Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 10:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3a5de6255ae960ed29c14c0924ca87f0_NEAS.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
3a5de6255ae960ed29c14c0924ca87f0_NEAS.exe
-
Size
94KB
-
MD5
3a5de6255ae960ed29c14c0924ca87f0
-
SHA1
9392d956da003dc060ac29d8012c52720098f348
-
SHA256
b51227b96f5473e837eed4127e5a90a5c396d8866d876db50a89761928e6fe27
-
SHA512
c947785c7f4a8d9f0064acf896b4c9752349fc0578ed8442d5300fdaf45e01062a2e8401a60d797d4c8e2f4e3d09bc86782ad2aee3cf94443e400c73fdad5434
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JxJAg8dtc:ymb3NkkiQ3mdBjFIWeFGyAsJAg2c
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2572-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/280-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1192-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1560-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/940-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/900-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2572 flrrrll.exe 2648 bbhhth.exe 2692 1dvvv.exe 2592 xlxrrrf.exe 2596 rrlxxlr.exe 2448 nhbnht.exe 2480 1pjpv.exe 2344 pjvdj.exe 280 jdppv.exe 1192 xrrrfll.exe 1616 bttttb.exe 2148 thtbbh.exe 1560 3pdjj.exe 1620 1jvjp.exe 1972 xrflllx.exe 1248 7xxfrrr.exe 2824 bnbtbt.exe 2060 3jpvv.exe 1964 vvdjp.exe 2712 xlrxrrx.exe 880 1xxfffl.exe 1404 1hthtn.exe 1736 vpdjp.exe 2172 1dpdd.exe 840 xrlfflf.exe 940 5lrlxxl.exe 2272 httnbt.exe 2020 1bttbh.exe 3032 dpvdj.exe 900 5lxxffl.exe 2304 1rxrxfl.exe 3068 bnbthb.exe 2572 jjvjp.exe 2536 3jdpv.exe 2588 lfrxxfl.exe 2908 nnbthh.exe 2720 tntbhh.exe 2544 jvddj.exe 2488 ppjjp.exe 2044 xrfxflx.exe 2860 rlxxfxf.exe 2480 tnntbb.exe 568 9hhnnh.exe 2164 jppdd.exe 1144 vpjjj.exe 284 xlflllx.exe 1792 nbnhhn.exe 2324 btbhhb.exe 1556 vjpjp.exe 1888 9pvjp.exe 1256 rrxxrrr.exe 1180 lxxflll.exe 2520 tbhbbn.exe 2412 nbbhnt.exe 2140 9vdpv.exe 2036 5pddd.exe 1964 frlrrll.exe 1424 rfxxxxf.exe 488 thbhbt.exe 1816 1hbntt.exe 2392 jjjdd.exe 328 jpvjd.exe 2172 frxrllx.exe 2220 xlrxlfl.exe -
resource yara_rule behavioral1/memory/2200-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/280-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1192-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1560-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/940-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/900-292-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2200 wrote to memory of 2572 2200 3a5de6255ae960ed29c14c0924ca87f0_NEAS.exe 28 PID 2200 wrote to memory of 2572 2200 3a5de6255ae960ed29c14c0924ca87f0_NEAS.exe 28 PID 2200 wrote