Analysis
-
max time kernel
82s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2023 14:18
Behavioral task
behavioral1
Sample
NEAS.ba29970443e0608cc1be77cbffb4f3b0.exe
Resource
win7-20231020-en
windows7-x64
5 signatures
150 seconds
General
-
Target
NEAS.ba29970443e0608cc1be77cbffb4f3b0.exe
-
Size
90KB
-
MD5
ba29970443e0608cc1be77cbffb4f3b0
-
SHA1
ad7bc751ee302e6bc4f25b3b48634d38ee4290ec
-
SHA256
fc3cbb8c19de110d9055a0190ae32f4bd2938eee0ea68494dbfa53476cb77f37
-
SHA512
b32d2691351a9e42f87bce26e22caac582404f117fa4b6c1caa99b7eccab878cdbad6c0e64e0570620dd7a86d52cf39f30dbf9df4e81c58021c58a5ba4bb1070
-
SSDEEP
1536:/vQBeOGtrYS3srx93UBWfwC6Ggnouy8jb5D1QWm7JT4ht:/hOmTsF93UYfwC6GIout4Wy4r
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3100-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1088-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1208-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3544-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1452-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4812-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2108-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4248-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3412-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3860-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2156-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4128-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4844-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3812-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/692-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3476-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/972-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/740-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/524-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3144-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1652-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3960-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2164-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1308-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3940-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1716-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2380-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3296-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3560-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2948-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1868-508-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2152-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2120-549-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2128-586-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2968-611-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3148-670-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4104-743-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1432-1022-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4036-1027-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2180 lrhljld.exe 2568 dtbrnvb.exe 1088 vnpnrnr.exe 1208 llrpd.exe 3252 rvnld.exe 4460 nrjhnn.exe 3548 ljxbft.exe 924 jjprnvt.exe 3544 nnxhhvv.exe 4692 vrjlxff.exe 3816 pjdbpvb.exe 4812 bxnhdfr.exe 1452 bbbdh.exe 2108 ldvvvdh.exe 4644 rtpblf.exe 3940 jfhpfpp.exe 4248 jnvfhh.exe 3412 fvxfpp.exe 2356 lvlprlx.exe 2156 jdppd.exe 3860 jjlhdxv.exe 4128 tnpldr.exe 4844 ptdft.exe 3812 htlvvx.exe 3568 jfnxxhx.exe 1948 xldnnjl.exe 3236 pdtnl.exe 4384 xbjxr.exe 3136 tdlbfl.exe 692 nnnhhl.exe 4700 dhnbhpv.exe 3476 rnvpv.exe 4816 rnxvhvt.exe 972 vnvrpx.exe 740 bjxbbv.exe 3364 tlrdlnt.exe 1432 btfdprt.exe 3336 pnlxn.exe 524 hdvjxjn.exe 4480 fjnptjx.exe 3808 xprdd.exe 1556 lvrpphp.exe 208 hdvvblt.exe 4512 bhvxhb.exe 3956 xrlldp.exe 4304 xlldbth.exe 4948 jflhhnh.exe 1772 lxdbbhb.exe 5096 ltnpnl.exe 884 pvvlxb.exe 1464 hjnlhtn.exe 3144 vdjtn.exe 1120 lptrnxd.exe 4460 dfhrnlf.exe 3736 txlvj.exe 2248 nhrbdbt.exe 1652 pxntrtt.exe 3960 rrfbln.exe 3828 rxxtjnx.exe 2016 bpdbl.exe 2460 dppphx.exe 2164 hltfjbl.exe 4092 hlxvffj.exe 4464 bjpjpdh.exe -
