Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 06:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
faa6d7023c135572ba5bac85c8ee129e77b426baa651f4aeae6eea41a9b8514a.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
faa6d7023c135572ba5bac85c8ee129e77b426baa651f4aeae6eea41a9b8514a.exe
-
Size
89KB
-
MD5
15e900e05a567435cb68c2f24fa004f6
-
SHA1
38d141f353f54d3f4d43b118e835540b8907db19
-
SHA256
faa6d7023c135572ba5bac85c8ee129e77b426baa651f4aeae6eea41a9b8514a
-
SHA512
001d3435efe3461b3054cdbde46e040afb14c73ee33cdd58ac416d71e397831c45eb5295ac54c7be02c40fdb5d157c5c2e6a9c12a5595f93db0681c4b5808dad
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2iJvRirE0DmmdL2jqWkBk:ymb3NkkiQ3mdBjF+3TU2iBRioSumWS1S
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/840-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4084-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2492-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4084 vdppd.exe 4456 pdddd.exe 4108 dvpjd.exe 3636 lfxlxrl.exe 1648 dddpj.exe 4744 vpjjj.exe 2208 xrrlflx.exe 4728 hhbtnn.exe 3368 nbnhbb.exe 3984 nnbhbt.exe 3948 vjjvj.exe 2040 vvvdj.exe 3084 jpppd.exe 4484 pppdp.exe 2492 lfrxrrx.exe 1680 rlllllr.exe 228 llxfxlx.exe 2088 tntntb.exe 2152 hhthhb.exe 2436 nnbnnt.exe 4036 lrrlffr.exe 3844 frrffxl.exe 1972 llfxlfl.exe 4348 fxrfrfx.exe 1872 ffrxrrr.exe 4876 frxrllr.exe 844 nbnnht.exe 4904 3pvvj.exe 868 pjjjv.exe 436 nntbht.exe 3876 xffflxx.exe 3560 llffxrf.exe 4688 tnnbtt.exe 748 lfrfrfl.exe 4220 bhbbht.exe 1224 xflrlfl.exe 452 hbbbbb.exe 1904 rlllxlr.exe 3712 djppp.exe 3188 hbbnbt.exe 4464 flrfffr.exe 3516 jddjd.exe 3024 jvpjv.exe 1136 xxrrrxx.exe 3576 vvppj.exe 4108 djdpd.exe 3644 btbbbb.exe 4540 pvvvd.exe 540 tttnnh.exe 3520 lfffflf.exe 3892 ntbbhb.exe 4580 rfrlrrx.exe 3968 nhhnhh.exe 1612 xffxfxl.exe 3368 btbbtb.exe 4980 xlrrxxl.exe 1480 vjdjd.exe 3948 bhnttt.exe 924 rrffflf.exe 2316 nhhtth.exe 880 pjdpp.exe 3700 thtntt.exe 3624 xlfffxx.exe 116 flxlfrx.exe -
resource yara_rule behavioral2/memory/840-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4084-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2492-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3844-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 840 wrote to memory of 4084 840 faa6d7023c135572ba5bac85c8ee129e77b426baa651f4aeae6eea41a9b8514a.exe 85 PID 840 wrote to memory of 4084 840 faa6d7023c135572ba5bac85c8ee129e77b426baa651f4aeae6eea41a9b8514a.exe 85 PID 840 wrote to memory of 4084 840 faa6d7023c135572ba5bac85c8ee129e77b426baa651f4aeae6eea41a9b8514a.exe 85 PID 4084 wrote to memory of 4456 4084 vdppd.exe 