Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 05:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fde1db7cb69fb22b8b7421d61ac8bc58bfd7fd2ad13daf614299441dc0302cce.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
fde1db7cb69fb22b8b7421d61ac8bc58bfd7fd2ad13daf614299441dc0302cce.exe
-
Size
61KB
-
MD5
d7efd1ba109c208083f1ade1bdd94323
-
SHA1
5c6825e692d6249541683b012499498ee6d3f351
-
SHA256
fde1db7cb69fb22b8b7421d61ac8bc58bfd7fd2ad13daf614299441dc0302cce
-
SHA512
a45b2cd51c76b23a4b86b1f8a48c76f3fb88fdef61ff97edfa650d17acba5678a77e0ca0f4bad3f9f56b4fbecb3b32c5952b5c9316ad37997a01e8c860ea6c64
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDII9ZvHKEo:ymb3NkkiQ3mdBjFII9ZvHKEo
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2088-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-59-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/788-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 22 IoCs
resource yara_rule behavioral1/memory/2088-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2088-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2520-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2524-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2488-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2400-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2428-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2436-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2924-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2924-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2924-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2924-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2548-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2724-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1864-137-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1948-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2760-156-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2904-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1964-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2652-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/788-237-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3024-245-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1244 hnhbtb.exe 2520 nbtbnh.exe 2524 jdvjp.exe 2488 xrxflfl.exe 2400 lfrfrfx.exe 2428 nnhtnb.exe 2436 hhtbnh.exe 2924 jjvvj.exe 2548 llfrrll.exe 2724 hbthht.exe 348 ttntbh.exe 2036 vvdjd.exe 1864 3pdpv.exe 1948 rlxflrx.exe 2760 1rxfxxr.exe 1952 3tbnnb.exe 1712 pjjvd.exe 2904 9pvvj.exe 1964 fxlfrxl.exe 2652 frxrrrr.exe 324 tnhhnn.exe 992 9thnbb.exe 1404 9dvdp.exe 788 rlffxff.exe 3024 llfxlfl.exe 1568 thttbb.exe 760 pddpd.exe 1516 pdjjd.exe 1520 lfflrlr.exe 1232 thnthn.exe 1944 nbhbbt.exe 860 pdppv.exe 1532 3jvjj.exe 2564 xxxrrfr.exe 2192 rxllrrx.exe 2380 tnbhnn.exe 2692 9vjvp.exe 2116 7vdjd.exe 2484 lxlrxfx.exe 2536 xllrrrr.exe 2428 rfxlrxl.exe 2124 tnbbtt.exe 2996 hhtbnn.exe 2640 jdppd.exe 2548 7rffffx.exe 2728 rfxrrll.exe 1996 xlrrflx.exe 2612 nbhbhb.exe 1604 9bbbbn.exe 2004 ppjjp.exe 2296 ddjdv.exe 2276 xlrllff.exe 2360 lxllrrr.exe 340 hbhtbb.exe 2808 nhnnbb.exe 2184 djjdd.exe 2228 vpjdv.exe 2352 rfxxxxl.exe 1192 7lfxxlr.exe 1408 9nnbtt.exe 884 thtthh.exe 1400 7dppv.exe 1728 vpvvd.exe 448 1lffffr.exe -
