Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 19:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
097c152c6cd4b8b5afabe3bb3fd7c1b0_NEAS.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
097c152c6cd4b8b5afabe3bb3fd7c1b0_NEAS.exe
-
Size
334KB
-
MD5
097c152c6cd4b8b5afabe3bb3fd7c1b0
-
SHA1
d2c4b0d7c6ec58e8c67d5cb3a7b2687916a9309d
-
SHA256
f624e1b231ed994cc85337ee6f550e98c8316cfbd97228a8a1b123036117d093
-
SHA512
33738db857653e7dc0d69add084603efee7a2a2ca16a88db9f20dc9c471aa03a14db3f99763c9d6c7393080f6a1a4bf205a7767a812c9391a3462099900459ee
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LCgnilBxBqwZK2q6sYTsmZDSFdBE0rXE4efi:n3C9BRo/CEilXBG2qZSlSFdBXExi
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4768-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1280-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2564-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2488 bnnbtt.exe 4784 ffxfrxx.exe 4272 vdvvd.exe 1916 llrrxrf.exe 1888 fxfxxxr.exe 2340 lxfffff.exe 5004 nnnnnh.exe 4764 9djdj.exe 4516 thnhhh.exe 2720 bhnnnt.exe 4944 pjvvv.exe 3236 jvppj.exe 3628 5xxxrrl.exe 3644 hhbbnn.exe 3564 9pjdv.exe 1480 tnnhhb.exe 1280 jpjjp.exe 2564 rrxrrxf.exe 3472 3bhhbh.exe 4656 djpjj.exe 2756 ppvpj.exe 4032 lrrrllf.exe 3720 jpdjp.exe 636 flxrrrr.exe 4804 tbhhhh.exe 2592 xrxflxx.exe 1968 lrlfllf.exe 2276 nnnhhb.exe 3744 jjvpj.exe 8 tbhhhh.exe 580 vvddd.exe 1360 xxfxfxr.exe 1632 ttbbbn.exe 2936 xxxlxxl.exe 4360 htnhhh.exe 4752 vpppp.exe 2488 ddvvp.exe 4676 5lfflxf.exe 4600 nthhhb.exe 868 nttttn.exe 3660 pdjpv.exe 1552 fxlfffx.exe 4892 9rrllrl.exe 5008 5hhbtt.exe 780 hnnttt.exe 4764 pjjdv.exe 3724 llrrrll.exe 4484 rflflll.exe 4348 bbnhhh.exe 4944 tttnnn.exe 232 pvvvv.exe 3048 fflllll.exe 3436 nthhtt.exe 3068 btbbbb.exe 812 dvdjj.exe 2320 5frlrxf.exe 4756 fxxllxx.exe 3284 nntttt.exe 3220 nhbtnh.exe 1764 pdvpd.exe 3156 xrxlrll.exe 3348 lxxxrrr.exe 1016 bttnhb.exe 1644 pddvj.exe -
resource yara_rule behavioral2/memory/4768-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2564-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4768 wrote to memory of 2488 4768 097c152c6cd4b8b5afabe3bb3fd7c1b0_NEAS.exe 84 PID 4768 wrote to memory of 2488 4768 097c152c6cd4b8b5afabe3bb3fd7c1b0_NEAS.exe 84 PID 4768 wrote to memory of 2488 4768 097c152c6cd4b8b5afabe3bb3fd7c1b0_NEAS.exe 84 PID 2488 wrote to memory of 4784 2488 bnnbtt.exe 85 PID 2488 wrote to memory of 4784 2488 bnnbtt.exe 85 PID 2488 wrote to memory of 4784 2488 bnnbtt.exe 85 PID 4784 wrote to memory of 4272 4784 ffxfrxx.exe 86 PID 4784 wrote