Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 09:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f03fd34d1fc39c7bd3151b7ec4b9cd492b531bde795d51c83e4fa41907149ef8.exe
Resource
win7-20240704-en
5 signatures
150 seconds
General
-
Target
f03fd34d1fc39c7bd3151b7ec4b9cd492b531bde795d51c83e4fa41907149ef8.exe
-
Size
65KB
-
MD5
bd8cb5de0ddc084e29de443333e49440
-
SHA1
5bc2f2b6e573e75b87748f58d6fb8f9befcae7f5
-
SHA256
f03fd34d1fc39c7bd3151b7ec4b9cd492b531bde795d51c83e4fa41907149ef8
-
SHA512
d51c4cfcfd9ac533cac3431bb56d948e2972a5631a1665f54adf92870fc9febd26f3ed69f2f6985d301bb97c522323061e0ddcfd284d462b9fb38d4398970077
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJULh1214ar:ymb3NkkiQ3mdBjFIFdJmdar
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2680-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2680-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/260-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1340-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1896-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2628-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3672 jppjp.exe 4496 jjjjj.exe 4540 xffxrlx.exe 4484 hnthbb.exe 260 jvpvv.exe 1524 bhntbt.exe 5044 pvpvj.exe 4840 rrlxrfl.exe 8 pdjjj.exe 1452 xxxrrxx.exe 1340 ttbhhh.exe 4716 vpdvv.exe 2416 7lxxlrr.exe 1172 3thhhn.exe 4568 vpvdd.exe 3400 ffffxxx.exe 4324 nbbbbb.exe 1100 ddppj.exe 3088 rfllflf.exe 3896 ntnnnh.exe 1896 vdddd.exe 1776 ddppp.exe 2152 lrflrxl.exe 2404 nbhhbh.exe 3940 ddvpp.exe 2628 xrxxxxx.exe 3112 bthnnt.exe 4772 dvjvv.exe 772 fflllxr.exe 2084 thhntn.exe 2996 vvjdp.exe 1596 hbhhhn.exe 784 ddddd.exe 1152 7xllflr.exe 3420 9hbbtn.exe 4436 jvjvv.exe 560 xxxxxxx.exe 3856 9hhhtt.exe 748 dvddv.exe 3956 xrxrllr.exe 3384 ffflllr.exe 644 1htnhb.exe 552 jpvdd.exe 1132 jppjj.exe 4140 llfxrff.exe 3084 7tnntt.exe 3080 djvjd.exe 3700 rxflllx.exe 2492 flrlxxl.exe 224 jdvpj.exe 4876 xrrrlll.exe 4260 hbntnn.exe 2356 djdjv.exe 2416 ffxfxxx.exe 1172 9bbbbt.exe 2580 9pjjp.exe 3304 jdjpj.exe 1584 9lxrrxx.exe 4624 7ntnnh.exe 1100 jpdvv.exe 2284 jjvdv.exe 2456 9rffflf.exe 1608 nbhnnb.exe 3448 1jppp.exe -
resource yara_rule behavioral2/memory/2680-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2680-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/260-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/260-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/260-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1340-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1896-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2404-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2628-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2680 wrote