Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 10:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3a5de6255ae960ed29c14c0924ca87f0_NEAS.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
3a5de6255ae960ed29c14c0924ca87f0_NEAS.exe
-
Size
94KB
-
MD5
3a5de6255ae960ed29c14c0924ca87f0
-
SHA1
9392d956da003dc060ac29d8012c52720098f348
-
SHA256
b51227b96f5473e837eed4127e5a90a5c396d8866d876db50a89761928e6fe27
-
SHA512
c947785c7f4a8d9f0064acf896b4c9752349fc0578ed8442d5300fdaf45e01062a2e8401a60d797d4c8e2f4e3d09bc86782ad2aee3cf94443e400c73fdad5434
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JxJAg8dtc:ymb3NkkiQ3mdBjFIWeFGyAsJAg2c
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4640-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1096-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-40-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4064-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2512-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3408 rffxxlf.exe 1096 bhhhht.exe 1488 bhtttn.exe 3636 ddppd.exe 3644 vjpjv.exe 4064 flrrrxx.exe 2204 3dppv.exe 2560 rlrrxfl.exe 880 3rxrxlf.exe 4812 ttnhnn.exe 2756 7xffxff.exe 4776 tnhbhb.exe 2276 bnhbtt.exe 4888 ddjjj.exe 2840 lfrlfxx.exe 376 3ttthh.exe 528 vvjpp.exe 2620 xlrxlxl.exe 2236 xlllffx.exe 2512 hbtnhb.exe 1764 7vdvp.exe 4112 xxrlfxr.exe 4388 1bbbtn.exe 4808 1nhhtb.exe 3136 jdpjd.exe 764 1jddv.exe 2752 fflfrrl.exe 4444 hbnhnh.exe 3984 vppjv.exe 3556 dppjv.exe 508 3flrlfx.exe 3264 nhhbnn.exe 3608 1vdvd.exe 1112 frxrllf.exe 3904 rxxrrll.exe 2628 nntnnh.exe 4092 dvdvj.exe 1428 djjdv.exe 4100 rfxlrfl.exe 4364 7hhtbt.exe 3780 hthbtb.exe 4040 vdjjj.exe 3868 pvdpv.exe 3932 lfxlfxx.exe 3032 nhnhbt.exe 2520 9jjjv.exe 4064 5dpdp.exe 4532 xlrlfxx.exe 4088 lrrrllf.exe 2068 1nhbtn.exe 4352 djppj.exe 4188 vjjdv.exe 4516 9llfxxr.exe 5024 llrrffx.exe 448 tbhhbb.exe 2720 ntnnbb.exe 2156 dppdd.exe 372 vvvpj.exe 1920 rlffxxl.exe 2516 nbbtnh.exe 3848 hnhnht.exe 5092 pjppp.exe 3212 ffxxlrl.exe 4424 xrlfrrl.exe -
resource yara_rule behavioral2/memory/4640-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1096-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2512-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4640 wrote to memory of 3408 4640 3a5de6255ae960ed29c14c0924ca87f0_NEAS.exe 85 PID 4640 wrote to memory of 3408 4640 3a5de6255ae960ed29c14c0924ca87f0_NEAS.exe 85 PID 4640 wrote to memory of 3408 4640 3a5de6255ae960ed29c14c0924ca87f0_NEAS.exe 85 PID 3408 wrote to memory of 1096 3408 rffxxlf.exe 86 PID 3408 wrote to memory of 1096 3408 rffxxlf.exe 86 PID 3408 wrote