Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2023, 07:58
Behavioral task
behavioral1
Sample
NEAS.245040d9c33da5a3dd4eab8f651d9ef0.exe
Resource
win7-20231020-en
5 signatures
150 seconds
General
-
Target
NEAS.245040d9c33da5a3dd4eab8f651d9ef0.exe
-
Size
113KB
-
MD5
245040d9c33da5a3dd4eab8f651d9ef0
-
SHA1
38c7ef043bb156d472dd74823d7334a7fb1e1219
-
SHA256
ebbdb80ec302867bdae9a2f91024390e49f0a6c6eb344bb76090348d791b2cca
-
SHA512
01c06569cb386aa635077a5e22d379dbad3bf3dd1f9257cf9113b201b7afe5a57f7c7843a353a1b246589ef5f961336ab83b3c8cbee91939114b4520636a1940
-
SSDEEP
3072:chOmTsF93UYfwC6GIout5pi8rY9AABa1D1DV6LYok:ccm4FmowdHoS5ddWi1KY9
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4944-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3804-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4312-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1728-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4676-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1456-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2700-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2948-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4140-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4252-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3116-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/824-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/728-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1284-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4288-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1292-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2616-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1084-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2484-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4796-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4696-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2944-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1772-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3564-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3844-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3444-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3116-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4808-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3824-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/932-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/688-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1136-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4616-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1948-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2236-532-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-553-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1104-579-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3316-607-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1284-634-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2688-706-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1728-718-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-999-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2432-1218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3804 