Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 02:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2bb221a79096b4add5b4fc61e68acd2457fdc24611153f905bfab25ce4e20ddb.exe
Resource
win7-20240704-en
5 signatures
150 seconds
General
-
Target
2bb221a79096b4add5b4fc61e68acd2457fdc24611153f905bfab25ce4e20ddb.exe
-
Size
71KB
-
MD5
2cd5da05314eacdcf8ef3dc677252e20
-
SHA1
b3be6cb3803df16d950c33ce0332e008024ac037
-
SHA256
2bb221a79096b4add5b4fc61e68acd2457fdc24611153f905bfab25ce4e20ddb
-
SHA512
a8a68724c1d0182b9b51e583cab65c4ac82e2b706700612b3896bf96e9c2f922a93936b201a28ae178808f843b87990562a04668dc92fdd0dcc504c03a855874
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUwcsbYsRgVq:ymb3NkkiQ3mdBjF0yjcsMsRb
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4788-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2868-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/604-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/884-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5028 1fffflf.exe 3912 nnbntt.exe 3516 vvvvd.exe 1648 fxrrlll.exe 3100 lflffff.exe 4780 hhbbtb.exe 884 ttnnhn.exe 4344 dvvpj.exe 604 dvppp.exe 4424 frfrrrr.exe 4760 nhnthh.exe 1176 tnhbnn.exe 4616 jjppj.exe 3788 vjddd.exe 4420 rrxxlrr.exe 1536 xffffff.exe 1704 nnnnbb.exe 1372 hbbtnh.exe 3040 dvdvv.exe 2860 vdppj.exe 3088 lxffxxl.exe 1816 hhhtnh.exe 2716 tnbhhh.exe 2868 jvdvp.exe 4868 9jjjd.exe 4576 lfxrrrr.exe 1060 lffxxxr.exe 2336 tnhbhh.exe 4676 tbhnbb.exe 2104 dvppj.exe 2520 3ppvp.exe 4748 rrfxrrf.exe 1568 7llllfx.exe 4484 tbntnt.exe 1172 bbnhnn.exe 4564 pvjjp.exe 2308 jdpjj.exe 392 rllfflr.exe 4164 9rrrrxx.exe 4084 nbhhbb.exe 3584 9thhtb.exe 2164 pjvpd.exe 436 jdpvv.exe 4020 rrrlffr.exe 4600 5ffxfff.exe 4988 bbbbbb.exe 3856 btttnh.exe 4744 jvjdv.exe 4728 pjjdd.exe 2888 jvdvp.exe 4320 llffxxf.exe 412 llrxffr.exe 5052 3htnht.exe 4456 tbhhtt.exe 3336 jvvvp.exe 1596 dvvpv.exe 5064 1dvvj.exe 4068 flxxrrl.exe 5048 fllrrrr.exe 1448 tnbtbb.exe 4660 bnttbh.exe 3968 jvjpd.exe 4396 9jjdv.exe 3328 3rrrlrl.exe -
resource yara_rule behavioral2/memory/4788-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2868-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/604-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-32-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4788 wrote to memory of 5028 4788 2bb221a79096b4add5b4fc61e68acd2457fdc24611153f905bfab25ce4e20ddb.exe 80 PID 4788 wrote to memory of 5028 4788 2bb221a79096b4add5b4fc61e68acd2457fdc24611153f905bfab25ce4e20ddb.exe 80 PID 4788 wrote to memory of 5028 4788 2bb221a79096b4add5b4fc61e68acd2457fdc24611153f905bfab25ce4e20ddb.exe 