Analysis
-
max time kernel
94s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 22:02
Behavioral task
behavioral1
Sample
NEAS.e0c4893c9926a652b9eef4c80480c730_JC.exe
Resource
win7-20231023-en
5 signatures
150 seconds
General
-
Target
NEAS.e0c4893c9926a652b9eef4c80480c730_JC.exe
-
Size
364KB
-
MD5
e0c4893c9926a652b9eef4c80480c730
-
SHA1
f686f265a79b47d7795116a68995ec8d24878b75
-
SHA256
8591c5e965af3bcdef8d8453edc1716fdadb66436561f36990fcfff0c5399bee
-
SHA512
acb48afef7fa51282ffabae7f7bbca3b5a5fbd8e8334e42be317fa2702c5bd275c0640b2e65749642f7b4b4492d23bf5e49ccbc5c6fd63465ad89d077ca16ac5
-
SSDEEP
6144:zcm4FmowdHoSgWrXD486jJq1BStv4Ib1HmKDA/:Z4wFHoSgWj16A3Stvxg/
Malware Config
Signatures
-
Detect Blackmoon payload 59 IoCs
resource yara_rule behavioral2/memory/1840-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/232-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1144-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1228-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/964-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3968-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2748-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3300-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1908-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3796-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1720-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1740-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1452-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2252-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/752-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1484-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5056-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2624-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2700-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4124-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/964-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5072-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3372-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3484-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1680-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4296-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2112-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4752-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2480-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4768-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2112-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1572-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3756-549-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1404-587-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1840 npbpnpr.exe 4540 ttbhbr.exe 1548 thlbtn.exe 4144 vxxfh.exe 1144 npldr.exe 964 phrhlxh.exe 1228 jjlprvf.exe 2272 vlldbp.exe 4604 nxjndbr.exe 224 vpbtx.exe 2044 xvbjjll.exe 3604 fvfrxxf.exe 3968 ndnvr.exe 4316 jpnhfl.exe 2748 jjxhh.exe 4792 jnxppv.exe 888 ndjnb.exe 3300 xvjfdjf.exe 2012 vvdffjh.exe 3796 xdplb.exe 2608 bnfjn.exe 1908 fdxbr.exe 1560 rjfjnbp.exe 5112 tlffj.exe 1720 rbttt.exe 2592 xfbdb.exe 752 tnfrb.exe 3012 nxthtjb.exe 1740 lvjjtft.exe 4220 jftpvft.exe 1164 djhxjvt.exe 