Analysis
-
max time kernel
110s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
28-10-2023 20:16
Behavioral task
behavioral1
Sample
NEAS.e1584cca234f9ad4939431578fc270e0.exe
Resource
win7-20231020-en
windows7-x64
5 signatures
150 seconds
General
-
Target
NEAS.e1584cca234f9ad4939431578fc270e0.exe
-
Size
134KB
-
MD5
e1584cca234f9ad4939431578fc270e0
-
SHA1
10b3f177242396587cfa3a0ff309b70a8c261efc
-
SHA256
7cba174e1d374938b06058b66b7ef61279d06fdfa057c5983678769448393167
-
SHA512
2d2129cabe1a58b36a0aff21e8247d2366689ace91faeb913d847746001d13304e79ef4933668f8fc2676297544e1e9c921b89f3c3c917bcf8d6c715f0431c67
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4J/CyCB2H:9cm4FmowdHoS4/8QH
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1060-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2916-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3812-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1940-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1772-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4040-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2832-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1580-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2580-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3176-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3148-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/980-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3512-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1704-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3084-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3104-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3784-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4760-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/744-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1592-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2468-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2544-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1468-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2828-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4632-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2912-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2628-477-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2936-515-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3964-543-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-574-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4636-601-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-607-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-667-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1404-721-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4196-839-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-853-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-877-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2296-1044-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2228-1058-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4996 bvpjn.exe 1772 tdtxrfl.exe 1940 jbvrll.exe 3812 fhnnftp.exe 