Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 18:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
019c23e895fb69020ea6e5589a91d052e76a2c03c77ce9c838ec75e7846f8f31.exe
Resource
win7-20240419-en
6 signatures
150 seconds
General
-
Target
019c23e895fb69020ea6e5589a91d052e76a2c03c77ce9c838ec75e7846f8f31.exe
-
Size
335KB
-
MD5
b765d95bee1ac2a7b853cadfcbca8518
-
SHA1
edeede86753f5a2d33360281c9d10ced1b8ed163
-
SHA256
019c23e895fb69020ea6e5589a91d052e76a2c03c77ce9c838ec75e7846f8f31
-
SHA512
4e8686faf4fef7605e52b8ebe6a55ac7799fc6244a0b78f61e7571717805da3ebd639d9bb6f625b2112a98b17f612954ab0e283e4509a28cf7fe0f9daf4a2cb6
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LCgnilBxBqwZK2q6sYTsmZDSFdBE0rXE4eftYDH8:n3C9BRo/CEilXBG2qZSlSFdBXExtYDH8
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/1340-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/620-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/812-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1816-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/656-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 24 IoCs
resource yara_rule behavioral1/memory/1340-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2252-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2680-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2680-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2680-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2680-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2720-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2696-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2696-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2788-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2612-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2424-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2796-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3016-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/620-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/812-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1816-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1692-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2080-190-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2940-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/656-244-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1672-271-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2320-289-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1524-298-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2252 frllxfl.exe 1544 jvjjv.exe 2680 xxxxrxl.exe 2720 bbbhtt.exe 2696 dvpvd.exe 2752 3btnbh.exe 2788 jpjpd.exe 2612 xlfrxfr.exe 2424 tnhtbt.exe 2796 3vjjp.exe 2780 btnntb.exe 3016 vjvdj.exe 620 xlxxffr.exe 812 thttbh.exe 1816 7vjjj.exe 2596 1hbhbh.exe 1748 jvddj.exe 1692 1lffrrx.exe 2080 hbttbb.exe 2940 pjpvp.exe 2772 fxlfffl.exe 3068 btnhhb.exe 992 rlffrxf.exe 2192 xflrxxx.exe 