Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 18:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
05645442132cb14ff2f64e0b0f2a740f2b07505949961eb96423c6564c5dc264.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
05645442132cb14ff2f64e0b0f2a740f2b07505949961eb96423c6564c5dc264.exe
-
Size
76KB
-
MD5
287414622bb8b4193a47085f7537410a
-
SHA1
48684dfe3568f87669d3265f1e7bdf9b70decf18
-
SHA256
05645442132cb14ff2f64e0b0f2a740f2b07505949961eb96423c6564c5dc264
-
SHA512
9ac31e4c1738568255b56403c2f716e8617faf8ffc4f9ba9134d8d72eb614c9ab0768be1b7bfd9d5bf602a8623b7025804fec12cea751220a3ccb5d449064139
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAX8gu3Gno9yvrjKI:ymb3NkkiQ3mdBjFo68t3Gno9Ij
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/2936-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/264-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/992-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/800-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3792-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4664-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1644-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 27 IoCs
resource yara_rule behavioral2/memory/2936-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/264-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4660-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1584-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1448-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2416-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1496-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3428-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2340-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2340-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5052-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3912-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4872-95-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4996-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3844-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/992-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/464-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/800-137-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1380-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2328-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3792-167-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/764-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2820-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2144-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4664-190-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1828-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1644-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 264 lfrffrr.exe 4660 42204.exe 1584 428282.exe 2160 002082.exe 1448 80226.exe 2416 ntttnb.exe 3428 btnhtb.exe 1496 82448.exe 2340 60266.exe 5052 vjdpj.exe 1804 hbtbtn.exe 3912 frxrlfl.exe 4872 6246428.exe 4056 82260.exe 4996 22820.exe 3844 ntbbbn.exe 3416 xrlrrxr.exe 992 2404400.exe 464 9bnntb.exe 800 jpdvv.exe 2328 4620426.exe 1380 vvvdp.exe 5044 rfflxrl.exe 2712 640488.exe 3792 6400826.exe 764 068222.exe 2820 4882660.exe 2144 pjdvp.exe 4664 0020226.exe 1828 vddvd.exe 1644 8200622.exe 1688 4448682.exe 4936 vjvpp.exe 4496 00664.exe 1716 lffxrrr.exe 4504 846048.exe 4316 266648.exe 5036 a2804.exe 2936 xrfxrfr.exe 5000 68000.exe 1584 4204026.exe 1580 rxffffl.exe 4804 0000000.exe 412 dpvjv.exe 3508 dvdvd.exe 1448 3vvjd.exe 4436 hnnhtt.exe 3632 lxrxrfr.exe 980 pddpp.exe 2036 u844604.exe 2912 3vddv.exe 5104 frxlxxr.exe 2800 0448226.exe 824 nhhbtn.exe 2188 042806.exe 4872 802888.exe 1332 028822.exe 3228 284826.exe 4708 htnhbb.exe 3244 88406.exe 3300 288824.exe 648 6040280.exe 4992 bbbthh.exe 1048 60048.exe -
