Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2024, 17:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
edff3fabab5c6532ed98673f33a22040N.exe
Resource
win7-20240704-en
5 signatures
120 seconds
General
-
Target
edff3fabab5c6532ed98673f33a22040N.exe
-
Size
86KB
-
MD5
edff3fabab5c6532ed98673f33a22040
-
SHA1
e1ed775bcfbcae9cbd9fbdd97ad8b6416488f30f
-
SHA256
736158917ca0eddf0377d1d3b32f8f0e7544aef95dcf9211435c627ce75266c3
-
SHA512
b5a2a36af446b253113e6350001807e9b9fcae4d8853de399b785637559ac2aa86ba26306cf3af1e98233d1a58ac0dfe3cbb1463bb615cff968e8aee5fe394c9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73yqKH/KjvHo+WdNlj:ymb3NkkiQ3mdBjFo73yX+vI+qvj
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/1228-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3048-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2240-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/876-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3344-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2096 464062.exe 4812 28820.exe 3272 1xxrlff.exe 3048 84664.exe 2196 5xlxllx.exe 3012 266426.exe 4256 jdvjj.exe 4888 nhbthb.exe 1988 46082.exe 2240 668460.exe 2460 jpjdv.exe 3996 2882264.exe 3224 jpvvp.exe 4896 608000.exe 1928 xrfrrlf.exe 2380 84682.exe 876 1tbtbt.exe 4344 lfllrrx.exe 3984 24000.exe 3044 9rrffxl.exe 1972 400482.exe 1384 pjjpj.exe 1236 pddpj.exe 3972 xllrfll.exe 1748 7ddjd.exe 3756 422084.exe 2476 bnnbnh.exe 3344 htbnbb.exe 3104 206082.exe 1316 jpvpj.exe 2856 rxxrrrl.exe 2408 2604822.exe 2672 680246.exe 4780 dvjvd.exe 3372 4248268.exe 4312 1xrlfxr.exe 2244 nnnnhb.exe 780 i288226.exe 1412 o866008.exe 2320 lfxrlfr.exe 2396 268240.exe 4828 068206.exe 1944 frxrfxx.exe 4972 826660.exe 1072 8400026.exe 1020 1lrlfxx.exe 3936 dvddv.exe 1328 042262.exe 1168 nbnhbb.exe 684 8284488.exe 3308 0048288.exe 3588 0000444.exe 1132 hbhbbb.exe 4836 024846.exe 644 2260486.exe 2328 lffflrx.exe 1364 240488.exe 1488 4600066.exe 3296 48448.exe 2284 bttnnn.exe 4520 rlrrfrr.exe 4952 266600.exe 4948 htntnh.exe 760 nnnhbb.exe -
resource yara_rule behavioral2/memory/1228-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2240-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/876-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3344-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-194-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1228 wrote to memory of 2096 1228 edff3fabab5c6532ed98673f33a22040N.exe 84 PID 1228 wrote to memory of 2096 1228 edff3fabab5c6532ed98673f33a22040N.exe 84 PID 1228 wrote to memory of 2096 1228 edff3fabab5c6532ed98673f33a22040N.exe 84 PID 2096 wrote to memory of 4812 2096 464062.exe 85 PID 2096 wrote to memory of 4812 2096 464062.exe 85 PID 2096 wrote to memory of 4812 2096 464062.exe 85 PID 4812 wrote to memory of 3272 4812 28820.exe 86 PID 4812 wrote to memory of 3272 4812 28820.exe 86 PID 4812 wrote to memory of 3272 4812 28820.exe 86 PID 3272 wrote to memory of 3048 3272 1xxrlff.exe 87 PID 3272 wrote to memory of 3048 3272 1xxrlff.exe 87 PID 3272 wrote to memory of 3048 3272 1xxrlff.exe 87 PID 3048 wrote to memory of 2196 3048 84664.exe 88 PID 3048 wrote to memory of 2196 3048 84664.exe 88 PID 3048 wrote to memory of 2196 3048 84664.exe 88 PID 2196 wrote to memory of 3012 2196 