Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
21/07/2024, 12:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bfe9ad8cdebb84d2b3a30415bfa7fd00N.exe
Resource
win7-20240705-en
5 signatures
120 seconds
General
-
Target
bfe9ad8cdebb84d2b3a30415bfa7fd00N.exe
-
Size
84KB
-
MD5
bfe9ad8cdebb84d2b3a30415bfa7fd00
-
SHA1
ab7c3d8dd4785f1255c1ea7284749856e41cce91
-
SHA256
6c036948d3d10bc7277cf78265b70fa58b0c13b888ac77a7afa390e4fd954a17
-
SHA512
9457fa4dd5f2c132008b71de6cfafbea1da98786286e45f28c7571688b71c5c696ce27a0e3b389653eae96bb44f26277fc0e67f4cf590026560f259bd829bc2a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAXPfgr2hKmdbcPi2v/:ymb3NkkiQ3mdBjFo6Pfgy3dbc//
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/872-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2688-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/688-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 116 lxxxrxr.exe 3464 bbtnhh.exe 4736 ppjjd.exe 4520 3rxrllf.exe 2632 rxlrxxr.exe 2688 dvppj.exe 3304 lxxxrrr.exe 2620 rfxllrf.exe 688 bbhhnn.exe 4844 dpjjp.exe 1508 lrxxxff.exe 3496 bnbnbn.exe 3656 9vddp.exe 2992 1xllllr.exe 436 nnnntt.exe 4392 ddvpj.exe 3224 9frlllr.exe 4040 tnbbbb.exe 1988 1hnnnn.exe 3064 djjjd.exe 3592 xrrlrrl.exe 2792 thhbbb.exe 2168 vpppj.exe 3996 xrffllx.exe 4716 ttnnnn.exe 3400 rllxfxf.exe 4868 fxrxxff.exe 4724 thnhtn.exe 1660 pjpvd.exe 924 xfllffr.exe 4144 bhthbh.exe 4876 ddpjd.exe 3232 rxxxrff.exe 3120 nhbtnn.exe 4456 pjpdj.exe 2860 9ttnbh.exe 4608 nbbtht.exe 4220 dvpvj.exe 4520 fxlfxxx.exe 1044 bntnnn.exe 4508 jjvpj.exe 4900 rxffrrl.exe 2716 hhhbhh.exe 3476 9nbtnn.exe 3900 7vvvj.exe 1812 xfrlffx.exe 3600 nbhhhh.exe 3696 tbttbn.exe 3964 jdvpp.exe 4208 xrlflrf.exe 4184 nnnthh.exe 436 pjvvp.exe 4364 rlrllll.exe 4864 bnhntb.exe 772 dvjvj.exe 3448 frfrxff.exe 460 bbbhtn.exe 1432 htttnn.exe 4960 djppd.exe 4796 xxffllr.exe 1624 bnttbn.exe 3720 pvdvj.exe 4484 lfflfxr.exe 552 hnhhbh.exe -
resource yara_rule behavioral2/memory/872-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2688-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4392-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4144-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 872 wrote to memory of 116 872 bfe9ad8cdebb84d2b3a30415bfa7fd00N.exe 84 PID 872 wrote to memory of 116 872 bfe9ad8cdebb84d2b3a30415bfa7fd00N.exe 84 PID 872 wrote to memory of 116 872 bfe9ad8cdebb84d2b3a30415bfa7fd00N.exe 84 PID 116 wrote to memory of 3464 116 lxxxrxr.exe 85 PID 116 wrote to memory of 3464 116 lxxxrxr.exe 85 PID 116 wrote to memory of 3464 