Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 18:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04e85ca84fc0e7d49b3ad74c82c63810_NEAS.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
04e85ca84fc0e7d49b3ad74c82c63810_NEAS.exe
-
Size
228KB
-
MD5
04e85ca84fc0e7d49b3ad74c82c63810
-
SHA1
8ceda241548906245ead9f4d74ba07809d7a5686
-
SHA256
64cc8920142782bc7e652c6034957767ad445a8557284a4a393f40640f6c02fe
-
SHA512
00c886c93e2aa8d7da324f535b6e9e4d9fb629d777821ee12179f32b24187a53925323a8649756966f51b66e521479dd6a9acaf5760e317fd63cf4ce5f744e56
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLn/cX:n3C9BRo7MlrWKo+lxKkX
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3036-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-15-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3256-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/976-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1336-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1376-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2108-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5004 7flxrrr.exe 3256 tttnnh.exe 1092 jddvv.exe 4420 jvddv.exe 1588 nthtnn.exe 1776 xlrlfxx.exe 4732 btnhtn.exe 1384 5rlxlrf.exe 4792 bbhhnt.exe 2032 1jpjp.exe 2268 lffxxxx.exe 4692 1bbtnh.exe 2220 fffxffl.exe 468 fffxrrr.exe 928 7tbttn.exe 976 vpjdd.exe 3924 nhnhbb.exe 1728 1dvpj.exe 2876 tnhbbb.exe 4056 flrrlrr.exe 1012 nnnnhb.exe 1336 jpdpj.exe 1376 rfrllff.exe 3876 nhhnhh.exe 4952 djjdv.exe 2108 rrllrlr.exe 4716 nttnnh.exe 1916 7rrlffx.exe 2716 hnthbt.exe 4072 dpvpp.exe 1436 ddvjd.exe 3016 nbtttt.exe 4152 7jjdd.exe 5020 lfxrlff.exe 3360 bthbtn.exe 1940 vpdvp.exe 3420 3rflffr.exe 2676 tbhhnb.exe 1060 djpjd.exe 3500 5frlffl.exe 2580 tnttnn.exe 896 ddjpj.exe 2664 vdjjj.exe 556 1xfffff.exe 1672 ttbttt.exe 116 5jpdd.exe 540 lrfxlfl.exe 3584 5bbbtn.exe 2444 9ttnhb.exe 2248 vvdvd.exe 1592 fxxrlff.exe 1180 hhnnhh.exe 1616 jvpvv.exe 2380 xrffrlr.exe 2268 bnbbtb.exe 3024 tbtnbb.exe 1676 pvvjv.exe 2928 lfxxrlr.exe 4356 bhntbh.exe 908 pdjpv.exe 4668 djjdd.exe 3896 9xlxfxl.exe 2956 tnnhbb.exe 1760 1pdvj.exe -
resource yara_rule behavioral2/memory/3036-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/976-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3036 wrote to memory of 5004 3036 04e85ca84fc0e7d49b3ad74c82c63810_NEAS.exe 83 PID 3036 wrote to memory of 5004 3036 04e85ca84fc0e7d49b3ad74c82c63810_NEAS.exe 83 PID 3036 wrote to memory of 5004 3036 04e85ca84fc0e7d49b3ad74c82c63810_NEAS.exe 83 PID 5004 wrote to memory of 3256 5004 7flxrrr.exe 84 PID 5004 