PID 1536 wrote to memory of 1100 1536 rlrbhn.exe 42 PID 1100 wrote to memory of 1440 1100 xhtlrht.exe 43 PID 1100 wrote to memory of 1440 1100 xhtlrht.exe 43 PID 1100 wrote to memory of 1440 1100 xhtlrht.exe 43 PID 1100 wrote to memory of 1440 1100 xhtlrht.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\47b9c3634b0669661c256df10be741fecb613eaafa379bc17e400f282ea63711.exe"C:\Users\Admin\AppData\Local\Temp\47b9c3634b0669661c256df10be741fecb613eaafa379bc17e400f282ea63711.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\hlxjxdj.exec:\hlxjxdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\hnbph.exec:\hnbph.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\tlxffpp.exec:\tlxffpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\tlfprv.exec:\tlfprv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\hjfnvd.exec:\hjfnvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\pbptvd.exec:\pbptvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\xjjlxl.exec:\xjjlxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\bdxtl.exec:\bdxtl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\plrnl.exec:\plrnl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
\??\c:\xjtvfhp.exec:\xjtvfhp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\pjnph.exec:\pjnph.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\jhdfx.exec:\jhdfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\brdbx.exec:\brdbx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\rlrbhn.exec:\rlrbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\xhtlrht.exec:\xhtlrht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\fvtplx.exec:\fvtplx.exe17⤵
- Executes dropped EXE
PID:1440 -
\??\c:\tjhfdrb.exec:\tjhfdrb.exe18⤵
- Executes dropped EXE
PID:952 -
\??\c:\njnhxfd.exec:\njnhxfd.exe19⤵
- Executes dropped EXE
PID:2256 -
\??\c:\fjtljt.exec:\fjtljt.exe20⤵
- Executes dropped EXE
PID:1708 -
\??\c:\jvxph.exec:\jvxph.exe21⤵
- Executes dropped EXE
PID:776 -
\??\c:\bjjhnht.exec:\bjjhnht.exe22⤵
- Executes dropped EXE
PID:268 -
\??\c:\rffhd.exec:\rffhd.exe23⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nhhfr.exec:\nhhfr.exe24⤵
- Executes dropped EXE
PID:1060 -
\??\c:\vdvhn.exec:\vdvhn.exe25⤵
- Executes dropped EXE
PID:1732 -
\??\c:\bnjpvhj.exec:\bnjpvhj.exe26⤵
- Executes dropped EXE
PID:1616 -
\??\c:\fvrbrvb.exec:\fvrbrvb.exe27⤵
- Executes dropped EXE
PID:2448 -
\??\c:\pnhhdtx.exec:\pnhhdtx.exe28⤵
- Executes dropped EXE
PID:1992 -
\??\c:\ddhplp.exec:\ddhplp.exe29⤵
- Executes dropped EXE