116 lxxxrxr.exe 85 PID 3464 wrote to memory of 4736 3464 bbtnhh.exe 86 PID 3464 wrote to memory of 4736 3464 bbtnhh.exe 86 PID 3464 wrote to memory of 4736 3464 bbtnhh.exe 86 PID 4736 wrote to memory of 4520 4736 ppjjd.exe 87 PID 4736 wrote to memory of 4520 4736 ppjjd.exe 87 PID 4736 wrote to memory of 4520 4736 ppjjd.exe 87 PID 4520 wrote to memory of 2632 4520 3rxrllf.exe 88 PID 4520 wrote to memory of 2632 4520 3rxrllf.exe 88 PID 4520 wrote to memory of 2632 4520 3rxrllf.exe 88 PID 2632 wrote to memory of 2688 2632 rxlrxxr.exe 89 PID 2632 wrote to memory of 2688 2632 rxlrxxr.exe 89 PID 2632 wrote to memory of 2688 2632 rxlrxxr.exe 89 PID 2688 wrote to memory of 3304 2688 dvppj.exe 90 PID 2688 wrote to memory of 3304 2688 dvppj.exe 90 PID 2688 wrote to memory of 3304 2688 dvppj.exe 90 PID 3304 wrote to memory of 2620 3304 lxxxrrr.exe 91 PID 3304 wrote to memory of 2620 3304 lxxxrrr.exe 91 PID 3304 wrote to memory of 2620 3304 lxxxrrr.exe 91 PID 2620 wrote to memory of 688 2620 rfxllrf.exe 92 PID 2620 wrote to memory of 688 2620 rfxllrf.exe 92 PID 2620 wrote to memory of 688 2620 rfxllrf.exe 92 PID 688 wrote to memory of 4844 688 bbhhnn.exe 93 PID 688 wrote to memory of 4844 688 bbhhnn.exe 93 PID 688 wrote to memory of 4844 688 bbhhnn.exe 93 PID 4844 wrote to memory of 1508 4844 dpjjp.exe 94 PID 4844 wrote to memory of 1508 4844 dpjjp.exe 94 PID 4844 wrote to memory of 1508 4844 dpjjp.exe 94 PID 1508 wrote to memory of 3496 1508 lrxxxff.exe 95 PID 1508 wrote to memory of 3496 1508 lrxxxff.exe 95 PID 1508 wrote to memory of 3496 1508 lrxxxff.exe 95 PID 3496 wrote to memory of 3656 3496 bnbnbn.exe 96 PID 3496 wrote to memory of 3656 3496 bnbnbn.exe 96 PID 3496 wrote to memory of 3656 3496 bnbnbn.exe 96 PID 3656 wrote to memory of 2992 3656 9vddp.exe 97 PID 3656 wrote to memory of 2992 3656 9vddp.exe 97 PID 3656 wrote to memory of 2992 3656 9vddp.exe 97 PID 2992 wrote to memory of 436 2992 1xllllr.exe 98 PID 2992 wrote to memory of 436 2992 1xllllr.exe 98 PID 2992 wrote to memory of 436 2992 1xllllr.exe 98 PID 436 wrote to memory of 4392 436 nnnntt.exe 99 PID 436 wrote to memory of 4392 436 nnnntt.exe 99 PID 436 wrote to memory of 4392 436 nnnntt.exe 99 PID 4392 wrote to memory of 3224 4392 ddvpj.exe 101 PID 4392 wrote to memory of 3224 4392 ddvpj.exe 101 PID 4392 wrote to memory of 3224 4392 ddvpj.exe 101 PID 3224 wrote to memory of 4040 3224 9frlllr.exe 102 PID 3224 wrote to memory of 4040 3224 9frlllr.exe 102 PID 3224 wrote to memory of 4040 3224 9frlllr.exe 102 PID 4040 wrote to memory of 1988 4040 tnbbbb.exe 