Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 00:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9968319a7cb0f4dcfd5999327af7391845e986aa47ffbcece3a1a442d32d8197.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
9968319a7cb0f4dcfd5999327af7391845e986aa47ffbcece3a1a442d32d8197.exe
-
Size
84KB
-
MD5
423959f9dda91641b41a383a97b05993
-
SHA1
090e84b0bcdbb763418b5e221fc3828626d6a957
-
SHA256
9968319a7cb0f4dcfd5999327af7391845e986aa47ffbcece3a1a442d32d8197
-
SHA512
7fd1351e380f9aca6a967800269b5548309a3e530154d435ba4038e7ef5d5b681cb861112e86e13d932551877cfc12c0893292fe4158b91f2567723ff4ee6d5a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73t6MlYqn+jMp99zx/K0Xt:ymb3NkkiQ3mdBjFo73tvn+Yp99zx
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral2/memory/716-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/876-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1552-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2656-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1192-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 22 IoCs
resource yara_rule behavioral2/memory/716-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2332-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/876-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2520-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3964-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3576-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4456-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4896-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2964-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2964-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1552-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3740-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2204-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4892-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3248-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2656-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2032-143-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2064-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4512-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1192-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2696-184-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4344-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2332 bnbbnt.exe 876 jdvdv.exe 2520 lffxrrr.exe 3964 pvjjd.exe 3576 rfxxxxx.exe 1064 pdddp.exe 4896 7ppjj.exe 4456 hnnnnh.exe 2964 1jdpd.exe 1552 rlllflf.exe 3740 tnttbh.exe 4956 3djpv.exe 3352 flrrrfr.exe 2204 hthhbh.exe 4892 jdvvj.exe 3248 lxlllxl.exe 2656 ttnnbh.exe 4396 vpjdv.exe 2972 llfrxxr.exe 3596 nthnth.exe 2032 jdjpd.exe 2064 vddjv.exe 4512 nttbhn.exe 2160 bnnnhh.exe 452 xflxxxf.exe 1192 tntttb.exe 4664 dvpvd.exe 2696 rrflflf.exe 4344 nnthhn.exe 1948 dpvjj.exe 2372 rxxfflx.exe 1252 