PID:1640 -
\??\c:\llthn.exec:\llthn.exe30⤵
- Executes dropped EXE
PID:1584 -
\??\c:\lnllt.exec:\lnllt.exe31⤵
- Executes dropped EXE
PID:3012 -
\??\c:\hnbpn.exec:\hnbpn.exe32⤵
- Executes dropped EXE
PID:3000 -
\??\c:\pvxtr.exec:\pvxtr.exe33⤵
- Executes dropped EXE
PID:1564 -
\??\c:\tphxdr.exec:\tphxdr.exe34⤵
- Executes dropped EXE
PID:1516 -
\??\c:\fhxdj.exec:\fhxdj.exe35⤵
- Executes dropped EXE
PID:3032 -
\??\c:\httrfr.exec:\httrfr.exe36⤵
- Executes dropped EXE
PID:2620 -
\??\c:\hlltf.exec:\hlltf.exe37⤵
- Executes dropped EXE
PID:1960 -
\??\c:\dddtrd.exec:\dddtrd.exe38⤵
- Executes dropped EXE
PID:2996 -
\??\c:\pfdxn.exec:\pfdxn.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xdttx.exec:\xdttx.exe40⤵
- Executes dropped EXE
PID:2668 -
\??\c:\rjhhh.exec:\rjhhh.exe41⤵
- Executes dropped EXE
PID:2964 -
\??\c:\fdjtfh.exec:\fdjtfh.exe42⤵
- Executes dropped EXE
PID:2536 -
\??\c:\bftpr.exec:\bftpr.exe43⤵
- Executes dropped EXE
PID:2380 -
\??\c:\ldvfht.exec:\ldvfht.exe44⤵
- Executes dropped EXE
PID:2484 -
\??\c:\hrftll.exec:\hrftll.exe45⤵
- Executes dropped EXE
PID:2396 -
\??\c:\prlphj.exec:\prlphj.exe46⤵
- Executes dropped EXE
PID:2876 -
\??\c:\thdfht.exec:\thdfht.exe47⤵
- Executes dropped EXE
PID:1264 -
\??\c:\lxxvrfl.exec:\lxxvrfl.exe48⤵
- Executes dropped EXE
PID:572 -
\??\c:\rhlnx.exec:\rhlnx.exe49⤵
- Executes dropped EXE
PID:2344 -
\??\c:\hptprb.exec:\hptprb.exe50⤵
- Executes dropped EXE
PID:2728 -
\??\c:\njfnrd.exec:\njfnrd.exe51⤵
- Executes dropped EXE
PID:2168 -
\??\c:\dflxhvf.exec:\dflxhvf.exe52⤵
- Executes dropped EXE
PID:864 -
\??\c:\lnhnptl.exec:\lnhnptl.exe53⤵
- Executes dropped EXE
PID:1224 -
\??\c:\bnjjfnd.exec:\bnjjfnd.exe54⤵
- Executes dropped EXE
PID:1088 -
\??\c:\rppbd.exec:\rppbd.exe55⤵
- Executes dropped EXE
PID:2352 -
\??\c:\bptvtr.exec:\bptvtr.exe56⤵
- Executes dropped EXE
PID:2464 -
\??\c:\frhxp.exec:\frhxp.exe57⤵
- Executes dropped EXE
PID:1768 -
\??\c:\nxnhr.exec:\nxnhr.exe58⤵
- Executes dropped EXE
PID:2460 -
\??\c:\lntrprj.exec:\lntrprj.exe59⤵
- Executes dropped EXE
PID:2972 -
\??\c:\jnhtl.exec:\jnhtl.exe60⤵
- Executes dropped EXE
PID:2312 -
\??\c:\pvnbl.exec:\pvnbl.exe61⤵
- Executes dropped EXE
PID:588 -
\??\c:\fbfxdnd.exec:\fbfxdnd.exe62⤵
- Executes dropped EXE
PID:2296 -
\??\c:\rrjxf.exec:\rrjxf.exe63⤵
- Executes dropped EXE
PID:1888 -
\??\c:\prdjbhx.exec:\prdjbhx.exe64⤵
- Executes dropped EXE
PID:1808 -
\??\c:\rxltr.exec:\rxltr.exe65⤵
- Executes dropped EXE
PID:1060 -
\??\c:\hvhrxhh.exec:\hvhrxhh.exe66⤵PID:1328
-
\??\c:\fhhlxp.exec:\fhhlxp.exe67⤵PID:2016
