Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 14:17
Behavioral task
behavioral1
Sample
1a0e6cfcfc2f7d4a6b16379bbb9766ff.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
1a0e6cfcfc2f7d4a6b16379bbb9766ff.exe
-
Size
487KB
-
MD5
1a0e6cfcfc2f7d4a6b16379bbb9766ff
-
SHA1
d52c725777497a0cf55e0350b0a5509e5cb436ca
-
SHA256
d36da087aefd30d3caa165a61fd3204168d08a7f55d7afd0b53e177da1940d80
-
SHA512
0ae290c25d8a195026fb32edf2556d7e016bcbe87fa41bb08c179bfcfc21084f4f9bb90ffeaf2b40aeb80936bad5c1e0353c0fd7f2119e8a3afb6f21b0be9c63
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjkUo7tvnJ9oH0IiVByq9CPobNVS:n3C9ytvngQjgtvngSV3CPobNVS
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3720-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2608-81-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-74-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-67-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-60-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2948-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4796 vjdvp.exe 4584 frxllll.exe 3964 bbtnnh.exe 2796 ntnntt.exe 4952 vjppp.exe 4860 xrrrrxl.exe 2948 1tnhbt.exe 436 vvjdj.exe 60 1djdd.exe 2608 xxfffff.exe 1456 btbbtt.exe 404 hthhhh.exe 4868 ppdvd.exe 5000 rrrrfff.exe 4940 bbbnhh.exe 3772 hntnnn.exe 5084 ppvpj.exe 624 9lfxrrr.exe 3340 nhbntb.exe 3056 5tnhhh.exe 4852 pjvdp.exe 640 xllfrrr.exe 3032 xrrllfx.exe 2040 nbhbbt.exe 3672 vpvvp.exe 1056 vpddv.exe 1084 7rxrrrl.exe 3236 bbhbtt.exe 440 nnttbb.exe 4804 djdvp.exe 3276 flfxrrr.exe 880 7bhbtt.exe 628 thtnnb.exe 3036 ppjdp.exe 3600 5llfxxr.exe 2024 xflfffx.exe 2576 5nhhbb.exe 4284 jpjvv.exe 4068 9ddvp.exe 1000 3ffxffx.exe 2596 1nbtnt.exe 1432 dddvj.exe 5092 rlrfffx.exe 2588 1ttnnn.exe 4336 thhhbb.exe 3028 vvjvv.exe 3720 lllffff.exe 4796 7flfllr.exe 4488 tntnhb.exe 3024 pvdvp.exe 1988 1ppdv.exe 4444 rfffxxr.exe 1684 7bbbtt.exe 4860 jddvp.exe 2424 djpjd.exe 436 1lfxlll.exe 1424 bbbbbt.exe 4816 tthbbb.exe 404 dvpjd.exe 4568 3rrlffx.exe 3416 hntnnn.exe 3312 1ntnbn.exe 3948 3pvpv.exe 5084 5rxrrrl.exe -
resource yara_rule behavioral2/memory/3720-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2608-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-19-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3720 wrote to memory of 4796 3720 1a0e6cfcfc2f7d4a6b16379bbb9766ff.exe 130 PID 3720 wrote to memory of 4796 3720 1a0e6cfcfc2f7d4a6b16379bbb9766ff.exe 130 PID 3720 wrote to memory of 4796 3720 1a0e6cfcfc2f7d4a6b16379bbb9766ff.exe 130 PID 4796 wrote to memory of 4584 4796 vjdvp.exe 84 PID 4796 wrote to memory of 4584 4796 vjdvp.exe 84 PID 4796 wrote to memory of 4584 4796 vjdvp.exe 84 PID 4584 wrote to memory of 3964 4584 frxllll.exe 85 PID 4584 wrote to memory of 3964 4584 frxllll.exe 85 PID 4584 wrote to memory of 3964 4584 frxllll.exe 85 PID 3964 wrote to memory of 2796 3964 bbtnnh.exe 86 PID 3964 wrote to memory of 2796 3964 bbtnnh.exe 86 PID 3964 wrote to memory of 2796 3964 bbtnnh.exe 86 PID 2796 wrote to memory of 4952 2796 ntnntt.exe 87 PID 2796 wrote to memory of 4952 2796 ntnntt.exe 87 PID 2796 wrote to memory of 4952 2796 ntnntt.exe 87 PID 4952 wrote to memory of 4860 4952 vjppp.exe 88 PID 4952 wrote to memory of 4860 4952 vjppp.exe 88 PID 4952 wrote