to memory of 1096 3408 rffxxlf.exe 86 PID 1096 wrote to memory of 1488 1096 bhhhht.exe 87 PID 1096 wrote to memory of 1488 1096 bhhhht.exe 87 PID 1096 wrote to memory of 1488 1096 bhhhht.exe 87 PID 1488 wrote to memory of 3636 1488 bhtttn.exe 88 PID 1488 wrote to memory of 3636 1488 bhtttn.exe 88 PID 1488 wrote to memory of 3636 1488 bhtttn.exe 88 PID 3636 wrote to memory of 3644 3636 ddppd.exe 89 PID 3636 wrote to memory of 3644 3636 ddppd.exe 89 PID 3636 wrote to memory of 3644 3636 ddppd.exe 89 PID 3644 wrote to memory of 4064 3644 vjpjv.exe 90 PID 3644 wrote to memory of 4064 3644 vjpjv.exe 90 PID 3644 wrote to memory of 4064 3644 vjpjv.exe 90 PID 4064 wrote to memory of 2204 4064 flrrrxx.exe 91 PID 4064 wrote to memory of 2204 4064 flrrrxx.exe 91 PID 4064 wrote to memory of 2204 4064 flrrrxx.exe 91 PID 2204 wrote to memory of 2560 2204 3dppv.exe 92 PID 2204 wrote to memory of 2560 2204 3dppv.exe 92 PID 2204 wrote to memory of 2560 2204 3dppv.exe 92 PID 2560 wrote to memory of 880 2560 rlrrxfl.exe 93 PID 2560 wrote to memory of 880 2560 rlrrxfl.exe 93 PID 2560 wrote to memory of 880 2560 rlrrxfl.exe 93 PID 880 wrote to memory of 4812 880 3rxrxlf.exe 94 PID 880 wrote to memory of 4812 880 3rxrxlf.exe 94 PID 880 wrote to memory of 4812 880 3rxrxlf.exe 94 PID 4812 wrote to memory of 2756 4812 ttnhnn.exe 95 PID 4812 wrote to memory of 2756 4812 ttnhnn.exe 95 PID 4812 wrote to memory of 2756 4812 ttnhnn.exe 95 PID 2756 wrote to memory of 4776 2756 7xffxff.exe 96 PID 2756 wrote to memory of 4776 2756 7xffxff.exe 96 PID 2756 wrote to memory of 4776 2756 7xffxff.exe 96 PID 4776 wrote to memory of 2276 4776 tnhbhb.exe 97 PID 4776 wrote to memory of 2276 4776 tnhbhb.exe 97 PID 4776 wrote to memory of 2276 4776 tnhbhb.exe 97 PID 2276 wrote to memory of 4888 2276 bnhbtt.exe 98 PID 2276 wrote to memory of 4888 2276 bnhbtt.exe 98 PID 2276 wrote to memory of 4888 2276 bnhbtt.exe 98 PID 4888 wrote to memory of 2840 4888 ddjjj.exe 99 PID 4888 wrote to memory of 2840 4888 ddjjj.exe 99 PID 4888 wrote to memory of 2840 4888 ddjjj.exe 99 PID 2840 wrote to memory of 376 2840 lfrlfxx.exe 100 PID 2840 wrote to memory of 376 2840 lfrlfxx.exe 100 PID 2840 wrote to memory of 376 2840 lfrlfxx.exe 100 PID 376 wrote to memory of 528 376 3ttthh.exe 101 PID 376 wrote to memory of 528 376 3ttthh.exe 101 PID 376 wrote to memory of 528 376 3ttthh.exe 101 PID 528 wrote to memory of 2620 528 vvjpp.exe 102 PID 528 wrote to memory of 2620 528 vvjpp.exe 102 PID 528 wrote to memory of 2620 528 vvjpp.exe 102 PID 2620 wrote to memory of 2236 2620 xlrxlxl.exe 103 PID 2620 wrote to