1452 blvpfxt.exe 4400 ldjlphj.exe 2252 brtflpt.exe 4824 jjjhvv.exe 1704 rhltvft.exe 4744 bfbjp.exe 1484 nnftjt.exe 2428 vbblv.exe 3720 xvdbr.exe 4320 thbvjf.exe 3120 tvplb.exe 532 prhnr.exe 5056 phxrn.exe 4544 vxttp.exe 2624 ltndfpn.exe 2844 nphdfbv.exe 2700 xbrlr.exe 3944 hfvff.exe 4500 rnxfxpn.exe 1180 lldbbdl.exe 4496 jddnbl.exe 3112 jljbdnb.exe 4124 jrtnjf.exe 964 rfxntf.exe 5000 bddhtj.exe 4068 hbrflr.exe 5072 ntbvr.exe 400 plfhbxj.exe 60 lvttr.exe 220 jxrtpnt.exe 4808 dtnbfpn.exe 2328 xphhnjj.exe 1072 rxvldn.exe -
resource yara_rule behavioral2/memory/232-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022d73-3.dat upx behavioral2/memory/1840-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d78-9.dat upx behavioral2/memory/232-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d78-10.dat upx behavioral2/files/0x0007000000022d79-11.dat upx behavioral2/files/0x0008000000022d73-4.dat upx behavioral2/memory/4540-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d79-14.dat upx behavioral2/files/0x0007000000022d79-15.dat upx behavioral2/files/0x0007000000022d7a-18.dat upx behavioral2/memory/1548-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d7a-20.dat upx behavioral2/files/0x0007000000022d7b-23.dat upx behavioral2/files/0x0007000000022d7b-25.dat upx behavioral2/memory/4144-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d7c-28.dat upx behavioral2/memory/1144-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d7c-30.dat upx behavioral2/files/0x0008000000022d74-33.dat upx behavioral2/files/0x0008000000022d74-35.dat upx behavioral2/memory/1228-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/964-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d7f-39.dat upx behavioral2/files/0x0007000000022d7f-40.dat upx behavioral2/files/0x0006000000022d91-43.dat upx behavioral2/memory/2272-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d91-44.dat upx behavioral2/files/0x0006000000022d92-48.dat upx behavioral2/files/0x0006000000022d92-49.dat upx behavioral2/memory/224-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d93-53.dat upx behavioral2/files/0x0006000000022d93-54.dat upx behavioral2/memory/224-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d94-59.dat upx behavioral2/memory/2044-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d94-58.dat upx behavioral2/files/0x0006000000022d95-63.dat upx behavioral2/files/0x0006000000022d95-64.dat upx behavioral2/files/0x0006000000022d96-67.dat upx behavioral2/files/0x0006000000022d96-69.dat upx behavioral2/memory/3968-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d97-72.dat upx behavioral2/files/0x0006000000022d97-73.dat upx behavioral2/memory/2748-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d98-78.dat upx behavioral2/files/0x0006000000022d9a-86.dat upx behavioral2/memory/3300-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d9b-91.dat upx behavioral2/files/0x0006000000022d9b-90.dat upx behavioral2/files/0x0006000000022d9a-85.dat upx behavioral2/files/0x0006000000022d9c-94.dat upx behavioral2/memory/2012-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2608-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d9e-106.dat upx behavioral2/files/0x0006000000022d9e-105.dat upx behavioral2/files/0x0006000000022d9f-111.dat upx behavioral2/files/0x0006000000022d9f-110.dat upx behavioral2/files/0x0006000000022da0-114.dat upx behavioral2/files/0x0006000000022da0-115.dat upx behavioral2/memory/1908-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3796-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d9d-100.