Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 01:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f13963b7296a6f96dc5d95b2d5889319dabba0cbef9af1d830a2bbb1a7c9006.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
7f13963b7296a6f96dc5d95b2d5889319dabba0cbef9af1d830a2bbb1a7c9006.exe
-
Size
55KB
-
MD5
d7cfaa175b9665062d9390403948c3d0
-
SHA1
dd705e7c50150361fec2a5f7a5d2164d8dc834c5
-
SHA256
7f13963b7296a6f96dc5d95b2d5889319dabba0cbef9af1d830a2bbb1a7c9006
-
SHA512
13a9956d024f1489d7895bca76e94706724cea866536bc5ce3dbafa65ab85486c3e5afb5b1f795a3c71393ae995116506c8e2304f8d82fa11e865e2df29ab07b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfEB:ymb3NkkiQ3mdBjFIM
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/2312-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-27-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1052-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/836-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2792 9fxrlfr.exe 4448 nnhhbb.exe 1052 dpppd.exe 1556 3xrlxxx.exe 2356 frlfxxr.exe 4820 nbhbhb.exe 2384 tnnhhh.exe 3856 dpjjv.exe 4348 xrrfxrx.exe 2844 fxffxrx.exe 3956 bbbtnn.exe 3036 3pvpp.exe 2724 djdvj.exe 1652 rllllrl.exe 2068 7ntnhb.exe 388 jjvpd.exe 4204 fllfxxr.exe 4000 fxrfxrl.exe 3308 bnbnhh.exe 1512 ddjdj.exe 836 vdddp.exe 4680 lxfxlll.exe 3028 httnhb.exe 4344 bnthbt.exe 1468 dvpjd.exe 3900 9jdvj.exe 776 xlrflfl.exe 1180 rfrrxxx.exe 4464 7thbtt.exe 2936 pjvjj.exe 3184 rfrrrrf.exe 4448 tntthn.exe 2580 nnhbbt.exe 3240 1ppjd.exe 3000 pjdvp.exe 636 xfrfxlx.exe 1600 rlrrrrl.exe 1380 htnhhb.exe 4140 bnhbnh.exe 2116 dvpjp.exe 2272 jvvpp.exe 3940 lfllflf.exe 4840 7lxrrrl.exe 3332 9ntnbt.exe 212 vvvvd.exe 3880 vjpdj.exe 2068 xflxfxl.exe 3208 rxxlxrl.exe 3868 tnbtnh.exe 4000 thbhth.exe 4308 pppjv.exe 3888 rrfrffr.exe 2400 rlffflf.exe 4680 hhhhhh.exe 4960 tbbtbh.exe 1976 pvvpp.exe 4116 dvpjp.exe 1596 fffxrlx.exe 2160 llrxxxx.exe 1448 nnhnhh.exe 5112 tbhhhh.exe 3920 djjjj.exe 4396 dppjv.exe 2252 5flfrxx.exe -
resource yara_rule behavioral2/memory/2312-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/836-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2792 2312 7f13963b7296a6f96dc5d95b2d5889319dabba0cbef9af1d830a2bbb1a7c9006.exe 90 PID 2312 wrote to memory of 2792 2312 7f13963b7296a6f96dc5d95b2d5889319dabba0cbef9af1d830a2bbb1a7c9006.exe 90 PID 2312 wrote to memory of 2792 2312 7f13963b7296a6f96dc5d95b2d5889319dabba0cbef9af1d830a2bbb1a7c9006.exe 90 PID 2792 wrote to memory of 4448 2792 9fxrlfr.exe 91 PID 2792 wrote to memory of 4448 2792 9fxrlfr.exe 91 PID 2792 wrote to memory of 4448 2792 