Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
18/11/2023, 06:17
Behavioral task
behavioral1
Sample
NEAS.b48e9f83bb846d932835c72f97100410.exe
Resource
win7-20231023-en
5 signatures
150 seconds
General
-
Target
NEAS.b48e9f83bb846d932835c72f97100410.exe
-
Size
88KB
-
MD5
b48e9f83bb846d932835c72f97100410
-
SHA1
30ac57f60ce21682f6d430d5f81ea9c323508d61
-
SHA256
677b4366b20f61f73623fa3c3e8964b366ef5fb3e625804da74e308f7dddde96
-
SHA512
e6b65e6950f284038fa53f1a495825588344de93999f464946c80098de8e2d8f862708469f8ef78532e8fcf7c217b072fc18fd4f087165016e727374f8894a75
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFbUZJjw5Ivov1dk:9hOmTsF93UYfwC6GIoutz5yLpc
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3652-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3836-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1028-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1072-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1064-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1456-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4500-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2748-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3656-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4012-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3092-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3392-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/352-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3896-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1232-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3676-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1568-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3936-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5088-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1868-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4296-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1192-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4280-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2788-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3468-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4660-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/576-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3452-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2468-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2760-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/240-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/868-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1760-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4160-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4268-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3464-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2932-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2544-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1960-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-532-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3412-607-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-623-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3960-630-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3836 p9919j6.exe 1028 038204.exe 4864 7mqlt5t.exe 1072 9r7177.exe 1280 18735.exe 1064 h1873.exe 3808 u2su3.exe 1456 2isr13.exe 4500 97el8d.exe 5048 j04b0.exe 4876 i8g8g.exe 2748 fswws6.exe 4332 eaqms33.exe 3656 93iass.exe 4012 5p7536.exe 3092 99h16.exe 4536 ef1553.exe 4888 2b1931.exe 3392 3sio3.exe 1732 03ikicb.exe 3592 