wrote to memory of 3256 5004 7flxrrr.exe 84 PID 5004 wrote to memory of 3256 5004 7flxrrr.exe 84 PID 3256 wrote to memory of 1092 3256 tttnnh.exe 85 PID 3256 wrote to memory of 1092 3256 tttnnh.exe 85 PID 3256 wrote to memory of 1092 3256 tttnnh.exe 85 PID 1092 wrote to memory of 4420 1092 jddvv.exe 86 PID 1092 wrote to memory of 4420 1092 jddvv.exe 86 PID 1092 wrote to memory of 4420 1092 jddvv.exe 86 PID 4420 wrote to memory of 1588 4420 jvddv.exe 87 PID 4420 wrote to memory of 1588 4420 jvddv.exe 87 PID 4420 wrote to memory of 1588 4420 jvddv.exe 87 PID 1588 wrote to memory of 1776 1588 nthtnn.exe 88 PID 1588 wrote to memory of 1776 1588 nthtnn.exe 88 PID 1588 wrote to memory of 1776 1588 nthtnn.exe 88 PID 1776 wrote to memory of 4732 1776 xlrlfxx.exe 89 PID 1776 wrote to memory of 4732 1776 xlrlfxx.exe 89 PID 1776 wrote to memory of 4732 1776 xlrlfxx.exe 89 PID 4732 wrote to memory of 1384 4732 btnhtn.exe 90 PID 4732 wrote to memory of 1384 4732 btnhtn.exe 90 PID 4732 wrote to memory of 1384 4732 btnhtn.exe 90 PID 1384 wrote to memory of 4792 1384 5rlxlrf.exe 91 PID 1384 wrote to memory of 4792 1384 5rlxlrf.exe 91 PID 1384 wrote to memory of 4792 1384 5rlxlrf.exe 91 PID 4792 wrote to memory of 2032 4792 bbhhnt.exe 92 PID 4792 wrote to memory of 2032 4792 bbhhnt.exe 92 PID 4792 wrote to memory of 2032 4792 bbhhnt.exe 92 PID 2032 wrote to memory of 2268 2032 1jpjp.exe 93 PID 2032 wrote to memory of 2268 2032 1jpjp.exe 93 PID 2032 wrote to memory of 2268 2032 1jpjp.exe 93 PID 2268 wrote to memory of 4692 2268 lffxxxx.exe 94 PID 2268 wrote to memory of 4692 2268 lffxxxx.exe 94 PID 2268 wrote to memory of 4692 2268 lffxxxx.exe 94 PID 4692 wrote to memory of 2220 4692 1bbtnh.exe 95 PID 4692 wrote to memory of 2220 4692 1bbtnh.exe 95 PID 4692 wrote to memory of 2220 4692 1bbtnh.exe 95 PID 2220 wrote to memory of 468 2220 fffxffl.exe 96 PID 2220 wrote to memory of 468 2220 fffxffl.exe 96 PID 2220 wrote to memory of 468 2220 fffxffl.exe 96 PID 468 wrote to memory of 928 468 fffxrrr.exe 97 PID 468 wrote to memory of 928 468 fffxrrr.exe 97 PID 468 wrote to memory of 928 468 fffxrrr.exe 97 PID 928 wrote to memory of 976 928 7tbttn.exe 98 PID 928 wrote to memory of 976 928 7tbttn.exe 98 PID 928 wrote to memory of 976 928 7tbttn.exe 98 PID 976 wrote to memory of 3924 976 vpjdd.exe 99 PID 976 wrote to memory of 3924 976 vpjdd.exe 99 PID 976 wrote to memory of 3924 976 vpjdd.exe 99 PID 3924 wrote to memory of 1728 3924 nhnhbb.exe 100 PID 3924 wrote to memory of 1728 3924 nhnhbb.exe 100 PID 3924 wrote to memory of 1728 3924 nhnhbb.exe 