9fxrlfr.exe 91 PID 4448 wrote to memory of 1052 4448 nnhhbb.exe 92 PID 4448 wrote to memory of 1052 4448 nnhhbb.exe 92 PID 4448 wrote to memory of 1052 4448 nnhhbb.exe 92 PID 1052 wrote to memory of 1556 1052 dpppd.exe 93 PID 1052 wrote to memory of 1556 1052 dpppd.exe 93 PID 1052 wrote to memory of 1556 1052 dpppd.exe 93 PID 1556 wrote to memory of 2356 1556 3xrlxxx.exe 94 PID 1556 wrote to memory of 2356 1556 3xrlxxx.exe 94 PID 1556 wrote to memory of 2356 1556 3xrlxxx.exe 94 PID 2356 wrote to memory of 4820 2356 frlfxxr.exe 95 PID 2356 wrote to memory of 4820 2356 frlfxxr.exe 95 PID 2356 wrote to memory of 4820 2356 frlfxxr.exe 95 PID 4820 wrote to memory of 2384 4820 nbhbhb.exe 96 PID 4820 wrote to memory of 2384 4820 nbhbhb.exe 96 PID 4820 wrote to memory of 2384 4820 nbhbhb.exe 96 PID 2384 wrote to memory of 3856 2384 tnnhhh.exe 97 PID 2384 wrote to memory of 3856 2384 tnnhhh.exe 97 PID 2384 wrote to memory of 3856 2384 tnnhhh.exe 97 PID 3856 wrote to memory of 4348 3856 dpjjv.exe 98 PID 3856 wrote to memory of 4348 3856 dpjjv.exe 98 PID 3856 wrote to memory of 4348 3856 dpjjv.exe 98 PID 4348 wrote to memory of 2844 4348 xrrfxrx.exe 99 PID 4348 wrote to memory of 2844 4348 xrrfxrx.exe 99 PID 4348 wrote to memory of 2844 4348 xrrfxrx.exe 99 PID 2844 wrote to memory of 3956 2844 fxffxrx.exe 100 PID 2844 wrote to memory of 3956 2844 fxffxrx.exe 100 PID 2844 wrote to memory of 3956 2844 fxffxrx.exe 100 PID 3956 wrote to memory of 3036 3956 bbbtnn.exe 101 PID 3956 wrote to memory of 3036 3956 bbbtnn.exe 101 PID 3956 wrote to memory of 3036 3956 bbbtnn.exe 101 PID 3036 wrote to memory of 2724 3036 3pvpp.exe 102 PID 3036 wrote to memory of 2724 3036 3pvpp.exe 102 PID 3036 wrote to memory of 2724 3036 3pvpp.exe 102 PID 2724 wrote to memory of 1652 2724 djdvj.exe 103 PID 2724 wrote to memory of 1652 2724 djdvj.exe 103 PID 2724 wrote to memory of 1652 2724 djdvj.exe 103 PID 1652 wrote to memory of 2068 1652 rllllrl.exe 104 PID 1652 wrote to memory of 2068 1652 rllllrl.exe 104 PID 1652 wrote to memory of 2068 1652 rllllrl.exe 104 PID 2068 wrote to memory of 388 2068 7ntnhb.exe 105 PID 2068 wrote to memory of 388 2068 7ntnhb.exe 105 PID 2068 wrote to memory of 388 2068 7ntnhb.exe 105 PID 388 wrote to memory of 4204 388 jjvpd.exe 106 PID 388 wrote to memory of 4204 388 jjvpd.exe 106 PID 388 wrote to memory of 4204 388 jjvpd.exe 106 PID 4204 wrote to memory of 4000 4204 fllfxxr.exe 107 PID 4204 wrote to memory of 4000 4204 fllfxxr.exe 107 PID 4204 wrote to memory of 4000 4204 fllfxxr.exe 107 PID 4000 wrote to memory of 3308 4000 fxrfxrl.exe 108 PID 4000 