Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 18:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
05645442132cb14ff2f64e0b0f2a740f2b07505949961eb96423c6564c5dc264.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
05645442132cb14ff2f64e0b0f2a740f2b07505949961eb96423c6564c5dc264.exe
-
Size
76KB
-
MD5
287414622bb8b4193a47085f7537410a
-
SHA1
48684dfe3568f87669d3265f1e7bdf9b70decf18
-
SHA256
05645442132cb14ff2f64e0b0f2a740f2b07505949961eb96423c6564c5dc264
-
SHA512
9ac31e4c1738568255b56403c2f716e8617faf8ffc4f9ba9134d8d72eb614c9ab0768be1b7bfd9d5bf602a8623b7025804fec12cea751220a3ccb5d449064139
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAX8gu3Gno9yvrjKI:ymb3NkkiQ3mdBjFo68t3Gno9Ij
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/1692-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2308-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1328-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1240-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1492-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/112-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1060-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 22 IoCs
resource yara_rule behavioral1/memory/1624-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1692-6-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2832-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2308-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2816-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2916-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2536-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2576-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2556-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1676-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2880-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3008-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1516-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1328-143-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2784-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1240-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1948-223-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1492-232-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2148-259-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/112-269-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1060-277-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2120-295-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1624 7xrrxfr.exe 2832 bthnnn.exe 2308 jdvdp.exe 2816 7xrxffl.exe 2916 1nhtnb.exe 2536 3djdj.exe 2740 dvjjj.exe 2576 lfrxllx.exe 2556 nhtbhh.exe 1676 hhhnbt.exe 2880 pjvpd.exe 3008 1ffflrx.exe 1516 7nntnh.exe 1328 bnhntn.exe 1656 dvvdp.exe 2500 lffxrrf.exe 2784 rrfrxlr.exe 1264 7thbtb.exe 1240 vvppd.exe 1232 ppppj.exe 564 rllffff.exe 2268 bthhhh.exe 1948 jddpv.exe 1492 3ddjd.exe 2608 llxfrxl.exe 1552 tnbbnn.exe 2148 