Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 14:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b32243da2822ead3b36bd8bafc7072d0_NEAS.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
b32243da2822ead3b36bd8bafc7072d0_NEAS.exe
-
Size
82KB
-
MD5
b32243da2822ead3b36bd8bafc7072d0
-
SHA1
1a098c8765ea939579f10bb7138b75924adf319f
-
SHA256
9ee28a5943547a5740f75427b869e4a3bf2888df89b71bbadbbf06d9969ec28b
-
SHA512
9bca1009d3ba289957c1cfc04f3ec1501cc20f1ad99296c6deb8b1b0694c46492bb89269d8a0c2204fba6dedf907bae93ef6725cc2909b7a3904792e12be02d5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JkZPsvg:ymb3NkkiQ3mdBjFIWeFGyA9PJ
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3000-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2620-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2252-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1964-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/508-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1252-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1764 3nhtbt.exe 2000 thbntb.exe 3504 dvvjj.exe 2620 5jdpd.exe 1080 rxlxfxl.exe 384 tnthnh.exe 3536 hnnbth.exe 2252 dppdj.exe 852 rxrfrlr.exe 4516 ththtn.exe 4984 pdpdj.exe 2960 ppjvp.exe 4948 xlrfxlx.exe 3268 tnbnbt.exe 1608 7tthtn.exe 3480 djpdp.exe 1964 xlfrfxl.exe 508 xlfrxrf.exe 2836 nhnbth.exe 1252 jdpdj.exe 1384 9dvjd.exe 4476 xxxfrfr.exe 2900 tnhtht.exe 3180 htnthb.exe 988 vjvjv.exe 3400 9dpdj.exe 3892 rfrflfl.exe 3088 hnhbnh.exe 3672 1tnbht.exe 2572 pjjvp.exe 3076 pvpdj.exe 4844 llflfxl.exe 184 nhnbnb.exe 3728 nnhthb.exe 1448 vdpdj.exe 4292 jdpdp.exe 2352 rxlfrlf.exe 992 xrfrllx.exe 1992 bnhtnb.exe 2248 ntntnb.exe 740 vjdjv.exe 1848 frrfrlx.exe 1756 flxllrx.exe 1704 bnnhbb.exe 2356 5vppv.exe 3424 vdppp.exe 4816 rflffff.exe 864 xrlfrlf.exe 2252 frxlxrl.exe 1660 bnhnnh.exe 4516 tbbnbn.exe 4180 jdpdj.exe 4020 jvjdp.exe 4852 xrrxxrf.exe 2408 rxlrffx.exe 1624 btnbnh.exe 1952 bbbbbb.exe 3480 9pdjv.exe 4908 jvvjp.exe 1664 frfrfxr.exe 4200 rllllxx.exe 5024 btbtth.exe 1716 hbthtn.exe 3544 dpjvd.exe -
resource yara_rule behavioral2/memory/3000-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/384-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1964-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/508-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1252-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-190-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 1764 3000 b32243da2822ead3b36bd8bafc7072d0_NEAS.exe 82 PID 3000 wrote to memory of 1764 3000 b32243da2822ead3b36bd8bafc7072d0_NEAS.exe 82 PID 3000 wrote to memory of 1764 