Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/06/2024, 02:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c990ca4dfb9cc2e1023466e22822f47685603d79fc17b4e395b1ce89ee981659.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
-
Target
c990ca4dfb9cc2e1023466e22822f47685603d79fc17b4e395b1ce89ee981659.exe
-
Size
446KB
-
MD5
a4fc0640b546cfcddc3d11ab3fbd1111
-
SHA1
1a811d7d1028a55cc2496cd4f422ac5e7ded82e2
-
SHA256
c990ca4dfb9cc2e1023466e22822f47685603d79fc17b4e395b1ce89ee981659
-
SHA512
beaa578c87cdeb986256d77a5242392e5b4a2373b81cec4893d7a565d0362b3cc011778e7efa389ff3ebadf0575c320441fb3cca20249f4c8e0e733fe6578a4b
-
SSDEEP
6144:n3C9BRo7tvnJ9Fywhk/T4i37K3BoKg0p5WI09JsB:n3C9ytvn8whkb4i3e3GFO6JsB
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4396-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1808-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1956-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1324-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/848-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 23 IoCs
resource yara_rule behavioral2/memory/4396-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4120-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2712-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4072-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1808-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2940-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4532-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1956-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1056-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3524-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3948-190-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3268-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4180-166-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3312-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4868-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4484-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4692-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1416-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4560-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2428-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1452-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1324-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/848-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4120 nhhttb.exe 848 vjjjj.exe 2712 pdpvv.exe 4072 9fllfff.exe 1324 tnhhhh.exe 1452 djvpd.exe 2108 fflllfl.exe 2428 ttbttt.exe 2264 vpppp.exe 4560 ffrxlrf.exe 1416 hnttnt.exe 1808 jjjpj.exe 2940 rfxrrll.exe 620 xxfflrl.exe 4692 nhhhhh.exe 4532 vvjjj.exe 4484 djpjj.exe 4868 thtbhh.exe 3312 jjddj.exe 1956 flrlffx.exe 3100 thttnt.exe 1056 jddvp.exe 4812 djdjv.exe 3564 9dvvp.exe 4180 frrflrf.exe 3268 bhhhnn.exe 5068 nbnttb.exe 3524 fxlllrx.exe 3948 ttbbbb.exe 448 nbtttb.exe 