resource yara_rule behavioral2/memory/3100-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022d3b-3.dat upx behavioral2/memory/3100-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022d3b-5.dat upx behavioral2/files/0x0007000000022d43-8.dat upx behavioral2/memory/2180-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d43-10.dat upx behavioral2/files/0x0007000000022d44-11.dat upx behavioral2/memory/2568-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d44-15.dat upx behavioral2/files/0x0007000000022d45-18.dat upx behavioral2/memory/1088-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d45-20.dat upx behavioral2/files/0x0007000000022d44-13.dat upx behavioral2/files/0x0007000000022d46-23.dat upx behavioral2/files/0x0007000000022d46-25.dat upx behavioral2/memory/1208-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d47-30.dat upx behavioral2/memory/3252-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4460-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d47-28.dat upx behavioral2/files/0x0007000000022d48-35.dat upx behavioral2/files/0x0007000000022d48-36.dat upx behavioral2/memory/3548-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d4a-41.dat upx behavioral2/files/0x0007000000022d4a-39.dat upx behavioral2/files/0x0007000000022d4b-44.dat upx behavioral2/files/0x0007000000022d4b-46.dat upx behavioral2/memory/3544-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d4d-49.dat upx behavioral2/files/0x0007000000022d4d-51.dat upx behavioral2/memory/4692-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d4e-55.dat upx behavioral2/files/0x0007000000022d4e-54.dat upx behavioral2/files/0x0007000000022d4f-61.dat upx behavioral2/files/0x0007000000022d4f-60.dat upx behavioral2/memory/1452-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d50-66.dat upx behavioral2/memory/4812-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d51-71.dat upx behavioral2/files/0x0007000000022d50-64.dat upx behavioral2/files/0x0007000000022d51-72.dat upx behavioral2/files/0x0007000000022d52-75.dat upx behavioral2/memory/2108-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d52-77.dat upx behavioral2/files/0x0007000000022d53-80.dat upx behavioral2/memory/4644-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d53-82.dat upx behavioral2/files/0x0007000000022d54-86.dat upx behavioral2/files/0x0007000000022d54-87.dat upx behavioral2/memory/4248-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d55-92.dat upx behavioral2/memory/3412-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d55-91.dat upx behavioral2/files/0x0007000000022d56-97.dat upx behavioral2/files/0x0007000000022d56-98.dat upx behavioral2/files/0x0007000000022d57-101.dat upx behavioral2/files/0x0007000000022d57-103.dat upx behavioral2/files/0x0007000000022d58-106.dat upx behavioral2/memory/4128-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d59-114.dat upx behavioral2/files/0x0007000000022d59-113.dat upx behavioral2/memory/3860-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d58-108.