Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 02:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc73d82a1c9a8ebc2ac8abbd0ed393fa688d576cc64668064a7540e13d658fbd.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
cc73d82a1c9a8ebc2ac8abbd0ed393fa688d576cc64668064a7540e13d658fbd.exe
-
Size
57KB
-
MD5
b51bdd5df765e7dcb1055b4d8323ae4c
-
SHA1
e8df4da0bfeb0f4401d1cc4489378192b0be4f0d
-
SHA256
cc73d82a1c9a8ebc2ac8abbd0ed393fa688d576cc64668064a7540e13d658fbd
-
SHA512
e832b20d9325a545338f46b0b1047448386e288978d47329abb7bb3c983e5fa2302cc0bc090738fe3f8c76284666fc2465e2da7067d64137ab582f4f60665c01
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuSwFaEt:ymb3NkkiQ3mdBjFIvIFaEt
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2128-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-49-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-69-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-89-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/748-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1480-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1320-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1288-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-5209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 19 IoCs
resource yara_rule behavioral1/memory/2128-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2032-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1728-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2828-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2608-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2884-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2784-68-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2528-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2824-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2524-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2948-108-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/748-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1748-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1480-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1320-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2736-207-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2324-215-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1288-233-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2608-5209-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2032 5pdjj.exe 1728 5lfflrf.exe 2828 bhtnnb.exe 2608 7vvpv.exe 2884 xxrxrfr.exe 2784 ttnhnh.exe 2528 vvvvv.exe 2824 ddvvd.exe 2524 rlfllrx.exe 2948 nbtthn.exe 1572 tnhthh.exe 748 1dpvv.exe 1748 xlflrxf.exe 1792 flfrrfl.exe 744 nntbtb.exe 1536 tnhnbn.exe 668 pppdj.exe 1480 rrfrffx.exe 1320 xrllrff.exe 2740 bbnbht.exe 2736 btthnn.exe 2324 vpddp.exe 2052 jjdjd.exe 1288 ffflffx.exe 376 9htnth.exe 2996 nhtntb.exe 564 pjvdp.exe 1932 llfxlfl.exe 348 ffxflrx.exe 2360 tthhnt.exe 2876 hhnthh.exe 