Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 08:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
42339071b3834f5cb04d38dddb282f4f17309ee3be98e38514ff3707f8fca940.exe
Resource
win7-20240611-en
5 signatures
150 seconds
General
-
Target
42339071b3834f5cb04d38dddb282f4f17309ee3be98e38514ff3707f8fca940.exe
-
Size
73KB
-
MD5
0fc08261466da61d4b57a7d9e344ac50
-
SHA1
24a9145bb510b486d544d6442a8cb7ab715fdcc8
-
SHA256
42339071b3834f5cb04d38dddb282f4f17309ee3be98e38514ff3707f8fca940
-
SHA512
16d2ccc42ee2a73159e00fca4aa40490361db34da90e116732aec722a6d9e461a9176daaf9c3001d7cbc97e0870cd9ffbd8ad46ab3cd80790723f1cfb49e6d3c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUwcsbYsGv+:ymb3NkkiQ3mdBjF0yjcsMsA+
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2504-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4288-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1304-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3140-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1876-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/532-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2504-657-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2832 lfffxxl.exe 4476 tnbbnn.exe 4756 frllrll.exe 4884 bbtnth.exe 1572 vdjjj.exe 1624 xlffflf.exe 4836 nnnttn.exe 4168 lrxrxrl.exe 3840 7bnttt.exe 2164 bntnhh.exe 3436 5dddd.exe 4288 hhhnnb.exe 1304 jjvdd.exe 4460 flrxfrx.exe 4816 vddjj.exe 4900 lrrrxll.exe 3140 3ttthn.exe 4764 jpvvp.exe 4600 7pdvv.exe 3928 rfrllrx.exe 4640 9bhnbb.exe 1284 rffflrx.exe 1716 tnbbhh.exe 4536 dvdvd.exe 4800 vpjjd.exe 1876 rrxrlrl.exe 532 7thhbt.exe 2988 thtthb.exe 1440 vpdpj.exe 3036 dvpvd.exe 1588 llxfrrx.exe 100 bbnhnt.exe 2000 jpppd.exe 4840 rxxxxxf.exe 2908 1rrrlrr.exe 3884 9tttbh.exe 232 vddjp.exe 5044 llxrxxl.exe 416 httbht.exe 4576 ttthbt.exe 3920 djpdp.exe 2760 3xlrxfl.exe 2244 5rxxflr.exe 4680 bttbbt.exe 4928 5dvvd.exe 1340 rrfxrrr.exe 1592 rffxxfl.exe 2304 htnnhh.exe 4884 hnhnhn.exe 2268 dpvdd.exe 640 rrxrfxr.exe 1156 rlrxxxf.exe 4956 hhnhbb.exe 3804 dpjjv.exe 3904 jjppj.exe 736 frxxrlr.exe 2932 htbhbb.exe 3292 pvpjd.exe 1752 frrflxr.exe 1708 5rlllrl.exe 2372 nnbhbt.exe 4460 pppdv.exe 3000 djpdd.exe 3816 xlfxrrl.exe -
resource yara_rule behavioral2/memory/2504-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2504-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1304-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3928-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1876-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/532-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2504-657-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2832 2504 42339071b3834f5cb04d38dddb282f4f17309ee3be98e38514ff3707f8fca940.exe 