to memory of 4860 4952 vjppp.exe 88 PID 4860 wrote to memory of 2948 4860 xrrrrxl.exe 89 PID 4860 wrote to memory of 2948 4860 xrrrrxl.exe 89 PID 4860 wrote to memory of 2948 4860 xrrrrxl.exe 89 PID 2948 wrote to memory of 436 2948 1tnhbt.exe 90 PID 2948 wrote to memory of 436 2948 1tnhbt.exe 90 PID 2948 wrote to memory of 436 2948 1tnhbt.exe 90 PID 436 wrote to memory of 60 436 vvjdj.exe 91 PID 436 wrote to memory of 60 436 vvjdj.exe 91 PID 436 wrote to memory of 60 436 vvjdj.exe 91 PID 60 wrote to memory of 2608 60 1djdd.exe 92 PID 60 wrote to memory of 2608 60 1djdd.exe 92 PID 60 wrote to memory of 2608 60 1djdd.exe 92 PID 2608 wrote to memory of 1456 2608 xxfffff.exe 93 PID 2608 wrote to memory of 1456 2608 xxfffff.exe 93 PID 2608 wrote to memory of 1456 2608 xxfffff.exe 93 PID 1456 wrote to memory of 404 1456 btbbtt.exe 94 PID 1456 wrote to memory of 404 1456 btbbtt.exe 94 PID 1456 wrote to memory of 404 1456 btbbtt.exe 94 PID 404 wrote to memory of 4868 404 hthhhh.exe 95 PID 404 wrote to memory of 4868 404 hthhhh.exe 95 PID 404 wrote to memory of 4868 404 hthhhh.exe 95 PID 4868 wrote to memory of 5000 4868 ppdvd.exe 96 PID 4868 wrote to memory of 5000 4868 ppdvd.exe 96 PID 4868 wrote to memory of 5000 4868 ppdvd.exe 96 PID 5000 wrote to memory of 4940 5000 rrrrfff.exe 97 PID 5000 wrote to memory of 4940 5000 rrrrfff.exe 97 PID 5000 wrote to memory of 4940 5000 rrrrfff.exe 97 PID 4940 wrote to memory of 3772 4940 bbbnhh.exe 98 PID 4940 wrote to memory of 3772 4940 bbbnhh.exe 98 PID 4940 wrote to memory of 3772 4940 bbbnhh.exe 98 PID 3772 wrote to memory of 5084 3772 hntnnn.exe 99 PID 3772 wrote to memory of 5084 3772 hntnnn.exe 99 PID 3772 wrote to memory of 5084 3772 hntnnn.exe 99 PID 5084 wrote to memory of 624 5084 ppvpj.exe 100 PID 5084 wrote to memory of 624 5084 ppvpj.exe 100 PID 5084 wrote to memory of 624 5084 ppvpj.exe 100 PID 624 wrote to memory of 3340 624 9lfxrrr.exe 101 PID 624 wrote to memory of 3340 624 9lfxrrr.exe 101 PID 624 wrote to memory of 3340 624 9lfxrrr.exe 101 PID 3340 wrote to memory of 3056 3340 nhbntb.exe 102 PID 3340 wrote to memory of 3056 3340 nhbntb.exe 102 PID 3340 wrote to memory of 3056 3340 nhbntb.exe 102 PID 3056 wrote to memory of 4852 3056 5tnhhh.exe 103 PID 3056 wrote to memory of 4852 3056 5tnhhh.exe 103 PID 3056 wrote to memory of 4852 3056 5tnhhh.exe 103 PID 4852 wrote to memory of 640 4852 pjvdp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a0e6cfcfc2f7d4a6b16379bbb9766ff.exe"C:\Users\Admin\AppData\Local\Temp\1a0e6cfcfc2f7d4a6b16379bbb9766ff.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\vjdvp.exec:\vjdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\frxllll.exec:\frxllll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\bbtnnh.exec:\bbtnnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\ntnntt.exec:\ntnntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\vjppp.exec:\vjppp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\xrrrrxl.exec:\xrrrrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\1tnhbt.exec:\1tnhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\vvjdj.exec:\vvjdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\1djdd.exec:\1djdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\xxfffff.exec:\xxfffff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\btbbtt.exec:\btbbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\hthhhh.exec:\hthhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\ppdvd.exec:\ppdvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\rrrrfff.exec:\rrrrfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\bbbnhh.exec:\bbbnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\hntnnn.exec:\hntnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\ppvpj.exec:\ppvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\9lfxrrr.exec:\9lfxrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\nhbntb.exec:\nhbntb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\5tnhhh.exec:\5tnhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\pjvdp.exec:\pjvdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\xllfrrr.exec:\xllfrrr.exe23⤵
- Executes dropped EXE
PID:640 -
\??\c:\xrrllfx.exec:\xrrllfx.exe24⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nbhbbt.exec:\nbhbbt.exe25⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vpvvp.exec:\vpvvp.exe26⤵
- Executes dropped EXE
PID:3672 -
\??\c:\vpddv.exec:\vpddv.exe27⤵
- Executes dropped EXE
PID:1056 -
\??\c:\7rxrrrl.exec:\7rxrrrl.exe28⤵
- Executes dropped EXE
PID:1084 -
\??\c:\bbhbtt.exec:\bbhbtt.exe29⤵
- Executes dropped EXE
PID:3236 -
\??\c:\nnttbb.exec:\nnttbb.exe30⤵
- Executes dropped EXE
PID:440 -
\??\c:\djdvp.exec:\djdvp.exe31⤵
- Executes dropped EXE
PID:4804 -
\??\c:\flfxrrr.exec:\flfxrrr.exe32⤵
- Executes dropped EXE
PID:3276 -
\??\c:\7bhbtt.exec:\7bhbtt.exe33⤵
- Executes dropped EXE
PID:880 -
\??\c:\thtnnb.exec:\thtnnb.exe34⤵
- Executes dropped EXE
PID:628 -
\??\c:\ppjdp.exec:\ppjdp.exe35⤵
- Executes dropped EXE
PID:3036 -
\??\c:\5llfxxr.exec:\5llfxxr.exe36⤵
- Executes dropped EXE
PID:3600 -
\??\c:\xflfffx.exec:\xflfffx.exe37⤵
- Executes dropped EXE
PID:2024 -
\??\c:\5nhhbb.exec:\5nhhbb.exe38⤵
- Executes dropped EXE
PID:2576 -
\??\c:\jpjvv.exec:\jpjvv.exe39⤵
- Executes dropped EXE
PID:4284 -
\??\c:\9ddvp.exec:\9ddvp.exe40⤵
- Executes dropped EXE
PID:4068 -
\??\c:\3ffxffx.exec:\3ffxffx.exe41⤵
- Executes dropped EXE
PID:1000 -
\??\c:\1nbtnt.exec:\1nbtnt.exe42⤵
- Executes dropped EXE
PID:2596 -
\??\c:\dddvj.exec:\dddvj.exe43⤵
- Executes dropped EXE
PID:1432 -
\??\c:\rlrfffx.exec:\rlrfffx.exe44⤵
- Executes dropped EXE
PID:5092 -
\??\c:\1ttnnn.exec:\1ttnnn.exe45⤵
- Executes dropped EXE
PID:2588 -
\??\c:\thhhbb.exec:\thhhbb.exe46⤵
- Executes dropped EXE
PID:4336 -
\??\c:\vvjvv.exec:\vvjvv.exe47⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lllffff.exec:\lllffff.exe48⤵
- Executes dropped EXE
PID:3720 -
\??\c:\7flfllr.exec:\7flfllr.exe49⤵
- Executes dropped EXE
PID:4796 -
\??\c:\tntnhb.exec:\tntnhb.exe50⤵
- Executes dropped EXE
PID:4488 -
\??\c:\pvdvp.exec:\pvdvp.exe51⤵
- Executes dropped EXE
PID:3024 -
\??\c:\1ppdv.exec:\1ppdv.exe52⤵
- Executes dropped EXE
PID:1988 -
\??\c:\rfffxxr.exec:\rfffxxr.exe53⤵
- Executes dropped EXE
PID:4444 -
\??\c:\7bbbtt.exec:\7bbbtt.exe54⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jddvp.exec:\jddvp.exe55⤵
- Executes dropped EXE
PID:4860 -
\??\c:\djpjd.exec:\djpjd.exe56⤵
- Executes dropped EXE
PID:2424 -
\??\c:\1lfxlll.exec:\1lfxlll.exe57⤵