frdvpp.exe 4312 pxrjx.exe 4460 fbrnlpv.exe 1728 hfxtndb.exe 4676 ldldvrr.exe 884 fnvvbfd.exe 1168 bljlnpf.exe 1456 hfprbp.exe 2700 vlrpvr.exe 1768 jhxjv.exe 3808 lppjht.exe 2948 lbnff.exe 4140 vbfvjjx.exe 4252 bphpxl.exe 3116 thlbv.exe 728 hpltf.exe 4672 jnrvd.exe 4812 bjvtln.exe 824 ptbhhv.exe 1612 rpprdr.exe 1284 hxrfbjd.exe 4180 thvbv.exe 5104 jxhjd.exe 4848 rbldthn.exe 4288 hxdrv.exe 100 rpfdt.exe 1696 rndxjnb.exe 1292 rprjv.exe 4104 lbrflfh.exe 2220 ndfnff.exe 2616 hlhhp.exe 2844 nvxffjr.exe 4936 ftjffx.exe 2272 nxntfnj.exe 3136 pnnxpb.exe 1084 fxftj.exe 2052 lhjnh.exe 5016 bfdfhtb.exe 2484 xnlxx.exe 1364 tbdjnff.exe 2432 dhxnfx.exe 4796 vrlrb.exe 4696 jdnptl.exe 3700 hllblp.exe 2944 dvpvbhv.exe 1772 flhtbf.exe 4068 lttrlnn.exe 376 hbxrbb.exe 3564 hnvfbt.exe 212 bpffbb.exe 4300 hxvpbvv.exe 3456 tnnfh.exe 4624 vhdjfb.exe 4768 tnvpbj.exe 4260 lhrtr.exe 1728 nbttvf.exe 640 ljdpxv.exe 4440 hhdjv.exe 4844 jbjvrp.exe 884 dbbnl.exe 1168 tffthr.exe 3184 vrvrll.exe 3844 btpfj.exe 2700 ppjxtbn.exe -
resource yara_rule behavioral2/memory/4944-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d5d-3.dat upx behavioral2/memory/4944-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d5d-4.dat upx behavioral2/files/0x0007000000022d60-8.dat upx behavioral2/files/0x0007000000022d60-10.dat upx behavioral2/memory/3804-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d66-11.dat upx behavioral2/memory/4312-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d67-18.dat upx behavioral2/memory/1728-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1728-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d68-26.dat upx behavioral2/files/0x0006000000022d68-25.dat upx behavioral2/files/0x0006000000022d67-20.dat upx behavioral2/memory/4460-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d66-14.dat upx behavioral2/files/0x0006000000022d66-13.dat upx behavioral2/files/0x0006000000022d69-30.dat upx behavioral2/memory/884-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d69-31.dat upx behavioral2/memory/4676-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1168-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d6b-41.dat upx behavioral2/files/0x0006000000022d6b-42.dat upx behavioral2/files/0x0006000000022d6a-36.dat upx behavioral2/files/0x0006000000022d6a-35.dat upx behavioral2/files/0x0006000000022d6c-45.dat upx behavioral2/memory/1456-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d6c-47.dat upx behavioral2/files/0x0006000000022d6d-50.dat upx behavioral2/memory/2700-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d6d-52.dat upx behavioral2/files/0x0006000000022d6e-55.dat upx behavioral2/memory/1768-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d6e-57.dat upx behavioral2/files/0x0006000000022d70-60.dat upx behavioral2/memory/3808-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d70-62.dat upx behavioral2/memory/2948-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022d61-65.dat upx behavioral2/files/0x0007000000022d61-67.dat upx behavioral2/memory/4140-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d73-70.dat upx