3000 b32243da2822ead3b36bd8bafc7072d0_NEAS.exe 82 PID 1764 wrote to memory of 2000 1764 3nhtbt.exe 83 PID 1764 wrote to memory of 2000 1764 3nhtbt.exe 83 PID 1764 wrote to memory of 2000 1764 3nhtbt.exe 83 PID 2000 wrote to memory of 3504 2000 thbntb.exe 84 PID 2000 wrote to memory of 3504 2000 thbntb.exe 84 PID 2000 wrote to memory of 3504 2000 thbntb.exe 84 PID 3504 wrote to memory of 2620 3504 dvvjj.exe 85 PID 3504 wrote to memory of 2620 3504 dvvjj.exe 85 PID 3504 wrote to memory of 2620 3504 dvvjj.exe 85 PID 2620 wrote to memory of 1080 2620 5jdpd.exe 86 PID 2620 wrote to memory of 1080 2620 5jdpd.exe 86 PID 2620 wrote to memory of 1080 2620 5jdpd.exe 86 PID 1080 wrote to memory of 384 1080 rxlxfxl.exe 87 PID 1080 wrote to memory of 384 1080 rxlxfxl.exe 87 PID 1080 wrote to memory of 384 1080 rxlxfxl.exe 87 PID 384 wrote to memory of 3536 384 tnthnh.exe 88 PID 384 wrote to memory of 3536 384 tnthnh.exe 88 PID 384 wrote to memory of 3536 384 tnthnh.exe 88 PID 3536 wrote to memory of 2252 3536 hnnbth.exe 89 PID 3536 wrote to memory of 2252 3536 hnnbth.exe 89 PID 3536 wrote to memory of 2252 3536 hnnbth.exe 89 PID 2252 wrote to memory of 852 2252 dppdj.exe 90 PID 2252 wrote to memory of 852 2252 dppdj.exe 90 PID 2252 wrote to memory of 852 2252 dppdj.exe 90 PID 852 wrote to memory of 4516 852 rxrfrlr.exe 91 PID 852 wrote to memory of 4516 852 rxrfrlr.exe 91 PID 852 wrote to memory of 4516 852 rxrfrlr.exe 91 PID 4516 wrote to memory of 4984 4516 ththtn.exe 92 PID 4516 wrote to memory of 4984 4516 ththtn.exe 92 PID 4516 wrote to memory of 4984 4516 ththtn.exe 92 PID 4984 wrote to memory of 2960 4984 pdpdj.exe 93 PID 4984 wrote to memory of 2960 4984 pdpdj.exe 93 PID 4984 wrote to memory of 2960 4984 pdpdj.exe 93 PID 2960 wrote to memory of 4948 2960 ppjvp.exe 95 PID 2960 wrote to memory of 4948 2960 ppjvp.exe 95 PID 2960 wrote to memory of 4948 2960 ppjvp.exe 95 PID 4948 wrote to memory of 3268 4948 xlrfxlx.exe 96 PID 4948 wrote to memory of 3268 4948 xlrfxlx.exe 96 PID 4948 wrote to memory of 3268 4948 xlrfxlx.exe 96 PID 3268 wrote to memory of 1608 3268 tnbnbt.exe 97 PID 3268 wrote to memory of 1608 3268 tnbnbt.exe 97 PID 3268 wrote to memory of 1608 3268 tnbnbt.exe 97 PID 1608 wrote to memory of 3480 1608 7tthtn.exe 98 PID 1608 wrote to memory of 3480 1608 7tthtn.exe 98 PID 1608 wrote to memory of 3480 1608 7tthtn.exe 98 PID 3480 wrote to memory of 1964 3480 djpdp.exe 99 PID 3480 wrote to memory of 1964 3480 djpdp.exe 99 PID 3480 wrote to memory of 1964 3480 djpdp.exe 99 PID 1964 wrote to memory of 508 1964 xlfrfxl.exe 100 PID 1964 wrote to memory of 508 1964 