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 232 wrote to memory of 1840 232 NEAS.e0c4893c9926a652b9eef4c80480c730_JC.exe 84 PID 232 wrote to memory of 1840 232 NEAS.e0c4893c9926a652b9eef4c80480c730_JC.exe 84 PID 232 wrote to memory of 1840 232 NEAS.e0c4893c9926a652b9eef4c80480c730_JC.exe 84 PID 1840 wrote to memory of 4540 1840 npbpnpr.exe 85 PID 1840 wrote to memory of 4540 1840 npbpnpr.exe 85 PID 1840 wrote to memory of 4540 1840 npbpnpr.exe 85 PID 4540 wrote to memory of 1548 4540 ttbhbr.exe 86 PID 4540 wrote to memory of 1548 4540 ttbhbr.exe 86 PID 4540 wrote to memory of 1548 4540 ttbhbr.exe 86 PID 1548 wrote to memory of 4144 1548 thlbtn.exe 87 PID 1548 wrote to memory of 4144 1548 thlbtn.exe 87 PID 1548 wrote to memory of 4144 1548 thlbtn.exe 87 PID 4144 wrote to memory of 1144 4144 vxxfh.exe 88 PID 4144 wrote to memory of 1144 4144 vxxfh.exe 88 PID 4144 wrote to memory of 1144 4144 vxxfh.exe 88 PID 1144 wrote to memory of 964 1144 npldr.exe 89 PID 1144 wrote to memory of 964 1144 npldr.exe 89 PID 1144 wrote to memory of 964 1144 npldr.exe 89 PID 964 wrote to memory of 1228 964 phrhlxh.exe 90 PID 964 wrote to memory of 1228 964 phrhlxh.exe 90 PID 964 wrote to memory of 1228 964 phrhlxh.exe 90 PID 1228 wrote to memory of 2272 1228 jjlprvf.exe 91 PID 1228 wrote to memory of 2272 1228 jjlprvf.exe 91 PID 1228 wrote to memory of 2272 1228 jjlprvf.exe 91 PID 2272 wrote to memory of 4604 2272 vlldbp.exe 92 PID 2272 wrote to memory of 4604 2272 vlldbp.exe 92 PID 2272 wrote to memory of 4604 2272 vlldbp.exe 92 PID 4604 wrote to memory of 224 4604 nxjndbr.exe 93 PID 4604 wrote to memory of 224 4604 nxjndbr.exe 93 PID 4604 wrote to memory of 224 4604 nxjndbr.exe 93 PID 224 wrote to memory of 2044 224 vpbtx.exe 94 PID 224 wrote to memory of 2044 224 vpbtx.exe 94 PID 224 wrote to memory of 2044 224 vpbtx.exe 94 PID 2044 wrote to memory of 3604 2044 xvbjjll.exe 95 PID 2044 wrote to memory of 3604 2044 xvbjjll.exe 95 PID 2044 wrote to memory of 3604 2044 xvbjjll.exe 95 PID 3604 wrote to memory of 3968 3604 fvfrxxf.exe 96 PID 3604 wrote to memory of 3968 3604 fvfrxxf.exe 96 PID 3604 wrote to memory of 3968 3604 fvfrxxf.exe 96 PID 3968 wrote to memory of 4316 3968 ndnvr.exe 97 PID 3968 wrote to memory of 4316 3968 ndnvr.exe 97 PID 3968 wrote to memory of 4316 3968 ndnvr.exe 97 PID 4316 wrote to memory of 2748 4316 jpnhfl.exe 98 PID 4316 wrote to memory of 2748 4316 jpnhfl.exe 98 PID 4316 wrote to memory of 2748 4316 jpnhfl.exe 98 PID 2748 wrote to memory of 4792 2748 jjxhh.exe 99 PID 2748 wrote to memory of 4792 2748 jjxhh.exe 99 PID 2748 wrote to memory of 4792 2748 jjxhh.exe 99 PID 4792 wrote to memory of 888 4792 jnxppv.exe 109 PID 4792 wrote to memory of 888 4792 jnxppv.exe 109 PID 4792 wrote to memory of 888 4792 jnxppv.exe 109 PID 888 wrote to memory of 3300 888 ndjnb.exe 108 PID 888 wrote to memory of 3300 888 ndjnb.exe 108 PID 888 wrote to memory of 