memory of 2236 2620 xlrxlxl.exe 103 PID 2620 wrote to memory of 2236 2620 xlrxlxl.exe 103 PID 2236 wrote to memory of 2512 2236 xlllffx.exe 104 PID 2236 wrote to memory of 2512 2236 xlllffx.exe 104 PID 2236 wrote to memory of 2512 2236 xlllffx.exe 104 PID 2512 wrote to memory of 1764 2512 hbtnhb.exe 105 PID 2512 wrote to memory of 1764 2512 hbtnhb.exe 105 PID 2512 wrote to memory of 1764 2512 hbtnhb.exe 105 PID 1764 wrote to memory of 4112 1764 7vdvp.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a5de6255ae960ed29c14c0924ca87f0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\3a5de6255ae960ed29c14c0924ca87f0_NEAS.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\rffxxlf.exec:\rffxxlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\bhhhht.exec:\bhhhht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\bhtttn.exec:\bhtttn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\ddppd.exec:\ddppd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\vjpjv.exec:\vjpjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\flrrrxx.exec:\flrrrxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\3dppv.exec:\3dppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\rlrrxfl.exec:\rlrrxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\3rxrxlf.exec:\3rxrxlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\ttnhnn.exec:\ttnhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\7xffxff.exec:\7xffxff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\tnhbhb.exec:\tnhbhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\bnhbtt.exec:\bnhbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\ddjjj.exec:\ddjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\lfrlfxx.exec:\lfrlfxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\3ttthh.exec:\3ttthh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\vvjpp.exec:\vvjpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\xlrxlxl.exec:\xlrxlxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xlllffx.exec:\xlllffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\hbtnhb.exec:\hbtnhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\7vdvp.exec:\7vdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\xxrlfxr.exec:\xxrlfxr.exe23⤵
- Executes dropped EXE
PID:4112 -
\??\c:\1bbbtn.exec:\1bbbtn.exe24⤵
- Executes dropped EXE
PID:4388 -
\??\c:\1nhhtb.exec:\1nhhtb.exe25⤵
- Executes dropped EXE
PID:4808 -
\??\c:\jdpjd.exec:\jdpjd.exe26⤵
- Executes dropped EXE
PID:3136 -
\??\c:\1jddv.exec:\1jddv.exe27⤵
- Executes dropped EXE
PID:764 -
\??\c:\fflfrrl.exec:\fflfrrl.exe28⤵
- Executes dropped EXE
