Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 03:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d504078f4a11a08c275ac2a9f3a946f70d64fb675d2e8ac2c689005c1d5d6613.exe
Resource
win7-20240611-en
6 signatures
150 seconds
General
-
Target
d504078f4a11a08c275ac2a9f3a946f70d64fb675d2e8ac2c689005c1d5d6613.exe
-
Size
79KB
-
MD5
781302e1075e9d00bf290be83c96f919
-
SHA1
a4f44e11d7491439672aad3cc1c6cd3d25ac9563
-
SHA256
d504078f4a11a08c275ac2a9f3a946f70d64fb675d2e8ac2c689005c1d5d6613
-
SHA512
c06f8b4c2307be2b458be682fc221aeeca79cbf8061cf14b64e5dcbf3b008b1f4b3e1ddda2a07a55bcb7698423be52f700b132aa4a7ecb8272e86e1e8e3ee446
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA8v:ymb3NkkiQ3mdBjFIIp9L9QrrA8v
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2164-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/588-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/304-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/956-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/772-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 24 IoCs
resource yara_rule behavioral1/memory/2164-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2200-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2644-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2684-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2648-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2648-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2628-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2864-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2544-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2544-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/588-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2676-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/304-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1716-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1952-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/956-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1736-220-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2140-238-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1568-248-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/836-256-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/772-275-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2200 rvhjdfp.exe 2684 jbjxb.exe 2644 jjtnbp.exe 2648 xvlrd.exe 2628 hrjdldf.exe 2864 prrljb.exe 2544 jbbdr.exe 2568 fjdxl.exe 2992 bfprfx.exe 588 fvlvbph.exe 2676 pppjpr.exe 3024 npfbvb.exe 1316 xtdvj.exe 304 rlpbfr.exe 1716 tphjvd.exe 2596 vrhttrb.exe 1952 fbjrx.exe 956 hvdrn.exe 2468 bffhld.exe 1048 ppdfdh.exe 524 bxlhxp.exe 1736 lpvnnbn.exe 1112 pxhjhrx.exe 2140 jprnjt.exe 1568 fjxbdj.exe 836 jrnld.exe 1784 tvhddvn.exe 772 rxnvrn.exe 1540 lhbpvp.exe 2972 ljhtl.exe 1956 ljrnxn.exe 2184 bxfthvf.exe 2424 dllfb.exe 2132 ftnrltj.exe 1520 vpbbdtp.exe 2072 lhnhxjt.exe 