Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
21/07/2024, 10:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ac049a6229d96e4451d6b03228d79680N.exe
Resource
win7-20240704-en
5 signatures
120 seconds
General
-
Target
ac049a6229d96e4451d6b03228d79680N.exe
-
Size
83KB
-
MD5
ac049a6229d96e4451d6b03228d79680
-
SHA1
b22ebdbccddea87fc6f2364ea6076a0e8b4e7b4e
-
SHA256
3326111efe62b87d6ab415d126b0c330e13bbb51648aad2d46d8cd6f1667a731
-
SHA512
c3b812a70d7995438ea42d6c14fa22e0b58bd010cb106f0ffc7cc298f9e1b5397ae4ec8e14b8584a73121a1eaabd93b2fa3247178382924ae914e96784bc8003
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73t6MlYqn+jMp9E+zLT71:ymb3NkkiQ3mdBjFo73tvn+Yp9ZD71
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
resource yara_rule behavioral2/memory/3528-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1716-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1988-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/876-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2688-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/544-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5072 pvddj.exe 4992 dvjdd.exe 4252 rfxrrxx.exe 4448 3hhhhn.exe 4824 bbnhbh.exe 5008 jdddd.exe 1968 5llfxff.exe 1496 vpddd.exe 5028 jjvvp.exe 1716 tnhhhn.exe 1736 ppvvv.exe 1988 flllllx.exe 1664 tnnbnn.exe 2968 jjdjd.exe 4608 5vjdp.exe 1152 lxrlxxr.exe 4468 ttbtnh.exe 876 ttnhtn.exe 4896 ppjpp.exe 3664 fxxrrrl.exe 2220 7nnbnh.exe 1280 jdvjd.exe 4764 fxxxxxf.exe 4928 lffxllx.exe 3200 ttnhth.exe 4168 jpvpj.exe 1588 llfrxxr.exe 2688 ttnhbb.exe 4528 ntthtn.exe 2984 3ddvj.exe 544 frfxlxr.exe 4560 lxxffxx.exe 2016 nbnhnn.exe 4900 pjppd.exe 700 pppjp.exe 2100 5llfxxr.exe 1592 1ffxfxf.exe 4476 bnnhtt.exe 4460 thhtnh.exe 4408 ddpdv.exe 2172 fxfrfxl.exe 4512 fxfrrll.exe 3764 bnhhbb.exe 1756 nhbbtb.exe 1072 jdjdv.exe 2768 jjvdv.exe 4976 7xxfxxr.exe 4084 bhnhhh.exe 1984 nbhbtt.exe 220 tnnhbh.exe 1380 dvjvp.exe 4076 xrrllxl.exe 4472 5frlxxl.exe 2604 7nnhhh.exe 4504 ppppp.exe 828 frrxxrl.exe 1896 nthhhh.exe 1088 bbnhnh.exe 1124 xlxxlrx.exe 368 htbbbh.exe 864 jdpjv.exe 5000 jjdvd.exe 3980 llrxffr.exe 4748 bnnhhb.exe -
resource yara_rule behavioral2/memory/3528-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/876-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2688-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/544-216-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3528 wrote to memory of 5072 3528 ac049a6229d96e4451d6b03228d79680N.exe 84 PID 3528 wrote to memory of 5072 3528 ac049a6229d96e4451d6b03228d79680N.exe 84 PID 3528 wrote to memory