Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 18:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04e85ca84fc0e7d49b3ad74c82c63810_NEAS.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
04e85ca84fc0e7d49b3ad74c82c63810_NEAS.exe
-
Size
228KB
-
MD5
04e85ca84fc0e7d49b3ad74c82c63810
-
SHA1
8ceda241548906245ead9f4d74ba07809d7a5686
-
SHA256
64cc8920142782bc7e652c6034957767ad445a8557284a4a393f40640f6c02fe
-
SHA512
00c886c93e2aa8d7da324f535b6e9e4d9fb629d777821ee12179f32b24187a53925323a8649756966f51b66e521479dd6a9acaf5760e317fd63cf4ce5f744e56
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLn/cX:n3C9BRo7MlrWKo+lxKkX
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/3004-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1564-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/292-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3004 dvvpv.exe 2640 1xfxffl.exe 2120 xxlxllx.exe 2712 ttnthh.exe 292 ppjpj.exe 2488 jjpdj.exe 3024 frrlxfl.exe 2004 bththn.exe 1564 bbnnnn.exe 2196 dvpdj.exe 1672 3xrrflr.exe 1668 tntthh.exe 1520 3tntbb.exe 1728 pdpjp.exe 592 jjvjd.exe 1420 fxlrxff.exe 1276 bbbhnt.exe 2720 hhthhn.exe 2708 ppdvp.exe 2356 xrflrfr.exe 2508 rfrxlxf.exe 1624 hhnbnn.exe 1148 7bnntt.exe 2232 vpvjv.exe 2032 vpjpp.exe 1720 lfffrxl.exe 2172 1nbbhn.exe 2116 1pjdj.exe 828 7pjjv.exe 2492 rrflrxx.exe 2916 5ffrxxl.exe 2604 frllrrx.exe 1540 nbbhtb.exe 2756 tnhnhb.exe 2680 jdppp.exe 2556 5llrlrx.exe 2656 rxlrxxl.exe 2408 hbnbtn.exe 2580 nhnthn.exe 2828 dpdjd.exe 2056 pjvjp.exe 1916 frfxffl.exe 1612 ffrfrxf.exe 2644 bttnnn.exe 2572 7hbtbn.exe 1652 vpddp.exe 1668 jjdpv.exe 296 pdpvd.exe 1864 flrxlrr.exe 1524 rfllrrx.exe 1324 hbhhnh.exe 1580 pdjpv.exe 2724 jdpjj.exe 2280 7lxxrrl.exe 2772 rfxxllr.exe 2356 nbnnnn.exe 2104 nhtnbt.exe 1992 tnbbhb.exe 448 5dvvv.exe 2868 jdpvd.exe 2032 7lffffl.exe 568 rfrrrrf.exe 1472 htbttn.exe 2068 7tbnnn.exe -
resource yara_rule behavioral1/memory/3004-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1564-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/292-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-4-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2836 wrote to memory of 3004 2836 04e85ca84fc0e7d49b3ad74c82c63810_NEAS.exe 28 PID 2836 wrote to memory of 3004 2836 04e85ca84fc0e7d49b3ad74c82c63810_NEAS.exe 28 PID 2836 wrote to memory of 3004 2836 04e85ca84fc0e7d49b3ad74c82c63810_NEAS.exe 28 PID 2836 wrote to memory of 3004 2836 04e85ca84fc0e7d49b3ad74c82c63810_NEAS.exe 28 PID 3004 wrote to memory of 2640 3004 dvvpv.exe 29 PID 3004 wrote to memory of 2640 3004 