Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 20:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3672f3185ad30da7798a6e883acd9c3aee354873d5590b2fa34b9d440e792c5b.exe
Resource
win7-20240705-en
5 signatures
150 seconds
General
-
Target
3672f3185ad30da7798a6e883acd9c3aee354873d5590b2fa34b9d440e792c5b.exe
-
Size
308KB
-
MD5
2608d8efd6e184807ab856a47bc1dba7
-
SHA1
313a38d083127581f6d06f60857a25404fc76584
-
SHA256
3672f3185ad30da7798a6e883acd9c3aee354873d5590b2fa34b9d440e792c5b
-
SHA512
79628149c622641f87f27e94f8137131e7f8cacb53bbb510fecbd6a37d6b37cdff42bae3864763a679f91a8f0f87015221c06cddb80514e6349cf3a77386dff5
-
SSDEEP
6144:n3C9BRo/CH26ZAmaOXicLrnRukAPXt1UP+3OgEbXeTiDSd2vJ:n3C9uUnAvtd3Ogld2vJ
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/4196-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1304-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3624-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1280-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2492-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4968 frfxlll.exe 4716 hhbthb.exe 1664 pvdpv.exe 3016 5bhbtt.exe 1304 3pvpd.exe 3624 nnhnhn.exe 1280 pjdvp.exe 1620 nhtnht.exe 2156 dvjpd.exe 4484 fxrxrlf.exe 2044 nbbnnh.exe 2344 3jdvp.exe 3080 htnhtt.exe 2116 jvpvp.exe 4728 3nhbtn.exe 3608 3ntnnb.exe 2492 1vppd.exe 2696 flxfxrr.exe 4780 jvpdp.exe 2788 7vpjj.exe 2296 rlfxxlx.exe 1860 tnnhbb.exe 3156 lxlfxlr.exe 2864 bntttn.exe 4172 tthhbt.exe 2648 jpvvj.exe 1824 lxfrlff.exe 1528 9nnhhh.exe 4804 jjpjv.exe 5116 rxfxrrr.exe 2444 bbbttt.exe 544 pvpjv.exe 2852 jddpj.exe 624 xrxrrrl.exe 2912 bttnnn.exe 812 bnbtnn.exe 4992 pddvp.exe 4464 9flfxff.exe 4548 lxrllff.exe 4716 nnbtnn.exe 1504 pddvp.exe 1664 jdpjd.exe 1792 xrllfff.exe 2332 xxrlffx.exe 2712 bhhhbb.exe 4556 pjppp.exe 2408 jvvpj.exe 1356 xlfllff.exe 324 nbhhbt.exe 212 vjjjd.exe 2404 jvdvp.exe 4444 xllfrrl.exe 2044 hbhtnn.exe 3852 dpvpd.exe 2960 1lffrrr.exe 3380 hhhbhh.exe 3080 btbhtn.exe 4440 5ddpd.exe 3168 xllxrxr.exe 1648 bntnth.exe 3608 htnbbb.exe 2812 7pjjd.exe 5084 5vdvd.exe 1420 9rrfxxx.exe -
resource yara_rule behavioral2/memory/4196-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1304-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1304-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1304-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3624-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2492-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2788-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4196 wrote to memory of 4968 4196 3672f3185ad30da7798a6e883acd9c3aee354873d5590b2fa34b9d440e792c5b.exe 82 PID 4196 wrote to memory of 4968 4196 