3300 888 ndjnb.exe 108 PID 3300 wrote to memory of 2012 3300 xvjfdjf.exe 107 PID 3300 wrote to memory of 2012 3300 xvjfdjf.exe 107 PID 3300 wrote to memory of 2012 3300 xvjfdjf.exe 107 PID 2012 wrote to memory of 3796 2012 vvdffjh.exe 100 PID 2012 wrote to memory of 3796 2012 vvdffjh.exe 100 PID 2012 wrote to memory of 3796 2012 vvdffjh.exe 100 PID 3796 wrote to memory of 2608 3796 xdplb.exe 101 PID 3796 wrote to memory of 2608 3796 xdplb.exe 101 PID 3796 wrote to memory of 2608 3796 xdplb.exe 101 PID 2608 wrote to memory of 1908 2608 bnfjn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.e0c4893c9926a652b9eef4c80480c730_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.e0c4893c9926a652b9eef4c80480c730_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\npbpnpr.exec:\npbpnpr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\ttbhbr.exec:\ttbhbr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\thlbtn.exec:\thlbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\vxxfh.exec:\vxxfh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\npldr.exec:\npldr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\phrhlxh.exec:\phrhlxh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\jjlprvf.exec:\jjlprvf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\vlldbp.exec:\vlldbp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\nxjndbr.exec:\nxjndbr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\vpbtx.exec:\vpbtx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\xvbjjll.exec:\xvbjjll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\fvfrxxf.exec:\fvfrxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\ndnvr.exec:\ndnvr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\jpnhfl.exec:\jpnhfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\jjxhh.exec:\jjxhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\jnxppv.exec:\jnxppv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\ndjnb.exec:\ndjnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\xdplb.exec:\xdplb.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\bnfjn.exec:\bnfjn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\fdxbr.exec:\fdxbr.exe3⤵
- Executes dropped EXE
PID:1908
-
-
-
\??\c:\rbttt.exec:\rbttt.exe1⤵
- Executes dropped EXE
PID:1720 -
\??\c:\xfbdb.exec:\xfbdb.exe2⤵
- Executes dropped EXE
PID:2592
-
-
\??\c:\tlffj.exec:\tlffj.exe1⤵
- Executes dropped EXE
PID:5112
-
\??\c:\rjfjnbp.exec:\rjfjnbp.exe1⤵
- Executes dropped EXE
PID:1560
-
\??\c:\vvdffjh.exec:\vvdffjh.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012
-
\??\c:\xvjfdjf.exec:\xvjfdjf.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300
-
\??\c:\tnfrb.exec:\tnfrb.exe1⤵
- Executes dropped EXE
PID:752 -
\??\c:\nxthtjb.exec:\nxthtjb.exe2⤵
- Executes dropped EXE
PID:3012
-
-
\??\c:\jftpvft.exec:\jftpvft.exe1⤵
- Executes dropped EXE
PID:4220 -
\??\c:\djhxjvt.exec:\djhxjvt.exe2⤵
- Executes dropped EXE
PID:1164 -
\??\c:\blvpfxt.exec:\blvpfxt.exe3⤵
- Executes dropped EXE
PID:1452 -
\??\c:\ldjlphj.exec:\ldjlphj.exe4⤵
- Executes dropped EXE
PID:4400 -
\??\c:\brtflpt.exec:\brtflpt.exe5⤵
- Executes dropped EXE
PID:2252 -
\??\c:\jjjhvv.exec:\jjjhvv.exe6⤵
- Executes dropped EXE
PID:4824 -
\??\c:\rhltvft.exec:\rhltvft.exe7⤵