qq85q1o.exe 352 39c0g.exe 3896 6a631.exe 1168 2akq2wa.exe 2548 49a37.exe 2888 ch51s51.exe 3496 p6wc6uq.exe 1232 uuos307.exe 2348 jmoe6.exe 3676 m9xn8.exe 3872 ji5jd.exe 4912 qet4wq8.exe 1568 acd1q.exe 4456 7caua.exe 4660 tp5wi.exe 3936 l717n4.exe 1352 n261p7.exe 4896 gqe0wwc.exe 3420 091969.exe 5088 ui51990.exe 1072 uk8c1.exe 5044 a2cq512.exe 2008 6mqa4.exe 1868 9w11x.exe 4436 2s1995.exe 1460 lg626.exe 4548 4x41i5m.exe 4604 pkuaq8.exe 4392 hn60tk.exe 2748 nf962w.exe 4892 tuiq6.exe 764 tpas0w8.exe 2680 990ch70.exe 2608 p1095.exe 3120 x6q369.exe 3380 kqacwgu.exe 4296 g8mf2m.exe 1192 d80qs35.exe 4948 7g36u.exe 2572 caegai6.exe 4124 23qt52.exe 2596 948ug23.exe 2436 h957c.exe 1852 3gh1wr0.exe -
resource yara_rule behavioral2/memory/3652-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000222f4-3.dat upx behavioral2/memory/3652-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000222f4-5.dat upx behavioral2/files/0x0008000000022df1-11.dat upx behavioral2/files/0x0008000000022dee-10.dat upx behavioral2/files/0x0008000000022dee-9.dat upx behavioral2/memory/3836-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1028-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022df1-14.dat upx behavioral2/files/0x0008000000022df1-13.dat upx behavioral2/files/0x0007000000022df5-19.dat upx behavioral2/memory/4864-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022df5-18.dat upx behavioral2/memory/1072-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022df6-26.dat upx behavioral2/files/0x0007000000022df6-24.dat upx behavioral2/files/0x0007000000022df7-29.dat upx behavioral2/files/0x0007000000022df7-31.dat upx behavioral2/files/0x0007000000022df8-34.dat upx behavioral2/files/0x0007000000022df8-35.dat upx behavioral2/memory/3808-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1064-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022df9-42.dat upx behavioral2/memory/1456-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022dfa-47.dat upx behavioral2/memory/4500-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4500-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022dfa-48.dat upx behavioral2/files/0x0007000000022df9-40.dat upx behavioral2/files/0x0007000000022dfb-53.dat upx behavioral2/files/0x0007000000022dfb-54.dat upx behavioral2/memory/5048-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022dfe-58.dat upx behavioral2/memory/5048-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022dfe-60.dat upx behavioral2/memory/4876-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022dff-65.dat upx behavioral2/files/0x0007000000022dff-66.dat upx behavioral2/memory/2748-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e01-70.dat upx behavioral2/files/0x0007000000022e01-69.dat upx behavioral2/files/0x0007000000022e02-74.dat upx behavioral2/memory/3656-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4332-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e03-82.dat upx behavioral2/files/0x0007000000022e03-80.dat upx behavioral2/memory/4012-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e02-75.dat upx behavioral2/files/0x0007000000022e04-87.dat upx behavioral2/files/0x0007000000022e04-85.dat upx behavioral2/files/0x0007000000022e05-90.dat upx behavioral2/memory/3092-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e05-92.dat upx behavioral2/files/0x0007000000022e07-97.dat upx behavioral2/memory/4536-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3392-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e09-108.dat upx behavioral2/files/0x0007000000022e08-102.dat upx behavioral2/files/0x0007000000022e08-101.dat upx behavioral2/files/0x0007000000022e09-109.dat upx behavioral2/memory/4888-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022e07-95.dat upx behavioral2/files/0x0007000000022e0a-112.