5xlxllx.exe 89 PID 2196 wrote to memory of 3012 2196 5xlxllx.exe 89 PID 2196 wrote to memory of 3012 2196 5xlxllx.exe 89 PID 3012 wrote to memory of 4256 3012 266426.exe 90 PID 3012 wrote to memory of 4256 3012 266426.exe 90 PID 3012 wrote to memory of 4256 3012 266426.exe 90 PID 4256 wrote to memory of 4888 4256 jdvjj.exe 91 PID 4256 wrote to memory of 4888 4256 jdvjj.exe 91 PID 4256 wrote to memory of 4888 4256 jdvjj.exe 91 PID 4888 wrote to memory of 1988 4888 nhbthb.exe 92 PID 4888 wrote to memory of 1988 4888 nhbthb.exe 92 PID 4888 wrote to memory of 1988 4888 nhbthb.exe 92 PID 1988 wrote to memory of 2240 1988 46082.exe 93 PID 1988 wrote to memory of 2240 1988 46082.exe 93 PID 1988 wrote to memory of 2240 1988 46082.exe 93 PID 2240 wrote to memory of 2460 2240 668460.exe 94 PID 2240 wrote to memory of 2460 2240 668460.exe 94 PID 2240 wrote to memory of 2460 2240 668460.exe 94 PID 2460 wrote to memory of 3996 2460 jpjdv.exe 95 PID 2460 wrote to memory of 3996 2460 jpjdv.exe 95 PID 2460 wrote to memory of 3996 2460 jpjdv.exe 95 PID 3996 wrote to memory of 3224 3996 2882264.exe 97 PID 3996 wrote to memory of 3224 3996 2882264.exe 97 PID 3996 wrote to memory of 3224 3996 2882264.exe 97 PID 3224 wrote to memory of 4896 3224 jpvvp.exe 98 PID 3224 wrote to memory of 4896 3224 jpvvp.exe 98 PID 3224 wrote to memory of 4896 3224 jpvvp.exe 98 PID 4896 wrote to memory of 1928 4896 608000.exe 99 PID 4896 wrote to memory of 1928 4896 608000.exe 99 PID 4896 wrote to memory of 1928 4896 608000.exe 99 PID 1928 wrote to memory of 2380 1928 xrfrrlf.exe 100 PID 1928 wrote to memory of 2380 1928 xrfrrlf.exe 100 PID 1928 wrote to memory of 2380 1928 xrfrrlf.exe 100 PID 2380 wrote to memory of 876 2380 84682.exe 101 PID 2380 wrote to memory of 876 2380 84682.exe 101 PID 2380 wrote to memory of 876 2380 84682.exe 101 PID 876 wrote to memory of 4344 876 1tbtbt.exe 102 PID 876 wrote to memory of 4344 876 1tbtbt.exe 102 PID 876 wrote to memory of 4344 876 1tbtbt.exe 102 PID 4344 wrote to memory of 3984 4344 lfllrrx.exe 104 PID 4344 wrote to memory of 3984 4344 lfllrrx.exe 104 PID 4344 wrote to memory of 3984 4344 lfllrrx.exe 104 PID 3984 wrote to memory of 3044 3984 24000.exe 105 PID 3984 wrote to memory of 3044 3984 24000.exe 105 PID 3984 wrote to memory of 3044 3984 24000.exe 105 PID 3044 wrote to memory of 1972 3044 9rrffxl.exe 106 PID 3044 wrote to memory of 1972 3044 9rrffxl.exe 106 PID 3044 wrote to memory of 1972 3044 9rrffxl.exe 106 PID 1972 wrote to memory of 1384 1972 400482.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\edff3fabab5c6532ed98673f33a22040N.exe"C:\Users\Admin\AppData\Local\Temp\edff3fabab5c6532ed98673f33a22040N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\464062.exec:\464062.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\28820.exec:\28820.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\1xxrlff.exec:\1xxrlff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\84664.exec:\84664.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\5xlxllx.exec:\5xlxllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\266426.exec:\266426.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\jdvjj.exec:\jdvjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\nhbthb.exec:\nhbthb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\46082.exec:\46082.