3448 fvxrh.exe 4712 nnpnlf.exe 3556 hfhjx.exe 4072 nvhdrj.exe 2916 vphlxjf.exe 4540 nrlhxnx.exe 212 djxdfr.exe 4040 vtnjhxp.exe 4224 hvxbbf.exe 1356 xfnpb.exe 2832 vpjdjbp.exe 4048 trjdr.exe 1580 nnrxpdh.exe 2828 vhvdbv.exe 1468 nxtflvf.exe 768 rhvbx.exe 2336 dbfxxb.exe 4840 ndbbx.exe 2860 hpdbvdd.exe 2580 pxnbtp.exe 4584 jnplnbp.exe 3176 dbnldjn.exe 3672 vhllr.exe 1388 ljrdbv.exe 3208 dvlbtfd.exe 1592 ddtjppt.exe 3148 ndpxt.exe 3888 jfrbtx.exe 980 lffthb.exe 3304 xnfvfbn.exe 3884 xhjrx.exe 3512 rnbfh.exe 5076 brfldxf.exe 3904 drlnpdl.exe 1704 fljhphr.exe 5068 rbvlrh.exe 1632 lbrfnl.exe 4736 vxbfl.exe 1276 pjjbv.exe 3084 hlvth.exe 4408 rtvbx.exe 4600 ntxtrf.exe 2160 lrhlbj.exe 4284 bjpfl.exe 3584 tpbjxp.exe 4664 jbvthpx.exe 3180 fppfjd.exe 4636 bprjrnt.exe 5012 bphbp.exe 3104 ptnvdbx.exe 5044 ttndrfr.exe 3336 dxndrt.exe 3784 brlvpd.exe 4760 jrfvndn.exe 3244 drthvp.exe 1952 bpvbtbv.exe 456 tvlbdfn.exe 4368 xljfjv.exe 4384 hrdbtbv.exe 4968 hbhhnh.exe -
resource yara_rule behavioral2/memory/1060-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022d86-5.dat upx behavioral2/memory/1060-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d8e-16.dat upx behavioral2/files/0x0007000000022d8f-19.dat upx behavioral2/files/0x0007000000022d8f-21.dat upx behavioral2/files/0x0007000000022d90-25.dat upx behavioral2/memory/3448-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d91-31.dat upx behavioral2/memory/4072-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d95-52.dat upx behavioral2/files/0x0007000000022d97-56.dat upx behavioral2/memory/212-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d97-58.dat upx behavioral2/files/0x0007000000022d95-51.dat upx behavioral2/memory/2916-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d94-47.dat upx behavioral2/files/0x0007000000022d94-46.dat upx behavioral2/memory/4072-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d93-41.dat upx behavioral2/files/0x0007000000022d93-39.dat upx behavioral2/files/0x0007000000022d92-36.dat upx behavioral2/memory/4712-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d92-34.dat upx behavioral2/files/0x0007000000022d91-29.dat upx behavioral2/memory/3812-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d90-24.dat upx behavioral2/memory/1940-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d8e-15.dat upx behavioral2/memory/1772-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d8e-11.dat upx behavioral2/files/0x0008000000022d89-10.dat upx behavioral2/memory/4996-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022d89-8.dat upx behavioral2/files/0x0008000000022d86-3.dat upx behavioral2/files/0x0007000000022d98-64.dat upx behavioral2/files/0x0007000000022d98-62.dat upx behavioral2/memory/4040-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d99-69.dat upx behavioral2/files/0x0007000000022d99-67.dat upx behavioral2/files/0x0007000000022d9b-74.dat upx behavioral2/memory/4224-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d9b-72.dat upx behavioral2/files/0x0007000000022d9c-77.dat upx behavioral2/files/0x0007000000022d9c-79.dat upx