to memory of 3672 2680 f03fd34d1fc39c7bd3151b7ec4b9cd492b531bde795d51c83e4fa41907149ef8.exe 84 PID 2680 wrote to memory of 3672 2680 f03fd34d1fc39c7bd3151b7ec4b9cd492b531bde795d51c83e4fa41907149ef8.exe 84 PID 2680 wrote to memory of 3672 2680 f03fd34d1fc39c7bd3151b7ec4b9cd492b531bde795d51c83e4fa41907149ef8.exe 84 PID 3672 wrote to memory of 4496 3672 jppjp.exe 85 PID 3672 wrote to memory of 4496 3672 jppjp.exe 85 PID 3672 wrote to memory of 4496 3672 jppjp.exe 85 PID 4496 wrote to memory of 4540 4496 jjjjj.exe 86 PID 4496 wrote to memory of 4540 4496 jjjjj.exe 86 PID 4496 wrote to memory of 4540 4496 jjjjj.exe 86 PID 4540 wrote to memory of 4484 4540 xffxrlx.exe 87 PID 4540 wrote to memory of 4484 4540 xffxrlx.exe 87 PID 4540 wrote to memory of 4484 4540 xffxrlx.exe 87 PID 4484 wrote to memory of 260 4484 hnthbb.exe 88 PID 4484 wrote to memory of 260 4484 hnthbb.exe 88 PID 4484 wrote to memory of 260 4484 hnthbb.exe 88 PID 260 wrote to memory of 1524 260 jvpvv.exe 89 PID 260 wrote to memory of 1524 260 jvpvv.exe 89 PID 260 wrote to memory of 1524 260 jvpvv.exe 89 PID 1524 wrote to memory of 5044 1524 bhntbt.exe 90 PID 1524 wrote to memory of 5044 1524 bhntbt.exe 90 PID 1524 wrote to memory of 5044 1524 bhntbt.exe 90 PID 5044 wrote to memory of 4840 5044 pvpvj.exe 91 PID 5044 wrote to memory of 4840 5044 pvpvj.exe 91 PID 5044 wrote to memory of 4840 5044 pvpvj.exe 91 PID 4840 wrote to memory of 8 4840 rrlxrfl.exe 92 PID 4840 wrote to memory of 8 4840 rrlxrfl.exe 92 PID 4840 wrote to memory of 8 4840 rrlxrfl.exe 92 PID 8 wrote to memory of 1452 8 pdjjj.exe 93 PID 8 wrote to memory of 1452 8 pdjjj.exe 93 PID 8 wrote to memory of 1452 8 pdjjj.exe 93 PID 1452 wrote to memory of 1340 1452 xxxrrxx.exe 94 PID 1452 wrote to memory of 1340 1452 xxxrrxx.exe 94 PID 1452 wrote to memory of 1340 1452 xxxrrxx.exe 94 PID 1340 wrote to memory of 4716 1340 ttbhhh.exe 95 PID 1340 wrote to memory of 4716 1340 ttbhhh.exe 95 PID 1340 wrote to memory of 4716 1340 ttbhhh.exe 95 PID 4716 wrote to memory of 2416 4716 vpdvv.exe 96 PID 4716 wrote to memory of 2416 4716 vpdvv.exe 96 PID 4716 wrote to memory of 2416 4716 vpdvv.exe 96 PID 2416 wrote to memory of 1172 2416 7lxxlrr.exe 97 PID 2416 wrote to memory of 1172 2416 7lxxlrr.exe 97 PID 2416 wrote to memory of 1172 2416 7lxxlrr.exe 97 PID 1172 wrote to memory of 4568 1172 3thhhn.exe 98 PID 1172 wrote to memory of 4568 1172 3thhhn.exe 98 PID 1172 wrote to memory of 4568 1172 3thhhn.exe 98 PID 4568 wrote to memory of 3400 4568 vpvdd.exe 99 PID 4568 wrote to memory of 3400 4568 vpvdd.exe 99 PID 4568 wrote to memory of 3400 4568 vpvdd.exe 99 PID 3400 wrote to memory of 4324 3400 ffffxxx.exe 101 PID 3400 wrote to memory of 4324 