Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
26s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 01:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9c623463facf38a35de1f7df408b1641aedbe1b56eba9c8961a5e6e46800eeb6.exe
Resource
win7-20240705-en
5 signatures
150 seconds
General
-
Target
9c623463facf38a35de1f7df408b1641aedbe1b56eba9c8961a5e6e46800eeb6.exe
-
Size
79KB
-
MD5
7d87a62d19ce90beedb3aa8cf667c2d6
-
SHA1
6230dafb93abbe384cf8dc012478260266ab1b5d
-
SHA256
9c623463facf38a35de1f7df408b1641aedbe1b56eba9c8961a5e6e46800eeb6
-
SHA512
44881a229163b7d5352c581b84d3a4d4700d35ddd9344dc4863c88b5272ab5b150ad63ee8124b7664102f1fcded791e050c1104ea93cb584dec79cf3d9df7b56
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrAr:ymb3NkkiQ3mdBjFIIp9L9QrrAr
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral2/memory/452-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2160-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/876-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1012-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2708-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3540 dpjvj.exe 3928 htbbbh.exe 3192 jpppj.exe 2160 jpjvd.exe 60 thnnnh.exe 5056 pvpdv.exe 876 rllllll.exe 1012 ththtb.exe 3664 tntthn.exe 2708 httbbt.exe 2872 flfxlff.exe 4584 5jjdv.exe 4860 vvjdd.exe 1216 lxrfrxf.exe 3700 dvdvp.exe 548 3ffxllx.exe 1020 nhbttn.exe 1372 ppvdv.exe 4796 flrrrxr.exe 2940 ntnhbt.exe 2692 pvpjv.exe 4648 rrrlrxl.exe 3616 jdvdp.exe 4220 djjpd.exe 3476 ttbtnb.exe 4312 vpdpp.exe 3144 xxxlfxx.exe 4384 bhbbbh.exe 208 ppjvd.exe 748 rlfxlxr.exe 3348 pppjv.exe 1164 rxlllrx.exe 264 hnthbb.exe 5052 pvpvd.exe 1732 lrxrfrx.exe 5032 dvvpd.exe 944 rffrxfr.exe 852 bbnhbh.exe 1848 htnhhb.exe 3980 ppppj.exe 3636 fllffff.exe 1052 nnnhbh.exe 4560 ddpdp.exe 3432 lfffflf.exe 4716 lrxflxx.exe 3668 bhhbth.exe 2972 dpvjd.exe 3848 xlfrflx.exe 548 1ttbbh.exe 2280 pdvdp.exe 4576 nbntnt.exe 4704 jjppp.exe 3684 ppppd.exe 1968 rxffxrx.exe 1940 bhnnbn.exe 2340 vjdvv.exe 2960 fxfxrxx.exe 4352 nhtbnb.exe 1996 pddpd.exe 348 rlflxrl.exe 1956 nhtthh.exe 4408 lflrxlf.exe 4664 lrfxffr.exe 4288 tthhhb.exe -
resource yara_rule behavioral2/memory/452-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3928-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/876-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1012-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2708-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2708-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-188-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 452 wrote to memory of 3540 452 9c623463facf38a35de1f7df408b1641aedbe1b56eba9c8961a5e6e46800eeb6.exe 