of 5072 3528 ac049a6229d96e4451d6b03228d79680N.exe 84 PID 5072 wrote to memory of 4992 5072 pvddj.exe 85 PID 5072 wrote to memory of 4992 5072 pvddj.exe 85 PID 5072 wrote to memory of 4992 5072 pvddj.exe 85 PID 4992 wrote to memory of 4252 4992 dvjdd.exe 86 PID 4992 wrote to memory of 4252 4992 dvjdd.exe 86 PID 4992 wrote to memory of 4252 4992 dvjdd.exe 86 PID 4252 wrote to memory of 4448 4252 rfxrrxx.exe 87 PID 4252 wrote to memory of 4448 4252 rfxrrxx.exe 87 PID 4252 wrote to memory of 4448 4252 rfxrrxx.exe 87 PID 4448 wrote to memory of 4824 4448 3hhhhn.exe 88 PID 4448 wrote to memory of 4824 4448 3hhhhn.exe 88 PID 4448 wrote to memory of 4824 4448 3hhhhn.exe 88 PID 4824 wrote to memory of 5008 4824 bbnhbh.exe 89 PID 4824 wrote to memory of 5008 4824 bbnhbh.exe 89 PID 4824 wrote to memory of 5008 4824 bbnhbh.exe 89 PID 5008 wrote to memory of 1968 5008 jdddd.exe 90 PID 5008 wrote to memory of 1968 5008 jdddd.exe 90 PID 5008 wrote to memory of 1968 5008 jdddd.exe 90 PID 1968 wrote to memory of 1496 1968 5llfxff.exe 91 PID 1968 wrote to memory of 1496 1968 5llfxff.exe 91 PID 1968 wrote to memory of 1496 1968 5llfxff.exe 91 PID 1496 wrote to memory of 5028 1496 vpddd.exe 92 PID 1496 wrote to memory of 5028 1496 vpddd.exe 92 PID 1496 wrote to memory of 5028 1496 vpddd.exe 92 PID 5028 wrote to memory of 1716 5028 jjvvp.exe 93 PID 5028 wrote to memory of 1716 5028 jjvvp.exe 93 PID 5028 wrote to memory of 1716 5028 jjvvp.exe 93 PID 1716 wrote to memory of 1736 1716 tnhhhn.exe 94 PID 1716 wrote to memory of 1736 1716 tnhhhn.exe 94 PID 1716 wrote to memory of 1736 1716 tnhhhn.exe 94 PID 1736 wrote to memory of 1988 1736 ppvvv.exe 95 PID 1736 wrote to memory of 1988 1736 ppvvv.exe 95 PID 1736 wrote to memory of 1988 1736 ppvvv.exe 95 PID 1988 wrote to memory of 1664 1988 flllllx.exe 96 PID 1988 wrote to memory of 1664 1988 flllllx.exe 96 PID 1988 wrote to memory of 1664 1988 flllllx.exe 96 PID 1664 wrote to memory of 2968 1664 tnnbnn.exe 97 PID 1664 wrote to memory of 2968 1664 tnnbnn.exe 97 PID 1664 wrote to memory of 2968 1664 tnnbnn.exe 97 PID 2968 wrote to memory of 4608 2968 jjdjd.exe 98 PID 2968 wrote to memory of 4608 2968 jjdjd.exe 98 PID 2968 wrote to memory of 4608 2968 jjdjd.exe 98 PID 4608 wrote to memory of 1152 4608 5vjdp.exe 99 PID 4608 wrote to memory of 1152 4608 5vjdp.exe 99 PID 4608 wrote to memory of 1152 4608 5vjdp.exe 99 PID 1152 wrote to memory of 4468 1152 lxrlxxr.exe 100 PID 1152 wrote to memory of 4468 1152 lxrlxxr.exe 100 PID 1152 wrote to memory of 4468 1152 lxrlxxr.exe 100 PID 4468 wrote to memory of 876 4468 ttbtnh.exe 