3672f3185ad30da7798a6e883acd9c3aee354873d5590b2fa34b9d440e792c5b.exe 82 PID 4196 wrote to memory of 4968 4196 3672f3185ad30da7798a6e883acd9c3aee354873d5590b2fa34b9d440e792c5b.exe 82 PID 4968 wrote to memory of 4716 4968 frfxlll.exe 83 PID 4968 wrote to memory of 4716 4968 frfxlll.exe 83 PID 4968 wrote to memory of 4716 4968 frfxlll.exe 83 PID 4716 wrote to memory of 1664 4716 hhbthb.exe 84 PID 4716 wrote to memory of 1664 4716 hhbthb.exe 84 PID 4716 wrote to memory of 1664 4716 hhbthb.exe 84 PID 1664 wrote to memory of 3016 1664 pvdpv.exe 85 PID 1664 wrote to memory of 3016 1664 pvdpv.exe 85 PID 1664 wrote to memory of 3016 1664 pvdpv.exe 85 PID 3016 wrote to memory of 1304 3016 5bhbtt.exe 86 PID 3016 wrote to memory of 1304 3016 5bhbtt.exe 86 PID 3016 wrote to memory of 1304 3016 5bhbtt.exe 86 PID 1304 wrote to memory of 3624 1304 3pvpd.exe 87 PID 1304 wrote to memory of 3624 1304 3pvpd.exe 87 PID 1304 wrote to memory of 3624 1304 3pvpd.exe 87 PID 3624 wrote to memory of 1280 3624 nnhnhn.exe 89 PID 3624 wrote to memory of 1280 3624 nnhnhn.exe 89 PID 3624 wrote to memory of 1280 3624 nnhnhn.exe 89 PID 1280 wrote to memory of 1620 1280 pjdvp.exe 90 PID 1280 wrote to memory of 1620 1280 pjdvp.exe 90 PID 1280 wrote to memory of 1620 1280 pjdvp.exe 90 PID 1620 wrote to memory of 2156 1620 nhtnht.exe 91 PID 1620 wrote to memory of 2156 1620 nhtnht.exe 91 PID 1620 wrote to memory of 2156 1620 nhtnht.exe 91 PID 2156 wrote to memory of 4484 2156 dvjpd.exe 93 PID 2156 wrote to memory of 4484 2156 dvjpd.exe 93 PID 2156 wrote to memory of 4484 2156 dvjpd.exe 93 PID 4484 wrote to memory of 2044 4484 fxrxrlf.exe 94 PID 4484 wrote to memory of 2044 4484 fxrxrlf.exe 94 PID 4484 wrote to memory of 2044 4484 fxrxrlf.exe 94 PID 2044 wrote to memory of 2344 2044 nbbnnh.exe 95 PID 2044 wrote to memory of 2344 2044 nbbnnh.exe 95 PID 2044 wrote to memory of 2344 2044 nbbnnh.exe 95 PID 2344 wrote to memory of 3080 2344 3jdvp.exe 96 PID 2344 wrote to memory of 3080 2344 3jdvp.exe 96 PID 2344 wrote to memory of 3080 2344 3jdvp.exe 96 PID 3080 wrote to memory of 2116 3080 htnhtt.exe 97 PID 3080 wrote to memory of 2116 3080 htnhtt.exe 97 PID 3080 wrote to memory of 2116 3080 htnhtt.exe 97 PID 2116 wrote to memory of 4728 2116 jvpvp.exe 99 PID 2116 wrote to memory of 4728 2116 jvpvp.exe 99 PID 2116 wrote to memory of 4728 2116 jvpvp.exe 99 PID 4728 wrote to memory of 3608 4728 3nhbtn.exe 100 PID 4728 wrote to memory of 3608 4728 3nhbtn.exe 100 PID 4728 wrote to memory of 3608 4728 3nhbtn.exe 100 PID 3608 wrote to memory of 2492 3608 3ntnnb.exe 101 PID 3608 wrote to memory of 2492 3608 3ntnnb.exe 101 PID 3608 wrote to memory of 2492 3608 3ntnnb.exe 101 PID 2492 wrote