bnbbhb.exe 1264 jjddp.exe 940 frxrxrx.exe 5096 9ntnnn.exe 4624 bbhhnt.exe 4756 jjdvp.exe 3696 rllxxxx.exe 4172 frflffr.exe 5048 bthtbh.exe 3752 vdjpp.exe 1860 jdvvp.exe 3516 lrxxllx.exe 3212 hhhbbb.exe 5004 vdppj.exe 2520 dvjpp.exe 2640 9llllrx.exe 464 tbthnn.exe 4020 ntbbbb.exe 2776 jpjvv.exe 1240 9dddv.exe 1576 rflflll.exe 928 thnbbh.exe 2644 ttttnt.exe 3572 vjppp.exe 3928 xrllfll.exe 4144 thnhnn.exe 2004 jvjpp.exe 3288 pvdvd.exe 824 lfxrllx.exe 2928 5hhhnt.exe 4388 jjvdp.exe 4576 lfflllx.exe 2404 fxllfll.exe -
resource yara_rule behavioral2/memory/716-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/876-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1192-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-191-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 716 wrote to memory of 2332 716 9968319a7cb0f4dcfd5999327af7391845e986aa47ffbcece3a1a442d32d8197.exe 81 PID 716 wrote to memory of 2332 716 9968319a7cb0f4dcfd5999327af7391845e986aa47ffbcece3a1a442d32d8197.exe 81 PID 716 wrote to memory of 2332 716 9968319a7cb0f4dcfd5999327af7391845e986aa47ffbcece3a1a442d32d8197.exe 81 PID 2332 wrote to memory of 876 2332 bnbbnt.exe 82 PID 2332 wrote to memory of 876 2332 bnbbnt.exe 82 PID 2332 wrote to memory of 876 2332 bnbbnt.exe 82 PID 876 wrote to memory of 2520 876 jdvdv.exe 83 PID 876 wrote to memory of 2520 876 jdvdv.exe 83 PID 876 wrote to memory of 2520 876 jdvdv.exe 83 PID 2520 wrote to memory of 3964 2520 lffxrrr.exe 84 PID 2520 wrote to memory of 3964 2520 lffxrrr.exe 84 PID 2520 wrote to memory of 3964 2520 lffxrrr.exe 84 PID 3964 wrote to memory of 3576 3964 pvjjd.exe 85 PID 3964 wrote to memory of 3576 3964 pvjjd.exe 85 PID 3964 wrote to memory of 3576 3964 pvjjd.exe 85 PID 3576 wrote to memory of 1064 3576 rfxxxxx.exe 86 PID 3576 wrote to memory of 1064 3576 rfxxxxx.exe 86 PID 3576 wrote to memory of 1064 3576 rfxxxxx.exe 86 PID 1064 wrote to memory of 4896 1064 pdddp.exe 87 PID 1064 wrote to memory of 4896 1064 pdddp.exe 87 PID 1064 wrote to memory of 4896 1064 pdddp.exe 87 PID 4896 wrote to memory of 4456 4896 7ppjj.exe 88 PID 4896 wrote to memory of 4456 4896 7ppjj.exe 88 PID 4896 wrote to memory of 4456 4896 7ppjj.exe 88 PID 4456 wrote to memory of 2964 4456 hnnnnh.exe 89 PID 4456 wrote to memory of 2964 4456 hnnnnh.exe 89 PID 4456 wrote to memory of 2964 4456 hnnnnh.exe 89 PID 2964 wrote to memory of 1552 2964 1jdpd.exe 90 PID 2964 wrote to memory of 1552 2964 1jdpd.exe 90 PID 2964 wrote to memory of 1552 2964 1jdpd.exe 90 PID 1552 wrote to memory of 3740 1552 rlllflf.exe 92 PID 1552 wrote to memory of 3740 1552 rlllflf.exe 92 PID 1552 wrote to memory of 3740 1552 rlllflf.exe 92 PID 3740 wrote to memory of 4956 3740 tnttbh.exe 93 PID 3740 wrote to memory of 4956 3740 tnttbh.exe 93 PID 3740 wrote to memory of 4956 3740 tnttbh.exe 93 PID 4956 wrote to memory of 3352 4956 3djpv.exe 94 PID 4956 wrote to memory of 