wrote to memory of 3308 4000 fxrfxrl.exe 108 PID 4000 wrote to memory of 3308 4000 fxrfxrl.exe 108 PID 3308 wrote to memory of 1512 3308 bnbnhh.exe 109 PID 3308 wrote to memory of 1512 3308 bnbnhh.exe 109 PID 3308 wrote to memory of 1512 3308 bnbnhh.exe 109 PID 1512 wrote to memory of 836 1512 ddjdj.exe 110 PID 1512 wrote to memory of 836 1512 ddjdj.exe 110 PID 1512 wrote to memory of 836 1512 ddjdj.exe 110 PID 836 wrote to memory of 4680 836 vdddp.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f13963b7296a6f96dc5d95b2d5889319dabba0cbef9af1d830a2bbb1a7c9006.exe"C:\Users\Admin\AppData\Local\Temp\7f13963b7296a6f96dc5d95b2d5889319dabba0cbef9af1d830a2bbb1a7c9006.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\9fxrlfr.exec:\9fxrlfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\nnhhbb.exec:\nnhhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\dpppd.exec:\dpppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\3xrlxxx.exec:\3xrlxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\frlfxxr.exec:\frlfxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\nbhbhb.exec:\nbhbhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\tnnhhh.exec:\tnnhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\dpjjv.exec:\dpjjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\xrrfxrx.exec:\xrrfxrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\fxffxrx.exec:\fxffxrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\bbbtnn.exec:\bbbtnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\3pvpp.exec:\3pvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\djdvj.exec:\djdvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rllllrl.exec:\rllllrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\7ntnhb.exec:\7ntnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\jjvpd.exec:\jjvpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\fllfxxr.exec:\fllfxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\fxrfxrl.exec:\fxrfxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\bnbnhh.exec:\bnbnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\ddjdj.exec:\ddjdj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\vdddp.exec:\vdddp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\lxfxlll.exec:\lxfxlll.exe23⤵
- Executes dropped EXE
PID:4680 -
\??\c:\httnhb.exec:\httnhb.exe24⤵
- Executes dropped EXE
PID:3028 -
\??\c:\bnthbt.exec:\bnthbt.exe25⤵
- Executes dropped EXE
PID:4344 -
\??\c:\dvpjd.exec:\dvpjd.exe26⤵
- Executes dropped EXE
PID:1468 -
\??\c:\9jdvj.exec:\9jdvj.exe27⤵
- Executes dropped EXE
PID:3900 -
\??\c:\xlrflfl.exec:\xlrflfl.exe28⤵