101 PID 4468 wrote to memory of 876 4468 ttbtnh.exe 101 PID 4468 wrote to memory of 876 4468 ttbtnh.exe 101 PID 876 wrote to memory of 4896 876 ttnhtn.exe 102 PID 876 wrote to memory of 4896 876 ttnhtn.exe 102 PID 876 wrote to memory of 4896 876 ttnhtn.exe 102 PID 4896 wrote to memory of 3664 4896 ppjpp.exe 103 PID 4896 wrote to memory of 3664 4896 ppjpp.exe 103 PID 4896 wrote to memory of 3664 4896 ppjpp.exe 103 PID 3664 wrote to memory of 2220 3664 fxxrrrl.exe 104 PID 3664 wrote to memory of 2220 3664 fxxrrrl.exe 104 PID 3664 wrote to memory of 2220 3664 fxxrrrl.exe 104 PID 2220 wrote to memory of 1280 2220 7nnbnh.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac049a6229d96e4451d6b03228d79680N.exe"C:\Users\Admin\AppData\Local\Temp\ac049a6229d96e4451d6b03228d79680N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\pvddj.exec:\pvddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\dvjdd.exec:\dvjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\rfxrrxx.exec:\rfxrrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\3hhhhn.exec:\3hhhhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\bbnhbh.exec:\bbnhbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\jdddd.exec:\jdddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\5llfxff.exec:\5llfxff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\vpddd.exec:\vpddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\jjvvp.exec:\jjvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\tnhhhn.exec:\tnhhhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\ppvvv.exec:\ppvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\flllllx.exec:\flllllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\tnnbnn.exec:\tnnbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\jjdjd.exec:\jjdjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\5vjdp.exec:\5vjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\lxrlxxr.exec:\lxrlxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\ttbtnh.exec:\ttbtnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\ttnhtn.exec:\ttnhtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\ppjpp.exec:\ppjpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\7nnbnh.exec:\7nnbnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\jdvjd.exec:\jdvjd.exe23⤵
- Executes dropped EXE
PID:1280 -
\??\c:\fxxxxxf.exec:\fxxxxxf.exe24⤵
- Executes dropped EXE
PID:4764 -
\??\c:\lffxllx.exec:\lffxllx.exe25⤵
- Executes dropped EXE
PID:4928 -
\??\c:\ttnhth.exec:\ttnhth.exe26⤵
- Executes dropped EXE
PID:3200 -
\??\c:\jpvpj.exec:\jpvpj.exe27⤵
- Executes dropped EXE
PID:4168 -