3352 4956 3djpv.exe 94 PID 4956 wrote to memory of 3352 4956 3djpv.exe 94 PID 3352 wrote to memory of 2204 3352 flrrrfr.exe 95 PID 3352 wrote to memory of 2204 3352 flrrrfr.exe 95 PID 3352 wrote to memory of 2204 3352 flrrrfr.exe 95 PID 2204 wrote to memory of 4892 2204 hthhbh.exe 96 PID 2204 wrote to memory of 4892 2204 hthhbh.exe 96 PID 2204 wrote to memory of 4892 2204 hthhbh.exe 96 PID 4892 wrote to memory of 3248 4892 jdvvj.exe 97 PID 4892 wrote to memory of 3248 4892 jdvvj.exe 97 PID 4892 wrote to memory of 3248 4892 jdvvj.exe 97 PID 3248 wrote to memory of 2656 3248 lxlllxl.exe 98 PID 3248 wrote to memory of 2656 3248 lxlllxl.exe 98 PID 3248 wrote to memory of 2656 3248 lxlllxl.exe 98 PID 2656 wrote to memory of 4396 2656 ttnnbh.exe 99 PID 2656 wrote to memory of 4396 2656 ttnnbh.exe 99 PID 2656 wrote to memory of 4396 2656 ttnnbh.exe 99 PID 4396 wrote to memory of 2972 4396 vpjdv.exe 100 PID 4396 wrote to memory of 2972 4396 vpjdv.exe 100 PID 4396 wrote to memory of 2972 4396 vpjdv.exe 100 PID 2972 wrote to memory of 3596 2972 llfrxxr.exe 101 PID 2972 wrote to memory of 3596 2972 llfrxxr.exe 101 PID 2972 wrote to memory of 3596 2972 llfrxxr.exe 101 PID 3596 wrote to memory of 2032 3596 nthnth.exe 102 PID 3596 wrote to memory of 2032 3596 nthnth.exe 102 PID 3596 wrote to memory of 2032 3596 nthnth.exe 102 PID 2032 wrote to memory of 2064 2032 jdjpd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9968319a7cb0f4dcfd5999327af7391845e986aa47ffbcece3a1a442d32d8197.exe"C:\Users\Admin\AppData\Local\Temp\9968319a7cb0f4dcfd5999327af7391845e986aa47ffbcece3a1a442d32d8197.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\bnbbnt.exec:\bnbbnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\jdvdv.exec:\jdvdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\lffxrrr.exec:\lffxrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\pvjjd.exec:\pvjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\rfxxxxx.exec:\rfxxxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\pdddp.exec:\pdddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\7ppjj.exec:\7ppjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\hnnnnh.exec:\hnnnnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\1jdpd.exec:\1jdpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\rlllflf.exec:\rlllflf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\tnttbh.exec:\tnttbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\3djpv.exec:\3djpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\flrrrfr.exec:\flrrrfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\hthhbh.exec:\hthhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\jdvvj.exec:\jdvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\lxlllxl.exec:\lxlllxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\ttnnbh.exec:\ttnnbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\vpjdv.exec:\vpjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\llfrxxr.exec:\llfrxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\nthnth.exec:\nthnth.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\jdjpd.exec:\jdjpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\vddjv.exec:\vddjv.exe23⤵