100 PID 1728 wrote to memory of 2876 1728 1dvpj.exe 101 PID 1728 wrote to memory of 2876 1728 1dvpj.exe 101 PID 1728 wrote to memory of 2876 1728 1dvpj.exe 101 PID 2876 wrote to memory of 4056 2876 tnhbbb.exe 102 PID 2876 wrote to memory of 4056 2876 tnhbbb.exe 102 PID 2876 wrote to memory of 4056 2876 tnhbbb.exe 102 PID 4056 wrote to memory of 1012 4056 flrrlrr.exe 103 PID 4056 wrote to memory of 1012 4056 flrrlrr.exe 103 PID 4056 wrote to memory of 1012 4056 flrrlrr.exe 103 PID 1012 wrote to memory of 1336 1012 nnnnhb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\04e85ca84fc0e7d49b3ad74c82c63810_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\04e85ca84fc0e7d49b3ad74c82c63810_NEAS.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\7flxrrr.exec:\7flxrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\tttnnh.exec:\tttnnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\jddvv.exec:\jddvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\jvddv.exec:\jvddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\nthtnn.exec:\nthtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\btnhtn.exec:\btnhtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\5rlxlrf.exec:\5rlxlrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\bbhhnt.exec:\bbhhnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\1jpjp.exec:\1jpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\lffxxxx.exec:\lffxxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\1bbtnh.exec:\1bbtnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\fffxffl.exec:\fffxffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\fffxrrr.exec:\fffxrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\7tbttn.exec:\7tbttn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\vpjdd.exec:\vpjdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\nhnhbb.exec:\nhnhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\1dvpj.exec:\1dvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\tnhbbb.exec:\tnhbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\flrrlrr.exec:\flrrlrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\nnnnhb.exec:\nnnnhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\jpdpj.exec:\jpdpj.exe23⤵
- Executes dropped EXE
PID:1336 -
\??\c:\rfrllff.exec:\rfrllff.exe24⤵
- Executes dropped EXE
PID:1376 -
\??\c:\nhhnhh.exec:\nhhnhh.exe25⤵
- Executes dropped EXE
PID:3876 -
\??\c:\djjdv.exec:\djjdv.exe26⤵
- Executes dropped EXE
PID:4952 -
\??\c:\rrllrlr.exec:\rrllrlr.exe27⤵
- Executes dropped EXE
PID:2108 -
\??\c:\nttnnh.exec:\nttnnh.exe28⤵
- Executes dropped EXE