dvvpv.exe 29 PID 3004 wrote to memory of 2640 3004 dvvpv.exe 29 PID 3004 wrote to memory of 2640 3004 dvvpv.exe 29 PID 2640 wrote to memory of 2120 2640 1xfxffl.exe 30 PID 2640 wrote to memory of 2120 2640 1xfxffl.exe 30 PID 2640 wrote to memory of 2120 2640 1xfxffl.exe 30 PID 2640 wrote to memory of 2120 2640 1xfxffl.exe 30 PID 2120 wrote to memory of 2712 2120 xxlxllx.exe 31 PID 2120 wrote to memory of 2712 2120 xxlxllx.exe 31 PID 2120 wrote to memory of 2712 2120 xxlxllx.exe 31 PID 2120 wrote to memory of 2712 2120 xxlxllx.exe 31 PID 2712 wrote to memory of 292 2712 ttnthh.exe 32 PID 2712 wrote to memory of 292 2712 ttnthh.exe 32 PID 2712 wrote to memory of 292 2712 ttnthh.exe 32 PID 2712 wrote to memory of 292 2712 ttnthh.exe 32 PID 292 wrote to memory of 2488 292 ppjpj.exe 33 PID 292 wrote to memory of 2488 292 ppjpj.exe 33 PID 292 wrote to memory of 2488 292 ppjpj.exe 33 PID 292 wrote to memory of 2488 292 ppjpj.exe 33 PID 2488 wrote to memory of 3024 2488 jjpdj.exe 34 PID 2488 wrote to memory of 3024 2488 jjpdj.exe 34 PID 2488 wrote to memory of 3024 2488 jjpdj.exe 34 PID 2488 wrote to memory of 3024 2488 jjpdj.exe 34 PID 3024 wrote to memory of 2004 3024 frrlxfl.exe 35 PID 3024 wrote to memory of 2004 3024 frrlxfl.exe 35 PID 3024 wrote to memory of 2004 3024 frrlxfl.exe 35 PID 3024 wrote to memory of 2004 3024 frrlxfl.exe 35 PID 2004 wrote to memory of 1564 2004 bththn.exe 36 PID 2004 wrote to memory of 1564 2004 bththn.exe 36 PID 2004 wrote to memory of 1564 2004 bththn.exe 36 PID 2004 wrote to memory of 1564 2004 bththn.exe 36 PID 1564 wrote to memory of 2196 1564 bbnnnn.exe 37 PID 1564 wrote to memory of 2196 1564 bbnnnn.exe 37 PID 1564 wrote to memory of 2196 1564 bbnnnn.exe 37 PID 1564 wrote to memory of 2196 1564 bbnnnn.exe 37 PID 2196 wrote to memory of 1672 2196 dvpdj.exe 38 PID 2196 wrote to memory of 1672 2196 dvpdj.exe 38 PID 2196 wrote to memory of 1672 2196 dvpdj.exe 38 PID 2196 wrote to memory of 1672 2196 dvpdj.exe 38 PID 1672 wrote to memory of 1668 1672 3xrrflr.exe 39 PID 1672 wrote to memory of 1668 1672 3xrrflr.exe 39 PID 1672 wrote to memory of 1668 1672 3xrrflr.exe 39 PID 1672 wrote to memory of 1668 1672 3xrrflr.exe 39 PID 1668 wrote to memory of 1520 1668 tntthh.exe 40 PID 1668 wrote to memory of 1520 1668 tntthh.exe 40 PID 1668 wrote to memory of 1520 1668 tntthh.exe 40 PID 1668 wrote to memory of 1520 1668 tntthh.exe 40 PID 1520 wrote to memory of 1728 1520 3tntbb.exe 41 PID 1520 wrote to memory of 1728 1520 3tntbb.exe 41 PID 1520 wrote to memory of 1728 1520 3tntbb.exe 41 PID 1520 wrote