Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 04:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
296e5dd8e88e5755ef56d38c72b77a50N.exe
Resource
win7-20240705-en
5 signatures
150 seconds
General
-
Target
296e5dd8e88e5755ef56d38c72b77a50N.exe
-
Size
75KB
-
MD5
296e5dd8e88e5755ef56d38c72b77a50
-
SHA1
3b6047ef632279b191ef13c9875c195e29271575
-
SHA256
89af54504034535d5de80f28b00522b96ba18fa7b20d2d63626f835f334de5b0
-
SHA512
a638d922c9656485708a1cf371c801cba896c6eb3be0c28547209ef9899fc7b3c3948be1dad1c9bbc906f538dbf4d745eaefa2691fac16b5d8e6f6c52535fce1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfv7+afCD+QsQbKQPEU:ymb3NkkiQ3mdBjFIfvTfCD+HlQcU
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3984-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/688-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/532-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2252-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3808-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1264-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1300-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/992-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 688 xfxlrrr.exe 2848 bbbbhn.exe 532 jvvvj.exe 4560 xlxrlrr.exe 636 jvdpv.exe 1136 rlxffxr.exe 2236 pppvd.exe 3600 fxlxffr.exe 2252 btnttt.exe 4328 1vvvd.exe 2244 nbnnhn.exe 3808 bhhnbb.exe 2076 fffrfrx.exe 3752 dpddj.exe 2316 1rxfflf.exe 4916 nnntnt.exe 768 7tbhht.exe 1308 rxfxlxx.exe 2032 nbbnnt.exe 4500 rxxlffr.exe 4348 fxrfxrr.exe 1764 ppddd.exe 4300 jjjpp.exe 4956 flxrfrf.exe 4624 tnnhbb.exe 1264 pvdpj.exe 1300 9rrxxxx.exe 992 tnttth.exe 1116 7vjjd.exe 3504 jvjpv.exe 1692 fxxxffl.exe 4052 9bnnnt.exe 1852 pvpdp.exe 2684 fxffxxx.exe 2744 hnhbbn.exe 5020 ttnhhn.exe 2748 vdjpp.exe 2884 vpjjv.exe 4940 lxlllll.exe 3904 nbhnnt.exe 2100 djvvv.exe 1544 ddvvv.exe 1976 xflfxxx.exe 1168 ntbhbb.exe 3392 bhhbnn.exe 4104 3ppjd.exe 5064 flfllxl.exe 2268 hbhthb.exe 604 pjjjp.exe 116 rrlfrxr.exe 3316 hhthnt.exe 2616 djpdp.exe 1312 rfflxff.exe 3976 hbbhtn.exe 2716 dvddj.exe 2240 ffflllr.exe 1872 rflfrxx.exe 2920 bbthbt.exe 2040 ddddv.exe 4860 rlffffx.exe 3952 9ttttb.exe 3752 jdppj.exe 2368 frxxrxx.exe 3728 rxllrrx.exe -
resource yara_rule behavioral2/memory/3984-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/532-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1136-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/768-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1264-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1300-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/992-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3984 