Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14/01/2024, 06:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a78961125ba475b29dcf408ce33cf38.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
5a78961125ba475b29dcf408ce33cf38.exe
-
Size
66KB
-
MD5
5a78961125ba475b29dcf408ce33cf38
-
SHA1
2eb6b3f980766baedc4f62a23efee7716e1edb76
-
SHA256
53ea18ee11da0d4c60509174a9c09f6eb93a2d634568758345538721883b6ba3
-
SHA512
c4dbab8c5dcc88eef5135b235ca663858cac2f222d8ab63b5e1fa2de861947c89bd0bb89758ed69655c5242447e4975cba87ff5a71b3e9587374c5782fe1e8b5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qjH4f:ymb3NkkiQ3mdBjFIj+qjH4f
Malware Config
Signatures
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral2/memory/4980-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/856-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2252-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3868-455-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-443-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-441-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-385-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-374-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-342-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/804-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3140-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-320-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1760-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-190-0x0000000002030000-0x000000000203C000-memory.dmp family_blackmoon behavioral2/memory/2736-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/896-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1840-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/100-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2808 thnhbt.exe 1640 9tbntn.exe 4936 dvdpv.exe 2856 jppdp.exe 3608 5rrrffx.exe 4588 djvpd.exe 468 rxrrxrx.exe 2668 jvvjd.exe 100 jjjdj.exe 1840 9lxfxrr.exe 856 vvpjv.exe 4208 xrrfxxf.exe 4124 dpjdv.exe 2776 httnhb.exe 1168 vvjjv.exe 3668 xrfrrlx.exe 4108 1ttnhh.exe 4488 5jdpd.exe 432 nnbnnh.exe 2992 jdpdj.exe 896 7nnhbt.exe 4832 jdjdv.exe 3868 3tbbtt.exe 4148 vvpvj.exe 4156 nbnhnh.exe 2736 ppjjd.exe 2436 hbtthn.exe 4848 1tnntn.exe 1436 llrrxxf.exe 1020 nbnbhh.exe 4956 fffxrxr.exe 1324 tbbtht.exe 1476 ddppv.exe 4312 3fffrxr.exe 4892 jdddv.exe 1972 dvpvj.exe 4884 frxlflx.exe 540 frlrrxr.exe 1760 nhhhhb.exe 2252 3lrlfff.exe 1616 nbtntt.exe 3500 pjddp.exe 4676 MusNotification.exe 1500 hhhhhh.exe 3464 jjjdv.exe 4092 1djjj.exe 3436 nntbbb.exe 3988 jjjjd.exe 4160 flllfll.exe 1004 1dddd.exe 2432 rfffllr.exe 3140 ttbnnb.exe 804 xfrrxfr.exe 4992 thttnb.exe 4152 frrrrxx.exe 4068 rxrxxff.exe 972 5lrlfxx.exe 4848 1tnntn.exe 3972 9xlffff.exe 1864 jdjjd.exe 4592 lllfxxx.exe 5036 thhhhh.exe 4760 3vvdv.exe 4312 3fffrxr.exe -