to memory of 2696 2492 1vppd.exe 102 PID 2492 wrote to memory of 2696 2492 1vppd.exe 102 PID 2492 wrote to memory of 2696 2492 1vppd.exe 102 PID 2696 wrote to memory of 4780 2696 flxfxrr.exe 103 PID 2696 wrote to memory of 4780 2696 flxfxrr.exe 103 PID 2696 wrote to memory of 4780 2696 flxfxrr.exe 103 PID 4780 wrote to memory of 2788 4780 jvpdp.exe 104 PID 4780 wrote to memory of 2788 4780 jvpdp.exe 104 PID 4780 wrote to memory of 2788 4780 jvpdp.exe 104 PID 2788 wrote to memory of 2296 2788 7vpjj.exe 105 PID 2788 wrote to memory of 2296 2788 7vpjj.exe 105 PID 2788 wrote to memory of 2296 2788 7vpjj.exe 105 PID 2296 wrote to memory of 1860 2296 rlfxxlx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\3672f3185ad30da7798a6e883acd9c3aee354873d5590b2fa34b9d440e792c5b.exe"C:\Users\Admin\AppData\Local\Temp\3672f3185ad30da7798a6e883acd9c3aee354873d5590b2fa34b9d440e792c5b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\frfxlll.exec:\frfxlll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\hhbthb.exec:\hhbthb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\pvdpv.exec:\pvdpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\5bhbtt.exec:\5bhbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\3pvpd.exec:\3pvpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\nnhnhn.exec:\nnhnhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\pjdvp.exec:\pjdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\nhtnht.exec:\nhtnht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\dvjpd.exec:\dvjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\fxrxrlf.exec:\fxrxrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\nbbnnh.exec:\nbbnnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\3jdvp.exec:\3jdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\htnhtt.exec:\htnhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\jvpvp.exec:\jvpvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\3nhbtn.exec:\3nhbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\3ntnnb.exec:\3ntnnb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\1vppd.exec:\1vppd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\flxfxrr.exec:\flxfxrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\jvpdp.exec:\jvpdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\7vpjj.exec:\7vpjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\rlfxxlx.exec:\rlfxxlx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\tnnhbb.exec:\tnnhbb.exe23⤵
- Executes dropped EXE
PID:1860 -
\??\c:\lxlfxlr.exec:\lxlfxlr.exe24⤵
- Executes dropped EXE
PID:3156 -
\??\c:\bntttn.exec:\bntttn.exe25⤵
- Executes dropped EXE
PID:2864 -
\??\c:\tthhbt.exec:\tthhbt.exe26⤵