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3652 wrote to memory of 3836 3652 NEAS.b48e9f83bb846d932835c72f97100410.exe 86 PID 3652 wrote to memory of 3836 3652 NEAS.b48e9f83bb846d932835c72f97100410.exe 86 PID 3652 wrote to memory of 3836 3652 NEAS.b48e9f83bb846d932835c72f97100410.exe 86 PID 3836 wrote to memory of 1028 3836 p9919j6.exe 87 PID 3836 wrote to memory of 1028 3836 p9919j6.exe 87 PID 3836 wrote to memory of 1028 3836 p9919j6.exe 87 PID 1028 wrote to memory of 4864 1028 038204.exe 88 PID 1028 wrote to memory of 4864 1028 038204.exe 88 PID 1028 wrote to memory of 4864 1028 038204.exe 88 PID 4864 wrote to memory of 1072 4864 7mqlt5t.exe 89 PID 4864 wrote to memory of 1072 4864 7mqlt5t.exe 89 PID 4864 wrote to memory of 1072 4864 7mqlt5t.exe 89 PID 1072 wrote to memory of 1280 1072 9r7177.exe 90 PID 1072 wrote to memory of 1280 1072 9r7177.exe 90 PID 1072 wrote to memory of 1280 1072 9r7177.exe 90 PID 1280 wrote to memory of 1064 1280 18735.exe 91 PID 1280 wrote to memory of 1064 1280 18735.exe 91 PID 1280 wrote to memory of 1064 1280 18735.exe 91 PID 1064 wrote to memory of 3808 1064 h1873.exe 92 PID 1064 wrote to memory of 3808 1064 h1873.exe 92 PID 1064 wrote to memory of 3808 1064 h1873.exe 92 PID 3808 wrote to memory of 1456 3808 u2su3.exe 93 PID 3808 wrote to memory of 1456 3808 u2su3.exe 93 PID 3808 wrote to memory of 1456 3808 u2su3.exe 93 PID 1456 wrote to memory of 4500 1456 2isr13.exe 94 PID 1456 wrote to memory of 4500 1456 2isr13.exe 94 PID 1456 wrote to memory of 4500 1456 2isr13.exe 94 PID 4500 wrote to memory of 5048 4500 97el8d.exe 95 PID 4500 wrote to memory of 5048 4500 97el8d.exe 95 PID 4500 wrote to memory of 5048 4500 97el8d.exe 95 PID 5048 wrote to memory of 4876 5048 j04b0.exe 96 PID 5048 wrote to memory of 4876 5048 j04b0.exe 96 PID 5048 wrote to memory of 4876 5048 j04b0.exe 96 PID 4876 wrote to memory of 2748 4876 i8g8g.exe 97 PID 4876 wrote to memory of 2748 4876 i8g8g.exe 97 PID 4876 wrote to memory of 2748 4876 i8g8g.exe 97 PID 2748 wrote to memory of 4332 2748 fswws6.exe 98 PID 2748 wrote to memory of 4332 2748 fswws6.exe 98 PID 2748 wrote to memory of 4332 2748 fswws6.exe 98 PID 4332 wrote to memory of 3656 4332 eaqms33.exe 101 PID 4332 wrote to memory of 3656 4332 eaqms33.exe 101 PID 4332 wrote to memory of 3656 4332 eaqms33.exe 101 PID 3656 wrote to memory of 4012 3656 93iass.exe 99 PID 3656 wrote to memory of 4012 3656 93iass.exe 99 PID 3656 wrote to memory of 4012 3656 93iass.exe 99 PID 4012 wrote to memory of 3092 4012 5p7536.exe 100 PID 4012 wrote to memory of 3092 4012 5p7536.exe 100 PID 4012 wrote to memory of 3092 4012 5p7536.exe 100 PID 3092 wrote to memory of 4536 3092 99h16.exe 102 PID 3092 wrote to memory of 4536 3092 99h16.exe 102 PID 3092 wrote to memory of 4536 3092 99h16.exe 102 PID 4536 wrote to memory of 4888 4536 ef1553.exe 103 PID 4536 wrote to memory of 4888 4536 ef1553.exe 103 PID 4536 wrote to memory of 4888 4536 ef1553.exe 103 PID 4888 wrote to memory of 3392 4888 2b1931.exe 105 PID 4888 wrote to memory of 3392 4888 2b1931.exe 105 PID 4888 wrote to memory of 3392 4888 2b1931.exe 105 PID 3392 wrote to memory of 1732 3392 3sio3.exe 104 PID 3392 wrote to memory of 1732 3392 3sio3.exe 104 PID 3392 wrote to memory of 1732 3392 3sio3.exe 104 PID 1732 wrote to memory of 3592 1732 03ikicb.exe 106 PID 1732 wrote to memory of 3592 1732 03ikicb.exe 106 PID 1732 wrote to memory of 3592 1732 03ikicb.exe 106 PID 3592 wrote to memory of 352 3592 qq85q1o.