- Executes dropped EXE
PID:2064 -
\??\c:\nttbhn.exec:\nttbhn.exe24⤵
- Executes dropped EXE
PID:4512 -
\??\c:\bnnnhh.exec:\bnnnhh.exe25⤵
- Executes dropped EXE
PID:2160 -
\??\c:\xflxxxf.exec:\xflxxxf.exe26⤵
- Executes dropped EXE
PID:452 -
\??\c:\tntttb.exec:\tntttb.exe27⤵
- Executes dropped EXE
PID:1192 -
\??\c:\dvpvd.exec:\dvpvd.exe28⤵
- Executes dropped EXE
PID:4664 -
\??\c:\rrflflf.exec:\rrflflf.exe29⤵
- Executes dropped EXE
PID:2696 -
\??\c:\nnthhn.exec:\nnthhn.exe30⤵
- Executes dropped EXE
PID:4344 -
\??\c:\dpvjj.exec:\dpvjj.exe31⤵
- Executes dropped EXE
PID:1948 -
\??\c:\rxxfflx.exec:\rxxfflx.exe32⤵
- Executes dropped EXE
PID:2372 -
\??\c:\bnbbhb.exec:\bnbbhb.exe33⤵
- Executes dropped EXE
PID:1252 -
\??\c:\jjddp.exec:\jjddp.exe34⤵
- Executes dropped EXE
PID:1264 -
\??\c:\frxrxrx.exec:\frxrxrx.exe35⤵
- Executes dropped EXE
PID:940 -
\??\c:\9ntnnn.exec:\9ntnnn.exe36⤵
- Executes dropped EXE
PID:5096 -
\??\c:\bbhhnt.exec:\bbhhnt.exe37⤵
- Executes dropped EXE
PID:4624 -
\??\c:\jjdvp.exec:\jjdvp.exe38⤵
- Executes dropped EXE
PID:4756 -
\??\c:\rllxxxx.exec:\rllxxxx.exe39⤵
- Executes dropped EXE
PID:3696 -
\??\c:\frflffr.exec:\frflffr.exe40⤵
- Executes dropped EXE
PID:4172 -
\??\c:\bthtbh.exec:\bthtbh.exe41⤵
- Executes dropped EXE
PID:5048 -
\??\c:\vdjpp.exec:\vdjpp.exe42⤵
- Executes dropped EXE
PID:3752 -
\??\c:\jdvvp.exec:\jdvvp.exe43⤵
- Executes dropped EXE
PID:1860 -
\??\c:\lrxxllx.exec:\lrxxllx.exe44⤵
- Executes dropped EXE
PID:3516 -
\??\c:\hhhbbb.exec:\hhhbbb.exe45⤵
- Executes dropped EXE
PID:3212 -
\??\c:\vdppj.exec:\vdppj.exe46⤵
- Executes dropped EXE
PID:5004 -
\??\c:\dvjpp.exec:\dvjpp.exe47⤵
- Executes dropped EXE
PID:2520 -
\??\c:\9llllrx.exec:\9llllrx.exe48⤵
- Executes dropped EXE
PID:2640 -
\??\c:\tbthnn.exec:\tbthnn.exe49⤵
- Executes dropped EXE
PID:464 -
\??\c:\ntbbbb.exec:\ntbbbb.exe50⤵
- Executes dropped EXE
PID:4020 -
\??\c:\jpjvv.exec:\jpjvv.exe51⤵
- Executes dropped EXE
PID:2776 -
\??\c:\9dddv.exec:\9dddv.exe52⤵
- Executes dropped EXE
PID:1240 -
\??\c:\rflflll.exec:\rflflll.exe53⤵
- Executes dropped EXE
PID:1576 -
\??\c:\thnbbh.exec:\thnbbh.exe54⤵
- Executes dropped EXE
PID:928 -
\??\c:\ttttnt.exec:\ttttnt.exe55⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vjppp.exec:\vjppp.exe56⤵
- Executes dropped EXE
PID:3572 -
\??\c:\xrllfll.exec:\xrllfll.exe57⤵
- Executes dropped EXE
PID:3928 -
\??\c:\thnhnn.exec:\thnhnn.exe58⤵
- Executes dropped EXE
PID:4144 -
\??\c:\jvjpp.exec:\jvjpp.exe59⤵
- Executes dropped EXE
PID:2004 -
\??\c:\pvdvd.exec:\pvdvd.exe60⤵
- Executes dropped EXE
PID:3288 -
\??\c:\lfxrllx.exec:\lfxrllx.exe61⤵
- Executes dropped EXE