- Executes dropped EXE
PID:436 -
\??\c:\bbbbbt.exec:\bbbbbt.exe58⤵
- Executes dropped EXE
PID:1424 -
\??\c:\tthbbb.exec:\tthbbb.exe59⤵
- Executes dropped EXE
PID:4816 -
\??\c:\dvpjd.exec:\dvpjd.exe60⤵
- Executes dropped EXE
PID:404 -
\??\c:\3rrlffx.exec:\3rrlffx.exe61⤵
- Executes dropped EXE
PID:4568 -
\??\c:\hntnnn.exec:\hntnnn.exe62⤵
- Executes dropped EXE
PID:3416 -
\??\c:\1ntnbn.exec:\1ntnbn.exe63⤵
- Executes dropped EXE
PID:3312 -
\??\c:\3pvpv.exec:\3pvpv.exe64⤵
- Executes dropped EXE
PID:3948 -
\??\c:\5rxrrrl.exec:\5rxrrrl.exe65⤵
- Executes dropped EXE
PID:5084 -
\??\c:\fxffxxr.exec:\fxffxxr.exe66⤵PID:4512
-
\??\c:\3tthhb.exec:\3tthhb.exe67⤵PID:5044
-
\??\c:\jvdpp.exec:\jvdpp.exe68⤵PID:4852
-
\??\c:\flxllff.exec:\flxllff.exe69⤵PID:4976
-
\??\c:\fllfxfx.exec:\fllfxfx.exe70⤵PID:1404
-
\??\c:\httnhh.exec:\httnhh.exe71⤵PID:2040
-
\??\c:\3jvpv.exec:\3jvpv.exe72⤵PID:1268
-
\??\c:\btbthb.exec:\btbthb.exe73⤵PID:1960
-
\??\c:\djjjd.exec:\djjjd.exe74⤵PID:4220
-
\??\c:\frrrllx.exec:\frrrllx.exe75⤵PID:3984
-
\??\c:\nttnnh.exec:\nttnnh.exe76⤵PID:1028
-
\??\c:\vpjdd.exec:\vpjdd.exe77⤵PID:880
-
\??\c:\vvdvj.exec:\vvdvj.exe78⤵PID:628
-
\??\c:\rlrlrlr.exec:\rlrlrlr.exe79⤵PID:432
-
\??\c:\ntbhbb.exec:\ntbhbb.exe80⤵PID:2460
-
\??\c:\5jdvd.exec:\5jdvd.exe81⤵PID:4980
-
\??\c:\3rlxxxl.exec:\3rlxxxl.exe82⤵PID:4404
-
\??\c:\ntnnnn.exec:\ntnnnn.exe83⤵PID:836
-
\??\c:\9xfxllf.exec:\9xfxllf.exe84⤵PID:3560
-
\??\c:\flrlffx.exec:\flrlffx.exe85⤵PID:2676
-
\??\c:\btnnnb.exec:\btnnnb.exe86⤵PID:4676
-
\??\c:\dpvpj.exec:\dpvpj.exe87⤵PID:1432
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe88⤵PID:1768
-
\??\c:\fxxrllf.exec:\fxxrllf.exe89⤵PID:4460
-
\??\c:\ntbthh.exec:\ntbthh.exe90⤵PID:3992
-
\??\c:\vjjdd.exec:\vjjdd.exe91⤵PID:4924
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe92⤵PID:1592
-
\??\c:\7nthhh.exec:\7nthhh.exe93⤵PID:4796
-
\??\c:\dvvpj.exec:\dvvpj.exe94⤵PID:3304
-
\??\c:\7rxxxrx.exec:\7rxxxrx.exe95⤵PID:4440
-
\??\c:\9dvvv.exec:\9dvvv.exe96⤵PID:1988
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe97⤵PID:4396
-
\??\c:\7bbbbn.exec:\7bbbbn.exe98⤵PID:1012
-
\??\c:\9xrllff.exec:\9xrllff.exe99⤵PID:1456
-
\??\c:\lflfllf.exec:\lflfllf.exe100⤵PID:3916
-
\??\c:\nhbtnh.exec:\nhbtnh.exe101⤵PID:4688
-
\??\c:\9vdvj.exec:\9vdvj.exe102⤵PID:2948
-
\??\c:\rxxxxxf.exec:\rxxxxxf.exe103⤵PID:1508
-
\??\c:\btnhbb.exec:\btnhbb.exe104⤵PID:3220
-
\??\c:\3bhbhn.exec:\3bhbhn.exe105⤵PID:1176
-
\??\c:\pvjdv.exec:\pvjdv.exe106⤵PID:2260
-
\??\c:\lrxrllf.exec:\lrxrllf.exe107⤵PID:1328
-
\??\c:\bttbbh.exec:\bttbbh.exe108⤵PID:4360
-
\??\c:\pvddd.exec:\pvddd.exe109⤵PID:3200
-
\??\c:\rxffxxx.exec:\rxffxxx.exe110⤵PID:3136
-
\??\c:\rffxrrl.exec:\rffxrrl.exe111⤵PID:1088
-
\??\c:\hhtnbb.exec:\hhtnbb.exe112⤵PID:5112
-
\??\c:\jjpjd.exec:\jjpjd.exe113⤵PID:3796
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe114⤵PID:4944
-
\??\c:\hthbtb.exec:\hthbtb.exe115⤵PID:1708
-
\??\c:\dvvpp.exec:\dvvpp.exe116⤵PID:3032
-
\??\c:\vvpjp.exec:\vvpjp.exe117⤵PID:1664
-
\??\c:\7rrlffr.exec:\7rrlffr.exe118⤵PID:1416
-
\??\c:\5hhhbh.exec:\5hhhbh.exe119⤵PID:3672
-
\??\c:\vvvpj.exec:\vvvpj.exe120⤵PID:3320
-
\??\c:\dvdvj.exec:\dvdvj.exe121⤵PID:1632
-
\??\c:\frxrfff.exec:\frxrfff.exe122⤵PID:4804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-