resource yara_rule behavioral2/memory/4980-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/856-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-306-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3868-455-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-443-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-441-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-399-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-385-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-374-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-342-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-335-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/804-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-320-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-312-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-225-0x00000000004B0000-0x00000000004C0000-memory.dmp upx behavioral2/memory/4956-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/896-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/100-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-2-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4980 wrote to memory of 2808 4980 5a78961125ba475b29dcf408ce33cf38.exe 142 PID 4980 wrote to memory of 2808 4980 5a78961125ba475b29dcf408ce33cf38.exe 142 PID 4980 wrote to memory of 2808 4980 5a78961125ba475b29dcf408ce33cf38.exe 142 PID 2808 wrote to memory of 1640 2808 thnhbt.exe 141 PID 2808 wrote to memory of 1640 2808 thnhbt.exe 141 PID 2808 wrote to memory of 1640 2808 thnhbt.exe 141 PID 1640 wrote to memory of 4936 1640 9tbntn.exe 140 PID 1640 wrote to memory of 4936 1640 9tbntn.exe 140 PID 1640 wrote to memory of 4936 1640 9tbntn.exe 140 PID 4936 wrote to memory of 2856 4936 dvdpv.exe 17 PID 4936 wrote to memory of 2856 4936 dvdpv.exe 17 PID 4936 wrote to memory of 2856 4936 dvdpv.exe 17 PID 2856 wrote to memory of 3608 2856 jppdp.exe 139 PID 2856 wrote to memory of 3608 2856 jppdp.exe 139 PID 2856 wrote to memory of 3608 2856 jppdp.exe 139 PID 3608 wrote to memory of 4588 3608 5rrrffx.exe 138 PID 3608 wrote to memory of 4588 3608 5rrrffx.exe 138 PID 3608 wrote to memory of 4588 3608 5rrrffx.exe 138 PID 4588 wrote to memory of 468 4588 djvpd.exe 137 PID 4588 wrote to memory of 468 4588 djvpd.exe 137 PID 4588 wrote to memory of 468 4588 djvpd.exe 137 PID 468 wrote to memory of 2668 468 rxrrxrx.exe 136 PID 468 wrote to memory of 2668 468 rxrrxrx.exe 136 PID 468 wrote to memory of 2668 468 rxrrxrx.exe 136 PID 2668 wrote to memory of 100 2668 jvvjd.exe 135 PID 2668 wrote to memory of 100 2668 jvvjd.exe 135 PID 2668 wrote to memory of 100 2668 jvvjd.exe 135 PID 100 wrote to memory of 1840 100 jjjdj.exe 18 PID 100 wrote to memory of 1840 100 jjjdj.exe 18 PID 100 wrote to memory of 1840 100 jjjdj.exe 18 PID 1840 wrote to memory of 856 1840 9lxfxrr.exe 132 PID 1840 wrote to memory of 856 1840 9lxfxrr.exe 132 PID 1840 wrote to memory of 856 1840 9lxfxrr.exe 132 PID 856 wrote to memory of 4208 856 vvpjv.exe 204 PID 856 wrote to memory of 4208 856 vvpjv.exe 204 PID 856 wrote to memory of 4208 856 vvpjv.exe 204 PID 4208 wrote to memory of 4124 4208 xrrfxxf.exe 130 PID 4208 wrote to memory of 4124 4208 xrrfxxf.exe 130 PID 4208 wrote to memory of 4124 4208 xrrfxxf.exe 130 PID 4124 wrote to memory of 2776 4124 dpjdv.exe 129 PID 4124 wrote to memory of 2776 4124 dpjdv.exe 129 PID 4124 wrote to memory of 2776 4124 dpjdv.exe 129 PID 2776 wrote to memory of 1168 2776 httnhb.exe 128 PID 2776 wrote to memory of 1168 2776 httnhb.exe 128 PID 2776 wrote to memory of 1168 2776 httnhb.exe 128 PID 1168 wrote to memory