656 vjjjp.exe 1400 jdvdp.exe 1276 7nbbnn.exe 1672 pjdpv.exe 2932 xlffrrf.exe 2320 tthhtt.exe 1524 fxflrrf.exe 2448 hbhhtb.exe 2292 dvvvj.exe 1328 frllrrf.exe 2748 3lxlrrf.exe 2148 nhntbb.exe 2716 7jppv.exe 2760 rfrxfxf.exe 2276 rxrrxxl.exe 2872 9tntnn.exe 2272 pjvvd.exe 2820 jdjjv.exe 2568 xfxlxlr.exe 2588 9bbbnh.exe 2656 1hbbbb.exe 2804 jvjpp.exe 2856 xlxfxxl.exe 2636 frffllx.exe 2980 tnthhh.exe 3016 bnbnbh.exe 1200 dvpdp.exe 1704 1pvvp.exe 1760 rfxrrrf.exe 1716 bnbbhh.exe 1648 3bbbtt.exe 1748 ddvdp.exe 2052 pjvpv.exe 2060 fxflrlx.exe 2520 nnbhtb.exe 2516 3nbbtt.exe 536 1vjjj.exe 868 9jddj.exe 584 fxrrxrf.exe 1820 btthnn.exe -
resource yara_rule behavioral1/memory/1340-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/620-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/812-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/656-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1340 wrote to memory of 2252 1340 019c23e895fb69020ea6e5589a91d052e76a2c03c77ce9c838ec75e7846f8f31.exe 28 PID 1340 wrote to memory of 2252 1340 019c23e895fb69020ea6e5589a91d052e76a2c03c77ce9c838ec75e7846f8f31.exe 28 PID 1340 wrote to memory of 2252 1340 019c23e895fb69020ea6e5589a91d052e76a2c03c77ce9c838ec75e7846f8f31.exe 28 PID 1340 wrote to memory of 2252 1340 019c23e895fb69020ea6e5589a91d052e76a2c03c77ce9c838ec75e7846f8f31.exe 28 PID 2252 wrote to memory of 1544 2252 frllxfl.exe 29 PID 2252 wrote to memory of 1544 2252 frllxfl.exe 29 PID 2252 wrote to memory of 1544 2252 frllxfl.exe 29 PID 2252 wrote to memory of 1544 2252 frllxfl.exe 29 PID 1544 wrote to memory of 2680 1544 jvjjv.exe 30 PID 1544 wrote to memory of 2680 1544 jvjjv.exe 30 PID 1544 wrote to memory of 2680 1544 jvjjv.exe 30 PID 1544 wrote to memory of 2680 1544 jvjjv.exe 30 PID 2680 wrote to memory of 2720 2680 xxxxrxl.exe 31 PID 2680 wrote to memory of 2720 2680 xxxxrxl.exe 31 PID 2680 wrote to memory of 2720 2680 xxxxrxl.exe 31 PID 2680 wrote to memory of 2720 2680 xxxxrxl.exe 31 PID 2720 wrote to memory of 2696 2720 bbbhtt.exe 32 PID 2720 wrote to memory of 2696 2720 bbbhtt.exe 32 PID 2720 wrote to memory of 2696 2720 bbbhtt.exe 32 PID 2720 wrote to memory of 2696 2720 bbbhtt.exe 32 PID 2696 wrote to memory of 2752 2696 dvpvd.exe 33 PID 2696 wrote to memory of 2752 2696 dvpvd.exe 33 PID 2696 wrote to memory of 2752 2696 dvpvd.exe 33 PID 2696 wrote to memory of 2752 2696 dvpvd.exe 33 PID 2752 wrote to memory of 2788 2752 3btnbh.exe 34 PID 2752 wrote to memory of 2788 2752 3btnbh.exe 34 PID 2752 wrote to memory of 2788 2752 3btnbh.exe 34 PID 2752 wrote to memory of 2788 2752 3btnbh.exe 34 PID 2788 wrote to memory of 2612 2788 jpjpd.exe 35 PID 2788 wrote to memory of 2612 2788 jpjpd.exe 35 PID 2788 wrote to memory of 2612 2788 jpjpd.exe 35 PID 2788 wrote to memory of 2612 2788 jpjpd.exe 35 PID 2612 wrote to memory of 2424 2612 xlfrxfr.exe 36 PID 2612 wrote to memory of 2424 2612 xlfrxfr.exe 36 PID 2612 wrote to memory of 2424 2612 