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\668460.exec:\668460.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\jpjdv.exec:\jpjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\2882264.exec:\2882264.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\jpvvp.exec:\jpvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\608000.exec:\608000.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\xrfrrlf.exec:\xrfrrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\84682.exec:\84682.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\1tbtbt.exec:\1tbtbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\lfllrrx.exec:\lfllrrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\24000.exec:\24000.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\9rrffxl.exec:\9rrffxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\400482.exec:\400482.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\pjjpj.exec:\pjjpj.exe23⤵
- Executes dropped EXE
PID:1384 -
\??\c:\pddpj.exec:\pddpj.exe24⤵
- Executes dropped EXE
PID:1236 -
\??\c:\xllrfll.exec:\xllrfll.exe25⤵
- Executes dropped EXE
PID:3972 -
\??\c:\7ddjd.exec:\7ddjd.exe26⤵
- Executes dropped EXE
PID:1748 -
\??\c:\422084.exec:\422084.exe27⤵
- Executes dropped EXE
PID:3756 -
\??\c:\bnnbnh.exec:\bnnbnh.exe28⤵
- Executes dropped EXE
PID:2476 -
\??\c:\htbnbb.exec:\htbnbb.exe29⤵
- Executes dropped EXE
PID:3344 -
\??\c:\206082.exec:\206082.exe30⤵
- Executes dropped EXE
PID:3104 -
\??\c:\jpvpj.exec:\jpvpj.exe31⤵
- Executes dropped EXE
PID:1316 -
\??\c:\rxxrrrl.exec:\rxxrrrl.exe32⤵
- Executes dropped EXE
PID:2856 -
\??\c:\2604822.exec:\2604822.exe33⤵
- Executes dropped EXE
PID:2408 -
\??\c:\680246.exec:\680246.exe34⤵
- Executes dropped EXE
PID:2672 -
\??\c:\dvjvd.exec:\dvjvd.exe35⤵
- Executes dropped EXE
PID:4780 -
\??\c:\4248268.exec:\4248268.exe36⤵
- Executes dropped EXE
PID:3372 -
\??\c:\1xrlfxr.exec:\1xrlfxr.exe37⤵
- Executes dropped EXE
PID:4312 -
\??\c:\nnnnhb.exec:\nnnnhb.exe38⤵
- Executes dropped EXE
PID:2244 -
\??\c:\i288226.exec:\i288226.exe39⤵
- Executes dropped EXE
PID:780 -
\??\c:\o866008.exec:\o866008.exe40⤵
- Executes dropped EXE
PID:1412 -
\??\c:\lfxrlfr.exec:\lfxrlfr.exe41⤵
- Executes dropped EXE
PID:2320 -
\??\c:\268240.exec:\268240.exe42⤵
- Executes dropped EXE
PID:2396 -
\??\c:\068206.exec:\068206.exe43⤵
- Executes dropped EXE
PID:4828 -
\??\c:\frxrfxx.exec:\frxrfxx.exe44⤵
- Executes dropped EXE
PID:1944 -
\??\c:\826660.exec:\826660.exe45⤵
- Executes dropped EXE
PID:4972 -
\??\c:\8400026.exec:\8400026.exe46⤵
- Executes dropped EXE
PID:1072 -
\??\c:\1lrlfxx.exec:\1lrlfxx.exe47⤵
- Executes dropped EXE
PID:1020 -
\??\c:\dvddv.exec:\dvddv.exe48⤵
- Executes dropped EXE
PID:3936 -
\??\c:\042262.exec:\042262.exe49⤵
- Executes dropped EXE
PID:1328 -
\??\c:\nbnhbb.exec:\nbnhbb.exe50⤵
- Executes dropped EXE
PID:1168 -
\??\c:\8284488.exec:\8284488.exe51⤵
- Executes dropped EXE
PID:684 -
\??\c:\0048288.exec:\0048288.exe52⤵
- Executes dropped EXE
PID:3308 -
\??\c:\0000444.exec:\0000444.exe53⤵
- Executes dropped EXE
PID:3588 -
\??\c:\hbhbbb.exec:\hbhbbb.exe54⤵
- Executes dropped EXE
PID:1132 -
\??\c:\024846.exec:\024846.exe55⤵
- Executes dropped EXE
PID:4836 -
\??\c:\2260486.exec:\2260486.exe56⤵