3400 ffffxxx.exe 101 PID 3400 wrote to memory of 4324 3400 ffffxxx.exe 101 PID 4324 wrote to memory of 1100 4324 nbbbbb.exe 102 PID 4324 wrote to memory of 1100 4324 nbbbbb.exe 102 PID 4324 wrote to memory of 1100 4324 nbbbbb.exe 102 PID 1100 wrote to memory of 3088 1100 ddppj.exe 103 PID 1100 wrote to memory of 3088 1100 ddppj.exe 103 PID 1100 wrote to memory of 3088 1100 ddppj.exe 103 PID 3088 wrote to memory of 3896 3088 rfllflf.exe 104 PID 3088 wrote to memory of 3896 3088 rfllflf.exe 104 PID 3088 wrote to memory of 3896 3088 rfllflf.exe 104 PID 3896 wrote to memory of 1896 3896 ntnnnh.exe 105 PID 3896 wrote to memory of 1896 3896 ntnnnh.exe 105 PID 3896 wrote to memory of 1896 3896 ntnnnh.exe 105 PID 1896 wrote to memory of 1776 1896 vdddd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\f03fd34d1fc39c7bd3151b7ec4b9cd492b531bde795d51c83e4fa41907149ef8.exe"C:\Users\Admin\AppData\Local\Temp\f03fd34d1fc39c7bd3151b7ec4b9cd492b531bde795d51c83e4fa41907149ef8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\jppjp.exec:\jppjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\jjjjj.exec:\jjjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\xffxrlx.exec:\xffxrlx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\hnthbb.exec:\hnthbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\jvpvv.exec:\jvpvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
\??\c:\bhntbt.exec:\bhntbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\pvpvj.exec:\pvpvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\rrlxrfl.exec:\rrlxrfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\pdjjj.exec:\pdjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\xxxrrxx.exec:\xxxrrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\ttbhhh.exec:\ttbhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\vpdvv.exec:\vpdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\7lxxlrr.exec:\7lxxlrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\3thhhn.exec:\3thhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\vpvdd.exec:\vpvdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\ffffxxx.exec:\ffffxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\nbbbbb.exec:\nbbbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\ddppj.exec:\ddppj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\rfllflf.exec:\rfllflf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\ntnnnh.exec:\ntnnnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\vdddd.exec:\vdddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\ddppp.exec:\ddppp.exe23⤵
- Executes dropped EXE
PID:1776 -
\??\c:\lrflrxl.exec:\lrflrxl.exe24⤵
- Executes dropped EXE
PID:2152 -