to memory of 1728 1520 3tntbb.exe 41 PID 1728 wrote to memory of 592 1728 pdpjp.exe 42 PID 1728 wrote to memory of 592 1728 pdpjp.exe 42 PID 1728 wrote to memory of 592 1728 pdpjp.exe 42 PID 1728 wrote to memory of 592 1728 pdpjp.exe 42 PID 592 wrote to memory of 1420 592 jjvjd.exe 43 PID 592 wrote to memory of 1420 592 jjvjd.exe 43 PID 592 wrote to memory of 1420 592 jjvjd.exe 43 PID 592 wrote to memory of 1420 592 jjvjd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\04e85ca84fc0e7d49b3ad74c82c63810_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\04e85ca84fc0e7d49b3ad74c82c63810_NEAS.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\dvvpv.exec:\dvvpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\1xfxffl.exec:\1xfxffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\xxlxllx.exec:\xxlxllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\ttnthh.exec:\ttnthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\ppjpj.exec:\ppjpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:292 -
\??\c:\jjpdj.exec:\jjpdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\frrlxfl.exec:\frrlxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\bththn.exec:\bththn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\bbnnnn.exec:\bbnnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\dvpdj.exec:\dvpdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\3xrrflr.exec:\3xrrflr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\tntthh.exec:\tntthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\3tntbb.exec:\3tntbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\pdpjp.exec:\pdpjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\jjvjd.exec:\jjvjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\fxlrxff.exec:\fxlrxff.exe17⤵
- Executes dropped EXE
PID:1420 -
\??\c:\bbbhnt.exec:\bbbhnt.exe18⤵
- Executes dropped EXE
PID:1276 -
\??\c:\hhthhn.exec:\hhthhn.exe19⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ppdvp.exec:\ppdvp.exe20⤵
- Executes dropped EXE
PID:2708 -
\??\c:\xrflrfr.exec:\xrflrfr.exe21⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rfrxlxf.exec:\rfrxlxf.exe22⤵
- Executes dropped EXE
PID:2508 -
\??\c:\hhnbnn.exec:\hhnbnn.exe23⤵
- Executes dropped EXE
PID:1624 -
\??\c:\7bnntt.exec:\7bnntt.exe24⤵
- Executes dropped EXE
PID:1148 -
\??\c:\vpvjv.exec:\vpvjv.exe25⤵
- Executes dropped EXE
PID:2232 -
\??\c:\vpjpp.exec:\vpjpp.exe26⤵
- Executes dropped EXE
PID:2032 -
\??\c:\lfffrxl.exec:\lfffrxl.exe27⤵
- Executes dropped EXE
PID:1720 -
\??\c:\1nbbhn.exec:\1nbbhn.exe28⤵
- Executes dropped EXE
