Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 18:17 UTC
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
05789da5965c484a02a5d283552a78287a01ef77a88d98a22b839007c1c2dd5b.exe
Resource
win7-20240419-en
6 signatures
150 seconds
General
-
Target
05789da5965c484a02a5d283552a78287a01ef77a88d98a22b839007c1c2dd5b.exe
-
Size
78KB
-
MD5
239664c882dfbf196dc75cd713388e98
-
SHA1
80b4e49292269a2722ddf6c186137124bc98d271
-
SHA256
05789da5965c484a02a5d283552a78287a01ef77a88d98a22b839007c1c2dd5b
-
SHA512
4411b92b44c5f57c26dcf19e90f89ebfb729bf5736863747000a5ef59759425ea13609f4bdab10ff26e6c6286f0bf867a157e601117dd6a80411add1ddeae1b0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgUVyiAnmUc7kJEsyP:ymb3NkkiQ3mdBjFIgUEXc7kJEFP
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/2604-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1240-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1672-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2916-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/332-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 25 IoCs
resource yara_rule behavioral2/memory/2604-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4296-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2980-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2980-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2980-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2488-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2488-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3904-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3704-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4580-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3728-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3732-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1240-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1332-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1672-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/452-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4508-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4408-121-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2096-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2916-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4076-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2008-159-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1828-192-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4532-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/332-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4296 lrrrllr.exe 2980 g4666.exe 2488 nbnnbb.exe 3904 rxxrxrl.exe 3704 hhbbtb.exe 4580 rlxrffr.exe 3728 u026000.exe 3948 280004.exe 3732 bnnhtn.exe 1240 5xxrffx.exe 2056 llrlxrl.exe 1332 hbbthh.exe 3200 dvjdp.exe 1672 m2442.exe 452 20826.exe 4508 lfxrffx.exe 4408 w06686.exe 3528 htbhnt.exe 2096 w88466.exe 2968 64200.exe 2916 bnnbbb.exe 4076 202604.exe 2008 tbtnbb.exe 2664 lrlxlfr.exe 3088 60048.exe 1580 0686442.exe 2228 xlrlfxr.exe 1924 lllxrrl.exe 1828 8448226.exe 4532 4626048.exe 332 a6042.exe 5052 rfllxrf.exe 3692 200222.exe 224 888444.exe 2516 02042.exe 4676 xlfrffr.exe 2212 7vpjv.exe 2404 u842266.exe 2820 64482.exe 232 8660826.exe 2524 u882602.exe 820 884482.exe 3812 jjjvj.exe 4948 888244.exe 4000 jvpdp.exe 3628 s8426.exe 1016 22868.exe 4184 8848604.exe 3348 g2604.exe 2876 7rrrxrf.exe 4884 2004820.exe 2044 662422.exe 1036 1xxlxrl.exe 1932 86666.exe 4300 m6608.exe 3380 466486.exe 4356 vdppv.exe 4400 048260.exe 1764 jvjpd.exe 1660 btnhhb.exe 2288 84624.exe 3648 5nhbnh.exe 412 8626208.exe 1488 lllxrrr.exe -
