Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 01:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
af7f0b212e9db53792fb7aacbe64f2b99e44eb735e666b60fac16cec9e225cf9.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
af7f0b212e9db53792fb7aacbe64f2b99e44eb735e666b60fac16cec9e225cf9.exe
-
Size
87KB
-
MD5
f8bbd7b634a2ae5149184cd972f2ee97
-
SHA1
553890ea5944beb6a270d185d3747acc2b4a7742
-
SHA256
af7f0b212e9db53792fb7aacbe64f2b99e44eb735e666b60fac16cec9e225cf9
-
SHA512
e0118a67ae84a099649997f967fff17e146a0b0102d123d9362007660d539f91033887a2cf04e81a603410932efc763745a4a924a7d94c794c2647cfa2908326
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLU1grORPfr0k890C0:ymb3NkkiQ3mdBjFoLk8Pk890C0
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2380-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-64-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1068-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1216-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/812-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1368-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 24 IoCs
resource yara_rule behavioral1/memory/2972-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2380-15-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2972-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1908-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1908-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1908-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1908-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1660-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1660-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2716-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2468-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2484-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2472-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2472-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2472-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1068-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2772-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2824-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1216-151-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1520-159-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2328-223-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/812-249-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1368-258-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2224-267-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2380 vdpvj.exe 1908 rrfllll.exe 1660 bnnbtb.exe 2716 3vpvj.exe 3024 9rfrfxl.exe 2468 fxllxfr.exe 2484 tnhtnn.exe 2472 ddvpd.exe 1068 ffrfrrf.exe 2772 ffrxlrl.exe 2824 ttthnn.exe 2936 ddvvj.exe 1688 jpjvj.exe 1216 lfrrflf.exe 1520 rxllfxx.exe 2144 tnnntt.exe 332 ppjpj.exe 1292 jdvdp.exe 2064 xxlrxfr.exe 568 rlrrlfx.exe 2872 bbtnbn.exe 2328 tnhnhn.exe 308 ddjjp.exe 