resource yara_rule behavioral2/memory/2936-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/264-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4660-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3844-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/992-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/800-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3792-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1828-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 264 2936 05645442132cb14ff2f64e0b0f2a740f2b07505949961eb96423c6564c5dc264.exe 83 PID 2936 wrote to memory of 264 2936 05645442132cb14ff2f64e0b0f2a740f2b07505949961eb96423c6564c5dc264.exe 83 PID 2936 wrote to memory of 264 2936 05645442132cb14ff2f64e0b0f2a740f2b07505949961eb96423c6564c5dc264.exe 83 PID 264 wrote to memory of 4660 264 lfrffrr.exe 84 PID 264 wrote to memory of 4660 264 lfrffrr.exe 84 PID 264 wrote to memory of 4660 264 lfrffrr.exe 84 PID 4660 wrote to memory of 1584 4660 42204.exe 85 PID 4660 wrote to memory of 1584 4660 42204.exe 85 PID 4660 wrote to memory of 1584 4660 42204.exe 85 PID 1584 wrote to memory of 2160 1584 428282.exe 86 PID 1584 wrote to memory of 2160 1584 428282.exe 86 PID 1584 wrote to memory of 2160 1584 428282.exe 86 PID 2160 wrote to memory of 1448 2160 002082.exe 87 PID 2160 wrote to memory of 1448 2160 002082.exe 87 PID 2160 wrote to memory of 1448 2160 002082.exe 87 PID 1448 wrote to memory of 2416 1448 80226.exe 88 PID 1448 wrote to memory of 2416 1448 80226.exe 88 PID 1448 wrote to memory of 2416 1448 80226.exe 88 PID 2416 wrote to memory of 3428 2416 ntttnb.exe 89 PID 2416 wrote to memory of 3428 2416 ntttnb.exe 89 PID 2416 wrote to memory of 3428 2416 ntttnb.exe 89 PID 3428 wrote to memory of 1496 3428 btnhtb.exe 90 PID 3428 wrote to memory of 1496 3428 btnhtb.exe 90 PID 3428 wrote to memory of 1496 3428 btnhtb.exe 90 PID 1496 wrote to memory of 2340 1496 82448.exe 91 PID 1496 wrote to memory of 2340 1496 82448.exe 91 PID 1496 wrote to memory of 2340 1496 82448.exe 91 PID 2340 wrote to memory of 5052 2340 60266.exe 92 PID 2340 wrote to memory of 5052 2340 60266.exe 92 PID 2340 wrote to memory of 5052 2340 60266.exe 92 PID 5052 wrote to memory of 1804 5052 vjdpj.exe 93 PID 5052 wrote to memory of 1804 5052 vjdpj.exe 93 PID 5052 wrote to memory of 1804 5052 vjdpj.exe 93 PID 1804 wrote to memory of 3912 1804 hbtbtn.exe 94 PID 1804 wrote to memory of 3912 1804 hbtbtn.exe 94 PID 1804 wrote to memory of 3912 1804 hbtbtn.exe 94 PID 3912 wrote to memory of 4872 3912 frxrlfl.exe 95 PID 3912 wrote to memory of 4872 3912 frxrlfl.exe 95 PID 3912 wrote to memory of 4872 3912 frxrlfl.exe 95 PID 4872 wrote to memory of 4056 4872 6246428.exe 96 PID 4872 wrote to memory of 4056 4872 6246428.exe 96 PID 4872 wrote to memory of 4056 4872 6246428.exe 96 PID 4056 wrote to memory of 4996 4056 82260.exe 97 PID 4056 wrote to memory of 4996 4056 82260.exe 97 PID 4056 wrote to memory of 4996 4056 82260.exe 97 PID 4996 wrote to memory of 3844 4996 22820.exe 98 PID 4996 wrote to memory of 3844 4996 22820.exe 98 PID 4996 wrote to memory of 3844 4996 22820.exe 98 PID 3844 wrote to memory of 3416 3844 ntbbbn.exe 99 PID 3844 wrote to memory of 3416 3844 ntbbbn.exe 99 PID 3844 wrote to memory of 3416 3844 ntbbbn.exe 99 PID 3416 wrote to memory of 992 3416 xrlrrxr.exe 100 PID 3416 wrote to memory of 992 3416 xrlrrxr.exe 100 PID 3416 wrote to memory of 992 3416 xrlrrxr.exe 100 PID 992 wrote to memory of 464 992 2404400.exe 101 PID 992 wrote to memory of 464 992 2404400.exe 101 PID 992 wrote to memory of 464 992 2404400.exe 101 PID 464 wrote to memory of 800 464 9bnntb.exe 102 PID 464 wrote to memory of 800 464 9bnntb.exe 102 PID 464 wrote to memory of 800 464 9bnntb.exe 102 PID 800 wrote to memory of 2328 800 jpdvv.exe 103 PID 800 wrote to memory of 2328 800 jpdvv.exe 103 PID 800 wrote to memory of 2328 800 jpdvv.exe 103 PID 2328 wrote to memory of 1380 2328 4620426.