81 PID 2504 wrote to memory of 2832 2504 42339071b3834f5cb04d38dddb282f4f17309ee3be98e38514ff3707f8fca940.exe 81 PID 2504 wrote to memory of 2832 2504 42339071b3834f5cb04d38dddb282f4f17309ee3be98e38514ff3707f8fca940.exe 81 PID 2832 wrote to memory of 4476 2832 lfffxxl.exe 82 PID 2832 wrote to memory of 4476 2832 lfffxxl.exe 82 PID 2832 wrote to memory of 4476 2832 lfffxxl.exe 82 PID 4476 wrote to memory of 4756 4476 tnbbnn.exe 83 PID 4476 wrote to memory of 4756 4476 tnbbnn.exe 83 PID 4476 wrote to memory of 4756 4476 tnbbnn.exe 83 PID 4756 wrote to memory of 4884 4756 frllrll.exe 84 PID 4756 wrote to memory of 4884 4756 frllrll.exe 84 PID 4756 wrote to memory of 4884 4756 frllrll.exe 84 PID 4884 wrote to memory of 1572 4884 bbtnth.exe 85 PID 4884 wrote to memory of 1572 4884 bbtnth.exe 85 PID 4884 wrote to memory of 1572 4884 bbtnth.exe 85 PID 1572 wrote to memory of 1624 1572 vdjjj.exe 86 PID 1572 wrote to memory of 1624 1572 vdjjj.exe 86 PID 1572 wrote to memory of 1624 1572 vdjjj.exe 86 PID 1624 wrote to memory of 4836 1624 xlffflf.exe 87 PID 1624 wrote to memory of 4836 1624 xlffflf.exe 87 PID 1624 wrote to memory of 4836 1624 xlffflf.exe 87 PID 4836 wrote to memory of 4168 4836 nnnttn.exe 88 PID 4836 wrote to memory of 4168 4836 nnnttn.exe 88 PID 4836 wrote to memory of 4168 4836 nnnttn.exe 88 PID 4168 wrote to memory of 3840 4168 lrxrxrl.exe 89 PID 4168 wrote to memory of 3840 4168 lrxrxrl.exe 89 PID 4168 wrote to memory of 3840 4168 lrxrxrl.exe 89 PID 3840 wrote to memory of 2164 3840 7bnttt.exe 90 PID 3840 wrote to memory of 2164 3840 7bnttt.exe 90 PID 3840 wrote to memory of 2164 3840 7bnttt.exe 90 PID 2164 wrote to memory of 3436 2164 bntnhh.exe 91 PID 2164 wrote to memory of 3436 2164 bntnhh.exe 91 PID 2164 wrote to memory of 3436 2164 bntnhh.exe 91 PID 3436 wrote to memory of 4288 3436 5dddd.exe 93 PID 3436 wrote to memory of 4288 3436 5dddd.exe 93 PID 3436 wrote to memory of 4288 3436 5dddd.exe 93 PID 4288 wrote to memory of 1304 4288 hhhnnb.exe 94 PID 4288 wrote to memory of 1304 4288 hhhnnb.exe 94 PID 4288 wrote to memory of 1304 4288 hhhnnb.exe 94 PID 1304 wrote to memory of 4460 1304 jjvdd.exe 95 PID 1304 wrote to memory of 4460 1304 jjvdd.exe 95 PID 1304 wrote to memory of 4460 1304 jjvdd.exe 95 PID 4460 wrote to memory of 4816 4460 flrxfrx.exe 97 PID 4460 wrote to memory of 4816 4460 flrxfrx.exe 97 PID 4460 wrote to memory of 4816 4460 flrxfrx.exe 97 PID 4816 wrote to memory of 4900 4816 vddjj.exe 98 PID 4816 wrote to memory of 4900 4816 vddjj.exe 98 PID 4816 wrote to memory of 4900 4816 vddjj.exe 98 PID 4900 wrote to memory of 3140 4900 lrrrxll.exe 99 PID 4900 wrote to memory of 3140 4900 