to memory of 4272 4784 ffxfrxx.exe 86 PID 4784 wrote to memory of 4272 4784 ffxfrxx.exe 86 PID 4272 wrote to memory of 1916 4272 vdvvd.exe 87 PID 4272 wrote to memory of 1916 4272 vdvvd.exe 87 PID 4272 wrote to memory of 1916 4272 vdvvd.exe 87 PID 1916 wrote to memory of 1888 1916 llrrxrf.exe 88 PID 1916 wrote to memory of 1888 1916 llrrxrf.exe 88 PID 1916 wrote to memory of 1888 1916 llrrxrf.exe 88 PID 1888 wrote to memory of 2340 1888 fxfxxxr.exe 89 PID 1888 wrote to memory of 2340 1888 fxfxxxr.exe 89 PID 1888 wrote to memory of 2340 1888 fxfxxxr.exe 89 PID 2340 wrote to memory of 5004 2340 lxfffff.exe 91 PID 2340 wrote to memory of 5004 2340 lxfffff.exe 91 PID 2340 wrote to memory of 5004 2340 lxfffff.exe 91 PID 5004 wrote to memory of 4764 5004 nnnnnh.exe 92 PID 5004 wrote to memory of 4764 5004 nnnnnh.exe 92 PID 5004 wrote to memory of 4764 5004 nnnnnh.exe 92 PID 4764 wrote to memory of 4516 4764 9djdj.exe 93 PID 4764 wrote to memory of 4516 4764 9djdj.exe 93 PID 4764 wrote to memory of 4516 4764 9djdj.exe 93 PID 4516 wrote to memory of 2720 4516 thnhhh.exe 94 PID 4516 wrote to memory of 2720 4516 thnhhh.exe 94 PID 4516 wrote to memory of 2720 4516 thnhhh.exe 94 PID 2720 wrote to memory of 4944 2720 bhnnnt.exe 95 PID 2720 wrote to memory of 4944 2720 bhnnnt.exe 95 PID 2720 wrote to memory of 4944 2720 bhnnnt.exe 95 PID 4944 wrote to memory of 3236 4944 pjvvv.exe 97 PID 4944 wrote to memory of 3236 4944 pjvvv.exe 97 PID 4944 wrote to memory of 3236 4944 pjvvv.exe 97 PID 3236 wrote to memory of 3628 3236 jvppj.exe 98 PID 3236 wrote to memory of 3628 3236 jvppj.exe 98 PID 3236 wrote to memory of 3628 3236 jvppj.exe 98 PID 3628 wrote to memory of 3644 3628 5xxxrrl.exe 100 PID 3628 wrote to memory of 3644 3628 5xxxrrl.exe 100 PID 3628 wrote to memory of 3644 3628 5xxxrrl.exe 100 PID 3644 wrote to memory of 3564 3644 hhbbnn.exe 101 PID 3644 wrote to memory of 3564 3644 hhbbnn.exe 101 PID 3644 wrote to memory of 3564 3644 hhbbnn.exe 101 PID 3564 wrote to memory of 1480 3564 9pjdv.exe 102 PID 3564 wrote to memory of 1480 3564 9pjdv.exe 102 PID 3564 wrote to memory of 1480 3564 9pjdv.exe 102 PID 1480 wrote to memory of 1280 1480 tnnhhb.exe 103 PID 1480 wrote to memory of 1280 1480 tnnhhb.exe 103 PID 1480 wrote to memory of 1280 1480 tnnhhb.exe 103 PID 1280 wrote to memory of 2564 1280 jpjjp.exe 104 PID 1280 wrote to memory of 2564 1280 jpjjp.exe 104 PID 1280 wrote to memory of 2564 1280 jpjjp.exe 104 PID 2564 wrote to memory of 3472 2564 rrxrrxf.exe 105 PID 2564 wrote to memory of 3472 2564 rrxrrxf.exe 105 