Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 19:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d18142072bcb0f6e248a399c04b87650faebe5d8e87b0f84e4059274c21cc91.exe
Resource
win7-20240708-en
5 signatures
150 seconds
General
-
Target
2d18142072bcb0f6e248a399c04b87650faebe5d8e87b0f84e4059274c21cc91.exe
-
Size
417KB
-
MD5
c10fa53151c92a9ddb8a6ec5f4fbe8df
-
SHA1
99352ef9c706f558ed539256511b4c1b3dd63128
-
SHA256
2d18142072bcb0f6e248a399c04b87650faebe5d8e87b0f84e4059274c21cc91
-
SHA512
a510c3171787391ceb29be2c62bfa2a73f205a626d6168f63a84ca694e03360a6e75a6585005dd1143025e3d71e9da138117b44d270e80a5085ba4cab0d15559
-
SSDEEP
12288:n3C9ytvngQj4DtvnV9wLn9UTfC8eieJNBNIsYPv:SgdnJUdnV9P
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/436-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/992-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4356 ppddj.exe 2044 lrllxrr.exe 2116 ppddv.exe 3268 dvjdv.exe 5092 1fxfflf.exe 4720 rfxxrrl.exe 3184 hhnnhb.exe 4036 flrrlrx.exe 1860 5nhhbh.exe 1180 9dddp.exe 4540 htthht.exe 1756 vvppj.exe 2748 5lxlllr.exe 2296 tbhthb.exe 4004 5xffxrl.exe 3212 7ttnhh.exe 4828 ddvvd.exe 1060 7flxrrl.exe 992 nbtnhb.exe 1344 5vpjj.exe 4408 rlffxxr.exe 2964 9hhbtn.exe 4200 5dvjj.exe 548 3rxxrrl.exe 3732 lxlflll.exe 452 hbnnnn.exe 4240 rfxxrff.exe 3524 pdvdd.exe 3500 ddpvv.exe 756 bnnhbt.exe 436 5pvpj.exe 4356 7rxlfff.exe 3936 lflxxll.exe 3076 tbtbnb.exe 1280 jdvdd.exe 1720 lflrfll.exe 1296 tnbttb.exe 4804 1jddv.exe 536 rrflfrr.exe 2128 rrxxxxx.exe 2744 bbnhhb.exe 8 rlxxxfx.exe 1808 bntnnn.exe 2648 djjjd.exe 3680 rlffxrr.exe 4108 1xffllr.exe 2288 jpvvv.exe 4884 fxxrlll.exe 2124 nhtnhh.exe 2520 ppddj.exe 2748 7lxffrr.exe 4208 bbthtt.exe 3952 pjpjd.exe 3212 pvjjj.exe 1444 flrfxfr.exe 2944 hntttt.exe 4688 jdvpj.exe 2000 nhnhnn.exe 3928 hbbhhh.exe 3740 fxlffff.exe 1976 bhtnhh.exe 1400 tnhbbb.exe 4396 pvvvp.exe 2512 bhhtnh.exe -
resource yara_rule behavioral2/memory/436-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/992-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 436 wrote to memory of 4356 436 2d18142072bcb0f6e248a399c04b87650faebe5d8e87b0f84e4059274c21cc91.exe 85 PID 436 wrote to memory of 4356 436 2d18142072bcb0f6e248a399c04b87650faebe5d8e87b0f84e4059274c21cc91.exe 85 PID 436 wrote to memory of 4356 436 2d18142072bcb0f6e248a399c04b87650faebe5d8e87b0f84e4059274c21cc91.exe 85 PID 4356 wrote to memory of 2044 4356 ppddj.exe 86 PID 4356 wrote to memory of 2044 4356 ppddj.exe 86 PID 4356 wrote to memory of 2044 4356 ppddj.exe 86 PID 2044 wrote to memory of 2116 2044 lrllxrr.exe 87 PID 