89 PID 452 wrote to memory of 3540 452 9c623463facf38a35de1f7df408b1641aedbe1b56eba9c8961a5e6e46800eeb6.exe 89 PID 452 wrote to memory of 3540 452 9c623463facf38a35de1f7df408b1641aedbe1b56eba9c8961a5e6e46800eeb6.exe 89 PID 3540 wrote to memory of 3928 3540 dpjvj.exe 91 PID 3540 wrote to memory of 3928 3540 dpjvj.exe 91 PID 3540 wrote to memory of 3928 3540 dpjvj.exe 91 PID 3928 wrote to memory of 3192 3928 htbbbh.exe 92 PID 3928 wrote to memory of 3192 3928 htbbbh.exe 92 PID 3928 wrote to memory of 3192 3928 htbbbh.exe 92 PID 3192 wrote to memory of 2160 3192 jpppj.exe 93 PID 3192 wrote to memory of 2160 3192 jpppj.exe 93 PID 3192 wrote to memory of 2160 3192 jpppj.exe 93 PID 2160 wrote to memory of 60 2160 jpjvd.exe 94 PID 2160 wrote to memory of 60 2160 jpjvd.exe 94 PID 2160 wrote to memory of 60 2160 jpjvd.exe 94 PID 60 wrote to memory of 5056 60 thnnnh.exe 95 PID 60 wrote to memory of 5056 60 thnnnh.exe 95 PID 60 wrote to memory of 5056 60 thnnnh.exe 95 PID 5056 wrote to memory of 876 5056 pvpdv.exe 96 PID 5056 wrote to memory of 876 5056 pvpdv.exe 96 PID 5056 wrote to memory of 876 5056 pvpdv.exe 96 PID 876 wrote to memory of 1012 876 rllllll.exe 97 PID 876 wrote to memory of 1012 876 rllllll.exe 97 PID 876 wrote to memory of 1012 876 rllllll.exe 97 PID 1012 wrote to memory of 3664 1012 ththtb.exe 98 PID 1012 wrote to memory of 3664 1012 ththtb.exe 98 PID 1012 wrote to memory of 3664 1012 ththtb.exe 98 PID 3664 wrote to memory of 2708 3664 tntthn.exe 100 PID 3664 wrote to memory of 2708 3664 tntthn.exe 100 PID 3664 wrote to memory of 2708 3664 tntthn.exe 100 PID 2708 wrote to memory of 2872 2708 httbbt.exe 101 PID 2708 wrote to memory of 2872 2708 httbbt.exe 101 PID 2708 wrote to memory of 2872 2708 httbbt.exe 101 PID 2872 wrote to memory of 4584 2872 flfxlff.exe 102 PID 2872 wrote to memory of 4584 2872 flfxlff.exe 102 PID 2872 wrote to memory of 4584 2872 flfxlff.exe 102 PID 4584 wrote to memory of 4860 4584 5jjdv.exe 103 PID 4584 wrote to memory of 4860 4584 5jjdv.exe 103 PID 4584 wrote to memory of 4860 4584 5jjdv.exe 103 PID 4860 wrote to memory of 1216 4860 vvjdd.exe 104 PID 4860 wrote to memory of 1216 4860 vvjdd.exe 104 PID 4860 wrote to memory of 1216 4860 vvjdd.exe 104 PID 1216 wrote to memory of 3700 1216 lxrfrxf.exe 106 PID 1216 wrote to memory of 3700 1216 lxrfrxf.exe 106 PID 1216 wrote to memory of 3700 1216 lxrfrxf.exe 106 PID 3700 wrote to memory of 548 3700 dvdvp.exe 140 PID 3700 wrote to memory of 548 3700 dvdvp.exe 140 PID 3700 wrote to memory of 548 3700 dvdvp.exe 140 PID 548 wrote to memory of 1020 548 3ffxllx.exe 108 PID 548 wrote to memory of 1020 548 3ffxllx.exe 108 PID 548 