xlfrxfr.exe 36 PID 2612 wrote to memory of 2424 2612 xlfrxfr.exe 36 PID 2424 wrote to memory of 2796 2424 tnhtbt.exe 37 PID 2424 wrote to memory of 2796 2424 tnhtbt.exe 37 PID 2424 wrote to memory of 2796 2424 tnhtbt.exe 37 PID 2424 wrote to memory of 2796 2424 tnhtbt.exe 37 PID 2796 wrote to memory of 2780 2796 3vjjp.exe 38 PID 2796 wrote to memory of 2780 2796 3vjjp.exe 38 PID 2796 wrote to memory of 2780 2796 3vjjp.exe 38 PID 2796 wrote to memory of 2780 2796 3vjjp.exe 38 PID 2780 wrote to memory of 3016 2780 btnntb.exe 39 PID 2780 wrote to memory of 3016 2780 btnntb.exe 39 PID 2780 wrote to memory of 3016 2780 btnntb.exe 39 PID 2780 wrote to memory of 3016 2780 btnntb.exe 39 PID 3016 wrote to memory of 620 3016 vjvdj.exe 40 PID 3016 wrote to memory of 620 3016 vjvdj.exe 40 PID 3016 wrote to memory of 620 3016 vjvdj.exe 40 PID 3016 wrote to memory of 620 3016 vjvdj.exe 40 PID 620 wrote to memory of 812 620 xlxxffr.exe 41 PID 620 wrote to memory of 812 620 xlxxffr.exe 41 PID 620 wrote to memory of 812 620 xlxxffr.exe 41 PID 620 wrote to memory of 812 620 xlxxffr.exe 41 PID 812 wrote to memory of 1816 812 thttbh.exe 42 PID 812 wrote to memory of 1816 812 thttbh.exe 42 PID 812 wrote to memory of 1816 812 thttbh.exe 42 PID 812 wrote to memory of 1816 812 thttbh.exe 42 PID 1816 wrote to memory of 2596 1816 7vjjj.exe 43 PID 1816 wrote to memory of 2596 1816 7vjjj.exe 43 PID 1816 wrote to memory of 2596 1816 7vjjj.exe 43 PID 1816 wrote to memory of 2596 1816 7vjjj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\019c23e895fb69020ea6e5589a91d052e76a2c03c77ce9c838ec75e7846f8f31.exe"C:\Users\Admin\AppData\Local\Temp\019c23e895fb69020ea6e5589a91d052e76a2c03c77ce9c838ec75e7846f8f31.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\frllxfl.exec:\frllxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\jvjjv.exec:\jvjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\xxxxrxl.exec:\xxxxrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\bbbhtt.exec:\bbbhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\dvpvd.exec:\dvpvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\3btnbh.exec:\3btnbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\jpjpd.exec:\jpjpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\xlfrxfr.exec:\xlfrxfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\tnhtbt.exec:\tnhtbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\3vjjp.exec:\3vjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\btnntb.exec:\btnntb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vjvdj.exec:\vjvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\xlxxffr.exec:\xlxxffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\thttbh.exec:\thttbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\7vjjj.exec:\7vjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\1hbhbh.exec:\1hbhbh.exe17⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jvddj.exec:\jvddj.exe18⤵