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3100 wrote to memory of 2180 3100 NEAS.ba29970443e0608cc1be77cbffb4f3b0.exe 84 PID 3100 wrote to memory of 2180 3100 NEAS.ba29970443e0608cc1be77cbffb4f3b0.exe 84 PID 3100 wrote to memory of 2180 3100 NEAS.ba29970443e0608cc1be77cbffb4f3b0.exe 84 PID 2180 wrote to memory of 2568 2180 lrhljld.exe 85 PID 2180 wrote to memory of 2568 2180 lrhljld.exe 85 PID 2180 wrote to memory of 2568 2180 lrhljld.exe 85 PID 2568 wrote to memory of 1088 2568 dtbrnvb.exe 86 PID 2568 wrote to memory of 1088 2568 dtbrnvb.exe 86 PID 2568 wrote to memory of 1088 2568 dtbrnvb.exe 86 PID 1088 wrote to memory of 1208 1088 vnpnrnr.exe 87 PID 1088 wrote to memory of 1208 1088 vnpnrnr.exe 87 PID 1088 wrote to memory of 1208 1088 vnpnrnr.exe 87 PID 1208 wrote to memory of 3252 1208 llrpd.exe 88 PID 1208 wrote to memory of 3252 1208 llrpd.exe 88 PID 1208 wrote to memory of 3252 1208 llrpd.exe 88 PID 3252 wrote to memory of 4460 3252 rvnld.exe 89 PID 3252 wrote to memory of 4460 3252 rvnld.exe 89 PID 3252 wrote to memory of 4460 3252 rvnld.exe 89 PID 4460 wrote to memory of 3548 4460 nrjhnn.exe 90 PID 4460 wrote to memory of 3548 4460 nrjhnn.exe 90 PID 4460 wrote to memory of 3548 4460 nrjhnn.exe 90 PID 3548 wrote to memory of 924 3548 ljxbft.exe 92 PID 3548 wrote to memory of 924 3548 ljxbft.exe 92 PID 3548 wrote to memory of 924 3548 ljxbft.exe 92 PID 924 wrote to memory of 3544 924 jjprnvt.exe 93 PID 924 wrote to memory of 3544 924 jjprnvt.exe 93 PID 924 wrote to memory of 3544 924 jjprnvt.exe 93 PID 3544 wrote to memory of 4692 3544 nnxhhvv.exe 94 PID 3544 wrote to memory of 4692 3544 nnxhhvv.exe 94 PID 3544 wrote to memory of 4692 3544 nnxhhvv.exe 94 PID 4692 wrote to memory of 3816 4692 vrjlxff.exe 95 PID 4692 wrote to memory of 3816 4692 vrjlxff.exe 95 PID 4692 wrote to memory of 3816 4692 vrjlxff.exe 95 PID 3816 wrote to memory of 4812 3816 pjdbpvb.exe 96 PID 3816 wrote to memory of 4812 3816 pjdbpvb.exe 96 PID 3816 wrote to memory of 4812 3816 pjdbpvb.exe 96 PID 4812 wrote to memory of 1452 4812 bxnhdfr.exe 97 PID 4812 wrote to memory of 1452 4812 bxnhdfr.exe 97 PID 4812 wrote to memory of 1452 4812 bxnhdfr.exe 97 PID 1452 wrote to memory of 2108 1452 bbbdh.exe 98 PID 1452 wrote to memory of 2108 1452 bbbdh.exe 98 PID 1452 wrote to memory of 2108 1452 bbbdh.exe 98 PID 2108 wrote to memory of 4644 2108 ldvvvdh.exe 99 PID 2108 wrote to memory of 4644 2108 ldvvvdh.exe 99 PID 2108 wrote to memory of 4644 2108 ldvvvdh.exe 99 PID 4644 wrote to memory of 3940 4644 rtpblf.exe 100 PID 4644 wrote to memory of 3940 4644 rtpblf.exe 100 PID 4644 wrote to memory of 3940 4644 rtpblf.exe 100 PID 3940 wrote to memory of 4248 3940 jfhpfpp.exe 101 PID 3940 wrote to memory of 4248 3940 jfhpfpp.exe 101 PID 3940 wrote to memory of 4248 3940 jfhpfpp.exe 101 PID 4248 wrote to memory of 3412 4248 jnvfhh.exe 102 PID 4248 wrote to memory of 3412 4248 jnvfhh.exe 102 PID 4248 wrote to memory of 3412 4248 jnvfhh.exe 102 PID 3412 wrote to memory of 2356 3412 fvxfpp.exe 103 PID 3412 wrote to memory of 2356 3412 fvxfpp.exe 103 PID 3412 wrote to memory of 2356 3412 fvxfpp.exe 103 PID 2356 wrote to memory of 2156 2356 lvlprlx.exe 104 PID 2356 wrote to memory of 2156 2356 lvlprlx.exe 104 PID 2356 wrote to memory of 2156 2356 lvlprlx.exe 104 PID 2156 wrote to memory of 3860 2156 jdppd.exe 105 PID 2156 wrote to memory of 3860 2156 jdppd.exe 105 PID 2156 wrote to memory of 3860 2156 jdppd.exe 105 PID 3860 wrote to memory of 4128 3860 jjlhdxv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ba29970443e0608cc1be77cbffb4f3b0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ba29970443e0608cc1be77cbffb4f3b0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\lrhljld.exec:\lrhljld.