behavioral2/memory/1356-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022d9d-82.dat upx behavioral2/memory/2832-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022d9d-84.dat upx behavioral2/files/0x0008000000022d9e-87.dat upx behavioral2/files/0x0008000000022d9e-89.dat upx behavioral2/memory/4048-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1580-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022da1-102.dat upx behavioral2/files/0x0008000000022da1-104.dat upx behavioral2/files/0x0008000000022da2-107.dat upx behavioral2/files/0x0008000000022da3-112.dat upx behavioral2/files/0x0008000000022da3-114.dat upx behavioral2/files/0x0008000000022da4-117.dat upx behavioral2/memory/2580-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022da5-124.dat upx behavioral2/files/0x0007000000022da8-130.dat upx behavioral2/files/0x0007000000022da9-135.dat upx behavioral2/memory/3176-139-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1060 wrote to memory of 4996 1060 NEAS.e1584cca234f9ad4939431578fc270e0.exe 33 PID 1060 wrote to memory of 4996 1060 NEAS.e1584cca234f9ad4939431578fc270e0.exe 33 PID 1060 wrote to memory of 4996 1060 NEAS.e1584cca234f9ad4939431578fc270e0.exe 33 PID 4996 wrote to memory of 1772 4996 bvpjn.exe 32 PID 4996 wrote to memory of 1772 4996 bvpjn.exe 32 PID 4996 wrote to memory of 1772 4996 bvpjn.exe 32 PID 1772 wrote to memory of 1940 1772 tdtxrfl.exe 31 PID 1772 wrote to memory of 1940 1772 tdtxrfl.exe 31 PID 1772 wrote to memory of 1940 1772 tdtxrfl.exe 31 PID 1940 wrote to memory of 3812 1940 jbvrll.exe 22 PID 1940 wrote to memory of 3812 1940 jbvrll.exe 22 PID 1940 wrote to memory of 3812 1940 jbvrll.exe 22 PID 3812 wrote to memory of 3448 3812 fhnnftp.exe 30 PID 3812 wrote to memory of 3448 3812 fhnnftp.exe 30 PID 3812 wrote to memory of 3448 3812 fhnnftp.exe 30 PID 3448 wrote to memory of 4712 3448 fvxrh.exe 23 PID 3448 wrote to memory of 4712 3448 fvxrh.exe 23 PID 3448 wrote to memory of 4712 3448 fvxrh.exe 23 PID 4712 wrote to memory of 3556 4712 nnpnlf.exe 176 PID 4712 wrote to memory of 3556 4712 nnpnlf.exe 176 PID 4712 wrote to memory of 3556 4712 nnpnlf.exe 176 PID 3556 wrote to memory of 4072 3556 hfhjx.exe 256 PID 3556 wrote to memory of 4072 3556 hfhjx.exe 256 PID 3556 wrote to memory of 4072 3556 hfhjx.exe 256 PID 4072 wrote to memory of 2916 4072 nvhdrj.exe 27 PID 4072 wrote to memory of 2916 4072 nvhdrj.exe 27 PID 4072 wrote to memory of 2916 4072 nvhdrj.exe 27 PID 2916 wrote to memory of 4540 2916 vphlxjf.exe 25 PID 2916 wrote to memory of 4540 2916 vphlxjf.exe 25 PID 2916 wrote to memory of 4540 2916 vphlxjf.exe 25 PID 4540 wrote to memory of 212 4540 nrlhxnx.exe 26 PID 4540 wrote to memory of 212 4540 nrlhxnx.exe 26 PID 4540 wrote to memory of 212 4540 nrlhxnx.exe 26 PID 212 wrote to memory of 4040 212 djxdfr.exe 46 PID 212 wrote to memory of 4040 212 djxdfr.exe 46 PID 212 wrote to memory of 4040 212 djxdfr.exe 46 PID 4040 wrote to memory of 4224 4040 vtnjhxp.exe 190 PID 4040 wrote to memory of 4224 4040 vtnjhxp.exe 190 PID 4040 wrote to memory of 4224 4040 vtnjhxp.exe 190 PID 4224 wrote to memory of 1356 