resource yara_rule behavioral1/memory/2088-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/788-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-245-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2088 wrote to memory of 1244 2088 fde1db7cb69fb22b8b7421d61ac8bc58bfd7fd2ad13daf614299441dc0302cce.exe 28 PID 2088 wrote to memory of 1244 2088 fde1db7cb69fb22b8b7421d61ac8bc58bfd7fd2ad13daf614299441dc0302cce.exe 28 PID 2088 wrote to memory of 1244 2088 fde1db7cb69fb22b8b7421d61ac8bc58bfd7fd2ad13daf614299441dc0302cce.exe 28 PID 2088 wrote to memory of 1244 2088 fde1db7cb69fb22b8b7421d61ac8bc58bfd7fd2ad13daf614299441dc0302cce.exe 28 PID 1244 wrote to memory of 2520 1244 hnhbtb.exe 29 PID 1244 wrote to memory of 2520 1244 hnhbtb.exe 29 PID 1244 wrote to memory of 2520 1244 hnhbtb.exe 29 PID 1244 wrote to memory of 2520 1244 hnhbtb.exe 29 PID 2520 wrote to memory of 2524 2520 nbtbnh.exe 30 PID 2520 wrote to memory of 2524 2520 nbtbnh.exe 30 PID 2520 wrote to memory of 2524 2520 nbtbnh.exe 30 PID 2520 wrote to memory of 2524 2520 nbtbnh.exe 30 PID 2524 wrote to memory of 2488 2524 jdvjp.exe 31 PID 2524 wrote to memory of 2488 2524 jdvjp.exe 31 PID 2524 wrote to memory of 2488 2524 jdvjp.exe 31 PID 2524 wrote to memory of 2488 2524 jdvjp.exe 31 PID 2488 wrote to memory of 2400 2488 xrxflfl.exe 32 PID 2488 wrote to memory of 2400 2488 xrxflfl.exe 32 PID 2488 wrote to memory of 2400 2488 xrxflfl.exe 32 PID 2488 wrote to memory of 2400 2488 xrxflfl.exe 32 PID 2400 wrote to memory of 2428 2400 lfrfrfx.exe 33 PID 2400 wrote to memory of 2428 2400 lfrfrfx.exe 33 PID 2400 wrote to memory of 2428 2400 lfrfrfx.exe 33 PID 2400 wrote to memory of 2428 2400 lfrfrfx.exe 33 PID 2428 wrote to memory of 2436 2428 nnhtnb.exe 34 PID 2428 wrote to memory of 2436 2428 nnhtnb.exe 34 PID 2428 wrote to memory of 2436 2428 nnhtnb.exe 34 PID 2428 wrote to memory of 2436 2428 nnhtnb.exe 34 PID 2436 wrote to memory of 2924 2436 hhtbnh.exe 35 PID 2436 wrote to memory of 2924 2436 hhtbnh.exe 35 PID 2436 wrote to memory of 2924 2436 hhtbnh.exe 35 PID 2436 wrote to memory of 2924 2436 hhtbnh.exe 35 PID 2924 wrote to memory of 2548 2924 jjvvj.exe 36 PID 2924 wrote to memory of 2548 2924 jjvvj.exe 36 PID 2924 wrote to memory of 2548 2924 jjvvj.exe 36 PID 2924 wrote to memory of 2548 2924 jjvvj.exe 36 PID 2548 wrote to memory of 2724 2548 llfrrll.exe 37 PID 2548 wrote to memory of 2724 2548 llfrrll.exe 37 PID 2548 wrote to memory of 2724 2548 