PID:4716 -
\??\c:\7rrlffx.exec:\7rrlffx.exe29⤵
- Executes dropped EXE
PID:1916 -
\??\c:\hnthbt.exec:\hnthbt.exe30⤵
- Executes dropped EXE
PID:2716 -
\??\c:\dpvpp.exec:\dpvpp.exe31⤵
- Executes dropped EXE
PID:4072 -
\??\c:\ddvjd.exec:\ddvjd.exe32⤵
- Executes dropped EXE
PID:1436 -
\??\c:\nbtttt.exec:\nbtttt.exe33⤵
- Executes dropped EXE
PID:3016 -
\??\c:\7jjdd.exec:\7jjdd.exe34⤵
- Executes dropped EXE
PID:4152 -
\??\c:\lfxrlff.exec:\lfxrlff.exe35⤵
- Executes dropped EXE
PID:5020 -
\??\c:\bthbtn.exec:\bthbtn.exe36⤵
- Executes dropped EXE
PID:3360 -
\??\c:\vpdvp.exec:\vpdvp.exe37⤵
- Executes dropped EXE
PID:1940 -
\??\c:\3rflffr.exec:\3rflffr.exe38⤵
- Executes dropped EXE
PID:3420 -
\??\c:\tbhhnb.exec:\tbhhnb.exe39⤵
- Executes dropped EXE
PID:2676 -
\??\c:\nbbhbh.exec:\nbbhbh.exe40⤵PID:4536
-
\??\c:\djpjd.exec:\djpjd.exe41⤵
- Executes dropped EXE
PID:1060 -
\??\c:\5frlffl.exec:\5frlffl.exe42⤵
- Executes dropped EXE
PID:3500 -
\??\c:\tnttnn.exec:\tnttnn.exe43⤵
- Executes dropped EXE
PID:2580 -
\??\c:\ddjpj.exec:\ddjpj.exe44⤵
- Executes dropped EXE
PID:896 -
\??\c:\vdjjj.exec:\vdjjj.exe45⤵
- Executes dropped EXE
PID:2664 -
\??\c:\1xfffff.exec:\1xfffff.exe46⤵
- Executes dropped EXE
PID:556 -
\??\c:\ttbttt.exec:\ttbttt.exe47⤵
- Executes dropped EXE
PID:1672 -
\??\c:\5jpdd.exec:\5jpdd.exe48⤵
- Executes dropped EXE
PID:116 -
\??\c:\lrfxlfl.exec:\lrfxlfl.exe49⤵
- Executes dropped EXE
PID:540 -
\??\c:\5bbbtn.exec:\5bbbtn.exe50⤵
- Executes dropped EXE
PID:3584 -
\??\c:\9ttnhb.exec:\9ttnhb.exe51⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vvdvd.exec:\vvdvd.exe52⤵
- Executes dropped EXE
PID:2248 -
\??\c:\fxxrlff.exec:\fxxrlff.exe53⤵
- Executes dropped EXE
PID:1592 -
\??\c:\hhnnhh.exec:\hhnnhh.exe54⤵
- Executes dropped EXE
PID:1180 -
\??\c:\jvpvv.exec:\jvpvv.exe55⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xrffrlr.exec:\xrffrlr.exe56⤵
- Executes dropped EXE
PID:2380 -
\??\c:\bnbbtb.exec:\bnbbtb.exe57⤵
- Executes dropped EXE
PID:2268 -
\??\c:\tbtnbb.exec:\tbtnbb.exe58⤵
- Executes dropped EXE
PID:3024 -
\??\c:\pvvjv.exec:\pvvjv.exe59⤵
- Executes dropped EXE
PID:1676 -
\??\c:\lfxxrlr.exec:\lfxxrlr.exe60⤵
- Executes dropped EXE
PID:2928 -
\??\c:\bhntbh.exec:\bhntbh.exe61⤵
- Executes dropped EXE
PID:4356 -
\??\c:\pdjpv.exec:\pdjpv.exe62⤵
- Executes dropped EXE
PID:908 -
\??\c:\djjdd.exec:\djjdd.exe63⤵
- Executes dropped EXE
PID:4668 -
\??\c:\9xlxfxl.exec:\9xlxfxl.exe64⤵
- Executes dropped EXE
PID:3896 -
\??\c:\tnnhbb.exec:\tnnhbb.exe65⤵
- Executes dropped EXE
PID:2956 -
\??\c:\1pdvj.exec:\1pdvj.exe66⤵
- Executes dropped EXE