- Executes dropped EXE
PID:4172 -
\??\c:\jpvvj.exec:\jpvvj.exe27⤵
- Executes dropped EXE
PID:2648 -
\??\c:\lxfrlff.exec:\lxfrlff.exe28⤵
- Executes dropped EXE
PID:1824 -
\??\c:\9nnhhh.exec:\9nnhhh.exe29⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jjpjv.exec:\jjpjv.exe30⤵
- Executes dropped EXE
PID:4804 -
\??\c:\rxfxrrr.exec:\rxfxrrr.exe31⤵
- Executes dropped EXE
PID:5116 -
\??\c:\bbbttt.exec:\bbbttt.exe32⤵
- Executes dropped EXE
PID:2444 -
\??\c:\pvpjv.exec:\pvpjv.exe33⤵
- Executes dropped EXE
PID:544 -
\??\c:\jddpj.exec:\jddpj.exe34⤵
- Executes dropped EXE
PID:2852 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe35⤵
- Executes dropped EXE
PID:624 -
\??\c:\bttnnn.exec:\bttnnn.exe36⤵
- Executes dropped EXE
PID:2912 -
\??\c:\bnbtnn.exec:\bnbtnn.exe37⤵
- Executes dropped EXE
PID:812 -
\??\c:\pddvp.exec:\pddvp.exe38⤵
- Executes dropped EXE
PID:4992 -
\??\c:\9flfxff.exec:\9flfxff.exe39⤵
- Executes dropped EXE
PID:4464 -
\??\c:\lxrllff.exec:\lxrllff.exe40⤵
- Executes dropped EXE
PID:4548 -
\??\c:\nnbtnn.exec:\nnbtnn.exe41⤵
- Executes dropped EXE
PID:4716 -
\??\c:\pddvp.exec:\pddvp.exe42⤵
- Executes dropped EXE
PID:1504 -
\??\c:\jdpjd.exec:\jdpjd.exe43⤵
- Executes dropped EXE
PID:1664 -
\??\c:\xrllfff.exec:\xrllfff.exe44⤵
- Executes dropped EXE
PID:1792 -
\??\c:\xxrlffx.exec:\xxrlffx.exe45⤵
- Executes dropped EXE
PID:2332 -
\??\c:\bhhhbb.exec:\bhhhbb.exe46⤵
- Executes dropped EXE
PID:2712 -
\??\c:\pjppp.exec:\pjppp.exe47⤵
- Executes dropped EXE
PID:4556 -
\??\c:\jvvpj.exec:\jvvpj.exe48⤵
- Executes dropped EXE
PID:2408 -
\??\c:\xlfllff.exec:\xlfllff.exe49⤵
- Executes dropped EXE
PID:1356 -
\??\c:\nbhhbt.exec:\nbhhbt.exe50⤵
- Executes dropped EXE
PID:324 -
\??\c:\vjjjd.exec:\vjjjd.exe51⤵
- Executes dropped EXE
PID:212 -
\??\c:\jvdvp.exec:\jvdvp.exe52⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xllfrrl.exec:\xllfrrl.exe53⤵
- Executes dropped EXE
PID:4444 -
\??\c:\hbhtnn.exec:\hbhtnn.exe54⤵
- Executes dropped EXE
PID:2044 -
\??\c:\dpvpd.exec:\dpvpd.exe55⤵
- Executes dropped EXE
PID:3852 -
\??\c:\1lffrrr.exec:\1lffrrr.exe56⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hhhbhh.exec:\hhhbhh.exe57⤵
- Executes dropped EXE
PID:3380 -
\??\c:\btbhtn.exec:\btbhtn.exe58⤵
- Executes dropped EXE
PID:3080 -
\??\c:\5ddpd.exec:\5ddpd.exe59⤵
- Executes dropped EXE
PID:4440 -
\??\c:\xllxrxr.exec:\xllxrxr.exe60⤵
- Executes dropped EXE
PID:3168 -
\??\c:\bntnth.exec:\bntnth.exe61⤵
- Executes dropped EXE
PID:1648 -
\??\c:\htnbbb.exec:\htnbbb.exe62⤵
- Executes dropped EXE
PID:3608 -
\??\c:\7pjjd.exec:\7pjjd.exe63⤵
- Executes dropped EXE
PID:2812 -
\??\c:\5vdvd.exec:\5vdvd.exe64⤵
- Executes dropped EXE
PID:5084 -