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\dtbrnvb.exec:\dtbrnvb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\vnpnrnr.exec:\vnpnrnr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\llrpd.exec:\llrpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\rvnld.exec:\rvnld.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\nrjhnn.exec:\nrjhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\ljxbft.exec:\ljxbft.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\jjprnvt.exec:\jjprnvt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\nnxhhvv.exec:\nnxhhvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\vrjlxff.exec:\vrjlxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\pjdbpvb.exec:\pjdbpvb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\bxnhdfr.exec:\bxnhdfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\bbbdh.exec:\bbbdh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\ldvvvdh.exec:\ldvvvdh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\rtpblf.exec:\rtpblf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\jfhpfpp.exec:\jfhpfpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\jnvfhh.exec:\jnvfhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\fvxfpp.exec:\fvxfpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\lvlprlx.exec:\lvlprlx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\jdppd.exec:\jdppd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\jjlhdxv.exec:\jjlhdxv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\tnpldr.exec:\tnpldr.exe23⤵
- Executes dropped EXE
PID:4128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\ptdft.exec:\ptdft.exe1⤵
- Executes dropped EXE
PID:4844 -
\??\c:\htlvvx.exec:\htlvvx.exe2⤵
- Executes dropped EXE
PID:3812 -
\??\c:\jfnxxhx.exec:\jfnxxhx.exe3⤵
- Executes dropped EXE
PID:3568 -
\??\c:\xldnnjl.exec:\xldnnjl.exe4⤵
- Executes dropped EXE
PID:1948 -
\??\c:\pdtnl.exec:\pdtnl.exe5⤵
- Executes dropped EXE
PID:3236 -
\??\c:\xbjxr.exec:\xbjxr.exe6⤵
- Executes dropped EXE
PID:4384 -
\??\c:\tdlbfl.exec:\tdlbfl.exe7⤵
- Executes dropped EXE
PID:3136 -
\??\c:\nnnhhl.exec:\nnnhhl.exe8⤵
- Executes dropped EXE
PID:692 -
\??\c:\dhnbhpv.exec:\dhnbhpv.exe9⤵
- Executes dropped EXE
PID:4700 -
\??\c:\rnvpv.exec:\rnvpv.exe10⤵
- Executes dropped EXE
PID:3476 -
\??\c:\rnxvhvt.exec:\rnxvhvt.exe11⤵
- Executes dropped EXE
PID:4816 -
\??\c:\vnvrpx.exec:\vnvrpx.exe12⤵
- Executes dropped EXE
PID:972 -
\??\c:\bjxbbv.exec:\bjxbbv.exe13⤵
- Executes dropped EXE
PID:740 -
\??\c:\tlrdlnt.exec:\tlrdlnt.exe14⤵
- Executes dropped EXE
PID:3364 -
\??\c:\btfdprt.exec:\btfdprt.exe15⤵
- Executes dropped EXE
PID:1432 -
\??\c:\pnlxn.exec:\pnlxn.exe16⤵
- Executes dropped EXE
PID:3336 -
\??\c:\hdvjxjn.exec:\hdvjxjn.exe17⤵
- Executes dropped EXE
PID:524 -
\??\c:\fjnptjx.exec:\fjnptjx.exe18⤵
- Executes dropped EXE
PID:4480 -
\??\c:\xprdd.exec:\xprdd.exe19⤵
- Executes dropped EXE
PID:3808 -
\??\c:\lvrpphp.exec:\lvrpphp.exe20⤵
- Executes dropped EXE
PID:1556 -
\??\c:\hdvvblt.exec:\hdvvblt.exe21⤵
- Executes dropped EXE
PID:208 -
\??\c:\bhvxhb.exec:\bhvxhb.exe22⤵
- Executes dropped EXE
PID:4512 -
\??\c:\xrlldp.exec:\xrlldp.exe23⤵
- Executes dropped EXE
PID:3956 -
\??\c:\xlldbth.exec:\xlldbth.exe24⤵
- Executes dropped EXE
PID:4304 -
\??\c:\jflhhnh.exec:\jflhhnh.exe25⤵
- Executes dropped EXE
PID:4948 -
\??\c:\lxdbbhb.exec:\lxdbbhb.exe26⤵
- Executes dropped EXE
PID:1772 -
\??\c:\ltnpnl.exec:\ltnpnl.exe27⤵
- Executes dropped EXE
PID:5096 -
\??\c:\pvvlxb.exec:\pvvlxb.exe28⤵
- Executes dropped EXE
PID:884 -
\??\c:\hjnlhtn.exec:\hjnlhtn.exe29⤵
- Executes dropped EXE
PID:1464 -
\??\c:\vdjtn.exec:\vdjtn.exe30⤵
- Executes dropped EXE
PID:3144 -
\??\c:\lptrnxd.exec:\lptrnxd.exe31⤵
- Executes dropped EXE
PID:1120 -
\??\c:\dfhrnlf.exec:\dfhrnlf.exe32⤵