lrrrxll.exe 99 PID 4900 wrote to memory of 3140 4900 lrrrxll.exe 99 PID 3140 wrote to memory of 4764 3140 3ttthn.exe 100 PID 3140 wrote to memory of 4764 3140 3ttthn.exe 100 PID 3140 wrote to memory of 4764 3140 3ttthn.exe 100 PID 4764 wrote to memory of 4600 4764 jpvvp.exe 101 PID 4764 wrote to memory of 4600 4764 jpvvp.exe 101 PID 4764 wrote to memory of 4600 4764 jpvvp.exe 101 PID 4600 wrote to memory of 3928 4600 7pdvv.exe 102 PID 4600 wrote to memory of 3928 4600 7pdvv.exe 102 PID 4600 wrote to memory of 3928 4600 7pdvv.exe 102 PID 3928 wrote to memory of 4640 3928 rfrllrx.exe 103 PID 3928 wrote to memory of 4640 3928 rfrllrx.exe 103 PID 3928 wrote to memory of 4640 3928 rfrllrx.exe 103 PID 4640 wrote to memory of 1284 4640 9bhnbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\42339071b3834f5cb04d38dddb282f4f17309ee3be98e38514ff3707f8fca940.exe"C:\Users\Admin\AppData\Local\Temp\42339071b3834f5cb04d38dddb282f4f17309ee3be98e38514ff3707f8fca940.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\lfffxxl.exec:\lfffxxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\tnbbnn.exec:\tnbbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\frllrll.exec:\frllrll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\bbtnth.exec:\bbtnth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\vdjjj.exec:\vdjjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\xlffflf.exec:\xlffflf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\nnnttn.exec:\nnnttn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\lrxrxrl.exec:\lrxrxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\7bnttt.exec:\7bnttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\bntnhh.exec:\bntnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\5dddd.exec:\5dddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\hhhnnb.exec:\hhhnnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\jjvdd.exec:\jjvdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\flrxfrx.exec:\flrxfrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\vddjj.exec:\vddjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\lrrrxll.exec:\lrrrxll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\3ttthn.exec:\3ttthn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\jpvvp.exec:\jpvvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\7pdvv.exec:\7pdvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\rfrllrx.exec:\rfrllrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\9bhnbb.exec:\9bhnbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\rffflrx.exec:\rffflrx.exe23⤵
- Executes dropped EXE
PID:1284 -
\??\c:\tnbbhh.exec:\tnbbhh.exe24⤵
- Executes dropped EXE
PID:1716 -
\??\c:\dvdvd.exec:\dvdvd.exe25⤵