4816 pjvvd.exe 4392 3thnnn.exe 3956 bthhnt.exe 1028 dvjjp.exe 3276 xxrlrll.exe 1864 ntbbhb.exe 1716 jjpjd.exe 2832 xlxffll.exe 1392 hbbttt.exe 1368 7tbthn.exe 4352 1jddd.exe 4340 rffxrlf.exe 4712 5rlrrfx.exe 1068 bhthtn.exe 2132 tbttbh.exe 3172 ddpjp.exe 2360 rrrrrxx.exe 3924 tthhbh.exe 4072 hhbhhn.exe 408 jdjjp.exe 8 rrlffrf.exe 1644 nhhhhn.exe 1632 hhnnbb.exe 2108 dpvvp.exe 4472 rxfxxfl.exe 216 9ththn.exe 4704 pjpjj.exe 2148 lxffflf.exe 1032 frxxrxl.exe 1940 tbhnnn.exe 4640 dvjjj.exe 3968 jjdjp.exe 1212 fllxxfx.exe 1264 hhnbbn.exe -
resource yara_rule behavioral2/memory/4396-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1808-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1956-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/848-18-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4396 wrote to memory of 4120 4396 c990ca4dfb9cc2e1023466e22822f47685603d79fc17b4e395b1ce89ee981659.exe 82 PID 4396 wrote to memory of 4120 4396 c990ca4dfb9cc2e1023466e22822f47685603d79fc17b4e395b1ce89ee981659.exe 82 PID 4396 wrote to memory of 4120 4396 c990ca4dfb9cc2e1023466e22822f47685603d79fc17b4e395b1ce89ee981659.exe 82 PID 4120 wrote to memory of 848 4120 nhhttb.exe 83 PID 4120 wrote to memory of 848 4120 nhhttb.exe 83 PID 4120 wrote to memory of 848 4120 nhhttb.exe 83 PID 848 wrote to memory of 2712 848 vjjjj.exe 84 PID 848 wrote to memory of 2712 848 vjjjj.exe 84 PID 848 wrote to memory of 2712 848 vjjjj.exe 84 PID 2712 wrote to memory of 4072 2712 pdpvv.exe 133 PID 2712 wrote to memory of 4072 2712 pdpvv.exe 133 PID 2712 wrote to memory of 4072 2712 pdpvv.exe 133 PID 4072 wrote to memory of 1324 4072 9fllfff.exe 87 PID 4072 wrote to memory of 1324 4072 9fllfff.exe 87 PID 4072 wrote to memory of 1324 4072 9fllfff.exe 87 PID 1324 wrote to memory of 1452 1324 tnhhhh.exe 88 PID 1324 wrote to memory of 1452 1324 tnhhhh.exe 88 PID 1324 wrote to memory of 1452 1324 tnhhhh.exe 88 PID 1452 wrote to memory of 2108 1452 djvpd.exe 138 PID 1452 wrote to memory of 2108 1452 djvpd.exe 138 PID 1452 wrote to memory of 2108 1452 djvpd.exe 138 PID 2108 wrote to memory of 2428 2108 fflllfl.exe 91 PID 2108 wrote to memory of 2428 2108 fflllfl.exe 91 PID 2108 wrote to memory of 2428 2108 fflllfl.exe 91 PID 2428 wrote to memory of 2264 2428 ttbttt.exe 92 PID 2428 wrote to memory of 2264 2428 ttbttt.exe 92 PID 2428 wrote to memory of 2264 2428 ttbttt.exe 92 PID 2264 wrote to memory of 4560 2264 vpppp.exe 94 PID 2264 wrote to memory of 4560 2264 vpppp.exe 94 PID 2264 wrote to memory of 4560 2264 vpppp.exe 94 PID 4560 wrote to memory of 1416 4560 ffrxlrf.exe 95 PID 4560 wrote to memory of 1416 4560 ffrxlrf.exe 95 PID 4560 wrote to memory of 1416 4560 ffrxlrf.exe 95 PID 1416 wrote to memory of 1808 1416 hnttnt.exe 96 PID 1416 wrote to memory of 1808 1416 hnttnt.exe 96 PID 1416 wrote to memory of 1808 1416 hnttnt.exe 96 PID 1808 wrote to memory of 2940 1808 jjjpj.exe 97 PID 