9vpjv.exe 112 xrffxxf.exe 1060 xxxxlfr.exe 2936 tnbntt.exe 2120 dvvdv.exe 892 3vjvj.exe 1692 rrrfrxl.exe 1716 btbhnt.exe 2228 5tnbnn.exe 2224 jjvdp.exe 1804 ddvjv.exe 2736 rlfrflx.exe 2668 rrlrffr.exe 2820 nhbhth.exe 2552 7ttnbh.exe 2684 ddpjd.exe 2524 3jjpv.exe 2436 ffffffr.exe 2588 llfrxfr.exe 2776 nhttht.exe 2844 bbthtt.exe 2900 9jvvd.exe 2260 ppdjv.exe 3008 7lxxfll.exe 1516 llxrlrx.exe 2008 9hhtbh.exe 1428 nhttbn.exe 2752 9pvvd.exe 536 5dvvj.exe 2784 9lrrflx.exe 852 xrflrfr.exe 320 7bhbnt.exe 2244 3thhht.exe 2496 ppjjd.exe 2428 pjjvv.exe 672 pdvpj.exe 916 rlxfrxr.exe 1984 llxlfrl.exe -
resource yara_rule behavioral1/memory/1624-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1328-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1240-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/112-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-295-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1692 wrote to memory of 1624 1692 05645442132cb14ff2f64e0b0f2a740f2b07505949961eb96423c6564c5dc264.exe 28 PID 1692 wrote to memory of 1624 1692 05645442132cb14ff2f64e0b0f2a740f2b07505949961eb96423c6564c5dc264.exe 28 PID 1692 wrote to memory of 1624 1692 05645442132cb14ff2f64e0b0f2a740f2b07505949961eb96423c6564c5dc264.exe 28 PID 1692 wrote to memory of 1624 1692 05645442132cb14ff2f64e0b0f2a740f2b07505949961eb96423c6564c5dc264.exe 28 PID 1624 wrote to memory of 2832 1624 7xrrxfr.exe 29 PID 1624 wrote to memory of 2832 1624 7xrrxfr.exe 29 PID 1624 wrote to memory of 2832 1624 7xrrxfr.exe 29 PID 1624 wrote to memory of 2832 1624 7xrrxfr.exe 29 PID 2832 wrote to memory of 2308 2832 bthnnn.exe 30 PID 2832 wrote to memory of 2308 2832 bthnnn.exe 30 PID 2832 wrote to memory of 2308 2832 bthnnn.exe 30 PID 2832 wrote to memory of 2308 2832 bthnnn.exe 30 PID 2308 wrote to memory of 2816 2308 jdvdp.exe 31 PID 2308 wrote to memory of 2816 2308 jdvdp.exe 31 PID 2308 wrote to memory of 2816 2308 jdvdp.exe 31 PID 2308 wrote to memory of 2816 2308 jdvdp.exe 31 PID 2816 wrote to memory of 2916 2816 7xrxffl.exe 32 PID 2816 wrote to memory of 2916 2816 7xrxffl.exe 32 PID 2816 wrote to memory of 2916 2816 7xrxffl.exe 32 PID 2816 wrote to memory of 2916 2816 7xrxffl.exe 32 PID 2916 wrote to memory of 2536 2916 1nhtnb.exe 33 PID 2916 wrote to memory of 2536 2916 1nhtnb.exe 33 PID 2916 wrote to memory of 2536 2916 1nhtnb.exe 33 PID 2916 wrote to memory of 2536 2916 1nhtnb.exe 33 PID 2536 wrote to memory of 2740 2536 3djdj.exe 34 PID 2536 wrote to memory of 2740 2536 3djdj.exe 34 PID 2536 wrote to memory of 2740 2536 3djdj.exe 34 PID 2536 wrote to memory of 2740 2536 3djdj.exe 34 PID 2740 wrote to memory of 2576 2740 dvjjj.exe 35 PID 2740 wrote to memory of 2576 2740 dvjjj.exe 35 PID 2740 wrote to memory of 2576 2740 dvjjj.exe 35 PID 2740 wrote to memory of 2576 2740 dvjjj.exe 35 PID 2576 wrote to memory of 2556 2576 lfrxllx.exe 36 PID 2576 wrote to memory of 2556 2576 lfrxllx.exe 36 PID 2576 wrote to