Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 12:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
37c29458daff98978480a1b7d9bd1e50N.exe
Resource
win7-20240705-en
5 signatures
150 seconds
General
-
Target
37c29458daff98978480a1b7d9bd1e50N.exe
-
Size
94KB
-
MD5
37c29458daff98978480a1b7d9bd1e50
-
SHA1
28098756c1028aa58efc9edb987e45f78d66e177
-
SHA256
691723493e45bfea37d5f0370f46c4117808b84d2a1af1f4a494e51a273d66d8
-
SHA512
e7ecdccaff6b1c6e5370a3548aef4b979af2f9f7049d5dd8666fb17ee6b16c65bcaeeb797997ff92e35d04c5cf958dc22cfc84789ea639c54c13c5028413e76f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLuePjDYlR3hnjKXIQSe9oEYL:ymb3NkkiQ3mdBjFoLucjDilOZho5
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3152-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1932-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/588-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3792-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1160-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/800-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1500-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2792 7xxlfxr.exe 1912 9bhhbb.exe 1932 hbnhhb.exe 588 lxrlfll.exe 1496 xxllrrx.exe 512 bnbtnh.exe 1572 vppjd.exe 4596 lffxrrl.exe 4896 ntbbbb.exe 2956 rflffff.exe 60 1llfxrl.exe 3688 nnnhbb.exe 3956 jdvvj.exe 4252 vdpdv.exe 2244 xffrlfx.exe 4500 pdddv.exe 3792 djppd.exe 5016 xflfxxr.exe 3268 9bbnbb.exe 1160 dvpjv.exe 796 7jvvj.exe 4316 rllllfx.exe 4196 rlrllll.exe 800 bbthnn.exe 3908 5ppjp.exe 456 fflfllx.exe 5020 1bhhnn.exe 2020 3bnnhn.exe 1500 1djdp.exe 1428 rfllfll.exe 4976 bhnnhn.exe 1496 pdpvp.exe 3384 frllrxr.exe 1488 btttbb.exe 1836 3pjjj.exe 2268 jdddp.exe 5048 ffrrfll.exe 3632 hbtthh.exe 408 hnhbbb.exe 2560 7vjdv.exe 1988 3lxxrxx.exe 3688 tthttb.exe 4476 jjjvp.exe 748 1rrfxrr.exe 4628 rlffxfx.exe 2840 bttttb.exe 1864 jpppd.exe 4916 vjjjd.exe 948 nhbbtb.exe 4000 3bnnbb.exe 1184 dvvvp.exe 3060 jpvvj.exe 2972 xflrlll.exe 4632 5fxrlrl.exe 4528 pppjj.exe 1920 vvvpj.exe 4768 xfllflx.exe 4536 lxfflxr.exe 456 hhnntt.exe 3884 djppv.exe 3780 lfllxfr.exe 4888 fxxxrrl.exe 1500 nhbnnn.exe 1928 3djdv.exe -
resource yara_rule behavioral2/memory/3152-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/588-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3792-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/800-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1500-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3152 wrote to memory of 2792 3152 37c29458daff98978480a1b7d9bd1e50N.exe 90 PID 3152 wrote to memory of 2792 3152 37c29458daff98978480a1b7d9bd1e50N.exe 90 