80 PID 5028 wrote to memory of 3912 5028 1fffflf.exe 81 PID 5028 wrote to memory of 3912 5028 1fffflf.exe 81 PID 5028 wrote to memory of 3912 5028 1fffflf.exe 81 PID 3912 wrote to memory of 3516 3912 nnbntt.exe 82 PID 3912 wrote to memory of 3516 3912 nnbntt.exe 82 PID 3912 wrote to memory of 3516 3912 nnbntt.exe 82 PID 3516 wrote to memory of 1648 3516 vvvvd.exe 83 PID 3516 wrote to memory of 1648 3516 vvvvd.exe 83 PID 3516 wrote to memory of 1648 3516 vvvvd.exe 83 PID 1648 wrote to memory of 3100 1648 fxrrlll.exe 84 PID 1648 wrote to memory of 3100 1648 fxrrlll.exe 84 PID 1648 wrote to memory of 3100 1648 fxrrlll.exe 84 PID 3100 wrote to memory of 4780 3100 lflffff.exe 85 PID 3100 wrote to memory of 4780 3100 lflffff.exe 85 PID 3100 wrote to memory of 4780 3100 lflffff.exe 85 PID 4780 wrote to memory of 884 4780 hhbbtb.exe 86 PID 4780 wrote to memory of 884 4780 hhbbtb.exe 86 PID 4780 wrote to memory of 884 4780 hhbbtb.exe 86 PID 884 wrote to memory of 4344 884 ttnnhn.exe 87 PID 884 wrote to memory of 4344 884 ttnnhn.exe 87 PID 884 wrote to memory of 4344 884 ttnnhn.exe 87 PID 4344 wrote to memory of 604 4344 dvvpj.exe 88 PID 4344 wrote to memory of 604 4344 dvvpj.exe 88 PID 4344 wrote to memory of 604 4344 dvvpj.exe 88 PID 604 wrote to memory of 4424 604 dvppp.exe 89 PID 604 wrote to memory of 4424 604 dvppp.exe 89 PID 604 wrote to memory of 4424 604 dvppp.exe 89 PID 4424 wrote to memory of 4760 4424 frfrrrr.exe 90 PID 4424 wrote to memory of 4760 4424 frfrrrr.exe 90 PID 4424 wrote to memory of 4760 4424 frfrrrr.exe 90 PID 4760 wrote to memory of 1176 4760 nhnthh.exe 91 PID 4760 wrote to memory of 1176 4760 nhnthh.exe 91 PID 4760 wrote to memory of 1176 4760 nhnthh.exe 91 PID 1176 wrote to memory of 4616 1176 tnhbnn.exe 92 PID 1176 wrote to memory of 4616 1176 tnhbnn.exe 92 PID 1176 wrote to memory of 4616 1176 tnhbnn.exe 92 PID 4616 wrote to memory of 3788 4616 jjppj.exe 93 PID 4616 wrote to memory of 3788 4616 jjppj.exe 93 PID 4616 wrote to memory of 3788 4616 jjppj.exe 93 PID 3788 wrote to memory of 4420 3788 vjddd.exe 94 PID 3788 wrote to memory of 4420 3788 vjddd.exe 94 PID 3788 wrote to memory of 4420 3788 vjddd.exe 94 PID 4420 wrote to memory of 1536 4420 rrxxlrr.exe 95 PID 4420 wrote to memory of 1536 4420 rrxxlrr.exe 95 PID 4420 wrote to memory of 1536 4420 rrxxlrr.exe 95 PID 1536 wrote to memory of 1704 1536 xffffff.exe 96 PID 1536 wrote to memory of 1704 1536 xffffff.exe 96 PID 1536 wrote to memory of 1704 1536 xffffff.exe 96 PID 1704 wrote to memory of 1372 1704 nnnnbb.exe 97 PID 1704 wrote to memory of 1372 1704 nnnnbb.exe 97 PID 1704 wrote to