wrote to memory of 1020 548 3ffxllx.exe 108 PID 1020 wrote to memory of 1372 1020 nhbttn.exe 109 PID 1020 wrote to memory of 1372 1020 nhbttn.exe 109 PID 1020 wrote to memory of 1372 1020 nhbttn.exe 109 PID 1372 wrote to memory of 4796 1372 ppvdv.exe 110 PID 1372 wrote to memory of 4796 1372 ppvdv.exe 110 PID 1372 wrote to memory of 4796 1372 ppvdv.exe 110 PID 4796 wrote to memory of 2940 4796 flrrrxr.exe 111 PID 4796 wrote to memory of 2940 4796 flrrrxr.exe 111 PID 4796 wrote to memory of 2940 4796 flrrrxr.exe 111 PID 2940 wrote to memory of 2692 2940 ntnhbt.exe 112 PID 2940 wrote to memory of 2692 2940 ntnhbt.exe 112 PID 2940 wrote to memory of 2692 2940 ntnhbt.exe 112 PID 2692 wrote to memory of 4648 2692 pvpjv.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c623463facf38a35de1f7df408b1641aedbe1b56eba9c8961a5e6e46800eeb6.exe"C:\Users\Admin\AppData\Local\Temp\9c623463facf38a35de1f7df408b1641aedbe1b56eba9c8961a5e6e46800eeb6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\dpjvj.exec:\dpjvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\htbbbh.exec:\htbbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\jpppj.exec:\jpppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\jpjvd.exec:\jpjvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\thnnnh.exec:\thnnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\pvpdv.exec:\pvpdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\rllllll.exec:\rllllll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\ththtb.exec:\ththtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\tntthn.exec:\tntthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\httbbt.exec:\httbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\flfxlff.exec:\flfxlff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\5jjdv.exec:\5jjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\vvjdd.exec:\vvjdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\lxrfrxf.exec:\lxrfrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\dvdvp.exec:\dvdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\3ffxllx.exec:\3ffxllx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\nhbttn.exec:\nhbttn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\ppvdv.exec:\ppvdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\flrrrxr.exec:\flrrrxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\ntnhbt.exec:\ntnhbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\pvpjv.exec:\pvpjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\rrrlrxl.exec:\rrrlrxl.exe23⤵
- Executes dropped EXE
PID:4648 -
\??\c:\jdvdp.exec:\jdvdp.exe24⤵
- Executes dropped EXE
PID:3616 -
\??\c:\djjpd.exec:\djjpd.exe25⤵