103 PID 4040 wrote to memory of 1988 4040 tnbbbb.exe 103 PID 4040 wrote to memory of 1988 4040 tnbbbb.exe 103 PID 1988 wrote to memory of 3064 1988 1hnnnn.exe 104 PID 1988 wrote to memory of 3064 1988 1hnnnn.exe 104 PID 1988 wrote to memory of 3064 1988 1hnnnn.exe 104 PID 3064 wrote to memory of 3592 3064 djjjd.exe 105 PID 3064 wrote to memory of 3592 3064 djjjd.exe 105 PID 3064 wrote to memory of 3592 3064 djjjd.exe 105 PID 3592 wrote to memory of 2792 3592 xrrlrrl.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfe9ad8cdebb84d2b3a30415bfa7fd00N.exe"C:\Users\Admin\AppData\Local\Temp\bfe9ad8cdebb84d2b3a30415bfa7fd00N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\lxxxrxr.exec:\lxxxrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\bbtnhh.exec:\bbtnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\ppjjd.exec:\ppjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\3rxrllf.exec:\3rxrllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\rxlrxxr.exec:\rxlrxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\dvppj.exec:\dvppj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\rfxllrf.exec:\rfxllrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\bbhhnn.exec:\bbhhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\dpjjp.exec:\dpjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\lrxxxff.exec:\lrxxxff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\bnbnbn.exec:\bnbnbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\9vddp.exec:\9vddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\1xllllr.exec:\1xllllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\nnnntt.exec:\nnnntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\ddvpj.exec:\ddvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\9frlllr.exec:\9frlllr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\tnbbbb.exec:\tnbbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\1hnnnn.exec:\1hnnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\djjjd.exec:\djjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\xrrlrrl.exec:\xrrlrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\thhbbb.exec:\thhbbb.exe23⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vpppj.exec:\vpppj.exe24⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xrffllx.exec:\xrffllx.exe25⤵
- Executes dropped EXE
PID:3996 -
\??\c:\ttnnnn.exec:\ttnnnn.exe26⤵
- Executes dropped EXE
PID:4716 -
\??\c:\rllxfxf.exec:\rllxfxf.exe27⤵
- Executes dropped EXE
PID:3400 -
\??\c:\fxrxxff.exec:\fxrxxff.exe28⤵
- Executes dropped EXE
PID:4868 -
