Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
21/07/2024, 23:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b496769513b4829e7e99aa4d959d000N.exe
Resource
win7-20240705-en
5 signatures
120 seconds
General
-
Target
2b496769513b4829e7e99aa4d959d000N.exe
-
Size
68KB
-
MD5
2b496769513b4829e7e99aa4d959d000
-
SHA1
3dfc221ece2143eac1753ae58d28204a834e1ffb
-
SHA256
6d58231936d99404657a49ad23138bbfa9427531d791e38d8e64ba08d2e1f9d9
-
SHA512
f3e8352b9319775494239aeb21508f26ee470692ec9a2b054494c64c619c51bea600474eb2bbcfc6f24bfc43ff3ba011f6014d459fe68056f8b424392fb1f8ef
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfUci4IO:ymb3NkkiQ3mdBjFI4V4ci4IO
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4092-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/412-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/312-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2564-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2872-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/804-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1296-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3672 nthtbt.exe 1536 5pdvp.exe 4072 lffxlrr.exe 4404 nbbntb.exe 412 pvvvp.exe 4628 dvddv.exe 1736 llrlffx.exe 3956 nntbbb.exe 312 jvjpj.exe 3448 xflfffr.exe 1048 jppdp.exe 2564 fxrllll.exe 2872 thtthn.exe 2344 vvjvp.exe 2072 lxffflx.exe 804 rlrxxxf.exe 3940 jpvvd.exe 3948 ppjjv.exe 4208 fxxllxx.exe 1296 jpdvp.exe 2980 xxrrlxx.exe 4912 hbbntb.exe 4856 jjjvv.exe 3240 3xxrrrl.exe 5064 5ntttb.exe 4772 pppvj.exe 3644 xlxfrxf.exe 1816 fxffffx.exe 3516 nnthnt.exe 2760 pvvvp.exe 2836 9xllrrl.exe 4028 bbtnbt.exe 3892 jpvdp.exe 3912 rrlrrff.exe 3236 lffflfr.exe 2316 hbnnnt.exe 2672 9dppj.exe 2240 vvppj.exe 4448 rrxlfxx.exe 4928 hnbbtt.exe 4744 vjvvd.exe 4260 djjpj.exe 3048 fxfffll.exe 4524 1ffllll.exe 4916 nntttt.exe 436 pjppv.exe 4628 3lfxxff.exe 964 9tbbbh.exe 3040 pdpjv.exe 2792 xxxfllx.exe 1436 bthbbb.exe 1168 bttntb.exe 3028 ppdjv.exe 2788 djddp.exe 4168 rrrrrxr.exe 3868 tthbht.exe 1320 jpddp.exe 4732 lrrxrfl.exe 4032 thhhhn.exe 2752 tnhhhh.exe 400 vpppp.exe 3216 ffllrrr.exe 3872 3xxrfll.exe 3076 tbbhhn.exe -
resource yara_rule behavioral2/memory/4092-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/412-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/312-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2564-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2872-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/804-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4092 wrote to memory of 3672 4092 2b496769513b4829e7e99aa4d959d000N.exe 83 PID 4092 wrote to memory of 3672 4092 2b496769513b4829e7e99aa4d959d000N.exe 83 PID 4092 wrote to memory of 3672 4092 2b496769513b4829e7e99aa4d959d000N.exe 83 PID 3672 wrote to memory of 1536 3672 nthtbt.exe 84 PID 3672 wrote to memory of 1536 3672 nthtbt.exe 84 PID 3672 wrote to memory of 1536 3672 nthtbt.exe 84 PID 1536 wrote to memory of 4072 1536 5pdvp.exe 85 PID 1536 wrote to memory of 4072 1536 5pdvp.exe 85 PID 1536 wrote to memory of 4072 1536 5pdvp.exe 85 PID 4072 wrote to memory of 4404 4072 lffxlrr.exe 86 PID 4072 wrote to memory of 4404 4072 lffxlrr.exe 86 PID 4072 wrote to memory of 4404 4072 lffxlrr.exe 86 PID 4404 wrote to memory of 412 4404 nbbntb.exe 87 PID 4404 wrote