xlfrfxl.exe 100 PID 1964 wrote to memory of 508 1964 xlfrfxl.exe 100 PID 508 wrote to memory of 2836 508 xlfrxrf.exe 101 PID 508 wrote to memory of 2836 508 xlfrxrf.exe 101 PID 508 wrote to memory of 2836 508 xlfrxrf.exe 101 PID 2836 wrote to memory of 1252 2836 nhnbth.exe 102 PID 2836 wrote to memory of 1252 2836 nhnbth.exe 102 PID 2836 wrote to memory of 1252 2836 nhnbth.exe 102 PID 1252 wrote to memory of 1384 1252 jdpdj.exe 103 PID 1252 wrote to memory of 1384 1252 jdpdj.exe 103 PID 1252 wrote to memory of 1384 1252 jdpdj.exe 103 PID 1384 wrote to memory of 4476 1384 9dvjd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b32243da2822ead3b36bd8bafc7072d0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\b32243da2822ead3b36bd8bafc7072d0_NEAS.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\3nhtbt.exec:\3nhtbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\thbntb.exec:\thbntb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\dvvjj.exec:\dvvjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\5jdpd.exec:\5jdpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\rxlxfxl.exec:\rxlxfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\tnthnh.exec:\tnthnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\hnnbth.exec:\hnnbth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\dppdj.exec:\dppdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\rxrfrlr.exec:\rxrfrlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\ththtn.exec:\ththtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\pdpdj.exec:\pdpdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\ppjvp.exec:\ppjvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\xlrfxlx.exec:\xlrfxlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\tnbnbt.exec:\tnbnbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\7tthtn.exec:\7tthtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\djpdp.exec:\djpdp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\xlfrfxl.exec:\xlfrfxl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\xlfrxrf.exec:\xlfrxrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
\??\c:\nhnbth.exec:\nhnbth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\jdpdj.exec:\jdpdj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\9dvjd.exec:\9dvjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\xxxfrfr.exec:\xxxfrfr.exe23⤵
- Executes dropped EXE
PID:4476 -
\??\c:\tnhtht.exec:\tnhtht.exe24⤵
- Executes dropped EXE
PID:2900 -
\??\c:\htnthb.exec:\htnthb.exe25⤵
- Executes dropped EXE
PID:3180 -
\??\c:\vjvjv.exec:\vjvjv.exe26⤵
- Executes dropped EXE
PID:988 -
\??\c:\9dpdj.exec:\9dpdj.exe27⤵