1684 vppvj.exe 1732 ppppv.exe 2856 7xrrflx.exe 1592 ttnthn.exe 3008 tnthtb.exe 2828 dvpdj.exe 2660 djvpv.exe 1972 ffflrxf.exe 2664 fxxfllf.exe 2684 9tttnt.exe 2780 nhbhnt.exe 2500 ddppd.exe 2580 vvjpv.exe 2524 9fxrxrx.exe 2944 lxfrrxf.exe 1504 fflxlrx.exe 2200 nhthnb.exe 1752 tthntt.exe 268 jdjvv.exe 2208 jdpvd.exe 2432 llrfrrf.exe 2316 1rllrrx.exe 868 btnttb.exe 624 ttbnnb.exe 844 pjjpd.exe 1636 vvppd.exe 2740 frrlflx.exe 2256 7rfrrxf.exe 2084 lxrxflx.exe 2852 nnbntb.exe 2340 tntbhn.exe 1856 jjpdd.exe 828 rlxxffl.exe -
resource yara_rule behavioral1/memory/2128-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/748-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1480-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1320-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1288-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-5209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2032 2128 cc73d82a1c9a8ebc2ac8abbd0ed393fa688d576cc64668064a7540e13d658fbd.exe 28 PID 2128 wrote to memory of 2032 2128 cc73d82a1c9a8ebc2ac8abbd0ed393fa688d576cc64668064a7540e13d658fbd.exe 28 PID 2128 wrote to memory of 2032 2128 cc73d82a1c9a8ebc2ac8abbd0ed393fa688d576cc64668064a7540e13d658fbd.exe 28 PID 2128 wrote to memory of 2032 2128 cc73d82a1c9a8ebc2ac8abbd0ed393fa688d576cc64668064a7540e13d658fbd.exe 28 PID 2032 wrote to memory of 1728 2032 5pdjj.exe 29 PID 2032 wrote to memory of 1728 2032 5pdjj.exe 29 PID 2032 wrote to memory of 1728 2032 5pdjj.exe 29 PID 2032 wrote to memory of 1728 2032 5pdjj.exe 29 PID 1728 wrote to memory of 2828 1728 5lfflrf.exe 30 PID 1728 wrote to memory of 2828 1728 5lfflrf.exe 30 PID 1728 wrote to memory of 2828 1728 5lfflrf.exe 30 PID 1728 wrote to memory of 2828 1728 5lfflrf.exe 30 PID 2828 wrote to memory of 2608 2828 bhtnnb.exe 31 PID 2828 wrote to memory of 2608 2828 bhtnnb.exe 31 PID 2828 wrote to memory of 2608 2828 bhtnnb.exe 31 PID 2828 wrote to memory of 2608 2828 bhtnnb.exe 31 PID 2608 wrote to memory of 2884 2608 7vvpv.exe 32 PID 2608 wrote to memory of 2884 2608 7vvpv.exe 32 PID 2608 wrote to memory of 2884 2608 7vvpv.exe 32 PID 2608 wrote to memory of 2884 2608 7vvpv.exe 32 PID 2884 wrote to memory of 2784 2884 xxrxrfr.exe 33 PID 2884 wrote to memory of 2784 2884 xxrxrfr.exe 33 PID 2884 wrote to memory of 2784 2884 xxrxrfr.exe 33 PID 2884 wrote to memory of 2784 2884 xxrxrfr.exe 33 PID 2784 wrote to memory of 2528 2784 ttnhnh.exe 34 PID 2784 wrote to memory of 2528 2784 ttnhnh.exe 34 PID 2784 wrote to memory of 2528 2784 ttnhnh.exe 34 PID 2784 wrote to memory of 2528 2784 ttnhnh.exe 34 PID 2528 wrote to memory of 2824 2528 vvvvv.exe 35 PID 2528 wrote to memory of 2824 2528 vvvvv.exe 35 PID 2528 wrote to memory of 2824 2528 vvvvv.exe 35 PID 2528 wrote to memory of 2824 2528 vvvvv.exe 35 PID 2824 wrote to memory of 2524 2824 ddvvd.exe 36 PID 2824 wrote to memory of 2524 2824 ddvvd.exe 36 PID 2824 wrote to memory of 2524 2824 