to memory of 412 4404 nbbntb.exe 87 PID 4404 wrote to memory of 412 4404 nbbntb.exe 87 PID 412 wrote to memory of 4628 412 pvvvp.exe 88 PID 412 wrote to memory of 4628 412 pvvvp.exe 88 PID 412 wrote to memory of 4628 412 pvvvp.exe 88 PID 4628 wrote to memory of 1736 4628 dvddv.exe 89 PID 4628 wrote to memory of 1736 4628 dvddv.exe 89 PID 4628 wrote to memory of 1736 4628 dvddv.exe 89 PID 1736 wrote to memory of 3956 1736 llrlffx.exe 90 PID 1736 wrote to memory of 3956 1736 llrlffx.exe 90 PID 1736 wrote to memory of 3956 1736 llrlffx.exe 90 PID 3956 wrote to memory of 312 3956 nntbbb.exe 91 PID 3956 wrote to memory of 312 3956 nntbbb.exe 91 PID 3956 wrote to memory of 312 3956 nntbbb.exe 91 PID 312 wrote to memory of 3448 312 jvjpj.exe 92 PID 312 wrote to memory of 3448 312 jvjpj.exe 92 PID 312 wrote to memory of 3448 312 jvjpj.exe 92 PID 3448 wrote to memory of 1048 3448 xflfffr.exe 93 PID 3448 wrote to memory of 1048 3448 xflfffr.exe 93 PID 3448 wrote to memory of 1048 3448 xflfffr.exe 93 PID 1048 wrote to memory of 2564 1048 jppdp.exe 94 PID 1048 wrote to memory of 2564 1048 jppdp.exe 94 PID 1048 wrote to memory of 2564 1048 jppdp.exe 94 PID 2564 wrote to memory of 2872 2564 fxrllll.exe 95 PID 2564 wrote to memory of 2872 2564 fxrllll.exe 95 PID 2564 wrote to memory of 2872 2564 fxrllll.exe 95 PID 2872 wrote to memory of 2344 2872 thtthn.exe 96 PID 2872 wrote to memory of 2344 2872 thtthn.exe 96 PID 2872 wrote to memory of 2344 2872 thtthn.exe 96 PID 2344 wrote to memory of 2072 2344 vvjvp.exe 97 PID 2344 wrote to memory of 2072 2344 vvjvp.exe 97 PID 2344 wrote to memory of 2072 2344 vvjvp.exe 97 PID 2072 wrote to memory of 804 2072 lxffflx.exe 98 PID 2072 wrote to memory of 804 2072 lxffflx.exe 98 PID 2072 wrote to memory of 804 2072 lxffflx.exe 98 PID 804 wrote to memory of 3940 804 rlrxxxf.exe 99 PID 804 wrote to memory of 3940 804 rlrxxxf.exe 99 PID 804 wrote to memory of 3940 804 rlrxxxf.exe 99 PID 3940 wrote to memory of 3948 3940 jpvvd.exe 101 PID 3940 wrote to memory of 3948 3940 jpvvd.exe 101 PID 3940 wrote to memory of 3948 3940 jpvvd.exe 101 PID 3948 wrote to memory of 4208 3948 ppjjv.exe 102 PID 3948 wrote to memory of 4208 3948 ppjjv.exe 102 PID 3948 wrote to memory of 4208 3948 ppjjv.exe 102 PID 4208 wrote to memory of 1296 4208 fxxllxx.exe 103 PID 4208 wrote to memory of 1296 4208 fxxllxx.exe 103 PID 4208 wrote to memory of 1296 4208 fxxllxx.exe 103 PID 1296 wrote to memory of 2980 1296 jpdvp.exe 104 PID 1296 wrote to memory of 2980 1296 jpdvp.exe 104 PID 1296 wrote to memory of 2980 1296 jpdvp.exe 104 PID 2980 wrote to memory of 4912 2980 xxrrlxx.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b496769513b4829e7e99aa4d959d000N.exe"C:\Users\Admin\AppData\Local\Temp\2b496769513b4829e7e99aa4d959d000N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\nthtbt.exec:\nthtbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\5pdvp.exec:\5pdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\lffxlrr.exec:\lffxlrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\nbbntb.exec:\nbbntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\pvvvp.exec:\pvvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\dvddv.exec:\dvddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\llrlffx.exec:\llrlffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\nntbbb.exec:\nntbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\jvjpj.exec:\jvjpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\xflfffr.exec:\xflfffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\jppdp.exec:\jppdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\fxrllll.exec:\fxrllll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\thtthn.exec:\thtthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\vvjvp.exec:\vvjvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\lxffflx.exec:\lxffflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\rlrxxxf.exec:\rlrxxxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\jpvvd.exec:\jpvvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\ppjjv.exec:\ppjjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\fxxllxx.exec:\fxxllxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\jpdvp.exec:\jpdvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\xxrrlxx.exec:\xxrrlxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\hbbntb.exec:\hbbntb.exe23⤵
- Executes dropped EXE
PID:4912 -
\??\c:\jjjvv.exec:\jjjvv.exe24⤵
- Executes dropped EXE
PID:4856 -
\??\c:\3xxrrrl.exec:\3xxrrrl.exe25⤵
- Executes dropped EXE
PID:3240 -
\??\c:\5ntttb.exec:\5ntttb.exe26⤵
- Executes dropped EXE
PID:5064 -
\??\c:\pppvj.exec:\pppvj.exe27⤵
- Executes dropped EXE
PID:4772 -
\??\c:\xlxfrxf.exec:\xlxfrxf.exe28⤵
- Executes dropped EXE
PID:3644 -
\??\c:\fxffffx.exec:\fxffffx.exe29⤵
- Executes dropped EXE
PID:1816 -
\??\c:\nnthnt.exec:\nnthnt.exe30⤵
- Executes dropped EXE
PID:3516 -
\??\c:\pvvvp.exec:\pvvvp.exe31⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9xllrrl.exec:\9xllrrl.exe32⤵
- Executes dropped EXE
PID:2836 -
\??\c:\bbtnbt.exec:\bbtnbt.exe33⤵
- Executes dropped EXE
PID:4028 -
\??\c:\jpvdp.exec:\jpvdp.exe34⤵
- Executes dropped EXE
PID:3892 -
\??\c:\rrlrrff.exec:\rrlrrff.exe35⤵
- Executes dropped EXE
PID:3912 -
\??\c:\lffflfr.exec:\lffflfr.exe36⤵
- Executes dropped EXE
PID:3236 -
\??\c:\hbnnnt.exec:\hbnnnt.exe37⤵
- Executes dropped EXE
PID:2316 -
\??\c:\9dppj.exec:\9dppj.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\vvppj.exec:\vvppj.exe39⤵
- Executes dropped EXE
PID:2240 -
\??\c:\rrxlfxx.exec:\rrxlfxx.exe40⤵
- Executes dropped EXE
PID:4448 -
\??\c:\hnbbtt.exec:\hnbbtt.exe41⤵
- Executes dropped EXE
PID:4928 -
\??\c:\vjvvd.exec:\vjvvd.exe42⤵
- Executes dropped EXE
PID:4744 -
\??\c:\djjpj.exec:\djjpj.exe43⤵
- Executes dropped EXE
PID:4260 -
\??\c:\fxfffll.exec:\fxfffll.exe44⤵
- Executes dropped EXE
PID:3048 -
\??\c:\1ffllll.exec:\1ffllll.exe45⤵
- Executes dropped EXE
PID:4524 -
\??\c:\nntttt.exec:\nntttt.exe46⤵
- Executes dropped EXE
PID:4916 -
\??\c:\pjppv.exec:\pjppv.exe47⤵
- Executes dropped EXE
PID:436 -
\??\c:\3lfxxff.exec:\3lfxxff.exe48⤵
- Executes dropped EXE
PID:4628 -
\??\c:\9tbbbh.exec:\9tbbbh.exe49⤵
- Executes dropped EXE
PID:964 -
\??\c:\pdpjv.exec:\pdpjv.exe50⤵
- Executes dropped EXE
PID:3040 -
\??\c:\xxxfllx.exec:\xxxfllx.exe51⤵
- Executes dropped EXE
PID:2792 -
\??\c:\bthbbb.exec:\bthbbb.exe52⤵
- Executes dropped EXE
PID:1436 -
\??\c:\bttntb.exec:\bttntb.exe53⤵
- Executes dropped EXE
PID:1168 -
\??\c:\ppdjv.exec:\ppdjv.exe54⤵
- Executes dropped EXE
PID:3028 -
\??\c:\djddp.exec:\djddp.exe55⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rrrrrxr.exec:\rrrrrxr.exe56⤵