- Executes dropped EXE
PID:644 -
\??\c:\lffflrx.exec:\lffflrx.exe57⤵
- Executes dropped EXE
PID:2328 -
\??\c:\240488.exec:\240488.exe58⤵
- Executes dropped EXE
PID:1364 -
\??\c:\4600066.exec:\4600066.exe59⤵
- Executes dropped EXE
PID:1488 -
\??\c:\48448.exec:\48448.exe60⤵
- Executes dropped EXE
PID:3296 -
\??\c:\bttnnn.exec:\bttnnn.exe61⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rlrrfrr.exec:\rlrrfrr.exe62⤵
- Executes dropped EXE
PID:4520 -
\??\c:\266600.exec:\266600.exe63⤵
- Executes dropped EXE
PID:4952 -
\??\c:\htntnh.exec:\htntnh.exe64⤵
- Executes dropped EXE
PID:4948 -
\??\c:\nnnhbb.exec:\nnnhbb.exe65⤵
- Executes dropped EXE
PID:760 -
\??\c:\g4882.exec:\g4882.exe66⤵PID:2884
-
\??\c:\q02822.exec:\q02822.exe67⤵PID:2360
-
\??\c:\084040.exec:\084040.exe68⤵PID:2608
-
\??\c:\9flfrfx.exec:\9flfrfx.exe69⤵PID:4628
-
\??\c:\7llrlfx.exec:\7llrlfx.exe70⤵PID:1236
-
\??\c:\nbnhnb.exec:\nbnhnb.exe71⤵PID:2464
-
\??\c:\0400002.exec:\0400002.exe72⤵PID:4496
-
\??\c:\2604882.exec:\2604882.exe73⤵PID:3880
-
\??\c:\btnbnn.exec:\btnbnn.exe74⤵PID:4540
-
\??\c:\thhhhb.exec:\thhhhb.exe75⤵PID:3344
-
\??\c:\284264.exec:\284264.exe76⤵PID:1216
-
\??\c:\lfrxxll.exec:\lfrxxll.exe77⤵PID:1896
-
\??\c:\068488.exec:\068488.exe78⤵PID:4092
-
\??\c:\flfxrrr.exec:\flfxrrr.exe79⤵PID:4468
-
\??\c:\vjpdv.exec:\vjpdv.exe80⤵PID:816
-
\??\c:\thnbnn.exec:\thnbnn.exe81⤵PID:2672
-
\??\c:\nhnhbb.exec:\nhnhbb.exe82⤵PID:4780
-
\??\c:\o640006.exec:\o640006.exe83⤵PID:3808
-
\??\c:\6468028.exec:\6468028.exe84⤵PID:4312
-
\??\c:\8284444.exec:\8284444.exe85⤵PID:2244
-
\??\c:\m4004.exec:\m4004.exe86⤵PID:856
-
\??\c:\5jvpd.exec:\5jvpd.exe87⤵PID:4492
-
\??\c:\thhhhn.exec:\thhhhn.exe88⤵PID:1708
-
\??\c:\7tnhnt.exec:\7tnhnt.exe89⤵PID:1924
-
\??\c:\jvddv.exec:\jvddv.exe90⤵PID:2724
-
\??\c:\9fffxxr.exec:\9fffxxr.exe91⤵PID:4972
-
\??\c:\llxxrrl.exec:\llxxrrl.exe92⤵PID:5064
-
\??\c:\tnbhhb.exec:\tnbhhb.exe93⤵PID:3012
-
\??\c:\bhbbbn.exec:\bhbbbn.exe94⤵PID:4884
-
\??\c:\64648.exec:\64648.exe95⤵PID:4364
-
\??\c:\tnnnbb.exec:\tnnnbb.exe96⤵PID:2892
-
\??\c:\062600.exec:\062600.exe97⤵PID:4168
-
\??\c:\vjjjd.exec:\vjjjd.exe98⤵PID:2632
-
\??\c:\3xxxrrl.exec:\3xxxrrl.exe99⤵PID:3588
-
\??\c:\tbtthh.exec:\tbtthh.exe100⤵PID:2148
-
\??\c:\a2400.exec:\a2400.exe101⤵PID:4032
-
\??\c:\pjjpp.exec:\pjjpp.exe102⤵PID:3224
-
\??\c:\040644.exec:\040644.exe103⤵PID:2532
-
\??\c:\40648.exec:\40648.exe104⤵PID:2620
-
\??\c:\pdjdp.exec:\pdjdp.exe105⤵PID:2744
-
\??\c:\5rxrxfl.exec:\5rxrxfl.exe106⤵PID:3028
-
\??\c:\2404488.exec:\2404488.exe107⤵PID:3056
-
\??\c:\622666.exec:\622666.exe108⤵PID:4656
-
\??\c:\k22200.exec:\k22200.exe109⤵PID:3592
-
\??\c:\rrxrrxr.exec:\rrxrrxr.exe110⤵PID:2868
-
\??\c:\624444.exec:\624444.exe111⤵PID:2316
-
\??\c:\hbtntt.exec:\hbtntt.exe112⤵PID:3816
-
\??\c:\vpppj.exec:\vpppj.exe113⤵PID:640
-
\??\c:\26288.exec:\26288.exe114⤵PID:3580
-
\??\c:\2840404.exec:\2840404.exe115⤵PID:3040
-
\??\c:\2280628.exec:\2280628.exe116⤵PID:4428
-
\??\c:\vvvvv.exec:\vvvvv.exe117⤵PID:3880
-
\??\c:\xfllflf.exec:\xfllflf.exe118⤵PID:220
-
\??\c:\6822288.exec:\6822288.exe119⤵PID:3344
-
\??\c:\jdppv.exec:\jdppv.exe120⤵PID:1504
-
\??\c:\422048.exec:\422048.exe121⤵PID:3036
-
\??\c:\xrrrffx.exec:\xrrrffx.exe122⤵PID:3140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-