PID:2172 -
\??\c:\1pjdj.exec:\1pjdj.exe29⤵
- Executes dropped EXE
PID:2116 -
\??\c:\7pjjv.exec:\7pjjv.exe30⤵
- Executes dropped EXE
PID:828 -
\??\c:\rrflrxx.exec:\rrflrxx.exe31⤵
- Executes dropped EXE
PID:2492 -
\??\c:\5ffrxxl.exec:\5ffrxxl.exe32⤵
- Executes dropped EXE
PID:2916 -
\??\c:\frllrrx.exec:\frllrrx.exe33⤵
- Executes dropped EXE
PID:2604 -
\??\c:\nbbhtb.exec:\nbbhtb.exe34⤵
- Executes dropped EXE
PID:1540 -
\??\c:\tnhnhb.exec:\tnhnhb.exe35⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jdppp.exec:\jdppp.exe36⤵
- Executes dropped EXE
PID:2680 -
\??\c:\5llrlrx.exec:\5llrlrx.exe37⤵
- Executes dropped EXE
PID:2556 -
\??\c:\rxlrxxl.exec:\rxlrxxl.exe38⤵
- Executes dropped EXE
PID:2656 -
\??\c:\hbnbtn.exec:\hbnbtn.exe39⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nhnthn.exec:\nhnthn.exe40⤵
- Executes dropped EXE
PID:2580 -
\??\c:\dpdjd.exec:\dpdjd.exe41⤵
- Executes dropped EXE
PID:2828 -
\??\c:\pjvjp.exec:\pjvjp.exe42⤵
- Executes dropped EXE
PID:2056 -
\??\c:\frfxffl.exec:\frfxffl.exe43⤵
- Executes dropped EXE
PID:1916 -
\??\c:\ffrfrxf.exec:\ffrfrxf.exe44⤵
- Executes dropped EXE
PID:1612 -
\??\c:\bttnnn.exec:\bttnnn.exe45⤵
- Executes dropped EXE
PID:2644 -
\??\c:\7hbtbn.exec:\7hbtbn.exe46⤵
- Executes dropped EXE
PID:2572 -
\??\c:\vpddp.exec:\vpddp.exe47⤵
- Executes dropped EXE
PID:1652 -
\??\c:\jjdpv.exec:\jjdpv.exe48⤵
- Executes dropped EXE
PID:1668 -
\??\c:\pdpvd.exec:\pdpvd.exe49⤵
- Executes dropped EXE
PID:296 -
\??\c:\flrxlrr.exec:\flrxlrr.exe50⤵
- Executes dropped EXE
PID:1864 -
\??\c:\rfllrrx.exec:\rfllrrx.exe51⤵
- Executes dropped EXE
PID:1524 -
\??\c:\hbhhnh.exec:\hbhhnh.exe52⤵
- Executes dropped EXE
PID:1324 -
\??\c:\pdjpv.exec:\pdjpv.exe53⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jdpjj.exec:\jdpjj.exe54⤵
- Executes dropped EXE
PID:2724 -
\??\c:\7lxxrrl.exec:\7lxxrrl.exe55⤵
- Executes dropped EXE
PID:2280 -
\??\c:\rfxxllr.exec:\rfxxllr.exe56⤵
- Executes dropped EXE
PID:2772 -
\??\c:\nbnnnn.exec:\nbnnnn.exe57⤵
- Executes dropped EXE
PID:2356 -
\??\c:\nhtnbt.exec:\nhtnbt.exe58⤵
- Executes dropped EXE
PID:2104 -
\??\c:\tnbbhb.exec:\tnbbhb.exe59⤵
- Executes dropped EXE
PID:1992 -
\??\c:\5dvvv.exec:\5dvvv.exe60⤵
- Executes dropped EXE
PID:448 -
\??\c:\jdpvd.exec:\jdpvd.exe61⤵
- Executes dropped EXE
PID:2868 -
\??\c:\7lffffl.exec:\7lffffl.exe62⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rfrrrrf.exec:\rfrrrrf.exe63⤵
- Executes dropped EXE
PID:568 -
\??\c:\htbttn.exec:\htbttn.exe64⤵
- Executes dropped EXE
PID:1472 -
\??\c:\7tbnnn.exec:\7tbnnn.exe65⤵
- Executes dropped EXE