resource yara_rule behavioral2/memory/2604-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2916-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1828-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/332-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2604 wrote to memory of 4296 2604 05789da5965c484a02a5d283552a78287a01ef77a88d98a22b839007c1c2dd5b.exe 83 PID 2604 wrote to memory of 4296 2604 05789da5965c484a02a5d283552a78287a01ef77a88d98a22b839007c1c2dd5b.exe 83 PID 2604 wrote to memory of 4296 2604 05789da5965c484a02a5d283552a78287a01ef77a88d98a22b839007c1c2dd5b.exe 83 PID 4296 wrote to memory of 2980 4296 lrrrllr.exe 84 PID 4296 wrote to memory of 2980 4296 lrrrllr.exe 84 PID 4296 wrote to memory of 2980 4296 lrrrllr.exe 84 PID 2980 wrote to memory of 2488 2980 g4666.exe 85 PID 2980 wrote to memory of 2488 2980 g4666.exe 85 PID 2980 wrote to memory of 2488 2980 g4666.exe 85 PID 2488 wrote to memory of 3904 2488 nbnnbb.exe 86 PID 2488 wrote to memory of 3904 2488 nbnnbb.exe 86 PID 2488 wrote to memory of 3904 2488 nbnnbb.exe 86 PID 3904 wrote to memory of 3704 3904 rxxrxrl.exe 87 PID 3904 wrote to memory of 3704 3904 rxxrxrl.exe 87 PID 3904 wrote to memory of 3704 3904 rxxrxrl.exe 87 PID 3704 wrote to memory of 4580 3704 hhbbtb.exe 88 PID 3704 wrote to memory of 4580 3704 hhbbtb.exe 88 PID 3704 wrote to memory of 4580 3704 hhbbtb.exe 88 PID 4580 wrote to memory of 3728 4580 rlxrffr.exe 89 PID 4580 wrote to memory of 3728 4580 rlxrffr.exe 89 PID 4580 wrote to memory of 3728 4580 rlxrffr.exe 89 PID 3728 wrote to memory of 3948 3728 u026000.exe 90 PID 3728 wrote to memory of 3948 3728 u026000.exe 90 PID 3728 wrote to memory of 3948 3728 u026000.exe 90 PID 3948 wrote to memory of 3732 3948 280004.exe 91 PID 3948 wrote to memory of 3732 3948 280004.exe 91 PID 3948 wrote to memory of 3732 3948 280004.exe 91 PID 3732 wrote to memory of 1240 3732 bnnhtn.exe 92 PID 3732 wrote to memory of 1240 3732 bnnhtn.exe 92 PID 3732 wrote to memory of 1240 3732 bnnhtn.exe 92 PID 1240 wrote to memory of 2056 1240 5xxrffx.exe 93 PID 1240 wrote to memory of 2056 1240 5xxrffx.exe 93 PID 1240 wrote to memory of 2056 1240 5xxrffx.exe 93 PID 2056 wrote to memory of 1332 2056 llrlxrl.exe 94 PID 2056 wrote to memory of 1332 2056 llrlxrl.exe 94 PID 2056 wrote to memory of 1332 2056 llrlxrl.exe 94 PID 1332 wrote to memory of 3200 1332 hbbthh.exe 95 PID 1332 wrote to memory of 3200 1332 hbbthh.exe 95 PID 1332 wrote to memory of 3200 1332 hbbthh.exe 95 PID 3200 wrote to memory of 1672 3200 dvjdp.exe 96 PID 3200 wrote to memory of 1672 3200 dvjdp.exe 96 PID 3200 wrote to memory of 1672 3200 dvjdp.exe 96 PID 1672 wrote to memory of 452 1672 m2442.exe 97 PID 1672 wrote to memory of 452 1672 m2442.exe 97 PID 1672 wrote to memory of 452 1672 m2442.exe 97 PID 452 wrote to memory of 4508 452 20826.exe 98 PID 452 wrote to memory of 4508 452 20826.exe 98 PID 452 wrote to memory of 4508 452 20826.exe 98 PID 4508 wrote to memory of 4408 4508 lfxrffx.exe 99 PID 4508 wrote to memory of 4408 4508 lfxrffx.exe 99 PID 4508 wrote to memory of 4408 4508 lfxrffx.exe 99 PID 4408 wrote to memory of 3528 4408 w06686.exe 100 PID 4408 wrote to memory of 3528 4408 w06686.exe 100 PID 4408 wrote to memory of 3528 4408 w06686.exe 100 PID 3528 wrote to memory of 2096 3528 htbhnt.exe 101 PID 3528 wrote to memory of 2096 3528 htbhnt.exe 101 PID 3528 wrote to memory of 2096 3528 htbhnt.exe 101 PID 2096 wrote to memory of 2968 2096 w88466.exe 102 PID 2096 wrote to memory of 2968 2096 w88466.exe 102 PID 2096 wrote to memory of 2968 2096 w88466.exe 102 PID 2968 wrote to memory of 2916 2968 64200.exe 104 PID 2968 wrote to memory of 2916 2968 64200.exe 104 PID 2968 wrote to memory of 2916 2968 64200.exe 104 PID 2916 wrote to memory of 4076 2916 bnnbbb.