Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2024, 06:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5fa981ee690fa68330e726bb41a56ba0N.exe
Resource
win7-20240708-en
5 signatures
120 seconds
General
-
Target
5fa981ee690fa68330e726bb41a56ba0N.exe
-
Size
67KB
-
MD5
5fa981ee690fa68330e726bb41a56ba0
-
SHA1
c7b18aa9435f87079a7c86367f7d84c71fb3258c
-
SHA256
27de56099f63d6bb43f05f7ab6ff55c15530ffb7c79f2b37cb503dc5fd3c4bf1
-
SHA512
54ba0e2e53d2c38a732ac89ad01cb323811e16768108ac79a1a1a97d3dc60a9c46a8ad5bf4901e39c28976cb5a31cab5c21962c85006774047ebd29b950dcea4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLU1g7c3wtA:ymb3NkkiQ3mdBjFoLkVAW
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/1616-14-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1132-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1616 nhnhbh.exe 2404 rffxrrl.exe 4908 vvvvj.exe 1732 hntnhh.exe 1132 jjvvd.exe 2000 880080.exe 2268 068200.exe 2744 9ddvp.exe 1972 20624.exe 2140 488866.exe 3984 rfrfxlx.exe 3988 06220.exe 3940 hhbhbn.exe 4672 ttnnht.exe 5012 g6264.exe 2736 ffllfrx.exe 3432 3lffxxr.exe 4496 840648.exe 3232 84048.exe 4480 042080.exe 4668 3hnhtt.exe 116 62222.exe 4160 lxrrrxf.exe 4964 68066.exe 1848 g4004.exe 1572 ntbtnn.exe 2204 jjpjd.exe 3720 flrlffx.exe 2716 006082.exe 4620 lfxrllf.exe 1612 86628.exe 3204 60824.exe 4812 06820.exe 2732 0848226.exe 2740 4462808.exe 1460 e68642.exe 2360 0282626.exe 4388 rxrfxrr.exe 2704 0044064.exe 1616 864028.exe 452 4800606.exe 4128 2844882.exe 1596 ttttnn.exe 3628 828280.exe 3356 c042048.exe 4168 802026.exe 2000 lrfxrrx.exe 2632 680060.exe 2020 nhbbtn.exe 1160 thhhbt.exe 4772 02028.exe 4416 88680.exe 4248 406080.exe 3984 3vppd.exe 3492 xfxlxrl.exe 3004 vdjvj.exe 724 vjdpv.exe 2748 lflxrg8.exe 900 7tthtn.exe 1676 jjddj.exe 3616 6220828.exe 4348 djjdp.exe 3464 k88260.exe 3836 0882260.exe -
resource yara_rule behavioral2/memory/4576-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2404-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1848-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4576 wrote to memory of 1616 4576 5fa981ee690fa68330e726bb41a56ba0N.exe 84 PID 4576 wrote to memory of 1616 4576 5fa981ee690fa68330e726bb41a56ba0N.exe 84 PID 4576 wrote to memory of 1616 4576 5fa981ee690fa68330e726bb41a56ba0N.exe 84 PID 1616 wrote to memory of 2404 1616 nhnhbh.exe 85 PID 1616 wrote to memory of 2404 1616 nhnhbh.exe 85 PID 1616 wrote to memory of 2404 1616 nhnhbh.exe 85 PID 2404 wrote to memory of 4908 2404 rffxrrl.exe 86 PID 2404 wrote to memory of 4908 2404 rffxrrl.exe 86 PID 2404 wrote to memory of 4908 2404 rffxrrl.exe 86 PID 4908 wrote to memory of 1732 4908 vvvvj.exe 87 PID 4908 wrote to memory of 1732 4908 vvvvj.exe 87 PID 4908 wrote to memory of 1732 4908 vvvvj.exe 87 PID 1732 wrote to memory of 1132 1732 hntnhh.exe 88 PID 1732 wrote to memory of 1132 1732 hntnhh.exe 88 PID 1732 wrote to memory of 1132 1732 hntnhh.exe 88 PID 1132 wrote to memory of 2000 1132 jjvvd.exe 89 PID 1132 wrote to memory of 2000 1132 jjvvd.exe 89 PID 1132 wrote to memory of 2000 1132 jjvvd.exe 89 PID 2000 wrote to memory of 2268 2000 880080.exe 90 PID 2000 wrote to memory of 2268 2000 880080.exe 90 PID 2000 