ddvvd.exe 36 PID 2824 wrote to memory of 2524 2824 ddvvd.exe 36 PID 2524 wrote to memory of 2948 2524 rlfllrx.exe 37 PID 2524 wrote to memory of 2948 2524 rlfllrx.exe 37 PID 2524 wrote to memory of 2948 2524 rlfllrx.exe 37 PID 2524 wrote to memory of 2948 2524 rlfllrx.exe 37 PID 2948 wrote to memory of 1572 2948 nbtthn.exe 38 PID 2948 wrote to memory of 1572 2948 nbtthn.exe 38 PID 2948 wrote to memory of 1572 2948 nbtthn.exe 38 PID 2948 wrote to memory of 1572 2948 nbtthn.exe 38 PID 1572 wrote to memory of 748 1572 tnhthh.exe 39 PID 1572 wrote to memory of 748 1572 tnhthh.exe 39 PID 1572 wrote to memory of 748 1572 tnhthh.exe 39 PID 1572 wrote to memory of 748 1572 tnhthh.exe 39 PID 748 wrote to memory of 1748 748 1dpvv.exe 40 PID 748 wrote to memory of 1748 748 1dpvv.exe 40 PID 748 wrote to memory of 1748 748 1dpvv.exe 40 PID 748 wrote to memory of 1748 748 1dpvv.exe 40 PID 1748 wrote to memory of 1792 1748 xlflrxf.exe 41 PID 1748 wrote to memory of 1792 1748 xlflrxf.exe 41 PID 1748 wrote to memory of 1792 1748 xlflrxf.exe 41 PID 1748 wrote to memory of 1792 1748 xlflrxf.exe 41 PID 1792 wrote to memory of 744 1792 flfrrfl.exe 42 PID 1792 wrote to memory of 744 1792 flfrrfl.exe 42 PID 1792 wrote to memory of 744 1792 flfrrfl.exe 42 PID 1792 wrote to memory of 744 1792 flfrrfl.exe 42 PID 744 wrote to memory of 1536 744 nntbtb.exe 43 PID 744 wrote to memory of 1536 744 nntbtb.exe 43 PID 744 wrote to memory of 1536 744 nntbtb.exe 43 PID 744 wrote to memory of 1536 744 nntbtb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc73d82a1c9a8ebc2ac8abbd0ed393fa688d576cc64668064a7540e13d658fbd.exe"C:\Users\Admin\AppData\Local\Temp\cc73d82a1c9a8ebc2ac8abbd0ed393fa688d576cc64668064a7540e13d658fbd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\5pdjj.exec:\5pdjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\5lfflrf.exec:\5lfflrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\bhtnnb.exec:\bhtnnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\7vvpv.exec:\7vvpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\xxrxrfr.exec:\xxrxrfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\ttnhnh.exec:\ttnhnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\vvvvv.exec:\vvvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\ddvvd.exec:\ddvvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\rlfllrx.exec:\rlfllrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\nbtthn.exec:\nbtthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\tnhthh.exec:\tnhthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\1dpvv.exec:\1dpvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\xlflrxf.exec:\xlflrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\flfrrfl.exec:\flfrrfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\nntbtb.exec:\nntbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\tnhnbn.exec:\tnhnbn.exe17⤵
- Executes dropped EXE
PID:1536 -
\??\c:\pppdj.exec:\pppdj.exe18⤵