2888 btvfnh.exe 1628 xbdpnr.exe 2692 jdhdf.exe 2920 lnfpj.exe 2648 fhtdff.exe 2740 xrphtn.exe 2532 dhdbdv.exe 2512 jxtrbt.exe 2976 fddpfvt.exe 1188 nfbxvfb.exe 1268 lvxvvl.exe 640 pnppjh.exe 2400 dnjldr.exe 1788 jfhrbld.exe 2776 jnhbf.exe 1036 vxlbx.exe 1032 dxlxrvt.exe 1300 vtdtxrf.exe 1320 dpprphp.exe 2812 pfbrfnr.exe 1768 ftxtdj.exe 1744 tnjjj.exe 2152 vhjxnbp.exe 2880 ldfdjb.exe 596 dtbdrv.exe 2928 xxlbvhf.exe 1272 rvldtd.exe 396 rttnhh.exe -
resource yara_rule behavioral1/memory/2164-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/588-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/304-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/956-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/772-275-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2200 2164 d504078f4a11a08c275ac2a9f3a946f70d64fb675d2e8ac2c689005c1d5d6613.exe 28 PID 2164 wrote to memory of 2200 2164 d504078f4a11a08c275ac2a9f3a946f70d64fb675d2e8ac2c689005c1d5d6613.exe 28 PID 2164 wrote to memory of 2200 2164 d504078f4a11a08c275ac2a9f3a946f70d64fb675d2e8ac2c689005c1d5d6613.exe 28 PID 2164 wrote to memory of 2200 2164 d504078f4a11a08c275ac2a9f3a946f70d64fb675d2e8ac2c689005c1d5d6613.exe 28 PID 2200 wrote to memory of 2684 2200 rvhjdfp.exe 29 PID 2200 wrote to memory of 2684 2200 rvhjdfp.exe 29 PID 2200 wrote to memory of 2684 2200 rvhjdfp.exe 29 PID 2200 wrote to memory of 2684 2200 rvhjdfp.exe 29 PID 2684 wrote to memory of 2644 2684 jbjxb.exe 30 PID 2684 wrote to memory of 2644 2684 jbjxb.exe 30 PID 2684 wrote to memory of 2644 2684 jbjxb.exe 30 PID 2684 wrote to memory of 2644 2684 jbjxb.exe 30 PID 2644 wrote to memory of 2648 2644 jjtnbp.exe 31 PID 2644 wrote to memory of 2648 2644 jjtnbp.exe 31 PID 2644 wrote to memory of 2648 2644 jjtnbp.exe 31 PID 2644 wrote to memory of 2648 2644 jjtnbp.exe 31 PID 2648 wrote to memory of 2628 2648 xvlrd.exe 32 PID 2648 wrote to memory of 2628 2648 xvlrd.exe 32 PID 2648 wrote to memory of 2628 2648 xvlrd.exe 32 PID 2648 wrote to memory of 2628 2648 xvlrd.exe 32 PID 2628 wrote to memory of 2864 2628 hrjdldf.exe 33 PID 2628 wrote to memory of 2864 2628 hrjdldf.exe 33 PID 2628 wrote to memory of 2864 2628 hrjdldf.exe 33 PID 2628 wrote to memory of 2864 2628 hrjdldf.exe 33 PID 2864 wrote to memory of 2544 2864 prrljb.exe 34 PID 2864 wrote to memory of 2544 2864 prrljb.exe 34 PID 2864 wrote to memory of 2544 2864 prrljb.exe 34 PID 2864 wrote to memory of 2544 2864 prrljb.exe 34 PID 2544 wrote to memory of 2568 2544 jbbdr.exe 35 PID 2544 wrote to memory of 2568 2544 jbbdr.exe 35 PID 2544 wrote to memory of 2568 2544 jbbdr.exe 35 PID 2544 wrote to memory of 2568 2544 jbbdr.exe 35 PID 2568 wrote to memory of 2992 2568 fjdxl.exe 36 PID 2568 wrote to memory of 2992 2568 fjdxl.exe 36 PID 2568 wrote to memory of 2992 2568 fjdxl.exe 36 PID 2568 wrote to memory of 2992 2568 fjdxl.exe 36 PID 2992 wrote to memory of 588 2992 bfprfx.exe 37 PID 2992 wrote