Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 14:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b32243da2822ead3b36bd8bafc7072d0_NEAS.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
b32243da2822ead3b36bd8bafc7072d0_NEAS.exe
-
Size
82KB
-
MD5
b32243da2822ead3b36bd8bafc7072d0
-
SHA1
1a098c8765ea939579f10bb7138b75924adf319f
-
SHA256
9ee28a5943547a5740f75427b869e4a3bf2888df89b71bbadbbf06d9969ec28b
-
SHA512
9bca1009d3ba289957c1cfc04f3ec1501cc20f1ad99296c6deb8b1b0694c46492bb89269d8a0c2204fba6dedf907bae93ef6725cc2909b7a3904792e12be02d5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JkZPsvg:ymb3NkkiQ3mdBjFIWeFGyA9PJ
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2612-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-88-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/984-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/572-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2612 3pdpp.exe 2220 rxllxfr.exe 2552 hhbbhn.exe 2688 vjpjp.exe 3000 9fxrffx.exe 2404 rlrxllx.exe 3012 nhtbhb.exe 1988 ppjvj.exe 2620 3frxfxf.exe 2764 frxlxfr.exe 1356 hthhnt.exe 2120 tnbhnn.exe 112 vpjjv.exe 1236 jdvvv.exe 2724 rlxfrxf.exe 1004 rfrxlrr.exe 1440 bnbhhh.exe 1032 vppvp.exe 2816 dpvvd.exe 2244 5xfflfl.exe 984 xrllxff.exe 1392 bthnnt.exe 1728 3djdj.exe 628 vvpdp.exe 3056 rxflxxf.exe 1896 fxlllrx.exe 2368 7nbbbn.exe 3008 vpddj.exe 572 jjvvp.exe 1940 rrlllrx.exe 2128 5thnth.exe 2276 thnbhn.exe 2740 ddpvv.exe 1496 1vdjj.exe 2600 frxrrrx.exe 2524 5nbntb.exe 2648 1thhbb.exe 2436 dvppv.exe 2636 vjdjj.exe 1588 3jppp.exe 2432 lfrrrrx.exe 2396 rfrrlll.exe 2964 tntbtb.exe 2500 tbntbt.exe 1988 5dvpp.exe 2628 vjvdp.exe 2756 lxfllrx.exe 1928 fxrfxfx.exe 1240 3nnnbb.exe 2120 1nhnnn.exe 112 5vppp.exe 2732 xrflfxx.exe 1580 lflxlxr.exe 760 1bthtb.exe 1004 nbnbht.exe 2076 3djjd.exe 1448 7dppp.exe 2232 9rlrxxl.exe 672 rlxxrlr.exe 1400 7hhthn.exe 984 thhtbt.exe 1396 vpppv.exe 1428 vjddp.exe 1696 7lxxrxf.exe -
resource yara_rule behavioral1/memory/2356-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/984-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/572-286-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2612 2356 b32243da2822ead3b36bd8bafc7072d0_NEAS.exe 28 PID 2356 wrote to memory of 2612 2356 b32243da2822ead3b36bd8bafc7072d0_NEAS.exe 28 PID 2356 wrote to memory of 2612 2356 b32243da2822ead3b36bd8bafc7072d0_NEAS.exe 28 PID 2356 wrote to memory of 2612 2356 b32243da2822ead3b36bd8bafc7072d0_NEAS.exe 28 PID 2612 wrote to memory of 2220 2612 3pdpp.exe 29 PID 2612 wrote to memory of 2220 2612 3pdpp.exe 29 PID 2612 