to memory of 2572 2200 3a5de6255ae960ed29c14c0924ca87f0_NEAS.exe 28 PID 2200 wrote to memory of 2572 2200 3a5de6255ae960ed29c14c0924ca87f0_NEAS.exe 28 PID 2572 wrote to memory of 2648 2572 flrrrll.exe 29 PID 2572 wrote to memory of 2648 2572 flrrrll.exe 29 PID 2572 wrote to memory of 2648 2572 flrrrll.exe 29 PID 2572 wrote to memory of 2648 2572 flrrrll.exe 29 PID 2648 wrote to memory of 2692 2648 bbhhth.exe 30 PID 2648 wrote to memory of 2692 2648 bbhhth.exe 30 PID 2648 wrote to memory of 2692 2648 bbhhth.exe 30 PID 2648 wrote to memory of 2692 2648 bbhhth.exe 30 PID 2692 wrote to memory of 2592 2692 1dvvv.exe 31 PID 2692 wrote to memory of 2592 2692 1dvvv.exe 31 PID 2692 wrote to memory of 2592 2692 1dvvv.exe 31 PID 2692 wrote to memory of 2592 2692 1dvvv.exe 31 PID 2592 wrote to memory of 2596 2592 xlxrrrf.exe 32 PID 2592 wrote to memory of 2596 2592 xlxrrrf.exe 32 PID 2592 wrote to memory of 2596 2592 xlxrrrf.exe 32 PID 2592 wrote to memory of 2596 2592 xlxrrrf.exe 32 PID 2596 wrote to memory of 2448 2596 rrlxxlr.exe 33 PID 2596 wrote to memory of 2448 2596 rrlxxlr.exe 33 PID 2596 wrote to memory of 2448 2596 rrlxxlr.exe 33 PID 2596 wrote to memory of 2448 2596 rrlxxlr.exe 33 PID 2448 wrote to memory of 2480 2448 nhbnht.exe 34 PID 2448 wrote to memory of 2480 2448 nhbnht.exe 34 PID 2448 wrote to memory of 2480 2448 nhbnht.exe 34 PID 2448 wrote to memory of 2480 2448 nhbnht.exe 34 PID 2480 wrote to memory of 2344 2480 1pjpv.exe 35 PID 2480 wrote to memory of 2344 2480 1pjpv.exe 35 PID 2480 wrote to memory of 2344 2480 1pjpv.exe 35 PID 2480 wrote to memory of 2344 2480 1pjpv.exe 35 PID 2344 wrote to memory of 280 2344 pjvdj.exe 36 PID 2344 wrote to memory of 280 2344 pjvdj.exe 36 PID 2344 wrote to memory of 280 2344 pjvdj.exe 36 PID 2344 wrote to memory of 280 2344 pjvdj.exe 36 PID 280 wrote to memory of 1192 280 jdppv.exe 37 PID 280 wrote to memory of 1192 280 jdppv.exe 37 PID 280 wrote to memory of 1192 280 jdppv.exe 37 PID 280 wrote to memory of 1192 280 jdppv.exe 37 PID 1192 wrote to memory of 1616 1192 xrrrfll.exe 38 PID 1192 wrote to memory of 1616 1192 xrrrfll.exe 38 PID 1192 wrote to memory of 1616 1192 xrrrfll.exe 38 PID 1192 wrote to memory of 1616 1192 xrrrfll.exe 38 PID 1616 wrote to memory of 2148 1616 bttttb.exe 39 PID 1616 wrote to memory of 2148 1616 bttttb.exe 39 PID 1616 wrote to memory of 2148 1616 bttttb.exe 39 PID 1616 wrote to memory of 2148 1616 bttttb.exe 39 PID 2148 wrote to memory of 1560 2148 thtbbh.exe 40 PID 2148 wrote to memory of 1560 2148 thtbbh.exe 40 PID 2148 wrote to memory of 1560 2148 thtbbh.exe 40 PID 2148 wrote to memory of 1560 2148 thtbbh.exe 