PID:2752 -
\??\c:\hbnhnh.exec:\hbnhnh.exe29⤵
- Executes dropped EXE
PID:4444 -
\??\c:\vppjv.exec:\vppjv.exe30⤵
- Executes dropped EXE
PID:3984 -
\??\c:\dppjv.exec:\dppjv.exe31⤵
- Executes dropped EXE
PID:3556 -
\??\c:\3flrlfx.exec:\3flrlfx.exe32⤵
- Executes dropped EXE
PID:508 -
\??\c:\nhhbnn.exec:\nhhbnn.exe33⤵
- Executes dropped EXE
PID:3264 -
\??\c:\1vdvd.exec:\1vdvd.exe34⤵
- Executes dropped EXE
PID:3608 -
\??\c:\frxrllf.exec:\frxrllf.exe35⤵
- Executes dropped EXE
PID:1112 -
\??\c:\rxxrrll.exec:\rxxrrll.exe36⤵
- Executes dropped EXE
PID:3904 -
\??\c:\nntnnh.exec:\nntnnh.exe37⤵
- Executes dropped EXE
PID:2628 -
\??\c:\dvdvj.exec:\dvdvj.exe38⤵
- Executes dropped EXE
PID:4092 -
\??\c:\djjdv.exec:\djjdv.exe39⤵
- Executes dropped EXE
PID:1428 -
\??\c:\rfxlrfl.exec:\rfxlrfl.exe40⤵
- Executes dropped EXE
PID:4100 -
\??\c:\7hhtbt.exec:\7hhtbt.exe41⤵
- Executes dropped EXE
PID:4364 -
\??\c:\hthbtb.exec:\hthbtb.exe42⤵
- Executes dropped EXE
PID:3780 -
\??\c:\vdjjj.exec:\vdjjj.exe43⤵
- Executes dropped EXE
PID:4040 -
\??\c:\pvdpv.exec:\pvdpv.exe44⤵
- Executes dropped EXE
PID:3868 -
\??\c:\lfxlfxx.exec:\lfxlfxx.exe45⤵
- Executes dropped EXE
PID:3932 -
\??\c:\nhnhbt.exec:\nhnhbt.exe46⤵
- Executes dropped EXE
PID:3032 -
\??\c:\9jjjv.exec:\9jjjv.exe47⤵
- Executes dropped EXE
PID:2520 -
\??\c:\5dpdp.exec:\5dpdp.exe48⤵
- Executes dropped EXE
PID:4064 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe49⤵
- Executes dropped EXE
PID:4532 -
\??\c:\lrrrllf.exec:\lrrrllf.exe50⤵
- Executes dropped EXE
PID:4088 -
\??\c:\1nhbtn.exec:\1nhbtn.exe51⤵
- Executes dropped EXE
PID:2068 -
\??\c:\djppj.exec:\djppj.exe52⤵
- Executes dropped EXE
PID:4352 -
\??\c:\vjjdv.exec:\vjjdv.exe53⤵
- Executes dropped EXE
PID:4188 -
\??\c:\9llfxxr.exec:\9llfxxr.exe54⤵
- Executes dropped EXE
PID:4516 -
\??\c:\llrrffx.exec:\llrrffx.exe55⤵
- Executes dropped EXE
PID:5024 -
\??\c:\tbhhbb.exec:\tbhhbb.exe56⤵
- Executes dropped EXE
PID:448 -
\??\c:\ntnnbb.exec:\ntnnbb.exe57⤵
- Executes dropped EXE
PID:2720 -
\??\c:\dppdd.exec:\dppdd.exe58⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vvvpj.exec:\vvvpj.exe59⤵
- Executes dropped EXE
PID:372 -
\??\c:\rlffxxl.exec:\rlffxxl.exe60⤵
- Executes dropped EXE
PID:1920 -
\??\c:\nbbtnh.exec:\nbbtnh.exe61⤵
- Executes dropped EXE
PID:2516 -
\??\c:\hnhnht.exec:\hnhnht.exe62⤵
- Executes dropped EXE
PID:3848 -
\??\c:\pjppp.exec:\pjppp.exe63⤵
- Executes dropped EXE
PID:5092 -
\??\c:\ffxxlrl.exec:\ffxxlrl.exe64⤵
- Executes dropped EXE
PID:3212 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe65⤵
- Executes dropped EXE
PID:4424 -