4224 hvxbbf.exe 56 PID 4224 wrote to memory of 1356 4224 hvxbbf.exe 56 PID 4224 wrote to memory of 1356 4224 hvxbbf.exe 56 PID 1356 wrote to memory of 2832 1356 xfnpb.exe 62 PID 1356 wrote to memory of 2832 1356 xfnpb.exe 62 PID 1356 wrote to memory of 2832 1356 xfnpb.exe 62 PID 2832 wrote to memory of 4048 2832 vpjdjbp.exe 74 PID 2832 wrote to memory of 4048 2832 vpjdjbp.exe 74 PID 2832 wrote to memory of 4048 2832 vpjdjbp.exe 74 PID 4048 wrote to memory of 1580 4048 trjdr.exe 156 PID 4048 wrote to memory of 1580 4048 trjdr.exe 156 PID 4048 wrote to memory of 1580 4048 trjdr.exe 156 PID 1580 wrote to memory of 2828 1580 nnrxpdh.exe 155 PID 1580 wrote to memory of 2828 1580 nnrxpdh.exe 155 PID 1580 wrote to memory of 2828 1580 nnrxpdh.exe 155 PID 2828 wrote to memory of 1468 2828 vhvdbv.exe 78 PID 2828 wrote to memory of 1468 2828 vhvdbv.exe 78 PID 2828 wrote to memory of 1468 2828 vhvdbv.exe 78 PID 1468 wrote to memory of 768 1468 nxtflvf.exe 154 PID 1468 wrote to memory of 768 1468 nxtflvf.exe 154 PID 1468 wrote to memory of 768 1468 nxtflvf.exe 154 PID 768 wrote to memory of 2336 768 rhvbx.exe 127 PID 768 wrote to memory of 2336 768 rhvbx.exe 127 PID 768 wrote to memory of 2336 768 rhvbx.exe 127 PID 2336 wrote to memory of 4840 2336 dbfxxb.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.e1584cca234f9ad4939431578fc270e0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.e1584cca234f9ad4939431578fc270e0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\bvpjn.exec:\bvpjn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996
-
-
\??\c:\fhnnftp.exec:\fhnnftp.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\fvxrh.exec:\fvxrh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448
-
-
\??\c:\nnpnlf.exec:\nnpnlf.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\ddhxrdr.exec:\ddhxrdr.exe2⤵PID:3556
-
\??\c:\dtnfrbf.exec:\dtnfrbf.exe3⤵PID:2132
-
\??\c:\fldvn.exec:\fldvn.exe4⤵PID:4140
-
\??\c:\jhbtnxf.exec:\jhbtnxf.exe5⤵PID:2912
-
\??\c:\bvrdffr.exec:\bvrdffr.exe6⤵PID:3112
-
\??\c:\tjxtxb.exec:\tjxtxb.exe7⤵PID:4940
-
\??\c:\vxrbb.exec:\vxrbb.exe8⤵PID:3668
-
\??\c:\xlplx.exec:\xlplx.exe9⤵PID:2432
-
\??\c:\hvxbbf.exec:\hvxbbf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224
-
-
-
-
-
-
-
-
-
-
\??\c:\nfbhl.exec:\nfbhl.exe1⤵PID:4072
-
\??\c:\vphlxjf.exec:\vphlxjf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916
-
-
\??\c:\nrlhxnx.exec:\nrlhxnx.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\djxdfr.exec:\djxdfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\vtnjhxp.exec:\vtnjhxp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\nnrfv.exec:\nnrfv.exe4⤵PID:4224
-
\??\c:\xfnpb.exec:\xfnpb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\vpjdjbp.exec:\vpjdjbp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\trjdr.exec:\trjdr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\nnrxpdh.exec:\nnrxpdh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\vtljlt.exec:\vtljlt.exe9⤵PID:1844
-
-
-
-
-
-
\??\c:\rvxpf.exec:\rvxpf.exe5⤵PID:112
-
\??\c:\nlttlln.exec:\nlttlln.exe6⤵PID:1188
-
\??\c:\dfbbvn.exec:\dfbbvn.exe7⤵PID:228