- Executes dropped EXE
PID:668 -
\??\c:\rrfrffx.exec:\rrfrffx.exe19⤵
- Executes dropped EXE
PID:1480 -
\??\c:\xrllrff.exec:\xrllrff.exe20⤵
- Executes dropped EXE
PID:1320 -
\??\c:\bbnbht.exec:\bbnbht.exe21⤵
- Executes dropped EXE
PID:2740 -
\??\c:\btthnn.exec:\btthnn.exe22⤵
- Executes dropped EXE
PID:2736 -
\??\c:\vpddp.exec:\vpddp.exe23⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jjdjd.exec:\jjdjd.exe24⤵
- Executes dropped EXE
PID:2052 -
\??\c:\ffflffx.exec:\ffflffx.exe25⤵
- Executes dropped EXE
PID:1288 -
\??\c:\9htnth.exec:\9htnth.exe26⤵
- Executes dropped EXE
PID:376 -
\??\c:\nhtntb.exec:\nhtntb.exe27⤵
- Executes dropped EXE
PID:2996 -
\??\c:\pjvdp.exec:\pjvdp.exe28⤵
- Executes dropped EXE
PID:564 -
\??\c:\llfxlfl.exec:\llfxlfl.exe29⤵
- Executes dropped EXE
PID:1932 -
\??\c:\ffxflrx.exec:\ffxflrx.exe30⤵
- Executes dropped EXE
PID:348 -
\??\c:\tthhnt.exec:\tthhnt.exe31⤵
- Executes dropped EXE
PID:2360 -
\??\c:\hhnthh.exec:\hhnthh.exe32⤵
- Executes dropped EXE
PID:2876 -
\??\c:\vppvj.exec:\vppvj.exe33⤵
- Executes dropped EXE
PID:1684 -
\??\c:\ppppv.exec:\ppppv.exe34⤵
- Executes dropped EXE
PID:1732 -
\??\c:\7xrrflx.exec:\7xrrflx.exe35⤵
- Executes dropped EXE
PID:2856 -
\??\c:\ttnthn.exec:\ttnthn.exe36⤵
- Executes dropped EXE
PID:1592 -
\??\c:\tnthtb.exec:\tnthtb.exe37⤵
- Executes dropped EXE
PID:3008 -
\??\c:\dvpdj.exec:\dvpdj.exe38⤵
- Executes dropped EXE
PID:2828 -
\??\c:\djvpv.exec:\djvpv.exe39⤵
- Executes dropped EXE
PID:2660 -
\??\c:\ffflrxf.exec:\ffflrxf.exe40⤵
- Executes dropped EXE
PID:1972 -
\??\c:\fxxfllf.exec:\fxxfllf.exe41⤵
- Executes dropped EXE
PID:2664 -
\??\c:\9tttnt.exec:\9tttnt.exe42⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nhbhnt.exec:\nhbhnt.exe43⤵
- Executes dropped EXE
PID:2780 -
\??\c:\ddppd.exec:\ddppd.exe44⤵
- Executes dropped EXE
PID:2500 -
\??\c:\vvjpv.exec:\vvjpv.exe45⤵
- Executes dropped EXE
PID:2580 -
\??\c:\9fxrxrx.exec:\9fxrxrx.exe46⤵
- Executes dropped EXE
PID:2524 -
\??\c:\lxfrrxf.exec:\lxfrrxf.exe47⤵
- Executes dropped EXE
PID:2944 -
\??\c:\fflxlrx.exec:\fflxlrx.exe48⤵
- Executes dropped EXE
PID:1504 -
\??\c:\nhthnb.exec:\nhthnb.exe49⤵
- Executes dropped EXE
PID:2200 -
\??\c:\tthntt.exec:\tthntt.exe50⤵
- Executes dropped EXE
PID:1752 -
\??\c:\jdjvv.exec:\jdjvv.exe51⤵
- Executes dropped EXE
PID:268 -
\??\c:\jdpvd.exec:\jdpvd.exe52⤵
- Executes dropped EXE
PID:2208 -
\??\c:\llrfrrf.exec:\llrfrrf.exe53⤵
- Executes dropped EXE
PID:2432 -
\??\c:\1rllrrx.exec:\1rllrrx.exe54⤵
- Executes dropped EXE
PID:2316 -
\??\c:\btnttb.exec:\btnttb.exe55⤵
- Executes dropped EXE
PID:868 -
\??\c:\ttbnnb.exec:\ttbnnb.exe56⤵
- Executes dropped EXE
PID:624 -
\??\c:\pjjpd.exec:\pjjpd.exe57⤵
- Executes dropped EXE
PID:844 -
\??\c:\vvppd.exec:\vvppd.exe58⤵
- Executes dropped EXE
PID:1636 -
\??\c:\frrlflx.exec:\frrlflx.exe59⤵
- Executes dropped EXE
PID:2740 -
\??\c:\7rfrrxf.exec:\7rfrrxf.exe60⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lxrxflx.exec:\lxrxflx.exe61⤵