496 vpvjp.exe 812 1frfxlx.exe 1368 btntnt.exe 2224 ddpvj.exe 3060 vjvdd.exe 1988 rlllflr.exe 2252 nhbnhh.exe 896 nnntbn.exe 2020 ppvdp.exe 2372 pdpjv.exe 2180 nntbnb.exe 2840 bttthh.exe 2564 7dvvj.exe 2532 5pvvd.exe 2588 frfrxlx.exe 2552 xxllxfl.exe 2728 rfxfrfr.exe 2448 thhbbn.exe 1624 7httbb.exe 2460 1jjvv.exe 2492 dvvdp.exe 1884 rrxfrff.exe 2780 fffflrx.exe 2828 btbhnt.exe 3036 bbnbnt.exe 2480 3vpdp.exe 2416 vpdpj.exe 1704 rllxfll.exe 1440 frllrrx.exe 1520 nhttnt.exe 2616 vdjdv.exe 1272 vpdjv.exe 1284 lxllrrl.exe 1132 1rxrxfr.exe 536 lxfflff.exe 2116 tntbtn.exe 1876 htnbhh.exe 2876 dvjpd.exe 2328 pvdvd.exe 1040 lxlrfll.exe 588 thnntn.exe -
resource yara_rule behavioral1/memory/2972-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1068-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1216-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/812-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-267-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2380 2972 af7f0b212e9db53792fb7aacbe64f2b99e44eb735e666b60fac16cec9e225cf9.exe 28 PID 2972 wrote to memory of 2380 2972 af7f0b212e9db53792fb7aacbe64f2b99e44eb735e666b60fac16cec9e225cf9.exe 28 PID 2972 wrote to memory of 2380 2972 af7f0b212e9db53792fb7aacbe64f2b99e44eb735e666b60fac16cec9e225cf9.exe 28 PID 2972 wrote to memory of 2380 2972 af7f0b212e9db53792fb7aacbe64f2b99e44eb735e666b60fac16cec9e225cf9.exe 28 PID 2380 wrote to memory of 1908 2380 vdpvj.exe 29 PID 2380 wrote to memory of 1908 2380 vdpvj.exe 29 PID 2380 wrote to memory of 1908 2380 vdpvj.exe 29 PID 2380 wrote to memory of 1908 2380 vdpvj.exe 29 PID 1908 wrote to memory of 1660 1908 rrfllll.exe 30 PID 1908 wrote to memory of 1660 1908 rrfllll.exe 30 PID 1908 wrote to memory of 1660 1908 rrfllll.exe 30 PID 1908 wrote to memory of 1660 1908 rrfllll.exe 30 PID 1660 wrote to memory of 2716 1660 bnnbtb.exe 31 PID 1660 wrote to memory of 2716 1660 bnnbtb.exe 31 PID 1660 wrote to memory of 2716 1660 bnnbtb.exe 31 PID 1660 wrote to memory of 2716 1660 bnnbtb.exe 31 PID 2716 wrote to memory of 3024 2716 3vpvj.exe 32 PID 2716 wrote to memory of 3024 2716 3vpvj.exe 32 PID 2716 wrote to memory of 3024 2716 3vpvj.exe 32 PID 2716 wrote to memory of 3024 2716 3vpvj.exe 32 PID 3024 wrote to memory of 2468 3024 9rfrfxl.exe 33 PID 3024 wrote to memory of 2468 3024 9rfrfxl.exe 33 PID 3024 wrote to memory of 2468 3024 9rfrfxl.exe 33 PID 3024 wrote to memory of 2468 3024 9rfrfxl.exe 33 PID 2468 wrote to memory of 2484 2468 fxllxfr.exe 34 PID 2468 wrote to memory of 2484 2468 fxllxfr.exe 34 PID 2468 wrote to memory of 2484 2468 fxllxfr.exe 34 PID 2468 wrote to memory of 2484 2468 fxllxfr.exe 34 PID 2484 wrote to memory of 2472 2484 tnhtnn.exe 35 PID 2484 wrote to memory of 2472 2484 tnhtnn.exe 35 PID 2484 wrote to memory of 2472 2484 tnhtnn.exe 35 PID 2484 wrote to memory of 2472 2484 tnhtnn.exe 35 PID 2472 wrote to memory of 1068 2472 ddvpd.exe 36 PID 2472 wrote to memory of 1068 2472 