2044 wrote to memory of 2116 2044 lrllxrr.exe 87 PID 2044 wrote to memory of 2116 2044 lrllxrr.exe 87 PID 2116 wrote to memory of 3268 2116 ppddv.exe 88 PID 2116 wrote to memory of 3268 2116 ppddv.exe 88 PID 2116 wrote to memory of 3268 2116 ppddv.exe 88 PID 3268 wrote to memory of 5092 3268 dvjdv.exe 89 PID 3268 wrote to memory of 5092 3268 dvjdv.exe 89 PID 3268 wrote to memory of 5092 3268 dvjdv.exe 89 PID 5092 wrote to memory of 4720 5092 1fxfflf.exe 91 PID 5092 wrote to memory of 4720 5092 1fxfflf.exe 91 PID 5092 wrote to memory of 4720 5092 1fxfflf.exe 91 PID 4720 wrote to memory of 3184 4720 rfxxrrl.exe 92 PID 4720 wrote to memory of 3184 4720 rfxxrrl.exe 92 PID 4720 wrote to memory of 3184 4720 rfxxrrl.exe 92 PID 3184 wrote to memory of 4036 3184 hhnnhb.exe 93 PID 3184 wrote to memory of 4036 3184 hhnnhb.exe 93 PID 3184 wrote to memory of 4036 3184 hhnnhb.exe 93 PID 4036 wrote to memory of 1860 4036 flrrlrx.exe 94 PID 4036 wrote to memory of 1860 4036 flrrlrx.exe 94 PID 4036 wrote to memory of 1860 4036 flrrlrx.exe 94 PID 1860 wrote to memory of 1180 1860 5nhhbh.exe 96 PID 1860 wrote to memory of 1180 1860 5nhhbh.exe 96 PID 1860 wrote to memory of 1180 1860 5nhhbh.exe 96 PID 1180 wrote to memory of 4540 1180 9dddp.exe 97 PID 1180 wrote to memory of 4540 1180 9dddp.exe 97 PID 1180 wrote to memory of 4540 1180 9dddp.exe 97 PID 4540 wrote to memory of 1756 4540 htthht.exe 98 PID 4540 wrote to memory of 1756 4540 htthht.exe 98 PID 4540 wrote to memory of 1756 4540 htthht.exe 98 PID 1756 wrote to memory of 2748 1756 vvppj.exe 99 PID 1756 wrote to memory of 2748 1756 vvppj.exe 99 PID 1756 wrote to memory of 2748 1756 vvppj.exe 99 PID 2748 wrote to memory of 2296 2748 5lxlllr.exe 100 PID 2748 wrote to memory of 2296 2748 5lxlllr.exe 100 PID 2748 wrote to memory of 2296 2748 5lxlllr.exe 100 PID 2296 wrote to memory of 4004 2296 tbhthb.exe 101 PID 2296 wrote to memory of 4004 2296 tbhthb.exe 101 PID 2296 wrote to memory of 4004 2296 tbhthb.exe 101 PID 4004 wrote to memory of 3212 4004 5xffxrl.exe 102 PID 4004 wrote to memory of 3212 4004 5xffxrl.exe 102 PID 4004 wrote to memory of 3212 4004 5xffxrl.exe 102 PID 3212 wrote to memory of 4828 3212 7ttnhh.exe 103 PID 3212 wrote to memory of 4828 3212 7ttnhh.exe 103 PID 3212 wrote to memory of 4828 3212 7ttnhh.exe 103 PID 4828 wrote to memory of 1060 4828 ddvvd.exe 104 PID 4828 wrote to memory of 1060 4828 ddvvd.exe 104 PID 4828 wrote to memory of 1060 4828 ddvvd.exe 104 PID 1060 wrote to memory of 992 1060 7flxrrl.exe 105 PID 1060 wrote to memory of 992 1060 7flxrrl.exe 105 PID 1060 