wrote to memory of 2220 2612 3pdpp.exe 29 PID 2612 wrote to memory of 2220 2612 3pdpp.exe 29 PID 2220 wrote to memory of 2552 2220 rxllxfr.exe 30 PID 2220 wrote to memory of 2552 2220 rxllxfr.exe 30 PID 2220 wrote to memory of 2552 2220 rxllxfr.exe 30 PID 2220 wrote to memory of 2552 2220 rxllxfr.exe 30 PID 2552 wrote to memory of 2688 2552 hhbbhn.exe 31 PID 2552 wrote to memory of 2688 2552 hhbbhn.exe 31 PID 2552 wrote to memory of 2688 2552 hhbbhn.exe 31 PID 2552 wrote to memory of 2688 2552 hhbbhn.exe 31 PID 2688 wrote to memory of 3000 2688 vjpjp.exe 32 PID 2688 wrote to memory of 3000 2688 vjpjp.exe 32 PID 2688 wrote to memory of 3000 2688 vjpjp.exe 32 PID 2688 wrote to memory of 3000 2688 vjpjp.exe 32 PID 3000 wrote to memory of 2404 3000 9fxrffx.exe 33 PID 3000 wrote to memory of 2404 3000 9fxrffx.exe 33 PID 3000 wrote to memory of 2404 3000 9fxrffx.exe 33 PID 3000 wrote to memory of 2404 3000 9fxrffx.exe 33 PID 2404 wrote to memory of 3012 2404 rlrxllx.exe 34 PID 2404 wrote to memory of 3012 2404 rlrxllx.exe 34 PID 2404 wrote to memory of 3012 2404 rlrxllx.exe 34 PID 2404 wrote to memory of 3012 2404 rlrxllx.exe 34 PID 3012 wrote to memory of 1988 3012 nhtbhb.exe 35 PID 3012 wrote to memory of 1988 3012 nhtbhb.exe 35 PID 3012 wrote to memory of 1988 3012 nhtbhb.exe 35 PID 3012 wrote to memory of 1988 3012 nhtbhb.exe 35 PID 1988 wrote to memory of 2620 1988 ppjvj.exe 36 PID 1988 wrote to memory of 2620 1988 ppjvj.exe 36 PID 1988 wrote to memory of 2620 1988 ppjvj.exe 36 PID 1988 wrote to memory of 2620 1988 ppjvj.exe 36 PID 2620 wrote to memory of 2764 2620 3frxfxf.exe 37 PID 2620 wrote to memory of 2764 2620 3frxfxf.exe 37 PID 2620 wrote to memory of 2764 2620 3frxfxf.exe 37 PID 2620 wrote to memory of 2764 2620 3frxfxf.exe 37 PID 2764 wrote to memory of 1356 2764 frxlxfr.exe 38 PID 2764 wrote to memory of 1356 2764 frxlxfr.exe 38 PID 2764 wrote to memory of 1356 2764 frxlxfr.exe 38 PID 2764 wrote to memory of 1356 2764 frxlxfr.exe 38 PID 1356 wrote to memory of 2120 1356 hthhnt.exe 39 PID 1356 wrote to memory of 2120 1356 hthhnt.exe 39 PID 1356 wrote to memory of 2120 1356 hthhnt.exe 39 PID 1356 wrote to memory of 2120 1356 hthhnt.exe 39 PID 2120 wrote to memory of 112 2120 tnbhnn.exe 40 PID 2120 wrote to memory of 112 2120 tnbhnn.exe 40 PID 2120 wrote to memory of 112 2120 tnbhnn.exe 40 PID 2120 wrote to memory of 112 2120 tnbhnn.exe 40 PID 112 wrote to memory of 1236 112 vpjjv.exe 41 PID 112 wrote to memory of 1236 112 vpjjv.exe 41 PID 112 wrote to memory of 1236 112 vpjjv.exe 41 PID 112 wrote to memory of 1236 