PID 2564 wrote to memory of 3472 2564 rrxrrxf.exe 105 PID 3472 wrote to memory of 4656 3472 3bhhbh.exe 106 PID 3472 wrote to memory of 4656 3472 3bhhbh.exe 106 PID 3472 wrote to memory of 4656 3472 3bhhbh.exe 106 PID 4656 wrote to memory of 2756 4656 djpjj.exe 107 PID 4656 wrote to memory of 2756 4656 djpjj.exe 107 PID 4656 wrote to memory of 2756 4656 djpjj.exe 107 PID 2756 wrote to memory of 4032 2756 ppvpj.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\097c152c6cd4b8b5afabe3bb3fd7c1b0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\097c152c6cd4b8b5afabe3bb3fd7c1b0_NEAS.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\bnnbtt.exec:\bnnbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\ffxfrxx.exec:\ffxfrxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\vdvvd.exec:\vdvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\llrrxrf.exec:\llrrxrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\lxfffff.exec:\lxfffff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\nnnnnh.exec:\nnnnnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\9djdj.exec:\9djdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\thnhhh.exec:\thnhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\bhnnnt.exec:\bhnnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\pjvvv.exec:\pjvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\jvppj.exec:\jvppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\5xxxrrl.exec:\5xxxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\hhbbnn.exec:\hhbbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\9pjdv.exec:\9pjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\tnnhhb.exec:\tnnhhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\jpjjp.exec:\jpjjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\rrxrrxf.exec:\rrxrrxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\3bhhbh.exec:\3bhhbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\djpjj.exec:\djpjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\ppvpj.exec:\ppvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\lrrrllf.exec:\lrrrllf.exe23⤵
- Executes dropped EXE
PID:4032 -
\??\c:\jpdjp.exec:\jpdjp.exe24⤵
- Executes dropped EXE
PID:3720 -
\??\c:\flxrrrr.exec:\flxrrrr.exe25⤵
- Executes dropped EXE
PID:636 -
\??\c:\tbhhhh.exec:\tbhhhh.exe26⤵
- Executes dropped EXE
PID:4804 -
\??\c:\xrxflxx.exec:\xrxflxx.exe27⤵
- Executes dropped EXE
PID:2592 -
\??\c:\lrlfllf.exec:\lrlfllf.exe28⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nnnhhb.exec:\nnnhhb.exe29⤵
- Executes dropped EXE