- Executes dropped EXE
PID:1748 -
\??\c:\1lffrrx.exec:\1lffrrx.exe19⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hbttbb.exec:\hbttbb.exe20⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pjpvp.exec:\pjpvp.exe21⤵
- Executes dropped EXE
PID:2940 -
\??\c:\fxlfffl.exec:\fxlfffl.exe22⤵
- Executes dropped EXE
PID:2772 -
\??\c:\btnhhb.exec:\btnhhb.exe23⤵
- Executes dropped EXE
PID:3068 -
\??\c:\rlffrxf.exec:\rlffrxf.exe24⤵
- Executes dropped EXE
PID:992 -
\??\c:\xflrxxx.exec:\xflrxxx.exe25⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vjjjp.exec:\vjjjp.exe26⤵
- Executes dropped EXE
PID:656 -
\??\c:\jdvdp.exec:\jdvdp.exe27⤵
- Executes dropped EXE
PID:1400 -
\??\c:\7nbbnn.exec:\7nbbnn.exe28⤵
- Executes dropped EXE
PID:1276 -
\??\c:\pjdpv.exec:\pjdpv.exe29⤵
- Executes dropped EXE
PID:1672 -
\??\c:\xlffrrf.exec:\xlffrrf.exe30⤵
- Executes dropped EXE
PID:2932 -
\??\c:\tthhtt.exec:\tthhtt.exe31⤵
- Executes dropped EXE
PID:2320 -
\??\c:\fxflrrf.exec:\fxflrrf.exe32⤵
- Executes dropped EXE
PID:1524 -
\??\c:\hbhhtb.exec:\hbhhtb.exe33⤵
- Executes dropped EXE
PID:2448 -
\??\c:\dvvvj.exec:\dvvvj.exe34⤵
- Executes dropped EXE
PID:2292 -
\??\c:\frllrrf.exec:\frllrrf.exe35⤵
- Executes dropped EXE
PID:1328 -
\??\c:\3lxlrrf.exec:\3lxlrrf.exe36⤵
- Executes dropped EXE
PID:2748 -
\??\c:\nhntbb.exec:\nhntbb.exe37⤵
- Executes dropped EXE
PID:2148 -
\??\c:\7jppv.exec:\7jppv.exe38⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rfrxfxf.exec:\rfrxfxf.exe39⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rxrrxxl.exec:\rxrrxxl.exe40⤵
- Executes dropped EXE
PID:2276 -
\??\c:\9tntnn.exec:\9tntnn.exe41⤵
- Executes dropped EXE
PID:2872 -
\??\c:\pjvvd.exec:\pjvvd.exe42⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jdjjv.exec:\jdjjv.exe43⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xfxlxlr.exec:\xfxlxlr.exe44⤵
- Executes dropped EXE
PID:2568 -
\??\c:\9bbbnh.exec:\9bbbnh.exe45⤵
- Executes dropped EXE
PID:2588 -
\??\c:\1hbbbb.exec:\1hbbbb.exe46⤵
- Executes dropped EXE
PID:2656 -
\??\c:\jvjpp.exec:\jvjpp.exe47⤵
- Executes dropped EXE
PID:2804 -
\??\c:\xlxfxxl.exec:\xlxfxxl.exe48⤵
- Executes dropped EXE
PID:2856 -
\??\c:\frffllx.exec:\frffllx.exe49⤵
- Executes dropped EXE
PID:2636 -
\??\c:\tnthhh.exec:\tnthhh.exe50⤵
- Executes dropped EXE
PID:2980 -
\??\c:\bnbnbh.exec:\bnbnbh.exe51⤵
- Executes dropped EXE
PID:3016 -
\??\c:\dvpdp.exec:\dvpdp.exe52⤵
- Executes dropped EXE
PID:1200 -
\??\c:\1pvvp.exec:\1pvvp.exe53⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rfxrrrf.exec:\rfxrrrf.exe54⤵
- Executes dropped EXE
PID:1760 -
\??\c:\bnbbhh.exec:\bnbbhh.exe55⤵
- Executes dropped EXE
PID:1716 -
\??\c:\3bbbtt.exec:\3bbbtt.exe56⤵
- Executes dropped EXE
PID:1648 -
\??\c:\ddvdp.exec:\ddvdp.exe57⤵
- Executes dropped EXE
PID:1748 -
\??\c:\pjvpv.exec:\pjvpv.exe58⤵
- Executes dropped EXE
PID:2052 -
\??\c:\fxflrlx.exec:\fxflrlx.exe59⤵
- Executes dropped EXE
PID:2060 -
\??\c:\nnbhtb.exec:\nnbhtb.exe60⤵