memory of 2556 2576 lfrxllx.exe 36 PID 2576 wrote to memory of 2556 2576 lfrxllx.exe 36 PID 2556 wrote to memory of 1676 2556 nhtbhh.exe 37 PID 2556 wrote to memory of 1676 2556 nhtbhh.exe 37 PID 2556 wrote to memory of 1676 2556 nhtbhh.exe 37 PID 2556 wrote to memory of 1676 2556 nhtbhh.exe 37 PID 1676 wrote to memory of 2880 1676 hhhnbt.exe 38 PID 1676 wrote to memory of 2880 1676 hhhnbt.exe 38 PID 1676 wrote to memory of 2880 1676 hhhnbt.exe 38 PID 1676 wrote to memory of 2880 1676 hhhnbt.exe 38 PID 2880 wrote to memory of 3008 2880 pjvpd.exe 39 PID 2880 wrote to memory of 3008 2880 pjvpd.exe 39 PID 2880 wrote to memory of 3008 2880 pjvpd.exe 39 PID 2880 wrote to memory of 3008 2880 pjvpd.exe 39 PID 3008 wrote to memory of 1516 3008 1ffflrx.exe 40 PID 3008 wrote to memory of 1516 3008 1ffflrx.exe 40 PID 3008 wrote to memory of 1516 3008 1ffflrx.exe 40 PID 3008 wrote to memory of 1516 3008 1ffflrx.exe 40 PID 1516 wrote to memory of 1328 1516 7nntnh.exe 41 PID 1516 wrote to memory of 1328 1516 7nntnh.exe 41 PID 1516 wrote to memory of 1328 1516 7nntnh.exe 41 PID 1516 wrote to memory of 1328 1516 7nntnh.exe 41 PID 1328 wrote to memory of 1656 1328 bnhntn.exe 42 PID 1328 wrote to memory of 1656 1328 bnhntn.exe 42 PID 1328 wrote to memory of 1656 1328 bnhntn.exe 42 PID 1328 wrote to memory of 1656 1328 bnhntn.exe 42 PID 1656 wrote to memory of 2500 1656 dvvdp.exe 43 PID 1656 wrote to memory of 2500 1656 dvvdp.exe 43 PID 1656 wrote to memory of 2500 1656 dvvdp.exe 43 PID 1656 wrote to memory of 2500 1656 dvvdp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\05645442132cb14ff2f64e0b0f2a740f2b07505949961eb96423c6564c5dc264.exe"C:\Users\Admin\AppData\Local\Temp\05645442132cb14ff2f64e0b0f2a740f2b07505949961eb96423c6564c5dc264.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\7xrrxfr.exec:\7xrrxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\bthnnn.exec:\bthnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\jdvdp.exec:\jdvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\7xrxffl.exec:\7xrxffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\1nhtnb.exec:\1nhtnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\3djdj.exec:\3djdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\dvjjj.exec:\dvjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\lfrxllx.exec:\lfrxllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\nhtbhh.exec:\nhtbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\hhhnbt.exec:\hhhnbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\pjvpd.exec:\pjvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\1ffflrx.exec:\1ffflrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\7nntnh.exec:\7nntnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\bnhntn.exec:\bnhntn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\dvvdp.exec:\dvvdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\lffxrrf.exec:\lffxrrf.exe17⤵
- Executes dropped EXE