to memory of 588 2992 bfprfx.exe 37 PID 2992 wrote to memory of 588 2992 bfprfx.exe 37 PID 2992 wrote to memory of 588 2992 bfprfx.exe 37 PID 588 wrote to memory of 2676 588 fvlvbph.exe 38 PID 588 wrote to memory of 2676 588 fvlvbph.exe 38 PID 588 wrote to memory of 2676 588 fvlvbph.exe 38 PID 588 wrote to memory of 2676 588 fvlvbph.exe 38 PID 2676 wrote to memory of 3024 2676 pppjpr.exe 39 PID 2676 wrote to memory of 3024 2676 pppjpr.exe 39 PID 2676 wrote to memory of 3024 2676 pppjpr.exe 39 PID 2676 wrote to memory of 3024 2676 pppjpr.exe 39 PID 3024 wrote to memory of 1316 3024 npfbvb.exe 40 PID 3024 wrote to memory of 1316 3024 npfbvb.exe 40 PID 3024 wrote to memory of 1316 3024 npfbvb.exe 40 PID 3024 wrote to memory of 1316 3024 npfbvb.exe 40 PID 1316 wrote to memory of 304 1316 xtdvj.exe 41 PID 1316 wrote to memory of 304 1316 xtdvj.exe 41 PID 1316 wrote to memory of 304 1316 xtdvj.exe 41 PID 1316 wrote to memory of 304 1316 xtdvj.exe 41 PID 304 wrote to memory of 1716 304 rlpbfr.exe 42 PID 304 wrote to memory of 1716 304 rlpbfr.exe 42 PID 304 wrote to memory of 1716 304 rlpbfr.exe 42 PID 304 wrote to memory of 1716 304 rlpbfr.exe 42 PID 1716 wrote to memory of 2596 1716 tphjvd.exe 43 PID 1716 wrote to memory of 2596 1716 tphjvd.exe 43 PID 1716 wrote to memory of 2596 1716 tphjvd.exe 43 PID 1716 wrote to memory of 2596 1716 tphjvd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\d504078f4a11a08c275ac2a9f3a946f70d64fb675d2e8ac2c689005c1d5d6613.exe"C:\Users\Admin\AppData\Local\Temp\d504078f4a11a08c275ac2a9f3a946f70d64fb675d2e8ac2c689005c1d5d6613.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\rvhjdfp.exec:\rvhjdfp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\jbjxb.exec:\jbjxb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\jjtnbp.exec:\jjtnbp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\xvlrd.exec:\xvlrd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\hrjdldf.exec:\hrjdldf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\prrljb.exec:\prrljb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\jbbdr.exec:\jbbdr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\fjdxl.exec:\fjdxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\bfprfx.exec:\bfprfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\fvlvbph.exec:\fvlvbph.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\pppjpr.exec:\pppjpr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\npfbvb.exec:\npfbvb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\xtdvj.exec:\xtdvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\rlpbfr.exec:\rlpbfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:304 -
\??\c:\tphjvd.exec:\tphjvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\vrhttrb.exec:\vrhttrb.exe17⤵
- Executes dropped EXE
PID:2596 -
\??\c:\fbjrx.exec:\fbjrx.exe18⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hvdrn.exec:\hvdrn.exe19⤵