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.b48e9f83bb846d932835c72f97100410.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.b48e9f83bb846d932835c72f97100410.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\p9919j6.exec:\p9919j6.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\038204.exec:\038204.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\7mqlt5t.exec:\7mqlt5t.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\9r7177.exec:\9r7177.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\18735.exec:\18735.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\h1873.exec:\h1873.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\u2su3.exec:\u2su3.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\2isr13.exec:\2isr13.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\97el8d.exec:\97el8d.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\j04b0.exec:\j04b0.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\i8g8g.exec:\i8g8g.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\fswws6.exec:\fswws6.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\eaqms33.exec:\eaqms33.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\93iass.exec:\93iass.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\5p7536.exec:\5p7536.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\99h16.exec:\99h16.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\ef1553.exec:\ef1553.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\2b1931.exec:\2b1931.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\3sio3.exec:\3sio3.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392
-
-
\??\c:\6a010.exec:\6a010.exe5⤵PID:1268
-
\??\c:\2aj8r5.exec:\2aj8r5.exe6⤵PID:3292
-
\??\c:\492s7.exec:\492s7.exe7⤵PID:4740
-
\??\c:\6o16ar1.exec:\6o16ar1.exe8⤵PID:4928
-
\??\c:\793oa.exec:\793oa.exe9⤵PID:2468
-
\??\c:\957311.exec:\957311.exe10⤵PID:2548
-
\??\c:\0f797.exec:\0f797.exe11⤵PID:1892
-
\??\c:\akf7g.exec:\akf7g.exe12⤵PID:712
-
\??\c:\6i0848.exec:\6i0848.exe13⤵PID:1304
-
\??\c:\5196e.exec:\5196e.exe14⤵PID:1604
-
\??\c:\0uv1a5.exec:\0uv1a5.exe15⤵PID:4912
-
\??\c:\r54e6an.exec:\r54e6an.exe16⤵PID:1900
-
\??\c:\5564ad7.exec:\5564ad7.exe17⤵PID:2588
-
\??\c:\86b6i.exec:\86b6i.exe18⤵PID:3488
-
\??\c:\kr6mkg.exec:\kr6mkg.exe19⤵PID:4540
-
\??\c:\wd937.exec:\wd937.exe20⤵PID:4552
-
\??\c:\8x32cur.exec:\8x32cur.exe21⤵PID:4460
-
\??\c:\35tpa5.exec:\35tpa5.exe22⤵PID:3520
-
\??\c:\716r8.exec:\716r8.exe23⤵PID:708
-
\??\c:\i5727.exec:\i5727.exe24⤵PID:4872
-
\??\c:\0g8lpg2.exec:\0g8lpg2.exe25⤵PID:3060
-
\??\c:\2q17q56.exec:\2q17q56.exe26⤵PID:1420
-
\??\c:\ftu74.exec:\ftu74.exe27⤵PID:4248
-
\??\c:\smsv991.exec:\smsv991.exe28⤵PID:3988
-
\??\c:\sw78i.exec:\sw78i.exe29⤵PID:4860
-
\??\c:\4dq764i.exec:\4dq764i.exe30⤵PID:3608
-
\??\c:\t1vsfc0.exec:\t1vsfc0.exe31⤵PID:1860
-
\??\c:\709hc6i.exec:\709hc6i.exe32⤵PID:3700
-
\??\c:\rs75751.exec:\rs75751.exe33⤵PID:3280
-
\??\c:\g52p90.exec:\g52p90.exe34⤵PID:4548
-
\??\c:\13617q.exec:\13617q.exe35⤵PID:4088
-
\??\c:\m26oe63.exec:\m26oe63.exe36⤵PID:3656
-
\??\c:\gtk2911.exec:\gtk2911.exe37⤵PID:2084
-
\??\c:\11577.exec:\11577.exe38⤵PID:4056
-
\??\c:\6t6nb1.exec:\6t6nb1.exe39⤵PID:4764
-
\??\c:\99933.exec:\99933.exe40⤵PID:1076
-
\??\c:\mmfpx5l.exec:\mmfpx5l.exe41⤵PID:3760
-
\??\c:\9d481ts.exec:\9d481ts.exe42⤵PID:900
-
\??\c:\ugkw5.exec:\ugkw5.exe43⤵PID:2468
-