of 3668 1168 vvjjv.exe 127 PID 1168 wrote to memory of 3668 1168 vvjjv.exe 127 PID 1168 wrote to memory of 3668 1168 vvjjv.exe 127 PID 3668 wrote to memory of 4108 3668 xrfrrlx.exe 126 PID 3668 wrote to memory of 4108 3668 xrfrrlx.exe 126 PID 3668 wrote to memory of 4108 3668 xrfrrlx.exe 126 PID 4108 wrote to memory of 4488 4108 1ttnhh.exe 125 PID 4108 wrote to memory of 4488 4108 1ttnhh.exe 125 PID 4108 wrote to memory of 4488 4108 1ttnhh.exe 125 PID 4488 wrote to memory of 432 4488 5jdpd.exe 124 PID 4488 wrote to memory of 432 4488 5jdpd.exe 124 PID 4488 wrote to memory of 432 4488 5jdpd.exe 124 PID 432 wrote to memory of 2992 432 nnbnnh.exe 123 PID 432 wrote to memory of 2992 432 nnbnnh.exe 123 PID 432 wrote to memory of 2992 432 nnbnnh.exe 123 PID 2992 wrote to memory of 896 2992 jdpdj.exe 122 PID 2992 wrote to memory of 896 2992 jdpdj.exe 122 PID 2992 wrote to memory of 896 2992 jdpdj.exe 122 PID 896 wrote to memory of 4832 896 7nnhbt.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a78961125ba475b29dcf408ce33cf38.exe"C:\Users\Admin\AppData\Local\Temp\5a78961125ba475b29dcf408ce33cf38.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\thnhbt.exec:\thnhbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808
-
-
\??\c:\jppdp.exec:\jppdp.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\5rrrffx.exec:\5rrrffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608
-
-
\??\c:\9lxfxrr.exec:\9lxfxrr.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\vvpjv.exec:\vvpjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856
-
-
\??\c:\bhnntb.exec:\bhnntb.exe1⤵PID:4892
-
\??\c:\flfrxlf.exec:\flfrxlf.exe2⤵PID:764
-
-
\??\c:\7xxxrrr.exec:\7xxxrrr.exe1⤵PID:4092
-
\??\c:\nntbbb.exec:\nntbbb.exe2⤵
- Executes dropped EXE
PID:3436
-
-
\??\c:\1xxfflf.exec:\1xxfflf.exe1⤵PID:4160
-
\??\c:\ttthnt.exec:\ttthnt.exe2⤵PID:1564
-
-
\??\c:\hbhhhn.exec:\hbhhhn.exe1⤵PID:972
-
\??\c:\9vvvp.exec:\9vvvp.exe2⤵PID:4848
-
\??\c:\9xlffff.exec:\9xlffff.exe3⤵
- Executes dropped EXE
PID:3972
-
-
\??\c:\llrrxxf.exec:\llrrxxf.exe3⤵
- Executes dropped EXE
PID:1436
-
-
-
\??\c:\lllfxxx.exec:\lllfxxx.exe1⤵
- Executes dropped EXE
PID:4592 -
\??\c:\thhhhh.exec:\thhhhh.exe2⤵
- Executes dropped EXE
PID:5036
-
-
\??\c:\bnbhht.exec:\bnbhht.exe1⤵PID:4036
-
\??\c:\3dpdj.exec:\3dpdj.exe2⤵PID:3472
-
\??\c:\thnhbb.exec:\thnhbb.exe3⤵PID:4488
-
\??\c:\nnbnnh.exec:\nnbnnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\tbhhbb.exec:\tbhhbb.exe5⤵PID:864
-
\??\c:\vddjp.exec:\vddjp.exe6⤵PID:4444
-
\??\c:\pdjdd.exec:\pdjdd.exe7⤵PID:528
-
\??\c:\3bbbbh.exec:\3bbbbh.exe8⤵PID:3988
-
\??\c:\jpjdj.exec:\jpjdj.exe9⤵PID:664
-
\??\c:\frffxff.exec:\frffxff.exe10⤵PID:5100
-
-
-
-
-
-
-
-
-
\??\c:\nhbbtb.exec:\nhbbtb.exe3⤵PID:2236
-
\??\c:\vpdvj.exec:\vpdvj.exe4⤵PID:1044
-
\??\c:\btbbbt.exec:\btbbbt.exe5⤵PID:4340
-
\??\c:\3hnthn.exec:\3hnthn.exe6⤵PID:3964
-
\??\c:\rflrrlx.exec:\rflrrlx.exe7⤵PID:1220
-
\??\c:\7bhhhh.exec:\7bhhhh.exe8⤵PID:4568
-
\??\c:\vvddd.exec:\vvddd.exe9⤵PID:4968
-
\??\c:\9rrrxfr.exec:\9rrrxfr.exe10⤵PID:2560
-
\??\c:\bnhtnt.exec:\bnhtnt.exe11⤵PID:4356
-
\??\c:\rrffrrr.exec:\rrffrrr.exe12⤵PID:3640
-
\??\c:\btbbbb.exec:\btbbbb.exe13⤵PID:4548
-
\??\c:\htthtb.exec:\htthtb.exe14⤵PID:4588
-