wrote to memory of 992 1060 7flxrrl.exe 105 PID 992 wrote to memory of 1344 992 nbtnhb.exe 106 PID 992 wrote to memory of 1344 992 nbtnhb.exe 106 PID 992 wrote to memory of 1344 992 nbtnhb.exe 106 PID 1344 wrote to memory of 4408 1344 5vpjj.exe 107 PID 1344 wrote to memory of 4408 1344 5vpjj.exe 107 PID 1344 wrote to memory of 4408 1344 5vpjj.exe 107 PID 4408 wrote to memory of 2964 4408 rlffxxr.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d18142072bcb0f6e248a399c04b87650faebe5d8e87b0f84e4059274c21cc91.exe"C:\Users\Admin\AppData\Local\Temp\2d18142072bcb0f6e248a399c04b87650faebe5d8e87b0f84e4059274c21cc91.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\ppddj.exec:\ppddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\lrllxrr.exec:\lrllxrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\ppddv.exec:\ppddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\dvjdv.exec:\dvjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\1fxfflf.exec:\1fxfflf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\rfxxrrl.exec:\rfxxrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\hhnnhb.exec:\hhnnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\flrrlrx.exec:\flrrlrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\5nhhbh.exec:\5nhhbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\9dddp.exec:\9dddp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\htthht.exec:\htthht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\vvppj.exec:\vvppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\5lxlllr.exec:\5lxlllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\tbhthb.exec:\tbhthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\5xffxrl.exec:\5xffxrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\7ttnhh.exec:\7ttnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\ddvvd.exec:\ddvvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\7flxrrl.exec:\7flxrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\nbtnhb.exec:\nbtnhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\5vpjj.exec:\5vpjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\rlffxxr.exec:\rlffxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\9hhbtn.exec:\9hhbtn.exe23⤵
- Executes dropped EXE
PID:2964 -
\??\c:\5dvjj.exec:\5dvjj.exe24⤵
- Executes dropped EXE
PID:4200 -
\??\c:\3rxxrrl.exec:\3rxxrrl.exe25⤵
- Executes dropped EXE
PID:548 -
\??\c:\lxlflll.exec:\lxlflll.exe26⤵
- Executes dropped EXE
PID:3732 -
\??\c:\hbnnnn.exec:\hbnnnn.exe27⤵
- Executes dropped EXE
PID:452 -
\??\c:\rfxxrff.exec:\rfxxrff.exe28⤵
- Executes dropped EXE