wrote to memory of 2268 2000 880080.exe 90 PID 2268 wrote to memory of 2744 2268 068200.exe 91 PID 2268 wrote to memory of 2744 2268 068200.exe 91 PID 2268 wrote to memory of 2744 2268 068200.exe 91 PID 2744 wrote to memory of 1972 2744 9ddvp.exe 92 PID 2744 wrote to memory of 1972 2744 9ddvp.exe 92 PID 2744 wrote to memory of 1972 2744 9ddvp.exe 92 PID 1972 wrote to memory of 2140 1972 20624.exe 93 PID 1972 wrote to memory of 2140 1972 20624.exe 93 PID 1972 wrote to memory of 2140 1972 20624.exe 93 PID 2140 wrote to memory of 3984 2140 488866.exe 95 PID 2140 wrote to memory of 3984 2140 488866.exe 95 PID 2140 wrote to memory of 3984 2140 488866.exe 95 PID 3984 wrote to memory of 3988 3984 rfrfxlx.exe 96 PID 3984 wrote to memory of 3988 3984 rfrfxlx.exe 96 PID 3984 wrote to memory of 3988 3984 rfrfxlx.exe 96 PID 3988 wrote to memory of 3940 3988 06220.exe 97 PID 3988 wrote to memory of 3940 3988 06220.exe 97 PID 3988 wrote to memory of 3940 3988 06220.exe 97 PID 3940 wrote to memory of 4672 3940 hhbhbn.exe 98 PID 3940 wrote to memory of 4672 3940 hhbhbn.exe 98 PID 3940 wrote to memory of 4672 3940 hhbhbn.exe 98 PID 4672 wrote to memory of 5012 4672 ttnnht.exe 99 PID 4672 wrote to memory of 5012 4672 ttnnht.exe 99 PID 4672 wrote to memory of 5012 4672 ttnnht.exe 99 PID 5012 wrote to memory of 2736 5012 g6264.exe 101 PID 5012 wrote to memory of 2736 5012 g6264.exe 101 PID 5012 wrote to memory of 2736 5012 g6264.exe 101 PID 2736 wrote to memory of 3432 2736 ffllfrx.exe 102 PID 2736 wrote to memory of 3432 2736 ffllfrx.exe 102 PID 2736 wrote to memory of 3432 2736 ffllfrx.exe 102 PID 3432 wrote to memory of 4496 3432 3lffxxr.exe 103 PID 3432 wrote to memory of 4496 3432 3lffxxr.exe 103 PID 3432 wrote to memory of 4496 3432 3lffxxr.exe 103 PID 4496 wrote to memory of 3232 4496 840648.exe 104 PID 4496 wrote to memory of 3232 4496 840648.exe 104 PID 4496 wrote to memory of 3232 4496 840648.exe 104 PID 3232 wrote to memory of 4480 3232 84048.exe 105 PID 3232 wrote to memory of 4480 3232 84048.exe 105 PID 3232 wrote to memory of 4480 3232 84048.exe 105 PID 4480 wrote to memory of 4668 4480 042080.exe 106 PID 4480 wrote to memory of 4668 4480 042080.exe 106 PID 4480 wrote to memory of 4668 4480 042080.exe 106 PID 4668 wrote to memory of 116 4668 3hnhtt.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fa981ee690fa68330e726bb41a56ba0N.exe"C:\Users\Admin\AppData\Local\Temp\5fa981ee690fa68330e726bb41a56ba0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\nhnhbh.exec:\nhnhbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\rffxrrl.exec:\rffxrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\vvvvj.exec:\vvvvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\hntnhh.exec:\hntnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\jjvvd.exec:\jjvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\880080.exec:\880080.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\068200.exec:\068200.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\9ddvp.exec:\9ddvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\20624.exec:\20624.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\488866.exec:\488866.