PID:2276 -
\??\c:\jjvpj.exec:\jjvpj.exe30⤵
- Executes dropped EXE
PID:3744 -
\??\c:\tbhhhh.exec:\tbhhhh.exe31⤵
- Executes dropped EXE
PID:8 -
\??\c:\vvddd.exec:\vvddd.exe32⤵
- Executes dropped EXE
PID:580 -
\??\c:\xxfxfxr.exec:\xxfxfxr.exe33⤵
- Executes dropped EXE
PID:1360 -
\??\c:\ttbbbn.exec:\ttbbbn.exe34⤵
- Executes dropped EXE
PID:1632 -
\??\c:\xxxlxxl.exec:\xxxlxxl.exe35⤵
- Executes dropped EXE
PID:2936 -
\??\c:\bnbtbb.exec:\bnbtbb.exe36⤵PID:4340
-
\??\c:\htnhhh.exec:\htnhhh.exe37⤵
- Executes dropped EXE
PID:4360 -
\??\c:\vpppp.exec:\vpppp.exe38⤵
- Executes dropped EXE
PID:4752 -
\??\c:\ddvvp.exec:\ddvvp.exe39⤵
- Executes dropped EXE
PID:2488 -
\??\c:\5lfflxf.exec:\5lfflxf.exe40⤵
- Executes dropped EXE
PID:4676 -
\??\c:\nthhhb.exec:\nthhhb.exe41⤵
- Executes dropped EXE
PID:4600 -
\??\c:\nttttn.exec:\nttttn.exe42⤵
- Executes dropped EXE
PID:868 -
\??\c:\pdjpv.exec:\pdjpv.exe43⤵
- Executes dropped EXE
PID:3660 -
\??\c:\fxlfffx.exec:\fxlfffx.exe44⤵
- Executes dropped EXE
PID:1552 -
\??\c:\9rrllrl.exec:\9rrllrl.exe45⤵
- Executes dropped EXE
PID:4892 -
\??\c:\5hhbtt.exec:\5hhbtt.exe46⤵
- Executes dropped EXE
PID:5008 -
\??\c:\hnnttt.exec:\hnnttt.exe47⤵
- Executes dropped EXE
PID:780 -
\??\c:\pjjdv.exec:\pjjdv.exe48⤵
- Executes dropped EXE
PID:4764 -
\??\c:\llrrrll.exec:\llrrrll.exe49⤵
- Executes dropped EXE
PID:3724 -
\??\c:\rflflll.exec:\rflflll.exe50⤵
- Executes dropped EXE
PID:4484 -
\??\c:\bbnhhh.exec:\bbnhhh.exe51⤵
- Executes dropped EXE
PID:4348 -
\??\c:\tttnnn.exec:\tttnnn.exe52⤵
- Executes dropped EXE
PID:4944 -
\??\c:\pvvvv.exec:\pvvvv.exe53⤵
- Executes dropped EXE
PID:232 -
\??\c:\fflllll.exec:\fflllll.exe54⤵
- Executes dropped EXE
PID:3048 -
\??\c:\nthhtt.exec:\nthhtt.exe55⤵
- Executes dropped EXE
PID:3436 -
\??\c:\btbbbb.exec:\btbbbb.exe56⤵
- Executes dropped EXE
PID:3068 -
\??\c:\dvdjj.exec:\dvdjj.exe57⤵
- Executes dropped EXE
PID:812 -
\??\c:\5frlrxf.exec:\5frlrxf.exe58⤵
- Executes dropped EXE
PID:2320 -
\??\c:\fxxllxx.exec:\fxxllxx.exe59⤵
- Executes dropped EXE
PID:4756 -
\??\c:\nntttt.exec:\nntttt.exe60⤵
- Executes dropped EXE
PID:3284 -
\??\c:\nhbtnh.exec:\nhbtnh.exe61⤵
- Executes dropped EXE
PID:3220 -
\??\c:\pdvpd.exec:\pdvpd.exe62⤵
- Executes dropped EXE
PID:1764 -
\??\c:\xrxlrll.exec:\xrxlrll.exe63⤵
- Executes dropped EXE
PID:3156 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe64⤵
- Executes dropped EXE
PID:3348 -
\??\c:\bttnhb.exec:\bttnhb.exe65⤵
- Executes dropped EXE
PID:1016 -
\??\c:\pddvj.exec:\pddvj.exe66⤵
- Executes dropped EXE
PID:1644 -
\??\c:\1vvjd.exec:\1vvjd.exe67⤵PID:3224