behavioral2/files/0x0006000000022d73-72.dat upx behavioral2/files/0x0006000000022d74-75.dat upx behavioral2/memory/4252-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d74-77.dat upx behavioral2/files/0x0006000000022d75-80.dat upx behavioral2/memory/3116-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d75-81.dat upx behavioral2/files/0x0006000000022d77-85.dat upx behavioral2/files/0x0006000000022d77-87.dat upx behavioral2/files/0x0006000000022d78-92.dat upx behavioral2/files/0x0006000000022d79-95.dat upx behavioral2/files/0x0006000000022d79-96.dat upx behavioral2/files/0x0006000000022d7a-101.dat upx behavioral2/memory/824-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d7a-102.dat upx behavioral2/files/0x0006000000022d78-90.dat upx behavioral2/memory/728-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022d7b-107.dat upx behavioral2/files/0x0006000000022d7b-106.dat upx behavioral2/files/0x0006000000022d7c-110.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4944 wrote to memory of 3804 4944 NEAS.245040d9c33da5a3dd4eab8f651d9ef0.exe 84 PID 4944 wrote to memory of 3804 4944 NEAS.245040d9c33da5a3dd4eab8f651d9ef0.exe 84 PID 4944 wrote to memory of 3804 4944 NEAS.245040d9c33da5a3dd4eab8f651d9ef0.exe 84 PID 3804 wrote to memory of 4312 3804 frdvpp.exe 85 PID 3804 wrote to memory of 4312 3804 frdvpp.exe 85 PID 3804 wrote to memory of 4312 3804 frdvpp.exe 85 PID 4312 wrote to memory of 4460 4312 pxrjx.exe 86 PID 4312 wrote to memory of 4460 4312 pxrjx.exe 86 PID 4312 wrote to memory of 4460 4312 pxrjx.exe 86 PID 4460 wrote to memory of 1728 4460 fbrnlpv.exe 87 PID 4460 wrote to memory of 1728 4460 fbrnlpv.exe 87 PID 4460 wrote to memory of 1728 4460 fbrnlpv.exe 87 PID 1728 wrote to memory of 4676 1728 hfxtndb.exe 88 PID 1728 wrote to memory of 4676 1728 hfxtndb.exe 88 PID 1728 wrote to memory of 4676 1728 hfxtndb.exe 88 PID 4676 wrote to memory of 884 4676 ldldvrr.exe 89 PID 4676 wrote to memory of 884 4676 ldldvrr.exe 89 PID 4676 wrote to memory of 884 4676 ldldvrr.exe 89 PID 884 wrote to memory of 1168 884 fnvvbfd.exe 90 PID 884 wrote to memory of 1168 884 fnvvbfd.exe 90 PID 884 wrote to memory of 1168 884 fnvvbfd.exe 90 PID 1168 wrote to memory of 1456 1168 bljlnpf.exe 91 PID 1168 wrote to memory of 1456 1168 bljlnpf.exe 91 PID 1168 wrote to memory of 1456 1168 bljlnpf.exe 91 PID 1456 wrote to memory of 2700 1456 hfprbp.exe 92 PID 1456 wrote to memory of 2700 1456 hfprbp.exe 92 PID 1456 wrote to memory of 2700 1456 hfprbp.exe 92 PID 2700 wrote to memory of 1768 2700 vlrpvr.exe 93 PID 2700 wrote to memory of 1768 2700 vlrpvr.exe 93 PID 2700 wrote to memory of 1768 2700 vlrpvr.exe 93 PID 1768 wrote to memory of 3808 1768 jhxjv.exe 94 PID 1768 wrote to memory of 3808 1768 jhxjv.exe 94 PID 1768 wrote to memory of 3808 1768 jhxjv.exe 94 PID 3808 wrote to memory of 2948 3808 lppjht.exe 95 PID 3808 wrote to memory of 2948 3808 lppjht.exe 95 PID 3808 wrote to memory of 2948 3808 lppjht.exe 95 PID 2948 wrote to memory of 4140 2948 lbnff.exe 96 PID 2948 wrote to memory of 4140 2948 lbnff.exe 96 PID 2948 wrote to memory of 4140 2948 lbnff.exe 96 PID 4140 wrote to memory of 4252 4140 vbfvjjx.exe 97 