\??\c:\llfrxxr.exec:\llfrxxr.exe28⤵
- Executes dropped EXE
PID:1588 -
\??\c:\ttnhbb.exec:\ttnhbb.exe29⤵
- Executes dropped EXE
PID:2688 -
\??\c:\ntthtn.exec:\ntthtn.exe30⤵
- Executes dropped EXE
PID:4528 -
\??\c:\3ddvj.exec:\3ddvj.exe31⤵
- Executes dropped EXE
PID:2984 -
\??\c:\frfxlxr.exec:\frfxlxr.exe32⤵
- Executes dropped EXE
PID:544 -
\??\c:\lxxffxx.exec:\lxxffxx.exe33⤵
- Executes dropped EXE
PID:4560 -
\??\c:\nbnhnn.exec:\nbnhnn.exe34⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pjppd.exec:\pjppd.exe35⤵
- Executes dropped EXE
PID:4900 -
\??\c:\pppjp.exec:\pppjp.exe36⤵
- Executes dropped EXE
PID:700 -
\??\c:\5llfxxr.exec:\5llfxxr.exe37⤵
- Executes dropped EXE
PID:2100 -
\??\c:\1ffxfxf.exec:\1ffxfxf.exe38⤵
- Executes dropped EXE
PID:1592 -
\??\c:\bnnhtt.exec:\bnnhtt.exe39⤵
- Executes dropped EXE
PID:4476 -
\??\c:\thhtnh.exec:\thhtnh.exe40⤵
- Executes dropped EXE
PID:4460 -
\??\c:\ddpdv.exec:\ddpdv.exe41⤵
- Executes dropped EXE
PID:4408 -
\??\c:\fxfrfxl.exec:\fxfrfxl.exe42⤵
- Executes dropped EXE
PID:2172 -
\??\c:\fxfrrll.exec:\fxfrrll.exe43⤵
- Executes dropped EXE
PID:4512 -
\??\c:\bnhhbb.exec:\bnhhbb.exe44⤵
- Executes dropped EXE
PID:3764 -
\??\c:\nhbbtb.exec:\nhbbtb.exe45⤵
- Executes dropped EXE
PID:1756 -
\??\c:\jdjdv.exec:\jdjdv.exe46⤵
- Executes dropped EXE
PID:1072 -
\??\c:\jjvdv.exec:\jjvdv.exe47⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7xxfxxr.exec:\7xxfxxr.exe48⤵
- Executes dropped EXE
PID:4976 -
\??\c:\bhnhhh.exec:\bhnhhh.exe49⤵
- Executes dropped EXE
PID:4084 -
\??\c:\nbhbtt.exec:\nbhbtt.exe50⤵
- Executes dropped EXE
PID:1984 -
\??\c:\tnnhbh.exec:\tnnhbh.exe51⤵
- Executes dropped EXE
PID:220 -
\??\c:\dvjvp.exec:\dvjvp.exe52⤵
- Executes dropped EXE
PID:1380 -
\??\c:\xrrllxl.exec:\xrrllxl.exe53⤵
- Executes dropped EXE
PID:4076 -
\??\c:\5frlxxl.exec:\5frlxxl.exe54⤵
- Executes dropped EXE
PID:4472 -
\??\c:\7nnhhh.exec:\7nnhhh.exe55⤵
- Executes dropped EXE
PID:2604 -
\??\c:\ppppp.exec:\ppppp.exe56⤵
- Executes dropped EXE
PID:4504 -
\??\c:\frrxxrl.exec:\frrxxrl.exe57⤵
- Executes dropped EXE
PID:828 -
\??\c:\nthhhh.exec:\nthhhh.exe58⤵
- Executes dropped EXE
PID:1896 -
\??\c:\bbnhnh.exec:\bbnhnh.exe59⤵
- Executes dropped EXE
PID:1088 -
\??\c:\xlxxlrx.exec:\xlxxlrx.exe60⤵
- Executes dropped EXE
PID:1124 -
\??\c:\htbbbh.exec:\htbbbh.exe61⤵
- Executes dropped EXE
PID:368 -
\??\c:\jdpjv.exec:\jdpjv.exe62⤵
- Executes dropped EXE
PID:864 -
\??\c:\jjdvd.exec:\jjdvd.exe63⤵
- Executes dropped EXE
PID:5000 -
\??\c:\llrxffr.exec:\llrxffr.exe64⤵
- Executes dropped EXE
PID:3980 -
\??\c:\bnnhhb.exec:\bnnhhb.exe65⤵
- Executes dropped EXE