llfrrll.exe 37 PID 2548 wrote to memory of 2724 2548 llfrrll.exe 37 PID 2724 wrote to memory of 348 2724 hbthht.exe 38 PID 2724 wrote to memory of 348 2724 hbthht.exe 38 PID 2724 wrote to memory of 348 2724 hbthht.exe 38 PID 2724 wrote to memory of 348 2724 hbthht.exe 38 PID 348 wrote to memory of 2036 348 ttntbh.exe 39 PID 348 wrote to memory of 2036 348 ttntbh.exe 39 PID 348 wrote to memory of 2036 348 ttntbh.exe 39 PID 348 wrote to memory of 2036 348 ttntbh.exe 39 PID 2036 wrote to memory of 1864 2036 vvdjd.exe 40 PID 2036 wrote to memory of 1864 2036 vvdjd.exe 40 PID 2036 wrote to memory of 1864 2036 vvdjd.exe 40 PID 2036 wrote to memory of 1864 2036 vvdjd.exe 40 PID 1864 wrote to memory of 1948 1864 3pdpv.exe 41 PID 1864 wrote to memory of 1948 1864 3pdpv.exe 41 PID 1864 wrote to memory of 1948 1864 3pdpv.exe 41 PID 1864 wrote to memory of 1948 1864 3pdpv.exe 41 PID 1948 wrote to memory of 2760 1948 rlxflrx.exe 42 PID 1948 wrote to memory of 2760 1948 rlxflrx.exe 42 PID 1948 wrote to memory of 2760 1948 rlxflrx.exe 42 PID 1948 wrote to memory of 2760 1948 rlxflrx.exe 42 PID 2760 wrote to memory of 1952 2760 1rxfxxr.exe 43 PID 2760 wrote to memory of 1952 2760 1rxfxxr.exe 43 PID 2760 wrote to memory of 1952 2760 1rxfxxr.exe 43 PID 2760 wrote to memory of 1952 2760 1rxfxxr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\fde1db7cb69fb22b8b7421d61ac8bc58bfd7fd2ad13daf614299441dc0302cce.exe"C:\Users\Admin\AppData\Local\Temp\fde1db7cb69fb22b8b7421d61ac8bc58bfd7fd2ad13daf614299441dc0302cce.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\hnhbtb.exec:\hnhbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\nbtbnh.exec:\nbtbnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\jdvjp.exec:\jdvjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\xrxflfl.exec:\xrxflfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\lfrfrfx.exec:\lfrfrfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\nnhtnb.exec:\nnhtnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\hhtbnh.exec:\hhtbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\jjvvj.exec:\jjvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\llfrrll.exec:\llfrrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\hbthht.exec:\hbthht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\ttntbh.exec:\ttntbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\vvdjd.exec:\vvdjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\3pdpv.exec:\3pdpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\rlxflrx.exec:\rlxflrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\1rxfxxr.exec:\1rxfxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\3tbnnb.exec:\3tbnnb.exe17⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pjjvd.exec:\pjjvd.exe18⤵
- Executes dropped EXE
PID:1712 -
\??\c:\9pvvj.exec:\9pvvj.exe19⤵
- Executes dropped EXE
PID:2904 -
\??\c:\fxlfrxl.exec:\fxlfrxl.exe20⤵