- Executes dropped EXE
PID:4536 -
\??\c:\vpjjd.exec:\vpjjd.exe26⤵
- Executes dropped EXE
PID:4800 -
\??\c:\rrxrlrl.exec:\rrxrlrl.exe27⤵
- Executes dropped EXE
PID:1876 -
\??\c:\7thhbt.exec:\7thhbt.exe28⤵
- Executes dropped EXE
PID:532 -
\??\c:\thtthb.exec:\thtthb.exe29⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vpdpj.exec:\vpdpj.exe30⤵
- Executes dropped EXE
PID:1440 -
\??\c:\dvpvd.exec:\dvpvd.exe31⤵
- Executes dropped EXE
PID:3036 -
\??\c:\llxfrrx.exec:\llxfrrx.exe32⤵
- Executes dropped EXE
PID:1588 -
\??\c:\bbnhnt.exec:\bbnhnt.exe33⤵
- Executes dropped EXE
PID:100 -
\??\c:\jpppd.exec:\jpppd.exe34⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rxxxxxf.exec:\rxxxxxf.exe35⤵
- Executes dropped EXE
PID:4840 -
\??\c:\1rrrlrr.exec:\1rrrlrr.exe36⤵
- Executes dropped EXE
PID:2908 -
\??\c:\9tttbh.exec:\9tttbh.exe37⤵
- Executes dropped EXE
PID:3884 -
\??\c:\vddjp.exec:\vddjp.exe38⤵
- Executes dropped EXE
PID:232 -
\??\c:\llxrxxl.exec:\llxrxxl.exe39⤵
- Executes dropped EXE
PID:5044 -
\??\c:\httbht.exec:\httbht.exe40⤵
- Executes dropped EXE
PID:416 -
\??\c:\ttthbt.exec:\ttthbt.exe41⤵
- Executes dropped EXE
PID:4576 -
\??\c:\djpdp.exec:\djpdp.exe42⤵
- Executes dropped EXE
PID:3920 -
\??\c:\3xlrxfl.exec:\3xlrxfl.exe43⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5rxxflr.exec:\5rxxflr.exe44⤵
- Executes dropped EXE
PID:2244 -
\??\c:\bttbbt.exec:\bttbbt.exe45⤵
- Executes dropped EXE
PID:4680 -
\??\c:\5dvvd.exec:\5dvvd.exe46⤵
- Executes dropped EXE
PID:4928 -
\??\c:\rrfxrrr.exec:\rrfxrrr.exe47⤵
- Executes dropped EXE
PID:1340 -
\??\c:\rffxxfl.exec:\rffxxfl.exe48⤵
- Executes dropped EXE
PID:1592 -
\??\c:\htnnhh.exec:\htnnhh.exe49⤵
- Executes dropped EXE
PID:2304 -
\??\c:\hnhnhn.exec:\hnhnhn.exe50⤵
- Executes dropped EXE
PID:4884 -
\??\c:\dpvdd.exec:\dpvdd.exe51⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rrxrfxr.exec:\rrxrfxr.exe52⤵
- Executes dropped EXE
PID:640 -
\??\c:\rlrxxxf.exec:\rlrxxxf.exe53⤵
- Executes dropped EXE
PID:1156 -
\??\c:\hhnhbb.exec:\hhnhbb.exe54⤵
- Executes dropped EXE
PID:4956 -
\??\c:\dpjjv.exec:\dpjjv.exe55⤵
- Executes dropped EXE
PID:3804 -
\??\c:\jjppj.exec:\jjppj.exe56⤵
- Executes dropped EXE
PID:3904 -
\??\c:\frxxrlr.exec:\frxxrlr.exe57⤵
- Executes dropped EXE
PID:736 -
\??\c:\htbhbb.exec:\htbhbb.exe58⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pvpjd.exec:\pvpjd.exe59⤵
- Executes dropped EXE
PID:3292 -
\??\c:\frrflxr.exec:\frrflxr.exe60⤵
- Executes dropped EXE
PID:1752 -
\??\c:\5rlllrl.exec:\5rlllrl.exe61⤵
- Executes dropped EXE
PID:1708 -
\??\c:\nnbhbt.exec:\nnbhbt.exe62⤵
- Executes dropped EXE
PID:2372 -
\??\c:\pppdv.exec:\pppdv.exe63⤵
- Executes dropped EXE
PID:4460 -
\??\c:\djpdd.exec:\djpdd.exe64⤵