\??\c:\vvddv.exec:\vvddv.exe15⤵PID:4744
-
\??\c:\xrllffx.exec:\xrllffx.exe16⤵PID:2444
-
\??\c:\hnnnnn.exec:\hnnnnn.exe17⤵PID:4616
-
\??\c:\pdpdv.exec:\pdpdv.exe18⤵PID:5096
-
\??\c:\xrrfxxf.exec:\xrrfxxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\tntttt.exec:\tntttt.exe20⤵PID:1716
-
\??\c:\djpjj.exec:\djpjj.exe21⤵PID:532
-
\??\c:\rxlfxxx.exec:\rxlfxxx.exe22⤵PID:4648
-
\??\c:\djdpp.exec:\djdpp.exe23⤵PID:4492
-
\??\c:\xxrllrr.exec:\xxrllrr.exe24⤵PID:4104
-
\??\c:\tttttt.exec:\tttttt.exe25⤵PID:1576
-
\??\c:\nhtbtt.exec:\nhtbtt.exe26⤵PID:768
-
\??\c:\ppvvp.exec:\ppvvp.exe27⤵PID:4036
-
\??\c:\ffffrlx.exec:\ffffrlx.exe28⤵PID:3152
-
\??\c:\ttnntt.exec:\ttnntt.exe29⤵PID:4836
-
\??\c:\9djjd.exec:\9djjd.exe30⤵PID:3956
-
\??\c:\rxrxxff.exec:\rxrxxff.exe31⤵
- Executes dropped EXE
PID:4068 -
\??\c:\bbbhhh.exec:\bbbhhh.exe32⤵PID:4444
-
\??\c:\ppvvj.exec:\ppvvj.exe33⤵PID:4468
-
\??\c:\hnnttt.exec:\hnnttt.exe34⤵PID:220
-
\??\c:\rxlrlll.exec:\rxlrlll.exe35⤵PID:2296
-
\??\c:\nnbhtb.exec:\nnbhtb.exe36⤵PID:4896
-
\??\c:\ddddp.exec:\ddddp.exe37⤵PID:2016
-
\??\c:\5nnnhn.exec:\5nnnhn.exe38⤵PID:3416
-
\??\c:\jjpjd.exec:\jjpjd.exe39⤵PID:4744
-
\??\c:\rflfxxr.exec:\rflfxxr.exe40⤵PID:3632
-
\??\c:\httnnn.exec:\httnnn.exe41⤵PID:4456
-
\??\c:\9rxxxxx.exec:\9rxxxxx.exe42⤵PID:3660
-
\??\c:\9httbb.exec:\9httbb.exe43⤵PID:1100
-
\??\c:\llllllr.exec:\llllllr.exe44⤵PID:3020
-
\??\c:\nbnnhn.exec:\nbnnhn.exe45⤵PID:3400
-
\??\c:\vpppj.exec:\vpppj.exe46⤵PID:828
-
\??\c:\7bnhtt.exec:\7bnhtt.exe47⤵PID:1896
-
\??\c:\jdjjd.exec:\jdjjd.exe48⤵PID:3380
-
\??\c:\llrrllr.exec:\llrrllr.exe49⤵PID:1576
-
\??\c:\1djjj.exec:\1djjj.exe50⤵
- Executes dropped EXE
PID:4092 -
\??\c:\rxxrrff.exec:\rxxrrff.exe51⤵PID:3376
-
\??\c:\hnttnt.exec:\hnttnt.exe52⤵PID:4672
-
\??\c:\rxfxffr.exec:\rxfxffr.exe53⤵PID:4156
-
\??\c:\nbnnhh.exec:\nbnnhh.exe54⤵PID:664
-
\??\c:\pjjvj.exec:\pjjvj.exe55⤵PID:376
-
\??\c:\htbtnh.exec:\htbtnh.exe56⤵PID:4936
-
\??\c:\vjvpd.exec:\vjvpd.exe57⤵PID:220
-
\??\c:\fffxrrl.exec:\fffxrrl.exe58⤵PID:3828
-
\??\c:\bbnntt.exec:\bbnntt.exe59⤵PID:4896
-
\??\c:\fflrxfx.exec:\fflrxfx.exe60⤵PID:4552
-
\??\c:\7hnnhh.exec:\7hnnhh.exe61⤵PID:2444
-
\??\c:\vpppd.exec:\vpppd.exe62⤵PID:1972
-
\??\c:\xlrrlrl.exec:\xlrrlrl.exe63⤵PID:3632
-
\??\c:\9dvvj.exec:\9dvvj.exe64⤵PID:1512
-
\??\c:\lffxrxx.exec:\lffxrxx.exe65⤵PID:3832
-
\??\c:\ddppp.exec:\ddppp.exe66⤵PID:1100
-
\??\c:\rlrrlrx.exec:\rlrrlrx.exe67⤵PID:2024
-
\??\c:\nbnbbh.exec:\nbnbbh.exe68⤵PID:4108
-
\??\c:\ffxxffr.exec:\ffxxffr.exe69⤵PID:828
-
\??\c:\htbbbb.exec:\htbbbb.exe70⤵PID:216
-
\??\c:\pppjd.exec:\pppjd.exe71⤵PID:4556
-
\??\c:\7lxflrr.exec:\7lxflrr.exe72⤵PID:3616
-
\??\c:\hhnhhh.exec:\hhnhhh.exe73⤵PID:2236
-
\??\c:\jpjvd.exec:\jpjvd.exe74⤵PID:3956
-
\??\c:\nntnhn.exec:\nntnhn.exe75⤵PID:4068
-
\??\c:\dvjjd.exec:\dvjjd.exe76⤵PID:4404
-
\??\c:\flfflrf.exec:\flfflrf.exe77⤵PID:4532
-
\??\c:\btbhhn.exec:\btbhhn.exe78⤵PID:4416
-
\??\c:\9dpjj.exec:\9dpjj.exe79⤵PID:2296
-
\??\c:\pppjd.exec:\pppjd.exe80⤵PID:4892
-
\??\c:\5lxxrrr.exec:\5lxxrrr.exe81⤵PID:4004
-
\??\c:\djppp.exec:\djppp.exe82⤵PID:2852
-
\??\c:\nhhhbb.exec:\nhhhbb.exe83⤵PID:1552
-
\??\c:\7ppjj.exec:\7ppjj.exe84⤵PID:1252
-
\??\c:\1xxxrrr.exec:\1xxxrrr.exe85⤵PID:1452
-
\??\c:\tnbbtt.exec:\tnbbtt.exe86⤵PID:4660