PID 4140 wrote to memory of 4252 4140 vbfvjjx.exe 97 PID 4140 wrote to memory of 4252 4140 vbfvjjx.exe 97 PID 4252 wrote to memory of 3116 4252 bphpxl.exe 98 PID 4252 wrote to memory of 3116 4252 bphpxl.exe 98 PID 4252 wrote to memory of 3116 4252 bphpxl.exe 98 PID 3116 wrote to memory of 728 3116 thlbv.exe 99 PID 3116 wrote to memory of 728 3116 thlbv.exe 99 PID 3116 wrote to memory of 728 3116 thlbv.exe 99 PID 728 wrote to memory of 4672 728 hpltf.exe 100 PID 728 wrote to memory of 4672 728 hpltf.exe 100 PID 728 wrote to memory of 4672 728 hpltf.exe 100 PID 4672 wrote to memory of 4812 4672 jnrvd.exe 101 PID 4672 wrote to memory of 4812 4672 jnrvd.exe 101 PID 4672 wrote to memory of 4812 4672 jnrvd.exe 101 PID 4812 wrote to memory of 824 4812 bjvtln.exe 102 PID 4812 wrote to memory of 824 4812 bjvtln.exe 102 PID 4812 wrote to memory of 824 4812 bjvtln.exe 102 PID 824 wrote to memory of 1612 824 ptbhhv.exe 103 PID 824 wrote to memory of 1612 824 ptbhhv.exe 103 PID 824 wrote to memory of 1612 824 ptbhhv.exe 103 PID 1612 wrote to memory of 1284 1612 rpprdr.exe 104 PID 1612 wrote to memory of 1284 1612 rpprdr.exe 104 PID 1612 wrote to memory of 1284 1612 rpprdr.exe 104 PID 1284 wrote to memory of 4180 1284 hxrfbjd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.245040d9c33da5a3dd4eab8f651d9ef0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.245040d9c33da5a3dd4eab8f651d9ef0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\frdvpp.exec:\frdvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\pxrjx.exec:\pxrjx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\fbrnlpv.exec:\fbrnlpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\hfxtndb.exec:\hfxtndb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\ldldvrr.exec:\ldldvrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\fnvvbfd.exec:\fnvvbfd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\bljlnpf.exec:\bljlnpf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\hfprbp.exec:\hfprbp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\vlrpvr.exec:\vlrpvr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\jhxjv.exec:\jhxjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\lppjht.exec:\lppjht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\lbnff.exec:\lbnff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\vbfvjjx.exec:\vbfvjjx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\bphpxl.exec:\bphpxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\thlbv.exec:\thlbv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\hpltf.exec:\hpltf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\jnrvd.exec:\jnrvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\bjvtln.exec:\bjvtln.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\ptbhhv.exec:\ptbhhv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\rpprdr.exec:\rpprdr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\hxrfbjd.exec:\hxrfbjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\thvbv.exec:\thvbv.exe23⤵
- Executes dropped EXE
PID:4180 -
\??\c:\jxhjd.exec:\jxhjd.exe24⤵
- Executes dropped EXE
PID:5104 -
\??\c:\rbldthn.exec:\rbldthn.exe25⤵
- Executes dropped EXE