- Executes dropped EXE
PID:1704 -
\??\c:\bfbjp.exec:\bfbjp.exe8⤵
- Executes dropped EXE
PID:4744 -
\??\c:\nnftjt.exec:\nnftjt.exe9⤵
- Executes dropped EXE
PID:1484 -
\??\c:\vbblv.exec:\vbblv.exe10⤵
- Executes dropped EXE
PID:2428 -
\??\c:\xvdbr.exec:\xvdbr.exe11⤵
- Executes dropped EXE
PID:3720 -
\??\c:\thbvjf.exec:\thbvjf.exe12⤵
- Executes dropped EXE
PID:4320 -
\??\c:\tvplb.exec:\tvplb.exe13⤵
- Executes dropped EXE
PID:3120 -
\??\c:\prhnr.exec:\prhnr.exe14⤵
- Executes dropped EXE
PID:532 -
\??\c:\phxrn.exec:\phxrn.exe15⤵
- Executes dropped EXE
PID:5056 -
\??\c:\vxttp.exec:\vxttp.exe16⤵
- Executes dropped EXE
PID:4544 -
\??\c:\ltndfpn.exec:\ltndfpn.exe17⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nphdfbv.exec:\nphdfbv.exe18⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xbrlr.exec:\xbrlr.exe19⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hfvff.exec:\hfvff.exe20⤵
- Executes dropped EXE
PID:3944 -
\??\c:\rnxfxpn.exec:\rnxfxpn.exe21⤵
- Executes dropped EXE
PID:4500 -
\??\c:\lldbbdl.exec:\lldbbdl.exe22⤵
- Executes dropped EXE
PID:1180 -
\??\c:\jddnbl.exec:\jddnbl.exe23⤵
- Executes dropped EXE
PID:4496 -
\??\c:\jljbdnb.exec:\jljbdnb.exe24⤵
- Executes dropped EXE
PID:3112 -
\??\c:\jrtnjf.exec:\jrtnjf.exe25⤵
- Executes dropped EXE
PID:4124 -
\??\c:\rfxntf.exec:\rfxntf.exe26⤵
- Executes dropped EXE
PID:964 -
\??\c:\bddhtj.exec:\bddhtj.exe27⤵
- Executes dropped EXE
PID:5000 -
\??\c:\hbrflr.exec:\hbrflr.exe28⤵
- Executes dropped EXE
PID:4068 -
\??\c:\ntbvr.exec:\ntbvr.exe29⤵
- Executes dropped EXE
PID:5072 -
\??\c:\plfhbxj.exec:\plfhbxj.exe30⤵
- Executes dropped EXE
PID:400 -
\??\c:\lvttr.exec:\lvttr.exe31⤵
- Executes dropped EXE
PID:60 -
\??\c:\jxrtpnt.exec:\jxrtpnt.exe32⤵
- Executes dropped EXE
PID:220 -
\??\c:\dtnbfpn.exec:\dtnbfpn.exe33⤵
- Executes dropped EXE
PID:4808 -
\??\c:\xphhnjj.exec:\xphhnjj.exe34⤵
- Executes dropped EXE
PID:2328 -
\??\c:\rxvldn.exec:\rxvldn.exe35⤵
- Executes dropped EXE
PID:1072 -
\??\c:\dbvnh.exec:\dbvnh.exe36⤵PID:4948
-
\??\c:\hjxtlr.exec:\hjxtlr.exe37⤵PID:2012
-
\??\c:\nnlvlxx.exec:\nnlvlxx.exe38⤵PID:3372
-
\??\c:\dtprn.exec:\dtprn.exe39⤵PID:1908
-
\??\c:\rxdjjf.exec:\rxdjjf.exe40⤵PID:4624
-
\??\c:\tprbxx.exec:\tprbxx.exe41⤵PID:1080
-
\??\c:\tvfnvbl.exec:\tvfnvbl.exe42⤵PID:3484
-
\??\c:\dbxnn.exec:\dbxnn.exe43⤵PID:1680
-
\??\c:\jnxpj.exec:\jnxpj.exe44⤵PID:1844
-
\??\c:\tflbrhh.exec:\tflbrhh.exe45⤵PID:1860
-
\??\c:\tdtjj.exec:\tdtjj.exe46⤵PID:4664
-
\??\c:\fhphf.exec:\fhphf.exe47⤵PID:3572
-
\??\c:\fhrffff.exec:\fhrffff.exe48⤵PID:4220
-
\??\c:\pnlxjnp.exec:\pnlxjnp.exe49⤵PID:1500
-
\??\c:\hnxrxh.exec:\hnxrxh.exe50⤵PID:4296
-
\??\c:\rjlndl.exec:\rjlndl.exe51⤵PID:4620
-
\??\c:\nbjthl.exec:\nbjthl.exe52⤵PID:3548
-
\??\c:\jppnvbt.exec:\jppnvbt.exe53⤵PID:2252
-
\??\c:\xpfrxtr.exec:\xpfrxtr.exe54⤵PID:1408
-
\??\c:\xrthvjd.exec:\xrthvjd.exe55⤵PID:4824
-
\??\c:\vfhpffx.exec:\vfhpffx.exe56⤵PID:496
-
\??\c:\lprjj.exec:\lprjj.exe57⤵PID:1704
-
\??\c:\nxnllft.exec:\nxnllft.exe58⤵PID:4744
-
\??\c:\vhbhp.exec:\vhbhp.exe59⤵PID:3228
-
\??\c:\xjjrvxf.exec:\xjjrvxf.exe60⤵PID:1864
-
\??\c:\rxdlhl.exec:\rxdlhl.exe61⤵PID:3076
-
\??\c:\prxndhh.exec:\prxndhh.exe62⤵PID:264
-
\??\c:\jhfrptp.exec:\jhfrptp.exe63⤵PID:652
-
\??\c:\rrjnd.exec:\rrjnd.exe64⤵PID:1380
-