40 PID 1560 wrote to memory of 1620 1560 3pdjj.exe 41 PID 1560 wrote to memory of 1620 1560 3pdjj.exe 41 PID 1560 wrote to memory of 1620 1560 3pdjj.exe 41 PID 1560 wrote to memory of 1620 1560 3pdjj.exe 41 PID 1620 wrote to memory of 1972 1620 1jvjp.exe 42 PID 1620 wrote to memory of 1972 1620 1jvjp.exe 42 PID 1620 wrote to memory of 1972 1620 1jvjp.exe 42 PID 1620 wrote to memory of 1972 1620 1jvjp.exe 42 PID 1972 wrote to memory of 1248 1972 xrflllx.exe 43 PID 1972 wrote to memory of 1248 1972 xrflllx.exe 43 PID 1972 wrote to memory of 1248 1972 xrflllx.exe 43 PID 1972 wrote to memory of 1248 1972 xrflllx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a5de6255ae960ed29c14c0924ca87f0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\3a5de6255ae960ed29c14c0924ca87f0_NEAS.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\flrrrll.exec:\flrrrll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\bbhhth.exec:\bbhhth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\1dvvv.exec:\1dvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\xlxrrrf.exec:\xlxrrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rrlxxlr.exec:\rrlxxlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\nhbnht.exec:\nhbnht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\1pjpv.exec:\1pjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\pjvdj.exec:\pjvdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\jdppv.exec:\jdppv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:280 -
\??\c:\xrrrfll.exec:\xrrrfll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\bttttb.exec:\bttttb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\thtbbh.exec:\thtbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\3pdjj.exec:\3pdjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\1jvjp.exec:\1jvjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\xrflllx.exec:\xrflllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\7xxfrrr.exec:\7xxfrrr.exe17⤵
- Executes dropped EXE
PID:1248 -
\??\c:\bnbtbt.exec:\bnbtbt.exe18⤵
- Executes dropped EXE
PID:2824 -
\??\c:\3jpvv.exec:\3jpvv.exe19⤵
- Executes dropped EXE
PID:2060 -
\??\c:\vvdjp.exec:\vvdjp.exe20⤵
- Executes dropped EXE
PID:1964 -
\??\c:\xlrxrrx.exec:\xlrxrrx.exe21⤵
- Executes dropped EXE
PID:2712 -
\??\c:\1xxfffl.exec:\1xxfffl.exe22⤵
- Executes dropped EXE
PID:880 -
\??\c:\1hthtn.exec:\1hthtn.exe23⤵
- Executes dropped EXE
PID:1404 -
\??\c:\vpdjp.exec:\vpdjp.exe24⤵
- Executes dropped EXE
PID:1736 -
\??\c:\1dpdd.exec:\1dpdd.exe25⤵
- Executes dropped EXE
PID:2172 -
\??\c:\xrlfflf.exec:\xrlfflf.exe26⤵
- Executes dropped EXE
PID:840 -