86 PID 4084 wrote to memory of 4456 4084 vdppd.exe 86 PID 4084 wrote to memory of 4456 4084 vdppd.exe 86 PID 4456 wrote to memory of 4108 4456 pdddd.exe 87 PID 4456 wrote to memory of 4108 4456 pdddd.exe 87 PID 4456 wrote to memory of 4108 4456 pdddd.exe 87 PID 4108 wrote to memory of 3636 4108 dvpjd.exe 88 PID 4108 wrote to memory of 3636 4108 dvpjd.exe 88 PID 4108 wrote to memory of 3636 4108 dvpjd.exe 88 PID 3636 wrote to memory of 1648 3636 lfxlxrl.exe 89 PID 3636 wrote to memory of 1648 3636 lfxlxrl.exe 89 PID 3636 wrote to memory of 1648 3636 lfxlxrl.exe 89 PID 1648 wrote to memory of 4744 1648 dddpj.exe 90 PID 1648 wrote to memory of 4744 1648 dddpj.exe 90 PID 1648 wrote to memory of 4744 1648 dddpj.exe 90 PID 4744 wrote to memory of 2208 4744 vpjjj.exe 91 PID 4744 wrote to memory of 2208 4744 vpjjj.exe 91 PID 4744 wrote to memory of 2208 4744 vpjjj.exe 91 PID 2208 wrote to memory of 4728 2208 xrrlflx.exe 92 PID 2208 wrote to memory of 4728 2208 xrrlflx.exe 92 PID 2208 wrote to memory of 4728 2208 xrrlflx.exe 92 PID 4728 wrote to memory of 3368 4728 hhbtnn.exe 93 PID 4728 wrote to memory of 3368 4728 hhbtnn.exe 93 PID 4728 wrote to memory of 3368 4728 hhbtnn.exe 93 PID 3368 wrote to memory of 3984 3368 nbnhbb.exe 94 PID 3368 wrote to memory of 3984 3368 nbnhbb.exe 94 PID 3368 wrote to memory of 3984 3368 nbnhbb.exe 94 PID 3984 wrote to memory of 3948 3984 nnbhbt.exe 95 PID 3984 wrote to memory of 3948 3984 nnbhbt.exe 95 PID 3984 wrote to memory of 3948 3984 nnbhbt.exe 95 PID 3948 wrote to memory of 2040 3948 vjjvj.exe 96 PID 3948 wrote to memory of 2040 3948 vjjvj.exe 96 PID 3948 wrote to memory of 2040 3948 vjjvj.exe 96 PID 2040 wrote to memory of 3084 2040 vvvdj.exe 97 PID 2040 wrote to memory of 3084 2040 vvvdj.exe 97 PID 2040 wrote to memory of 3084 2040 vvvdj.exe 97 PID 3084 wrote to memory of 4484 3084 jpppd.exe 98 PID 3084 wrote to memory of 4484 3084 jpppd.exe 98 PID 3084 wrote to memory of 4484 3084 jpppd.exe 98 PID 4484 wrote to memory of 2492 4484 pppdp.exe 99 PID 4484 wrote to memory of 2492 4484 pppdp.exe 99 PID 4484 wrote to memory of 2492 4484 pppdp.exe 99 PID 2492 wrote to memory of 1680 2492 lfrxrrx.exe 100 PID 2492 wrote to memory of 1680 2492 lfrxrrx.exe 100 PID 2492 wrote to memory of 1680 2492 lfrxrrx.exe 100 PID 1680 wrote to memory of 228 1680 rlllllr.exe 101 PID 1680 wrote to memory of 228 1680 rlllllr.exe 101 PID 1680 wrote to memory of 228 1680 rlllllr.exe 101 PID 228 wrote to memory of 2088 228 llxfxlx.exe 102 PID 228 wrote to memory of 2088 228 llxfxlx.exe 102 PID 228 wrote to memory of 2088 228 llxfxlx.exe 102 PID 2088 