-
\??\c:\nfvfx.exec:\nfvfx.exe8⤵PID:4460
-
\??\c:\tbnbv.exec:\tbnbv.exe9⤵PID:1084
-
\??\c:\njpfrh.exec:\njpfrh.exe10⤵PID:5056
-
\??\c:\vpvjt.exec:\vpvjt.exe11⤵PID:5000
-
\??\c:\xfrttbf.exec:\xfrttbf.exe12⤵PID:2452
-
\??\c:\hthjb.exec:\hthjb.exe13⤵PID:2628
-
\??\c:\pphhdvv.exec:\pphhdvv.exe14⤵PID:1844
-
\??\c:\pfjbvlp.exec:\pfjbvlp.exe15⤵PID:4676
-
\??\c:\vbxdvb.exec:\vbxdvb.exe16⤵PID:4344
-
-
-
-
-
-
-
-
\??\c:\bpbxp.exec:\bpbxp.exe10⤵PID:1744
-
\??\c:\tnxlbdl.exec:\tnxlbdl.exe11⤵PID:64
-
\??\c:\trvpvnt.exec:\trvpvnt.exe12⤵PID:4344
-
\??\c:\vvnbv.exec:\vvnbv.exe13⤵PID:2784
-
\??\c:\vvjtnjb.exec:\vvjtnjb.exe14⤵PID:4860
-
\??\c:\nhdvnrd.exec:\nhdvnrd.exe15⤵PID:3272
-
\??\c:\lfxnbvb.exec:\lfxnbvb.exe16⤵PID:2204
-
\??\c:\pfndfx.exec:\pfndfx.exe17⤵PID:3948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\fnnnt.exec:\fnnnt.exe4⤵PID:3544
-
\??\c:\hrrhvlv.exec:\hrrhvlv.exe5⤵PID:2940
-
\??\c:\rjfrpn.exec:\rjfrpn.exe6⤵PID:116
-
\??\c:\dhxxf.exec:\dhxxf.exe7⤵PID:2832
-
-
-
\??\c:\tfdvrv.exec:\tfdvrv.exe6⤵PID:5108
-
\??\c:\rlhtrt.exec:\rlhtrt.exe7⤵PID:840
-
\??\c:\bftpjth.exec:\bftpjth.exe8⤵PID:4508
-
\??\c:\nvjnhj.exec:\nvjnhj.exe9⤵PID:4940
-
\??\c:\djbfv.exec:\djbfv.exe10⤵PID:3528
-
\??\c:\fnvxhv.exec:\fnvxhv.exe11⤵PID:4944
-
\??\c:\xnvlb.exec:\xnvlb.exe12⤵PID:3024
-
\??\c:\ffldntv.exec:\ffldntv.exe13⤵PID:2400
-
\??\c:\nvrxdf.exec:\nvrxdf.exe14⤵PID:3716
-
\??\c:\fbrjb.exec:\fbrjb.exe15⤵PID:1844
-
\??\c:\ttrvhdl.exec:\ttrvhdl.exe16⤵PID:2876
-
\??\c:\rrxrjln.exec:\rrxrjln.exe17⤵PID:2892
-
\??\c:\jdhjxdr.exec:\jdhjxdr.exe18⤵PID:4304
-
\??\c:\rrdnpj.exec:\rrdnpj.exe19⤵PID:4292
-
\??\c:\bvtrb.exec:\bvtrb.exe20⤵PID:4012
-
\??\c:\vddhf.exec:\vddhf.exe21⤵PID:4044
-
\??\c:\dxphr.exec:\dxphr.exe22⤵PID:3176
-
\??\c:\vbrvv.exec:\vbrvv.exe23⤵PID:768
-
\??\c:\tfjjjv.exec:\tfjjjv.exe24⤵PID:4308
-
\??\c:\nhpppt.exec:\nhpppt.exe25⤵PID:4876
-
\??\c:\rrtbhjh.exec:\rrtbhjh.exe26⤵PID:2296
-
\??\c:\pbbfnbv.exec:\pbbfnbv.exe27⤵PID:3500
-
\??\c:\nbdpbl.exec:\nbdpbl.exe28⤵PID:5080
-
\??\c:\pnxbnjj.exec:\pnxbnjj.exe29⤵PID:2068
-
\??\c:\hxlpn.exec:\hxlpn.exe30⤵PID:3452
-
\??\c:\bhfnttb.exec:\bhfnttb.exe31⤵PID:3708
-
\??\c:\dvtdrlx.exec:\dvtdrlx.exe32⤵PID:3184
-
\??\c:\jxrplv.exec:\jxrplv.exe33⤵PID:4300
-
\??\c:\fhvpvl.exec:\fhvpvl.exe34⤵PID:2276
-
\??\c:\hfldb.exec:\hfldb.exe35⤵PID:4456
-
\??\c:\rptvvrp.exec:\rptvvrp.exe36⤵PID:5036
-
\??\c:\nhrlbjx.exec:\nhrlbjx.exe37⤵PID:1884
-
\??\c:\rndthdr.exec:\rndthdr.exe38⤵PID:1904
-
\??\c:\ddrdl.exec:\ddrdl.exe39⤵PID:4364
-
\??\c:\bddjf.exec:\bddjf.exe40⤵PID:4848
-
\??\c:\rvtdpvl.exec:\rvtdpvl.exe41⤵PID:4068
-
\??\c:\dxttrr.exec:\dxttrr.exe42⤵PID:5020
-
\??\c:\bhdvbp.exec:\bhdvbp.exe43⤵PID:3064
-
\??\c:\rhdvnn.exec:\rhdvnn.exe44⤵PID:3748
-
\??\c:\pnljh.exec:\pnljh.exe45⤵PID:3608
-
\??\c:\jpdbn.exec:\jpdbn.exe46⤵PID:3564
-
\??\c:\vvfxpft.exec:\vvfxpft.exe47⤵PID:4088
-
\??\c:\dbnfnp.exec:\dbnfnp.exe48⤵PID:4284
-
\??\c:\xfndj.exec:\xfndj.exe49⤵PID:872
-
\??\c:\dvhprxd.exec:\dvhprxd.exe50⤵PID:1640
-
\??\c:\jttbvx.exec:\jttbvx.exe51⤵PID:2756
-
\??\c:\hvhfdfj.exec:\hvhfdfj.exe52⤵PID:4132
-
\??\c:\jbjxv.exec:\jbjxv.exe53⤵PID:3388
-