112 vpjjv.exe 41 PID 1236 wrote to memory of 2724 1236 jdvvv.exe 42 PID 1236 wrote to memory of 2724 1236 jdvvv.exe 42 PID 1236 wrote to memory of 2724 1236 jdvvv.exe 42 PID 1236 wrote to memory of 2724 1236 jdvvv.exe 42 PID 2724 wrote to memory of 1004 2724 rlxfrxf.exe 43 PID 2724 wrote to memory of 1004 2724 rlxfrxf.exe 43 PID 2724 wrote to memory of 1004 2724 rlxfrxf.exe 43 PID 2724 wrote to memory of 1004 2724 rlxfrxf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\b32243da2822ead3b36bd8bafc7072d0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\b32243da2822ead3b36bd8bafc7072d0_NEAS.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\3pdpp.exec:\3pdpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\rxllxfr.exec:\rxllxfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\hhbbhn.exec:\hhbbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\vjpjp.exec:\vjpjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\9fxrffx.exec:\9fxrffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\rlrxllx.exec:\rlrxllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\nhtbhb.exec:\nhtbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\ppjvj.exec:\ppjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\3frxfxf.exec:\3frxfxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\frxlxfr.exec:\frxlxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\hthhnt.exec:\hthhnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\tnbhnn.exec:\tnbhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\vpjjv.exec:\vpjjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\jdvvv.exec:\jdvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\rlxfrxf.exec:\rlxfrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rfrxlrr.exec:\rfrxlrr.exe17⤵
- Executes dropped EXE
PID:1004 -
\??\c:\bnbhhh.exec:\bnbhhh.exe18⤵
- Executes dropped EXE
PID:1440 -
\??\c:\vppvp.exec:\vppvp.exe19⤵
- Executes dropped EXE
PID:1032 -
\??\c:\dpvvd.exec:\dpvvd.exe20⤵
- Executes dropped EXE
PID:2816 -
\??\c:\5xfflfl.exec:\5xfflfl.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xrllxff.exec:\xrllxff.exe22⤵
- Executes dropped EXE
PID:984 -
\??\c:\bthnnt.exec:\bthnnt.exe23⤵
- Executes dropped EXE
PID:1392 -
\??\c:\3djdj.exec:\3djdj.exe24⤵
- Executes dropped EXE
PID:1728 -
\??\c:\vvpdp.exec:\vvpdp.exe25⤵
- Executes dropped EXE
PID:628 -
\??\c:\rxflxxf.exec:\rxflxxf.exe26⤵
- Executes dropped EXE
PID:3056 -
\??\c:\fxlllrx.exec:\fxlllrx.exe27⤵
- Executes dropped EXE
PID:1896 -
\??\c:\7nbbbn.exec:\7nbbbn.exe28⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vpddj.exec:\vpddj.exe29⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jjvvp.exec:\jjvvp.exe30⤵