\??\c:\hhnhbt.exec:\hhnhbt.exe66⤵PID:3972
-
\??\c:\bbtnbb.exec:\bbtnbb.exe67⤵PID:2500
-
\??\c:\vvddv.exec:\vvddv.exe68⤵PID:1824
-
\??\c:\lfxrrll.exec:\lfxrrll.exe69⤵PID:4276
-
\??\c:\rfxfxxr.exec:\rfxfxxr.exe70⤵PID:864
-
\??\c:\bhhbhh.exec:\bhhbhh.exe71⤵PID:2568
-
\??\c:\bbnhtt.exec:\bbnhtt.exe72⤵PID:2280
-
\??\c:\pjpvj.exec:\pjpvj.exe73⤵PID:3520
-
\??\c:\vvvpj.exec:\vvvpj.exe74⤵PID:3688
-
\??\c:\lfrrllf.exec:\lfrrllf.exe75⤵PID:4596
-
\??\c:\rrrrfxl.exec:\rrrrfxl.exe76⤵PID:3068
-
\??\c:\hhhbtn.exec:\hhhbtn.exe77⤵PID:3556
-
\??\c:\bhtnbb.exec:\bhtnbb.exe78⤵PID:3768
-
\??\c:\vddpj.exec:\vddpj.exe79⤵PID:620
-
\??\c:\rflxrlf.exec:\rflxrlf.exe80⤵PID:3632
-
\??\c:\tntntn.exec:\tntntn.exe81⤵PID:4396
-
\??\c:\vjjdv.exec:\vjjdv.exe82⤵PID:4764
-
\??\c:\ppvvp.exec:\ppvvp.exe83⤵PID:540
-
\??\c:\rrlfxff.exec:\rrlfxff.exe84⤵PID:1760
-
\??\c:\9lrlffx.exec:\9lrlffx.exe85⤵PID:828
-
\??\c:\bhnhtt.exec:\bhnhtt.exe86⤵PID:4452
-
\??\c:\jdjdv.exec:\jdjdv.exe87⤵PID:4844
-
\??\c:\xxxrffx.exec:\xxxrffx.exe88⤵PID:3460
-
\??\c:\5rlxxxr.exec:\5rlxxxr.exe89⤵PID:4368
-
\??\c:\btnnhh.exec:\btnnhh.exe90⤵PID:4040
-
\??\c:\9vvvp.exec:\9vvvp.exe91⤵PID:1040
-
\??\c:\xflfxxr.exec:\xflfxxr.exe92⤵PID:2764
-
\??\c:\lrxlllf.exec:\lrxlllf.exe93⤵PID:2108
-
\??\c:\htbhhb.exec:\htbhhb.exe94⤵PID:2740
-
\??\c:\3vpjv.exec:\3vpjv.exe95⤵PID:5064
-
\??\c:\jvvpd.exec:\jvvpd.exe96⤵PID:4116
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe97⤵PID:3540
-
\??\c:\rfflxxx.exec:\rfflxxx.exe98⤵PID:2456
-
\??\c:\bhhtnh.exec:\bhhtnh.exe99⤵PID:1496
-
\??\c:\jpdvp.exec:\jpdvp.exe100⤵PID:3100
-
\??\c:\9vjdd.exec:\9vjdd.exe101⤵PID:616
-
\??\c:\dpdvd.exec:\dpdvd.exe102⤵PID:4348
-
\??\c:\fffxxxx.exec:\fffxxxx.exe103⤵PID:4692
-
\??\c:\llfxfxl.exec:\llfxfxl.exe104⤵PID:3620
-
\??\c:\bhnhhh.exec:\bhnhhh.exe105⤵PID:3908
-
\??\c:\bbbtnn.exec:\bbbtnn.exe106⤵PID:5032
-
\??\c:\ddvvp.exec:\ddvvp.exe107⤵PID:1920
-
\??\c:\jjdvj.exec:\jjdvj.exe108⤵PID:3528
-
\??\c:\lrxxlll.exec:\lrxxlll.exe109⤵PID:1472
-
\??\c:\7rrlxxl.exec:\7rrlxxl.exe110⤵PID:1828
-
\??\c:\tnbbbb.exec:\tnbbbb.exe111⤵PID:2324
-
\??\c:\nbhhnt.exec:\nbhhnt.exe112⤵PID:1764
-
\??\c:\vjppv.exec:\vjppv.exe113⤵PID:1756
-
\??\c:\vjjdp.exec:\vjjdp.exe114⤵PID:4112
-
\??\c:\rxxrrll.exec:\rxxrrll.exe115⤵PID:4748
-
\??\c:\lllllxl.exec:\lllllxl.exe116⤵PID:1976
-
\??\c:\htbttt.exec:\htbttt.exe117⤵PID:1676
-
\??\c:\bhhbtb.exec:\bhhbtb.exe118⤵PID:4536
-
\??\c:\pjppd.exec:\pjppd.exe119⤵PID:1252
-
\??\c:\pdvdp.exec:\pdvdp.exe120⤵PID:3948
-
\??\c:\rfrlxrr.exec:\rfrlxrr.exe121⤵PID:684
-
\??\c:\hbhhbb.exec:\hbhhbb.exe122⤵PID:3092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-