\??\c:\94k950.exec:\94k950.exe44⤵PID:2760
-
\??\c:\2o18w.exec:\2o18w.exe45⤵PID:1232
-
\??\c:\99nt01b.exec:\99nt01b.exe46⤵PID:2348
-
\??\c:\ofm697.exec:\ofm697.exe47⤵PID:3624
-
\??\c:\ufjko68.exec:\ufjko68.exe48⤵PID:712
-
\??\c:\2eb30.exec:\2eb30.exe49⤵PID:1588
-
\??\c:\4t2dh.exec:\4t2dh.exe50⤵PID:868
-
\??\c:\u5057.exec:\u5057.exe51⤵PID:2564
-
\??\c:\omr53ww.exec:\omr53ww.exe52⤵PID:3848
-
\??\c:\8a917q.exec:\8a917q.exe53⤵PID:4464
-
\??\c:\se30ul.exec:\se30ul.exe54⤵PID:3020
-
\??\c:\93eu9.exec:\93eu9.exe55⤵PID:4632
-
\??\c:\xt122.exec:\xt122.exe56⤵PID:3520
-
\??\c:\0g866q3.exec:\0g866q3.exe57⤵PID:3996
-
\??\c:\v17w5.exec:\v17w5.exe58⤵PID:4872
-
\??\c:\133795.exec:\133795.exe59⤵PID:3060
-
\??\c:\0qjjrp7.exec:\0qjjrp7.exe60⤵PID:5072
-
\??\c:\8vjk0c.exec:\8vjk0c.exe61⤵PID:4248
-
\??\c:\h3ke596.exec:\h3ke596.exe62⤵PID:3352
-
\??\c:\n88a9.exec:\n88a9.exe63⤵PID:1400
-
\??\c:\957t1c.exec:\957t1c.exe64⤵PID:3608
-
\??\c:\qo77a35.exec:\qo77a35.exe65⤵PID:2904
-
\??\c:\f6v4c9.exec:\f6v4c9.exe66⤵PID:4068
-
\??\c:\i5aeic5.exec:\i5aeic5.exe67⤵PID:5100
-
\??\c:\2slmwk.exec:\2slmwk.exe68⤵PID:1812
-
\??\c:\ach8cd4.exec:\ach8cd4.exe69⤵PID:4260
-
\??\c:\kd5qq.exec:\kd5qq.exe70⤵PID:576
-
\??\c:\93378g.exec:\93378g.exe71⤵PID:4852
-
\??\c:\4ksqqu.exec:\4ksqqu.exe72⤵PID:4296
-
\??\c:\639x7am.exec:\639x7am.exe73⤵PID:4056
-
\??\c:\82dw0.exec:\82dw0.exe74⤵PID:2232
-
\??\c:\0mt577.exec:\0mt577.exe75⤵PID:2912
-
\??\c:\0cl1sju.exec:\0cl1sju.exe76⤵PID:3960
-
\??\c:\r0oe5mi.exec:\r0oe5mi.exe77⤵PID:1052
-
\??\c:\ng37st3.exec:\ng37st3.exe78⤵PID:2544
-
\??\c:\15s3113.exec:\15s3113.exe79⤵PID:240
-
\??\c:\4ih7u.exec:\4ih7u.exe80⤵PID:2848
-
\??\c:\gcj92.exec:\gcj92.exe81⤵PID:4364
-
\??\c:\pmjb31a.exec:\pmjb31a.exe82⤵PID:1960
-
\??\c:\ks7cb35.exec:\ks7cb35.exe83⤵PID:3196
-
\??\c:\2q31997.exec:\2q31997.exe84⤵PID:4132
-
\??\c:\ewgaems.exec:\ewgaems.exe85⤵PID:2472
-
\??\c:\7170un3.exec:\7170un3.exe86⤵PID:3696
-
\??\c:\48ts92.exec:\48ts92.exe87⤵PID:4864
-
\??\c:\go4a359.exec:\go4a359.exe88⤵PID:3376
-
\??\c:\50m6sg9.exec:\50m6sg9.exe89⤵PID:4592
-
\??\c:\2aomi7.exec:\2aomi7.exe90⤵PID:3940
-
\??\c:\qu143.exec:\qu143.exe91⤵PID:3996
-
\??\c:\12cp1c.exec:\12cp1c.exe92⤵PID:208
-
\??\c:\4if5ej5.exec:\4if5ej5.exe93⤵PID:1796
-
\??\c:\4agka54.exec:\4agka54.exe94⤵PID:4584
-
\??\c:\92955w.exec:\92955w.exe95⤵PID:2132
-
\??\c:\268n3l.exec:\268n3l.exe96⤵PID:3352
-
\??\c:\6iv9ix.exec:\6iv9ix.exe97⤵PID:3068
-
\??\c:\wa38q.exec:\wa38q.exe98⤵PID:3608
-
\??\c:\awp36s.exec:\awp36s.exe99⤵PID:3808
-
\??\c:\50c3a9.exec:\50c3a9.exe100⤵PID:1944
-
\??\c:\l94q71.exec:\l94q71.exe101⤵PID:3408
-
\??\c:\x9a7k15.exec:\x9a7k15.exe102⤵PID:4788
-
\??\c:\27cps.exec:\27cps.exe103⤵PID:4260
-
\??\c:\4x30u3.exec:\4x30u3.exe104⤵PID:576
-
\??\c:\39570b.exec:\39570b.exe105⤵PID:1292
-
\??\c:\793s75.exec:\793s75.exe106⤵PID:5040
-
\??\c:\79u79.exec:\79u79.exe107⤵PID:968
-
\??\c:\75k70m.exec:\75k70m.exe108⤵PID:1496
-
\??\c:\33w9h.exec:\33w9h.exe109⤵PID:3328
-
\??\c:\0ij3k52.exec:\0ij3k52.exe110⤵PID:3592
-
\??\c:\112864.exec:\112864.exe111⤵PID:3044
-
\??\c:\89wnw.exec:\89wnw.exe112⤵PID:3268
-
\??\c:\63559.exec:\63559.exe113⤵PID:2788
-
\??\c:\8k530ud.exec:\8k530ud.exe114⤵PID:2568
-
\??\c:\2u9os.exec:\2u9os.exe115⤵PID:3828
-
\??\c:\a36ge.exec:\a36ge.exe116⤵PID:4912
-
\??\c:\cp91io1.exec:\cp91io1.exe117⤵PID:868
-
\??\c:\4x21tf.exec:\4x21tf.exe118⤵PID:4456
-
\??\c:\0k7p75w.exec:\0k7p75w.exe119⤵PID:700
-
\??\c:\2s3g1.exec:\2s3g1.exe120⤵PID:216
-
\??\c:\3ni3gj1.exec:\3ni3gj1.exe121⤵PID:2108
-
\??\c:\7wms61k.exec:\7wms61k.exe122⤵PID:3020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-