- Executes dropped EXE
PID:4168 -
\??\c:\tthbht.exec:\tthbht.exe57⤵
- Executes dropped EXE
PID:3868 -
\??\c:\jpddp.exec:\jpddp.exe58⤵
- Executes dropped EXE
PID:1320 -
\??\c:\lrrxrfl.exec:\lrrxrfl.exe59⤵
- Executes dropped EXE
PID:4732 -
\??\c:\thhhhn.exec:\thhhhn.exe60⤵
- Executes dropped EXE
PID:4032 -
\??\c:\tnhhhh.exec:\tnhhhh.exe61⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vpppp.exec:\vpppp.exe62⤵
- Executes dropped EXE
PID:400 -
\??\c:\ffllrrr.exec:\ffllrrr.exe63⤵
- Executes dropped EXE
PID:3216 -
\??\c:\3xxrfll.exec:\3xxrfll.exe64⤵
- Executes dropped EXE
PID:3872 -
\??\c:\tbbhhn.exec:\tbbhhn.exe65⤵
- Executes dropped EXE
PID:3076 -
\??\c:\dpvpp.exec:\dpvpp.exe66⤵PID:1296
-
\??\c:\3xffffr.exec:\3xffffr.exe67⤵PID:4068
-
\??\c:\ffllfxx.exec:\ffllfxx.exe68⤵PID:3592
-
\??\c:\nthnnt.exec:\nthnnt.exe69⤵PID:4392
-
\??\c:\ddvvv.exec:\ddvvv.exe70⤵PID:1388
-
\??\c:\bbbtnb.exec:\bbbtnb.exe71⤵PID:4856
-
\??\c:\hthtbh.exec:\hthtbh.exe72⤵PID:912
-
\??\c:\dpdpp.exec:\dpdpp.exe73⤵PID:3404
-
\??\c:\rxfflrr.exec:\rxfflrr.exe74⤵PID:1464
-
\??\c:\btbnbn.exec:\btbnbn.exe75⤵PID:1420
-
\??\c:\5jpvp.exec:\5jpvp.exe76⤵PID:3748
-
\??\c:\jpjjj.exec:\jpjjj.exe77⤵PID:4220
-
\??\c:\frllrxf.exec:\frllrxf.exe78⤵PID:5104
-
\??\c:\btbhnn.exec:\btbhnn.exe79⤵PID:396
-
\??\c:\pvjpv.exec:\pvjpv.exe80⤵PID:4300
-
\??\c:\lfrflrx.exec:\lfrflrx.exe81⤵PID:3328
-
\??\c:\hbthnt.exec:\hbthnt.exe82⤵PID:3892
-
\??\c:\bhhttt.exec:\bhhttt.exe83⤵PID:5112
-
\??\c:\vpvdp.exec:\vpvdp.exe84⤵PID:4360
-
\??\c:\frlllrl.exec:\frlllrl.exe85⤵PID:4416
-
\??\c:\nthnbb.exec:\nthnbb.exe86⤵PID:3804
-
\??\c:\7bbbtb.exec:\7bbbtb.exe87⤵PID:4868
-
\??\c:\jpdvd.exec:\jpdvd.exe88⤵PID:2540
-
\??\c:\ffrxlxx.exec:\ffrxlxx.exe89⤵PID:3044
-
\??\c:\tnbthh.exec:\tnbthh.exe90⤵PID:3048
-
\??\c:\7lxxrrr.exec:\7lxxrrr.exe91⤵PID:3092
-
\??\c:\nttttt.exec:\nttttt.exe92⤵PID:4336
-
\??\c:\vvvpp.exec:\vvvpp.exe93⤵PID:4404
-
\??\c:\vpvpp.exec:\vpvpp.exe94⤵PID:4316
-
\??\c:\fffxfff.exec:\fffxfff.exe95⤵PID:3624
-
\??\c:\htbttb.exec:\htbttb.exe96⤵PID:2068
-
\??\c:\dvvpj.exec:\dvvpj.exe97⤵PID:3956
-
\??\c:\7lrrlrr.exec:\7lrrlrr.exe98⤵PID:4716
-
\??\c:\ttttbh.exec:\ttttbh.exe99⤵PID:100
-
\??\c:\jvvdd.exec:\jvvdd.exe100⤵PID:1008
-
\??\c:\lfffxxx.exec:\lfffxxx.exe101⤵PID:2716
-
\??\c:\jpdvp.exec:\jpdvp.exe102⤵PID:4988
-
\??\c:\pppjj.exec:\pppjj.exe103⤵PID:2076
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe104⤵PID:2224
-
\??\c:\nhnnbh.exec:\nhnnbh.exe105⤵PID:1976
-
\??\c:\jdppj.exec:\jdppj.exe106⤵PID:5068
-
\??\c:\lxxxrff.exec:\lxxxrff.exe107⤵PID:2612
-
\??\c:\nhnntt.exec:\nhnntt.exe108⤵PID:4080
-
\??\c:\djjdj.exec:\djjdj.exe109⤵PID:3392
-
\??\c:\9lfxrfx.exec:\9lfxrfx.exe110⤵PID:3376
-
\??\c:\bttnht.exec:\bttnht.exe111⤵PID:2800
-
\??\c:\nhbnnn.exec:\nhbnnn.exe112⤵PID:3308
-
\??\c:\vvpjj.exec:\vvpjj.exe113⤵PID:4912
-
\??\c:\nhhnnt.exec:\nhhnnt.exe114⤵PID:4392
-
\??\c:\dvddd.exec:\dvddd.exe115⤵PID:3700
-
\??\c:\lffxrfx.exec:\lffxrfx.exe116⤵PID:4760
-
\??\c:\lxlfxrr.exec:\lxlfxrr.exe117⤵PID:912
-
\??\c:\ntthtn.exec:\ntthtn.exe118⤵PID:1520
-
\??\c:\vdjjj.exec:\vdjjj.exe119⤵PID:3488
-
\??\c:\lrlfrxx.exec:\lrlfrxx.exe120⤵PID:936
-
\??\c:\fxxxxlr.exec:\fxxxxlr.exe121⤵PID:3748
-
\??\c:\nnhhbb.exec:\nnhhbb.exe122⤵PID:2760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-