- Executes dropped EXE
PID:776 -
\??\c:\rfrrxxx.exec:\rfrrxxx.exe29⤵
- Executes dropped EXE
PID:1180 -
\??\c:\7thbtt.exec:\7thbtt.exe30⤵
- Executes dropped EXE
PID:4464 -
\??\c:\pjvjj.exec:\pjvjj.exe31⤵
- Executes dropped EXE
PID:2936 -
\??\c:\rfrrrrf.exec:\rfrrrrf.exe32⤵
- Executes dropped EXE
PID:3184 -
\??\c:\tntthn.exec:\tntthn.exe33⤵
- Executes dropped EXE
PID:4448 -
\??\c:\nnhbbt.exec:\nnhbbt.exe34⤵
- Executes dropped EXE
PID:2580 -
\??\c:\1ppjd.exec:\1ppjd.exe35⤵
- Executes dropped EXE
PID:3240 -
\??\c:\pjdvp.exec:\pjdvp.exe36⤵
- Executes dropped EXE
PID:3000 -
\??\c:\xfrfxlx.exec:\xfrfxlx.exe37⤵
- Executes dropped EXE
PID:636 -
\??\c:\rlrrrrl.exec:\rlrrrrl.exe38⤵
- Executes dropped EXE
PID:1600 -
\??\c:\htnhhb.exec:\htnhhb.exe39⤵
- Executes dropped EXE
PID:1380 -
\??\c:\bnhbnh.exec:\bnhbnh.exe40⤵
- Executes dropped EXE
PID:4140 -
\??\c:\dvpjp.exec:\dvpjp.exe41⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jvvpp.exec:\jvvpp.exe42⤵
- Executes dropped EXE
PID:2272 -
\??\c:\lfllflf.exec:\lfllflf.exe43⤵
- Executes dropped EXE
PID:3940 -
\??\c:\7lxrrrl.exec:\7lxrrrl.exe44⤵
- Executes dropped EXE
PID:4840 -
\??\c:\9ntnbt.exec:\9ntnbt.exe45⤵
- Executes dropped EXE
PID:3332 -
\??\c:\vvvvd.exec:\vvvvd.exe46⤵
- Executes dropped EXE
PID:212 -
\??\c:\vjpdj.exec:\vjpdj.exe47⤵
- Executes dropped EXE
PID:3880 -
\??\c:\xflxfxl.exec:\xflxfxl.exe48⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rxxlxrl.exec:\rxxlxrl.exe49⤵
- Executes dropped EXE
PID:3208 -
\??\c:\tnbtnh.exec:\tnbtnh.exe50⤵
- Executes dropped EXE
PID:3868 -
\??\c:\thbhth.exec:\thbhth.exe51⤵
- Executes dropped EXE
PID:4000 -
\??\c:\pppjv.exec:\pppjv.exe52⤵
- Executes dropped EXE
PID:4308 -
\??\c:\rrfrffr.exec:\rrfrffr.exe53⤵
- Executes dropped EXE
PID:3888 -
\??\c:\rlffflf.exec:\rlffflf.exe54⤵
- Executes dropped EXE
PID:2400 -
\??\c:\hhhhhh.exec:\hhhhhh.exe55⤵
- Executes dropped EXE
PID:4680 -
\??\c:\tbbtbh.exec:\tbbtbh.exe56⤵
- Executes dropped EXE
PID:4960 -
\??\c:\pvvpp.exec:\pvvpp.exe57⤵
- Executes dropped EXE
PID:1976 -
\??\c:\dvpjp.exec:\dvpjp.exe58⤵
- Executes dropped EXE
PID:4116 -
\??\c:\fffxrlx.exec:\fffxrlx.exe59⤵
- Executes dropped EXE
PID:1596 -
\??\c:\llrxxxx.exec:\llrxxxx.exe60⤵
- Executes dropped EXE
PID:2160 -
\??\c:\nnhnhh.exec:\nnhnhh.exe61⤵
- Executes dropped EXE
PID:1448 -
\??\c:\tbhhhh.exec:\tbhhhh.exe62⤵
- Executes dropped EXE
PID:5112 -
\??\c:\djjjj.exec:\djjjj.exe63⤵
- Executes dropped EXE
PID:3920 -
\??\c:\dppjv.exec:\dppjv.exe64⤵
- Executes dropped EXE
PID:4396 -
\??\c:\5flfrxx.exec:\5flfrxx.exe65⤵
- Executes dropped EXE
PID:2252 -