- Executes dropped EXE
PID:4460 -
\??\c:\txlvj.exec:\txlvj.exe33⤵
- Executes dropped EXE
PID:3736 -
\??\c:\nhrbdbt.exec:\nhrbdbt.exe34⤵
- Executes dropped EXE
PID:2248 -
\??\c:\pxntrtt.exec:\pxntrtt.exe35⤵
- Executes dropped EXE
PID:1652 -
\??\c:\rrfbln.exec:\rrfbln.exe36⤵
- Executes dropped EXE
PID:3960 -
\??\c:\rxxtjnx.exec:\rxxtjnx.exe37⤵
- Executes dropped EXE
PID:3828 -
\??\c:\bpdbl.exec:\bpdbl.exe38⤵
- Executes dropped EXE
PID:2016 -
\??\c:\dppphx.exec:\dppphx.exe39⤵
- Executes dropped EXE
PID:2460 -
\??\c:\hltfjbl.exec:\hltfjbl.exe40⤵
- Executes dropped EXE
PID:2164 -
\??\c:\hlxvffj.exec:\hlxvffj.exe41⤵
- Executes dropped EXE
PID:4092 -
\??\c:\bjpjpdh.exec:\bjpjpdh.exe42⤵
- Executes dropped EXE
PID:4464 -
\??\c:\tdtbtjh.exec:\tdtbtjh.exe43⤵PID:1308
-
\??\c:\xprrp.exec:\xprrp.exe44⤵PID:4644
-
\??\c:\tbxxpr.exec:\tbxxpr.exe45⤵PID:3940
-
\??\c:\rndjl.exec:\rndjl.exe46⤵PID:3416
-
\??\c:\xvhnvht.exec:\xvhnvht.exe47⤵PID:4688
-
\??\c:\dvbvbp.exec:\dvbvbp.exe48⤵PID:4072
-
\??\c:\rdlht.exec:\rdlht.exe49⤵PID:1112
-
\??\c:\pjpxdp.exec:\pjpxdp.exe50⤵PID:3916
-
\??\c:\vdrdt.exec:\vdrdt.exe51⤵PID:4360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\txbxn.exec:\txbxn.exe1⤵PID:3328
-
\??\c:\pvjlhfl.exec:\pvjlhfl.exe2⤵PID:536
-
\??\c:\bptrnf.exec:\bptrnf.exe3⤵PID:1716
-
\??\c:\hppbxxt.exec:\hppbxxt.exe4⤵PID:4444
-
\??\c:\xtnpf.exec:\xtnpf.exe5⤵PID:1948
-
\??\c:\tfjlx.exec:\tfjlx.exe6⤵PID:3236
-
\??\c:\lrhbjfv.exec:\lrhbjfv.exe7⤵PID:4012
-
\??\c:\jvvtnxv.exec:\jvvtnxv.exe8⤵PID:3136
-
\??\c:\lvpddv.exec:\lvpddv.exe9⤵PID:4524
-
\??\c:\bdrrf.exec:\bdrrf.exe10⤵PID:4700
-
\??\c:\lbhpx.exec:\lbhpx.exe11⤵PID:2380
-
\??\c:\btblf.exec:\btblf.exe12⤵PID:3476
-
\??\c:\rttrjjx.exec:\rttrjjx.exe13⤵PID:3980
-
\??\c:\pvtrbft.exec:\pvtrbft.exe14⤵PID:3468
-
\??\c:\rnjjv.exec:\rnjjv.exe15⤵PID:4720
-
\??\c:\ptjtj.exec:\ptjtj.exe16⤵PID:4888
-
\??\c:\hnjnd.exec:\hnjnd.exe17⤵PID:3296
-
\??\c:\blpltrx.exec:\blpltrx.exe18⤵PID:3560
-
\??\c:\hptphr.exec:\hptphr.exe19⤵PID:2216
-
\??\c:\ljfdv.exec:\ljfdv.exe20⤵PID:2004
-
\??\c:\rnlvb.exec:\rnlvb.exe21⤵PID:1556
-
\??\c:\tvjhvj.exec:\tvjhvj.exe22⤵PID:4008
-
\??\c:\vjfpx.exec:\vjfpx.exe23⤵PID:4296
-
\??\c:\xpdtdl.exec:\xpdtdl.exe24⤵PID:1800
-
\??\c:\bjlnj.exec:\bjlnj.exe25⤵PID:4948
-
\??\c:\jrdpjb.exec:\jrdpjb.exe26⤵PID:2568
-
\??\c:\hbprd.exec:\hbprd.exe27⤵PID:1696
-
\??\c:\rhpjlt.exec:\rhpjlt.exe28⤵PID:3036
-
\??\c:\bnlnnh.exec:\bnlnnh.exe29⤵PID:1464
-
\??\c:\xljbrx.exec:\xljbrx.exe30⤵PID:4528
-
\??\c:\djbtrnb.exec:\djbtrnb.exe31⤵PID:2936
-
\??\c:\nfptr.exec:\nfptr.exe32⤵PID:2248
-
\??\c:\hhvfhfh.exec:\hhvfhfh.exe33⤵PID:3008
-
\??\c:\fnjphv.exec:\fnjphv.exe34⤵PID:2888
-
\??\c:\htbhnxb.exec:\htbhnxb.exe35⤵PID:4708
-
\??\c:\pvhvdld.exec:\pvhvdld.exe36⤵PID:2472
-
\??\c:\ttrxhbv.exec:\ttrxhbv.exe37⤵PID:5024
-
\??\c:\tdrrtln.exec:\tdrrtln.exe38⤵PID:2108
-
\??\c:\pntttd.exec:\pntttd.exe39⤵PID:1804
-
\??\c:\fvfptv.exec:\fvfptv.exe40⤵PID:3936
-
\??\c:\htptppx.exec:\htptppx.exe41⤵PID:2312
-
\??\c:\rrbnr.exec:\rrbnr.exe42⤵PID:1960
-
\??\c:\frtnxr.exec:\frtnxr.exe43⤵PID:4596
-
\??\c:\pfdhf.exec:\pfdhf.exe44⤵PID:4688
-
\??\c:\bbhtjp.exec:\bbhtjp.exe45⤵PID:4492
-
\??\c:\hxrjrlt.exec:\hxrjrlt.exe46⤵PID:3916
-
\??\c:\thlttv.exec:\thlttv.exe47⤵PID:4244
-
\??\c:\fxfrn.exec:\fxfrn.exe48⤵PID:4400
-
\??\c:\dbdnxnx.exec:\dbdnxnx.exe49⤵PID:3784
-
\??\c:\xddtd.exec:\xddtd.exe50⤵PID:3288
-
\??\c:\tlrlv.exec:\tlrlv.exe51⤵PID:3568
-
\??\c:\lxjplhh.exec:\lxjplhh.exe52⤵PID:2344
-
\??\c:\hdpbh.exec:\hdpbh.exe53⤵PID:1108
-
\??\c:\pvjvxb.exec:\pvjvxb.exe54⤵PID:1700
-
\??\c:\nbdvvbb.exec:\nbdvvbb.exe55⤵PID:3140
-
\??\c:\hrhpv.exec:\hrhpv.exe56⤵PID:3292
-
\??\c:\jxftv.exec:\jxftv.exe57⤵PID:4816