PID:2068 -
\??\c:\vpjdv.exec:\vpjdv.exe66⤵PID:2116
-
\??\c:\pjvpp.exec:\pjvpp.exe67⤵PID:2472
-
\??\c:\pdppp.exec:\pdppp.exe68⤵PID:896
-
\??\c:\1rxxxxl.exec:\1rxxxxl.exe69⤵PID:1788
-
\??\c:\5htntt.exec:\5htntt.exe70⤵PID:1528
-
\??\c:\bnbtbb.exec:\bnbtbb.exe71⤵PID:2672
-
\??\c:\bntnnh.exec:\bntnnh.exe72⤵PID:2504
-
\??\c:\1jddv.exec:\1jddv.exe73⤵PID:2972
-
\??\c:\7xfxrll.exec:\7xfxrll.exe74⤵PID:696
-
\??\c:\1rrrlll.exec:\1rrrlll.exe75⤵PID:2436
-
\??\c:\tnthhh.exec:\tnthhh.exe76⤵PID:2652
-
\??\c:\nnhbnb.exec:\nnhbnb.exe77⤵PID:2608
-
\??\c:\htbttt.exec:\htbttt.exe78⤵PID:2428
-
\??\c:\3jjjp.exec:\3jjjp.exe79⤵PID:2352
-
\??\c:\vpdjj.exec:\vpdjj.exe80⤵PID:2300
-
\??\c:\xxlxxlr.exec:\xxlxxlr.exe81⤵PID:1492
-
\??\c:\lfrlrxr.exec:\lfrlrxr.exe82⤵PID:1456
-
\??\c:\xxlrrll.exec:\xxlrrll.exe83⤵PID:1516
-
\??\c:\hthttn.exec:\hthttn.exe84⤵PID:1876
-
\??\c:\tthtbb.exec:\tthtbb.exe85⤵PID:2424
-
\??\c:\pjddj.exec:\pjddj.exe86⤵PID:2308
-
\??\c:\7vppd.exec:\7vppd.exe87⤵PID:2320
-
\??\c:\vjvdd.exec:\vjvdd.exe88⤵PID:1752
-
\??\c:\lxxxrlr.exec:\lxxxrlr.exe89⤵PID:536
-
\??\c:\hbttbb.exec:\hbttbb.exe90⤵PID:600
-
\??\c:\ttnhtb.exec:\ttnhtb.exe91⤵PID:1608
-
\??\c:\bthhtb.exec:\bthhtb.exe92⤵PID:580
-
\??\c:\5vddd.exec:\5vddd.exe93⤵PID:1276
-
\??\c:\vjjdd.exec:\vjjdd.exe94⤵PID:3064
-
\??\c:\lrxrrlr.exec:\lrxrrlr.exe95⤵PID:2724
-
\??\c:\1lxrffr.exec:\1lxrffr.exe96⤵PID:2824
-
\??\c:\tnbhnb.exec:\tnbhnb.exe97⤵PID:2772
-
\??\c:\tnbbhb.exec:\tnbbhb.exe98⤵PID:2356
-
\??\c:\vvppv.exec:\vvppv.exe99⤵PID:1712
-
\??\c:\dvpvd.exec:\dvpvd.exe100⤵PID:2292
-
\??\c:\pjddj.exec:\pjddj.exe101⤵PID:2224
-
\??\c:\7rxlfrr.exec:\7rxlfrr.exe102⤵PID:1056
-
\??\c:\xlrllxf.exec:\xlrllxf.exe103⤵PID:300
-
\??\c:\tnttth.exec:\tnttth.exe104⤵PID:2288
-
\??\c:\7bbnhb.exec:\7bbnhb.exe105⤵PID:2020
-
\??\c:\pjdpv.exec:\pjdpv.exe106⤵PID:3028
-
\??\c:\5jvjd.exec:\5jvjd.exe107⤵PID:1584
-
\??\c:\dpvdj.exec:\dpvdj.exe108⤵PID:2264
-
\??\c:\rlxrllx.exec:\rlxrllx.exe109⤵PID:2492
-
\??\c:\frxxffl.exec:\frxxffl.exe110⤵PID:2916
-
\??\c:\hbtnnh.exec:\hbtnnh.exe111⤵PID:2836
-
\??\c:\nbbnhh.exec:\nbbnhh.exe112⤵PID:2840
-
\??\c:\1nbbtt.exec:\1nbbtt.exe113⤵PID:860
-
\??\c:\jvddd.exec:\jvddd.exe114⤵PID:2620
-
\??\c:\1dppj.exec:\1dppj.exe115⤵PID:2972
-
\??\c:\rfrflfx.exec:\rfrflfx.exe116⤵PID:696
-
\??\c:\3ffxxxx.exec:\3ffxxxx.exe117⤵PID:2436
-
\??\c:\tnhtbh.exec:\tnhtbh.exe118⤵PID:2512
-
\??\c:\7thbtn.exec:\7thbtn.exe119⤵PID:1732
-
\??\c:\hthhtt.exec:\hthhtt.exe120⤵PID:2408
-
\??\c:\5djdd.exec:\5djdd.exe121⤵PID:2828
-
\??\c:\ddjvv.exec:\ddjvv.exe122⤵PID:320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-