-
\??\c:\pjjpv.exec:\pjjpv.exe87⤵PID:1420
-
\??\c:\nhtntt.exec:\nhtntt.exe88⤵PID:4648
-
\??\c:\dpddp.exec:\dpddp.exe89⤵PID:2024
-
\??\c:\nnnbth.exec:\nnnbth.exe90⤵PID:768
-
\??\c:\7lrrlrr.exec:\7lrrlrr.exe91⤵PID:896
-
\??\c:\thhttt.exec:\thhttt.exe92⤵PID:2432
-
\??\c:\llxfxxr.exec:\llxfxxr.exe93⤵PID:2236
-
\??\c:\7tttnn.exec:\7tttnn.exe94⤵PID:3968
-
\??\c:\dvvpp.exec:\dvvpp.exe95⤵PID:4068
-
\??\c:\jvdvj.exec:\jvdvj.exe96⤵PID:4404
-
\??\c:\rrrrlll.exec:\rrrrlll.exe97⤵PID:2696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\xxxxlrr.exec:\xxxxlrr.exe78⤵PID:3316
-
\??\c:\1btbhn.exec:\1btbhn.exe79⤵PID:2344
-
\??\c:\1jvvv.exec:\1jvvv.exe80⤵PID:2244
-
\??\c:\5pvpj.exec:\5pvpj.exe81⤵PID:4700
-
\??\c:\lrxxxxl.exec:\lrxxxxl.exe82⤵PID:2696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\fxxllll.exec:\fxxllll.exe29⤵PID:3472
-
\??\c:\ddpjp.exec:\ddpjp.exe30⤵PID:4568
-
\??\c:\llrxllf.exec:\llrxllf.exe31⤵PID:4844
-
\??\c:\bbnntt.exec:\bbnntt.exe32⤵PID:3880
-
\??\c:\vpppp.exec:\vpppp.exe33⤵PID:4468
-
\??\c:\fxllrrf.exec:\fxllrrf.exe34⤵PID:4636
-
\??\c:\5pvdd.exec:\5pvdd.exe35⤵PID:4936
-
\??\c:\pppvv.exec:\pppvv.exe36⤵PID:208
-
\??\c:\xxllrrl.exec:\xxllrrl.exe37⤵PID:4892
-
\??\c:\nbhntt.exec:\nbhntt.exe38⤵PID:2156
-
\??\c:\vvpvv.exec:\vvpvv.exe39⤵PID:2900
-
\??\c:\lllfxfx.exec:\lllfxfx.exe40⤵PID:3468
-
\??\c:\nbhhtt.exec:\nbhhtt.exe41⤵PID:2444
-
\??\c:\1rrrflx.exec:\1rrrflx.exe42⤵PID:856
-
-
-
-
-
\??\c:\ddjjd.exec:\ddjjd.exe39⤵PID:1636
-
\??\c:\1xfxxxr.exec:\1xfxxxr.exe40⤵PID:4892
-
\??\c:\nttttt.exec:\nttttt.exe41⤵PID:5116
-
-
-
\??\c:\rrffxll.exec:\rrffxll.exe40⤵PID:3464
-
\??\c:\ffrxfff.exec:\ffrxfff.exe41⤵PID:1608
-
-
-
-
-
-
-
-
-
\??\c:\rlllflf.exec:\rlllflf.exe34⤵PID:4312
-
\??\c:\lfxlllx.exec:\lfxlllx.exe35⤵PID:912
-
\??\c:\7vppp.exec:\7vppp.exe36⤵PID:4700
-
\??\c:\lffffff.exec:\lffffff.exe37⤵PID:1252
-
\??\c:\1frlxfl.exec:\1frlxfl.exe38⤵PID:4844
-
\??\c:\frxrxxl.exec:\frxrxxl.exe39⤵PID:1996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\rxrrxrx.exec:\rxrrxrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\dpddd.exec:\dpddd.exe1⤵PID:1500
-
\??\c:\jjjdv.exec:\jjjdv.exe2⤵
- Executes dropped EXE
PID:3464 -
\??\c:\llrxxfx.exec:\llrxxfx.exe3⤵PID:3136
-
\??\c:\ttbtbb.exec:\ttbtbb.exe4⤵PID:1580
-
\??\c:\ddpvp.exec:\ddpvp.exe5⤵PID:2860
-
\??\c:\7rxfxxx.exec:\7rxfxxx.exe6⤵PID:4224
-
\??\c:\7fllfll.exec:\7fllfll.exe7⤵PID:2196
-
\??\c:\bbnnnt.exec:\bbnnnt.exe8⤵PID:3416
-
\??\c:\jpvjp.exec:\jpvjp.exe9⤵PID:4516
-
\??\c:\rrrlflf.exec:\rrrlflf.exe10⤵PID:5096
-
-
-
-
-
-
-
-
-
-
\??\c:\dpdvp.exec:\dpdvp.exe1⤵PID:3988
-
\??\c:\flllfll.exec:\flllfll.exe2⤵
- Executes dropped EXE
PID:4160 -
\??\c:\1dddd.exec:\1dddd.exe3⤵
- Executes dropped EXE
PID:1004
-
-
-
\??\c:\jddjp.exec:\jddjp.exe1⤵PID:3868
-
\??\c:\htbhbh.exec:\htbhbh.exe2⤵PID:3896
-
\??\c:\9pjjd.exec:\9pjjd.exe3⤵PID:232
-
\??\c:\5lrlfxx.exec:\5lrlfxx.exe4⤵
- Executes dropped EXE
PID:972 -
\??\c:\jpddd.exec:\jpddd.exe5⤵PID:1488
-
\??\c:\llxxlll.exec:\llxxlll.exe6⤵PID:4636
-
\??\c:\lxlllll.exec:\lxlllll.exe7⤵PID:4896
-
\??\c:\dvddd.exec:\dvddd.exe8⤵PID:1412
-
-
-
-
-
-
-
-
\??\c:\vvpvj.exec:\vvpvj.exe2⤵
- Executes dropped EXE
PID:4148
-
-
\??\c:\tbthbn.exec:\tbthbn.exe1⤵PID:2024