\??\c:\hdlxtn.exec:\hdlxtn.exe65⤵PID:2112
-
\??\c:\nprtj.exec:\nprtj.exe66⤵PID:1444
-
\??\c:\xbptpf.exec:\xbptpf.exe67⤵PID:4752
-
\??\c:\hrnbh.exec:\hrnbh.exe68⤵PID:2092
-
\??\c:\jrhrvh.exec:\jrhrvh.exe69⤵PID:2700
-
\??\c:\dtrvpp.exec:\dtrvpp.exe70⤵PID:996
-
\??\c:\xdffbr.exec:\xdffbr.exe71⤵PID:4144
-
\??\c:\rhjbhpx.exec:\rhjbhpx.exe72⤵PID:4660
-
\??\c:\ntbhr.exec:\ntbhr.exe73⤵PID:4060
-
\??\c:\jjnjxvj.exec:\jjnjxvj.exe74⤵PID:5060
-
\??\c:\hxxdn.exec:\hxxdn.exe75⤵PID:572
-
\??\c:\drnpfv.exec:\drnpfv.exe76⤵PID:2272
-
\??\c:\jjrtx.exec:\jjrtx.exe77⤵PID:5000
-
\??\c:\ltvdxb.exec:\ltvdxb.exe78⤵PID:224
-
\??\c:\rhnhxdp.exec:\rhnhxdp.exe79⤵PID:3556
-
\??\c:\rlrxjrr.exec:\rlrxjrr.exe80⤵PID:3184
-
\??\c:\jnjjbvb.exec:\jnjjbvb.exe81⤵PID:444
-
\??\c:\hrnft.exec:\hrnft.exe82⤵PID:2404
-
\??\c:\hxjvplr.exec:\hxjvplr.exe83⤵PID:3676
-
\??\c:\hvrljx.exec:\hvrljx.exe84⤵PID:2736
-
\??\c:\dnlvj.exec:\dnlvj.exe85⤵PID:1676
-
\??\c:\blbpt.exec:\blbpt.exe86⤵PID:4948
-
\??\c:\lpfbfp.exec:\lpfbfp.exe87⤵PID:2012
-
\??\c:\tbjjv.exec:\tbjjv.exe88⤵PID:3372
-
\??\c:\ttllv.exec:\ttllv.exe89⤵PID:1888
-
\??\c:\jvbpnph.exec:\jvbpnph.exe90⤵PID:4624
-
\??\c:\xfnvr.exec:\xfnvr.exe91⤵PID:3524
-
\??\c:\lprppj.exec:\lprppj.exe92⤵PID:4772
-
\??\c:\jrtfb.exec:\jrtfb.exe93⤵PID:2592
-
\??\c:\lrtxhl.exec:\lrtxhl.exe94⤵PID:3756
-
\??\c:\phxnnvb.exec:\phxnnvb.exe95⤵PID:2396
-
\??\c:\dvnnxxj.exec:\dvnnxxj.exe96⤵PID:5096
-
\??\c:\dlrphl.exec:\dlrphl.exe97⤵PID:3580
-
\??\c:\bvbjf.exec:\bvbjf.exe98⤵PID:4400
-
\??\c:\btpfp.exec:\btpfp.exe99⤵PID:1476
-
\??\c:\lfhxhrn.exec:\lfhxhrn.exe100⤵PID:2480
-
\??\c:\tfldt.exec:\tfldt.exe101⤵PID:4568
-
\??\c:\lvndn.exec:\lvndn.exe102⤵PID:3168
-
\??\c:\lrfnjtj.exec:\lrfnjtj.exe103⤵PID:3588
-
\??\c:\hlvnlrr.exec:\hlvnlrr.exe104⤵PID:4016
-
\??\c:\rfhtpt.exec:\rfhtpt.exe105⤵PID:4864
-
\??\c:\bbbrr.exec:\bbbrr.exe106⤵PID:3408
-
\??\c:\tbxtjr.exec:\tbxtjr.exe107⤵PID:4152
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\jprpj.exec:\jprpj.exe74⤵PID:3604
-
\??\c:\bnldjr.exec:\bnldjr.exe75⤵PID:1416
-
\??\c:\fxdhv.exec:\fxdhv.exe76⤵PID:220
-
\??\c:\jjbht.exec:\jjbht.exe77⤵PID:4808
-
\??\c:\fhjtx.exec:\fhjtx.exe78⤵PID:1436
-
\??\c:\ntxpj.exec:\ntxpj.exe79⤵PID:4416
-
\??\c:\fbdbnh.exec:\fbdbnh.exe80⤵PID:4076
-
\??\c:\nbrtjjx.exec:\nbrtjjx.exe81⤵PID:2608
-
\??\c:\hpfhvdv.exec:\hpfhvdv.exe82⤵PID:3764
-
\??\c:\rxrhhnt.exec:\rxrhhnt.exe83⤵PID:2320
-
\??\c:\ppdvn.exec:\ppdvn.exe84⤵PID:4732
-
\??\c:\rrhhvh.exec:\rrhhvh.exe85⤵PID:4036
-
\??\c:\vfppr.exec:\vfppr.exe86⤵PID:3536
-
\??\c:\tbjhrl.exec:\tbjhrl.exe87⤵PID:3688
-
\??\c:\fdlbb.exec:\fdlbb.exe88⤵PID:4928
-
\??\c:\hvrrjd.exec:\hvrrjd.exe89⤵PID:3456
-
\??\c:\jfpnbrb.exec:\jfpnbrb.exe90⤵PID:3848
-
\??\c:\jnjrv.exec:\jnjrv.exe91⤵PID:2040
-
\??\c:\hbtxpv.exec:\hbtxpv.exe92⤵PID:4160
-
\??\c:\jntbfd.exec:\jntbfd.exe93⤵PID:1408
-
\??\c:\vlxvl.exec:\vlxvl.exe94⤵PID:4552
-
\??\c:\xjtdjfn.exec:\xjtdjfn.exe95⤵PID:1872
-
\??\c:\xfhtvp.exec:\xfhtvp.exe96⤵PID:5104
-
\??\c:\vjrfpnx.exec:\vjrfpnx.exe97⤵PID:4320
-
\??\c:\pfxbvvb.exec:\pfxbvvb.exe98⤵PID:1748
-
\??\c:\xjhjdr.exec:\xjhjdr.exe99⤵PID:4312
-
\??\c:\npphhnr.exec:\npphhnr.exe100⤵PID:5056
-
\??\c:\vvdrjjx.exec:\vvdrjjx.exe101⤵PID:1840
-
\??\c:\rvtjb.exec:\rvtjb.exe102⤵PID:784
-
\??\c:\bjtbjv.exec:\bjtbjv.exe103⤵PID:952
-