wrote to memory of 2152 2088 tntntb.exe 103 PID 2088 wrote to memory of 2152 2088 tntntb.exe 103 PID 2088 wrote to memory of 2152 2088 tntntb.exe 103 PID 2152 wrote to memory of 2436 2152 hhthhb.exe 104 PID 2152 wrote to memory of 2436 2152 hhthhb.exe 104 PID 2152 wrote to memory of 2436 2152 hhthhb.exe 104 PID 2436 wrote to memory of 4036 2436 nnbnnt.exe 105 PID 2436 wrote to memory of 4036 2436 nnbnnt.exe 105 PID 2436 wrote to memory of 4036 2436 nnbnnt.exe 105 PID 4036 wrote to memory of 3844 4036 lrrlffr.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\faa6d7023c135572ba5bac85c8ee129e77b426baa651f4aeae6eea41a9b8514a.exe"C:\Users\Admin\AppData\Local\Temp\faa6d7023c135572ba5bac85c8ee129e77b426baa651f4aeae6eea41a9b8514a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\vdppd.exec:\vdppd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\pdddd.exec:\pdddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\dvpjd.exec:\dvpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\lfxlxrl.exec:\lfxlxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\dddpj.exec:\dddpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\vpjjj.exec:\vpjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\xrrlflx.exec:\xrrlflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\hhbtnn.exec:\hhbtnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\nbnhbb.exec:\nbnhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\nnbhbt.exec:\nnbhbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\vjjvj.exec:\vjjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\vvvdj.exec:\vvvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\jpppd.exec:\jpppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\pppdp.exec:\pppdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\lfrxrrx.exec:\lfrxrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\rlllllr.exec:\rlllllr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\llxfxlx.exec:\llxfxlx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\tntntb.exec:\tntntb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\hhthhb.exec:\hhthhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\nnbnnt.exec:\nnbnnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\lrrlffr.exec:\lrrlffr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\frrffxl.exec:\frrffxl.exe23⤵
- Executes dropped EXE
PID:3844 -
\??\c:\llfxlfl.exec:\llfxlfl.exe24⤵
- Executes dropped EXE
PID:1972 -
\??\c:\fxrfrfx.exec:\fxrfrfx.exe25⤵
- Executes dropped EXE
PID:4348 -
\??\c:\ffrxrrr.exec:\ffrxrrr.exe26⤵
- Executes dropped EXE
PID:1872 -
\??\c:\frxrllr.exec:\frxrllr.exe27⤵