- Executes dropped EXE
PID:1964 -
\??\c:\frxrrrr.exec:\frxrrrr.exe21⤵
- Executes dropped EXE
PID:2652 -
\??\c:\tnhhnn.exec:\tnhhnn.exe22⤵
- Executes dropped EXE
PID:324 -
\??\c:\9thnbb.exec:\9thnbb.exe23⤵
- Executes dropped EXE
PID:992 -
\??\c:\9dvdp.exec:\9dvdp.exe24⤵
- Executes dropped EXE
PID:1404 -
\??\c:\rlffxff.exec:\rlffxff.exe25⤵
- Executes dropped EXE
PID:788 -
\??\c:\llfxlfl.exec:\llfxlfl.exe26⤵
- Executes dropped EXE
PID:3024 -
\??\c:\thttbb.exec:\thttbb.exe27⤵
- Executes dropped EXE
PID:1568 -
\??\c:\pddpd.exec:\pddpd.exe28⤵
- Executes dropped EXE
PID:760 -
\??\c:\pdjjd.exec:\pdjjd.exe29⤵
- Executes dropped EXE
PID:1516 -
\??\c:\lfflrlr.exec:\lfflrlr.exe30⤵
- Executes dropped EXE
PID:1520 -
\??\c:\thnthn.exec:\thnthn.exe31⤵
- Executes dropped EXE
PID:1232 -
\??\c:\nbhbbt.exec:\nbhbbt.exe32⤵
- Executes dropped EXE
PID:1944 -
\??\c:\pdppv.exec:\pdppv.exe33⤵
- Executes dropped EXE
PID:860 -
\??\c:\3jvjj.exec:\3jvjj.exe34⤵
- Executes dropped EXE
PID:1532 -
\??\c:\xxxrrfr.exec:\xxxrrfr.exe35⤵
- Executes dropped EXE
PID:2564 -
\??\c:\rxllrrx.exec:\rxllrrx.exe36⤵
- Executes dropped EXE
PID:2192 -
\??\c:\tnbhnn.exec:\tnbhnn.exe37⤵
- Executes dropped EXE
PID:2380 -
\??\c:\9vjvp.exec:\9vjvp.exe38⤵
- Executes dropped EXE
PID:2692 -
\??\c:\7vdjd.exec:\7vdjd.exe39⤵
- Executes dropped EXE
PID:2116 -
\??\c:\lxlrxfx.exec:\lxlrxfx.exe40⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xllrrrr.exec:\xllrrrr.exe41⤵
- Executes dropped EXE
PID:2536 -
\??\c:\rfxlrxl.exec:\rfxlrxl.exe42⤵
- Executes dropped EXE
PID:2428 -
\??\c:\tnbbtt.exec:\tnbbtt.exe43⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hhtbnn.exec:\hhtbnn.exe44⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jdppd.exec:\jdppd.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\7rffffx.exec:\7rffffx.exe46⤵
- Executes dropped EXE
PID:2548 -
\??\c:\rfxrrll.exec:\rfxrrll.exe47⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xlrrflx.exec:\xlrrflx.exe48⤵
- Executes dropped EXE
PID:1996 -
\??\c:\nbhbhb.exec:\nbhbhb.exe49⤵
- Executes dropped EXE
PID:2612 -
\??\c:\9bbbbn.exec:\9bbbbn.exe50⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ppjjp.exec:\ppjjp.exe51⤵
- Executes dropped EXE
PID:2004 -
\??\c:\ddjdv.exec:\ddjdv.exe52⤵
- Executes dropped EXE
PID:2296 -
\??\c:\xlrllff.exec:\xlrllff.exe53⤵
- Executes dropped EXE
PID:2276 -
\??\c:\lxllrrr.exec:\lxllrrr.exe54⤵
- Executes dropped EXE
PID:2360 -
\??\c:\hbhtbb.exec:\hbhtbb.exe55⤵
- Executes dropped EXE
PID:340 -
\??\c:\nhnnbb.exec:\nhnnbb.exe56⤵
- Executes dropped EXE
PID:2808 -
\??\c:\djjdd.exec:\djjdd.exe57⤵
- Executes dropped EXE
PID:2184 -
\??\c:\vpjdv.exec:\vpjdv.exe58⤵
- Executes dropped EXE
PID:2228 -
\??\c:\rfxxxxl.exec:\rfxxxxl.exe59⤵
- Executes dropped EXE
PID:2352 -
\??\c:\7lfxxlr.exec:\7lfxxlr.exe60⤵
- Executes dropped EXE
PID:1192 -
\??\c:\9nnbtt.exec:\9nnbtt.exe61⤵