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\05645442132cb14ff2f64e0b0f2a740f2b07505949961eb96423c6564c5dc264.exe"C:\Users\Admin\AppData\Local\Temp\05645442132cb14ff2f64e0b0f2a740f2b07505949961eb96423c6564c5dc264.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\lfrffrr.exec:\lfrffrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\42204.exec:\42204.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\428282.exec:\428282.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\002082.exec:\002082.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\80226.exec:\80226.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\ntttnb.exec:\ntttnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\btnhtb.exec:\btnhtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\82448.exec:\82448.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\60266.exec:\60266.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\vjdpj.exec:\vjdpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\hbtbtn.exec:\hbtbtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\frxrlfl.exec:\frxrlfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\6246428.exec:\6246428.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\82260.exec:\82260.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\22820.exec:\22820.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\ntbbbn.exec:\ntbbbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\xrlrrxr.exec:\xrlrrxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\2404400.exec:\2404400.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\9bnntb.exec:\9bnntb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\jpdvv.exec:\jpdvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\4620426.exec:\4620426.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\vvvdp.exec:\vvvdp.exe23⤵
- Executes dropped EXE
PID:1380 -
\??\c:\rfflxrl.exec:\rfflxrl.exe24⤵
- Executes dropped EXE
PID:5044 -
\??\c:\640488.exec:\640488.exe25⤵
- Executes dropped EXE
PID:2712 -
\??\c:\6400826.exec:\6400826.exe26⤵
- Executes dropped EXE
PID:3792 -
\??\c:\068222.exec:\068222.exe27⤵
- Executes dropped EXE
PID:764 -
\??\c:\4882660.exec:\4882660.exe28⤵
- Executes dropped EXE
PID:2820 -
\??\c:\pjdvp.exec:\pjdvp.exe29⤵
- Executes dropped EXE
PID:2144 -
\??\c:\0020226.exec:\0020226.exe30⤵
- Executes dropped EXE
PID:4664 -
\??\c:\vddvd.exec:\vddvd.exe31⤵
- Executes dropped EXE
PID:1828 -
\??\c:\8200622.exec:\8200622.exe32⤵
- Executes dropped EXE
PID:1644 -
\??\c:\4448682.exec:\4448682.exe33⤵
- Executes dropped EXE
PID:1688 -
\??\c:\vjvpp.exec:\vjvpp.exe34⤵
- Executes dropped EXE
PID:4936 -
\??\c:\00664.exec:\00664.exe35⤵
- Executes dropped EXE
PID:4496 -
\??\c:\lffxrrr.exec:\lffxrrr.exe36⤵
- Executes dropped EXE
PID:1716 -
\??\c:\846048.exec:\846048.exe37⤵
- Executes dropped EXE
PID:4504 -
\??\c:\266648.exec:\266648.exe38⤵
- Executes dropped EXE
PID:4316 -
\??\c:\a2804.exec:\a2804.exe39⤵
- Executes dropped EXE
PID:5036 -
\??\c:\xrfxrfr.exec:\xrfxrfr.exe40⤵
- Executes dropped EXE
PID:2936 -
\??\c:\68000.exec:\68000.exe41⤵
- Executes dropped EXE
PID:5000 -
\??\c:\4204026.exec:\4204026.exe42⤵
- Executes dropped EXE
PID:1584 -
\??\c:\rxffffl.exec:\rxffffl.exe43⤵
- Executes dropped EXE
PID:1580 -
\??\c:\0000000.exec:\0000000.exe44⤵
- Executes dropped EXE
PID:4804 -
\??\c:\dpvjv.exec:\dpvjv.exe45⤵
- Executes dropped EXE
PID:412 -
\??\c:\dvdvd.exec:\dvdvd.exe46⤵
- Executes dropped EXE
PID:3508 -
\??\c:\3vvjd.exec:\3vvjd.exe47⤵
- Executes dropped EXE
PID:1448 -
\??\c:\hnnhtt.exec:\hnnhtt.exe48⤵