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe1⤵PID:3920
-
\??\c:\hhtttt.exec:\hhtttt.exe1⤵PID:532
-
\??\c:\rrrlfff.exec:\rrrlfff.exe1⤵PID:4124
-
\??\c:\5dddd.exec:\5dddd.exe1⤵PID:3020
-
\??\c:\bbhhtt.exec:\bbhhtt.exe1⤵PID:1512
-
\??\c:\lffxffl.exec:\lffxffl.exe1⤵PID:2404
-
\??\c:\ntttbh.exec:\ntttbh.exe2⤵PID:2444
-
\??\c:\jddjv.exec:\jddjv.exe3⤵PID:1972
-
\??\c:\rrrrrxx.exec:\rrrrrxx.exe4⤵PID:4864
-
\??\c:\jvjvj.exec:\jvjvj.exe5⤵PID:3192
-
\??\c:\9xrlflf.exec:\9xrlflf.exe6⤵PID:3660
-
\??\c:\xlllllf.exec:\xlllllf.exe7⤵PID:3944
-
-
-
-
-
\??\c:\frxlflx.exec:\frxlflx.exe4⤵
- Executes dropped EXE
PID:4884
-
-
-
-
\??\c:\xrxxrxx.exec:\xrxxrxx.exe1⤵PID:3468
-
\??\c:\jdddv.exec:\jdddv.exe1⤵
- Executes dropped EXE
PID:4892 -
\??\c:\dvpvj.exec:\dvpvj.exe2⤵
- Executes dropped EXE
PID:1972
-
-
\??\c:\bhttnt.exec:\bhttnt.exe1⤵PID:4312
-
\??\c:\3vvdv.exec:\3vvdv.exe1⤵
- Executes dropped EXE
PID:4760
-
\??\c:\jdjjd.exec:\jdjjd.exe1⤵
- Executes dropped EXE
PID:1864
-
\??\c:\rllxffr.exec:\rllxffr.exe1⤵PID:4068
-
\??\c:\frrrrxx.exec:\frrrrxx.exe1⤵
- Executes dropped EXE
PID:4152
-
\??\c:\thttnb.exec:\thttnb.exe1⤵
- Executes dropped EXE
PID:4992
-
\??\c:\xfrrxfr.exec:\xfrrxfr.exe1⤵
- Executes dropped EXE
PID:804
-
\??\c:\ttbnnb.exec:\ttbnnb.exe1⤵
- Executes dropped EXE
PID:3140
-
\??\c:\rfffllr.exec:\rfffllr.exe1⤵
- Executes dropped EXE
PID:2432
-
\??\c:\jjjjd.exec:\jjjjd.exe1⤵
- Executes dropped EXE
PID:3988
-
\??\c:\hhhhhh.exec:\hhhhhh.exe1⤵
- Executes dropped EXE
PID:1500
-
\??\c:\lxrxffx.exec:\lxrxffx.exe1⤵PID:4676
-
\??\c:\pjddp.exec:\pjddp.exe1⤵
- Executes dropped EXE
PID:3500
-
\??\c:\thbbtt.exec:\thbbtt.exe1⤵PID:4124
-
\??\c:\7pdvp.exec:\7pdvp.exe2⤵PID:4704
-
\??\c:\7djjj.exec:\7djjj.exe3⤵PID:1132
-
\??\c:\hhtttt.exec:\hhtttt.exe4⤵PID:1896
-
\??\c:\jpdjp.exec:\jpdjp.exe5⤵PID:768
-
\??\c:\3jvdj.exec:\3jvdj.exe6⤵PID:4036
-
\??\c:\bnbttt.exec:\bnbttt.exe7⤵PID:3472
-
-
-
-
-
-
-
\??\c:\httnhb.exec:\httnhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776
-
-
\??\c:\nbtntt.exec:\nbtntt.exe1⤵
- Executes dropped EXE
PID:1616
-
\??\c:\3lrlfff.exec:\3lrlfff.exe1⤵
- Executes dropped EXE
PID:2252
-
\??\c:\nhhhhb.exec:\nhhhhb.exe1⤵
- Executes dropped EXE
PID:1760
-
\??\c:\frlrrxr.exec:\frlrrxr.exe1⤵
- Executes dropped EXE
PID:540
-
\??\c:\3fffrxr.exec:\3fffrxr.exe1⤵
- Executes dropped EXE
PID:4312
-
\??\c:\ddppv.exec:\ddppv.exe1⤵
- Executes dropped EXE
PID:1476
-
\??\c:\tbbtht.exec:\tbbtht.exe1⤵
- Executes dropped EXE
PID:1324
-
\??\c:\fffxrxr.exec:\fffxrxr.exe1⤵
- Executes dropped EXE
PID:4956
-
\??\c:\nbnbhh.exec:\nbnbhh.exe1⤵
- Executes dropped EXE
PID:1020
-
\??\c:\1tnntn.exec:\1tnntn.exe1⤵
- Executes dropped EXE
PID:4848
-
\??\c:\hbtthn.exec:\hbtthn.exe1⤵
- Executes dropped EXE
PID:2436
-
\??\c:\ppjjd.exec:\ppjjd.exe1⤵
- Executes dropped EXE
PID:2736
-
\??\c:\nbnhnh.exec:\nbnhnh.exe1⤵
- Executes dropped EXE
PID:4156
-
\??\c:\3tbbtt.exec:\3tbbtt.exe1⤵
- Executes dropped EXE
PID:3868
-
\??\c:\jdjdv.exec:\jdjdv.exe1⤵
- Executes dropped EXE
PID:4832
-
\??\c:\7nnhbt.exec:\7nnhbt.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896
-
\??\c:\jdpdj.exec:\jdpdj.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992
-
\??\c:\5jdpd.exec:\5jdpd.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488