\??\c:\nbhhbh.exec:\nbhhbh.exe25⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ddvpp.exec:\ddvpp.exe26⤵
- Executes dropped EXE
PID:3940 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe27⤵
- Executes dropped EXE
PID:2628 -
\??\c:\bthnnt.exec:\bthnnt.exe28⤵
- Executes dropped EXE
PID:3112 -
\??\c:\dvjvv.exec:\dvjvv.exe29⤵
- Executes dropped EXE
PID:4772 -
\??\c:\fflllxr.exec:\fflllxr.exe30⤵
- Executes dropped EXE
PID:772 -
\??\c:\thhntn.exec:\thhntn.exe31⤵
- Executes dropped EXE
PID:2084 -
\??\c:\vvjdp.exec:\vvjdp.exe32⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hbhhhn.exec:\hbhhhn.exe33⤵
- Executes dropped EXE
PID:1596 -
\??\c:\ddddd.exec:\ddddd.exe34⤵
- Executes dropped EXE
PID:784 -
\??\c:\7xllflr.exec:\7xllflr.exe35⤵
- Executes dropped EXE
PID:1152 -
\??\c:\9hbbtn.exec:\9hbbtn.exe36⤵
- Executes dropped EXE
PID:3420 -
\??\c:\jvjvv.exec:\jvjvv.exe37⤵
- Executes dropped EXE
PID:4436 -
\??\c:\xxxxxxx.exec:\xxxxxxx.exe38⤵
- Executes dropped EXE
PID:560 -
\??\c:\9hhhtt.exec:\9hhhtt.exe39⤵
- Executes dropped EXE
PID:3856 -
\??\c:\dvddv.exec:\dvddv.exe40⤵
- Executes dropped EXE
PID:748 -
\??\c:\xrxrllr.exec:\xrxrllr.exe41⤵
- Executes dropped EXE
PID:3956 -
\??\c:\ffflllr.exec:\ffflllr.exe42⤵
- Executes dropped EXE
PID:3384 -
\??\c:\1htnhb.exec:\1htnhb.exe43⤵
- Executes dropped EXE
PID:644 -
\??\c:\jpvdd.exec:\jpvdd.exe44⤵
- Executes dropped EXE
PID:552 -
\??\c:\jppjj.exec:\jppjj.exe45⤵
- Executes dropped EXE
PID:1132 -
\??\c:\llfxrff.exec:\llfxrff.exe46⤵
- Executes dropped EXE
PID:4140 -
\??\c:\7tnntt.exec:\7tnntt.exe47⤵
- Executes dropped EXE
PID:3084 -
\??\c:\djvjd.exec:\djvjd.exe48⤵
- Executes dropped EXE
PID:3080 -
\??\c:\rxflllx.exec:\rxflllx.exe49⤵
- Executes dropped EXE
PID:3700 -
\??\c:\flrlxxl.exec:\flrlxxl.exe50⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jdvpj.exec:\jdvpj.exe51⤵
- Executes dropped EXE
PID:224 -
\??\c:\xrrrlll.exec:\xrrrlll.exe52⤵
- Executes dropped EXE
PID:4876 -
\??\c:\hbntnn.exec:\hbntnn.exe53⤵
- Executes dropped EXE
PID:4260 -
\??\c:\djdjv.exec:\djdjv.exe54⤵
- Executes dropped EXE
PID:2356 -
\??\c:\ffxfxxx.exec:\ffxfxxx.exe55⤵
- Executes dropped EXE
PID:2416 -
\??\c:\9bbbbt.exec:\9bbbbt.exe56⤵
- Executes dropped EXE
PID:1172 -
\??\c:\9pjjp.exec:\9pjjp.exe57⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jdjpj.exec:\jdjpj.exe58⤵
- Executes dropped EXE
PID:3304 -
\??\c:\9lxrrxx.exec:\9lxrrxx.exe59⤵
- Executes dropped EXE
PID:1584 -
\??\c:\7ntnnh.exec:\7ntnnh.exe60⤵
- Executes dropped EXE
PID:4624 -
\??\c:\jpdvv.exec:\jpdvv.exe61⤵
- Executes dropped EXE
PID:1100 -
\??\c:\jjvdv.exec:\jjvdv.exe62⤵
- Executes dropped EXE
PID:2284 -
\??\c:\9rffflf.exec:\9rffflf.exe63⤵
- Executes dropped EXE
PID:2456 -
\??\c:\nbhnnb.exec:\nbhnnb.exe64⤵
