Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13/05/2021, 12:29 UTC
Static task
static1
Behavioral task
behavioral1
Sample
f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe
Resource
win10v20210410
0 signatures
0 seconds
General
-
Target
f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe
-
Size
94KB
-
MD5
fa561f5076f3425f1d910882f7096bc1
-
SHA1
aa6e59d89ca18465328f2a9dfe534d8ce1a87b57
-
SHA256
f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255
-
SHA512
a64a0cb7b51937bc47486d91911ccf453dd44a02897d5ccc5113beaa8f14f4d1efc9ce25e8fce9e4b477d2d26ce949a315d51fbf6f09a30954a6461c5244d384
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 428 lthrjlv.exe 3836 ltfnvnl.exe 3172 jfbhdf.exe 616 njvvd.exe 1172 bnfrj.exe 1424 bxxrrd.exe 1820 vndrnp.exe 2168 rpjxnff.exe 2384 rvjvprp.exe 2452 ndbbf.exe 2856 lvtvj.exe 2976 vfhjpdh.exe 3860 rhllj.exe 1224 tdfhx.exe 2128 fnxlf.exe 2644 pjtlbff.exe 2824 htpbb.exe 660 tjblv.exe 908 ltpdv.exe 1156 nbnftbl.exe 3904 xftjjh.exe 1644 vvnjfp.exe 1808 vjnxlj.exe 2344 rxfbvt.exe 2388 hvbnx.exe 2732 drnjvfb.exe 2892 rtjnvb.exe 2976 tnbrtn.exe 1092 hdjtxt.exe 2128 hbjjrpn.exe 2644 fdnnrf.exe 824 frbhvr.exe 3172 pnltxh.exe 1168 ddbllf.exe 1784 vdvtp.exe 1932 hbjbnt.exe 1644 hltrlrf.exe 1808 rhjhd.exe 2336 tplfl.exe 2476 llfrftx.exe 2452 frtfb.exe 2732 jtjllt.exe 3340 nbpbrf.exe 2112 tlrrl.exe 4068 xpvvbr.exe 296 dnhpvdj.exe 3492 rvhndrx.exe 1512 hvtvt.exe 3980 rnxxpd.exe 2644 nnhll.exe 640 pfjtp.exe 3172 jvtlv.exe 3964 lxtdxnt.exe 1088 jxrxfpp.exe 1768 vfllvvr.exe 860 fhdnffv.exe 2164 bbpnvx.exe 2248 xffff.exe 2336 vdhpnln.exe 3364 npnhtv.exe 1824 hlrtbr.exe 2856 dvdjtx.exe 3616 ndppnb.exe 1224 plrpnt.exe -
resource yara_rule behavioral2/files/0x0008000000000689-115.dat upx behavioral2/files/0x0008000000000689-116.dat upx behavioral2/files/0x000200000001ab53-118.dat upx behavioral2/files/0x000200000001ab53-119.dat upx behavioral2/files/0x000200000001ab54-121.dat upx behavioral2/files/0x000200000001ab54-122.dat upx behavioral2/files/0x000100000001ab58-124.dat upx behavioral2/files/0x000100000001ab58-125.dat upx behavioral2/files/0x000100000001ab59-127.dat upx behavioral2/files/0x000100000001ab59-128.dat upx behavioral2/files/0x000100000001ab5a-130.dat upx behavioral2/files/0x000100000001ab5a-131.dat upx behavioral2/files/0x000100000001ab5b-133.dat upx behavioral2/files/0x000100000001ab5b-134.dat upx behavioral2/files/0x000100000001ab5c-136.dat upx behavioral2/files/0x000100000001ab5c-137.dat upx behavioral2/files/0x000100000001ab5d-139.dat upx behavioral2/files/0x000100000001ab5d-140.dat upx behavioral2/files/0x000100000001ab5e-142.dat upx behavioral2/files/0x000100000001ab5e-143.dat upx behavioral2/files/0x000100000001ab5f-146.dat upx behavioral2/files/0x000100000001ab5f-145.dat upx behavioral2/files/0x000100000001ab60-148.dat upx behavioral2/files/0x000100000001ab60-149.dat upx behavioral2/files/0x000100000001ab61-151.dat upx behavioral2/files/0x000100000001ab61-152.dat upx behavioral2/files/0x000100000001ab62-154.dat upx behavioral2/files/0x000100000001ab62-155.dat upx behavioral2/files/0x000100000001ab63-157.dat