\??\c:\5lrlxxl.exec:\5lrlxxl.exe27⤵
- Executes dropped EXE
PID:940 -
\??\c:\httnbt.exec:\httnbt.exe28⤵
- Executes dropped EXE
PID:2272 -
\??\c:\1bttbh.exec:\1bttbh.exe29⤵
- Executes dropped EXE
PID:2020 -
\??\c:\dpvdj.exec:\dpvdj.exe30⤵
- Executes dropped EXE
PID:3032 -
\??\c:\5lxxffl.exec:\5lxxffl.exe31⤵
- Executes dropped EXE
PID:900 -
\??\c:\1rxrxfl.exec:\1rxrxfl.exe32⤵
- Executes dropped EXE
PID:2304 -
\??\c:\bnbthb.exec:\bnbthb.exe33⤵
- Executes dropped EXE
PID:3068 -
\??\c:\jjvjp.exec:\jjvjp.exe34⤵
- Executes dropped EXE
PID:2572 -
\??\c:\3jdpv.exec:\3jdpv.exe35⤵
- Executes dropped EXE
PID:2536 -
\??\c:\lfrxxfl.exec:\lfrxxfl.exe36⤵
- Executes dropped EXE
PID:2588 -
\??\c:\nnbthh.exec:\nnbthh.exe37⤵
- Executes dropped EXE
PID:2908 -
\??\c:\tntbhh.exec:\tntbhh.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\jvddj.exec:\jvddj.exe39⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ppjjp.exec:\ppjjp.exe40⤵
- Executes dropped EXE
PID:2488 -
\??\c:\xrfxflx.exec:\xrfxflx.exe41⤵
- Executes dropped EXE
PID:2044 -
\??\c:\rlxxfxf.exec:\rlxxfxf.exe42⤵
- Executes dropped EXE
PID:2860 -
\??\c:\tnntbb.exec:\tnntbb.exe43⤵
- Executes dropped EXE
PID:2480 -
\??\c:\9hhnnh.exec:\9hhnnh.exe44⤵
- Executes dropped EXE
PID:568 -
\??\c:\jppdd.exec:\jppdd.exe45⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vpjjj.exec:\vpjjj.exe46⤵
- Executes dropped EXE
PID:1144 -
\??\c:\xlflllx.exec:\xlflllx.exe47⤵
- Executes dropped EXE
PID:284 -
\??\c:\nbnhhn.exec:\nbnhhn.exe48⤵
- Executes dropped EXE
PID:1792 -
\??\c:\btbhhb.exec:\btbhhb.exe49⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vjpjp.exec:\vjpjp.exe50⤵
- Executes dropped EXE
PID:1556 -
\??\c:\9pvjp.exec:\9pvjp.exe51⤵
- Executes dropped EXE
PID:1888 -
\??\c:\rrxxrrr.exec:\rrxxrrr.exe52⤵
- Executes dropped EXE
PID:1256 -
\??\c:\lxxflll.exec:\lxxflll.exe53⤵
- Executes dropped EXE
PID:1180 -
\??\c:\tbhbbn.exec:\tbhbbn.exe54⤵
- Executes dropped EXE
PID:2520 -
\??\c:\nbbhnt.exec:\nbbhnt.exe55⤵
- Executes dropped EXE
PID:2412 -
\??\c:\9vdpv.exec:\9vdpv.exe56⤵
- Executes dropped EXE
PID:2140 -
\??\c:\5pddd.exec:\5pddd.exe57⤵
- Executes dropped EXE
PID:2036 -
\??\c:\frlrrll.exec:\frlrrll.exe58⤵
- Executes dropped EXE
PID:1964 -
\??\c:\rfxxxxf.exec:\rfxxxxf.exe59⤵
- Executes dropped EXE
PID:1424 -
\??\c:\thbhbt.exec:\thbhbt.exe60⤵
- Executes dropped EXE
PID:488 -
\??\c:\1hbntt.exec:\1hbntt.exe61⤵
- Executes dropped EXE
PID:1816 -
\??\c:\jjjdd.exec:\jjjdd.exe62⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jpvjd.exec:\jpvjd.exe63⤵
- Executes dropped EXE
PID:328 -
\??\c:\frxrllx.exec:\frxrllx.exe64⤵
- Executes dropped EXE
PID:2172 -
\??\c:\xlrxlfl.exec:\xlrxlfl.exe65⤵