\??\c:\fxxrrrx.exec:\fxxrrrx.exe66⤵PID:812
-
\??\c:\thnnhn.exec:\thnnhn.exe67⤵PID:1628
-
\??\c:\tbhhnn.exec:\tbhhnn.exe68⤵PID:4904
-
\??\c:\nbhbtt.exec:\nbhbtt.exe69⤵PID:2580
-
\??\c:\ppppd.exec:\ppppd.exe70⤵PID:4036
-
\??\c:\rfrxlfx.exec:\rfrxlfx.exe71⤵PID:4580
-
\??\c:\rlffrxf.exec:\rlffrxf.exe72⤵PID:452
-
\??\c:\tnhbtt.exec:\tnhbtt.exe73⤵PID:4088
-
\??\c:\thbbtt.exec:\thbbtt.exe74⤵PID:1380
-
\??\c:\dvpjv.exec:\dvpjv.exe75⤵PID:4140
-
\??\c:\3jdvp.exec:\3jdvp.exe76⤵PID:772
-
\??\c:\lxfxllr.exec:\lxfxllr.exe77⤵PID:3948
-
\??\c:\fxrlffx.exec:\fxrlffx.exe78⤵PID:3636
-
\??\c:\nhbbbb.exec:\nhbbbb.exe79⤵PID:4840
-
\??\c:\bnbbbh.exec:\bnbbbh.exe80⤵PID:588
-
\??\c:\pjpjv.exec:\pjpjv.exe81⤵PID:3336
-
\??\c:\ppppj.exec:\ppppj.exe82⤵PID:5092
-
\??\c:\lffxllf.exec:\lffxllf.exe83⤵PID:2068
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe84⤵PID:4712
-
\??\c:\tnnbnt.exec:\tnnbnt.exe85⤵PID:744
-
\??\c:\httnbb.exec:\httnbb.exe86⤵PID:1852
-
\??\c:\btbnht.exec:\btbnht.exe87⤵PID:864
-
\??\c:\pjpjj.exec:\pjpjj.exe88⤵PID:1992
-
\??\c:\9xfxrrx.exec:\9xfxrrx.exe89⤵PID:4312
-
\??\c:\1rrllfr.exec:\1rrllfr.exe90⤵PID:4272
-
\??\c:\ttnnbb.exec:\ttnnbb.exe91⤵PID:4240
-
\??\c:\vvpjj.exec:\vvpjj.exe92⤵PID:324
-
\??\c:\frxrffx.exec:\frxrffx.exe93⤵PID:4912
-
\??\c:\fxxxlll.exec:\fxxxlll.exe94⤵PID:1752
-
\??\c:\tbtnhh.exec:\tbtnhh.exe95⤵PID:3792
-
\??\c:\3pjpj.exec:\3pjpj.exe96⤵PID:456
-
\??\c:\dpvvd.exec:\dpvvd.exe97⤵PID:1448
-
\??\c:\lxlfxlf.exec:\lxlfxlf.exe98⤵PID:1232
-
\??\c:\lfrrfxl.exec:\lfrrfxl.exe99⤵PID:3492
-
\??\c:\nbnnnt.exec:\nbnnnt.exe100⤵PID:4396
-
\??\c:\vpppd.exec:\vpppd.exe101⤵PID:2252
-
\??\c:\3dpdv.exec:\3dpdv.exe102⤵PID:5100
-
\??\c:\frxrlxl.exec:\frxrlxl.exe103⤵PID:4400
-
\??\c:\lxxxxrf.exec:\lxxxxrf.exe104⤵PID:1556
-
\??\c:\thhnhn.exec:\thhnhn.exe105⤵PID:2580
-
\??\c:\hbtnbb.exec:\hbtnbb.exe106⤵PID:3664
-
\??\c:\jdvjj.exec:\jdvjj.exe107⤵PID:2912
-
\??\c:\vddvp.exec:\vddvp.exe108⤵PID:4648
-
\??\c:\1xlfxxl.exec:\1xlfxxl.exe109⤵PID:2532
-
\??\c:\lflffxf.exec:\lflffxf.exe110⤵PID:2116
-
\??\c:\tbhhbn.exec:\tbhhbn.exe111⤵PID:3948
-
\??\c:\htnhtn.exec:\htnhtn.exe112⤵PID:4952
-
\??\c:\jvjjd.exec:\jvjjd.exe113⤵PID:2724
-
\??\c:\pjjdp.exec:\pjjdp.exe114⤵PID:4928
-
\??\c:\rffxlfx.exec:\rffxlfx.exe115⤵PID:3188
-
\??\c:\lxlrrrf.exec:\lxlrrrf.exe116⤵PID:1624
-
\??\c:\httnht.exec:\httnht.exe117⤵PID:4712
-
\??\c:\btttnn.exec:\btttnn.exe118⤵PID:3864
-
\??\c:\pjpjd.exec:\pjpjd.exe119⤵PID:4000
-
\??\c:\dvvjd.exec:\dvvjd.exe120⤵PID:1972
-
\??\c:\rfllrlr.exec:\rfllrlr.exe121⤵PID:4792
-
\??\c:\xlxrrrl.exec:\xlxrrrl.exe122⤵PID:5032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-