\??\c:\9rrfxxx.exec:\9rrfxxx.exe65⤵
- Executes dropped EXE
PID:1420 -
\??\c:\9rrrlll.exec:\9rrrlll.exe66⤵PID:816
-
\??\c:\bhtnnn.exec:\bhtnnn.exe67⤵PID:3452
-
\??\c:\bbhbtt.exec:\bbhbtt.exe68⤵PID:3028
-
\??\c:\vjpjj.exec:\vjpjj.exe69⤵PID:5052
-
\??\c:\ffffxxx.exec:\ffffxxx.exe70⤵PID:2856
-
\??\c:\9fxxxll.exec:\9fxxxll.exe71⤵PID:4156
-
\??\c:\nbbttb.exec:\nbbttb.exe72⤵PID:2864
-
\??\c:\thbbnn.exec:\thbbnn.exe73⤵PID:4172
-
\??\c:\jdddd.exec:\jdddd.exe74⤵PID:1716
-
\??\c:\rfxrllf.exec:\rfxrllf.exe75⤵PID:1532
-
\??\c:\btthbh.exec:\btthbh.exe76⤵PID:3236
-
\??\c:\vpppp.exec:\vpppp.exe77⤵PID:4620
-
\??\c:\ppppj.exec:\ppppj.exe78⤵PID:4584
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe79⤵PID:5080
-
\??\c:\3hnhnh.exec:\3hnhnh.exe80⤵PID:3668
-
\??\c:\tnttnn.exec:\tnttnn.exe81⤵PID:3276
-
\??\c:\dvvjd.exec:\dvvjd.exe82⤵PID:2560
-
\??\c:\7ffxxxx.exec:\7ffxxxx.exe83⤵PID:528
-
\??\c:\xffrxlr.exec:\xffrxlr.exe84⤵PID:4648
-
\??\c:\thbtbt.exec:\thbtbt.exe85⤵PID:3552
-
\??\c:\jdjdv.exec:\jdjdv.exe86⤵PID:2884
-
\??\c:\dddvp.exec:\dddvp.exe87⤵PID:2364
-
\??\c:\lrlllrl.exec:\lrlllrl.exe88⤵PID:4416
-
\??\c:\rlfxlll.exec:\rlfxlll.exe89⤵PID:2340
-
\??\c:\bhhhhh.exec:\bhhhhh.exe90⤵PID:4864
-
\??\c:\jpjjj.exec:\jpjjj.exe91⤵PID:2784
-
\??\c:\3ddvv.exec:\3ddvv.exe92⤵PID:4120
-
\??\c:\rllfxxr.exec:\rllfxxr.exe93⤵PID:3508
-
\??\c:\9fxrllf.exec:\9fxrllf.exe94⤵PID:4508
-
\??\c:\3bnhhh.exec:\3bnhhh.exe95⤵PID:972
-
\??\c:\1hhbtt.exec:\1hhbtt.exe96⤵PID:1572
-
\??\c:\vvvpd.exec:\vvvpd.exe97⤵PID:1280
-
\??\c:\pjppj.exec:\pjppj.exe98⤵PID:756
-
\??\c:\xfrfxxr.exec:\xfrfxxr.exe99⤵PID:4320
-
\??\c:\tbnhhb.exec:\tbnhhb.exe100⤵PID:2452
-
\??\c:\bbntbt.exec:\bbntbt.exe101⤵PID:4484
-
\??\c:\vjpdv.exec:\vjpdv.exe102⤵PID:4092
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe103⤵PID:224
-
\??\c:\bhbttt.exec:\bhbttt.exe104⤵PID:404
-
\??\c:\bhtnhn.exec:\bhtnhn.exe105⤵PID:4064
-
\??\c:\dpppj.exec:\dpppj.exe106⤵PID:3436
-
\??\c:\lllrlfl.exec:\lllrlfl.exe107⤵PID:4856
-
\??\c:\3flfxxx.exec:\3flfxxx.exe108⤵PID:1176
-
\??\c:\nhbbtt.exec:\nhbbtt.exe109⤵PID:4572
-
\??\c:\thtthh.exec:\thtthh.exe110⤵PID:5044
-
\??\c:\9pvpj.exec:\9pvpj.exe111⤵PID:3768
-
\??\c:\rrxrlff.exec:\rrxrlff.exe112⤵PID:2476
-
\??\c:\ffxrllf.exec:\ffxrllf.exe113⤵PID:3208
-
\??\c:\3tbttt.exec:\3tbttt.exe114⤵PID:2284
-
\??\c:\5ddvj.exec:\5ddvj.exe115⤵PID:4516
-
\??\c:\vvjdp.exec:\vvjdp.exe116⤵PID:2296
-
\??\c:\frfxrrl.exec:\frfxrrl.exe117⤵PID:1860
-
\??\c:\hhbtnn.exec:\hhbtnn.exe118⤵PID:3888
-
\??\c:\tbhhbb.exec:\tbhhbb.exe119⤵PID:2076
-
\??\c:\jjdvv.exec:\jjdvv.exe120⤵PID:540
-
\??\c:\dvjdj.exec:\dvjdj.exe121⤵PID:4696
-
\??\c:\7xfrrrl.exec:\7xfrrrl.exe122⤵PID:4172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-