- Executes dropped EXE
PID:2220 -
\??\c:\5bhbnh.exec:\5bhbnh.exe66⤵PID:2916
-
\??\c:\bnhthh.exec:\bnhthh.exe67⤵PID:1640
-
\??\c:\7pvdd.exec:\7pvdd.exe68⤵PID:1784
-
\??\c:\vddvp.exec:\vddvp.exe69⤵PID:2924
-
\??\c:\rxrllfl.exec:\rxrllfl.exe70⤵PID:1684
-
\??\c:\lrxffff.exec:\lrxffff.exe71⤵PID:1992
-
\??\c:\xflxfll.exec:\xflxfll.exe72⤵PID:2376
-
\??\c:\htttnh.exec:\htttnh.exe73⤵PID:2072
-
\??\c:\nbbtbt.exec:\nbbtbt.exe74⤵PID:2016
-
\??\c:\htbtnb.exec:\htbtnb.exe75⤵PID:2620
-
\??\c:\dpvvj.exec:\dpvvj.exe76⤵PID:2632
-
\??\c:\djjdd.exec:\djjdd.exe77⤵PID:2932
-
\??\c:\rflffxf.exec:\rflffxf.exe78⤵PID:2724
-
\??\c:\xlrlrff.exec:\xlrlrff.exe79⤵PID:2604
-
\??\c:\5lxxxrr.exec:\5lxxxrr.exe80⤵PID:2428
-
\??\c:\nbthtn.exec:\nbthtn.exe81⤵PID:2504
-
\??\c:\7tbttn.exec:\7tbttn.exe82⤵PID:2460
-
\??\c:\1pvpd.exec:\1pvpd.exe83⤵PID:2160
-
\??\c:\vpjpp.exec:\vpjpp.exe84⤵PID:2312
-
\??\c:\lffxxxr.exec:\lffxxxr.exe85⤵PID:1884
-
\??\c:\xfxrxxx.exec:\xfxrxxx.exe86⤵PID:1236
-
\??\c:\3thbbt.exec:\3thbbt.exe87⤵PID:1596
-
\??\c:\nhhtbh.exec:\nhhtbh.exe88⤵PID:1616
-
\??\c:\dpppv.exec:\dpppv.exe89⤵PID:1904
-
\??\c:\ppjjv.exec:\ppjjv.exe90⤵PID:2148
-
\??\c:\7jvjp.exec:\7jvjp.exe91⤵PID:1364
-
\??\c:\frfxrll.exec:\frfxrll.exe92⤵PID:2008
-
\??\c:\5xlxlxx.exec:\5xlxlxx.exe93⤵PID:1232
-
\??\c:\7nbttn.exec:\7nbttn.exe94⤵PID:1324
-
\??\c:\thnhtt.exec:\thnhtt.exe95⤵PID:2500
-
\??\c:\pvjjj.exec:\pvjjj.exe96⤵PID:1984
-
\??\c:\pvvpp.exec:\pvvpp.exe97⤵PID:1928
-
\??\c:\dpddd.exec:\dpddd.exe98⤵PID:1204
-
\??\c:\lrrllff.exec:\lrrllff.exe99⤵PID:680
-
\??\c:\1fxfrlx.exec:\1fxfrlx.exe100⤵PID:2408
-
\??\c:\bnbtbt.exec:\bnbtbt.exe101⤵PID:880
-
\??\c:\5tnntn.exec:\5tnntn.exe102⤵PID:1220
-
\??\c:\vpdvp.exec:\vpdvp.exe103⤵PID:2396
-
\??\c:\9jpjv.exec:\9jpjv.exe104⤵PID:452
-
\??\c:\9djpp.exec:\9djpp.exe105⤵PID:2960
-
\??\c:\lxxxfxf.exec:\lxxxfxf.exe106⤵PID:924
-
\??\c:\frxxfrr.exec:\frxxfrr.exe107⤵PID:1676
-
\??\c:\ttbbbn.exec:\ttbbbn.exe108⤵PID:2972
-
\??\c:\9bbbbh.exec:\9bbbbh.exe109⤵PID:1636
-
\??\c:\pdppv.exec:\pdppv.exe110⤵PID:3044
-
\??\c:\pdjdp.exec:\pdjdp.exe111⤵PID:3032
-
\??\c:\rfflrll.exec:\rfflrll.exe112⤵PID:900
-
\??\c:\3xrrrrx.exec:\3xrrrrx.exe113⤵PID:1532
-
\??\c:\rfxfxff.exec:\rfxfxff.exe114⤵PID:2912
-
\??\c:\nbhbbn.exec:\nbhbbn.exe115⤵PID:2968
-
\??\c:\1bhhbt.exec:\1bhhbt.exe116⤵PID:2580
-
\??\c:\jdvvv.exec:\jdvvv.exe117⤵PID:2684
-
\??\c:\dpvvj.exec:\dpvvj.exe118⤵PID:2732
-
\??\c:\fxlrlll.exec:\fxlrlll.exe119⤵PID:2284
-
\??\c:\xllxllr.exec:\xllxllr.exe120⤵PID:2464
-
\??\c:\thhbhb.exec:\thhbhb.exe121⤵PID:2420
-
\??\c:\7hnnbb.exec:\7hnnbb.exe122⤵PID:3060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-