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\05789da5965c484a02a5d283552a78287a01ef77a88d98a22b839007c1c2dd5b.exe"C:\Users\Admin\AppData\Local\Temp\05789da5965c484a02a5d283552a78287a01ef77a88d98a22b839007c1c2dd5b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\lrrrllr.exec:\lrrrllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\g4666.exec:\g4666.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\nbnnbb.exec:\nbnnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\rxxrxrl.exec:\rxxrxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\hhbbtb.exec:\hhbbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\rlxrffr.exec:\rlxrffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\u026000.exec:\u026000.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\280004.exec:\280004.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\bnnhtn.exec:\bnnhtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\5xxrffx.exec:\5xxrffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\llrlxrl.exec:\llrlxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\hbbthh.exec:\hbbthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\dvjdp.exec:\dvjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\m2442.exec:\m2442.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\20826.exec:\20826.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\lfxrffx.exec:\lfxrffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\w06686.exec:\w06686.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\htbhnt.exec:\htbhnt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\w88466.exec:\w88466.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\64200.exec:\64200.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\bnnbbb.exec:\bnnbbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\202604.exec:\202604.exe23⤵
- Executes dropped EXE
PID:4076 -
\??\c:\tbtnbb.exec:\tbtnbb.exe24⤵
- Executes dropped EXE
PID:2008 -
\??\c:\lrlxlfr.exec:\lrlxlfr.exe25⤵
- Executes dropped EXE
PID:2664 -
\??\c:\60048.exec:\60048.exe26⤵
- Executes dropped EXE
PID:3088 -
\??\c:\0686442.exec:\0686442.exe27⤵
- Executes dropped EXE
PID:1580 -
\??\c:\xlrlfxr.exec:\xlrlfxr.exe28⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lllxrrl.exec:\lllxrrl.exe29⤵
- Executes dropped EXE
PID:1924 -
\??\c:\8448226.exec:\8448226.exe30⤵
- Executes dropped EXE
PID:1828 -
\??\c:\4626048.exec:\4626048.exe31⤵
- Executes dropped EXE
PID:4532 -
\??\c:\a6042.exec:\a6042.exe32⤵
- Executes dropped EXE
PID:332 -
\??\c:\rfllxrf.exec:\rfllxrf.exe33⤵
- Executes dropped EXE
PID:5052 -
\??\c:\200222.exec:\200222.exe34⤵
- Executes dropped EXE
PID:3692 -
\??\c:\888444.exec:\888444.exe35⤵
- Executes dropped EXE
PID:224 -
\??\c:\02042.exec:\02042.exe36⤵
- Executes dropped EXE
PID:2516 -
\??\c:\xlfrffr.exec:\xlfrffr.exe37⤵
- Executes dropped EXE
PID:4676 -
\??\c:\7vpjv.exec:\7vpjv.exe38⤵
- Executes dropped EXE
PID:2212 -
\??\c:\u842266.exec:\u842266.exe39⤵
- Executes dropped EXE
PID:2404 -
\??\c:\frrllll.exec:\frrllll.exe40⤵PID:2728
-
\??\c:\64482.exec:\64482.exe41⤵
- Executes dropped EXE
PID:2820 -
\??\c:\8660826.exec:\8660826.exe42⤵
- Executes dropped EXE
PID:232 -
\??\c:\u882602.exec:\u882602.exe43⤵
- Executes dropped EXE
PID:2524 -
\??\c:\884482.exec:\884482.exe44⤵
- Executes dropped EXE
PID:820 -
\??\c:\jjjvj.exec:\jjjvj.exe45⤵
- Executes dropped EXE
PID:3812 -
\??\c:\888244.exec:\888244.exe46⤵
- Executes dropped EXE
PID:4948 -
\??\c:\jvpdp.exec:\jvpdp.exe47⤵
- Executes dropped EXE
PID:4000 -
\??\c:\s8426.exec:\s8426.exe48⤵
- Executes dropped EXE
PID:3628 -
\??\c:\22868.exec:\22868.exe49⤵
- Executes dropped EXE
PID:1016 -