wrote to memory of 688 3984 296e5dd8e88e5755ef56d38c72b77a50N.exe 81 PID 3984 wrote to memory of 688 3984 296e5dd8e88e5755ef56d38c72b77a50N.exe 81 PID 3984 wrote to memory of 688 3984 296e5dd8e88e5755ef56d38c72b77a50N.exe 81 PID 688 wrote to memory of 2848 688 xfxlrrr.exe 82 PID 688 wrote to memory of 2848 688 xfxlrrr.exe 82 PID 688 wrote to memory of 2848 688 xfxlrrr.exe 82 PID 2848 wrote to memory of 532 2848 bbbbhn.exe 83 PID 2848 wrote to memory of 532 2848 bbbbhn.exe 83 PID 2848 wrote to memory of 532 2848 bbbbhn.exe 83 PID 532 wrote to memory of 4560 532 jvvvj.exe 84 PID 532 wrote to memory of 4560 532 jvvvj.exe 84 PID 532 wrote to memory of 4560 532 jvvvj.exe 84 PID 4560 wrote to memory of 636 4560 xlxrlrr.exe 85 PID 4560 wrote to memory of 636 4560 xlxrlrr.exe 85 PID 4560 wrote to memory of 636 4560 xlxrlrr.exe 85 PID 636 wrote to memory of 1136 636 jvdpv.exe 86 PID 636 wrote to memory of 1136 636 jvdpv.exe 86 PID 636 wrote to memory of 1136 636 jvdpv.exe 86 PID 1136 wrote to memory of 2236 1136 rlxffxr.exe 87 PID 1136 wrote to memory of 2236 1136 rlxffxr.exe 87 PID 1136 wrote to memory of 2236 1136 rlxffxr.exe 87 PID 2236 wrote to memory of 3600 2236 pppvd.exe 88 PID 2236 wrote to memory of 3600 2236 pppvd.exe 88 PID 2236 wrote to memory of 3600 2236 pppvd.exe 88 PID 3600 wrote to memory of 2252 3600 fxlxffr.exe 90 PID 3600 wrote to memory of 2252 3600 fxlxffr.exe 90 PID 3600 wrote to memory of 2252 3600 fxlxffr.exe 90 PID 2252 wrote to memory of 4328 2252 btnttt.exe 91 PID 2252 wrote to memory of 4328 2252 btnttt.exe 91 PID 2252 wrote to memory of 4328 2252 btnttt.exe 91 PID 4328 wrote to memory of 2244 4328 1vvvd.exe 92 PID 4328 wrote to memory of 2244 4328 1vvvd.exe 92 PID 4328 wrote to memory of 2244 4328 1vvvd.exe 92 PID 2244 wrote to memory of 3808 2244 nbnnhn.exe 93 PID 2244 wrote to memory of 3808 2244 nbnnhn.exe 93 PID 2244 wrote to memory of 3808 2244 nbnnhn.exe 93 PID 3808 wrote to memory of 2076 3808 bhhnbb.exe 94 PID 3808 wrote to memory of 2076 3808 bhhnbb.exe 94 PID 3808 wrote to memory of 2076 3808 bhhnbb.exe 94 PID 2076 wrote to memory of 3752 2076 fffrfrx.exe 95 PID 2076 wrote to memory of 3752 2076 fffrfrx.exe 95 PID 2076 wrote to memory of 3752 2076 fffrfrx.exe 95 PID 3752 wrote to memory of 2316 3752 dpddj.exe 96 PID 3752 wrote to memory of 2316 3752 dpddj.exe 96 PID 3752 wrote to memory of 2316 3752 dpddj.exe 96 PID 2316 wrote to memory of 4916 2316 1rxfflf.exe 97 PID 2316 wrote to memory of 4916 2316 1rxfflf.exe 97 PID 2316 wrote to memory of 4916 2316 1rxfflf.exe 97 PID 4916 wrote to memory of 768 4916 nnntnt.exe 98 PID 4916 wrote to memory of 768 4916 nnntnt.exe 98 PID 4916 