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\rfrfxlx.exec:\rfrfxlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\06220.exec:\06220.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\hhbhbn.exec:\hhbhbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\ttnnht.exec:\ttnnht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\g6264.exec:\g6264.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\ffllfrx.exec:\ffllfrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\3lffxxr.exec:\3lffxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\840648.exec:\840648.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\84048.exec:\84048.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\042080.exec:\042080.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\3hnhtt.exec:\3hnhtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\62222.exec:\62222.exe23⤵
- Executes dropped EXE
PID:116 -
\??\c:\lxrrrxf.exec:\lxrrrxf.exe24⤵
- Executes dropped EXE
PID:4160 -
\??\c:\68066.exec:\68066.exe25⤵
- Executes dropped EXE
PID:4964 -
\??\c:\g4004.exec:\g4004.exe26⤵
- Executes dropped EXE
PID:1848 -
\??\c:\ntbtnn.exec:\ntbtnn.exe27⤵
- Executes dropped EXE
PID:1572 -
\??\c:\jjpjd.exec:\jjpjd.exe28⤵
- Executes dropped EXE
PID:2204 -
\??\c:\flrlffx.exec:\flrlffx.exe29⤵
- Executes dropped EXE
PID:3720 -
\??\c:\006082.exec:\006082.exe30⤵
- Executes dropped EXE
PID:2716 -
\??\c:\lfxrllf.exec:\lfxrllf.exe31⤵
- Executes dropped EXE
PID:4620 -
\??\c:\86628.exec:\86628.exe32⤵
- Executes dropped EXE
PID:1612 -
\??\c:\60824.exec:\60824.exe33⤵
- Executes dropped EXE
PID:3204 -
\??\c:\06820.exec:\06820.exe34⤵
- Executes dropped EXE
PID:4812 -
\??\c:\0848226.exec:\0848226.exe35⤵
- Executes dropped EXE
PID:2732 -
\??\c:\4462808.exec:\4462808.exe36⤵
- Executes dropped EXE
PID:2740 -
\??\c:\e68642.exec:\e68642.exe37⤵
- Executes dropped EXE
PID:1460 -
\??\c:\0282626.exec:\0282626.exe38⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rxrfxrr.exec:\rxrfxrr.exe39⤵
- Executes dropped EXE
PID:4388 -
\??\c:\0044064.exec:\0044064.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\864028.exec:\864028.exe41⤵
- Executes dropped EXE
PID:1616 -
\??\c:\4800606.exec:\4800606.exe42⤵
- Executes dropped EXE
PID:452 -
\??\c:\2844882.exec:\2844882.exe43⤵
- Executes dropped EXE
PID:4128 -
\??\c:\ttttnn.exec:\ttttnn.exe44⤵
- Executes dropped EXE
PID:1596 -
\??\c:\828280.exec:\828280.exe45⤵
- Executes dropped EXE
PID:3628 -
\??\c:\c042048.exec:\c042048.exe46⤵
- Executes dropped EXE
PID:3356 -
\??\c:\802026.exec:\802026.exe47⤵
- Executes dropped EXE
PID:4168 -
\??\c:\lrfxrrx.exec:\lrfxrrx.exe48⤵
- Executes dropped EXE
PID:2000 -
\??\c:\680060.exec:\680060.exe49⤵
- Executes dropped EXE
PID:2632 -
\??\c:\nhbbtn.exec:\nhbbtn.exe50⤵
- Executes dropped EXE
PID:2020 -
\??\c:\thhhbt.exec:\thhhbt.exe51⤵
- Executes dropped EXE
PID:1160 -
\??\c:\02028.exec:\02028.exe52⤵
- Executes dropped EXE
PID:4772 -
\??\c:\88680.exec:\88680.exe53⤵
- Executes dropped EXE
PID:4416 -
\??\c:\406080.exec:\406080.exe54⤵
- Executes dropped EXE
PID:4248 -
\??\c:\3vppd.exec:\3vppd.exe55⤵
- Executes dropped EXE
PID:3984 -
\??\c:\xfxlxrl.exec:\xfxlxrl.exe56⤵
- Executes dropped EXE
PID:3492 -