-
\??\c:\ltpfjp.exec:\ltpfjp.exe68⤵PID:1084
-
\??\c:\pfvtrj.exec:\pfvtrj.exe69⤵PID:1624
-
\??\c:\rtvhh.exec:\rtvhh.exe70⤵PID:2140
-
\??\c:\vlddfjd.exec:\vlddfjd.exe71⤵PID:2832
-
\??\c:\tdptt.exec:\tdptt.exe72⤵PID:1728
-
\??\c:\ltnfjj.exec:\ltnfjj.exe73⤵PID:2336
-
\??\c:\tlvjbvl.exec:\tlvjbvl.exe74⤵PID:1752
-
\??\c:\htbrh.exec:\htbrh.exe75⤵PID:1792
-
\??\c:\rdjvt.exec:\rdjvt.exe76⤵PID:2896
-
\??\c:\lfdvrlb.exec:\lfdvrlb.exe77⤵PID:1516
-
\??\c:\pllttd.exec:\pllttd.exe78⤵PID:2680
-
\??\c:\jxxrpb.exec:\jxxrpb.exe79⤵PID:2620
-
\??\c:\lfrftjt.exec:\lfrftjt.exe80⤵PID:2644
-
\??\c:\tbdhtl.exec:\tbdhtl.exe81⤵PID:2480
-
\??\c:\jdrnfvd.exec:\jdrnfvd.exe82⤵PID:2520
-
\??\c:\pltntd.exec:\pltntd.exe83⤵PID:2372
-
\??\c:\pttlxxf.exec:\pttlxxf.exe84⤵PID:2416
-
\??\c:\jnrdd.exec:\jnrdd.exe85⤵PID:1588
-
\??\c:\lxnddff.exec:\lxnddff.exe86⤵PID:2360
-
\??\c:\xldtvrb.exec:\xldtvrb.exe87⤵PID:2872
-
\??\c:\fphtxdd.exec:\fphtxdd.exe88⤵PID:1388
-
\??\c:\xdhbdd.exec:\xdhbdd.exe89⤵PID:1372
-
\??\c:\tpffr.exec:\tpffr.exe90⤵PID:968
-
\??\c:\jdnvb.exec:\jdnvb.exe91⤵PID:1348
-
\??\c:\ttxpvjv.exec:\ttxpvjv.exe92⤵PID:1688
-
\??\c:\brvnthv.exec:\brvnthv.exe93⤵PID:2728
-
\??\c:\jxxrf.exec:\jxxrf.exe94⤵PID:1156
-
\??\c:\jhrvpnp.exec:\jhrvpnp.exe95⤵PID:2164
-
\??\c:\ljrnttr.exec:\ljrnttr.exe96⤵PID:2204
-
\??\c:\vrbff.exec:\vrbff.exe97⤵PID:1100
-
\??\c:\pblpf.exec:\pblpf.exe98⤵PID:1440
-
\??\c:\bbtbv.exec:\bbtbv.exe99⤵PID:2044
-
\??\c:\lxbvftx.exec:\lxbvftx.exe100⤵PID:952
-
\??\c:\tvdff.exec:\tvdff.exe101⤵PID:2276
-
\??\c:\vtlhvh.exec:\vtlhvh.exe102⤵PID:540
-
\??\c:\pfnrd.exec:\pfnrd.exe103⤵PID:2280
-
\??\c:\dndblfr.exec:\dndblfr.exe104⤵PID:912
-
\??\c:\lffxb.exec:\lffxb.exe105⤵PID:2196
-
\??\c:\ntvfhrx.exec:\ntvfhrx.exe106⤵PID:2920
-
\??\c:\nrrxjjd.exec:\nrrxjjd.exe107⤵PID:1248
-
\??\c:\jjfrppd.exec:\jjfrppd.exe108⤵PID:2452
-
\??\c:\ltblh.exec:\ltblh.exe109⤵PID:708
-
\??\c:\xfnpt.exec:\xfnpt.exe110⤵PID:2080
-
\??\c:\bpfjn.exec:\bpfjn.exe111⤵PID:2016
-
\??\c:\xrnjbln.exec:\xrnjbln.exe112⤵PID:2932
-
\??\c:\rjdhnp.exec:\rjdhnp.exe113⤵PID:1736
-
\??\c:\njjvbvt.exec:\njjvbvt.exe114⤵PID:2076
-
\??\c:\vjjjv.exec:\vjjjv.exe115⤵PID:1764
-
\??\c:\rflxphr.exec:\rflxphr.exe116⤵PID:2424
-
\??\c:\hxplb.exec:\hxplb.exe117⤵PID:1748
-
\??\c:\hnphbn.exec:\hnphbn.exe118⤵PID:960
-
\??\c:\rvpdbr.exec:\rvpdbr.exe119⤵PID:3060
-
\??\c:\rxnrrp.exec:\rxnrrp.exe120⤵PID:2896
-
\??\c:\rtfjj.exec:\rtfjj.exe121⤵PID:1516
-
\??\c:\ttxxj.exec:\ttxxj.exe122⤵PID:2680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-