PID:4748 -
\??\c:\bbbbtt.exec:\bbbbtt.exe66⤵PID:3216
-
\??\c:\fxfxlrr.exec:\fxfxlrr.exe67⤵PID:4464
-
\??\c:\rxlxxxx.exec:\rxlxxxx.exe68⤵PID:2396
-
\??\c:\bbtthb.exec:\bbtthb.exe69⤵PID:3684
-
\??\c:\thhbtn.exec:\thhbtn.exe70⤵PID:1000
-
\??\c:\ddjvp.exec:\ddjvp.exe71⤵PID:4220
-
\??\c:\dvjpp.exec:\dvjpp.exe72⤵PID:1452
-
\??\c:\thtntn.exec:\thtntn.exe73⤵PID:2032
-
\??\c:\djjjp.exec:\djjjp.exe74⤵PID:852
-
\??\c:\lfxxxxx.exec:\lfxxxxx.exe75⤵PID:2984
-
\??\c:\hhtnth.exec:\hhtnth.exe76⤵PID:2444
-
\??\c:\jpvvv.exec:\jpvvv.exe77⤵PID:2420
-
\??\c:\vvjdd.exec:\vvjdd.exe78⤵PID:3524
-
\??\c:\xrllxrf.exec:\xrllxrf.exe79⤵PID:4368
-
\??\c:\thbtnb.exec:\thbtnb.exe80⤵PID:4964
-
\??\c:\dpvpv.exec:\dpvpv.exe81⤵PID:1892
-
\??\c:\lxrrrll.exec:\lxrrrll.exe82⤵PID:2976
-
\??\c:\ttnnbb.exec:\ttnnbb.exe83⤵PID:2712
-
\??\c:\bthbbh.exec:\bthbbh.exe84⤵PID:4184
-
\??\c:\vddpj.exec:\vddpj.exe85⤵PID:4008
-
\??\c:\pvjjd.exec:\pvjjd.exe86⤵PID:2124
-
\??\c:\ffxrfff.exec:\ffxrfff.exe87⤵PID:944
-
\??\c:\btbbbb.exec:\btbbbb.exe88⤵PID:1956
-
\??\c:\thnhnh.exec:\thnhnh.exe89⤵PID:4016
-
\??\c:\pvddv.exec:\pvddv.exe90⤵PID:2632
-
\??\c:\frxlrrx.exec:\frxlrrx.exe91⤵PID:2060
-
\??\c:\hnttbb.exec:\hnttbb.exe92⤵PID:4356
-
\??\c:\pjjdp.exec:\pjjdp.exe93⤵PID:4084
-
\??\c:\jpvjd.exec:\jpvjd.exe94⤵PID:3888
-
\??\c:\xrrfrlx.exec:\xrrfrlx.exe95⤵PID:1520
-
\??\c:\hthbtb.exec:\hthbtb.exe96⤵PID:4028
-
\??\c:\tthhtt.exec:\tthhtt.exe97⤵PID:2968
-
\??\c:\jpvvp.exec:\jpvvp.exe98⤵PID:3676
-
\??\c:\rxxxxfr.exec:\rxxxxfr.exe99⤵PID:4712
-
\??\c:\bhhbnb.exec:\bhhbnb.exe100⤵PID:1116
-
\??\c:\djvdd.exec:\djvdd.exe101⤵PID:1112
-
\??\c:\lllrrrl.exec:\lllrrrl.exe102⤵PID:1704
-
\??\c:\xfllrff.exec:\xfllrff.exe103⤵PID:4544
-
\??\c:\nttnbh.exec:\nttnbh.exe104⤵PID:4656
-
\??\c:\ddvvd.exec:\ddvvd.exe105⤵PID:2220
-
\??\c:\5pvjv.exec:\5pvjv.exe106⤵PID:5112
-
\??\c:\rxlrrrx.exec:\rxlrrrx.exe107⤵PID:3368
-
\??\c:\htnnnh.exec:\htnnnh.exe108⤵PID:3952
-
\??\c:\dpvjd.exec:\dpvjd.exe109⤵PID:1660
-
\??\c:\djvdp.exec:\djvdp.exe110⤵PID:4128
-
\??\c:\llflrxf.exec:\llflrxf.exe111⤵PID:4400
-
\??\c:\thnnbn.exec:\thnnbn.exe112⤵PID:3948
-
\??\c:\9xlllrx.exec:\9xlllrx.exe113⤵PID:1644
-
\??\c:\nbttnh.exec:\nbttnh.exe114⤵PID:3104
-
\??\c:\hbntbh.exec:\hbntbh.exe115⤵PID:748
-
\??\c:\9pjjd.exec:\9pjjd.exe116⤵PID:4360
-
\??\c:\xfxrllf.exec:\xfxrllf.exe117⤵PID:3692
-
\??\c:\frlxrrf.exec:\frlxrrf.exe118⤵PID:2908
-
\??\c:\nnnnnt.exec:\nnnnnt.exe119⤵PID:4288
-
\??\c:\btbtnh.exec:\btbtnh.exe120⤵PID:4296
-
\??\c:\djppp.exec:\djppp.exe121⤵PID:4988
-
\??\c:\rrlfflr.exec:\rrlfflr.exe122⤵PID:4368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-