PID:824 -
\??\c:\5hhhnt.exec:\5hhhnt.exe62⤵
- Executes dropped EXE
PID:2928 -
\??\c:\jjvdp.exec:\jjvdp.exe63⤵
- Executes dropped EXE
PID:4388 -
\??\c:\lfflllx.exec:\lfflllx.exe64⤵
- Executes dropped EXE
PID:4576 -
\??\c:\fxllfll.exec:\fxllfll.exe65⤵
- Executes dropped EXE
PID:2404 -
\??\c:\tnhnhn.exec:\tnhnhn.exe66⤵PID:4600
-
\??\c:\jdjjp.exec:\jdjjp.exe67⤵PID:5044
-
\??\c:\lrllrxf.exec:\lrllrxf.exe68⤵PID:2032
-
\??\c:\nnhhnn.exec:\nnhhnn.exe69⤵PID:4908
-
\??\c:\bttnht.exec:\bttnht.exe70⤵PID:2428
-
\??\c:\3ddpj.exec:\3ddpj.exe71⤵PID:2872
-
\??\c:\xrffrlr.exec:\xrffrlr.exe72⤵PID:872
-
\??\c:\nnhtnn.exec:\nnhtnn.exe73⤵PID:868
-
\??\c:\jddjv.exec:\jddjv.exe74⤵PID:4324
-
\??\c:\llrxxfl.exec:\llrxxfl.exe75⤵PID:392
-
\??\c:\hhnnhh.exec:\hhnnhh.exe76⤵PID:2684
-
\??\c:\jppvd.exec:\jppvd.exe77⤵PID:4220
-
\??\c:\llrrffr.exec:\llrrffr.exe78⤵PID:1996
-
\??\c:\tnntnh.exec:\tnntnh.exe79⤵PID:4344
-
\??\c:\jvvpj.exec:\jvvpj.exe80⤵PID:4084
-
\??\c:\pppjj.exec:\pppjj.exe81⤵PID:2116
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe82⤵PID:1088
-
\??\c:\bntnbb.exec:\bntnbb.exe83⤵PID:4988
-
\??\c:\djppv.exec:\djppv.exe84⤵PID:3804
-
\??\c:\rxxrlfl.exec:\rxxrlfl.exe85⤵PID:3236
-
\??\c:\lffxrff.exec:\lffxrff.exe86⤵PID:3000
-
\??\c:\9nttht.exec:\9nttht.exe87⤵PID:2868
-
\??\c:\7nttnt.exec:\7nttnt.exe88⤵PID:2560
-
\??\c:\vpdpj.exec:\vpdpj.exe89⤵PID:4372
-
\??\c:\lfllrxf.exec:\lfllrxf.exe90⤵PID:1852
-
\??\c:\1frrxlx.exec:\1frrxlx.exe91⤵PID:528
-
\??\c:\nnnnhh.exec:\nnnnhh.exe92⤵PID:4196
-
\??\c:\jjddv.exec:\jjddv.exe93⤵PID:3008
-
\??\c:\vjvpj.exec:\vjvpj.exe94⤵PID:2056
-
\??\c:\rrxxlrr.exec:\rrxxlrr.exe95⤵PID:4788
-
\??\c:\3bnnth.exec:\3bnnth.exe96⤵PID:2640
-
\??\c:\xxrrlrr.exec:\xxrrlrr.exe97⤵PID:2748
-
\??\c:\bhhthh.exec:\bhhthh.exe98⤵PID:3372
-
\??\c:\hnhbhb.exec:\hnhbhb.exe99⤵PID:4912
-
\??\c:\dppdp.exec:\dppdp.exe100⤵PID:224
-
\??\c:\lrrxxxx.exec:\lrrxxxx.exe101⤵PID:4456
-
\??\c:\rxrfrrf.exec:\rxrfrrf.exe102⤵PID:2884
-
\??\c:\nthntb.exec:\nthntb.exe103⤵PID:3172
-
\??\c:\bbbtnn.exec:\bbbtnn.exe104⤵PID:396
-
\??\c:\vvdpd.exec:\vvdpd.exe105⤵PID:2788
-
\??\c:\rlxlrll.exec:\rlxlrll.exe106⤵PID:5092
-
\??\c:\ffrllrr.exec:\ffrllrr.exe107⤵PID:1112
-
\??\c:\tbbnht.exec:\tbbnht.exe108⤵PID:4460
-
\??\c:\vjddj.exec:\vjddj.exe109⤵PID:4392
-
\??\c:\xrlrrff.exec:\xrlrrff.exe110⤵PID:1268
-
\??\c:\tbtttt.exec:\tbtttt.exe111⤵PID:628
-
\??\c:\thhbth.exec:\thhbth.exe112⤵PID:4040
-
\??\c:\jvjjd.exec:\jvjjd.exe113⤵PID:2120
-
\??\c:\lxxlxrl.exec:\lxxlxrl.exe114⤵PID:4504
-
\??\c:\bttbnt.exec:\bttbnt.exe115⤵PID:644
-
\??\c:\5vpdd.exec:\5vpdd.exe116⤵PID:2600
-
\??\c:\rrlxrll.exec:\rrlxrll.exe117⤵PID:2664
-
\??\c:\lxxlrrr.exec:\lxxlrrr.exe118⤵PID:2160
-
\??\c:\nhbthb.exec:\nhbthb.exe119⤵PID:1568
-
\??\c:\vppvp.exec:\vppvp.exe120⤵PID:4828
-
\??\c:\fxrfxrx.exec:\fxrfxrx.exe121⤵PID:4936
-
\??\c:\rrffxfx.exec:\rrffxfx.exe122⤵PID:2724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-