1808 wrote to memory of 2940 1808 jjjpj.exe 97 PID 1808 wrote to memory of 2940 1808 jjjpj.exe 97 PID 2940 wrote to memory of 620 2940 rfxrrll.exe 98 PID 2940 wrote to memory of 620 2940 rfxrrll.exe 98 PID 2940 wrote to memory of 620 2940 rfxrrll.exe 98 PID 620 wrote to memory of 4692 620 xxfflrl.exe 99 PID 620 wrote to memory of 4692 620 xxfflrl.exe 99 PID 620 wrote to memory of 4692 620 xxfflrl.exe 99 PID 4692 wrote to memory of 4532 4692 nhhhhh.exe 100 PID 4692 wrote to memory of 4532 4692 nhhhhh.exe 100 PID 4692 wrote to memory of 4532 4692 nhhhhh.exe 100 PID 4532 wrote to memory of 4484 4532 vvjjj.exe 101 PID 4532 wrote to memory of 4484 4532 vvjjj.exe 101 PID 4532 wrote to memory of 4484 4532 vvjjj.exe 101 PID 4484 wrote to memory of 4868 4484 djpjj.exe 102 PID 4484 wrote to memory of 4868 4484 djpjj.exe 102 PID 4484 wrote to memory of 4868 4484 djpjj.exe 102 PID 4868 wrote to memory of 3312 4868 thtbhh.exe 103 PID 4868 wrote to memory of 3312 4868 thtbhh.exe 103 PID 4868 wrote to memory of 3312 4868 thtbhh.exe 103 PID 3312 wrote to memory of 1956 3312 jjddj.exe 104 PID 3312 wrote to memory of 1956 3312 jjddj.exe 104 PID 3312 wrote to memory of 1956 3312 jjddj.exe 104 PID 1956 wrote to memory of 3100 1956 flrlffx.exe 105 PID 1956 wrote to memory of 3100 1956 flrlffx.exe 105 PID 1956 wrote to memory of 3100 1956 flrlffx.exe 105 PID 3100 wrote to memory of 1056 3100 thttnt.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\c990ca4dfb9cc2e1023466e22822f47685603d79fc17b4e395b1ce89ee981659.exe"C:\Users\Admin\AppData\Local\Temp\c990ca4dfb9cc2e1023466e22822f47685603d79fc17b4e395b1ce89ee981659.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\nhhttb.exec:\nhhttb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\vjjjj.exec:\vjjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\pdpvv.exec:\pdpvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\9fllfff.exec:\9fllfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\tnhhhh.exec:\tnhhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\djvpd.exec:\djvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\fflllfl.exec:\fflllfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\ttbttt.exec:\ttbttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\vpppp.exec:\vpppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\ffrxlrf.exec:\ffrxlrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\hnttnt.exec:\hnttnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\jjjpj.exec:\jjjpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\rfxrrll.exec:\rfxrrll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\xxfflrl.exec:\xxfflrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\nhhhhh.exec:\nhhhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\vvjjj.exec:\vvjjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\djpjj.exec:\djpjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\thtbhh.exec:\thtbhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\jjddj.exec:\jjddj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\flrlffx.exec:\flrlffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\thttnt.exec:\thttnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\jddvp.exec:\jddvp.exe23⤵