\??\c:\thnhtn.exec:\thnhtn.exe29⤵
- Executes dropped EXE
PID:4724 -
\??\c:\pjpvd.exec:\pjpvd.exe30⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xfllffr.exec:\xfllffr.exe31⤵
- Executes dropped EXE
PID:924 -
\??\c:\bhthbh.exec:\bhthbh.exe32⤵
- Executes dropped EXE
PID:4144 -
\??\c:\ddpjd.exec:\ddpjd.exe33⤵
- Executes dropped EXE
PID:4876 -
\??\c:\rxxxrff.exec:\rxxxrff.exe34⤵
- Executes dropped EXE
PID:3232 -
\??\c:\hbhthb.exec:\hbhthb.exe35⤵PID:4424
-
\??\c:\nhbtnn.exec:\nhbtnn.exe36⤵
- Executes dropped EXE
PID:3120 -
\??\c:\pjpdj.exec:\pjpdj.exe37⤵
- Executes dropped EXE
PID:4456 -
\??\c:\9ttnbh.exec:\9ttnbh.exe38⤵
- Executes dropped EXE
PID:2860 -
\??\c:\nbbtht.exec:\nbbtht.exe39⤵
- Executes dropped EXE
PID:4608 -
\??\c:\dvpvj.exec:\dvpvj.exe40⤵
- Executes dropped EXE
PID:4220 -
\??\c:\fxlfxxx.exec:\fxlfxxx.exe41⤵
- Executes dropped EXE
PID:4520 -
\??\c:\bntnnn.exec:\bntnnn.exe42⤵
- Executes dropped EXE
PID:1044 -
\??\c:\jjvpj.exec:\jjvpj.exe43⤵
- Executes dropped EXE
PID:4508 -
\??\c:\rxffrrl.exec:\rxffrrl.exe44⤵
- Executes dropped EXE
PID:4900 -
\??\c:\hhhbhh.exec:\hhhbhh.exe45⤵
- Executes dropped EXE
PID:2716 -
\??\c:\9nbtnn.exec:\9nbtnn.exe46⤵
- Executes dropped EXE
PID:3476 -
\??\c:\7vvvj.exec:\7vvvj.exe47⤵
- Executes dropped EXE
PID:3900 -
\??\c:\xfrlffx.exec:\xfrlffx.exe48⤵
- Executes dropped EXE
PID:1812 -
\??\c:\nbhhhh.exec:\nbhhhh.exe49⤵
- Executes dropped EXE
PID:3600 -
\??\c:\tbttbn.exec:\tbttbn.exe50⤵
- Executes dropped EXE
PID:3696 -
\??\c:\jdvpp.exec:\jdvpp.exe51⤵
- Executes dropped EXE
PID:3964 -
\??\c:\xrlflrf.exec:\xrlflrf.exe52⤵
- Executes dropped EXE
PID:4208 -
\??\c:\nnnthh.exec:\nnnthh.exe53⤵
- Executes dropped EXE
PID:4184 -
\??\c:\pjvvp.exec:\pjvvp.exe54⤵
- Executes dropped EXE
PID:436 -
\??\c:\rlrllll.exec:\rlrllll.exe55⤵
- Executes dropped EXE
PID:4364 -
\??\c:\bnhntb.exec:\bnhntb.exe56⤵
- Executes dropped EXE
PID:4864 -
\??\c:\dvjvj.exec:\dvjvj.exe57⤵
- Executes dropped EXE
PID:772 -
\??\c:\frfrxff.exec:\frfrxff.exe58⤵
- Executes dropped EXE
PID:3448 -
\??\c:\bbbhtn.exec:\bbbhtn.exe59⤵
- Executes dropped EXE
PID:460 -
\??\c:\htttnn.exec:\htttnn.exe60⤵
- Executes dropped EXE
PID:1432 -
\??\c:\djppd.exec:\djppd.exe61⤵
- Executes dropped EXE
PID:4960 -
\??\c:\xxffllr.exec:\xxffllr.exe62⤵
- Executes dropped EXE
PID:4796 -
\??\c:\bnttbn.exec:\bnttbn.exe63⤵
- Executes dropped EXE
PID:1624 -
\??\c:\pvdvj.exec:\pvdvj.exe64⤵
- Executes dropped EXE
PID:3720 -
\??\c:\lfflfxr.exec:\lfflfxr.exe65⤵
- Executes dropped EXE
PID:4484 -
\??\c:\hnhhbh.exec:\hnhhbh.exe66⤵
- Executes dropped EXE