PID 3152 wrote to memory of 2792 3152 37c29458daff98978480a1b7d9bd1e50N.exe 90 PID 2792 wrote to memory of 1912 2792 7xxlfxr.exe 91 PID 2792 wrote to memory of 1912 2792 7xxlfxr.exe 91 PID 2792 wrote to memory of 1912 2792 7xxlfxr.exe 91 PID 1912 wrote to memory of 1932 1912 9bhhbb.exe 92 PID 1912 wrote to memory of 1932 1912 9bhhbb.exe 92 PID 1912 wrote to memory of 1932 1912 9bhhbb.exe 92 PID 1932 wrote to memory of 588 1932 hbnhhb.exe 93 PID 1932 wrote to memory of 588 1932 hbnhhb.exe 93 PID 1932 wrote to memory of 588 1932 hbnhhb.exe 93 PID 588 wrote to memory of 1496 588 lxrlfll.exe 95 PID 588 wrote to memory of 1496 588 lxrlfll.exe 95 PID 588 wrote to memory of 1496 588 lxrlfll.exe 95 PID 1496 wrote to memory of 512 1496 xxllrrx.exe 96 PID 1496 wrote to memory of 512 1496 xxllrrx.exe 96 PID 1496 wrote to memory of 512 1496 xxllrrx.exe 96 PID 512 wrote to memory of 1572 512 bnbtnh.exe 97 PID 512 wrote to memory of 1572 512 bnbtnh.exe 97 PID 512 wrote to memory of 1572 512 bnbtnh.exe 97 PID 1572 wrote to memory of 4596 1572 vppjd.exe 98 PID 1572 wrote to memory of 4596 1572 vppjd.exe 98 PID 1572 wrote to memory of 4596 1572 vppjd.exe 98 PID 4596 wrote to memory of 4896 4596 lffxrrl.exe 100 PID 4596 wrote to memory of 4896 4596 lffxrrl.exe 100 PID 4596 wrote to memory of 4896 4596 lffxrrl.exe 100 PID 4896 wrote to memory of 2956 4896 ntbbbb.exe 101 PID 4896 wrote to memory of 2956 4896 ntbbbb.exe 101 PID 4896 wrote to memory of 2956 4896 ntbbbb.exe 101 PID 2956 wrote to memory of 60 2956 rflffff.exe 102 PID 2956 wrote to memory of 60 2956 rflffff.exe 102 PID 2956 wrote to memory of 60 2956 rflffff.exe 102 PID 60 wrote to memory of 3688 60 1llfxrl.exe 103 PID 60 wrote to memory of 3688 60 1llfxrl.exe 103 PID 60 wrote to memory of 3688 60 1llfxrl.exe 103 PID 3688 wrote to memory of 3956 3688 nnnhbb.exe 104 PID 3688 wrote to memory of 3956 3688 nnnhbb.exe 104 PID 3688 wrote to memory of 3956 3688 nnnhbb.exe 104 PID 3956 wrote to memory of 4252 3956 jdvvj.exe 105 PID 3956 wrote to memory of 4252 3956 jdvvj.exe 105 PID 3956 wrote to memory of 4252 3956 jdvvj.exe 105 PID 4252 wrote to memory of 2244 4252 vdpdv.exe 106 PID 4252 wrote to memory of 2244 4252 vdpdv.exe 106 PID 4252 wrote to memory of 2244 4252 vdpdv.exe 106 PID 2244 wrote to memory of 4500 2244 xffrlfx.exe 107 PID 2244 wrote to memory of 4500 2244 xffrlfx.exe 107 PID 2244 wrote to memory of 4500 2244 xffrlfx.exe 107 PID 4500 wrote to memory of 3792 4500 pdddv.exe 108 PID 4500 wrote to memory of 3792 4500 pdddv.exe 108 PID 4500 wrote to memory of 3792 4500 pdddv.exe 108 PID 3792 wrote to memory of 5016 3792 djppd.exe 109 