PID:4240 -
\??\c:\pdvdd.exec:\pdvdd.exe29⤵
- Executes dropped EXE
PID:3524 -
\??\c:\ddpvv.exec:\ddpvv.exe30⤵
- Executes dropped EXE
PID:3500 -
\??\c:\bnnhbt.exec:\bnnhbt.exe31⤵
- Executes dropped EXE
PID:756 -
\??\c:\5pvpj.exec:\5pvpj.exe32⤵
- Executes dropped EXE
PID:436 -
\??\c:\7rxlfff.exec:\7rxlfff.exe33⤵
- Executes dropped EXE
PID:4356 -
\??\c:\lflxxll.exec:\lflxxll.exe34⤵
- Executes dropped EXE
PID:3936 -
\??\c:\tbtbnb.exec:\tbtbnb.exe35⤵
- Executes dropped EXE
PID:3076 -
\??\c:\jdvdd.exec:\jdvdd.exe36⤵
- Executes dropped EXE
PID:1280 -
\??\c:\lflrfll.exec:\lflrfll.exe37⤵
- Executes dropped EXE
PID:1720 -
\??\c:\tnbttb.exec:\tnbttb.exe38⤵
- Executes dropped EXE
PID:1296 -
\??\c:\1jddv.exec:\1jddv.exe39⤵
- Executes dropped EXE
PID:4804 -
\??\c:\rrflfrr.exec:\rrflfrr.exe40⤵
- Executes dropped EXE
PID:536 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe41⤵
- Executes dropped EXE
PID:2128 -
\??\c:\bbnhhb.exec:\bbnhhb.exe42⤵
- Executes dropped EXE
PID:2744 -
\??\c:\rlxxxfx.exec:\rlxxxfx.exe43⤵
- Executes dropped EXE
PID:8 -
\??\c:\bntnnn.exec:\bntnnn.exe44⤵
- Executes dropped EXE
PID:1808 -
\??\c:\djjjd.exec:\djjjd.exe45⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rlffxrr.exec:\rlffxrr.exe46⤵
- Executes dropped EXE
PID:3680 -
\??\c:\1xffllr.exec:\1xffllr.exe47⤵
- Executes dropped EXE
PID:4108 -
\??\c:\jpvvv.exec:\jpvvv.exe48⤵
- Executes dropped EXE
PID:2288 -
\??\c:\fxxrlll.exec:\fxxrlll.exe49⤵
- Executes dropped EXE
PID:4884 -
\??\c:\nhtnhh.exec:\nhtnhh.exe50⤵
- Executes dropped EXE
PID:2124 -
\??\c:\ppddj.exec:\ppddj.exe51⤵
- Executes dropped EXE
PID:2520 -
\??\c:\7lxffrr.exec:\7lxffrr.exe52⤵
- Executes dropped EXE
PID:2748 -
\??\c:\bbthtt.exec:\bbthtt.exe53⤵
- Executes dropped EXE
PID:4208 -
\??\c:\pjpjd.exec:\pjpjd.exe54⤵
- Executes dropped EXE
PID:3952 -
\??\c:\pvjjj.exec:\pvjjj.exe55⤵
- Executes dropped EXE
PID:3212 -
\??\c:\flrfxfr.exec:\flrfxfr.exe56⤵
- Executes dropped EXE
PID:1444 -
\??\c:\hntttt.exec:\hntttt.exe57⤵
- Executes dropped EXE
PID:2944 -
\??\c:\jdvpj.exec:\jdvpj.exe58⤵
- Executes dropped EXE
PID:4688 -
\??\c:\nhnhnn.exec:\nhnhnn.exe59⤵
- Executes dropped EXE
PID:2000 -
\??\c:\hbbhhh.exec:\hbbhhh.exe60⤵
- Executes dropped EXE
PID:3928 -
\??\c:\fxlffff.exec:\fxlffff.exe61⤵
- Executes dropped EXE
PID:3740 -
\??\c:\bhtnhh.exec:\bhtnhh.exe62⤵
- Executes dropped EXE
PID:1976 -
\??\c:\tnhbbb.exec:\tnhbbb.exe63⤵
- Executes dropped EXE
PID:1400 -
\??\c:\pvvvp.exec:\pvvvp.exe64⤵
- Executes dropped EXE
PID:4396 -
\??\c:\bhhtnh.exec:\bhhtnh.exe65⤵
- Executes dropped EXE
PID:2512 -