ddvpd.exe 36 PID 2472 wrote to memory of 1068 2472 ddvpd.exe 36 PID 2472 wrote to memory of 1068 2472 ddvpd.exe 36 PID 1068 wrote to memory of 2772 1068 ffrfrrf.exe 37 PID 1068 wrote to memory of 2772 1068 ffrfrrf.exe 37 PID 1068 wrote to memory of 2772 1068 ffrfrrf.exe 37 PID 1068 wrote to memory of 2772 1068 ffrfrrf.exe 37 PID 2772 wrote to memory of 2824 2772 ffrxlrl.exe 38 PID 2772 wrote to memory of 2824 2772 ffrxlrl.exe 38 PID 2772 wrote to memory of 2824 2772 ffrxlrl.exe 38 PID 2772 wrote to memory of 2824 2772 ffrxlrl.exe 38 PID 2824 wrote to memory of 2936 2824 ttthnn.exe 39 PID 2824 wrote to memory of 2936 2824 ttthnn.exe 39 PID 2824 wrote to memory of 2936 2824 ttthnn.exe 39 PID 2824 wrote to memory of 2936 2824 ttthnn.exe 39 PID 2936 wrote to memory of 1688 2936 ddvvj.exe 40 PID 2936 wrote to memory of 1688 2936 ddvvj.exe 40 PID 2936 wrote to memory of 1688 2936 ddvvj.exe 40 PID 2936 wrote to memory of 1688 2936 ddvvj.exe 40 PID 1688 wrote to memory of 1216 1688 jpjvj.exe 41 PID 1688 wrote to memory of 1216 1688 jpjvj.exe 41 PID 1688 wrote to memory of 1216 1688 jpjvj.exe 41 PID 1688 wrote to memory of 1216 1688 jpjvj.exe 41 PID 1216 wrote to memory of 1520 1216 lfrrflf.exe 42 PID 1216 wrote to memory of 1520 1216 lfrrflf.exe 42 PID 1216 wrote to memory of 1520 1216 lfrrflf.exe 42 PID 1216 wrote to memory of 1520 1216 lfrrflf.exe 42 PID 1520 wrote to memory of 2144 1520 rxllfxx.exe 43 PID 1520 wrote to memory of 2144 1520 rxllfxx.exe 43 PID 1520 wrote to memory of 2144 1520 rxllfxx.exe 43 PID 1520 wrote to memory of 2144 1520 rxllfxx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\af7f0b212e9db53792fb7aacbe64f2b99e44eb735e666b60fac16cec9e225cf9.exe"C:\Users\Admin\AppData\Local\Temp\af7f0b212e9db53792fb7aacbe64f2b99e44eb735e666b60fac16cec9e225cf9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\vdpvj.exec:\vdpvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\rrfllll.exec:\rrfllll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\bnnbtb.exec:\bnnbtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\3vpvj.exec:\3vpvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\9rfrfxl.exec:\9rfrfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\fxllxfr.exec:\fxllxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\tnhtnn.exec:\tnhtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\ddvpd.exec:\ddvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\ffrfrrf.exec:\ffrfrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\ffrxlrl.exec:\ffrxlrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\ttthnn.exec:\ttthnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\ddvvj.exec:\ddvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\jpjvj.exec:\jpjvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\lfrrflf.exec:\lfrrflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\rxllfxx.exec:\rxllfxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\tnnntt.exec:\tnnntt.exe17⤵