\??\c:\nbtdld.exec:\nbtdld.exe54⤵PID:4352
-
\??\c:\bffbvnt.exec:\bffbvnt.exe55⤵PID:5008
-
\??\c:\pjbxdp.exec:\pjbxdp.exe56⤵PID:3144
-
\??\c:\nvlptd.exec:\nvlptd.exe57⤵PID:4072
-
\??\c:\fdtvthr.exec:\fdtvthr.exe58⤵PID:5072
-
\??\c:\xvtlhd.exec:\xvtlhd.exe59⤵PID:4740
-
\??\c:\fhtnr.exec:\fhtnr.exe60⤵PID:3632
-
\??\c:\lxvln.exec:\lxvln.exe61⤵PID:2912
-
\??\c:\fbprr.exec:\fbprr.exe62⤵PID:4400
-
\??\c:\vplvjp.exec:\vplvjp.exe63⤵PID:3872
-
\??\c:\tlvhnf.exec:\tlvhnf.exe64⤵PID:4540
-
\??\c:\rjfrht.exec:\rjfrht.exe65⤵PID:4844
-
\??\c:\nnxnvh.exec:\nnxnvh.exe66⤵PID:4712
-
\??\c:\npxrvlh.exec:\npxrvlh.exe67⤵PID:840
-
\??\c:\vljtrv.exec:\vljtrv.exe68⤵PID:1808
-
\??\c:\bvbltl.exec:\bvbltl.exe69⤵PID:3784
-
\??\c:\plrjtj.exec:\plrjtj.exe70⤵PID:4884
-
\??\c:\tvndjh.exec:\tvndjh.exe71⤵PID:1684
-
\??\c:\vdfft.exec:\vdfft.exe72⤵PID:2908
-
\??\c:\dtvdt.exec:\dtvdt.exe73⤵PID:5000
-
\??\c:\jvbbf.exec:\jvbbf.exe74⤵PID:2648
-
\??\c:\fnvrbb.exec:\fnvrbb.exe75⤵PID:2800
-
\??\c:\xjhxfjl.exec:\xjhxfjl.exe76⤵PID:2080
-
\??\c:\dlddt.exec:\dlddt.exe77⤵PID:4304
-
\??\c:\ddffln.exec:\ddffln.exe78⤵PID:32
-
\??\c:\ntdfnfl.exec:\ntdfnfl.exe79⤵PID:4584
-
\??\c:\pplrpnn.exec:\pplrpnn.exe80⤵PID:3488
-
\??\c:\nhljtnn.exec:\nhljtnn.exe81⤵PID:2228
-
\??\c:\xlpjhjh.exec:\xlpjhjh.exe82⤵PID:4716
-
\??\c:\dvfxj.exec:\dvfxj.exe83⤵PID:3096
-
\??\c:\hrhprvv.exec:\hrhprvv.exe84⤵PID:4832
-
\??\c:\xxtnv.exec:\xxtnv.exe85⤵PID:1576
-
\??\c:\rddhfb.exec:\rddhfb.exe86⤵PID:776
-
\??\c:\vxpvlnr.exec:\vxpvlnr.exe87⤵PID:3500
-
\??\c:\vfdhv.exec:\vfdhv.exe88⤵PID:4536
-
\??\c:\lvjxxrx.exec:\lvjxxrx.exe89⤵PID:2996
-
\??\c:\nhrvt.exec:\nhrvt.exe90⤵PID:1128
-
\??\c:\pfjbvjj.exec:\pfjbvjj.exe91⤵PID:1688
-
\??\c:\bxfpfp.exec:\bxfpfp.exe92⤵PID:3184
-
\??\c:\nfhftxl.exec:\nfhftxl.exe93⤵PID:4300
-
\??\c:\rrdjjpl.exec:\rrdjjpl.exe94⤵PID:3524
-
\??\c:\hhvnt.exec:\hhvnt.exe95⤵PID:980
-
\??\c:\jdbvtt.exec:\jdbvtt.exe96⤵PID:2960
-
\??\c:\rflrbr.exec:\rflrbr.exe97⤵PID:1636
-
\??\c:\fdvbb.exec:\fdvbb.exe98⤵PID:4180
-
\??\c:\nftvj.exec:\nftvj.exe99⤵PID:2244
-
\??\c:\tjfhxv.exec:\tjfhxv.exe100⤵PID:4984
-
\??\c:\htjvpf.exec:\htjvpf.exe101⤵PID:1840
-
\??\c:\dhvbfxp.exec:\dhvbfxp.exe102⤵PID:2424
-
\??\c:\xjbdnd.exec:\xjbdnd.exe103⤵PID:652
-
\??\c:\vllvfdf.exec:\vllvfdf.exe104⤵PID:8
-
\??\c:\bftxxr.exec:\bftxxr.exe105⤵PID:1948
-
\??\c:\rtbhtb.exec:\rtbhtb.exe106⤵PID:3564
-
\??\c:\ldbrdvt.exec:\ldbrdvt.exe107⤵PID:4412
-
\??\c:\vrntdlp.exec:\vrntdlp.exe108⤵PID:4748
-
\??\c:\ljjvdjb.exec:\ljjvdjb.exe109⤵PID:1304
-
\??\c:\pjtlxx.exec:\pjtlxx.exe110⤵PID:1480
-
\??\c:\pbxfvt.exec:\pbxfvt.exe111⤵PID:4756
-
\??\c:\tlxvnb.exec:\tlxvnb.exe112⤵PID:3156
-
\??\c:\bdvnhv.exec:\bdvnhv.exe113⤵PID:4636
-
\??\c:\lnnvhp.exec:\lnnvhp.exe114⤵PID:4352
-
\??\c:\lhfrt.exec:\lhfrt.exe115⤵PID:348
-
\??\c:\rbxfp.exec:\rbxfp.exe116⤵PID:2224
-
\??\c:\nnhvbr.exec:\nnhvbr.exe117⤵PID:4072
-
\??\c:\hrrjdjr.exec:\hrrjdjr.exe118⤵PID:2640
-
\??\c:\njxjpj.exec:\njxjpj.exe119⤵PID:3476
-
\??\c:\dnvnffb.exec:\dnvnffb.exe120⤵PID:3632
-
\??\c:\dxbnbrl.exec:\dxbnbrl.exe121⤵PID:1028
-
\??\c:\xddrrr.exec:\xddrrr.exe122⤵PID:2596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-