upx behavioral2/files/0x000100000001ab63-158.dat upx behavioral2/files/0x000100000001ab64-160.dat upx behavioral2/files/0x000100000001ab64-161.dat upx behavioral2/files/0x000100000001ab65-163.dat upx behavioral2/files/0x000100000001ab65-164.dat upx behavioral2/files/0x000100000001ab66-167.dat upx behavioral2/files/0x000100000001ab66-166.dat upx behavioral2/files/0x000100000001ab68-170.dat upx behavioral2/files/0x000100000001ab68-169.dat upx behavioral2/files/0x000100000001ab69-173.dat upx behavioral2/files/0x000100000001ab6a-175.dat upx behavioral2/files/0x000100000001ab6a-176.dat upx behavioral2/files/0x000100000001ab6b-178.dat upx behavioral2/files/0x000100000001ab6b-179.dat upx behavioral2/files/0x000100000001ab69-172.dat upx behavioral2/files/0x000100000001ab6c-181.dat upx behavioral2/files/0x000100000001ab6c-182.dat upx behavioral2/files/0x000100000001ab6d-184.dat upx behavioral2/files/0x000100000001ab6d-185.dat upx behavioral2/files/0x000100000001ab6e-187.dat upx behavioral2/files/0x000100000001ab6e-188.dat upx behavioral2/files/0x000100000001ab6f-190.dat upx behavioral2/files/0x000100000001ab6f-191.dat upx behavioral2/files/0x000100000001ab70-194.dat upx behavioral2/files/0x000100000001ab70-193.dat upx behavioral2/files/0x000100000001ab71-196.dat upx behavioral2/files/0x000100000001ab71-197.dat upx behavioral2/files/0x000100000001ab72-200.dat upx behavioral2/files/0x000100000001ab72-199.dat upx behavioral2/files/0x000100000001ab73-202.dat upx behavioral2/files/0x000100000001ab73-203.dat upx behavioral2/files/0x000100000001ab74-205.dat upx behavioral2/files/0x000100000001ab74-206.dat upx behavioral2/files/0x000100000001ab75-209.dat upx behavioral2/files/0x000100000001ab75-208.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4048 wrote to memory of 428 4048 f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe 73 PID 4048 wrote to memory of 428 4048 f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe 73 PID 4048 wrote to memory of 428 4048 f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe 73 PID 428 wrote to memory of 3836 428 lthrjlv.exe 74 PID 428 wrote to memory of 3836 428 lthrjlv.exe 74 PID 428 wrote to memory of 3836 428 lthrjlv.exe 74 PID 3836 wrote to memory of 3172 3836 ltfnvnl.exe 75 PID 3836 wrote to memory of 3172 3836 ltfnvnl.exe 75 PID 3836 wrote to memory of 3172 3836 ltfnvnl.exe 75 PID 3172 wrote to memory of 616 3172 jfbhdf.exe 76 PID 3172 wrote to memory of 616 3172 jfbhdf.exe 76 PID 3172 wrote to memory of 616 3172 jfbhdf.exe 76 PID 616 wrote to memory of 1172 616 njvvd.exe 77 PID 616 wrote to memory of 1172 616 njvvd.exe 77 PID 616 wrote to memory of 1172 616 njvvd.exe 77 PID 1172 wrote to memory of 1424 1172 bnfrj.exe 78 PID 1172 wrote to memory of 1424 1172 bnfrj.exe 78 PID 1172 wrote to memory of 1424 1172 bnfrj.exe 78 PID 1424 wrote to memory of 1820 1424 bxxrrd.exe 79 PID 1424 wrote to memory of 1820 1424 bxxrrd.exe 79 PID 1424 wrote to memory of 1820 1424 bxxrrd.exe 79 PID 1820 wrote to memory of 2168 1820 vndrnp.exe 81 PID 1820 wrote to memory of 2168 1820 vndrnp.exe 81 PID 1820 wrote to memory of 2168 