memory of 1372 1704 nnnnbb.exe 97 PID 1372 wrote to memory of 3040 1372 hbbtnh.exe 98 PID 1372 wrote to memory of 3040 1372 hbbtnh.exe 98 PID 1372 wrote to memory of 3040 1372 hbbtnh.exe 98 PID 3040 wrote to memory of 2860 3040 dvdvv.exe 99 PID 3040 wrote to memory of 2860 3040 dvdvv.exe 99 PID 3040 wrote to memory of 2860 3040 dvdvv.exe 99 PID 2860 wrote to memory of 3088 2860 vdppj.exe 100 PID 2860 wrote to memory of 3088 2860 vdppj.exe 100 PID 2860 wrote to memory of 3088 2860 vdppj.exe 100 PID 3088 wrote to memory of 1816 3088 lxffxxl.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bb221a79096b4add5b4fc61e68acd2457fdc24611153f905bfab25ce4e20ddb.exe"C:\Users\Admin\AppData\Local\Temp\2bb221a79096b4add5b4fc61e68acd2457fdc24611153f905bfab25ce4e20ddb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\1fffflf.exec:\1fffflf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\nnbntt.exec:\nnbntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\vvvvd.exec:\vvvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\fxrrlll.exec:\fxrrlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\lflffff.exec:\lflffff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\hhbbtb.exec:\hhbbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\ttnnhn.exec:\ttnnhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\dvvpj.exec:\dvvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\dvppp.exec:\dvppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\frfrrrr.exec:\frfrrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\nhnthh.exec:\nhnthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\tnhbnn.exec:\tnhbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\jjppj.exec:\jjppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\vjddd.exec:\vjddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\rrxxlrr.exec:\rrxxlrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\xffffff.exec:\xffffff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\nnnnbb.exec:\nnnnbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\hbbtnh.exec:\hbbtnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\dvdvv.exec:\dvdvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\vdppj.exec:\vdppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\lxffxxl.exec:\lxffxxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\hhhtnh.exec:\hhhtnh.exe23⤵
- Executes dropped EXE
PID:1816 -
\??\c:\tnbhhh.exec:\tnbhhh.exe24⤵
- Executes dropped EXE
PID:2716 -
\??\c:\jvdvp.exec:\jvdvp.exe25⤵
- Executes dropped EXE
PID:2868 -
\??\c:\9jjjd.exec:\9jjjd.exe26⤵
- Executes dropped EXE
PID:4868 -
\??\c:\lfxrrrr.exec:\lfxrrrr.exe27⤵