PID 3792 wrote to memory of 5016 3792 djppd.exe 109 PID 3792 wrote to memory of 5016 3792 djppd.exe 109 PID 5016 wrote to memory of 3268 5016 xflfxxr.exe 110 PID 5016 wrote to memory of 3268 5016 xflfxxr.exe 110 PID 5016 wrote to memory of 3268 5016 xflfxxr.exe 110 PID 3268 wrote to memory of 1160 3268 9bbnbb.exe 111 PID 3268 wrote to memory of 1160 3268 9bbnbb.exe 111 PID 3268 wrote to memory of 1160 3268 9bbnbb.exe 111 PID 1160 wrote to memory of 796 1160 dvpjv.exe 112 PID 1160 wrote to memory of 796 1160 dvpjv.exe 112 PID 1160 wrote to memory of 796 1160 dvpjv.exe 112 PID 796 wrote to memory of 4316 796 7jvvj.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\37c29458daff98978480a1b7d9bd1e50N.exe"C:\Users\Admin\AppData\Local\Temp\37c29458daff98978480a1b7d9bd1e50N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\7xxlfxr.exec:\7xxlfxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\9bhhbb.exec:\9bhhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\hbnhhb.exec:\hbnhhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\lxrlfll.exec:\lxrlfll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\xxllrrx.exec:\xxllrrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\bnbtnh.exec:\bnbtnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\vppjd.exec:\vppjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\lffxrrl.exec:\lffxrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\ntbbbb.exec:\ntbbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\rflffff.exec:\rflffff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\1llfxrl.exec:\1llfxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\nnnhbb.exec:\nnnhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\jdvvj.exec:\jdvvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\vdpdv.exec:\vdpdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\xffrlfx.exec:\xffrlfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\pdddv.exec:\pdddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\djppd.exec:\djppd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\xflfxxr.exec:\xflfxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\9bbnbb.exec:\9bbnbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\dvpjv.exec:\dvpjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\7jvvj.exec:\7jvvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\rllllfx.exec:\rllllfx.exe23⤵
- Executes dropped EXE
PID:4316 -
\??\c:\rlrllll.exec:\rlrllll.exe24⤵
- Executes dropped EXE
PID:4196 -
\??\c:\bbthnn.exec:\bbthnn.exe25⤵
- Executes dropped EXE
PID:800 -
\??\c:\5ppjp.exec:\5ppjp.exe26⤵
- Executes dropped EXE
PID:3908 -