- Executes dropped EXE
PID:3000 -
\??\c:\xlfxrrl.exec:\xlfxrrl.exe65⤵
- Executes dropped EXE
PID:3816 -
\??\c:\llrxllf.exec:\llrxllf.exe66⤵PID:832
-
\??\c:\httbnn.exec:\httbnn.exe67⤵PID:1368
-
\??\c:\jppdd.exec:\jppdd.exe68⤵PID:4936
-
\??\c:\jvjpv.exec:\jvjpv.exe69⤵PID:1476
-
\??\c:\frrrlrl.exec:\frrrlrl.exe70⤵PID:4540
-
\??\c:\nhbtnn.exec:\nhbtnn.exe71⤵PID:4272
-
\??\c:\vvddd.exec:\vvddd.exe72⤵PID:2780
-
\??\c:\xfxfllr.exec:\xfxfllr.exe73⤵PID:2824
-
\??\c:\frlxrxf.exec:\frlxrxf.exe74⤵PID:3112
-
\??\c:\1nhbbb.exec:\1nhbbb.exe75⤵PID:4448
-
\??\c:\ppvpv.exec:\ppvpv.exe76⤵PID:984
-
\??\c:\fxrllfx.exec:\fxrllfx.exe77⤵PID:5048
-
\??\c:\htnbhh.exec:\htnbhh.exe78⤵PID:1536
-
\??\c:\hbntnt.exec:\hbntnt.exe79⤵PID:384
-
\??\c:\dvpjp.exec:\dvpjp.exe80⤵PID:4528
-
\??\c:\lrrrlff.exec:\lrrrlff.exe81⤵PID:1664
-
\??\c:\bttbbb.exec:\bttbbb.exe82⤵PID:1040
-
\??\c:\tbnhhn.exec:\tbnhhn.exe83⤵PID:1540
-
\??\c:\vjdvp.exec:\vjdvp.exe84⤵PID:4360
-
\??\c:\xlllxrl.exec:\xlllxrl.exe85⤵PID:3328
-
\??\c:\xllflfx.exec:\xllflfx.exe86⤵PID:4904
-
\??\c:\9nbnnn.exec:\9nbnnn.exe87⤵PID:228
-
\??\c:\ddvdv.exec:\ddvdv.exe88⤵PID:2900
-
\??\c:\vdjjj.exec:\vdjjj.exe89⤵PID:2588
-
\??\c:\7lrlfff.exec:\7lrlfff.exe90⤵PID:2148
-
\??\c:\hhbhtb.exec:\hhbhtb.exe91⤵PID:4812
-
\??\c:\bbbhhn.exec:\bbbhhn.exe92⤵PID:1816
-
\??\c:\pdvpj.exec:\pdvpj.exe93⤵PID:4864
-
\??\c:\xrllllf.exec:\xrllllf.exe94⤵PID:3920
-
\??\c:\tnbtnn.exec:\tnbtnn.exe95⤵PID:4008
-
\??\c:\ttbnhn.exec:\ttbnhn.exe96⤵PID:1804
-
\??\c:\jvdvd.exec:\jvdvd.exe97⤵PID:4680
-
\??\c:\fxlxxxx.exec:\fxlxxxx.exe98⤵PID:4476
-
\??\c:\lxllfxr.exec:\lxllfxr.exe99⤵PID:3444
-
\??\c:\thnhnn.exec:\thnhnn.exe100⤵PID:620
-
\??\c:\htttnh.exec:\htttnh.exe101⤵PID:4520
-
\??\c:\pdvpd.exec:\pdvpd.exe102⤵PID:1972
-
\??\c:\3xrrlrr.exec:\3xrrlrr.exe103⤵PID:1624
-
\??\c:\jpjjp.exec:\jpjjp.exe104⤵PID:4996
-
\??\c:\pdvdd.exec:\pdvdd.exe105⤵PID:1156
-
\??\c:\fxrfxxr.exec:\fxrfxxr.exe106⤵PID:4772
-
\??\c:\1hbbtt.exec:\1hbbtt.exe107⤵PID:380
-
\??\c:\vpjpp.exec:\vpjpp.exe108⤵PID:1964
-
\??\c:\xfxffrf.exec:\xfxffrf.exe109⤵PID:736
-
\??\c:\rlrlffx.exec:\rlrlffx.exe110⤵PID:4292
-
\??\c:\nbhhnn.exec:\nbhhnn.exe111⤵PID:3292
-
\??\c:\1nttbh.exec:\1nttbh.exe112⤵PID:1752
-
\??\c:\jvpjd.exec:\jvpjd.exe113⤵PID:4364
-
\??\c:\lffxrfl.exec:\lffxrfl.exe114⤵PID:2848
-
\??\c:\bnnhbn.exec:\bnnhbn.exe115⤵PID:4460
-
\??\c:\vpppv.exec:\vpppv.exe116⤵PID:1108
-
\??\c:\3rxlxxx.exec:\3rxlxxx.exe117⤵PID:3816
-
\??\c:\fxrfffx.exec:\fxrfffx.exe118⤵PID:408
-
\??\c:\9nhtnh.exec:\9nhtnh.exe119⤵PID:1324
-
\??\c:\vdvpp.exec:\vdvpp.exe120⤵PID:1576
-
\??\c:\flrlfff.exec:\flrlfff.exe121⤵PID:3268
-
\??\c:\rllfxxx.exec:\rllfxxx.exe122⤵PID:3384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-