- Executes dropped EXE
PID:956 -
\??\c:\bffhld.exec:\bffhld.exe20⤵
- Executes dropped EXE
PID:2468 -
\??\c:\ppdfdh.exec:\ppdfdh.exe21⤵
- Executes dropped EXE
PID:1048 -
\??\c:\bxlhxp.exec:\bxlhxp.exe22⤵
- Executes dropped EXE
PID:524 -
\??\c:\lpvnnbn.exec:\lpvnnbn.exe23⤵
- Executes dropped EXE
PID:1736 -
\??\c:\pxhjhrx.exec:\pxhjhrx.exe24⤵
- Executes dropped EXE
PID:1112 -
\??\c:\jprnjt.exec:\jprnjt.exe25⤵
- Executes dropped EXE
PID:2140 -
\??\c:\fjxbdj.exec:\fjxbdj.exe26⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jrnld.exec:\jrnld.exe27⤵
- Executes dropped EXE
PID:836 -
\??\c:\tvhddvn.exec:\tvhddvn.exe28⤵
- Executes dropped EXE
PID:1784 -
\??\c:\rxnvrn.exec:\rxnvrn.exe29⤵
- Executes dropped EXE
PID:772 -
\??\c:\lhbpvp.exec:\lhbpvp.exe30⤵
- Executes dropped EXE
PID:1540 -
\??\c:\ljhtl.exec:\ljhtl.exe31⤵
- Executes dropped EXE
PID:2972 -
\??\c:\ljrnxn.exec:\ljrnxn.exe32⤵
- Executes dropped EXE
PID:1956 -
\??\c:\bxfthvf.exec:\bxfthvf.exe33⤵
- Executes dropped EXE
PID:2184 -
\??\c:\dllfb.exec:\dllfb.exe34⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ftnrltj.exec:\ftnrltj.exe35⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vpbbdtp.exec:\vpbbdtp.exe36⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lhnhxjt.exec:\lhnhxjt.exe37⤵
- Executes dropped EXE
PID:2072 -
\??\c:\btvfnh.exec:\btvfnh.exe38⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xbdpnr.exec:\xbdpnr.exe39⤵
- Executes dropped EXE
PID:1628 -
\??\c:\jdhdf.exec:\jdhdf.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lnfpj.exec:\lnfpj.exe41⤵
- Executes dropped EXE
PID:2920 -
\??\c:\fhtdff.exec:\fhtdff.exe42⤵
- Executes dropped EXE
PID:2648 -
\??\c:\xrphtn.exec:\xrphtn.exe43⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dhdbdv.exec:\dhdbdv.exe44⤵
- Executes dropped EXE
PID:2532 -
\??\c:\jxtrbt.exec:\jxtrbt.exe45⤵
- Executes dropped EXE
PID:2512 -
\??\c:\fddpfvt.exec:\fddpfvt.exe46⤵
- Executes dropped EXE
PID:2976 -
\??\c:\nfbxvfb.exec:\nfbxvfb.exe47⤵
- Executes dropped EXE
PID:1188 -
\??\c:\lvxvvl.exec:\lvxvvl.exe48⤵
- Executes dropped EXE
PID:1268 -
\??\c:\pnppjh.exec:\pnppjh.exe49⤵
- Executes dropped EXE
PID:640 -
\??\c:\dnjldr.exec:\dnjldr.exe50⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jfhrbld.exec:\jfhrbld.exe51⤵
- Executes dropped EXE
PID:1788 -
\??\c:\jnhbf.exec:\jnhbf.exe52⤵
- Executes dropped EXE
PID:2776 -
\??\c:\vxlbx.exec:\vxlbx.exe53⤵
- Executes dropped EXE
PID:1036 -
\??\c:\dxlxrvt.exec:\dxlxrvt.exe54⤵
- Executes dropped EXE
PID:1032 -
\??\c:\vtdtxrf.exec:\vtdtxrf.exe55⤵
- Executes dropped EXE
PID:1300 -
\??\c:\dpprphp.exec:\dpprphp.exe56⤵
- Executes dropped EXE
PID:1320 -
\??\c:\pfbrfnr.exec:\pfbrfnr.exe57⤵
- Executes dropped EXE
PID:2812 -
\??\c:\ftxtdj.exec:\ftxtdj.exe58⤵
- Executes dropped EXE
PID:1768 -
\??\c:\tnjjj.exec:\tnjjj.exe59⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vhjxnbp.exec:\vhjxnbp.exe60⤵
- Executes dropped EXE
PID:2152 -