- Executes dropped EXE
PID:4876 -
\??\c:\nbnnht.exec:\nbnnht.exe28⤵
- Executes dropped EXE
PID:844 -
\??\c:\3pvvj.exec:\3pvvj.exe29⤵
- Executes dropped EXE
PID:4904 -
\??\c:\pjjjv.exec:\pjjjv.exe30⤵
- Executes dropped EXE
PID:868 -
\??\c:\nntbht.exec:\nntbht.exe31⤵
- Executes dropped EXE
PID:436 -
\??\c:\xffflxx.exec:\xffflxx.exe32⤵
- Executes dropped EXE
PID:3876 -
\??\c:\llffxrf.exec:\llffxrf.exe33⤵
- Executes dropped EXE
PID:3560 -
\??\c:\tnnbtt.exec:\tnnbtt.exe34⤵
- Executes dropped EXE
PID:4688 -
\??\c:\lfrfrfl.exec:\lfrfrfl.exe35⤵
- Executes dropped EXE
PID:748 -
\??\c:\bhbbht.exec:\bhbbht.exe36⤵
- Executes dropped EXE
PID:4220 -
\??\c:\xflrlfl.exec:\xflrlfl.exe37⤵
- Executes dropped EXE
PID:1224 -
\??\c:\hbbbbb.exec:\hbbbbb.exe38⤵
- Executes dropped EXE
PID:452 -
\??\c:\rlllxlr.exec:\rlllxlr.exe39⤵
- Executes dropped EXE
PID:1904 -
\??\c:\djppp.exec:\djppp.exe40⤵
- Executes dropped EXE
PID:3712 -
\??\c:\hbbnbt.exec:\hbbnbt.exe41⤵
- Executes dropped EXE
PID:3188 -
\??\c:\flrfffr.exec:\flrfffr.exe42⤵
- Executes dropped EXE
PID:4464 -
\??\c:\jddjd.exec:\jddjd.exe43⤵
- Executes dropped EXE
PID:3516 -
\??\c:\jvpjv.exec:\jvpjv.exe44⤵
- Executes dropped EXE
PID:3024 -
\??\c:\xxrrrxx.exec:\xxrrrxx.exe45⤵
- Executes dropped EXE
PID:1136 -
\??\c:\vvppj.exec:\vvppj.exe46⤵
- Executes dropped EXE
PID:3576 -
\??\c:\djdpd.exec:\djdpd.exe47⤵
- Executes dropped EXE
PID:4108 -
\??\c:\btbbbb.exec:\btbbbb.exe48⤵
- Executes dropped EXE
PID:3644 -
\??\c:\pvvvd.exec:\pvvvd.exe49⤵
- Executes dropped EXE
PID:4540 -
\??\c:\tttnnh.exec:\tttnnh.exe50⤵
- Executes dropped EXE
PID:540 -
\??\c:\lfffflf.exec:\lfffflf.exe51⤵
- Executes dropped EXE
PID:3520 -
\??\c:\ntbbhb.exec:\ntbbhb.exe52⤵
- Executes dropped EXE
PID:3892 -
\??\c:\rfrlrrx.exec:\rfrlrrx.exe53⤵
- Executes dropped EXE
PID:4580 -
\??\c:\nhhnhh.exec:\nhhnhh.exe54⤵
- Executes dropped EXE
PID:3968 -
\??\c:\xffxfxl.exec:\xffxfxl.exe55⤵
- Executes dropped EXE
PID:1612 -
\??\c:\btbbtb.exec:\btbbtb.exe56⤵
- Executes dropped EXE
PID:3368 -
\??\c:\xlrrxxl.exec:\xlrrxxl.exe57⤵
- Executes dropped EXE
PID:4980 -
\??\c:\vjdjd.exec:\vjdjd.exe58⤵
- Executes dropped EXE
PID:1480 -
\??\c:\bhnttt.exec:\bhnttt.exe59⤵
- Executes dropped EXE
PID:3948 -
\??\c:\rrffflf.exec:\rrffflf.exe60⤵
- Executes dropped EXE
PID:924 -
\??\c:\nhhtth.exec:\nhhtth.exe61⤵
- Executes dropped EXE
PID:2316 -
\??\c:\pjdpp.exec:\pjdpp.exe62⤵
- Executes dropped EXE
PID:880 -
\??\c:\thtntt.exec:\thtntt.exe63⤵
- Executes dropped EXE
PID:3700 -
\??\c:\xlfffxx.exec:\xlfffxx.exe64⤵
- Executes dropped EXE
PID:3624 -
\??\c:\flxlfrx.exec:\flxlfrx.exe65⤵
- Executes dropped EXE