- Executes dropped EXE
PID:1608 -
\??\c:\1jppp.exec:\1jppp.exe65⤵
- Executes dropped EXE
PID:3448 -
\??\c:\1xrllrl.exec:\1xrllrl.exe66⤵PID:2976
-
\??\c:\bthhhn.exec:\bthhhn.exe67⤵PID:3492
-
\??\c:\7ntbhn.exec:\7ntbhn.exe68⤵PID:3352
-
\??\c:\xrxxxfl.exec:\xrxxxfl.exe69⤵PID:4516
-
\??\c:\tbhhhh.exec:\tbhhhh.exe70⤵PID:2412
-
\??\c:\hnhhbh.exec:\hnhhbh.exe71⤵PID:2628
-
\??\c:\ppppp.exec:\ppppp.exe72⤵PID:3112
-
\??\c:\rxfrxfx.exec:\rxfrxfx.exe73⤵PID:3696
-
\??\c:\fxllrfl.exec:\fxllrfl.exe74⤵PID:2940
-
\??\c:\9bhhbb.exec:\9bhhbb.exe75⤵PID:4304
-
\??\c:\pvddd.exec:\pvddd.exe76⤵PID:4680
-
\??\c:\xlrrlrl.exec:\xlrrlrl.exe77⤵PID:2996
-
\??\c:\hhtbbh.exec:\hhtbbh.exe78⤵PID:1596
-
\??\c:\vpvvv.exec:\vpvvv.exe79⤵PID:784
-
\??\c:\jpppj.exec:\jpppj.exe80⤵PID:220
-
\??\c:\nnhtnh.exec:\nnhtnh.exe81⤵PID:4132
-
\??\c:\ppvpj.exec:\ppvpj.exe82⤵PID:3872
-
\??\c:\lrxlxxr.exec:\lrxlxxr.exe83⤵PID:2188
-
\??\c:\vvdjj.exec:\vvdjj.exe84⤵PID:840
-
\??\c:\lrfxrlf.exec:\lrfxrlf.exe85⤵PID:3672
-
\??\c:\9lrlxrf.exec:\9lrlxrf.exe86⤵PID:4540
-
\??\c:\btbttn.exec:\btbttn.exe87⤵PID:4560
-
\??\c:\vdvvj.exec:\vdvvj.exe88⤵PID:312
-
\??\c:\rfrflrf.exec:\rfrflrf.exe89⤵PID:2816
-
\??\c:\nbnhbn.exec:\nbnhbn.exe90⤵PID:3588
-
\??\c:\dpjpp.exec:\dpjpp.exe91⤵PID:3884
-
\??\c:\llfxfxf.exec:\llfxfxf.exe92⤵PID:2080
-
\??\c:\tbhbtn.exec:\tbhbtn.exe93⤵PID:3392
-
\??\c:\pvjpp.exec:\pvjpp.exe94⤵PID:3700
-
\??\c:\xffxxrf.exec:\xffxxrf.exe95⤵PID:1056
-
\??\c:\ntntth.exec:\ntntth.exe96⤵PID:4616
-
\??\c:\flxxfff.exec:\flxxfff.exe97⤵PID:4620
-
\??\c:\htthhh.exec:\htthhh.exe98⤵PID:1224
-
\??\c:\vpvdp.exec:\vpvdp.exe99⤵PID:3660
-
\??\c:\lfffxff.exec:\lfffxff.exe100⤵PID:5084
-
\??\c:\lflrxfl.exec:\lflrxfl.exe101⤵PID:3888
-
\??\c:\9hhtth.exec:\9hhtth.exe102⤵PID:3064
-
\??\c:\pdpjp.exec:\pdpjp.exe103⤵PID:1464
-
\??\c:\3xllrxr.exec:\3xllrxr.exe104⤵PID:4572
-
\??\c:\btbbbh.exec:\btbbbh.exe105⤵PID:2348
-
\??\c:\dvvdj.exec:\dvvdj.exe106⤵PID:3536
-
\??\c:\lllllll.exec:\lllllll.exe107⤵PID:1072
-
\??\c:\1ffllrl.exec:\1ffllrl.exe108⤵PID:1896
-
\??\c:\1pjpv.exec:\1pjpv.exe109⤵PID:2612
-
\??\c:\pjvjj.exec:\pjvjj.exe110⤵PID:2932
-
\??\c:\rflrfxr.exec:\rflrfxr.exe111⤵PID:2360
-
\??\c:\tthbnn.exec:\tthbnn.exe112⤵PID:1944
-
\??\c:\vvddj.exec:\vvddj.exe113⤵PID:3352
-
\??\c:\pvvpp.exec:\pvvpp.exe114⤵PID:1912
-
\??\c:\xlrrfrf.exec:\xlrrfrf.exe115⤵PID:4192
-
\??\c:\ntthtb.exec:\ntthtb.exe116⤵PID:4992
-
\??\c:\pjjpp.exec:\pjjpp.exe117⤵PID:2072
-
\??\c:\7vjjv.exec:\7vjjv.exe118⤵PID:772
-
\??\c:\rlfxlxx.exec:\rlfxlxx.exe119⤵PID:1972
-
\??\c:\llrrrxx.exec:\llrrrxx.exe120⤵PID:4032
-
\??\c:\ttnbnt.exec:\ttnbnt.exe121⤵PID:4784
-
\??\c:\jjjjj.exec:\jjjjj.exe122⤵PID:4400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-