- Executes dropped EXE
PID:1056 -
\??\c:\djdjv.exec:\djdjv.exe24⤵
- Executes dropped EXE
PID:4812 -
\??\c:\9dvvp.exec:\9dvvp.exe25⤵
- Executes dropped EXE
PID:3564 -
\??\c:\frrflrf.exec:\frrflrf.exe26⤵
- Executes dropped EXE
PID:4180 -
\??\c:\bhhhnn.exec:\bhhhnn.exe27⤵
- Executes dropped EXE
PID:3268 -
\??\c:\nbnttb.exec:\nbnttb.exe28⤵
- Executes dropped EXE
PID:5068 -
\??\c:\fxlllrx.exec:\fxlllrx.exe29⤵
- Executes dropped EXE
PID:3524 -
\??\c:\ttbbbb.exec:\ttbbbb.exe30⤵
- Executes dropped EXE
PID:3948 -
\??\c:\nbtttb.exec:\nbtttb.exe31⤵
- Executes dropped EXE
PID:448 -
\??\c:\pjvvd.exec:\pjvvd.exe32⤵
- Executes dropped EXE
PID:4816 -
\??\c:\3thnnn.exec:\3thnnn.exe33⤵
- Executes dropped EXE
PID:4392 -
\??\c:\bthhnt.exec:\bthhnt.exe34⤵
- Executes dropped EXE
PID:3956 -
\??\c:\dvjjp.exec:\dvjjp.exe35⤵
- Executes dropped EXE
PID:1028 -
\??\c:\xxrlrll.exec:\xxrlrll.exe36⤵
- Executes dropped EXE
PID:3276 -
\??\c:\ntbbhb.exec:\ntbbhb.exe37⤵
- Executes dropped EXE
PID:1864 -
\??\c:\jjpjd.exec:\jjpjd.exe38⤵
- Executes dropped EXE
PID:1716 -
\??\c:\xlxffll.exec:\xlxffll.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\hbbttt.exec:\hbbttt.exe40⤵
- Executes dropped EXE
PID:1392 -
\??\c:\7tbthn.exec:\7tbthn.exe41⤵
- Executes dropped EXE
PID:1368 -
\??\c:\1jddd.exec:\1jddd.exe42⤵
- Executes dropped EXE
PID:4352 -
\??\c:\rffxrlf.exec:\rffxrlf.exe43⤵
- Executes dropped EXE
PID:4340 -
\??\c:\5rlrrfx.exec:\5rlrrfx.exe44⤵
- Executes dropped EXE
PID:4712 -
\??\c:\bhthtn.exec:\bhthtn.exe45⤵
- Executes dropped EXE
PID:1068 -
\??\c:\tbttbh.exec:\tbttbh.exe46⤵
- Executes dropped EXE
PID:2132 -
\??\c:\ddpjp.exec:\ddpjp.exe47⤵
- Executes dropped EXE
PID:3172 -
\??\c:\rrrrrxx.exec:\rrrrrxx.exe48⤵
- Executes dropped EXE
PID:2360 -
\??\c:\tthhbh.exec:\tthhbh.exe49⤵
- Executes dropped EXE
PID:3924 -
\??\c:\hhbhhn.exec:\hhbhhn.exe50⤵
- Executes dropped EXE
PID:4072 -
\??\c:\jdjjp.exec:\jdjjp.exe51⤵
- Executes dropped EXE
PID:408 -
\??\c:\rrlffrf.exec:\rrlffrf.exe52⤵
- Executes dropped EXE
PID:8 -
\??\c:\nhhhhn.exec:\nhhhhn.exe53⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hhnnbb.exec:\hhnnbb.exe54⤵
- Executes dropped EXE
PID:1632 -
\??\c:\dpvvp.exec:\dpvvp.exe55⤵
- Executes dropped EXE
PID:2108 -
\??\c:\rxfxxfl.exec:\rxfxxfl.exe56⤵
- Executes dropped EXE
PID:4472 -
\??\c:\9ththn.exec:\9ththn.exe57⤵
- Executes dropped EXE
PID:216 -
\??\c:\pjpjj.exec:\pjpjj.exe58⤵
- Executes dropped EXE
PID:4704 -
\??\c:\lxffflf.exec:\lxffflf.exe59⤵
- Executes dropped EXE
PID:2148 -
\??\c:\frxxrxl.exec:\frxxrxl.exe60⤵
- Executes dropped EXE
PID:1032 -
\??\c:\tbhnnn.exec:\tbhnnn.exe61⤵
- Executes dropped EXE