- Executes dropped EXE
PID:4576 -
\??\c:\lffxxxr.exec:\lffxxxr.exe28⤵
- Executes dropped EXE
PID:1060 -
\??\c:\tnhbhh.exec:\tnhbhh.exe29⤵
- Executes dropped EXE
PID:2336 -
\??\c:\tbhnbb.exec:\tbhnbb.exe30⤵
- Executes dropped EXE
PID:4676 -
\??\c:\dvppj.exec:\dvppj.exe31⤵
- Executes dropped EXE
PID:2104 -
\??\c:\3ppvp.exec:\3ppvp.exe32⤵
- Executes dropped EXE
PID:2520 -
\??\c:\rrfxrrf.exec:\rrfxrrf.exe33⤵
- Executes dropped EXE
PID:4748 -
\??\c:\7llllfx.exec:\7llllfx.exe34⤵
- Executes dropped EXE
PID:1568 -
\??\c:\tbntnt.exec:\tbntnt.exe35⤵
- Executes dropped EXE
PID:4484 -
\??\c:\bbnhnn.exec:\bbnhnn.exe36⤵
- Executes dropped EXE
PID:1172 -
\??\c:\pvjjp.exec:\pvjjp.exe37⤵
- Executes dropped EXE
PID:4564 -
\??\c:\jdpjj.exec:\jdpjj.exe38⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rllfflr.exec:\rllfflr.exe39⤵
- Executes dropped EXE
PID:392 -
\??\c:\9rrrrxx.exec:\9rrrrxx.exe40⤵
- Executes dropped EXE
PID:4164 -
\??\c:\nbhhbb.exec:\nbhhbb.exe41⤵
- Executes dropped EXE
PID:4084 -
\??\c:\9thhtb.exec:\9thhtb.exe42⤵
- Executes dropped EXE
PID:3584 -
\??\c:\pjvpd.exec:\pjvpd.exe43⤵
- Executes dropped EXE
PID:2164 -
\??\c:\jdpvv.exec:\jdpvv.exe44⤵
- Executes dropped EXE
PID:436 -
\??\c:\rrrlffr.exec:\rrrlffr.exe45⤵
- Executes dropped EXE
PID:4020 -
\??\c:\5ffxfff.exec:\5ffxfff.exe46⤵
- Executes dropped EXE
PID:4600 -
\??\c:\bbbbbb.exec:\bbbbbb.exe47⤵
- Executes dropped EXE
PID:4988 -
\??\c:\btttnh.exec:\btttnh.exe48⤵
- Executes dropped EXE
PID:3856 -
\??\c:\jvjdv.exec:\jvjdv.exe49⤵
- Executes dropped EXE
PID:4744 -
\??\c:\pjjdd.exec:\pjjdd.exe50⤵
- Executes dropped EXE
PID:4728 -
\??\c:\jvdvp.exec:\jvdvp.exe51⤵
- Executes dropped EXE
PID:2888 -
\??\c:\llffxxf.exec:\llffxxf.exe52⤵
- Executes dropped EXE
PID:4320 -
\??\c:\llrxffr.exec:\llrxffr.exe53⤵
- Executes dropped EXE
PID:412 -
\??\c:\3htnht.exec:\3htnht.exe54⤵
- Executes dropped EXE
PID:5052 -
\??\c:\tbhhtt.exec:\tbhhtt.exe55⤵
- Executes dropped EXE
PID:4456 -
\??\c:\jvvvp.exec:\jvvvp.exe56⤵
- Executes dropped EXE
PID:3336 -
\??\c:\dvvpv.exec:\dvvpv.exe57⤵
- Executes dropped EXE
PID:1596 -
\??\c:\1dvvj.exec:\1dvvj.exe58⤵
- Executes dropped EXE
PID:5064 -
\??\c:\flxxrrl.exec:\flxxrrl.exe59⤵
- Executes dropped EXE
PID:4068 -
\??\c:\fllrrrr.exec:\fllrrrr.exe60⤵
- Executes dropped EXE
PID:5048 -
\??\c:\tnbtbb.exec:\tnbtbb.exe61⤵
- Executes dropped EXE
PID:1448 -
\??\c:\bnttbh.exec:\bnttbh.exe62⤵
- Executes dropped EXE
PID:4660 -
\??\c:\jvjpd.exec:\jvjpd.exe63⤵
- Executes dropped EXE
PID:3968 -
\??\c:\9jjdv.exec:\9jjdv.exe64⤵
- Executes dropped EXE
PID:4396 -
\??\c:\3rrrlrl.exec:\3rrrlrl.exe65⤵