- Executes dropped EXE
PID:2520 -
\??\c:\3nbbtt.exec:\3nbbtt.exe61⤵
- Executes dropped EXE
PID:2516 -
\??\c:\1vjjj.exec:\1vjjj.exe62⤵
- Executes dropped EXE
PID:536 -
\??\c:\9jddj.exec:\9jddj.exe63⤵
- Executes dropped EXE
PID:868 -
\??\c:\fxrrxrf.exec:\fxrrxrf.exe64⤵
- Executes dropped EXE
PID:584 -
\??\c:\btthnn.exec:\btthnn.exe65⤵
- Executes dropped EXE
PID:1820 -
\??\c:\nnbhbb.exec:\nnbhbb.exe66⤵PID:1920
-
\??\c:\dvjjp.exec:\dvjjp.exe67⤵PID:656
-
\??\c:\7lrrrlx.exec:\7lrrrlx.exe68⤵PID:1928
-
\??\c:\7xrrxxf.exec:\7xrrxxf.exe69⤵PID:2948
-
\??\c:\btnntb.exec:\btnntb.exe70⤵PID:572
-
\??\c:\7jpjv.exec:\7jpjv.exe71⤵PID:2332
-
\??\c:\vpvvd.exec:\vpvvd.exe72⤵PID:2232
-
\??\c:\3fxfllr.exec:\3fxfllr.exe73⤵PID:2324
-
\??\c:\xxxfllr.exec:\xxxfllr.exe74⤵PID:2616
-
\??\c:\hhtbhh.exec:\hhtbhh.exe75⤵PID:1900
-
\??\c:\dvjjv.exec:\dvjjv.exe76⤵PID:1728
-
\??\c:\1pdjp.exec:\1pdjp.exe77⤵PID:1256
-
\??\c:\9frxfxf.exec:\9frxfxf.exe78⤵PID:1328
-
\??\c:\frfflfr.exec:\frfflfr.exe79⤵PID:1456
-
\??\c:\3bbnhh.exec:\3bbnhh.exe80⤵PID:2148
-
\??\c:\dvjjv.exec:\dvjjv.exe81⤵PID:2640
-
\??\c:\vpjdj.exec:\vpjdj.exe82⤵PID:2760
-
\??\c:\fxffrrf.exec:\fxffrrf.exe83⤵PID:2688
-
\??\c:\rlrlfff.exec:\rlrlfff.exe84⤵PID:2872
-
\??\c:\bhbbbb.exec:\bhbbbb.exe85⤵PID:2752
-
\??\c:\hthhnn.exec:\hthhnn.exe86⤵PID:2592
-
\??\c:\jjdjp.exec:\jjdjp.exe87⤵PID:3044
-
\??\c:\xxrxlfr.exec:\xxrxlfr.exe88⤵PID:2588
-
\??\c:\fxllrrx.exec:\fxllrrx.exe89⤵PID:2656
-
\??\c:\bhbbhn.exec:\bhbbhn.exe90⤵PID:2796
-
\??\c:\ddvjp.exec:\ddvjp.exe91⤵PID:2856
-
\??\c:\jvjjp.exec:\jvjjp.exe92⤵PID:2636
-
\??\c:\xrxxffx.exec:\xrxxffx.exe93⤵PID:2980
-
\??\c:\lxxfxfr.exec:\lxxfxfr.exe94⤵PID:2008
-
\??\c:\ttnbnt.exec:\ttnbnt.exe95⤵PID:2020
-
\??\c:\dvjdj.exec:\dvjdj.exe96⤵PID:1704
-
\??\c:\3pdjv.exec:\3pdjv.exe97⤵PID:2604
-
\??\c:\xrffxlx.exec:\xrffxlx.exe98⤵PID:1716
-
\??\c:\rrlrrxl.exec:\rrlrrxl.exe99⤵PID:1564
-
\??\c:\nnbhnt.exec:\nnbhnt.exe100⤵PID:1748
-
\??\c:\5dpdj.exec:\5dpdj.exe101⤵PID:1336
-
\??\c:\3vdjp.exec:\3vdjp.exe102⤵PID:2060
-
\??\c:\xlxfrrx.exec:\xlxfrrx.exe103⤵PID:1264
-
\??\c:\rllrlrx.exec:\rllrlrx.exe104⤵PID:2516
-
\??\c:\tbnnbh.exec:\tbnnbh.exe105⤵PID:1504
-
\??\c:\3jjvd.exec:\3jjvd.exe106⤵PID:868
-
\??\c:\5vpdd.exec:\5vpdd.exe107⤵PID:712
-
\??\c:\7rflrrf.exec:\7rflrrf.exe108⤵PID:1820
-
\??\c:\xrfflrx.exec:\xrfflrx.exe109⤵PID:1880
-
\??\c:\hnhntt.exec:\hnhntt.exe110⤵PID:656
-
\??\c:\dpddp.exec:\dpddp.exe111⤵PID:1668
-
\??\c:\ddppv.exec:\ddppv.exe112⤵PID:2948
-
\??\c:\frflrrx.exec:\frflrrx.exe113⤵PID:1736
-
\??\c:\btttbb.exec:\btttbb.exe114⤵PID:2332
-
\??\c:\hbnbtb.exec:\hbnbtb.exe115⤵PID:2232
-
\??\c:\jdpjv.exec:\jdpjv.exe116⤵PID:2324
-
\??\c:\jddpv.exec:\jddpv.exe117⤵PID:1588
-
\??\c:\9ffxxfr.exec:\9ffxxfr.exe118⤵PID:2264
-
\??\c:\rfllllf.exec:\rfllllf.exe119⤵PID:2096
-
\??\c:\hbtbnt.exec:\hbtbnt.exe120⤵PID:2108
-
\??\c:\dvddj.exec:\dvddj.exe121⤵PID:2684
-
\??\c:\jdjvj.exec:\jdjvj.exe122⤵PID:2768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-