wrote to memory of 768 4916 nnntnt.exe 98 PID 768 wrote to memory of 1308 768 7tbhht.exe 100 PID 768 wrote to memory of 1308 768 7tbhht.exe 100 PID 768 wrote to memory of 1308 768 7tbhht.exe 100 PID 1308 wrote to memory of 2032 1308 rxfxlxx.exe 101 PID 1308 wrote to memory of 2032 1308 rxfxlxx.exe 101 PID 1308 wrote to memory of 2032 1308 rxfxlxx.exe 101 PID 2032 wrote to memory of 4500 2032 nbbnnt.exe 102 PID 2032 wrote to memory of 4500 2032 nbbnnt.exe 102 PID 2032 wrote to memory of 4500 2032 nbbnnt.exe 102 PID 4500 wrote to memory of 4348 4500 rxxlffr.exe 103 PID 4500 wrote to memory of 4348 4500 rxxlffr.exe 103 PID 4500 wrote to memory of 4348 4500 rxxlffr.exe 103 PID 4348 wrote to memory of 1764 4348 fxrfxrr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\296e5dd8e88e5755ef56d38c72b77a50N.exe"C:\Users\Admin\AppData\Local\Temp\296e5dd8e88e5755ef56d38c72b77a50N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\xfxlrrr.exec:\xfxlrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\bbbbhn.exec:\bbbbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\jvvvj.exec:\jvvvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\xlxrlrr.exec:\xlxrlrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\jvdpv.exec:\jvdpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\rlxffxr.exec:\rlxffxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\pppvd.exec:\pppvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\fxlxffr.exec:\fxlxffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\btnttt.exec:\btnttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\1vvvd.exec:\1vvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\nbnnhn.exec:\nbnnhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\bhhnbb.exec:\bhhnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\fffrfrx.exec:\fffrfrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\dpddj.exec:\dpddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\1rxfflf.exec:\1rxfflf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\nnntnt.exec:\nnntnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\7tbhht.exec:\7tbhht.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\rxfxlxx.exec:\rxfxlxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\nbbnnt.exec:\nbbnnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\rxxlffr.exec:\rxxlffr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\fxrfxrr.exec:\fxrfxrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\ppddd.exec:\ppddd.exe23⤵
- Executes dropped EXE
PID:1764 -
\??\c:\jjjpp.exec:\jjjpp.exe24⤵
- Executes dropped EXE
PID:4300 -
\??\c:\flxrfrf.exec:\flxrfrf.exe25⤵
- Executes dropped EXE
PID:4956 -