PID:4848
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\nlxfl.exec:\nlxfl.exe14⤵PID:4584
-
\??\c:\njfrvt.exec:\njfrvt.exe15⤵PID:3404
-
-
-
-
-
-
-
\??\c:\lnjtfb.exec:\lnjtfb.exe10⤵PID:4660
-
\??\c:\dffhb.exec:\dffhb.exe11⤵PID:4420
-
\??\c:\bhffd.exec:\bhffd.exe12⤵PID:3808
-
\??\c:\nttbdp.exec:\nttbdp.exe13⤵PID:3884
-
\??\c:\fhxjjr.exec:\fhxjjr.exe14⤵PID:3656
-
\??\c:\ftjhj.exec:\ftjhj.exe15⤵PID:3520
-
\??\c:\jvpjdf.exec:\jvpjdf.exe16⤵PID:1780
-
\??\c:\ddbrvd.exec:\ddbrvd.exe17⤵PID:2208
-
\??\c:\tftrht.exec:\tftrht.exe18⤵PID:3316
-
\??\c:\hxrbpbr.exec:\hxrbpbr.exe19⤵PID:1932
-
\??\c:\rdptbrh.exec:\rdptbrh.exe20⤵PID:4272
-
\??\c:\npdjp.exec:\npdjp.exe21⤵PID:3244
-
\??\c:\xvvfr.exec:\xvvfr.exe22⤵PID:2400
-
\??\c:\lhrnt.exec:\lhrnt.exe23⤵PID:1380
-
\??\c:\bxnfvjj.exec:\bxnfvjj.exe24⤵PID:1460
-
\??\c:\tbrxrf.exec:\tbrxrf.exe25⤵PID:2788
-
\??\c:\pdphj.exec:\pdphj.exe26⤵PID:4772
-
\??\c:\txpnb.exec:\txpnb.exe27⤵PID:3012
-
\??\c:\hvfrvh.exec:\hvfrvh.exe28⤵PID:3180
-
\??\c:\ttlllpj.exec:\ttlllpj.exe29⤵PID:2560
-
\??\c:\vllldd.exec:\vllldd.exe30⤵PID:4024
-
\??\c:\rphdh.exec:\rphdh.exe31⤵PID:4472
-
\??\c:\fvdjrt.exec:\fvdjrt.exe32⤵PID:536
-
\??\c:\vddft.exec:\vddft.exe33⤵PID:1248
-
\??\c:\fhbjdnp.exec:\fhbjdnp.exe34⤵PID:1928
-
\??\c:\fjdbv.exec:\fjdbv.exe35⤵PID:3888
-
\??\c:\jxdhxjb.exec:\jxdhxjb.exe36⤵PID:1700
-
\??\c:\ltprp.exec:\ltprp.exe37⤵PID:2372
-
\??\c:\hprdhbd.exec:\hprdhbd.exe38⤵PID:4600
-
\??\c:\npbxrtp.exec:\npbxrtp.exe39⤵PID:4000
-
\??\c:\rnntjx.exec:\rnntjx.exe40⤵PID:3080
-
\??\c:\lpbrp.exec:\lpbrp.exe41⤵PID:2320
-
\??\c:\bbjvb.exec:\bbjvb.exe42⤵PID:4708
-
\??\c:\brhvjd.exec:\brhvjd.exe43⤵PID:4416
-
\??\c:\rdhrh.exec:\rdhrh.exe44⤵PID:4616
-
\??\c:\rddbx.exec:\rddbx.exe45⤵PID:4692
-
\??\c:\xnpdj.exec:\xnpdj.exe46⤵PID:2752
-
\??\c:\bppdjf.exec:\bppdjf.exe47⤵PID:1552
-
\??\c:\nhbbbp.exec:\nhbbbp.exe48⤵PID:3336
-
\??\c:\dpflr.exec:\dpflr.exe49⤵PID:3608
-
\??\c:\frlbr.exec:\frlbr.exe50⤵PID:2100
-
\??\c:\tdxht.exec:\tdxht.exe51⤵PID:1488
-
\??\c:\ftffnbp.exec:\ftffnbp.exe52⤵PID:1840
-
\??\c:\brrnbp.exec:\brrnbp.exe53⤵PID:1728
-
\??\c:\hxnvtrv.exec:\hxnvtrv.exe54⤵PID:3148
-
\??\c:\nxvrx.exec:\nxvrx.exe55⤵PID:1456
-
\??\c:\jnxvxn.exec:\jnxvxn.exe56⤵PID:4460
-
\??\c:\xvvtj.exec:\xvvtj.exe57⤵PID:3924
-
\??\c:\hbxphd.exec:\hbxphd.exe58⤵PID:628
-
\??\c:\nvnrrv.exec:\nvnrrv.exe59⤵PID:4660
-
\??\c:\tfxll.exec:\tfxll.exe60⤵PID:4020
-
\??\c:\tltfjvn.exec:\tltfjvn.exe61⤵PID:4140
-
\??\c:\fpvhfhd.exec:\fpvhfhd.exe62⤵PID:3656
-
\??\c:\rnjjdp.exec:\rnjjdp.exe63⤵PID:3052
-
\??\c:\rdnll.exec:\rdnll.exe64⤵PID:4328
-
\??\c:\ftfvnjn.exec:\ftfvnjn.exe65⤵PID:2208
-
\??\c:\rfxpfxp.exec:\rfxpfxp.exe66⤵PID:3316
-
\??\c:\fpfhrfh.exec:\fpfhrfh.exe67⤵PID:1304
-
\??\c:\nrtvbn.exec:\nrtvbn.exe68⤵PID:464
-
\??\c:\xpxlb.exec:\xpxlb.exe69⤵PID:2864
-
\??\c:\ldhxd.exec:\ldhxd.exe70⤵PID:1360
-
\??\c:\bbrrtf.exec:\bbrrtf.exe71⤵PID:944
-
\??\c:\nljrdp.exec:\nljrdp.exe72⤵PID:2788
-
\??\c:\jpdvbpb.exec:\jpdvbpb.exe73⤵PID:4540
-
\??\c:\tdrrv.exec:\tdrrv.exe74⤵PID:804
-
\??\c:\ffpppbr.exec:\ffpppbr.exe75⤵PID:2680
-
\??\c:\rdfltl.exec:\rdfltl.exe76⤵PID:1424
-
\??\c:\bjpvbp.exec:\bjpvbp.exe77⤵PID:4684
-