\??\c:\vdjvj.exec:\vdjvj.exe57⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vjdpv.exec:\vjdpv.exe58⤵
- Executes dropped EXE
PID:724 -
\??\c:\lflxrg8.exec:\lflxrg8.exe59⤵
- Executes dropped EXE
PID:2748 -
\??\c:\7tthtn.exec:\7tthtn.exe60⤵
- Executes dropped EXE
PID:900 -
\??\c:\jjddj.exec:\jjddj.exe61⤵
- Executes dropped EXE
PID:1676 -
\??\c:\6220828.exec:\6220828.exe62⤵
- Executes dropped EXE
PID:3616 -
\??\c:\djjdp.exec:\djjdp.exe63⤵
- Executes dropped EXE
PID:4348 -
\??\c:\k88260.exec:\k88260.exe64⤵
- Executes dropped EXE
PID:3464 -
\??\c:\0882260.exec:\0882260.exe65⤵
- Executes dropped EXE
PID:3836 -
\??\c:\i444800.exec:\i444800.exe66⤵PID:4480
-
\??\c:\040660.exec:\040660.exe67⤵PID:4172
-
\??\c:\8622606.exec:\8622606.exe68⤵PID:244
-
\??\c:\0000000.exec:\0000000.exe69⤵PID:692
-
\??\c:\8826048.exec:\8826048.exe70⤵PID:1788
-
\??\c:\tntntt.exec:\tntntt.exe71⤵PID:4856
-
\??\c:\0682266.exec:\0682266.exe72⤵PID:1504
-
\??\c:\0026048.exec:\0026048.exe73⤵PID:2504
-
\??\c:\20824.exec:\20824.exe74⤵PID:2172
-
\??\c:\64442.exec:\64442.exe75⤵PID:2636
-
\??\c:\lxxrxrr.exec:\lxxrxrr.exe76⤵PID:2204
-
\??\c:\hhhbnh.exec:\hhhbnh.exe77⤵PID:2932
-
\??\c:\5bnbhn.exec:\5bnbhn.exe78⤵PID:4088
-
\??\c:\6602860.exec:\6602860.exe79⤵PID:3676
-
\??\c:\404860.exec:\404860.exe80⤵PID:3068
-
\??\c:\frrrrlx.exec:\frrrrlx.exe81⤵PID:3152
-
\??\c:\202282.exec:\202282.exe82⤵PID:4444
-
\??\c:\9ththh.exec:\9ththh.exe83⤵PID:1520
-
\??\c:\8620044.exec:\8620044.exe84⤵PID:1728
-
\??\c:\46400.exec:\46400.exe85⤵PID:1384
-
\??\c:\440860.exec:\440860.exe86⤵PID:3244
-
\??\c:\242884.exec:\242884.exe87⤵PID:4536
-
\??\c:\420262.exec:\420262.exe88⤵PID:1200
-
\??\c:\606082.exec:\606082.exe89⤵PID:1176
-
\??\c:\xfxrllx.exec:\xfxrllx.exe90⤵PID:2188
-
\??\c:\2060048.exec:\2060048.exe91⤵PID:4468
-
\??\c:\82440.exec:\82440.exe92⤵PID:4128
-
\??\c:\9vpjj.exec:\9vpjj.exe93⤵PID:1768
-
\??\c:\4880844.exec:\4880844.exe94⤵PID:1132
-
\??\c:\q20280.exec:\q20280.exe95⤵PID:2004
-
\??\c:\080422.exec:\080422.exe96⤵PID:2236
-
\??\c:\66222.exec:\66222.exe97⤵PID:4836
-
\??\c:\u606464.exec:\u606464.exe98⤵PID:3256
-
\??\c:\bbhbnt.exec:\bbhbnt.exe99⤵PID:2744
-
\??\c:\btbttt.exec:\btbttt.exe100⤵PID:2020
-
\??\c:\i282662.exec:\i282662.exe101⤵PID:1076
-
\??\c:\6288266.exec:\6288266.exe102⤵PID:1824
-
\??\c:\6844448.exec:\6844448.exe103⤵PID:4008
-
\??\c:\hbnnhh.exec:\hbnnhh.exe104⤵PID:2372
-
\??\c:\fxxrllf.exec:\fxxrllf.exe105⤵PID:4696
-
\??\c:\i400448.exec:\i400448.exe106⤵PID:3940
-
\??\c:\c688440.exec:\c688440.exe107⤵PID:2144
-
\??\c:\60004.exec:\60004.exe108⤵PID:3468
-
\??\c:\3xxlxrf.exec:\3xxlxrf.exe109⤵PID:964
-
\??\c:\26884.exec:\26884.exe110⤵PID:712
-
\??\c:\flrlxxr.exec:\flrlxxr.exe111⤵PID:3828
-
\??\c:\480400.exec:\480400.exe112⤵PID:1960
-
\??\c:\hhhbnn.exec:\hhhbnn.exe113⤵PID:2356
-
\??\c:\nbbthb.exec:\nbbthb.exe114⤵PID:1124
-
\??\c:\80286.exec:\80286.exe115⤵PID:4668
-
\??\c:\pjvvv.exec:\pjvvv.exe116⤵PID:4860
-
\??\c:\k28828.exec:\k28828.exe117⤵PID:2528
-
\??\c:\m8606.exec:\m8606.exe118⤵PID:1144
-
\??\c:\268822.exec:\268822.exe119⤵PID:1408
-
\??\c:\dvdvv.exec:\dvdvv.exe120⤵PID:3996
-
\??\c:\824422.exec:\824422.exe121⤵PID:1420
-
\??\c:\48448.exec:\48448.exe122⤵PID:3336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-