1820 vndrnp.exe 81 PID 2168 wrote to memory of 2384 2168 rpjxnff.exe 82 PID 2168 wrote to memory of 2384 2168 rpjxnff.exe 82 PID 2168 wrote to memory of 2384 2168 rpjxnff.exe 82 PID 2384 wrote to memory of 2452 2384 rvjvprp.exe 83 PID 2384 wrote to memory of 2452 2384 rvjvprp.exe 83 PID 2384 wrote to memory of 2452 2384 rvjvprp.exe 83 PID 2452 wrote to memory of 2856 2452 ndbbf.exe 84 PID 2452 wrote to memory of 2856 2452 ndbbf.exe 84 PID 2452 wrote to memory of 2856 2452 ndbbf.exe 84 PID 2856 wrote to memory of 2976 2856 lvtvj.exe 85 PID 2856 wrote to memory of 2976 2856 lvtvj.exe 85 PID 2856 wrote to memory of 2976 2856 lvtvj.exe 85 PID 2976 wrote to memory of 3860 2976 vfhjpdh.exe 86 PID 2976 wrote to memory of 3860 2976 vfhjpdh.exe 86 PID 2976 wrote to memory of 3860 2976 vfhjpdh.exe 86 PID 3860 wrote to memory of 1224 3860 rhllj.exe 87 PID 3860 wrote to memory of 1224 3860 rhllj.exe 87 PID 3860 wrote to memory of 1224 3860 rhllj.exe 87 PID 1224 wrote to memory of 2128 1224 tdfhx.exe 88 PID 1224 wrote to memory of 2128 1224 tdfhx.exe 88 PID 1224 wrote to memory of 2128 1224 tdfhx.exe 88 PID 2128 wrote to memory of 2644 2128 fnxlf.exe 89 PID 2128 wrote to memory of 2644 2128 fnxlf.exe 89 PID 2128 wrote to memory of 2644 2128 fnxlf.exe 89 PID 2644 wrote to memory of 2824 2644 pjtlbff.exe 90 PID 2644 wrote to memory of 2824 2644 pjtlbff.exe 90 PID 2644 wrote to memory of 2824 2644 pjtlbff.exe 90 PID 2824 wrote to memory of 660 2824 htpbb.exe 91 PID 2824 wrote to memory of 660 2824 htpbb.exe 91 PID 2824 wrote to memory of 660 2824 htpbb.exe 91 PID 660 wrote to memory of 908 660 tjblv.exe 92 PID 660 wrote to memory of 908 660 tjblv.exe 92 PID 660 wrote to memory of 908 660 tjblv.exe 92 PID 908 wrote to memory of 1156 908 ltpdv.exe 93 PID 908 wrote to memory of 1156 908 ltpdv.exe 93 PID 908 wrote to memory of 1156 908 ltpdv.exe 93 PID 1156 wrote to memory of 3904 1156 nbnftbl.exe 95 PID 1156 wrote to memory of 3904 1156 nbnftbl.exe 95 PID 1156 wrote to memory of 3904 1156 nbnftbl.exe 95 PID 3904 wrote to memory of 1644 3904 xftjjh.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe"C:\Users\Admin\AppData\Local\Temp\f2bbd3321ff53ba6ff46d9e4758d1721fd3fd0b70b1984a7918f3324e8b80255.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\lthrjlv.exec:\lthrjlv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\ltfnvnl.exec:\ltfnvnl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\jfbhdf.exec:\jfbhdf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\njvvd.exec:\njvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
\??\c:\bnfrj.exec:\bnfrj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\bxxrrd.exec:\bxxrrd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\vndrnp.exec:\vndrnp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\rpjxnff.exec:\rpjxnff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\rvjvprp.exec:\rvjvprp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\ndbbf.exec:\ndbbf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\lvtvj.exec:\lvtvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\vfhjpdh.exec:\vfhjpdh