\??\c:\jttpt.exec:\jttpt.exe104⤵PID:4952
-
\??\c:\fprvnbr.exec:\fprvnbr.exe105⤵PID:4476
-
\??\c:\bfnfr.exec:\bfnfr.exe106⤵PID:1824
-
\??\c:\txlrnpb.exec:\txlrnpb.exe107⤵PID:180
-
\??\c:\prrxrdn.exec:\prrxrdn.exe108⤵PID:1492
-
\??\c:\lbpjdll.exec:\lbpjdll.exe109⤵PID:2080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\rbbdhnd.exec:\rbbdhnd.exe67⤵PID:1420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\lvjjtft.exec:\lvjjtft.exe1⤵
- Executes dropped EXE
PID:1740
-
\??\c:\bbrfrdf.exec:\bbrfrdf.exe1⤵PID:2904
-
\??\c:\lprlfj.exec:\lprlfj.exe2⤵PID:2988
-
-
\??\c:\hxdxnx.exec:\hxdxnx.exe1⤵PID:4768
-
\??\c:\rfddxvb.exec:\rfddxvb.exe2⤵PID:1108
-
\??\c:\hvjtv.exec:\hvjtv.exe3⤵PID:4544
-
\??\c:\vfnjj.exec:\vfnjj.exe4⤵PID:2112
-
\??\c:\pbtblrh.exec:\pbtblrh.exe5⤵PID:1444
-
-
-
-
-
\??\c:\blbpt.exec:\blbpt.exe1⤵PID:3364
-
\??\c:\hjlvvvv.exec:\hjlvvvv.exe1⤵PID:1572
-
\??\c:\tnhdh.exec:\tnhdh.exe2⤵PID:4500
-
\??\c:\flxpj.exec:\flxpj.exe3⤵PID:1180
-
\??\c:\ddtdhf.exec:\ddtdhf.exe4⤵PID:4144
-
\??\c:\jxvhnn.exec:\jxvhnn.exe5⤵PID:4660
-
\??\c:\hnnbpx.exec:\hnnbpx.exe6⤵PID:4060
-
-
-
-
-
-
\??\c:\rxfhvj.exec:\rxfhvj.exe1⤵PID:2700
-
\??\c:\jvfxh.exec:\jvfxh.exe2⤵PID:5048
-
\??\c:\jtnvvbf.exec:\jtnvvbf.exe3⤵PID:1144
-
\??\c:\vrnhx.exec:\vrnhx.exe4⤵PID:556
-
\??\c:\vxvhjt.exec:\vxvhjt.exe5⤵PID:964
-
\??\c:\rxnxjbn.exec:\rxnxjbn.exe6⤵PID:4264
-
\??\c:\ttxjv.exec:\ttxjv.exe7⤵PID:4972
-
\??\c:\fdfbhl.exec:\fdfbhl.exe8⤵PID:224
-
\??\c:\xtlbpjt.exec:\xtlbpjt.exe9⤵PID:2244
-
\??\c:\jhhjhv.exec:\jhhjhv.exe10⤵PID:3556
-
\??\c:\fnjhjv.exec:\fnjhjv.exe11⤵PID:4484
-
\??\c:\bbfnr.exec:\bbfnr.exe12⤵PID:3360
-
\??\c:\lnldn.exec:\lnldn.exe13⤵PID:4900
-
\??\c:\tfdtxp.exec:\tfdtxp.exe14⤵PID:1072
-
\??\c:\hrrdd.exec:\hrrdd.exe15⤵PID:940
-
\??\c:\rxjbdr.exec:\rxjbdr.exe16⤵PID:2596
-
\??\c:\hvhvdpb.exec:\hvhvdpb.exe17⤵PID:5068
-
\??\c:\trrdfln.exec:\trrdfln.exe18⤵PID:1560
-
\??\c:\rtddb.exec:\rtddb.exe19⤵PID:1888
-
\??\c:\hdhhr.exec:\hdhhr.exe20⤵PID:4624
-
\??\c:\nltlf.exec:\nltlf.exe21⤵PID:3524
-
\??\c:\trldh.exec:\trldh.exe22⤵PID:4772
-
\??\c:\rdbpd.exec:\rdbpd.exe23⤵PID:1844
-
\??\c:\vvnvttt.exec:\vvnvttt.exe24⤵PID:3756
-
\??\c:\rpxxf.exec:\rpxxf.exe25⤵PID:3864
-
\??\c:\rvfpvvb.exec:\rvfpvvb.exe26⤵PID:5096
-
\??\c:\hnfdhpv.exec:\hnfdhpv.exe27⤵PID:4380
-
\??\c:\vlbbdl.exec:\vlbbdl.exe28⤵PID:4620
-
\??\c:\bnxlv.exec:\bnxlv.exe29⤵PID:3800
-
\??\c:\nddrrr.exec:\nddrrr.exe30⤵PID:944
-
\??\c:\fnjrxdj.exec:\fnjrxdj.exe31⤵PID:3832
-
\??\c:\nbxxrbl.exec:\nbxxrbl.exe32⤵PID:3060
-
\??\c:\pxxbll.exec:\pxxbll.exe33⤵PID:4204
-
\??\c:\fphrnp.exec:\fphrnp.exe34⤵PID:4236
-
\??\c:\fhxtl.exec:\fhxtl.exe35⤵PID:3076
-
\??\c:\jbvjn.exec:\jbvjn.exe36⤵PID:5104
-
\??\c:\dpnrjxj.exec:\dpnrjxj.exe37⤵PID:1940
-
\??\c:\lfflbbb.exec:\lfflbbb.exe38⤵PID:4768
-
\??\c:\vnljj.exec:\vnljj.exe39⤵PID:1108
-
\??\c:\dhtld.exec:\dhtld.exe40⤵PID:3132
-
\??\c:\dtjvpf.exec:\dtjvpf.exe41⤵PID:4628
-
\??\c:\tvxrdp.exec:\tvxrdp.exe42⤵PID:1404
-
\??\c:\vfhnv.exec:\vfhnv.exe43⤵PID:784
-
\??\c:\nrhlb.exec:\nrhlb.exe44⤵PID:2844
-
\??\c:\jdlprbr.exec:\jdlprbr.exe45⤵PID:2464
-
\??\c:\xvpdnlx.exec:\xvpdnlx.exe46⤵PID:4952
-
\??\c:\vxbfnl.exec:\vxbfnl.exe47⤵PID:3568
-
\??\c:\lvdfhnf.exec:\lvdfhnf.exe48⤵PID:1824
-
\??\c:\xpxbttj.exec:\xpxbttj.exe49⤵PID:180
-