-
\??\c:\rvvpdv.exec:\rvvpdv.exe58⤵PID:2952
-
\??\c:\xpbnnt.exec:\xpbnnt.exe59⤵PID:2876
-
\??\c:\vtjpx.exec:\vtjpx.exe60⤵PID:3160
-
\??\c:\ttddfr.exec:\ttddfr.exe61⤵PID:2028
-
\??\c:\lvjpppn.exec:\lvjpppn.exe62⤵PID:3468
-
\??\c:\rrnvt.exec:\rrnvt.exe63⤵PID:2948
-
\??\c:\bddfxh.exec:\bddfxh.exe64⤵PID:1868
-
\??\c:\ltnxr.exec:\ltnxr.exe65⤵PID:2536
-
\??\c:\tvhrxj.exec:\tvhrxj.exe66⤵PID:2216
-
\??\c:\dppdln.exec:\dppdln.exe67⤵PID:4588
-
\??\c:\ptbbjpv.exec:\ptbbjpv.exe68⤵PID:2152
-
\??\c:\nlfdnpb.exec:\nlfdnpb.exe69⤵PID:4304
-
\??\c:\tlpdnlp.exec:\tlpdnlp.exe70⤵PID:3384
-
\??\c:\fbtfpr.exec:\fbtfpr.exe71⤵PID:1020
-
\??\c:\jltpp.exec:\jltpp.exe72⤵PID:4664
-
\??\c:\jtdlnb.exec:\jtdlnb.exe73⤵PID:1972
-
\??\c:\htfvdht.exec:\htfvdht.exe74⤵PID:3060
-
\??\c:\xhtddhx.exec:\xhtddhx.exe75⤵PID:2120
-
\??\c:\lxlhx.exec:\lxlhx.exe76⤵PID:2176
-
\??\c:\hpxbthl.exec:\hpxbthl.exe77⤵PID:3960
-
\??\c:\jlfrn.exec:\jlfrn.exe78⤵PID:3816
-
\??\c:\tlbvnjx.exec:\tlbvnjx.exe79⤵PID:4416
-
\??\c:\nbftjtr.exec:\nbftjtr.exe80⤵PID:3188
-
\??\c:\hjrxd.exec:\hjrxd.exe81⤵PID:1064
-
\??\c:\ldnfblt.exec:\ldnfblt.exe82⤵PID:1332
-
\??\c:\pfxrrxx.exec:\pfxrrxx.exe83⤵PID:5024
-
\??\c:\tdbdjdd.exec:\tdbdjdd.exe84⤵PID:2928
-
\??\c:\xtptb.exec:\xtptb.exe85⤵PID:1876
-
\??\c:\rjbtdp.exec:\rjbtdp.exe86⤵PID:4684
-
\??\c:\jflxr.exec:\jflxr.exe87⤵PID:1824
-
\??\c:\fhjbjd.exec:\fhjbjd.exe88⤵PID:2128
-
\??\c:\fvnxt.exec:\fvnxt.exe89⤵PID:3192
-
\??\c:\rfdbpt.exec:\rfdbpt.exe90⤵PID:864
-
\??\c:\hthpj.exec:\hthpj.exe91⤵PID:3916
-
\??\c:\xjxlbx.exec:\xjxlbx.exe92⤵PID:3716
-
\??\c:\rhhppd.exec:\rhhppd.exe93⤵PID:536
-
\??\c:\rbdvdtt.exec:\rbdvdtt.exe94⤵PID:2056
-
\??\c:\pftnxnp.exec:\pftnxnp.exe95⤵PID:4800
-
\??\c:\btpntb.exec:\btpntb.exe96⤵PID:2968
-
\??\c:\jlfvxft.exec:\jlfvxft.exe97⤵PID:5016
-
\??\c:\hvtndv.exec:\hvtndv.exe98⤵PID:5092
-
\??\c:\vjrtvj.exec:\vjrtvj.exe99⤵PID:3080
-
\??\c:\dfprt.exec:\dfprt.exe100⤵PID:940
-
\??\c:\pxfbt.exec:\pxfbt.exe101⤵PID:3792
-
\??\c:\vbfpf.exec:\vbfpf.exe102⤵PID:3256
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\xbnxbhn.exec:\xbnxbhn.exe1⤵PID:1856
-
\??\c:\rbhhd.exec:\rbhhd.exe2⤵PID:2876
-
\??\c:\bjpflph.exec:\bjpflph.exe3⤵PID:5044
-
\??\c:\lvjbd.exec:\lvjbd.exe4⤵PID:1432
-
\??\c:\ffrltbn.exec:\ffrltbn.exe5⤵PID:4424
-
\??\c:\dhvxb.exec:\dhvxb.exe6⤵PID:4888
-
\??\c:\lxrpn.exec:\lxrpn.exe7⤵PID:752
-
\??\c:\lrfvdvf.exec:\lrfvdvf.exe8⤵PID:2536
-
\??\c:\dnrnjhd.exec:\dnrnjhd.exe9⤵PID:4556
-
\??\c:\ltnldt.exec:\ltnldt.exe10⤵PID:4932
-
\??\c:\hxrlfpt.exec:\hxrlfpt.exe11⤵PID:2180
-
\??\c:\lxlplh.exec:\lxlplh.exe12⤵PID:4504
-
\??\c:\bntdfdn.exec:\bntdfdn.exe13⤵PID:5108
-
\??\c:\jlrfpx.exec:\jlrfpx.exe14⤵PID:3148
-
\??\c:\dxttph.exec:\dxttph.exe15⤵PID:3144
-
\??\c:\tdhjtlv.exec:\tdhjtlv.exe16⤵PID:4412
-
\??\c:\hdnjtxh.exec:\hdnjtxh.exe17⤵PID:3556
-
\??\c:\fnvjnf.exec:\fnvjnf.exe18⤵PID:4428
-
\??\c:\rtfrdj.exec:\rtfrdj.exe19⤵PID:620
-
\??\c:\bpbbbjt.exec:\bpbbbjt.exe20⤵PID:3008
-
\??\c:\jpxtjdl.exec:\jpxtjdl.exe21⤵PID:4852
-
\??\c:\nvppjn.exec:\nvppjn.exe22⤵PID:1544
-
\??\c:\xbnfxhv.exec:\xbnfxhv.exe23⤵PID:4812
-
\??\c:\btlrdpx.exec:\btlrdpx.exe24⤵PID:4052
-
\??\c:\pxhdlr.exec:\pxhdlr.exe25⤵PID:1804
-
\??\c:\llllhb.exec:\llllhb.exe26⤵PID:1068
-
\??\c:\xlbvhrp.exec:\xlbvhrp.exe27⤵PID:2116
-
\??\c:\vhbnx.exec:\vhbnx.exe28⤵PID:3268
-
\??\c:\tdvfvb.exec:\tdvfvb.exe29⤵PID:3448
-
\??\c:\dntxnjl.exec:\dntxnjl.exe30⤵PID:1824
-
\??\c:\dtfxvd.exec:\dtfxvd.exe31⤵PID:4492
-
\??\c:\xjtpll.exec:\xjtpll.exe32⤵PID:2188
-
\??\c:\fjftbpx.exec:\fjftbpx.exe33⤵PID:2804
-
\??\c:\lpvxxp.exec:\lpvxxp.exe34⤵PID:4172
-
\??\c:\xlrbdjp.exec:\xlrbdjp.exe35⤵PID:2716
-
\??\c:\frvhdlv.exec:\frvhdlv.exe36⤵PID:4444
-