\??\c:\tnnhbb.exec:\tnnhbb.exe26⤵
- Executes dropped EXE
PID:4624 -
\??\c:\pvdpj.exec:\pvdpj.exe27⤵
- Executes dropped EXE
PID:1264 -
\??\c:\9rrxxxx.exec:\9rrxxxx.exe28⤵
- Executes dropped EXE
PID:1300 -
\??\c:\tnttth.exec:\tnttth.exe29⤵
- Executes dropped EXE
PID:992 -
\??\c:\7vjjd.exec:\7vjjd.exe30⤵
- Executes dropped EXE
PID:1116 -
\??\c:\jvjpv.exec:\jvjpv.exe31⤵
- Executes dropped EXE
PID:3504 -
\??\c:\fxxxffl.exec:\fxxxffl.exe32⤵
- Executes dropped EXE
PID:1692 -
\??\c:\9bnnnt.exec:\9bnnnt.exe33⤵
- Executes dropped EXE
PID:4052 -
\??\c:\pvpdp.exec:\pvpdp.exe34⤵
- Executes dropped EXE
PID:1852 -
\??\c:\fxffxxx.exec:\fxffxxx.exe35⤵
- Executes dropped EXE
PID:2684 -
\??\c:\hnhbbn.exec:\hnhbbn.exe36⤵
- Executes dropped EXE
PID:2744 -
\??\c:\ttnhhn.exec:\ttnhhn.exe37⤵
- Executes dropped EXE
PID:5020 -
\??\c:\vdjpp.exec:\vdjpp.exe38⤵
- Executes dropped EXE
PID:2748 -
\??\c:\vpjjv.exec:\vpjjv.exe39⤵
- Executes dropped EXE
PID:2884 -
\??\c:\lxlllll.exec:\lxlllll.exe40⤵
- Executes dropped EXE
PID:4940 -
\??\c:\nbhnnt.exec:\nbhnnt.exe41⤵
- Executes dropped EXE
PID:3904 -
\??\c:\djvvv.exec:\djvvv.exe42⤵
- Executes dropped EXE
PID:2100 -
\??\c:\ddvvv.exec:\ddvvv.exe43⤵
- Executes dropped EXE
PID:1544 -
\??\c:\xflfxxx.exec:\xflfxxx.exe44⤵
- Executes dropped EXE
PID:1976 -
\??\c:\ntbhbb.exec:\ntbhbb.exe45⤵
- Executes dropped EXE
PID:1168 -
\??\c:\bhhbnn.exec:\bhhbnn.exe46⤵
- Executes dropped EXE
PID:3392 -
\??\c:\3ppjd.exec:\3ppjd.exe47⤵
- Executes dropped EXE
PID:4104 -
\??\c:\flfllxl.exec:\flfllxl.exe48⤵
- Executes dropped EXE
PID:5064 -
\??\c:\hbhthb.exec:\hbhthb.exe49⤵
- Executes dropped EXE
PID:2268 -
\??\c:\pjjjp.exec:\pjjjp.exe50⤵
- Executes dropped EXE
PID:604 -
\??\c:\rrlfrxr.exec:\rrlfrxr.exe51⤵
- Executes dropped EXE
PID:116 -
\??\c:\hhthnt.exec:\hhthnt.exe52⤵
- Executes dropped EXE
PID:3316 -
\??\c:\djpdp.exec:\djpdp.exe53⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rfflxff.exec:\rfflxff.exe54⤵
- Executes dropped EXE
PID:1312 -
\??\c:\hbbhtn.exec:\hbbhtn.exe55⤵
- Executes dropped EXE
PID:3976 -
\??\c:\dvddj.exec:\dvddj.exe56⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ffflllr.exec:\ffflllr.exe57⤵
- Executes dropped EXE
PID:2240 -
\??\c:\rflfrxx.exec:\rflfrxx.exe58⤵
- Executes dropped EXE
PID:1872 -
\??\c:\bbthbt.exec:\bbthbt.exe59⤵
- Executes dropped EXE
PID:2920 -
\??\c:\ddddv.exec:\ddddv.exe60⤵
- Executes dropped EXE
PID:2040 -
\??\c:\rlffffx.exec:\rlffffx.exe61⤵
- Executes dropped EXE
PID:4860 -
\??\c:\9ttttb.exec:\9ttttb.exe62⤵
- Executes dropped EXE
PID:3952 -
\??\c:\jdppj.exec:\jdppj.exe63⤵
- Executes dropped EXE
PID:3752 -
\??\c:\frxxrxx.exec:\frxxrxx.exe64⤵
- Executes dropped EXE