PID:2500 -
\??\c:\rrfrxlr.exec:\rrfrxlr.exe18⤵
- Executes dropped EXE
PID:2784 -
\??\c:\7thbtb.exec:\7thbtb.exe19⤵
- Executes dropped EXE
PID:1264 -
\??\c:\vvppd.exec:\vvppd.exe20⤵
- Executes dropped EXE
PID:1240 -
\??\c:\ppppj.exec:\ppppj.exe21⤵
- Executes dropped EXE
PID:1232 -
\??\c:\rllffff.exec:\rllffff.exe22⤵
- Executes dropped EXE
PID:564 -
\??\c:\bthhhh.exec:\bthhhh.exe23⤵
- Executes dropped EXE
PID:2268 -
\??\c:\jddpv.exec:\jddpv.exe24⤵
- Executes dropped EXE
PID:1948 -
\??\c:\3ddjd.exec:\3ddjd.exe25⤵
- Executes dropped EXE
PID:1492 -
\??\c:\llxfrxl.exec:\llxfrxl.exe26⤵
- Executes dropped EXE
PID:2608 -
\??\c:\tnbbnn.exec:\tnbbnn.exe27⤵
- Executes dropped EXE
PID:1552 -
\??\c:\9vpjv.exec:\9vpjv.exe28⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xrffxxf.exec:\xrffxxf.exe29⤵
- Executes dropped EXE
PID:112 -
\??\c:\xxxxlfr.exec:\xxxxlfr.exe30⤵
- Executes dropped EXE
PID:1060 -
\??\c:\tnbntt.exec:\tnbntt.exe31⤵
- Executes dropped EXE
PID:2936 -
\??\c:\dvvdv.exec:\dvvdv.exe32⤵
- Executes dropped EXE
PID:2120 -
\??\c:\3vjvj.exec:\3vjvj.exe33⤵
- Executes dropped EXE
PID:892 -
\??\c:\rrrfrxl.exec:\rrrfrxl.exe34⤵
- Executes dropped EXE
PID:1692 -
\??\c:\btbhnt.exec:\btbhnt.exe35⤵
- Executes dropped EXE
PID:1716 -
\??\c:\5tnbnn.exec:\5tnbnn.exe36⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jjvdp.exec:\jjvdp.exe37⤵
- Executes dropped EXE
PID:2224 -
\??\c:\ddvjv.exec:\ddvjv.exe38⤵
- Executes dropped EXE
PID:1804 -
\??\c:\rlfrflx.exec:\rlfrflx.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rrlrffr.exec:\rrlrffr.exe40⤵
- Executes dropped EXE
PID:2668 -
\??\c:\nhbhth.exec:\nhbhth.exe41⤵
- Executes dropped EXE
PID:2820 -
\??\c:\7ttnbh.exec:\7ttnbh.exe42⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ddpjd.exec:\ddpjd.exe43⤵
- Executes dropped EXE
PID:2684 -
\??\c:\3jjpv.exec:\3jjpv.exe44⤵
- Executes dropped EXE
PID:2524 -
\??\c:\ffffffr.exec:\ffffffr.exe45⤵
- Executes dropped EXE
PID:2436 -
\??\c:\llfrxfr.exec:\llfrxfr.exe46⤵
- Executes dropped EXE
PID:2588 -
\??\c:\nhttht.exec:\nhttht.exe47⤵
- Executes dropped EXE
PID:2776 -
\??\c:\bbthtt.exec:\bbthtt.exe48⤵
- Executes dropped EXE
PID:2844 -
\??\c:\9jvvd.exec:\9jvvd.exe49⤵
- Executes dropped EXE
PID:2900 -
\??\c:\ppdjv.exec:\ppdjv.exe50⤵
- Executes dropped EXE
PID:2260 -
\??\c:\7lxxfll.exec:\7lxxfll.exe51⤵
- Executes dropped EXE
PID:3008 -
\??\c:\llxrlrx.exec:\llxrlrx.exe52⤵
- Executes dropped EXE
PID:1516 -
\??\c:\9hhtbh.exec:\9hhtbh.exe53⤵
- Executes dropped EXE
PID:2008 -
\??\c:\nhttbn.exec:\nhttbn.exe54⤵
- Executes dropped EXE
PID:1428 -
\??\c:\9pvvd.exec:\9pvvd.exe55⤵
- Executes dropped EXE
PID:2752 -
\??\c:\5dvvj.exec:\5dvvj.exe56⤵
- Executes dropped EXE
PID:536 -
\??\c:\9lrrflx.exec:\9lrrflx.exe57⤵
- Executes dropped EXE
PID:2784 -
\??\c:\xrflrfr.exec:\xrflrfr.exe58⤵
- Executes dropped EXE
PID:852 -
\??\c:\7bhbnt.exec:\7bhbnt.exe59⤵
- Executes dropped EXE
PID:320 -