- Executes dropped EXE
PID:572 -
\??\c:\rrlllrx.exec:\rrlllrx.exe31⤵
- Executes dropped EXE
PID:1940 -
\??\c:\5thnth.exec:\5thnth.exe32⤵
- Executes dropped EXE
PID:2128 -
\??\c:\thnbhn.exec:\thnbhn.exe33⤵
- Executes dropped EXE
PID:2276 -
\??\c:\ddpvv.exec:\ddpvv.exe34⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1vdjj.exec:\1vdjj.exe35⤵
- Executes dropped EXE
PID:1496 -
\??\c:\frxrrrx.exec:\frxrrrx.exe36⤵
- Executes dropped EXE
PID:2600 -
\??\c:\5nbntb.exec:\5nbntb.exe37⤵
- Executes dropped EXE
PID:2524 -
\??\c:\1thhbb.exec:\1thhbb.exe38⤵
- Executes dropped EXE
PID:2648 -
\??\c:\dvppv.exec:\dvppv.exe39⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vjdjj.exec:\vjdjj.exe40⤵
- Executes dropped EXE
PID:2636 -
\??\c:\3jppp.exec:\3jppp.exe41⤵
- Executes dropped EXE
PID:1588 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe42⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rfrrlll.exec:\rfrrlll.exe43⤵
- Executes dropped EXE
PID:2396 -
\??\c:\tntbtb.exec:\tntbtb.exe44⤵
- Executes dropped EXE
PID:2964 -
\??\c:\tbntbt.exec:\tbntbt.exe45⤵
- Executes dropped EXE
PID:2500 -
\??\c:\5dvpp.exec:\5dvpp.exe46⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vjvdp.exec:\vjvdp.exe47⤵
- Executes dropped EXE
PID:2628 -
\??\c:\lxfllrx.exec:\lxfllrx.exe48⤵
- Executes dropped EXE
PID:2756 -
\??\c:\fxrfxfx.exec:\fxrfxfx.exe49⤵
- Executes dropped EXE
PID:1928 -
\??\c:\3nnnbb.exec:\3nnnbb.exe50⤵
- Executes dropped EXE
PID:1240 -
\??\c:\1nhnnn.exec:\1nhnnn.exe51⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5vppp.exec:\5vppp.exe52⤵
- Executes dropped EXE
PID:112 -
\??\c:\xrflfxx.exec:\xrflfxx.exe53⤵
- Executes dropped EXE
PID:2732 -
\??\c:\lflxlxr.exec:\lflxlxr.exe54⤵
- Executes dropped EXE
PID:1580 -
\??\c:\1bthtb.exec:\1bthtb.exe55⤵
- Executes dropped EXE
PID:760 -
\??\c:\nbnbht.exec:\nbnbht.exe56⤵
- Executes dropped EXE
PID:1004 -
\??\c:\3djjd.exec:\3djjd.exe57⤵
- Executes dropped EXE
PID:2076 -
\??\c:\7dppp.exec:\7dppp.exe58⤵
- Executes dropped EXE
PID:1448 -
\??\c:\9rlrxxl.exec:\9rlrxxl.exe59⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rlxxrlr.exec:\rlxxrlr.exe60⤵
- Executes dropped EXE
PID:672 -
\??\c:\7hhthn.exec:\7hhthn.exe61⤵
- Executes dropped EXE
PID:1400 -
\??\c:\thhtbt.exec:\thhtbt.exe62⤵
- Executes dropped EXE
PID:984 -
\??\c:\vpppv.exec:\vpppv.exe63⤵
- Executes dropped EXE
PID:1396 -
\??\c:\vjddp.exec:\vjddp.exe64⤵
- Executes dropped EXE
PID:1428 -
\??\c:\7lxxrxf.exec:\7lxxrxf.exe65⤵
- Executes dropped EXE