PID:2368 -
\??\c:\rxllrrx.exec:\rxllrrx.exe65⤵
- Executes dropped EXE
PID:3728 -
\??\c:\hhttbh.exec:\hhttbh.exe66⤵PID:1680
-
\??\c:\vpddd.exec:\vpddd.exe67⤵PID:2232
-
\??\c:\rrfxlfl.exec:\rrfxlfl.exe68⤵PID:4584
-
\??\c:\tntthb.exec:\tntthb.exe69⤵PID:5044
-
\??\c:\jddpd.exec:\jddpd.exe70⤵PID:2280
-
\??\c:\frxrfxf.exec:\frxrfxf.exe71⤵PID:3832
-
\??\c:\hntnnn.exec:\hntnnn.exe72⤵PID:4128
-
\??\c:\9vvvp.exec:\9vvvp.exe73⤵PID:4612
-
\??\c:\xrfxrxx.exec:\xrfxrxx.exe74⤵PID:2696
-
\??\c:\xfllfrr.exec:\xfllfrr.exe75⤵PID:5100
-
\??\c:\jvdjv.exec:\jvdjv.exe76⤵PID:4404
-
\??\c:\ppppd.exec:\ppppd.exe77⤵PID:1964
-
\??\c:\lfxxxrr.exec:\lfxxxrr.exe78⤵PID:3876
-
\??\c:\bhbbtn.exec:\bhbbtn.exe79⤵PID:1264
-
\??\c:\pdjpd.exec:\pdjpd.exe80⤵PID:3360
-
\??\c:\xxfllfr.exec:\xxfllfr.exe81⤵PID:992
-
\??\c:\lfrrfxl.exec:\lfrrfxl.exe82⤵PID:4476
-
\??\c:\nhbbhh.exec:\nhbbhh.exe83⤵PID:3216
-
\??\c:\5fffrxl.exec:\5fffrxl.exe84⤵PID:2888
-
\??\c:\nnhbhb.exec:\nnhbhb.exe85⤵PID:1800
-
\??\c:\vpppp.exec:\vpppp.exe86⤵PID:2568
-
\??\c:\rfxrlfx.exec:\rfxrlfx.exe87⤵PID:2152
-
\??\c:\tnnnhh.exec:\tnnnhh.exe88⤵PID:3420
-
\??\c:\bnbthh.exec:\bnbthh.exe89⤵PID:4796
-
\??\c:\vjjpj.exec:\vjjpj.exe90⤵PID:856
-
\??\c:\fffxxxx.exec:\fffxxxx.exe91⤵PID:5016
-
\??\c:\htttnn.exec:\htttnn.exe92⤵PID:4000
-
\??\c:\5nnthh.exec:\5nnthh.exe93⤵PID:1496
-
\??\c:\dpjjj.exec:\dpjjj.exe94⤵PID:3232
-
\??\c:\lrrxlrx.exec:\lrrxlrx.exe95⤵PID:1884
-
\??\c:\thhbbt.exec:\thhbbt.exe96⤵PID:3384
-
\??\c:\jdddd.exec:\jdddd.exe97⤵PID:4456
-
\??\c:\dvvpp.exec:\dvvpp.exe98⤵PID:1008
-
\??\c:\rrfrfxl.exec:\rrfrfxl.exe99⤵PID:4808
-
\??\c:\hnntnb.exec:\hnntnb.exe100⤵PID:4712
-
\??\c:\pvvvj.exec:\pvvvj.exe101⤵PID:4872
-
\??\c:\ppvpj.exec:\ppvpj.exe102⤵PID:2848
-
\??\c:\5rxrfxl.exec:\5rxrfxl.exe103⤵PID:2268
-
\??\c:\ntbnhh.exec:\ntbnhh.exe104⤵PID:604
-
\??\c:\bbbhbh.exec:\bbbhbh.exe105⤵PID:1864
-
\??\c:\3jjvj.exec:\3jjvj.exe106⤵PID:3444
-
\??\c:\lffxxff.exec:\lffxxff.exe107⤵PID:3240
-
\??\c:\hnhtht.exec:\hnhtht.exe108⤵PID:4976
-
\??\c:\htbntt.exec:\htbntt.exe109⤵PID:2252
-
\??\c:\5jpjd.exec:\5jpjd.exe110⤵PID:4984
-
\??\c:\fxlrffx.exec:\fxlrffx.exe111⤵PID:1560
-
\??\c:\5frfflx.exec:\5frfflx.exe112⤵PID:3036
-
\??\c:\thhhth.exec:\thhhth.exe113⤵PID:3068
-
\??\c:\bbbnbt.exec:\bbbnbt.exe114⤵PID:384
-
\??\c:\ppvjv.exec:\ppvjv.exe115⤵PID:2096
-
\??\c:\lxlrxrx.exec:\lxlrxrx.exe116⤵PID:4776
-
\??\c:\xlxxrlx.exec:\xlxxrlx.exe117⤵PID:5000
-
\??\c:\btbbbt.exec:\btbbbt.exe118⤵PID:228
-
\??\c:\1djjv.exec:\1djjv.exe119⤵PID:4324
-
\??\c:\nhnnbh.exec:\nhnnbh.exe120⤵PID:4504
-
\??\c:\tbtthn.exec:\tbtthn.exe121⤵PID:756
-
\??\c:\jjvvp.exec:\jjvvp.exe122⤵PID:3780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-