PID:552 -
\??\c:\jpjvv.exec:\jpjvv.exe67⤵PID:1536
-
\??\c:\pvdpd.exec:\pvdpd.exe68⤵PID:3672
-
\??\c:\lrlxxfr.exec:\lrlxxfr.exe69⤵PID:2184
-
\??\c:\pjpdv.exec:\pjpdv.exe70⤵PID:3400
-
\??\c:\lrxffrl.exec:\lrxffrl.exe71⤵PID:4388
-
\??\c:\xfxxxlr.exec:\xfxxxlr.exe72⤵PID:2308
-
\??\c:\nntnhh.exec:\nntnhh.exe73⤵PID:3856
-
\??\c:\5jddv.exec:\5jddv.exe74⤵PID:2596
-
\??\c:\rxlxrlf.exec:\rxlxrlf.exe75⤵PID:4500
-
\??\c:\hnhthb.exec:\hnhthb.exe76⤵PID:2172
-
\??\c:\tbnhht.exec:\tbnhht.exe77⤵PID:4972
-
\??\c:\pppdj.exec:\pppdj.exe78⤵PID:3232
-
\??\c:\rfflfxr.exec:\rfflfxr.exe79⤵PID:224
-
\??\c:\7xrlxxx.exec:\7xrlxxx.exe80⤵PID:928
-
\??\c:\hhnhbb.exec:\hhnhbb.exe81⤵PID:4848
-
\??\c:\dpdjv.exec:\dpdjv.exe82⤵PID:952
-
\??\c:\lflxxxr.exec:\lflxxxr.exe83⤵PID:520
-
\??\c:\nnnhbt.exec:\nnnhbt.exe84⤵PID:4916
-
\??\c:\3vvpj.exec:\3vvpj.exe85⤵PID:516
-
\??\c:\rxlllrr.exec:\rxlllrr.exe86⤵PID:2208
-
\??\c:\llrfffl.exec:\llrfffl.exe87⤵PID:4348
-
\??\c:\1ntnnn.exec:\1ntnnn.exe88⤵PID:4512
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe89⤵PID:4044
-
\??\c:\lflfxxr.exec:\lflfxxr.exe90⤵PID:688
-
\??\c:\hbhhhh.exec:\hbhhhh.exe91⤵PID:2300
-
\??\c:\ppdvp.exec:\ppdvp.exe92⤵PID:4844
-
\??\c:\btbthh.exec:\btbthh.exe93⤵PID:4640
-
\??\c:\jdpvp.exec:\jdpvp.exe94⤵PID:3656
-
\??\c:\rrlrfxl.exec:\rrlrfxl.exe95⤵PID:4904
-
\??\c:\hbhhhh.exec:\hbhhhh.exe96⤵PID:3056
-
\??\c:\jddpv.exec:\jddpv.exe97⤵PID:2216
-
\??\c:\7ppjv.exec:\7ppjv.exe98⤵PID:4544
-
\??\c:\xlrfxrl.exec:\xlrfxrl.exe99⤵PID:748
-
\??\c:\nttttt.exec:\nttttt.exe100⤵PID:4864
-
\??\c:\vjjdd.exec:\vjjdd.exe101⤵PID:1420
-
\??\c:\vjpdp.exec:\vjpdp.exe102⤵PID:4504
-
\??\c:\rfxxrrr.exec:\rfxxrrr.exe103⤵PID:472
-
\??\c:\9nhtnb.exec:\9nhtnb.exe104⤵PID:4448
-
\??\c:\7bbtnn.exec:\7bbtnn.exe105⤵PID:5100
-
\??\c:\ppvvp.exec:\ppvvp.exe106⤵PID:4472
-
\??\c:\hbnhtt.exec:\hbnhtt.exe107⤵PID:1156
-
\??\c:\5hbbtt.exec:\5hbbtt.exe108⤵PID:632
-
\??\c:\pvdjd.exec:\pvdjd.exe109⤵PID:1584
-
\??\c:\lxxrlll.exec:\lxxrlll.exe110⤵PID:4288
-
\??\c:\llrllrx.exec:\llrllrx.exe111⤵PID:4716
-
\??\c:\nhtntn.exec:\nhtntn.exe112⤵PID:4252
-
\??\c:\hnhbtn.exec:\hnhbtn.exe113⤵PID:2824
-
\??\c:\1pjpj.exec:\1pjpj.exe114⤵PID:2284
-
\??\c:\rrrlfff.exec:\rrrlfff.exe115⤵PID:1856
-
\??\c:\btbthh.exec:\btbthh.exe116⤵PID:2516
-
\??\c:\vdvpv.exec:\vdvpv.exe117⤵PID:3624
-
\??\c:\vpdpv.exec:\vpdpv.exe118⤵PID:5072
-
\??\c:\bhbhnn.exec:\bhbhnn.exe119⤵PID:4240
-
\??\c:\vdjjj.exec:\vdjjj.exe120⤵PID:3232
-
\??\c:\frrlfff.exec:\frrlfff.exe121⤵PID:4424
-
\??\c:\xxlfffr.exec:\xxlfffr.exe122⤵PID:4416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-