- Executes dropped EXE
PID:1408 -
\??\c:\thtthh.exec:\thtthh.exe62⤵
- Executes dropped EXE
PID:884 -
\??\c:\7dppv.exec:\7dppv.exe63⤵
- Executes dropped EXE
PID:1400 -
\??\c:\vpvvd.exec:\vpvvd.exe64⤵
- Executes dropped EXE
PID:1728 -
\??\c:\1lffffr.exec:\1lffffr.exe65⤵
- Executes dropped EXE
PID:448 -
\??\c:\xrrrffl.exec:\xrrrffl.exe66⤵PID:2336
-
\??\c:\nbthhn.exec:\nbthhn.exe67⤵PID:1568
-
\??\c:\nhtthn.exec:\nhtthn.exe68⤵PID:836
-
\??\c:\pjjjv.exec:\pjjjv.exe69⤵PID:2836
-
\??\c:\jdpdv.exec:\jdpdv.exe70⤵PID:1516
-
\??\c:\xlrlllf.exec:\xlrlllf.exe71⤵PID:888
-
\??\c:\tthntb.exec:\tthntb.exe72⤵PID:2248
-
\??\c:\tnthnh.exec:\tnthnh.exe73⤵PID:1944
-
\??\c:\jvddp.exec:\jvddp.exe74⤵PID:2984
-
\??\c:\vjvpv.exec:\vjvpv.exe75⤵PID:1244
-
\??\c:\ffrrlrf.exec:\ffrrlrf.exe76⤵PID:3068
-
\??\c:\9rrfrlr.exec:\9rrfrlr.exe77⤵PID:2520
-
\??\c:\btbbnh.exec:\btbbnh.exe78⤵PID:2828
-
\??\c:\tnhhhn.exec:\tnhhhn.exe79⤵PID:2688
-
\??\c:\djpvv.exec:\djpvv.exe80⤵PID:2584
-
\??\c:\5dddj.exec:\5dddj.exe81⤵PID:2376
-
\??\c:\fxfrxlr.exec:\fxfrxlr.exe82⤵PID:2484
-
\??\c:\1ffllff.exec:\1ffllff.exe83⤵PID:2324
-
\??\c:\hbtbhn.exec:\hbtbhn.exe84⤵PID:1836
-
\??\c:\dvvjd.exec:\dvvjd.exe85⤵PID:2580
-
\??\c:\dvjdj.exec:\dvjdj.exe86⤵PID:2668
-
\??\c:\xlfflrx.exec:\xlfflrx.exe87⤵PID:2764
-
\??\c:\frlxllx.exec:\frlxllx.exe88⤵PID:2780
-
\??\c:\nbhttt.exec:\nbhttt.exe89⤵PID:2020
-
\??\c:\thhtbn.exec:\thhtbn.exe90⤵PID:1600
-
\??\c:\hbttbh.exec:\hbttbh.exe91⤵PID:2256
-
\??\c:\7ppvd.exec:\7ppvd.exe92⤵PID:1844
-
\??\c:\xxrflxl.exec:\xxrflxl.exe93⤵PID:2348
-
\??\c:\rffllfr.exec:\rffllfr.exe94⤵PID:2092
-
\??\c:\nnbhnn.exec:\nnbhnn.exe95⤵PID:812
-
\??\c:\tnbnth.exec:\tnbnth.exe96⤵PID:1552
-
\??\c:\ddpvj.exec:\ddpvj.exe97⤵PID:1688
-
\??\c:\pjjvd.exec:\pjjvd.exe98⤵PID:2904
-
\??\c:\fxlrffx.exec:\fxlrffx.exe99⤵PID:2196
-
\??\c:\xxlflrx.exec:\xxlflrx.exe100⤵PID:2356
-
\??\c:\tttbbn.exec:\tttbbn.exe101⤵PID:540
-
\??\c:\bnbntt.exec:\bnbntt.exe102⤵PID:1884
-
\??\c:\vdvjv.exec:\vdvjv.exe103⤵PID:1708
-
\??\c:\pjvdj.exec:\pjvdj.exe104⤵PID:1128
-
\??\c:\7lfxfxf.exec:\7lfxfxf.exe105⤵PID:1904
-
\??\c:\xrffrxl.exec:\xrffrxl.exe106⤵PID:1892
-
\??\c:\tnhtbb.exec:\tnhtbb.exe107⤵PID:1292
-
\??\c:\5bhthn.exec:\5bhthn.exe108⤵PID:2976
-
\??\c:\pjjdd.exec:\pjjdd.exe109⤵PID:1452
-
\??\c:\vpppv.exec:\vpppv.exe110⤵PID:2068
-
\??\c:\xlrxllr.exec:\xlrxllr.exe111⤵PID:1520
-
\??\c:\lxrrxxf.exec:\lxrrxxf.exe112⤵PID:332
-
\??\c:\btbhtb.exec:\btbhtb.exe113⤵PID:1632
-
\??\c:\nhnnnt.exec:\nhnnnt.exe114⤵PID:2480
-
\??\c:\vpdvd.exec:\vpdvd.exe115⤵PID:2464
-
\??\c:\ppdjv.exec:\ppdjv.exe116⤵PID:2568
-
\??\c:\9xxrxfl.exec:\9xxrxfl.exe117⤵PID:2840
-
\??\c:\3fxxlrf.exec:\3fxxlrf.exe118⤵PID:2192
-
\??\c:\hbhnbb.exec:\hbhnbb.exe119⤵PID:2408
-
\??\c:\btnhnn.exec:\btnhnn.exe120⤵PID:2400
-
\??\c:\pjppd.exec:\pjppd.exe121⤵PID:2696
-
\??\c:\vjvdj.exec:\vjvdj.exe122⤵PID:2392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-