- Executes dropped EXE
PID:4220 -
\??\c:\ttbtnb.exec:\ttbtnb.exe26⤵
- Executes dropped EXE
PID:3476 -
\??\c:\vpdpp.exec:\vpdpp.exe27⤵
- Executes dropped EXE
PID:4312 -
\??\c:\xxxlfxx.exec:\xxxlfxx.exe28⤵
- Executes dropped EXE
PID:3144 -
\??\c:\bhbbbh.exec:\bhbbbh.exe29⤵
- Executes dropped EXE
PID:4384 -
\??\c:\ppjvd.exec:\ppjvd.exe30⤵
- Executes dropped EXE
PID:208 -
\??\c:\rlfxlxr.exec:\rlfxlxr.exe31⤵
- Executes dropped EXE
PID:748 -
\??\c:\pppjv.exec:\pppjv.exe32⤵
- Executes dropped EXE
PID:3348 -
\??\c:\rxlllrx.exec:\rxlllrx.exe33⤵
- Executes dropped EXE
PID:1164 -
\??\c:\hnthbb.exec:\hnthbb.exe34⤵
- Executes dropped EXE
PID:264 -
\??\c:\pvpvd.exec:\pvpvd.exe35⤵
- Executes dropped EXE
PID:5052 -
\??\c:\lrxrfrx.exec:\lrxrfrx.exe36⤵
- Executes dropped EXE
PID:1732 -
\??\c:\dvvpd.exec:\dvvpd.exe37⤵
- Executes dropped EXE
PID:5032 -
\??\c:\rffrxfr.exec:\rffrxfr.exe38⤵
- Executes dropped EXE
PID:944 -
\??\c:\bbnhbh.exec:\bbnhbh.exe39⤵
- Executes dropped EXE
PID:852 -
\??\c:\htnhhb.exec:\htnhhb.exe40⤵
- Executes dropped EXE
PID:1848 -
\??\c:\ppppj.exec:\ppppj.exe41⤵
- Executes dropped EXE
PID:3980 -
\??\c:\fllffff.exec:\fllffff.exe42⤵
- Executes dropped EXE
PID:3636 -
\??\c:\nnnhbh.exec:\nnnhbh.exe43⤵
- Executes dropped EXE
PID:1052 -
\??\c:\ddpdp.exec:\ddpdp.exe44⤵
- Executes dropped EXE
PID:4560 -
\??\c:\lfffflf.exec:\lfffflf.exe45⤵
- Executes dropped EXE
PID:3432 -
\??\c:\lrxflxx.exec:\lrxflxx.exe46⤵
- Executes dropped EXE
PID:4716 -
\??\c:\bhhbth.exec:\bhhbth.exe47⤵
- Executes dropped EXE
PID:3668 -
\??\c:\dpvjd.exec:\dpvjd.exe48⤵
- Executes dropped EXE
PID:2972 -
\??\c:\xlfrflx.exec:\xlfrflx.exe49⤵
- Executes dropped EXE
PID:3848 -
\??\c:\1ttbbh.exec:\1ttbbh.exe50⤵
- Executes dropped EXE
PID:548 -
\??\c:\pdvdp.exec:\pdvdp.exe51⤵
- Executes dropped EXE
PID:2280 -
\??\c:\nbntnt.exec:\nbntnt.exe52⤵
- Executes dropped EXE
PID:4576 -
\??\c:\jjppp.exec:\jjppp.exe53⤵
- Executes dropped EXE
PID:4704 -
\??\c:\ppppd.exec:\ppppd.exe54⤵
- Executes dropped EXE
PID:3684 -
\??\c:\rxffxrx.exec:\rxffxrx.exe55⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bhnnbn.exec:\bhnnbn.exe56⤵
- Executes dropped EXE
PID:1940 -
\??\c:\vjdvv.exec:\vjdvv.exe57⤵
- Executes dropped EXE
PID:2340 -
\??\c:\fxfxrxx.exec:\fxfxrxx.exe58⤵
- Executes dropped EXE
PID:2960 -
\??\c:\nhtbnb.exec:\nhtbnb.exe59⤵
- Executes dropped EXE
PID:4352 -
\??\c:\pddpd.exec:\pddpd.exe60⤵
- Executes dropped EXE
PID:1996 -
\??\c:\rlflxrl.exec:\rlflxrl.exe61⤵
- Executes dropped EXE
PID:348 -
\??\c:\nhtthh.exec:\nhtthh.exe62⤵
- Executes dropped EXE
PID:1956 -
\??\c:\jjjjd.exec:\jjjjd.exe63⤵PID:5072
-
\??\c:\lflrxlf.exec:\lflrxlf.exe64⤵
- Executes dropped EXE
PID:4408 -