- Executes dropped EXE
PID:3400 -
\??\c:\rfrflfl.exec:\rfrflfl.exe28⤵
- Executes dropped EXE
PID:3892 -
\??\c:\hnhbnh.exec:\hnhbnh.exe29⤵
- Executes dropped EXE
PID:3088 -
\??\c:\1tnbht.exec:\1tnbht.exe30⤵
- Executes dropped EXE
PID:3672 -
\??\c:\pjjvp.exec:\pjjvp.exe31⤵
- Executes dropped EXE
PID:2572 -
\??\c:\pvpdj.exec:\pvpdj.exe32⤵
- Executes dropped EXE
PID:3076 -
\??\c:\llflfxl.exec:\llflfxl.exe33⤵
- Executes dropped EXE
PID:4844 -
\??\c:\nhnbnb.exec:\nhnbnb.exe34⤵
- Executes dropped EXE
PID:184 -
\??\c:\nnhthb.exec:\nnhthb.exe35⤵
- Executes dropped EXE
PID:3728 -
\??\c:\vdpdj.exec:\vdpdj.exe36⤵
- Executes dropped EXE
PID:1448 -
\??\c:\jdpdp.exec:\jdpdp.exe37⤵
- Executes dropped EXE
PID:4292 -
\??\c:\rxlfrlf.exec:\rxlfrlf.exe38⤵
- Executes dropped EXE
PID:2352 -
\??\c:\xrfrllx.exec:\xrfrllx.exe39⤵
- Executes dropped EXE
PID:992 -
\??\c:\bnhtnb.exec:\bnhtnb.exe40⤵
- Executes dropped EXE
PID:1992 -
\??\c:\ntntnb.exec:\ntntnb.exe41⤵
- Executes dropped EXE
PID:2248 -
\??\c:\vjdjv.exec:\vjdjv.exe42⤵
- Executes dropped EXE
PID:740 -
\??\c:\frrfrlx.exec:\frrfrlx.exe43⤵
- Executes dropped EXE
PID:1848 -
\??\c:\flxllrx.exec:\flxllrx.exe44⤵
- Executes dropped EXE
PID:1756 -
\??\c:\bnnhbb.exec:\bnnhbb.exe45⤵
- Executes dropped EXE
PID:1704 -
\??\c:\5vppv.exec:\5vppv.exe46⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vdppp.exec:\vdppp.exe47⤵
- Executes dropped EXE
PID:3424 -
\??\c:\rflffff.exec:\rflffff.exe48⤵
- Executes dropped EXE
PID:4816 -
\??\c:\xrlfrlf.exec:\xrlfrlf.exe49⤵
- Executes dropped EXE
PID:864 -
\??\c:\frxlxrl.exec:\frxlxrl.exe50⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bnhnnh.exec:\bnhnnh.exe51⤵
- Executes dropped EXE
PID:1660 -
\??\c:\tbbnbn.exec:\tbbnbn.exe52⤵
- Executes dropped EXE
PID:4516 -
\??\c:\jdpdj.exec:\jdpdj.exe53⤵
- Executes dropped EXE
PID:4180 -
\??\c:\jvjdp.exec:\jvjdp.exe54⤵
- Executes dropped EXE
PID:4020 -
\??\c:\xrrxxrf.exec:\xrrxxrf.exe55⤵
- Executes dropped EXE
PID:4852 -
\??\c:\rxlrffx.exec:\rxlrffx.exe56⤵
- Executes dropped EXE
PID:2408 -
\??\c:\btnbnh.exec:\btnbnh.exe57⤵
- Executes dropped EXE
PID:1624 -
\??\c:\bbbbbb.exec:\bbbbbb.exe58⤵
- Executes dropped EXE
PID:1952 -
\??\c:\9pdjv.exec:\9pdjv.exe59⤵
- Executes dropped EXE
PID:3480 -
\??\c:\jvvjp.exec:\jvvjp.exe60⤵
- Executes dropped EXE
PID:4908 -
\??\c:\frfrfxr.exec:\frfrfxr.exe61⤵
- Executes dropped EXE
PID:1664 -
\??\c:\rllllxx.exec:\rllllxx.exe62⤵
- Executes dropped EXE
PID:4200 -
\??\c:\btbtth.exec:\btbtth.exe63⤵
- Executes dropped EXE
PID:5024 -
\??\c:\hbthtn.exec:\hbthtn.exe64⤵
- Executes dropped EXE
PID:1716 -
\??\c:\dpjvd.exec:\dpjvd.exe65⤵