\??\c:\ldfdjb.exec:\ldfdjb.exe61⤵
- Executes dropped EXE
PID:2880 -
\??\c:\dtbdrv.exec:\dtbdrv.exe62⤵
- Executes dropped EXE
PID:596 -
\??\c:\xxlbvhf.exec:\xxlbvhf.exe63⤵
- Executes dropped EXE
PID:2928 -
\??\c:\rvldtd.exec:\rvldtd.exe64⤵
- Executes dropped EXE
PID:1272 -
\??\c:\rttnhh.exec:\rttnhh.exe65⤵
- Executes dropped EXE
PID:396 -
\??\c:\fdlvjt.exec:\fdlvjt.exe66⤵PID:2148
-
\??\c:\hbvhf.exec:\hbvhf.exe67⤵PID:1976
-
\??\c:\vvpvvtn.exec:\vvpvvtn.exe68⤵PID:1424
-
\??\c:\hppjlv.exec:\hppjlv.exe69⤵PID:2272
-
\??\c:\tdjllx.exec:\tdjllx.exe70⤵PID:1820
-
\??\c:\rxptl.exec:\rxptl.exe71⤵PID:2428
-
\??\c:\tnxtvl.exec:\tnxtvl.exe72⤵PID:2112
-
\??\c:\xvbxhh.exec:\xvbxhh.exe73⤵PID:1828
-
\??\c:\ltfvdbl.exec:\ltfvdbl.exe74⤵PID:2948
-
\??\c:\vbrdjbp.exec:\vbrdjbp.exe75⤵PID:112
-
\??\c:\phpfhp.exec:\phpfhp.exe76⤵PID:888
-
\??\c:\ttbpl.exec:\ttbpl.exe77⤵PID:2900
-
\??\c:\httpn.exec:\httpn.exe78⤵PID:1120
-
\??\c:\plvfr.exec:\plvfr.exe79⤵PID:2280
-
\??\c:\tvfjh.exec:\tvfjh.exe80⤵PID:2384
-
\??\c:\ndblntd.exec:\ndblntd.exe81⤵PID:2624
-
\??\c:\nvdxfjh.exec:\nvdxfjh.exe82⤵PID:1632
-
\??\c:\lxntld.exec:\lxntld.exe83⤵PID:2208
-
\??\c:\vxxhr.exec:\vxxhr.exe84⤵PID:2744
-
\??\c:\njlbtph.exec:\njlbtph.exe85⤵PID:2748
-
\??\c:\pvlvjp.exec:\pvlvjp.exe86⤵PID:2504
-
\??\c:\hnvbv.exec:\hnvbv.exe87⤵PID:2608
-
\??\c:\nbpjpd.exec:\nbpjpd.exe88⤵PID:2660
-
\??\c:\ppttnl.exec:\ppttnl.exe89⤵PID:2664
-
\??\c:\fbrppn.exec:\fbrppn.exe90⤵PID:2412
-
\??\c:\xpxfdd.exec:\xpxfdd.exe91⤵PID:1188
-
\??\c:\hjhff.exec:\hjhff.exe92⤵PID:2996
-
\??\c:\dntvphn.exec:\dntvphn.exe93⤵PID:640
-
\??\c:\vllvp.exec:\vllvp.exe94⤵PID:2584
-
\??\c:\ljnxdvr.exec:\ljnxdvr.exe95⤵PID:1788
-
\??\c:\pxbthjn.exec:\pxbthjn.exe96⤵PID:3000
-
\??\c:\nbrnjpj.exec:\nbrnjpj.exe97⤵PID:1884
-
\??\c:\xrhlt.exec:\xrhlt.exe98⤵PID:3020
-
\??\c:\jrbltxd.exec:\jrbltxd.exe99⤵PID:2548
-
\??\c:\bjjndp.exec:\bjjndp.exe100⤵PID:1040
-
\??\c:\dxbbnr.exec:\dxbbnr.exe101⤵PID:2332
-
\??\c:\phxtd.exec:\phxtd.exe102⤵PID:1756
-
\??\c:\hdvftd.exec:\hdvftd.exe103⤵PID:2060
-
\??\c:\tjddv.exec:\tjddv.exe104⤵PID:2324
-
\??\c:\pprnhn.exec:\pprnhn.exe105⤵PID:956
-
\??\c:\pxtrx.exec:\pxtrx.exe106⤵PID:320
-
\??\c:\bdrxfl.exec:\bdrxfl.exe107⤵PID:2052
-
\??\c:\rrjvj.exec:\rrjvj.exe108⤵PID:524
-
\??\c:\ntltpnv.exec:\ntltpnv.exe109⤵PID:1248
-
\??\c:\vbbtv.exec:\vbbtv.exe110⤵PID:432
-
\??\c:\jpdrn.exec:\jpdrn.exe111⤵PID:2148
-
\??\c:\dbxhbvp.exec:\dbxhbvp.exe112⤵PID:1976
-
\??\c:\prlxfdt.exec:\prlxfdt.exe113⤵PID:1424
-
\??\c:\vpdbpv.exec:\vpdbpv.exe114⤵PID:1880
-
\??\c:\bndnnfh.exec:\bndnnfh.exe115⤵PID:1820
-
\??\c:\npdhtb.exec:\npdhtb.exe116⤵PID:2428
-
\??\c:\nrflnft.exec:\nrflnft.exe117⤵PID:2112
-
\??\c:\jpllh.exec:\jpllh.exe118⤵PID:1828
-
\??\c:\xpxltf.exec:\xpxltf.exe119⤵PID:2948
-
\??\c:\pbttj.exec:\pbttj.exe120⤵PID:112
-
\??\c:\jffjjbp.exec:\jffjjbp.exe121⤵PID:888
-
\??\c:\jdfpj.exec:\jdfpj.exe122⤵PID:2184
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-