PID:1696 -
\??\c:\lfrxlfr.exec:\lfrxlfr.exe66⤵PID:2316
-
\??\c:\hbhnnt.exec:\hbhnnt.exe67⤵PID:2092
-
\??\c:\5nbttn.exec:\5nbttn.exe68⤵PID:1888
-
\??\c:\vpdjp.exec:\vpdjp.exe69⤵PID:2052
-
\??\c:\jvddj.exec:\jvddj.exe70⤵PID:688
-
\??\c:\thttbb.exec:\thttbb.exe71⤵PID:2172
-
\??\c:\nthnnn.exec:\nthnnn.exe72⤵PID:572
-
\??\c:\1dddd.exec:\1dddd.exe73⤵PID:1940
-
\??\c:\dpjpj.exec:\dpjpj.exe74⤵PID:1948
-
\??\c:\3ddpd.exec:\3ddpd.exe75⤵PID:2312
-
\??\c:\xllrlrr.exec:\xllrlrr.exe76⤵PID:1528
-
\??\c:\9btnbn.exec:\9btnbn.exe77⤵PID:2492
-
\??\c:\tnbhbh.exec:\tnbhbh.exe78⤵PID:2588
-
\??\c:\1jvpp.exec:\1jvpp.exe79⤵PID:2608
-
\??\c:\1pvvd.exec:\1pvvd.exe80⤵PID:2592
-
\??\c:\fffllxr.exec:\fffllxr.exe81⤵PID:2832
-
\??\c:\lrrlfrf.exec:\lrrlfrf.exe82⤵PID:2560
-
\??\c:\tnthbh.exec:\tnthbh.exe83⤵PID:2420
-
\??\c:\3hnnhn.exec:\3hnnhn.exe84⤵PID:1588
-
\??\c:\9tbbnt.exec:\9tbbnt.exe85⤵PID:2212
-
\??\c:\9pvdj.exec:\9pvdj.exe86⤵PID:1772
-
\??\c:\ppjdd.exec:\ppjdd.exe87⤵PID:2968
-
\??\c:\3xlrxxr.exec:\3xlrxxr.exe88⤵PID:2760
-
\??\c:\ffxlrrr.exec:\ffxlrrr.exe89⤵PID:2788
-
\??\c:\hbthnb.exec:\hbthnb.exe90⤵PID:1604
-
\??\c:\nhhtbb.exec:\nhhtbb.exe91⤵PID:492
-
\??\c:\jjdjv.exec:\jjdjv.exe92⤵PID:1788
-
\??\c:\vvdjp.exec:\vvdjp.exe93⤵PID:2032
-
\??\c:\1vjpp.exec:\1vjpp.exe94⤵PID:2708
-
\??\c:\7llxlfx.exec:\7llxlfx.exe95⤵PID:2616
-
\??\c:\1rlrfll.exec:\1rlrfll.exe96⤵PID:788
-
\??\c:\lrlrfxx.exec:\lrlrfxx.exe97⤵PID:1644
-
\??\c:\7bhbtn.exec:\7bhbtn.exe98⤵PID:2984
-
\??\c:\bbnnbh.exec:\bbnnbh.exe99⤵PID:2056
-
\??\c:\vjddd.exec:\vjddd.exe100⤵PID:1032
-
\??\c:\dpvdd.exec:\dpvdd.exe101⤵PID:1340
-
\??\c:\xrxflrx.exec:\xrxflrx.exe102⤵PID:772
-
\??\c:\7llffxf.exec:\7llffxf.exe103⤵PID:1048
-
\??\c:\frflfrf.exec:\frflfrf.exe104⤵PID:1400
-
\??\c:\httnbb.exec:\httnbb.exe105⤵PID:1116
-
\??\c:\nhhnnn.exec:\nhhnnn.exe106⤵PID:1728
-
\??\c:\dpvdd.exec:\dpvdd.exe107⤵PID:856
-
\??\c:\1pppv.exec:\1pppv.exe108⤵PID:2372
-
\??\c:\5xllfff.exec:\5xllfff.exe109⤵PID:1876
-
\??\c:\fxrfflf.exec:\fxrfflf.exe110⤵PID:556
-
\??\c:\nhbhnt.exec:\nhbhnt.exe111⤵PID:1652
-
\??\c:\ttntbb.exec:\ttntbb.exe112⤵PID:3040
-
\??\c:\vpjjj.exec:\vpjjj.exe113⤵PID:864
-
\??\c:\pvjjd.exec:\pvjjd.exe114⤵PID:2156
-
\??\c:\fxrlrfr.exec:\fxrlrfr.exe115⤵PID:2176
-
\??\c:\3rfrxxl.exec:\3rfrxxl.exe116⤵PID:2128
-
\??\c:\5nhntt.exec:\5nhntt.exe117⤵PID:1536
-
\??\c:\9nhnbb.exec:\9nhnbb.exe118⤵PID:400
-
\??\c:\dpdpv.exec:\dpdpv.exe119⤵PID:2596
-
\??\c:\pdjjv.exec:\pdjjv.exe120⤵PID:2504
-
\??\c:\dddpj.exec:\dddpj.exe121⤵PID:2588
-
\??\c:\xrflrxf.exec:\xrflrxf.exe122⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-