\??\c:\fjhprj.exec:\fjhprj.exe78⤵PID:100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\nbtjn.exec:\nbtjn.exe54⤵PID:2924
-
\??\c:\nxbfdp.exec:\nxbfdp.exe55⤵PID:4440
-
\??\c:\frhdf.exec:\frhdf.exe56⤵PID:628
-
\??\c:\tvxrpvb.exec:\tvxrpvb.exe57⤵PID:4660
-
\??\c:\fjdtv.exec:\fjdtv.exe58⤵PID:3172
-
\??\c:\dhldvjj.exec:\dhldvjj.exe59⤵PID:3520
-
\??\c:\xdhvnrd.exec:\xdhvnrd.exe60⤵PID:4140
-
\??\c:\dfvpjp.exec:\dfvpjp.exe61⤵PID:3656
-
\??\c:\nrvjbj.exec:\nrvjbj.exe62⤵PID:4760
-
\??\c:\rvvxtpv.exec:\rvvxtpv.exe63⤵PID:3220
-
\??\c:\rbbjxd.exec:\rbbjxd.exe64⤵PID:736
-
\??\c:\tfpprxv.exec:\tfpprxv.exe65⤵PID:3316
-
\??\c:\tdjjn.exec:\tdjjn.exe66⤵PID:4272
-
\??\c:\xjpbf.exec:\xjpbf.exe67⤵PID:2156
-
\??\c:\fdlrnh.exec:\fdlrnh.exe68⤵PID:3668
-
\??\c:\jrvtpbf.exec:\jrvtpbf.exe69⤵PID:872
-
\??\c:\hnbvfjp.exec:\hnbvfjp.exe70⤵PID:1420
-
\??\c:\nddldvr.exec:\nddldvr.exe71⤵PID:4636
-
\??\c:\ndnxb.exec:\ndnxb.exe72⤵PID:4684
-
\??\c:\jrvfbfl.exec:\jrvfbfl.exe73⤵PID:4008
-
\??\c:\dlnhjdh.exec:\dlnhjdh.exe74⤵PID:536
-
\??\c:\plxlx.exec:\plxlx.exe75⤵PID:4864
-
\??\c:\lbvvn.exec:\lbvvn.exe76⤵PID:4632
-
\??\c:\hjvrvdn.exec:\hjvrvdn.exe77⤵PID:2616
-
\??\c:\xbltn.exec:\xbltn.exe78⤵PID:3936
-
\??\c:\ndnjv.exec:\ndnjv.exe79⤵PID:1312
-
\??\c:\xhlddl.exec:\xhlddl.exe80⤵PID:4908
-
\??\c:\fdtpbbt.exec:\fdtpbbt.exe81⤵PID:2104
-
\??\c:\frrxph.exec:\frrxph.exe82⤵PID:4600
-
\??\c:\fhltxrb.exec:\fhltxrb.exe83⤵PID:4836
-
\??\c:\vpnrtt.exec:\vpnrtt.exe84⤵PID:1528
-
\??\c:\jhhtlf.exec:\jhhtlf.exe85⤵PID:1648
-
\??\c:\brphj.exec:\brphj.exe86⤵PID:3756
-
\??\c:\pjnhl.exec:\pjnhl.exe87⤵PID:1548
-
\??\c:\brhnlrv.exec:\brhnlrv.exe88⤵PID:2832
-
\??\c:\ftdjp.exec:\ftdjp.exe89⤵PID:3496
-
\??\c:\jrfbnv.exec:\jrfbnv.exe90⤵PID:4640
-
\??\c:\bbbxvpp.exec:\bbbxvpp.exe91⤵PID:4896
-
\??\c:\fdrldbn.exec:\fdrldbn.exe92⤵PID:5072
-
\??\c:\rfttvh.exec:\rfttvh.exe93⤵PID:4692
-
\??\c:\lrplt.exec:\lrplt.exe94⤵PID:3992
-
\??\c:\xrtdj.exec:\xrtdj.exe95⤵PID:680
-
\??\c:\lvplvvp.exec:\lvplvvp.exe96⤵PID:4452
-
\??\c:\nnlvvbd.exec:\nnlvvbd.exe97⤵PID:3584
-
\??\c:\pnhbfn.exec:\pnhbfn.exe98⤵PID:4260
-
\??\c:\vbpxpvn.exec:\vbpxpvn.exe99⤵PID:2240
-
\??\c:\hfpxhvt.exec:\hfpxhvt.exe100⤵PID:3924
-
\??\c:\ftpvl.exec:\ftpvl.exe101⤵PID:1216
-
\??\c:\vtjhd.exec:\vtjhd.exe102⤵PID:1828
-
\??\c:\jbfrxr.exec:\jbfrxr.exe103⤵PID:3812
-
\??\c:\dttrrrj.exec:\dttrrrj.exe104⤵PID:1768
-
\??\c:\bplfbv.exec:\bplfbv.exe105⤵PID:1844
-
\??\c:\jxrdnl.exec:\jxrdnl.exe106⤵PID:2588
-
\??\c:\drxnr.exec:\drxnr.exe107⤵PID:4140
-
\??\c:\pbxpfjh.exec:\pbxpfjh.exe108⤵PID:4328
-
\??\c:\brrblhr.exec:\brrblhr.exe109⤵PID:1780
-
\??\c:\bhnvvb.exec:\bhnvvb.exe110⤵PID:2948
-
\??\c:\drvtprf.exec:\drvtprf.exe111⤵PID:4180
-
\??\c:\btplr.exec:\btplr.exe112⤵PID:464
-
\??\c:\dxbrj.exec:\dxbrj.exe113⤵PID:2156
-
\??\c:\lfttfjd.exec:\lfttfjd.exe114⤵PID:1460
-
\??\c:\rxjjxbh.exec:\rxjjxbh.exe115⤵PID:3032
-
\??\c:\rtxvlph.exec:\rtxvlph.exe116⤵PID:2788
-
\??\c:\bnbph.exec:\bnbph.exe117⤵PID:2892
-
\??\c:\jrfvl.exec:\jrfvl.exe118⤵PID:3652
-
\??\c:\vdvjn.exec:\vdvjn.exe119⤵PID:4988
-
\??\c:\lpvfl.exec:\lpvfl.exe120⤵PID:3168
-
\??\c:\rntvr.exec:\rntvr.exe121⤵PID:4104
-
\??\c:\jxdxjtd.exec:\jxdxjtd.exe122⤵PID:2944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-