PID:1940 -
\??\c:\dvjjj.exec:\dvjjj.exe62⤵
- Executes dropped EXE
PID:4640 -
\??\c:\jjdjp.exec:\jjdjp.exe63⤵
- Executes dropped EXE
PID:3968 -
\??\c:\fllxxfx.exec:\fllxxfx.exe64⤵
- Executes dropped EXE
PID:1212 -
\??\c:\hhnbbn.exec:\hhnbbn.exe65⤵
- Executes dropped EXE
PID:1264 -
\??\c:\hbhbtb.exec:\hbhbtb.exe66⤵PID:2800
-
\??\c:\ddddj.exec:\ddddj.exe67⤵PID:1584
-
\??\c:\1frrrxx.exec:\1frrrxx.exe68⤵PID:3712
-
\??\c:\nhnnnt.exec:\nhnnnt.exe69⤵PID:952
-
\??\c:\hhtnhn.exec:\hhtnhn.exe70⤵PID:3012
-
\??\c:\jjvvj.exec:\jjvvj.exe71⤵PID:4784
-
\??\c:\rrfxxxf.exec:\rrfxxxf.exe72⤵PID:3116
-
\??\c:\xlxrrrf.exec:\xlxrrrf.exe73⤵PID:4588
-
\??\c:\tbtbnt.exec:\tbtbnt.exe74⤵PID:1860
-
\??\c:\dvdvv.exec:\dvdvv.exe75⤵PID:1488
-
\??\c:\jvjjd.exec:\jvjjd.exe76⤵PID:4760
-
\??\c:\flfflrx.exec:\flfflrx.exe77⤵PID:1580
-
\??\c:\htttth.exec:\htttth.exe78⤵PID:4044
-
\??\c:\djdjp.exec:\djdjp.exe79⤵PID:3428
-
\??\c:\vvvvd.exec:\vvvvd.exe80⤵PID:1528
-
\??\c:\frrrffr.exec:\frrrffr.exe81⤵PID:964
-
\??\c:\nnnhnn.exec:\nnnhnn.exe82⤵PID:844
-
\??\c:\vjjvd.exec:\vjjvd.exe83⤵PID:4964
-
\??\c:\rfffllr.exec:\rfffllr.exe84⤵PID:2484
-
\??\c:\tntnnt.exec:\tntnnt.exe85⤵PID:4860
-
\??\c:\pvvdd.exec:\pvvdd.exe86⤵PID:628
-
\??\c:\fxflflr.exec:\fxflflr.exe87⤵PID:1648
-
\??\c:\nnbnnb.exec:\nnbnnb.exe88⤵PID:1512
-
\??\c:\vvdvd.exec:\vvdvd.exe89⤵PID:2284
-
\??\c:\lfllrfx.exec:\lfllrfx.exe90⤵PID:3612
-
\??\c:\rxffxfr.exec:\rxffxfr.exe91⤵PID:1244
-
\??\c:\llrrrrx.exec:\llrrrrx.exe92⤵PID:636
-
\??\c:\xrrrlrx.exec:\xrrrlrx.exe93⤵PID:2320
-
\??\c:\7pdvp.exec:\7pdvp.exe94⤵PID:4660
-
\??\c:\xrfffff.exec:\xrfffff.exe95⤵PID:4892
-
\??\c:\nnbhtt.exec:\nnbhtt.exe96⤵PID:2496
-
\??\c:\dvvdd.exec:\dvvdd.exe97⤵PID:4316
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe98⤵PID:724
-
\??\c:\bnnhhb.exec:\bnnhhb.exe99⤵PID:2456
-
\??\c:\ddvvv.exec:\ddvvv.exe100⤵PID:4120
-
\??\c:\flxrrlf.exec:\flxrrlf.exe101⤵PID:1728
-
\??\c:\nnbntt.exec:\nnbntt.exe102⤵PID:4916
-
\??\c:\dppvp.exec:\dppvp.exe103⤵PID:4168
-
\??\c:\fflffff.exec:\fflffff.exe104⤵PID:2908
-
\??\c:\thhnhh.exec:\thhnhh.exe105⤵PID:2860
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe106⤵PID:3940
-
\??\c:\httbnn.exec:\httbnn.exe107⤵PID:408
-
\??\c:\pdvvd.exec:\pdvvd.exe108⤵PID:3016
-
\??\c:\fxfffll.exec:\fxfffll.exe109⤵PID:1624
-
\??\c:\bbhhhh.exec:\bbhhhh.exe110⤵PID:2428
-
\??\c:\rfrrrrl.exec:\rfrrrrl.exe111⤵PID:4540
-
\??\c:\jdjdv.exec:\jdjdv.exe112⤵PID:1192
-
\??\c:\bnhtnh.exec:\bnhtnh.exe113⤵PID:4836
-
\??\c:\xrrrrrl.exec:\xrrrrrl.exe114⤵PID:4048
-
\??\c:\llfxffr.exec:\llfxffr.exe115⤵PID:4140
-
\??\c:\9ntbbh.exec:\9ntbbh.exe116⤵PID:4948
-
\??\c:\rlxrflf.exec:\rlxrflf.exe117⤵PID:3292
-
\??\c:\pdjjj.exec:\pdjjj.exe118⤵PID:4252
-
\??\c:\ddvpd.exec:\ddvpd.exe119⤵PID:3968
-
\??\c:\pvpjv.exec:\pvpjv.exe120⤵PID:4088
-
\??\c:\tnbntt.exec:\tnbntt.exe121⤵PID:5060
-
\??\c:\hhbtbb.exec:\hhbtbb.exe122⤵PID:1080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-