- Executes dropped EXE
PID:2144 -
\??\c:\ppjpj.exec:\ppjpj.exe18⤵
- Executes dropped EXE
PID:332 -
\??\c:\jdvdp.exec:\jdvdp.exe19⤵
- Executes dropped EXE
PID:1292 -
\??\c:\xxlrxfr.exec:\xxlrxfr.exe20⤵
- Executes dropped EXE
PID:2064 -
\??\c:\rlrrlfx.exec:\rlrrlfx.exe21⤵
- Executes dropped EXE
PID:568 -
\??\c:\bbtnbn.exec:\bbtnbn.exe22⤵
- Executes dropped EXE
PID:2872 -
\??\c:\tnhnhn.exec:\tnhnhn.exe23⤵
- Executes dropped EXE
PID:2328 -
\??\c:\ddjjp.exec:\ddjjp.exe24⤵
- Executes dropped EXE
PID:308 -
\??\c:\vpvjp.exec:\vpvjp.exe25⤵
- Executes dropped EXE
PID:496 -
\??\c:\1frfxlx.exec:\1frfxlx.exe26⤵
- Executes dropped EXE
PID:812 -
\??\c:\btntnt.exec:\btntnt.exe27⤵
- Executes dropped EXE
PID:1368 -
\??\c:\ddpvj.exec:\ddpvj.exe28⤵
- Executes dropped EXE
PID:2224 -
\??\c:\vjvdd.exec:\vjvdd.exe29⤵
- Executes dropped EXE
PID:3060 -
\??\c:\rlllflr.exec:\rlllflr.exe30⤵
- Executes dropped EXE
PID:1988 -
\??\c:\nhbnhh.exec:\nhbnhh.exe31⤵
- Executes dropped EXE
PID:2252 -
\??\c:\nnntbn.exec:\nnntbn.exe32⤵
- Executes dropped EXE
PID:896 -
\??\c:\ppvdp.exec:\ppvdp.exe33⤵
- Executes dropped EXE
PID:2020 -
\??\c:\pdpjv.exec:\pdpjv.exe34⤵
- Executes dropped EXE
PID:2372 -
\??\c:\nntbnb.exec:\nntbnb.exe35⤵
- Executes dropped EXE
PID:2180 -
\??\c:\bttthh.exec:\bttthh.exe36⤵
- Executes dropped EXE
PID:2840 -
\??\c:\7dvvj.exec:\7dvvj.exe37⤵
- Executes dropped EXE
PID:2564 -
\??\c:\5pvvd.exec:\5pvvd.exe38⤵
- Executes dropped EXE
PID:2532 -
\??\c:\frfrxlx.exec:\frfrxlx.exe39⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xxllxfl.exec:\xxllxfl.exe40⤵
- Executes dropped EXE
PID:2552 -
\??\c:\rfxfrfr.exec:\rfxfrfr.exe41⤵
- Executes dropped EXE
PID:2728 -
\??\c:\thhbbn.exec:\thhbbn.exe42⤵
- Executes dropped EXE
PID:2448 -
\??\c:\7httbb.exec:\7httbb.exe43⤵
- Executes dropped EXE
PID:1624 -
\??\c:\1jjvv.exec:\1jjvv.exe44⤵
- Executes dropped EXE
PID:2460 -
\??\c:\dvvdp.exec:\dvvdp.exe45⤵
- Executes dropped EXE
PID:2492 -
\??\c:\rrxfrff.exec:\rrxfrff.exe46⤵
- Executes dropped EXE
PID:1884 -
\??\c:\fffflrx.exec:\fffflrx.exe47⤵
- Executes dropped EXE
PID:2780 -
\??\c:\btbhnt.exec:\btbhnt.exe48⤵
- Executes dropped EXE
PID:2828 -
\??\c:\bbnbnt.exec:\bbnbnt.exe49⤵
- Executes dropped EXE
PID:3036 -
\??\c:\3vpdp.exec:\3vpdp.exe50⤵
- Executes dropped EXE
PID:2480 -
\??\c:\vpdpj.exec:\vpdpj.exe51⤵
- Executes dropped EXE
PID:2416 -
\??\c:\rllxfll.exec:\rllxfll.exe52⤵
- Executes dropped EXE
PID:1704 -
\??\c:\frllrrx.exec:\frllrrx.exe53⤵
- Executes dropped EXE
PID:1440 -
\??\c:\nhttnt.exec:\nhttnt.exe54⤵
- Executes dropped EXE
PID:1520 -
\??\c:\vdjdv.exec:\vdjdv.exe55⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vpdjv.exec:\vpdjv.exe56⤵
- Executes dropped EXE
PID:1272 -
\??\c:\lxllrrl.exec:\lxllrrl.exe57⤵
- Executes dropped EXE
PID:1284 -
\??\c:\1rxrxfr.exec:\1rxrxfr.exe58⤵
- Executes dropped EXE
PID:1132 -
\??\c:\lxfflff.exec:\lxfflff.exe59⤵
- Executes dropped EXE
PID:536 -
\??\c:\tntbtn.exec:\tntbtn.exe60⤵