PID:1760 -
\??\c:\lrxxrlf.exec:\lrxxrlf.exe67⤵PID:4056
-
\??\c:\5xlfxff.exec:\5xlfxff.exe68⤵PID:4492
-
\??\c:\thhtbt.exec:\thhtbt.exe69⤵PID:2920
-
\??\c:\dvdvp.exec:\dvdvp.exe70⤵PID:1536
-
\??\c:\pppjd.exec:\pppjd.exe71⤵PID:4376
-
\??\c:\xllfrlf.exec:\xllfrlf.exe72⤵PID:4288
-
\??\c:\xxfxrlf.exec:\xxfxrlf.exe73⤵PID:4452
-
\??\c:\hbbtnn.exec:\hbbtnn.exe74⤵PID:4736
-
\??\c:\jjjdp.exec:\jjjdp.exe75⤵PID:4240
-
\??\c:\dppjp.exec:\dppjp.exe76⤵PID:4960
-
\??\c:\xffxxfx.exec:\xffxxfx.exe77⤵PID:2448
-
\??\c:\flrlrff.exec:\flrlrff.exe78⤵PID:4412
-
\??\c:\hbtnhh.exec:\hbtnhh.exe79⤵PID:4072
-
\??\c:\ntttnb.exec:\ntttnb.exe80⤵PID:1716
-
\??\c:\pdvvp.exec:\pdvvp.exe81⤵PID:3208
-
\??\c:\rlfxrll.exec:\rlfxrll.exe82⤵PID:4560
-
\??\c:\3xlxfxl.exec:\3xlxfxl.exe83⤵PID:3480
-
\??\c:\ntnbbb.exec:\ntnbbb.exe84⤵PID:3028
-
\??\c:\bthhnh.exec:\bthhnh.exe85⤵PID:4052
-
\??\c:\7ppjd.exec:\7ppjd.exe86⤵PID:4300
-
\??\c:\xlllffx.exec:\xlllffx.exe87⤵PID:3420
-
\??\c:\ffxxlfr.exec:\ffxxlfr.exe88⤵PID:4320
-
\??\c:\tnbnhb.exec:\tnbnhb.exe89⤵PID:3344
-
\??\c:\9jdpp.exec:\9jdpp.exe90⤵PID:3504
-
\??\c:\vddvv.exec:\vddvv.exe91⤵PID:3536
-
\??\c:\tthhnt.exec:\tthhnt.exe92⤵PID:3140
-
\??\c:\vvpjd.exec:\vvpjd.exe93⤵PID:1620
-
\??\c:\pjvjd.exec:\pjvjd.exe94⤵PID:532
-
\??\c:\rffrxrr.exec:\rffrxrr.exe95⤵PID:2692
-
\??\c:\hbnbhb.exec:\hbnbhb.exe96⤵PID:4696
-
\??\c:\thtnbb.exec:\thtnbb.exe97⤵PID:4000
-
\??\c:\jdjvd.exec:\jdjvd.exe98⤵PID:4168
-
\??\c:\vjpjp.exec:\vjpjp.exe99⤵PID:2044
-
\??\c:\xflffrl.exec:\xflffrl.exe100⤵PID:2656
-
\??\c:\nttnhh.exec:\nttnhh.exe101⤵PID:1384
-
\??\c:\nbnnhh.exec:\nbnnhh.exe102⤵PID:1592
-
\??\c:\pdpdv.exec:\pdpdv.exe103⤵PID:1616
-
\??\c:\vdpjd.exec:\vdpjd.exe104⤵PID:2380
-
\??\c:\1rfxrlf.exec:\1rfxrlf.exe105⤵PID:4440
-
\??\c:\btnnhh.exec:\btnnhh.exe106⤵PID:592
-
\??\c:\ttnhbh.exec:\ttnhbh.exe107⤵PID:1788
-
\??\c:\7pjdp.exec:\7pjdp.exe108⤵PID:2272
-
\??\c:\vppvp.exec:\vppvp.exe109⤵PID:3248
-
\??\c:\ffrrxxf.exec:\ffrrxxf.exe110⤵PID:3316
-
\??\c:\3lllllf.exec:\3lllllf.exe111⤵PID:4068
-
\??\c:\ttbtbt.exec:\ttbtbt.exe112⤵PID:1336
-
\??\c:\dpjvj.exec:\dpjvj.exe113⤵PID:4492
-
\??\c:\vjpjd.exec:\vjpjd.exe114⤵PID:4432
-
\??\c:\rlffxxr.exec:\rlffxxr.exe115⤵PID:4384
-
\??\c:\hntnhh.exec:\hntnhh.exe116⤵PID:748
-
\??\c:\hnnttt.exec:\hnnttt.exe117⤵PID:5048
-
\??\c:\jvdvp.exec:\jvdvp.exe118⤵PID:2916
-
\??\c:\djvdv.exec:\djvdv.exe119⤵PID:1916
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe120⤵PID:3872
-
\??\c:\thnhbt.exec:\thnhbt.exe121⤵PID:1392
-
\??\c:\hbtbtt.exec:\hbtbtt.exe122⤵PID:1600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-