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\rhllj.exec:\rhllj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\tdfhx.exec:\tdfhx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\fnxlf.exec:\fnxlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\pjtlbff.exec:\pjtlbff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\htpbb.exec:\htpbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\tjblv.exec:\tjblv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\ltpdv.exec:\ltpdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\nbnftbl.exec:\nbnftbl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\xftjjh.exec:\xftjjh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\vvnjfp.exec:\vvnjfp.exe23⤵
- Executes dropped EXE
PID:1644 -
\??\c:\vjnxlj.exec:\vjnxlj.exe24⤵
- Executes dropped EXE
PID:1808 -
\??\c:\rxfbvt.exec:\rxfbvt.exe25⤵
- Executes dropped EXE
PID:2344 -
\??\c:\hvbnx.exec:\hvbnx.exe26⤵
- Executes dropped EXE
PID:2388 -
\??\c:\drnjvfb.exec:\drnjvfb.exe27⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rtjnvb.exec:\rtjnvb.exe28⤵
- Executes dropped EXE
PID:2892 -
\??\c:\tnbrtn.exec:\tnbrtn.exe29⤵
- Executes dropped EXE
PID:2976 -
\??\c:\hdjtxt.exec:\hdjtxt.exe30⤵
- Executes dropped EXE
PID:1092 -
\??\c:\hbjjrpn.exec:\hbjjrpn.exe31⤵
- Executes dropped EXE
PID:2128 -
\??\c:\fdnnrf.exec:\fdnnrf.exe32⤵
- Executes dropped EXE
PID:2644 -
\??\c:\frbhvr.exec:\frbhvr.exe33⤵
- Executes dropped EXE
PID:824 -
\??\c:\pnltxh.exec:\pnltxh.exe34⤵
- Executes dropped EXE
PID:3172 -
\??\c:\ddbllf.exec:\ddbllf.exe35⤵
- Executes dropped EXE
PID:1168 -
\??\c:\vdvtp.exec:\vdvtp.exe36⤵
- Executes dropped EXE
PID:1784 -
\??\c:\hbjbnt.exec:\hbjbnt.exe37⤵
- Executes dropped EXE
PID:1932 -
\??\c:\hltrlrf.exec:\hltrlrf.exe38⤵
- Executes dropped EXE
PID:1644 -
\??\c:\rhjhd.exec:\rhjhd.exe39⤵
- Executes dropped EXE
PID:1808 -
\??\c:\tplfl.exec:\tplfl.exe40⤵
- Executes dropped EXE
PID:2336 -
\??\c:\llfrftx.exec:\llfrftx.exe41⤵
- Executes dropped EXE
PID:2476 -
\??\c:\frtfb.exec:\frtfb.exe42⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jtjllt.exec:\jtjllt.exe43⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nbpbrf.exec:\nbpbrf.exe44⤵
- Executes dropped EXE
PID:3340 -
\??\c:\tlrrl.exec:\tlrrl.exe45⤵
- Executes dropped EXE
PID:2112 -
\??\c:\xpvvbr.exec:\xpvvbr.exe46⤵
- Executes dropped EXE
PID:4068 -
\??\c:\dnhpvdj.exec:\dnhpvdj.exe47⤵
- Executes dropped EXE
PID:296 -
\??\c:\rvhndrx.exec:\rvhndrx.exe48⤵
- Executes dropped EXE
PID:3492 -
\??\c:\hvtvt.exec:\hvtvt.exe49⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rnxxpd.exec:\rnxxpd.exe50⤵
- Executes dropped EXE
PID:3980 -
\??\c:\nnhll.exec:\nnhll.exe51⤵
- Executes dropped EXE
PID:2644 -
\??\c:\pfjtp.exec:\pfjtp.exe52⤵
- Executes dropped EXE
PID:640 -
\??\c:\jvtlv.exec:\jvtlv.exe53⤵
- Executes dropped EXE
PID:3172 -
\??\c:\lxtdxnt.exec:\lxtdxnt.exe54⤵
- Executes dropped EXE
PID:3964 -
\??\c:\jxrxfpp.exec:\jxrxfpp.exe55⤵
- Executes dropped EXE
PID:1088 -
\??\c:\vfllvvr.exec:\vfllvvr.exe56⤵
- Executes dropped EXE
PID:1768 -
\??\c:\fhdnffv.exec:\fhdnffv.exe57⤵
- Executes dropped EXE
PID:860 -