- Executes dropped EXE
PID:2084 -
\??\c:\nnbntb.exec:\nnbntb.exe62⤵
- Executes dropped EXE
PID:2852 -
\??\c:\tntbhn.exec:\tntbhn.exe63⤵
- Executes dropped EXE
PID:2340 -
\??\c:\jjpdd.exec:\jjpdd.exe64⤵
- Executes dropped EXE
PID:1856 -
\??\c:\rlxxffl.exec:\rlxxffl.exe65⤵
- Executes dropped EXE
PID:828 -
\??\c:\tnbbhn.exec:\tnbbhn.exe66⤵PID:1296
-
\??\c:\bhttbt.exec:\bhttbt.exe67⤵PID:596
-
\??\c:\vpdjj.exec:\vpdjj.exe68⤵PID:1280
-
\??\c:\7jddd.exec:\7jddd.exe69⤵PID:3056
-
\??\c:\vpjjj.exec:\vpjjj.exe70⤵PID:3060
-
\??\c:\7xfrxxl.exec:\7xfrxxl.exe71⤵PID:1212
-
\??\c:\fllrlfr.exec:\fllrlfr.exe72⤵PID:800
-
\??\c:\1ththh.exec:\1ththh.exe73⤵PID:2876
-
\??\c:\btnnbb.exec:\btnnbb.exe74⤵PID:2100
-
\??\c:\jdpvj.exec:\jdpvj.exe75⤵PID:2064
-
\??\c:\9jjpv.exec:\9jjpv.exe76⤵PID:1564
-
\??\c:\rlxfllx.exec:\rlxfllx.exe77⤵PID:3068
-
\??\c:\frlrxfl.exec:\frlrxfl.exe78⤵PID:3012
-
\??\c:\3nhbnn.exec:\3nhbnn.exe79⤵PID:2812
-
\??\c:\nnthtt.exec:\nnthtt.exe80⤵PID:2872
-
\??\c:\dvvvd.exec:\dvvvd.exe81⤵PID:2620
-
\??\c:\dvpjp.exec:\dvpjp.exe82⤵PID:2592
-
\??\c:\7rrrffr.exec:\7rrrffr.exe83⤵PID:2668
-
\??\c:\rrlxlxl.exec:\rrlxlxl.exe84⤵PID:2508
-
\??\c:\bnnnbb.exec:\bnnnbb.exe85⤵PID:2576
-
\??\c:\bbbhbn.exec:\bbbhbn.exe86⤵PID:2536
-
\??\c:\ppddp.exec:\ppddp.exe87⤵PID:1180
-
\??\c:\pdvpv.exec:\pdvpv.exe88⤵PID:1512
-
\??\c:\7rlxrlf.exec:\7rlxrlf.exe89⤵PID:1412
-
\??\c:\llrflrx.exec:\llrflrx.exe90⤵PID:1672
-
\??\c:\btbhnt.exec:\btbhnt.exe91⤵PID:2004
-
\??\c:\tnbthh.exec:\tnbthh.exe92⤵PID:2192
-
\??\c:\pppvd.exec:\pppvd.exe93⤵PID:2212
-
\??\c:\pjvvj.exec:\pjvvj.exe94⤵PID:544
-
\??\c:\dddvd.exec:\dddvd.exe95⤵PID:980
-
\??\c:\rlllrxr.exec:\rlllrxr.exe96⤵PID:2420
-
\??\c:\5rffffr.exec:\5rffffr.exe97⤵PID:2716
-
\??\c:\nhtnhb.exec:\nhtnhb.exe98⤵PID:1092
-
\??\c:\bnbnbn.exec:\bnbnbn.exe99⤵PID:936
-
\??\c:\9jjjp.exec:\9jjjp.exe100⤵PID:3048
-
\??\c:\1vpvd.exec:\1vpvd.exe101⤵PID:1996
-
\??\c:\llfrflx.exec:\llfrflx.exe102⤵PID:2272
-
\??\c:\rlrfllx.exec:\rlrfllx.exe103⤵PID:2056
-
\??\c:\btbhhh.exec:\btbhhh.exe104⤵PID:2052
-
\??\c:\3btbnb.exec:\3btbnb.exe105⤵PID:1356
-
\??\c:\1vpvj.exec:\1vpvj.exe106⤵PID:1300
-
\??\c:\9jdvd.exec:\9jdvd.exe107⤵PID:1500
-
\??\c:\rrlfxfx.exec:\rrlfxfx.exe108⤵PID:2160
-
\??\c:\rlxfrrx.exec:\rlxfrrx.exe109⤵PID:1744
-
\??\c:\btbtbb.exec:\btbtbb.exe110⤵PID:2352
-
\??\c:\bnhtbb.exec:\bnhtbb.exe111⤵PID:1496
-
\??\c:\hhbhnt.exec:\hhbhnt.exe112⤵PID:1236
-
\??\c:\7pvdj.exec:\7pvdj.exe113⤵PID:2008
-
\??\c:\1vjjp.exec:\1vjjp.exe114⤵PID:2588
-
\??\c:\xxfxxlf.exec:\xxfxxlf.exe115⤵PID:2112
-
\??\c:\lfxflll.exec:\lfxflll.exe116⤵PID:1848
-
\??\c:\bthntb.exec:\bthntb.exe117⤵PID:2596
-
\??\c:\nhtttt.exec:\nhtttt.exe118⤵PID:2648
-
\??\c:\vvpdd.exec:\vvpdd.exe119⤵PID:2768
-
\??\c:\vpppv.exec:\vpppv.exe120⤵PID:2812
-
\??\c:\rxxllfr.exec:\rxxllfr.exe121⤵PID:2884
-
\??\c:\ffxxlfx.exec:\ffxxlfx.exe122⤵PID:1144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-