-
\??\c:\fxfxrfx.exec:\fxfxrfx.exe68⤵PID:3720
-
\??\c:\lfrlflx.exec:\lfrlflx.exe69⤵PID:4760
-
\??\c:\htnhhb.exec:\htnhhb.exe70⤵PID:3204
-
\??\c:\5pjpp.exec:\5pjpp.exe71⤵PID:2112
-
\??\c:\pjjdd.exec:\pjjdd.exe72⤵PID:3552
-
\??\c:\rfxrllf.exec:\rfxrllf.exe73⤵PID:1968
-
\??\c:\3nnbtt.exec:\3nnbtt.exe74⤵PID:3096
-
\??\c:\htnbth.exec:\htnbth.exe75⤵PID:4536
-
\??\c:\pjjjv.exec:\pjjjv.exe76⤵PID:5012
-
\??\c:\llllfll.exec:\llllfll.exe77⤵PID:372
-
\??\c:\rxlxrlf.exec:\rxlxrlf.exe78⤵PID:4208
-
\??\c:\btbnbt.exec:\btbnbt.exe79⤵PID:4280
-
\??\c:\htbtnn.exec:\htbtnn.exe80⤵PID:1632
-
\??\c:\frrlfxr.exec:\frrlfxr.exe81⤵PID:4376
-
\??\c:\nbhtnn.exec:\nbhtnn.exe82⤵PID:2560
-
\??\c:\vddpd.exec:\vddpd.exe83⤵PID:4068
-
\??\c:\jdvpp.exec:\jdvpp.exe84⤵PID:4240
-
\??\c:\7ffrlfx.exec:\7ffrlfx.exe85⤵PID:1720
-
\??\c:\bnnbtn.exec:\bnnbtn.exe86⤵PID:1032
-
\??\c:\5btnhb.exec:\5btnhb.exe87⤵PID:1572
-
\??\c:\pjppp.exec:\pjppp.exe88⤵PID:1820
-
\??\c:\lffllxl.exec:\lffllxl.exe89⤵PID:2216
-
\??\c:\xlxlrrr.exec:\xlxlrrr.exe90⤵PID:2260
-
\??\c:\9hbttt.exec:\9hbttt.exe91⤵PID:1692
-
\??\c:\bbbthh.exec:\bbbthh.exe92⤵PID:3612
-
\??\c:\jpdpj.exec:\jpdpj.exe93⤵PID:1176
-
\??\c:\xxxrxfx.exec:\xxxrxfx.exe94⤵PID:4516
-
\??\c:\3nhhbh.exec:\3nhhbh.exe95⤵PID:1900
-
\??\c:\pdjdp.exec:\pdjdp.exe96⤵PID:2660
-
\??\c:\rlfrlfr.exec:\rlfrlfr.exe97⤵PID:4568
-
\??\c:\nnhtnh.exec:\nnhtnh.exe98⤵PID:3604
-
\??\c:\vvpvj.exec:\vvpvj.exe99⤵PID:5048
-
\??\c:\9rfxrrr.exec:\9rfxrrr.exe100⤵PID:892
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe101⤵PID:3104
-
\??\c:\bbhbhh.exec:\bbhbhh.exe102⤵PID:2512
-
\??\c:\pjpvv.exec:\pjpvv.exe103⤵PID:4112
-
\??\c:\vvdpp.exec:\vvdpp.exe104⤵PID:3556
-
\??\c:\rrlfxxx.exec:\rrlfxxx.exe105⤵PID:4404
-
\??\c:\hhtthn.exec:\hhtthn.exe106⤵PID:224
-
\??\c:\jvjjj.exec:\jvjjj.exe107⤵PID:4644
-
\??\c:\vpvpv.exec:\vpvpv.exe108⤵PID:2668
-
\??\c:\5fffxxx.exec:\5fffxxx.exe109⤵PID:2756
-
\??\c:\xllffrr.exec:\xllffrr.exe110⤵PID:3492
-
\??\c:\btbbbb.exec:\btbbbb.exe111⤵PID:4052
-
\??\c:\hhhtnh.exec:\hhhtnh.exe112⤵PID:1408
-
\??\c:\jvjjp.exec:\jvjjp.exe113⤵PID:4328
-
\??\c:\ddjjj.exec:\ddjjj.exe114⤵PID:1220
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe115⤵PID:3540
-
\??\c:\rllllxx.exec:\rllllxx.exe116⤵PID:4888
-
\??\c:\nntttn.exec:\nntttn.exe117⤵PID:816
-
\??\c:\ddddd.exec:\ddddd.exe118⤵PID:3700
-
\??\c:\7pvdp.exec:\7pvdp.exe119⤵PID:1064
-
\??\c:\3xxxrlf.exec:\3xxxrlf.exe120⤵PID:4576
-
\??\c:\lffflll.exec:\lffflll.exe121⤵PID:4476
-
\??\c:\nhnnnn.exec:\nhnnnn.exe122⤵PID:1360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-