\??\c:\bbpnvx.exec:\bbpnvx.exe58⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xffff.exec:\xffff.exe59⤵
- Executes dropped EXE
PID:2248 -
\??\c:\vdhpnln.exec:\vdhpnln.exe60⤵
- Executes dropped EXE
PID:2336 -
\??\c:\npnhtv.exec:\npnhtv.exe61⤵
- Executes dropped EXE
PID:3364 -
\??\c:\hlrtbr.exec:\hlrtbr.exe62⤵
- Executes dropped EXE
PID:1824 -
\??\c:\dvdjtx.exec:\dvdjtx.exe63⤵
- Executes dropped EXE
PID:2856 -
\??\c:\ndppnb.exec:\ndppnb.exe64⤵
- Executes dropped EXE
PID:3616 -
\??\c:\plrpnt.exec:\plrpnt.exe65⤵
- Executes dropped EXE
PID:1224 -
\??\c:\dtdvbf.exec:\dtdvbf.exe66⤵PID:2948
-
\??\c:\vvxljr.exec:\vvxljr.exe67⤵PID:1092
-
\??\c:\bvffr.exec:\bvffr.exe68⤵PID:2128
-
\??\c:\lrjbtrd.exec:\lrjbtrd.exe69⤵PID:3492
-
\??\c:\jxtvtrd.exec:\jxtvtrd.exe70⤵PID:3836
-
\??\c:\fffhtvh.exec:\fffhtvh.exe71⤵PID:2644
-
\??\c:\pxrnv.exec:\pxrnv.exe72⤵PID:700
-
\??\c:\tptvrvh.exec:\tptvrvh.exe73⤵PID:1920
-
\??\c:\tntnjp.exec:\tntnjp.exe74⤵PID:3904
-
\??\c:\xrnfr.exec:\xrnfr.exe75⤵PID:1632
-
\??\c:\xvtjnnv.exec:\xvtjnnv.exe76⤵PID:1932
-
\??\c:\jfhdr.exec:\jfhdr.exe77⤵PID:1768
-
\??\c:\rjrhb.exec:\rjrhb.exe78⤵PID:860
-
\??\c:\npdpdht.exec:\npdpdht.exe79⤵PID:2472
-
\??\c:\rnvnldb.exec:\rnvnldb.exe80⤵PID:2344
-
\??\c:\bhdjbbl.exec:\bhdjbbl.exe81⤵PID:2080
-
\??\c:\xbldb.exec:\xbldb.exe82⤵PID:3480
-
\??\c:\pdhdnn.exec:\pdhdnn.exe83⤵PID:3364
-
\??\c:\flhnn.exec:\flhnn.exe84⤵PID:1120
-
\??\c:\rxdjt.exec:\rxdjt.exe85⤵PID:2888
-
\??\c:\jflbd.exec:\jflbd.exe86⤵PID:2856
-
\??\c:\nbdnpv.exec:\nbdnpv.exe87⤵PID:3616
-
\??\c:\vvnhdnx.exec:\vvnhdnx.exe88⤵PID:4044
-
\??\c:\jnrnnj.exec:\jnrnnj.exe89⤵PID:4068
-
\??\c:\bnlbb.exec:\bnlbb.exe90⤵PID:2468
-
\??\c:\jhlffvn.exec:\jhlffvn.exe91⤵PID:656
-
\??\c:\ltffn.exec:\ltffn.exe92⤵PID:1972
-
\??\c:\lfvxl.exec:\lfvxl.exe93⤵PID:1512
-
\??\c:\vntvrtn.exec:\vntvrtn.exe94⤵PID:4032
-
\??\c:\rvnffb.exec:\rvnffb.exe95⤵PID:2644
-
\??\c:\fjlnvp.exec:\fjlnvp.exe96⤵PID:616
-
\??\c:\jhjxxln.exec:\jhjxxln.exe97⤵PID:3964
-
\??\c:\hlhnvbn.exec:\hlhnvbn.exe98⤵PID:1088
-
\??\c:\vvbtr.exec:\vvbtr.exe99⤵PID:1596
-
\??\c:\lxhjj.exec:\lxhjj.exe100⤵PID:2368
-
\??\c:\ldptr.exec:\ldptr.exe101⤵PID:1644
-
\??\c:\dlhrf.exec:\dlhrf.exe102⤵PID:2384
-
\??\c:\llnnf.exec:\llnnf.exe103⤵PID:2248
-
\??\c:\vhvjxnx.exec:\vhvjxnx.exe104⤵PID:2388
-
\??\c:\pvbvln.exec:\pvbvln.exe105⤵PID:2452
-
\??\c:\drxxhn.exec:\drxxhn.exe106⤵PID:3364
-
\??\c:\xtjrvb.exec:\xtjrvb.exe107⤵PID:1120
-
\??\c:\ttrlpd.exec:\ttrlpd.exe108⤵PID:2888
-
\??\c:\nbxpfj.exec:\nbxpfj.exe109⤵PID:2024
-
\??\c:\hvnrlbh.exec:\hvnrlbh.exe110⤵PID:2976
-
\??\c:\nhlxxj.exec:\nhlxxj.exe111⤵PID:428
-
\??\c:\ddfbxt.exec:\ddfbxt.exe112⤵PID:3136
-
\??\c:\ffxxlln.exec:\ffxxlln.exe113⤵PID:2468
-
\??\c:\jphppt.exec:\jphppt.exe114⤵PID:2688
-
\??\c:\bhvfb.exec:\bhvfb.exe115⤵PID:3892
-
\??\c:\fdjht.exec:\fdjht.exe116⤵PID:3872
-
\??\c:\rfhrb.exec:\rfhrb.exe117⤵PID:3900
-
\??\c:\hrtjrl.exec:\hrtjrl.exe118⤵PID:1640
-
\??\c:\bdbtnb.exec:\bdbtnb.exe119⤵PID:1760
-
\??\c:\nprvbf.exec:\nprvbf.exe120⤵PID:1424
-
\??\c:\jlbfnr.exec:\jlbfnr.exe121⤵PID:908
-
\??\c:\bnxrpx.exec:\bnxrpx.exe122⤵PID:2064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-