\??\c:\vjddv.exec:\vjddv.exe66⤵PID:1156
-
\??\c:\lllffff.exec:\lllffff.exe67⤵PID:3988
-
\??\c:\bbbttt.exec:\bbbttt.exe68⤵PID:3060
-
\??\c:\nnhtnn.exec:\nnhtnn.exe69⤵PID:4292
-
\??\c:\pppvv.exec:\pppvv.exe70⤵PID:5076
-
\??\c:\1lxxxxx.exec:\1lxxxxx.exe71⤵PID:4892
-
\??\c:\hbbtnh.exec:\hbbtnh.exe72⤵PID:1800
-
\??\c:\jjjjp.exec:\jjjjp.exe73⤵PID:1568
-
\??\c:\pjvpp.exec:\pjvpp.exe74⤵PID:2152
-
\??\c:\lllfrrl.exec:\lllfrrl.exe75⤵PID:3848
-
\??\c:\nhbtnn.exec:\nhbtnn.exe76⤵PID:436
-
\??\c:\ntnhbt.exec:\ntnhbt.exe77⤵PID:5000
-
\??\c:\vdvjv.exec:\vdvjv.exe78⤵PID:2044
-
\??\c:\fflffxr.exec:\fflffxr.exe79⤵PID:3772
-
\??\c:\tnnhbb.exec:\tnnhbb.exe80⤵PID:2576
-
\??\c:\7jdvp.exec:\7jdvp.exe81⤵PID:2172
-
\??\c:\fxrrrxf.exec:\fxrrrxf.exe82⤵PID:2012
-
\??\c:\frxxfrr.exec:\frxxfrr.exe83⤵PID:552
-
\??\c:\btbbth.exec:\btbbth.exe84⤵PID:4812
-
\??\c:\jvvpj.exec:\jvvpj.exe85⤵PID:4664
-
\??\c:\xflffff.exec:\xflffff.exe86⤵PID:2724
-
\??\c:\5rxlxrl.exec:\5rxlxrl.exe87⤵PID:968
-
\??\c:\7tbbbh.exec:\7tbbbh.exe88⤵PID:1860
-
\??\c:\9vddv.exec:\9vddv.exe89⤵PID:4112
-
\??\c:\xflfxrr.exec:\xflfxrr.exe90⤵PID:740
-
\??\c:\5hnbbb.exec:\5hnbbb.exe91⤵PID:4696
-
\??\c:\3tbhnt.exec:\3tbhnt.exe92⤵PID:2892
-
\??\c:\ppvjv.exec:\ppvjv.exe93⤵PID:3104
-
\??\c:\rfrrrff.exec:\rfrrrff.exe94⤵PID:2748
-
\??\c:\bthhhb.exec:\bthhhb.exe95⤵PID:3304
-
\??\c:\pjvpj.exec:\pjvpj.exe96⤵PID:3296
-
\??\c:\rrrrlll.exec:\rrrrlll.exe97⤵PID:448
-
\??\c:\nhbtbb.exec:\nhbtbb.exe98⤵PID:3424
-
\??\c:\vjjvj.exec:\vjjvj.exe99⤵PID:992
-
\??\c:\dvdvp.exec:\dvdvp.exe100⤵PID:3532
-
\??\c:\llxlrlx.exec:\llxlrlx.exe101⤵PID:2000
-
\??\c:\nntnhh.exec:\nntnhh.exe102⤵PID:2964
-
\??\c:\5vjdv.exec:\5vjdv.exe103⤵PID:4236
-
\??\c:\rxlfrrl.exec:\rxlfrrl.exe104⤵PID:2344
-
\??\c:\5tbbbh.exec:\5tbbbh.exe105⤵PID:4192
-
\??\c:\3vvpj.exec:\3vvpj.exe106⤵PID:1432
-
\??\c:\rrrlfxx.exec:\rrrlfxx.exe107⤵PID:3528
-
\??\c:\xrfrllf.exec:\xrfrllf.exe108⤵PID:2532
-
\??\c:\ntthbb.exec:\ntthbb.exe109⤵PID:3656
-
\??\c:\dvvvp.exec:\dvvvp.exe110⤵PID:1680
-
\??\c:\ffrrlrr.exec:\ffrrlrr.exe111⤵PID:452
-
\??\c:\nbnhbh.exec:\nbnhbh.exe112⤵PID:2672
-
\??\c:\vvvpv.exec:\vvvpv.exe113⤵PID:1740
-
\??\c:\frxrlfx.exec:\frxrlfx.exe114⤵PID:540
-
\??\c:\flllfff.exec:\flllfff.exe115⤵PID:4312
-
\??\c:\tnbhnh.exec:\tnbhnh.exe116⤵PID:2560
-
\??\c:\vvddd.exec:\vvddd.exe117⤵PID:756
-
\??\c:\lrfffrr.exec:\lrfffrr.exe118⤵PID:780
-
\??\c:\3fxrrxf.exec:\3fxrrxf.exe119⤵PID:916
-
\??\c:\dvdvp.exec:\dvdvp.exe120⤵PID:2956
-
\??\c:\ddpvp.exec:\ddpvp.exe121⤵PID:2588
-
\??\c:\xfxrrrl.exec:\xfxrrrl.exe122⤵PID:3900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-