\??\c:\tlnrt.exec:\tlnrt.exe50⤵PID:1420
-
\??\c:\jrnjhnb.exec:\jrnjhnb.exe51⤵PID:1572
-
\??\c:\tnxtvj.exec:\tnxtvj.exe52⤵PID:4500
-
\??\c:\xpfvlv.exec:\xpfvlv.exe53⤵PID:4124
-
\??\c:\rpjfhp.exec:\rpjfhp.exe54⤵PID:3732
-
\??\c:\vpnfbh.exec:\vpnfbh.exe55⤵PID:4584
-
\??\c:\drxrt.exec:\drxrt.exe56⤵PID:4156
-
\??\c:\fvptpnh.exec:\fvptpnh.exe57⤵PID:5000
-
\??\c:\hdbpv.exec:\hdbpv.exe58⤵PID:1136
-
\??\c:\tjpht.exec:\tjpht.exe59⤵PID:400
-
\??\c:\txpfll.exec:\txpfll.exe60⤵PID:2068
-
\??\c:\nnhxdv.exec:\nnhxdv.exe61⤵PID:3064
-
\??\c:\bjtnl.exec:\bjtnl.exe62⤵PID:3124
-
\??\c:\nfdnhx.exec:\nfdnhx.exe63⤵PID:972
-
\??\c:\rbnjtv.exec:\rbnjtv.exe64⤵PID:4808
-
\??\c:\tvfxvft.exec:\tvfxvft.exe65⤵PID:1072
-
\??\c:\rdxpdj.exec:\rdxpdj.exe66⤵PID:940
-
\??\c:\bbdvfvb.exec:\bbdvfvb.exe67⤵PID:2596
-
\??\c:\nxdbdb.exec:\nxdbdb.exe68⤵PID:3980
-
\??\c:\fxndpxd.exec:\fxndpxd.exe69⤵PID:4816
-
\??\c:\nnrvt.exec:\nnrvt.exe70⤵PID:2320
-
\??\c:\prrrvjt.exec:\prrrvjt.exe71⤵PID:4732
-
\??\c:\dljfp.exec:\dljfp.exe72⤵PID:4968
-
\??\c:\fnblxfn.exec:\fnblxfn.exe73⤵PID:1680
-
\??\c:\jblhpjx.exec:\jblhpjx.exe74⤵PID:4592
-
\??\c:\hbvxtnl.exec:\hbvxtnl.exe75⤵PID:3572
-
\??\c:\ffjhl.exec:\ffjhl.exe76⤵PID:1500
-
\??\c:\fbblfxx.exec:\fbblfxx.exe77⤵PID:3864
-
\??\c:\hjlrd.exec:\hjlrd.exe78⤵PID:5096
-
\??\c:\nnbnrj.exec:\nnbnrj.exe79⤵PID:4380
-
\??\c:\xjlht.exec:\xjlht.exe80⤵PID:1992
-
\??\c:\ttfbtjp.exec:\ttfbtjp.exe81⤵PID:2040
-
\??\c:\bdrnfdl.exec:\bdrnfdl.exe82⤵PID:4160
-
\??\c:\pthvv.exec:\pthvv.exe83⤵PID:3504
-
\??\c:\rfbjpb.exec:\rfbjpb.exe84⤵PID:4552
-
\??\c:\tvhjp.exec:\tvhjp.exe85⤵PID:2420
-
\??\c:\jvxnvv.exec:\jvxnvv.exe86⤵PID:3408
-
\??\c:\lbfxt.exec:\lbfxt.exe87⤵PID:4480
-
\??\c:\nnrnn.exec:\nnrnn.exe88⤵PID:264
-
\??\c:\jjfnnnv.exec:\jjfnnnv.exe89⤵PID:2984
-
\??\c:\lbfjf.exec:\lbfjf.exe90⤵PID:1816
-
\??\c:\bjhfhb.exec:\bjhfhb.exe91⤵PID:4284
-
\??\c:\rtlbt.exec:\rtlbt.exe92⤵PID:1468
-
\??\c:\vjbbt.exec:\vjbbt.exe93⤵PID:2872
-
\??\c:\phfvl.exec:\phfvl.exe94⤵PID:1868
-
\??\c:\xpxhp.exec:\xpxhp.exe95⤵PID:4212
-
\??\c:\bnhjrbb.exec:\bnhjrbb.exe96⤵PID:952
-
\??\c:\thbnf.exec:\thbnf.exe97⤵PID:1728
-
\??\c:\ntrrf.exec:\ntrrf.exe98⤵PID:3480
-
\??\c:\jjnfvf.exec:\jjnfvf.exe99⤵PID:4952
-
\??\c:\djptp.exec:\djptp.exe100⤵PID:4052
-
\??\c:\ftpxtt.exec:\ftpxtt.exe101⤵PID:1596
-
\??\c:\nrxlpn.exec:\nrxlpn.exe102⤵PID:1492
-
\??\c:\tdtbp.exec:\tdtbp.exe103⤵PID:1420
-
\??\c:\pprpt.exec:\pprpt.exe104⤵PID:4144
-
\??\c:\hxdth.exec:\hxdth.exe105⤵PID:5060
-
\??\c:\pjfrhf.exec:\pjfrhf.exe106⤵PID:572
-
\??\c:\rjhxtd.exec:\rjhxtd.exe107⤵PID:2272
-
\??\c:\tbvvvp.exec:\tbvvvp.exe108⤵PID:4288
-
\??\c:\vfrfbhn.exec:\vfrfbhn.exe109⤵PID:4604
-
\??\c:\rbfhvbt.exec:\rbfhvbt.exe110⤵PID:5072
-
\??\c:\bdflfn.exec:\bdflfn.exe111⤵PID:1136
-
\??\c:\rnnjbvp.exec:\rnnjbvp.exe112⤵PID:4924
-
\??\c:\njvhb.exec:\njvhb.exe113⤵PID:2068
-
\??\c:\fxndvtd.exec:\fxndvtd.exe114⤵PID:3064
-
\??\c:\hhtxf.exec:\hhtxf.exe115⤵PID:444
-
\??\c:\vlhnl.exec:\vlhnl.exe116⤵PID:2212
-
\??\c:\tjxdprv.exec:\tjxdprv.exe117⤵PID:440
-
\??\c:\vljht.exec:\vljht.exe118⤵PID:4516
-
\??\c:\vbhhj.exec:\vbhhj.exe119⤵PID:3764
-
\??\c:\hnrxvrv.exec:\hnrxvrv.exe120⤵PID:5112
-
\??\c:\fnrvj.exec:\fnrvj.exe121⤵PID:2320
-
\??\c:\ffjvjp.exec:\ffjvjp.exe122⤵PID:4732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-