\??\c:\8848604.exec:\8848604.exe50⤵
- Executes dropped EXE
PID:4184 -
\??\c:\g2604.exec:\g2604.exe51⤵
- Executes dropped EXE
PID:3348 -
\??\c:\7rrrxrf.exec:\7rrrxrf.exe52⤵
- Executes dropped EXE
PID:2876 -
\??\c:\2004820.exec:\2004820.exe53⤵
- Executes dropped EXE
PID:4884 -
\??\c:\662422.exec:\662422.exe54⤵
- Executes dropped EXE
PID:2044 -
\??\c:\1xxlxrl.exec:\1xxlxrl.exe55⤵
- Executes dropped EXE
PID:1036 -
\??\c:\86666.exec:\86666.exe56⤵
- Executes dropped EXE
PID:1932 -
\??\c:\m6608.exec:\m6608.exe57⤵
- Executes dropped EXE
PID:4300 -
\??\c:\466486.exec:\466486.exe58⤵
- Executes dropped EXE
PID:3380 -
\??\c:\vdppv.exec:\vdppv.exe59⤵
- Executes dropped EXE
PID:4356 -
\??\c:\048260.exec:\048260.exe60⤵
- Executes dropped EXE
PID:4400 -
\??\c:\jvjpd.exec:\jvjpd.exe61⤵
- Executes dropped EXE
PID:1764 -
\??\c:\btnhhb.exec:\btnhhb.exe62⤵
- Executes dropped EXE
PID:1660 -
\??\c:\84624.exec:\84624.exe63⤵
- Executes dropped EXE
PID:2288 -
\??\c:\5nhbnh.exec:\5nhbnh.exe64⤵
- Executes dropped EXE
PID:3648 -
\??\c:\8626208.exec:\8626208.exe65⤵
- Executes dropped EXE
PID:412 -
\??\c:\lllxrrr.exec:\lllxrrr.exe66⤵
- Executes dropped EXE
PID:1488 -
\??\c:\5tthbt.exec:\5tthbt.exe67⤵PID:876
-
\??\c:\048826.exec:\048826.exe68⤵PID:1212
-
\??\c:\pdvpj.exec:\pdvpj.exe69⤵PID:1716
-
\??\c:\7flfrxr.exec:\7flfrxr.exe70⤵PID:4076
-
\??\c:\8226482.exec:\8226482.exe71⤵PID:4692
-
\??\c:\280482.exec:\280482.exe72⤵PID:5104
-
\??\c:\04048.exec:\04048.exe73⤵PID:4544
-
\??\c:\djdvv.exec:\djdvv.exe74⤵PID:4172
-
\??\c:\q44200.exec:\q44200.exe75⤵PID:1524
-
\??\c:\24420.exec:\24420.exe76⤵PID:5020
-
\??\c:\jpjdp.exec:\jpjdp.exe77⤵PID:1964
-
\??\c:\9nbhhh.exec:\9nbhhh.exe78⤵PID:1160
-
\??\c:\5lrfxrl.exec:\5lrfxrl.exe79⤵PID:2796
-
\??\c:\5jjjd.exec:\5jjjd.exe80⤵PID:3512
-
\??\c:\bhhhhh.exec:\bhhhhh.exe81⤵PID:4180
-
\??\c:\9xxxlll.exec:\9xxxlll.exe82⤵PID:3888
-
\??\c:\048266.exec:\048266.exe83⤵PID:2656
-
\??\c:\c022228.exec:\c022228.exe84⤵PID:4388
-
\??\c:\0480488.exec:\0480488.exe85⤵PID:3700
-
\??\c:\i460666.exec:\i460666.exe86⤵PID:4740
-
\??\c:\ppvvd.exec:\ppvvd.exe87⤵PID:3816
-
\??\c:\i444888.exec:\i444888.exe88⤵PID:4936
-
\??\c:\24228.exec:\24228.exe89⤵PID:4360
-
\??\c:\006200.exec:\006200.exe90⤵PID:2832
-
\??\c:\268824.exec:\268824.exe91⤵PID:2728
-
\??\c:\k22600.exec:\k22600.exe92⤵PID:2820
-
\??\c:\jpddd.exec:\jpddd.exe93⤵PID:388
-
\??\c:\bhhhbh.exec:\bhhhbh.exe94⤵PID:3928
-
\??\c:\a4222.exec:\a4222.exe95⤵PID:2932
-
\??\c:\k20444.exec:\k20444.exe96⤵PID:3812
-
\??\c:\28662.exec:\28662.exe97⤵PID:2480
-
\??\c:\lrfxlxx.exec:\lrfxlxx.exe98⤵PID:3916
-
\??\c:\5rrrlrr.exec:\5rrrlrr.exe99⤵PID:3016
-
\??\c:\1ppjd.exec:\1ppjd.exe100⤵PID:1016
-
\??\c:\9tbntb.exec:\9tbntb.exe101⤵PID:4184
-
\??\c:\648482.exec:\648482.exe102⤵PID:2108
-
\??\c:\6000448.exec:\6000448.exe103⤵PID:1704
-
\??\c:\nhbhbb.exec:\nhbhbb.exe104⤵PID:3856
-
\??\c:\o482266.exec:\o482266.exe105⤵PID:4828
-
\??\c:\48602.exec:\48602.exe106⤵PID:2804
-
\??\c:\084822.exec:\084822.exe107⤵PID:2528
-
\??\c:\04004.exec:\04004.exe108⤵PID:4300
-
\??\c:\ddppp.exec:\ddppp.exe109⤵PID:3380
-
\??\c:\0200448.exec:\0200448.exe110⤵PID:4356
-
\??\c:\46226.exec:\46226.exe111⤵PID:3580
-
\??\c:\5rxxxxx.exec:\5rxxxxx.exe112⤵PID:1764
-
\??\c:\jdjjd.exec:\jdjjd.exe113⤵PID:1660
-
\??\c:\s6826.exec:\s6826.exe114⤵PID:2288
-
\??\c:\nbtnbb.exec:\nbtnbb.exe115⤵PID:4568
-
\??\c:\vvddd.exec:\vvddd.exe116⤵PID:412
-
\??\c:\xflxlfx.exec:\xflxlfx.exe117⤵PID:3132
-
\??\c:\222082.exec:\222082.exe118⤵PID:4632
-
\??\c:\rfffrxr.exec:\rfffrxr.exe119⤵PID:1696
-
\??\c:\9hnnth.exec:\9hnnth.exe120⤵PID:3508
-
\??\c:\e02060.exec:\e02060.exe121⤵PID:4076
-
\??\c:\3pjjj.exec:\3pjjj.exe122⤵PID:5056
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-