PID:116 -
\??\c:\ffrlxrx.exec:\ffrlxrx.exe66⤵PID:1200
-
\??\c:\bhntnt.exec:\bhntnt.exe67⤵PID:1056
-
\??\c:\rllfxfr.exec:\rllfxfr.exe68⤵PID:1856
-
\??\c:\vpdjp.exec:\vpdjp.exe69⤵PID:672
-
\??\c:\bhnbtn.exec:\bhnbtn.exe70⤵PID:2428
-
\??\c:\jjjvp.exec:\jjjvp.exe71⤵PID:740
-
\??\c:\pjjdp.exec:\pjjdp.exe72⤵PID:2120
-
\??\c:\llfrlfx.exec:\llfrlfx.exe73⤵PID:1676
-
\??\c:\jdpvj.exec:\jdpvj.exe74⤵PID:1792
-
\??\c:\nhtnnt.exec:\nhtnnt.exe75⤵PID:2220
-
\??\c:\dvpjd.exec:\dvpjd.exe76⤵PID:5016
-
\??\c:\tbbbnh.exec:\tbbbnh.exe77⤵PID:2052
-
\??\c:\llxllxr.exec:\llxllxr.exe78⤵PID:2884
-
\??\c:\btthbb.exec:\btthbb.exe79⤵PID:3756
-
\??\c:\lrllfrl.exec:\lrllfrl.exe80⤵PID:2452
-
\??\c:\jpdjj.exec:\jpdjj.exe81⤵PID:5116
-
\??\c:\rfrxrfr.exec:\rfrxrfr.exe82⤵PID:2736
-
\??\c:\djvjd.exec:\djvjd.exe83⤵PID:1528
-
\??\c:\nhbnth.exec:\nhbnth.exe84⤵PID:3764
-
\??\c:\xrxrlll.exec:\xrxrlll.exe85⤵PID:1616
-
\??\c:\vjjpp.exec:\vjjpp.exe86⤵PID:3708
-
\??\c:\tnhnnt.exec:\tnhnnt.exe87⤵PID:1940
-
\??\c:\3xfllll.exec:\3xfllll.exe88⤵PID:4916
-
\??\c:\bhhbnt.exec:\bhhbnt.exe89⤵PID:4320
-
\??\c:\lfxflxf.exec:\lfxflxf.exe90⤵PID:452
-
\??\c:\jvjjd.exec:\jvjjd.exe91⤵PID:1904
-
\??\c:\bhbtht.exec:\bhbtht.exe92⤵PID:3712
-
\??\c:\1rlfflx.exec:\1rlfflx.exe93⤵PID:3188
-
\??\c:\xrxfrfx.exec:\xrxfrfx.exe94⤵PID:4464
-
\??\c:\djjdv.exec:\djjdv.exe95⤵PID:1036
-
\??\c:\hhbntt.exec:\hhbntt.exe96⤵PID:3024
-
\??\c:\lxxfxrl.exec:\lxxfxrl.exe97⤵PID:1136
-
\??\c:\jvppj.exec:\jvppj.exe98⤵PID:1544
-
\??\c:\nbbtth.exec:\nbbtth.exe99⤵PID:3636
-
\??\c:\lxfffrr.exec:\lxfffrr.exe100⤵PID:5096
-
\??\c:\vdddd.exec:\vdddd.exe101⤵PID:4540
-
\??\c:\bhtnhb.exec:\bhtnhb.exe102⤵PID:4744
-
\??\c:\xffrrrl.exec:\xffrrrl.exe103⤵PID:3520
-
\??\c:\bhthtt.exec:\bhthtt.exe104⤵PID:3892
-
\??\c:\ffxlxrf.exec:\ffxlxrf.exe105⤵PID:1656
-
\??\c:\jvdjv.exec:\jvdjv.exe106⤵PID:4024
-
\??\c:\jvjjv.exec:\jvjjv.exe107⤵PID:2828
-
\??\c:\bthttt.exec:\bthttt.exe108⤵PID:2244
-
\??\c:\rlffrrr.exec:\rlffrrr.exe109⤵PID:2504
-
\??\c:\pvddd.exec:\pvddd.exe110⤵PID:2056
-
\??\c:\thhhbb.exec:\thhhbb.exe111⤵PID:3512
-
\??\c:\tbbbbb.exec:\tbbbbb.exe112⤵PID:4388
-
\??\c:\vjvvv.exec:\vjvvv.exe113⤵PID:2316
-
\??\c:\vjvvv.exec:\vjvvv.exe114⤵PID:2972
-
\??\c:\xffrxxf.exec:\xffrxxf.exe115⤵PID:2732
-
\??\c:\xlffxxl.exec:\xlffxxl.exe116⤵PID:3652
-
\??\c:\bhhthn.exec:\bhhthn.exe117⤵PID:4536
-
\??\c:\lfxrfxr.exec:\lfxrfxr.exe118⤵PID:1680
-
\??\c:\9nbbbb.exec:\9nbbbb.exe119⤵PID:2320
-
\??\c:\rxxfffr.exec:\rxxfffr.exe120⤵PID:1064
-
\??\c:\pvvpd.exec:\pvvpd.exe121⤵PID:1200
-
\??\c:\bhhnnh.exec:\bhhnnh.exe122⤵PID:1056
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-