-
\??\c:\1ttnhh.exec:\1ttnhh.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108
-
\??\c:\xrfrrlx.exec:\xrfrrlx.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668
-
\??\c:\vvjjv.exec:\vvjjv.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168
-
\??\c:\dpjdv.exec:\dpjdv.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124
-
\??\c:\rxxrfxr.exec:\rxxrfxr.exe1⤵PID:4208
-
\??\c:\jjjdj.exec:\jjjdj.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100
-
\??\c:\jvvjd.exec:\jvvjd.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668
-
\??\c:\djvpd.exec:\djvpd.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588
-
\??\c:\dvdpv.exec:\dvdpv.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936
-
\??\c:\9tbntn.exec:\9tbntn.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵
- Executes dropped EXE
PID:4676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:4456
-
\??\c:\thnhht.exec:\thnhht.exe1⤵PID:220
-
\??\c:\jpvpp.exec:\jpvpp.exe2⤵PID:4760
-
\??\c:\5rlfxxx.exec:\5rlfxxx.exe3⤵PID:5036
-
\??\c:\vjppp.exec:\vjppp.exe4⤵PID:1616
-
\??\c:\lxlflrl.exec:\lxlflrl.exe5⤵PID:4864
-
\??\c:\xxrrxfl.exec:\xxrrxfl.exe6⤵PID:1944
-
\??\c:\tttttt.exec:\tttttt.exe7⤵PID:856
-
\??\c:\ppdvp.exec:\ppdvp.exe8⤵PID:4996
-
-
\??\c:\rffffll.exec:\rffffll.exe8⤵PID:4996
-
\??\c:\1nbbtt.exec:\1nbbtt.exe9⤵PID:532
-
\??\c:\1jppp.exec:\1jppp.exe10⤵PID:4648
-
\??\c:\1nbbntn.exec:\1nbbntn.exe11⤵PID:528
-
\??\c:\pvddj.exec:\pvddj.exe12⤵PID:4040
-
\??\c:\rrrrlrx.exec:\rrrrlrx.exe13⤵PID:3896
-
\??\c:\bhtbnt.exec:\bhtbnt.exe14⤵PID:4412
-
\??\c:\7rrrfll.exec:\7rrrfll.exe15⤵PID:1220
-
\??\c:\bthtbb.exec:\bthtbb.exe16⤵PID:3968
-
\??\c:\7fllfll.exec:\7fllfll.exe17⤵PID:3880
-
\??\c:\7hnnnn.exec:\7hnnnn.exe18⤵PID:2696
-
\??\c:\ffxxlrl.exec:\ffxxlrl.exe19⤵PID:4636
-
\??\c:\xxfflxx.exec:\xxfflxx.exe20⤵PID:4760
-
\??\c:\dvppj.exec:\dvppj.exe21⤵PID:4004
-
\??\c:\hhtbtt.exec:\hhtbtt.exe22⤵PID:4892
-
\??\c:\bnbtth.exec:\bnbtth.exe23⤵PID:4864
-
\??\c:\fffrrrx.exec:\fffrrrx.exe24⤵PID:2852
-
\??\c:\nhhhbh.exec:\nhhhbh.exe25⤵PID:2776
-
\??\c:\rflffff.exec:\rflffff.exe26⤵PID:1584
-
\??\c:\hhhbbh.exec:\hhhbbh.exe27⤵PID:2104
-
\??\c:\vdjpv.exec:\vdjpv.exe28⤵PID:1500
-
\??\c:\xlrrllr.exec:\xlrrllr.exe29⤵PID:532
-
\??\c:\nhnnhn.exec:\nhnnhn.exe30⤵PID:1004
-
\??\c:\5fxllxx.exec:\5fxllxx.exe31⤵PID:2064
-
\??\c:\xfrxxxf.exec:\xfrxxxf.exe32⤵PID:3024
-
\??\c:\jjppj.exec:\jjppj.exe33⤵PID:2432
-
\??\c:\rfxxfff.exec:\rfxxfff.exe34⤵PID:2236
-
\??\c:\9tnnnn.exec:\9tnnnn.exe35⤵PID:1996
-
\??\c:\xfffxfl.exec:\xfffxfl.exe36⤵PID:1864
-
\??\c:\hhbbtb.exec:\hhbbtb.exe37⤵PID:2560
-
\??\c:\ppppj.exec:\ppppj.exe38⤵PID:2792
-
\??\c:\pvjdv.exec:\pvjdv.exe39⤵PID:4244
-
\??\c:\1xllxxf.exec:\1xllxxf.exe40⤵PID:4760
-
\??\c:\frfllll.exec:\frfllll.exe41⤵PID:4616
-
\??\c:\9hbbhh.exec:\9hbbhh.exe42⤵PID:2488
-
\??\c:\9jppj.exec:\9jppj.exe43⤵PID:5096
-
\??\c:\1nbtnn.exec:\1nbtnn.exe44⤵PID:4660
-
\??\c:\dvdjv.exec:\dvdjv.exe45⤵PID:1420
-
\??\c:\xxllffx.exec:\xxllffx.exe46⤵PID:4996
-
\??\c:\jjjjj.exec:\jjjjj.exe47⤵PID:4104
-
\??\c:\rrffxlf.exec:\rrffxlf.exe48⤵PID:2024
-
\??\c:\fxxlffl.exec:\fxxlffl.exe49⤵PID:3152
-
\??\c:\bbbhnt.exec:\bbbhnt.exe50⤵PID:1508
-
\??\c:\jpdpj.exec:\jpdpj.exe51⤵PID:4672
-