\??\c:\djjdp.exec:\djjdp.exe27⤵PID:4536
-
\??\c:\fflfllx.exec:\fflfllx.exe28⤵
- Executes dropped EXE
PID:456 -
\??\c:\1bhhnn.exec:\1bhhnn.exe29⤵
- Executes dropped EXE
PID:5020 -
\??\c:\3bnnhn.exec:\3bnnhn.exe30⤵
- Executes dropped EXE
PID:2020 -
\??\c:\1djdp.exec:\1djdp.exe31⤵
- Executes dropped EXE
PID:1500 -
\??\c:\rfllfll.exec:\rfllfll.exe32⤵
- Executes dropped EXE
PID:1428 -
\??\c:\bhnnhn.exec:\bhnnhn.exe33⤵
- Executes dropped EXE
PID:4976 -
\??\c:\pdpvp.exec:\pdpvp.exe34⤵
- Executes dropped EXE
PID:1496 -
\??\c:\frllrxr.exec:\frllrxr.exe35⤵
- Executes dropped EXE
PID:3384 -
\??\c:\btttbb.exec:\btttbb.exe36⤵
- Executes dropped EXE
PID:1488 -
\??\c:\3pjjj.exec:\3pjjj.exe37⤵
- Executes dropped EXE
PID:1836 -
\??\c:\jdddp.exec:\jdddp.exe38⤵
- Executes dropped EXE
PID:2268 -
\??\c:\ffrrfll.exec:\ffrrfll.exe39⤵
- Executes dropped EXE
PID:5048 -
\??\c:\hbtthh.exec:\hbtthh.exe40⤵
- Executes dropped EXE
PID:3632 -
\??\c:\hnhbbb.exec:\hnhbbb.exe41⤵
- Executes dropped EXE
PID:408 -
\??\c:\7vjdv.exec:\7vjdv.exe42⤵
- Executes dropped EXE
PID:2560 -
\??\c:\3lxxrxx.exec:\3lxxrxx.exe43⤵
- Executes dropped EXE
PID:1988 -
\??\c:\tthttb.exec:\tthttb.exe44⤵
- Executes dropped EXE
PID:3688 -
\??\c:\jjjvp.exec:\jjjvp.exe45⤵
- Executes dropped EXE
PID:4476 -
\??\c:\1rrfxrr.exec:\1rrfxrr.exe46⤵
- Executes dropped EXE
PID:748 -
\??\c:\rlffxfx.exec:\rlffxfx.exe47⤵
- Executes dropped EXE
PID:4628 -
\??\c:\bttttb.exec:\bttttb.exe48⤵
- Executes dropped EXE
PID:2840 -
\??\c:\jpppd.exec:\jpppd.exe49⤵
- Executes dropped EXE
PID:1864 -
\??\c:\vjjjd.exec:\vjjjd.exe50⤵
- Executes dropped EXE
PID:4916 -
\??\c:\nhbbtb.exec:\nhbbtb.exe51⤵
- Executes dropped EXE
PID:948 -
\??\c:\3bnnbb.exec:\3bnnbb.exe52⤵
- Executes dropped EXE
PID:4000 -
\??\c:\dvvvp.exec:\dvvvp.exe53⤵
- Executes dropped EXE
PID:1184 -
\??\c:\jpvvj.exec:\jpvvj.exe54⤵
- Executes dropped EXE
PID:3060 -
\??\c:\xflrlll.exec:\xflrlll.exe55⤵
- Executes dropped EXE
PID:2972 -
\??\c:\5fxrlrl.exec:\5fxrlrl.exe56⤵
- Executes dropped EXE
PID:4632 -
\??\c:\pppjj.exec:\pppjj.exe57⤵
- Executes dropped EXE
PID:4528 -
\??\c:\vvvpj.exec:\vvvpj.exe58⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xfllflx.exec:\xfllflx.exe59⤵
- Executes dropped EXE
PID:4768 -
\??\c:\lxfflxr.exec:\lxfflxr.exe60⤵
- Executes dropped EXE
PID:4536 -
\??\c:\hhnntt.exec:\hhnntt.exe61⤵
- Executes dropped EXE
PID:456 -
\??\c:\djppv.exec:\djppv.exe62⤵
- Executes dropped EXE
PID:3884 -
\??\c:\lfllxfr.exec:\lfllxfr.exe63⤵
- Executes dropped EXE
PID:3780 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe64⤵
- Executes dropped EXE
PID:4888 -
\??\c:\nhbnnn.exec:\nhbnnn.exe65⤵
- Executes dropped EXE