- Executes dropped EXE
PID:4436 -
\??\c:\lxrxrfr.exec:\lxrxrfr.exe49⤵
- Executes dropped EXE
PID:3632 -
\??\c:\pddpp.exec:\pddpp.exe50⤵
- Executes dropped EXE
PID:980 -
\??\c:\u844604.exec:\u844604.exe51⤵
- Executes dropped EXE
PID:2036 -
\??\c:\3vddv.exec:\3vddv.exe52⤵
- Executes dropped EXE
PID:2912 -
\??\c:\frxlxxr.exec:\frxlxxr.exe53⤵
- Executes dropped EXE
PID:5104 -
\??\c:\0448226.exec:\0448226.exe54⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nhhbtn.exec:\nhhbtn.exe55⤵
- Executes dropped EXE
PID:824 -
\??\c:\042806.exec:\042806.exe56⤵
- Executes dropped EXE
PID:2188 -
\??\c:\802888.exec:\802888.exe57⤵
- Executes dropped EXE
PID:4872 -
\??\c:\028822.exec:\028822.exe58⤵
- Executes dropped EXE
PID:1332 -
\??\c:\284826.exec:\284826.exe59⤵
- Executes dropped EXE
PID:3228 -
\??\c:\htnhbb.exec:\htnhbb.exe60⤵
- Executes dropped EXE
PID:4708 -
\??\c:\88406.exec:\88406.exe61⤵
- Executes dropped EXE
PID:3244 -
\??\c:\288824.exec:\288824.exe62⤵
- Executes dropped EXE
PID:3300 -
\??\c:\6040280.exec:\6040280.exe63⤵
- Executes dropped EXE
PID:648 -
\??\c:\bbbthh.exec:\bbbthh.exe64⤵
- Executes dropped EXE
PID:4992 -
\??\c:\60048.exec:\60048.exe65⤵
- Executes dropped EXE
PID:1048 -
\??\c:\084480.exec:\084480.exe66⤵PID:2236
-
\??\c:\xrlfrrr.exec:\xrlfrrr.exe67⤵PID:692
-
\??\c:\86822.exec:\86822.exe68⤵PID:3492
-
\??\c:\fxxlffx.exec:\fxxlffx.exe69⤵PID:2308
-
\??\c:\a0882.exec:\a0882.exe70⤵PID:4468
-
\??\c:\1bbbbn.exec:\1bbbbn.exe71⤵PID:4920
-
\??\c:\68488.exec:\68488.exe72⤵PID:2320
-
\??\c:\48884.exec:\48884.exe73⤵PID:4404
-
\??\c:\8444448.exec:\8444448.exe74⤵PID:5020
-
\??\c:\6684444.exec:\6684444.exe75⤵PID:1052
-
\??\c:\bhtttt.exec:\bhtttt.exe76⤵PID:2140
-
\??\c:\xlfxrxx.exec:\xlfxrxx.exe77⤵PID:3504
-
\??\c:\fxxxrxx.exec:\fxxxrxx.exe78⤵PID:3996
-
\??\c:\g2886.exec:\g2886.exe79⤵PID:3660
-
\??\c:\840488.exec:\840488.exe80⤵PID:948
-
\??\c:\pvddv.exec:\pvddv.exe81⤵PID:3956
-
\??\c:\82208.exec:\82208.exe82⤵PID:768
-
\??\c:\28842.exec:\28842.exe83⤵PID:1088
-
\??\c:\tnbbhh.exec:\tnbbhh.exe84⤵PID:2796
-
\??\c:\04488.exec:\04488.exe85⤵PID:1560
-
\??\c:\0200006.exec:\0200006.exe86⤵PID:4572
-
\??\c:\22226.exec:\22226.exe87⤵PID:2704
-
\??\c:\s2888.exec:\s2888.exe88⤵PID:2296
-
\??\c:\o844488.exec:\o844488.exe89⤵PID:4596
-
\??\c:\7htntt.exec:\7htntt.exe90⤵PID:3880
-
\??\c:\tthbbb.exec:\tthbbb.exe91⤵PID:3964
-
\??\c:\482604.exec:\482604.exe92⤵PID:3092
-
\??\c:\hbtnhh.exec:\hbtnhh.exe93⤵PID:4808
-
\??\c:\hnnhtt.exec:\hnnhtt.exe94⤵PID:2384
-
\??\c:\ttnhnh.exec:\ttnhnh.exe95⤵PID:2000
-
\??\c:\vpvvp.exec:\vpvvp.exe96⤵PID:3428
-
\??\c:\ntbtnn.exec:\ntbtnn.exe97⤵PID:2240
-
\??\c:\820406.exec:\820406.exe98⤵PID:4224
-
\??\c:\lffxxrf.exec:\lffxxrf.exe99⤵PID:3064
-
\??\c:\048260.exec:\048260.exe100⤵PID:2912
-
\??\c:\82260.exec:\82260.exe101⤵PID:5052
-
\??\c:\86820.exec:\86820.exe102⤵PID:2800
-
\??\c:\dpvdd.exec:\dpvdd.exe103⤵PID:1544
-
\??\c:\nhnhbb.exec:\nhnhbb.exe104⤵PID:3628
-
\??\c:\dppdd.exec:\dppdd.exe105⤵PID:3664
-
\??\c:\jdvpj.exec:\jdvpj.exe106⤵PID:1332
-
\??\c:\xlllxxr.exec:\xlllxxr.exe107⤵PID:4220
-
\??\c:\4082662.exec:\4082662.exe108⤵PID:1720
-
\??\c:\lfxxfxf.exec:\lfxxfxf.exe109⤵PID:1796
-
\??\c:\260624.exec:\260624.exe110⤵PID:3724
-
\??\c:\pvvpd.exec:\pvvpd.exe111⤵PID:4736
-
\??\c:\hthhbb.exec:\hthhbb.exe112⤵PID:4844
-
\??\c:\pvdvp.exec:\pvdvp.exe113⤵PID:1048
-
\??\c:\86206.exec:\86206.exe114⤵PID:2236
-
\??\c:\44004.exec:\44004.exe115⤵PID:392
-
\??\c:\400044.exec:\400044.exe116⤵PID:1772
-
\??\c:\2622040.exec:\2622040.exe117⤵PID:2376
-
\??\c:\lrlllfx.exec:\lrlllfx.exe118⤵PID:4468
-
\??\c:\248664.exec:\248664.exe119⤵PID:2228
-
\??\c:\tbthnh.exec:\tbthnh.exe120⤵PID:924
-
\??\c:\thnbnn.exec:\thnbnn.exe121⤵PID:4372
-
\??\c:\48080.exec:\48080.exe122⤵PID:3016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-