\??\c:\xflllll.exec:\xflllll.exe52⤵PID:3896
-
\??\c:\nhbbtt.exec:\nhbbtt.exe53⤵PID:4844
-
\??\c:\pdppj.exec:\pdppj.exe54⤵PID:4404
-
\??\c:\ntthbh.exec:\ntthbh.exe55⤵PID:1996
-
\??\c:\llllfll.exec:\llllfll.exe56⤵PID:3964
-
\??\c:\7nbbbb.exec:\7nbbbb.exe57⤵PID:4588
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe58⤵PID:4896
-
\??\c:\9ntthn.exec:\9ntthn.exe59⤵PID:4764
-
\??\c:\nhbnhn.exec:\nhbnhn.exe60⤵PID:2180
-
\??\c:\dpppj.exec:\dpppj.exe61⤵PID:2196
-
\??\c:\3tbbbh.exec:\3tbbbh.exe62⤵PID:4552
-
\??\c:\ppdvv.exec:\ppdvv.exe63⤵PID:1716
-
\??\c:\rlffxlf.exec:\rlffxlf.exe64⤵PID:4864
-
\??\c:\hntbtb.exec:\hntbtb.exe65⤵PID:2776
-
\??\c:\lfllflf.exec:\lfllflf.exe66⤵PID:1588
-
\??\c:\hbhbbb.exec:\hbhbbb.exe67⤵PID:3436
-
\??\c:\ppjjd.exec:\ppjjd.exe68⤵PID:4996
-
\??\c:\nntnhh.exec:\nntnhh.exe69⤵PID:4092
-
\??\c:\nhbbbb.exec:\nhbbbb.exe70⤵PID:5100
-
\??\c:\vjppj.exec:\vjppj.exe71⤵PID:4112
-
\??\c:\1ntntt.exec:\1ntntt.exe72⤵PID:4832
-
\??\c:\dddpp.exec:\dddpp.exe73⤵PID:3972
-
\??\c:\bthbtt.exec:\bthbtt.exe74⤵PID:972
-
\??\c:\jjjjj.exec:\jjjjj.exe75⤵PID:1460
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe76⤵PID:4968
-
\??\c:\tnnnhh.exec:\tnnnhh.exe77⤵PID:1864
-
\??\c:\dvdvv.exec:\dvdvv.exe78⤵PID:2016
-
\??\c:\ffrrxxf.exec:\ffrrxxf.exe79⤵PID:2792
-
\??\c:\1ttttt.exec:\1ttttt.exe80⤵PID:4896
-
\??\c:\djjjd.exec:\djjjd.exe81⤵PID:4760
-
\??\c:\bhtnnh.exec:\bhtnnh.exe82⤵PID:2208
-
\??\c:\rrllxff.exec:\rrllxff.exe83⤵PID:4892
-
\??\c:\tnbhnt.exec:\tnbhnt.exe84⤵PID:4552
-
\??\c:\pvjdv.exec:\pvjdv.exe85⤵PID:4312
-
\??\c:\xlflrfx.exec:\xlflrfx.exe86⤵PID:2408
-
\??\c:\ttttnn.exec:\ttttnn.exe87⤵PID:864
-
\??\c:\jvvvv.exec:\jvvvv.exe88⤵PID:3988
-
\??\c:\nnnnhh.exec:\nnnnhh.exe89⤵PID:532
-
\??\c:\xrxrfll.exec:\xrxrfll.exe90⤵PID:4488
-
\??\c:\tbbbth.exec:\tbbbth.exe91⤵PID:3152
-
\??\c:\jpvdp.exec:\jpvdp.exe92⤵PID:2064
-
\??\c:\9rxrllf.exec:\9rxrllf.exe93⤵PID:2656
-
\??\c:\vpvvv.exec:\vpvvv.exe94⤵PID:2236
-
\??\c:\xxllrll.exec:\xxllrll.exe95⤵PID:4844
-
\??\c:\7hbbnn.exec:\7hbbnn.exe96⤵PID:2980
-
\??\c:\3djjv.exec:\3djjv.exe97⤵PID:1892
-
\??\c:\lfxrffl.exec:\lfxrffl.exe98⤵PID:3964
-
\??\c:\htttnn.exec:\htttnn.exe99⤵PID:3912
-
\??\c:\ddvpp.exec:\ddvpp.exe100⤵PID:3136
-
\??\c:\hhnntt.exec:\hhnntt.exe101⤵PID:2604
-
\??\c:\5dpjd.exec:\5dpjd.exe102⤵PID:3300
-
\??\c:\5lllxxx.exec:\5lllxxx.exe103⤵PID:1616
-
\??\c:\hbtbtb.exec:\hbtbtb.exe104⤵PID:1868
-
\??\c:\vppdv.exec:\vppdv.exe105⤵PID:1716
-
\??\c:\bhnttt.exec:\bhnttt.exe106⤵PID:4864
-
\??\c:\nhbbbh.exec:\nhbbbh.exe107⤵PID:2104
-
\??\c:\5fxrlrl.exec:\5fxrlrl.exe108⤵PID:2408
-
\??\c:\httttt.exec:\httttt.exe109⤵PID:864
-
\??\c:\ddvdd.exec:\ddvdd.exe110⤵PID:2024
-
\??\c:\llrrxff.exec:\llrrxff.exe111⤵PID:3868
-
\??\c:\pjjjj.exec:\pjjjj.exe112⤵PID:896
-
\??\c:\rrffxxx.exec:\rrffxxx.exe113⤵PID:3152
-
\??\c:\vjpvp.exec:\vjpvp.exe114⤵PID:2064
-
\??\c:\jpvpd.exec:\jpvpd.exe115⤵PID:4068
-
\??\c:\5xllfff.exec:\5xllfff.exe116⤵PID:2236
-
\??\c:\vjvvv.exec:\vjvvv.exe117⤵PID:972
-
\??\c:\rfrllrl.exec:\rfrllrl.exe118⤵PID:4356
-
\??\c:\bnnnhn.exec:\bnnnhn.exe119⤵PID:4416
-
\??\c:\ddvpv.exec:\ddvpv.exe120⤵PID:5028
-
\??\c:\rflxfxr.exec:\rflxfxr.exe121⤵PID:4936
-
\??\c:\jdjjj.exec:\jdjjj.exe122⤵PID:1636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-