- Executes dropped EXE
PID:3328 -
\??\c:\fffffff.exec:\fffffff.exe66⤵PID:1664
-
\??\c:\tbhttn.exec:\tbhttn.exe67⤵PID:2616
-
\??\c:\tntnnt.exec:\tntnnt.exe68⤵PID:3136
-
\??\c:\hhtntt.exec:\hhtntt.exe69⤵PID:3680
-
\??\c:\dvppd.exec:\dvppd.exe70⤵PID:3164
-
\??\c:\7dddj.exec:\7dddj.exe71⤵PID:3452
-
\??\c:\lfllflr.exec:\lfllflr.exe72⤵PID:4508
-
\??\c:\rrrflxl.exec:\rrrflxl.exe73⤵PID:4420
-
\??\c:\3tbbbb.exec:\3tbbbb.exe74⤵PID:5012
-
\??\c:\ntntth.exec:\ntntth.exe75⤵PID:2280
-
\??\c:\pvpvd.exec:\pvpvd.exe76⤵PID:2692
-
\??\c:\pvvvp.exec:\pvvvp.exe77⤵PID:4004
-
\??\c:\xlxrllf.exec:\xlxrllf.exe78⤵PID:1592
-
\??\c:\1rxrfff.exec:\1rxrfff.exe79⤵PID:2860
-
\??\c:\hntthh.exec:\hntthh.exe80⤵PID:2632
-
\??\c:\hntnbt.exec:\hntnbt.exe81⤵PID:1936
-
\??\c:\nnhnhh.exec:\nnhnhh.exe82⤵PID:1816
-
\??\c:\3ddvv.exec:\3ddvv.exe83⤵PID:4944
-
\??\c:\7pppj.exec:\7pppj.exe84⤵PID:1988
-
\??\c:\xlrlffx.exec:\xlrlffx.exe85⤵PID:1136
-
\??\c:\xxxxlll.exec:\xxxxlll.exe86⤵PID:3536
-
\??\c:\nnnnnt.exec:\nnnnnt.exe87⤵PID:1088
-
\??\c:\tnhbnb.exec:\tnhbnb.exe88⤵PID:4376
-
\??\c:\5ddvj.exec:\5ddvj.exe89⤵PID:1892
-
\??\c:\xllflll.exec:\xllflll.exe90⤵PID:3364
-
\??\c:\nbbnnn.exec:\nbbnnn.exe91⤵PID:3712
-
\??\c:\jdpjj.exec:\jdpjj.exe92⤵PID:2680
-
\??\c:\jpvvv.exec:\jpvvv.exe93⤵PID:5092
-
\??\c:\xfrfrrl.exec:\xfrfrrl.exe94⤵PID:3984
-
\??\c:\nnbthh.exec:\nnbthh.exe95⤵PID:2660
-
\??\c:\jjpdv.exec:\jjpdv.exe96⤵PID:1568
-
\??\c:\vjvvj.exec:\vjvvj.exe97⤵PID:3244
-
\??\c:\lrrlflf.exec:\lrrlflf.exe98⤵PID:4612
-
\??\c:\nhhbhn.exec:\nhhbhn.exe99⤵PID:1172
-
\??\c:\jpddd.exec:\jpddd.exe100⤵PID:4564
-
\??\c:\jdvpp.exec:\jdvpp.exe101⤵PID:2308
-
\??\c:\nntbbh.exec:\nntbbh.exe102⤵PID:4196
-
\??\c:\1pvvd.exec:\1pvvd.exe103⤵PID:5008
-
\??\c:\llffxfx.exec:\llffxfx.exe104⤵PID:1376
-
\??\c:\fxffflx.exec:\fxffflx.exe105⤵PID:2884
-
\??\c:\nhnnbh.exec:\nhnnbh.exe106⤵PID:4552
-
\??\c:\xflrxrr.exec:\xflrxrr.exe107⤵PID:1352
-
\??\c:\hbnthh.exec:\hbnthh.exe108⤵PID:2148
-
\??\c:\vpvvv.exec:\vpvvv.exe109⤵PID:3288
-
\??\c:\5rfrlrr.exec:\5rfrlrr.exe110⤵PID:5080
-
\??\c:\nthtnh.exec:\nthtnh.exe111⤵PID:2976
-
\??\c:\lffrfxf.exec:\lffrfxf.exe112⤵PID:4364
-
\??\c:\flffrlx.exec:\flffrlx.exe113⤵PID:924
-
\??\c:\3bnnnb.exec:\3bnnnb.exe114⤵PID:208
-
\??\c:\xrxxfll.exec:\xrxxfll.exe115⤵PID:4324
-
\??\c:\hbhhnn.exec:\hbhhnn.exe116⤵PID:2088
-
\??\c:\ppjdj.exec:\ppjdj.exe117⤵PID:5028
-
\??\c:\5llfrxf.exec:\5llfrxf.exe118⤵PID:1384
-
\??\c:\ttbtbb.exec:\ttbtbb.exe119⤵PID:4636
-
\??\c:\xxrrflx.exec:\xxrrflx.exe120⤵PID:1636
-
\??\c:\tbnnnt.exec:\tbnnnt.exe121⤵PID:2272
-
\??\c:\1pvdd.exec:\1pvdd.exe122⤵PID:2180
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-