\??\c:\ddprfp.exec:\ddprfp.exe37⤵PID:4104
-
\??\c:\tpjhdb.exec:\tpjhdb.exe38⤵PID:5040
-
\??\c:\fnnhbd.exec:\fnnhbd.exe39⤵PID:2968
-
\??\c:\nphlbvd.exec:\nphlbvd.exe40⤵PID:2392
-
\??\c:\bxbllh.exec:\bxbllh.exe41⤵PID:4984
-
\??\c:\hbxhfl.exec:\hbxhfl.exe42⤵PID:3856
-
\??\c:\rbjhd.exec:\rbjhd.exe43⤵PID:4816
-
\??\c:\nddlbx.exec:\nddlbx.exe44⤵PID:4700
-
\??\c:\tlvjjl.exec:\tlvjjl.exe45⤵PID:5000
-
\??\c:\xhrpv.exec:\xhrpv.exe46⤵PID:5056
-
\??\c:\tbjtrr.exec:\tbjtrr.exe47⤵PID:3364
-
\??\c:\rrfdjjd.exec:\rrfdjjd.exe48⤵PID:1364
-
\??\c:\xnfjxj.exec:\xnfjxj.exe49⤵PID:3560
-
\??\c:\bjlrrtx.exec:\bjlrrtx.exe50⤵PID:1072
-
\??\c:\rfdfrl.exec:\rfdfrl.exe51⤵PID:2364
-
\??\c:\prnlpv.exec:\prnlpv.exe52⤵PID:3628
-
\??\c:\pnnvxpp.exec:\pnnvxpp.exe53⤵PID:4512
-
\??\c:\lxhxjf.exec:\lxhxjf.exe54⤵PID:4176
-
\??\c:\nhnlt.exec:\nhnlt.exe55⤵PID:4304
-
\??\c:\fdffnl.exec:\fdffnl.exe56⤵PID:2180
-
\??\c:\ttfpfxx.exec:\ttfpfxx.exe57⤵PID:1464
-
\??\c:\bpjplf.exec:\bpjplf.exe58⤵PID:4664
-
\??\c:\ldphpjj.exec:\ldphpjj.exe59⤵PID:3076
-
\??\c:\rxjhxdt.exec:\rxjhxdt.exe60⤵PID:4312
-
\??\c:\rvnbtfn.exec:\rvnbtfn.exe61⤵PID:4412
-
\??\c:\ttljtx.exec:\ttljtx.exe62⤵PID:3544
-
\??\c:\hfnfvl.exec:\hfnfvl.exe63⤵PID:4428
-
\??\c:\ddffxln.exec:\ddffxln.exe64⤵PID:620
-
\??\c:\hlxtl.exec:\hlxtl.exe65⤵PID:5012
-
\??\c:\tjnjlhd.exec:\tjnjlhd.exe66⤵PID:4708
-
\??\c:\fnffbnb.exec:\fnffbnb.exe67⤵PID:3896
-
\??\c:\rlrxbr.exec:\rlrxbr.exe68⤵PID:4812
-
\??\c:\jjnnjf.exec:\jjnnjf.exe69⤵PID:4308
-
\??\c:\xjbpbl.exec:\xjbpbl.exe70⤵PID:3400
-
\??\c:\dhjxbf.exec:\dhjxbf.exe71⤵PID:1068
-
\??\c:\pbtrldt.exec:\pbtrldt.exe72⤵PID:1624
-
\??\c:\rhlhnr.exec:\rhlhnr.exe73⤵PID:676
-
\??\c:\xfbrh.exec:\xfbrh.exe74⤵PID:3812
-
\??\c:\vdxjj.exec:\vdxjj.exe75⤵PID:864
-
\??\c:\jvfjdxb.exec:\jvfjdxb.exe76⤵PID:3900
-
\??\c:\bhrln.exec:\bhrln.exe77⤵PID:1716
-
\??\c:\rpnpf.exec:\rpnpf.exe78⤵PID:1232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\dfxhl.exec:\dfxhl.exe1⤵PID:1628
-
\??\c:\bdlxhl.exec:\bdlxhl.exe2⤵PID:2344
-
\??\c:\nrljrlh.exec:\nrljrlh.exe3⤵PID:5040
-
\??\c:\blbvbvh.exec:\blbvbvh.exe4⤵PID:2428
-
\??\c:\pdlbhrj.exec:\pdlbhrj.exe5⤵PID:5092
-
\??\c:\bxphd.exec:\bxphd.exe6⤵PID:3080
-
\??\c:\fphxplf.exec:\fphxplf.exe7⤵PID:3292
-
\??\c:\ltdvxdr.exec:\ltdvxdr.exe8⤵PID:4816
-
\??\c:\xxthx.exec:\xxthx.exe9⤵PID:740
-
\??\c:\jlbvnp.exec:\jlbvnp.exe10⤵PID:5000
-
\??\c:\jllbnlr.exec:\jllbnlr.exe11⤵PID:2028
-
\??\c:\jbtrp.exec:\jbtrp.exe12⤵PID:3852
-
\??\c:\jtljv.exec:\jtljv.exe13⤵PID:2948
-
\??\c:\frndf.exec:\frndf.exe14⤵PID:556
-
\??\c:\vbhrdl.exec:\vbhrdl.exe15⤵PID:752
-
\??\c:\rjtntv.exec:\rjtntv.exe16⤵PID:3956
-
\??\c:\dfvdt.exec:\dfvdt.exe17⤵PID:4932
-
\??\c:\vpppl.exec:\vpppl.exe18⤵PID:1104
-
\??\c:\hbxbdjj.exec:\hbxbdjj.exe19⤵PID:2568
-
\??\c:\nvnvx.exec:\nvnvx.exe20⤵PID:2492
-
\??\c:\djpdj.exec:\djpdj.exe21⤵PID:3252
-
\??\c:\pxfvfhh.exec:\pxfvfhh.exe22⤵PID:4224
-
\??\c:\pdlrptx.exec:\pdlrptx.exe23⤵PID:1120
-
\??\c:\txtplh.exec:\txtplh.exe24⤵PID:2936
-
\??\c:\tjxhdl.exec:\tjxhdl.exe25⤵PID:3052
-
\??\c:\hjltpfv.exec:\hjltpfv.exe26⤵PID:2196
-
\??\c:\xhhbpt.exec:\xhhbpt.exe27⤵PID:3960
-
\??\c:\tlprvbh.exec:\tlprvbh.exe28⤵PID:3008
-
\??\c:\xhtfj.exec:\xhtfj.exe29⤵PID:2164
-
\??\c:\dttpdl.exec:\dttpdl.exe30⤵PID:4464
-
\??\c:\fxxrp.exec:\fxxrp.exe31⤵PID:3896
-
\??\c:\bjxdhj.exec:\bjxdhj.exe32⤵PID:4052
-
\??\c:\flfljt.exec:\flfljt.exe33⤵PID:2312
-
\??\c:\bjxnnd.exec:\bjxnnd.exe34⤵PID:3416
-
\??\c:\fddndl.exec:\fddndl.exe35⤵PID:3400
-
\??\c:\ndxnj.exec:\ndxnj.exe36⤵PID:1624
-
\??\c:\tvfdhn.exec:\tvfdhn.exe37⤵PID:4400
-
\??\c:\ntltd.exec:\ntltd.exe38⤵PID:3716
-
\??\c:\lrtbd.exec:\lrtbd.exe39⤵PID:3784
-
\??\c:\xhnfxfh.exec:\xhnfxfh.exe40⤵PID:1672
-
\??\c:\btftr.exec:\btftr.exe41⤵PID:3236