PID:1500 -
\??\c:\3djdv.exec:\3djdv.exe66⤵
- Executes dropped EXE
PID:1928 -
\??\c:\lflfxfx.exec:\lflfxfx.exe67⤵PID:1396
-
\??\c:\vjddd.exec:\vjddd.exe68⤵PID:1736
-
\??\c:\lfxxrll.exec:\lfxxrll.exe69⤵PID:2472
-
\??\c:\ffffflf.exec:\ffffflf.exe70⤵PID:996
-
\??\c:\nbbbbb.exec:\nbbbbb.exe71⤵PID:4836
-
\??\c:\7bbhbh.exec:\7bbhbh.exe72⤵PID:1452
-
\??\c:\pvvvp.exec:\pvvvp.exe73⤵PID:3932
-
\??\c:\3rrrxxl.exec:\3rrrxxl.exe74⤵PID:4396
-
\??\c:\7fffrxf.exec:\7fffrxf.exe75⤵PID:1248
-
\??\c:\nbbttn.exec:\nbbttn.exe76⤵PID:3108
-
\??\c:\jjppj.exec:\jjppj.exe77⤵PID:8
-
\??\c:\fffxrrr.exec:\fffxrrr.exe78⤵PID:1212
-
\??\c:\xrllxxf.exec:\xrllxxf.exe79⤵PID:224
-
\??\c:\hbbbhn.exec:\hbbbhn.exe80⤵PID:1484
-
\??\c:\jdppv.exec:\jdppv.exe81⤵PID:4552
-
\??\c:\djppd.exec:\djppd.exe82⤵PID:3076
-
\??\c:\llxlffx.exec:\llxlffx.exe83⤵PID:2016
-
\??\c:\thhbtb.exec:\thhbtb.exe84⤵PID:5096
-
\??\c:\ttbbbh.exec:\ttbbbh.exe85⤵PID:3904
-
\??\c:\dpdvp.exec:\dpdvp.exe86⤵PID:2656
-
\??\c:\djjjd.exec:\djjjd.exe87⤵PID:4024
-
\??\c:\xxffrrx.exec:\xxffrrx.exe88⤵PID:816
-
\??\c:\9xrxrxx.exec:\9xrxrxx.exe89⤵PID:3160
-
\??\c:\ttnnnn.exec:\ttnnnn.exe90⤵PID:4196
-
\??\c:\nhbbtt.exec:\nhbbtt.exe91⤵PID:4800
-
\??\c:\jdpjj.exec:\jdpjj.exe92⤵PID:4368
-
\??\c:\vjvjj.exec:\vjvjj.exe93⤵PID:1628
-
\??\c:\flxrxxx.exec:\flxrxxx.exe94⤵PID:4940
-
\??\c:\hbhbbb.exec:\hbhbbb.exe95⤵PID:4536
-
\??\c:\tnhhbh.exec:\tnhhbh.exe96⤵PID:4856
-
\??\c:\5ppjd.exec:\5ppjd.exe97⤵PID:2392
-
\??\c:\3ddvp.exec:\3ddvp.exe98⤵PID:4328
-
\??\c:\7llxxrr.exec:\7llxxrr.exe99⤵PID:2856
-
\??\c:\nhttbb.exec:\nhttbb.exe100⤵PID:1096
-
\??\c:\tnttbh.exec:\tnttbh.exe101⤵PID:3336
-
\??\c:\vpjjv.exec:\vpjjv.exe102⤵PID:3132
-
\??\c:\xflfxxr.exec:\xflfxxr.exe103⤵PID:396
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe104⤵PID:2472
-
\??\c:\3thhnh.exec:\3thhnh.exe105⤵PID:1204
-
\??\c:\3hnnhh.exec:\3hnnhh.exe106⤵PID:3512
-
\??\c:\9thbhh.exec:\9thbhh.exe107⤵PID:1452
-
\??\c:\ppdjj.exec:\ppdjj.exe108⤵PID:2208
-
\??\c:\xxxxrlf.exec:\xxxxrlf.exe109⤵PID:3632
-
\??\c:\9bhntt.exec:\9bhntt.exe110⤵PID:1248
-
\??\c:\hthbtt.exec:\hthbtt.exe111⤵PID:3944
-
\??\c:\dvppp.exec:\dvppp.exe112⤵PID:1564
-
\??\c:\xffrffr.exec:\xffrffr.exe113⤵PID:4476
-
\??\c:\bbbhhh.exec:\bbbhhh.exe114⤵PID:748
-
\??\c:\5jjdv.exec:\5jjdv.exe115⤵PID:2096
-
\??\c:\frfxxrr.exec:\frfxxrr.exe116⤵PID:4984
-
\??\c:\5rllfll.exec:\5rllfll.exe117⤵PID:2504
-
\??\c:\hhbbtt.exec:\hhbbtt.exe118⤵PID:2044
-
\??\c:\ppvpp.exec:\ppvpp.exe119⤵PID:3268
-
\??\c:\dpvjd.exec:\dpvjd.exe120⤵PID:3904
-
\??\c:\llflfll.exec:\llflfll.exe121⤵PID:2304
-
\??\c:\btbbbb.exec:\btbbbb.exe122⤵PID:2572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-