\??\c:\lrfxffr.exec:\lrfxffr.exe65⤵
- Executes dropped EXE
PID:4664 -
\??\c:\tthhhb.exec:\tthhhb.exe66⤵
- Executes dropped EXE
PID:4288 -
\??\c:\pdppj.exec:\pdppj.exe67⤵PID:1636
-
\??\c:\lrrflrl.exec:\lrrflrl.exe68⤵PID:3724
-
\??\c:\fflfxll.exec:\fflfxll.exe69⤵PID:3220
-
\??\c:\hthbhn.exec:\hthbhn.exe70⤵PID:1296
-
\??\c:\dvppp.exec:\dvppp.exe71⤵PID:3480
-
\??\c:\xlxlllf.exec:\xlxlllf.exe72⤵PID:2412
-
\??\c:\3lrxllr.exec:\3lrxllr.exe73⤵PID:4172
-
\??\c:\ntbttb.exec:\ntbttb.exe74⤵PID:876
-
\??\c:\jpjpv.exec:\jpjpv.exe75⤵PID:2636
-
\??\c:\xllffrx.exec:\xllffrx.exe76⤵PID:4032
-
\??\c:\bbnnhn.exec:\bbnnhn.exe77⤵PID:3664
-
\??\c:\ppvvp.exec:\ppvvp.exe78⤵PID:2708
-
\??\c:\pjdvp.exec:\pjdvp.exe79⤵PID:3600
-
\??\c:\lfrxlxl.exec:\lfrxlxl.exe80⤵PID:2872
-
\??\c:\thhhhh.exec:\thhhhh.exe81⤵PID:4584
-
\??\c:\tbthbt.exec:\tbthbt.exe82⤵PID:3388
-
\??\c:\jpvjd.exec:\jpvjd.exe83⤵PID:1648
-
\??\c:\lfxrxrf.exec:\lfxrxrf.exe84⤵PID:3552
-
\??\c:\hhhnht.exec:\hhhnht.exe85⤵PID:3408
-
\??\c:\pvjpp.exec:\pvjpp.exe86⤵PID:4504
-
\??\c:\lrfffff.exec:\lrfffff.exe87⤵PID:1020
-
\??\c:\ntnttb.exec:\ntnttb.exe88⤵PID:3820
-
\??\c:\hbtbhn.exec:\hbtbhn.exe89⤵PID:4900
-
\??\c:\jdvvj.exec:\jdvvj.exe90⤵PID:4704
-
\??\c:\xlffxxr.exec:\xlffxxr.exe91⤵PID:3684
-
\??\c:\nbtnbb.exec:\nbtnbb.exe92⤵PID:3788
-
\??\c:\pvppd.exec:\pvppd.exe93⤵PID:1940
-
\??\c:\rlrlflx.exec:\rlrlflx.exe94⤵PID:3472
-
\??\c:\nnnntn.exec:\nnnntn.exe95⤵PID:3296
-
\??\c:\9tbtnh.exec:\9tbtnh.exe96⤵PID:2616
-
\??\c:\dpjvp.exec:\dpjvp.exe97⤵PID:3144
-
\??\c:\xxlxrrl.exec:\xxlxrrl.exe98⤵PID:4236
-
\??\c:\thnhbt.exec:\thnhbt.exe99⤵PID:1076
-
\??\c:\ntbnhb.exec:\ntbnhb.exe100⤵PID:208
-
\??\c:\jdvdv.exec:\jdvdv.exe101⤵PID:440
-
\??\c:\rxrxxxr.exec:\rxrxxxr.exe102⤵PID:3496
-
\??\c:\thbnhh.exec:\thbnhh.exe103⤵PID:1164
-
\??\c:\nhtthb.exec:\nhtthb.exe104⤵PID:1980
-
\??\c:\pvpdv.exec:\pvpdv.exe105⤵PID:3764
-
\??\c:\lrlxfxx.exec:\lrlxfxx.exe106⤵PID:5052
-
\??\c:\bhnnhn.exec:\bhnnhn.exe107⤵PID:1672
-
\??\c:\pppdj.exec:\pppdj.exe108⤵PID:4880
-
\??\c:\rfrrfff.exec:\rfrrfff.exe109⤵PID:860
-
\??\c:\hhnntb.exec:\hhnntb.exe110⤵PID:948
-
\??\c:\nnbhbh.exec:\nnbhbh.exe111⤵PID:3336
-
\??\c:\dpdjj.exec:\dpdjj.exe112⤵PID:1200
-
\??\c:\lfrlxxl.exec:\lfrlxxl.exe113⤵PID:3636
-
\??\c:\ntbbbt.exec:\ntbbbt.exe114⤵PID:4560
-
\??\c:\dvpdp.exec:\dvpdp.exe115⤵PID:2108
-
\??\c:\frrrrxx.exec:\frrrrxx.exe116⤵PID:4376
-
\??\c:\thnhnh.exec:\thnhnh.exe117⤵PID:4972
-
\??\c:\vjddv.exec:\vjddv.exe118⤵PID:3700
-
\??\c:\btthnb.exec:\btthnb.exe119⤵PID:2972
-
\??\c:\jjjdd.exec:\jjjdd.exe120⤵PID:5084
-
\??\c:\rffxlrr.exec:\rffxlrr.exe121⤵PID:3268
-
\??\c:\thhbtt.exec:\thhbtt.exe122⤵PID:2916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-