- Executes dropped EXE
PID:3544 -
\??\c:\jvpdp.exec:\jvpdp.exe66⤵PID:756
-
\??\c:\fffrlxl.exec:\fffrlxl.exe67⤵PID:2668
-
\??\c:\1lxrxrx.exec:\1lxrxrx.exe68⤵PID:3644
-
\??\c:\fffrfxx.exec:\fffrfxx.exe69⤵PID:4720
-
\??\c:\nnnhtn.exec:\nnnhtn.exe70⤵PID:3180
-
\??\c:\hnhtht.exec:\hnhtht.exe71⤵PID:1568
-
\??\c:\pppjj.exec:\pppjj.exe72⤵PID:4184
-
\??\c:\dpdpd.exec:\dpdpd.exe73⤵PID:4060
-
\??\c:\lrrflrr.exec:\lrrflrr.exe74⤵PID:4344
-
\??\c:\bnhbnh.exec:\bnhbnh.exe75⤵PID:4808
-
\??\c:\htnbnb.exec:\htnbnb.exe76⤵PID:4040
-
\??\c:\5dvjp.exec:\5dvjp.exe77⤵PID:4204
-
\??\c:\pddjp.exec:\pddjp.exe78⤵PID:1116
-
\??\c:\3xxlrlx.exec:\3xxlrlx.exe79⤵PID:3068
-
\??\c:\rfrflfr.exec:\rfrflfr.exe80⤵PID:3900
-
\??\c:\bhbtnb.exec:\bhbtnb.exe81⤵PID:4332
-
\??\c:\3nnbnh.exec:\3nnbnh.exe82⤵PID:1496
-
\??\c:\vjvjp.exec:\vjvjp.exe83⤵PID:1476
-
\??\c:\vdjvj.exec:\vdjvj.exe84⤵PID:2400
-
\??\c:\5ppvd.exec:\5ppvd.exe85⤵PID:2256
-
\??\c:\rxlfxlf.exec:\rxlfxlf.exe86⤵PID:1156
-
\??\c:\hthnht.exec:\hthnht.exe87⤵PID:4460
-
\??\c:\bnhnhb.exec:\bnhnhb.exe88⤵PID:2380
-
\??\c:\nbbnbt.exec:\nbbnbt.exe89⤵PID:3432
-
\??\c:\jdpdj.exec:\jdpdj.exe90⤵PID:740
-
\??\c:\pdpjp.exec:\pdpjp.exe91⤵PID:1848
-
\??\c:\rxrflfr.exec:\rxrflfr.exe92⤵PID:1756
-
\??\c:\nhbthb.exec:\nhbthb.exe93⤵PID:5004
-
\??\c:\jvpdp.exec:\jvpdp.exe94⤵PID:2732
-
\??\c:\jvvjd.exec:\jvvjd.exe95⤵PID:3928
-
\??\c:\3xxlrxl.exec:\3xxlrxl.exe96⤵PID:1844
-
\??\c:\xffrfxl.exec:\xffrfxl.exe97⤵PID:852
-
\??\c:\9btnbb.exec:\9btnbb.exe98⤵PID:1660
-
\??\c:\ntbtbt.exec:\ntbtbt.exe99⤵PID:4972
-
\??\c:\5hthth.exec:\5hthth.exe100⤵PID:2012
-
\??\c:\vppjp.exec:\vppjp.exe101⤵PID:3144
-
\??\c:\7rrxfxl.exec:\7rrxfxl.exe102⤵PID:1428
-
\??\c:\3flrlxl.exec:\3flrlxl.exe103⤵PID:1200
-
\??\c:\9hhtnn.exec:\9hhtnn.exe104⤵PID:4552
-
\??\c:\1pjvv.exec:\1pjvv.exe105⤵PID:1204
-
\??\c:\lfxlxrl.exec:\lfxlxrl.exe106⤵PID:4156
-
\??\c:\9rrlxrf.exec:\9rrlxrf.exe107⤵PID:3700
-
\??\c:\hthbnh.exec:\hthbnh.exe108⤵PID:4444
-
\??\c:\nnbbbb.exec:\nnbbbb.exe109⤵PID:2028
-
\??\c:\vjdpv.exec:\vjdpv.exe110⤵PID:4912
-
\??\c:\rfrxxlf.exec:\rfrxxlf.exe111⤵PID:3208
-
\??\c:\fffrfrf.exec:\fffrfrf.exe112⤵PID:1384
-
\??\c:\7bthtn.exec:\7bthtn.exe113⤵PID:4992
-
\??\c:\nbbnnb.exec:\nbbnnb.exe114⤵PID:804
-
\??\c:\pjdjj.exec:\pjdjj.exe115⤵PID:4848
-
\??\c:\jdjvd.exec:\jdjvd.exe116⤵PID:1520
-
\??\c:\lrlxlfr.exec:\lrlxlfr.exe117⤵PID:4572
-
\??\c:\thttbn.exec:\thttbn.exe118⤵PID:2864
-
\??\c:\9hbnnb.exec:\9hbnnb.exe119⤵PID:4008
-
\??\c:\pjdpd.exec:\pjdpd.exe120⤵PID:3216
-
\??\c:\pvpdp.exec:\pvpdp.exe121⤵PID:4808
-
\??\c:\lfxxllf.exec:\lfxxllf.exe122⤵PID:3736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-