\??\c:\3thhht.exec:\3thhht.exe60⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ppjjd.exec:\ppjjd.exe61⤵
- Executes dropped EXE
PID:2496 -
\??\c:\pjjvv.exec:\pjjvv.exe62⤵
- Executes dropped EXE
PID:2428 -
\??\c:\pdvpj.exec:\pdvpj.exe63⤵
- Executes dropped EXE
PID:672 -
\??\c:\rlxfrxr.exec:\rlxfrxr.exe64⤵
- Executes dropped EXE
PID:916 -
\??\c:\llxlfrl.exec:\llxlfrl.exe65⤵
- Executes dropped EXE
PID:1984 -
\??\c:\tnbbtb.exec:\tnbbtb.exe66⤵PID:1096
-
\??\c:\tntbnt.exec:\tntbnt.exe67⤵PID:324
-
\??\c:\pvdjv.exec:\pvdjv.exe68⤵PID:344
-
\??\c:\vjdpp.exec:\vjdpp.exe69⤵PID:920
-
\??\c:\9frxffr.exec:\9frxffr.exe70⤵PID:548
-
\??\c:\7nnhtb.exec:\7nnhtb.exe71⤵PID:2924
-
\??\c:\nhbnnn.exec:\nhbnnn.exe72⤵PID:1060
-
\??\c:\jjvvp.exec:\jjvvp.exe73⤵PID:1828
-
\??\c:\3pddp.exec:\3pddp.exe74⤵PID:896
-
\??\c:\vpjpv.exec:\vpjpv.exe75⤵PID:296
-
\??\c:\frrlrxx.exec:\frrlrxx.exe76⤵PID:1612
-
\??\c:\lfxflrr.exec:\lfxflrr.exe77⤵PID:2408
-
\??\c:\1hhtht.exec:\1hhtht.exe78⤵PID:2128
-
\??\c:\hnhthh.exec:\hnhthh.exe79⤵PID:2652
-
\??\c:\jvppp.exec:\jvppp.exe80⤵PID:2720
-
\??\c:\dvppv.exec:\dvppv.exe81⤵PID:2712
-
\??\c:\3rxxfrx.exec:\3rxxfrx.exe82⤵PID:2628
-
\??\c:\9lxfffx.exec:\9lxfffx.exe83⤵PID:2796
-
\??\c:\bbthbt.exec:\bbthbt.exe84⤵PID:2868
-
\??\c:\nntttt.exec:\nntttt.exe85⤵PID:2536
-
\??\c:\dvddj.exec:\dvddj.exe86⤵PID:2508
-
\??\c:\jdjjv.exec:\jdjjv.exe87⤵PID:3004
-
\??\c:\5xrfrxf.exec:\5xrfrxf.exe88⤵PID:2108
-
\??\c:\xrxlrrx.exec:\xrxlrrx.exe89⤵PID:2840
-
\??\c:\hbntbh.exec:\hbntbh.exe90⤵PID:1676
-
\??\c:\nhhnth.exec:\nhhnth.exe91⤵PID:2384
-
\??\c:\jjvjp.exec:\jjvjp.exe92⤵PID:1304
-
\??\c:\1jddd.exec:\1jddd.exe93⤵PID:2260
-
\??\c:\1ffrffl.exec:\1ffrffl.exe94⤵PID:1628
-
\??\c:\rlxrxlf.exec:\rlxrxlf.exe95⤵PID:2160
-
\??\c:\hhhtnh.exec:\hhhtnh.exe96⤵PID:2008
-
\??\c:\tnthtb.exec:\tnthtb.exe97⤵PID:2792
-
\??\c:\tnnbbh.exec:\tnnbbh.exe98⤵PID:1816
-
\??\c:\pjddd.exec:\pjddd.exe99⤵PID:1320
-
\??\c:\dvppp.exec:\dvppp.exe100⤵PID:684
-
\??\c:\1lffllr.exec:\1lffllr.exe101⤵PID:2076
-
\??\c:\rrllxfl.exec:\rrllxfl.exe102⤵PID:596
-
\??\c:\hbntbh.exec:\hbntbh.exe103⤵PID:2084
-
\??\c:\bnhhtb.exec:\bnhhtb.exe104⤵PID:2332
-
\??\c:\tnhtbn.exec:\tnhtbn.exe105⤵PID:1176
-
\??\c:\1pppv.exec:\1pppv.exe106⤵PID:1104
-
\??\c:\5vvvd.exec:\5vvvd.exe107⤵PID:1868
-
\??\c:\7dvvp.exec:\7dvvp.exe108⤵PID:2312
-
\??\c:\rrlrlxl.exec:\rrlrlxl.exe109⤵PID:1364
-
\??\c:\3lllrrx.exec:\3lllrrx.exe110⤵PID:764
-
\??\c:\3btbnt.exec:\3btbnt.exe111⤵PID:624
-
\??\c:\tnhhnt.exec:\tnhhnt.exe112⤵PID:1796
-
\??\c:\ddjpv.exec:\ddjpv.exe113⤵PID:2596
-
\??\c:\vppdv.exec:\vppdv.exe114⤵PID:2256
-
\??\c:\5llrxfx.exec:\5llrxfx.exe115⤵PID:2980
-
\??\c:\rlllxfr.exec:\rlllxfr.exe116⤵PID:2120
-
\??\c:\rrlrfxf.exec:\rrlrfxf.exe117⤵PID:1044
-
\??\c:\nhhttb.exec:\nhhttb.exe118⤵PID:1692
-
\??\c:\jdvjp.exec:\jdvjp.exe119⤵PID:1572
-
\??\c:\jddvd.exec:\jddvd.exe120⤵PID:2604
-
\??\c:\rfrxlxf.exec:\rfrxlxf.exe121⤵PID:2236
-
\??\c:\llxfxll.exec:\llxfxll.exe122⤵PID:1804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-