-
\??\c:\xtjhxr.exec:\xtjhxr.exe42⤵PID:3324
-
\??\c:\ptxpf.exec:\ptxpf.exe43⤵PID:3136
-
\??\c:\bnxdvf.exec:\bnxdvf.exe44⤵PID:3948
-
\??\c:\xxlvvv.exec:\xxlvvv.exe45⤵PID:2428
-
\??\c:\bnnpdtr.exec:\bnnpdtr.exe46⤵PID:3996
-
\??\c:\jvfld.exec:\jvfld.exe47⤵PID:3080
-
\??\c:\rbhfvx.exec:\rbhfvx.exe48⤵PID:940
-
\??\c:\vxjpdbd.exec:\vxjpdbd.exe49⤵PID:4720
-
\??\c:\plntft.exec:\plntft.exe50⤵PID:3340
-
\??\c:\rtlht.exec:\rtlht.exe51⤵PID:5056
-
\??\c:\pjpbbp.exec:\pjpbbp.exe52⤵PID:1432
-
\??\c:\tnfhfd.exec:\tnfhfd.exe53⤵PID:3444
-
\??\c:\dxrnd.exec:\dxrnd.exe54⤵PID:1608
-
\??\c:\jplrb.exec:\jplrb.exe55⤵PID:4036
-
\??\c:\bvjtnt.exec:\bvjtnt.exe56⤵PID:4456
-
\??\c:\lpvdrh.exec:\lpvdrh.exe57⤵PID:2364
-
\??\c:\dvdtj.exec:\dvdtj.exe58⤵PID:752
-
\??\c:\xdftxrl.exec:\xdftxrl.exe59⤵PID:836
-
\??\c:\lrhpflj.exec:\lrhpflj.exe60⤵PID:4932
-
\??\c:\dldxd.exec:\dldxd.exe61⤵PID:3384
-
\??\c:\lnnjj.exec:\lnnjj.exe62⤵PID:5108
-
\??\c:\bltlbp.exec:\bltlbp.exe63⤵PID:2492
-
\??\c:\bvfbljv.exec:\bvfbljv.exe64⤵PID:4004
-
\??\c:\tdtvjtl.exec:\tdtvjtl.exe65⤵PID:3076
-
\??\c:\jvbjpf.exec:\jvbjpf.exe66⤵PID:1652
-
\??\c:\pdtrv.exec:\pdtrv.exe67⤵PID:4460
-
\??\c:\fttrbj.exec:\fttrbj.exe68⤵PID:2016
-
\??\c:\hhhxl.exec:\hhhxl.exe69⤵PID:4092
-
\??\c:\vxxphnr.exec:\vxxphnr.exe70⤵PID:3816
-
\??\c:\lxlrrfl.exec:\lxlrrfl.exe71⤵PID:4344
-
\??\c:\xrbht.exec:\xrbht.exe72⤵PID:3944
-
\??\c:\vpnlb.exec:\vpnlb.exe73⤵PID:2108
-
\??\c:\hjdtjrf.exec:\hjdtjrf.exe74⤵PID:3896
-
\??\c:\trhlxhb.exec:\trhlxhb.exe75⤵PID:3708
-
\??\c:\hbprj.exec:\hbprj.exe76⤵PID:4448
-
\??\c:\hddxlvd.exec:\hddxlvd.exe77⤵PID:4072
-
\??\c:\xrthd.exec:\xrthd.exe78⤵PID:3024
-
\??\c:\fhdtnvd.exec:\fhdtnvd.exe79⤵PID:1624
-
\??\c:\tjpvh.exec:\tjpvh.exe80⤵PID:3328
-
\??\c:\xbddvbr.exec:\xbddvbr.exe81⤵PID:5048
-
\??\c:\pfbtd.exec:\pfbtd.exe82⤵PID:2056
-
\??\c:\nxdpvbr.exec:\nxdpvbr.exe83⤵PID:4884
-
\??\c:\trthbpv.exec:\trthbpv.exe84⤵PID:2252
-
\??\c:\vfxhvb.exec:\vfxhvb.exe85⤵PID:3748
-
\??\c:\llpntpx.exec:\llpntpx.exe86⤵PID:5016
-
\??\c:\xllxlf.exec:\xllxlf.exe87⤵PID:1964
-
\??\c:\xxjljf.exec:\xxjljf.exe88⤵PID:3456
-
\??\c:\htnjtr.exec:\htnjtr.exe89⤵PID:1320
-
\??\c:\txhxfd.exec:\txhxfd.exe90⤵PID:3292
-
\??\c:\pvbrj.exec:\pvbrj.exe91⤵PID:4700
-
\??\c:\jvxxbl.exec:\jvxxbl.exe92⤵PID:2516
-
\??\c:\hdfblp.exec:\hdfblp.exe93⤵PID:5000
-
\??\c:\nhptnrf.exec:\nhptnrf.exe94⤵PID:2532
-
\??\c:\drtlr.exec:\drtlr.exe95⤵PID:2028
-
\??\c:\xvfvttl.exec:\xvfvttl.exe96⤵PID:1468
-
\??\c:\nbdhxfd.exec:\nbdhxfd.exe97⤵PID:2004
-
\??\c:\rpdbn.exec:\rpdbn.exe98⤵PID:4880
-
\??\c:\bbfxdv.exec:\bbfxdv.exe99⤵PID:4456
-
\??\c:\fjphnn.exec:\fjphnn.exe100⤵PID:2364
-
\??\c:\nlppvr.exec:\nlppvr.exe101⤵PID:752
-
\??\c:\xpltrl.exec:\xpltrl.exe102⤵PID:836
-
\??\c:\lrjth.exec:\lrjth.exe103⤵PID:4932
-
\??\c:\xrddlj.exec:\xrddlj.exe104⤵PID:4592
-
\??\c:\dhrjd.exec:\dhrjd.exe105⤵PID:4836
-
\??\c:\dxpjpjx.exec:\dxpjpjx.exe106⤵PID:3744
-
\??\c:\phvxhp.exec:\phvxhp.exe107⤵PID:3148
-
\??\c:\lttrrtx.exec:\lttrrtx.exe108⤵PID:4312
-
\??\c:\ppxbhtx.exec:\ppxbhtx.exe109⤵PID:2176
-
\??\c:\drlppff.exec:\drlppff.exe110⤵PID:5084
-
\??\c:\jrvxr.exec:\jrvxr.exe111⤵PID:4292
-
\??\c:\vbfjfhb.exec:\vbfjfhb.exe112⤵PID:4852
-
\??\c:\dfnbd.exec:\dfnbd.exe113⤵PID:3188
-
\??\c:\fplvln.exec:\fplvln.exe114⤵PID:1544
-
\??\c:\rltphf.exec:\rltphf.exe115⤵PID:2896
-
\??\c:\phxvrx.exec:\phxvrx.exe116⤵PID:3936
-
\??\c:\hhxrblv.exec:\hhxrblv.exe117⤵PID:1804
-
\??\c:\tvtflp.exec:\tvtflp.exe118⤵PID:4052
-
\??\c:\vdbfxpb.exec:\vdbfxpb.exe119⤵PID:2768
-
\??\c:\lplllh.exec:\lplllh.exe120⤵PID:4448
-
\??\c:\fxxph.exec:\fxxph.exe121⤵PID:4492
-
\??\c:\xbnnljd.exec:\xbnnljd.exe122⤵PID:2728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-