- Executes dropped EXE
PID:2116 -
\??\c:\htnbhh.exec:\htnbhh.exe61⤵
- Executes dropped EXE
PID:1876 -
\??\c:\dvjpd.exec:\dvjpd.exe62⤵
- Executes dropped EXE
PID:2876 -
\??\c:\pvdvd.exec:\pvdvd.exe63⤵
- Executes dropped EXE
PID:2328 -
\??\c:\lxlrfll.exec:\lxlrfll.exe64⤵
- Executes dropped EXE
PID:1040 -
\??\c:\thnntn.exec:\thnntn.exe65⤵
- Executes dropped EXE
PID:588 -
\??\c:\nbhntb.exec:\nbhntb.exe66⤵PID:412
-
\??\c:\dvjjp.exec:\dvjjp.exe67⤵PID:1700
-
\??\c:\vpddd.exec:\vpddd.exe68⤵PID:292
-
\??\c:\frflrrx.exec:\frflrrx.exe69⤵PID:2224
-
\??\c:\1flfrff.exec:\1flfrff.exe70⤵PID:1736
-
\??\c:\3tbbnn.exec:\3tbbnn.exe71⤵PID:1924
-
\??\c:\nhtbth.exec:\nhtbth.exe72⤵PID:2212
-
\??\c:\vjppp.exec:\vjppp.exe73⤵PID:1824
-
\??\c:\pjpjv.exec:\pjpjv.exe74⤵PID:2132
-
\??\c:\lfrlfxf.exec:\lfrlfxf.exe75⤵PID:1444
-
\??\c:\5fxrffx.exec:\5fxrffx.exe76⤵PID:2288
-
\??\c:\bhtthh.exec:\bhtthh.exe77⤵PID:2356
-
\??\c:\1bnbtb.exec:\1bnbtb.exe78⤵PID:1728
-
\??\c:\jpdpv.exec:\jpdpv.exe79⤵PID:1908
-
\??\c:\pdpdj.exec:\pdpdj.exe80⤵PID:2628
-
\??\c:\rxffrrf.exec:\rxffrrf.exe81⤵PID:1264
-
\??\c:\flfxfxx.exec:\flfxfxx.exe82⤵PID:2724
-
\??\c:\hbhhbb.exec:\hbhhbb.exe83⤵PID:2568
-
\??\c:\3tbttt.exec:\3tbttt.exe84⤵PID:2600
-
\??\c:\jppjp.exec:\jppjp.exe85⤵PID:2572
-
\??\c:\djjjp.exec:\djjjp.exe86⤵PID:2436
-
\??\c:\5pdpp.exec:\5pdpp.exe87⤵PID:2948
-
\??\c:\fflxrfx.exec:\fflxrfx.exe88⤵PID:2712
-
\??\c:\rffflfl.exec:\rffflfl.exe89⤵PID:1892
-
\??\c:\bhnnnh.exec:\bhnnnh.exe90⤵PID:2836
-
\??\c:\1hbbbb.exec:\1hbbbb.exe91⤵PID:404
-
\??\c:\jjpdd.exec:\jjpdd.exe92⤵PID:1084
-
\??\c:\5pppd.exec:\5pppd.exe93⤵PID:2320
-
\??\c:\9lffllr.exec:\9lffllr.exe94⤵PID:1588
-
\??\c:\btthtb.exec:\btthtb.exe95⤵PID:628
-
\??\c:\ttnhnh.exec:\ttnhnh.exe96⤵PID:2528
-
\??\c:\dvpjp.exec:\dvpjp.exe97⤵PID:2784
-
\??\c:\1lffflx.exec:\1lffflx.exe98⤵PID:860
-
\??\c:\1hnbth.exec:\1hnbth.exe99⤵PID:2112
-
\??\c:\thbbhb.exec:\thbbhb.exe100⤵PID:2028
-
\??\c:\dvjpd.exec:\dvjpd.exe101⤵PID:2064
-
\??\c:\7lrllxl.exec:\7lrllxl.exe102⤵PID:568
-
\??\c:\1frlfrx.exec:\1frlfrx.exe103⤵PID:488
-
\??\c:\3hhnbn.exec:\3hhnbn.exe104⤵PID:1156
-
\??\c:\hbnhnt.exec:\hbnhnt.exe105⤵PID:348
-
\??\c:\pdjpv.exec:\pdjpv.exe106⤵PID:1904
-
\??\c:\pjjpv.exec:\pjjpv.exe107⤵PID:2024
-
\??\c:\rxfllxl.exec:\rxfllxl.exe108⤵PID:1820
-
\??\c:\nhbbnn.exec:\nhbbnn.exe109⤵PID:1192
-
\??\c:\hnbthh.exec:\hnbthh.exe110⤵PID:612
-
\??\c:\djjjv.exec:\djjjv.exe111⤵PID:880
-
\??\c:\djdjd.exec:\djdjd.exe112⤵PID:2904
-
\??\c:\rxrlfrx.exec:\rxrlfrx.exe113⤵PID:1968
-
\??\c:\7frxllr.exec:\7frxllr.exe114⤵PID:1768
-
\??\c:\lxxlllr.exec:\lxxlllr.exe115⤵PID:2896
-
\??\c:\ttnnhb.exec:\ttnnhb.exe116⤵PID:2972
-
\??\c:\bbhbbt.exec:\bbhbbt.exe117⤵PID:1744
-
\??\c:\jppdp.exec:\jppdp.exe118⤵PID:2524
-
\??\c:\xrlfllr.exec:\xrlfllr.exe119⤵PID:2288
-
\??\c:\rlflflx.exec:\rlflflx.exe120⤵PID:2356
-
\??\c:\tttthb.exec:\tttthb.exe121⤵PID:1728
-
\??\c:\bnhbhh.exec:\bnhbhh.exe122⤵PID:2632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-