Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 19:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
245b9a7d6db0293d516aa2b4b5fbe8431a736f209e84b7af13ceca1273b858ed.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
-
Target
245b9a7d6db0293d516aa2b4b5fbe8431a736f209e84b7af13ceca1273b858ed.exe
-
Size
75KB
-
MD5
0382fbb94d4a1ee4e9f47ead7877afbf
-
SHA1
5c995479ff52d5a6136940365ab72f5add3fac49
-
SHA256
245b9a7d6db0293d516aa2b4b5fbe8431a736f209e84b7af13ceca1273b858ed
-
SHA512
41fc372d3cdab91985742a9d50c4c82b022eb1b14b3191e3a254e987f02b6c80c29b1ffc7598aba3ba43be9cf8c5249d78cb00e726aa115d9faa6a7771d29da4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINHB:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCuj
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2972-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2040-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-81-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1900-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 23 IoCs
resource yara_rule behavioral1/memory/2972-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2040-6-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2560-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2168-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2168-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2168-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2808-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2600-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2428-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2404-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1900-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2788-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2140-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1960-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2252-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/872-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1872-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1556-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1964-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1764-236-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1640-253-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2016-262-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1748-272-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2972 5lxflll.exe 2560 lxrxxrr.exe 2168 bnhhhn.exe 2808 jjvvv.exe 2600 lfllxxf.exe 2428 lxrllxf.exe 2404 nhbhtt.exe 1900 vjddd.exe 2608 dvjpj.exe 2788 xlxxfxf.exe 2720 1lfffxl.exe 2140 tnbtnn.exe 1960 tntnnh.exe 2252 vjpvv.exe 872 rlfrflx.exe 1872 xrxfrfl.exe 1556 3thtbb.exe 1372 9ppvv.exe 1964 jddvp.exe 2592 fxffxlx.exe 2828 tnbtbh.exe 1004 tnbbhh.exe 2840 dpvjp.exe 1764 vpjdd.exe 2240 fxfxfxl.exe 1640 tntntn.exe 2016 jvjpp.exe 1748 pjppd.exe 1272 rfffllr.exe 1628 lxrflff.exe 900 hthhnn.exe 2040 jdjpj.exe 2584 xrxrrxf.exe 2644 hbtnbb.exe 2480 nnhnbn.exe 2500 9pdjj.exe 2692 fxfxfxx.exe 2688 fxxrxxf.exe 2400 lfrrxxf.exe 2376 thhhnh.exe 2132 jjpvv.exe 2424 jdpvd.exe 1944 vpddj.exe 2604 flrxfxf.exe 2608 7bbtbn.exe 1616 5nhhnn.exe 1940 5vpdd.exe 1916 fxflrxr.exe 2140 fxfflrx.exe 1932 bthhhh.exe 2768 1vvdj.exe 2144 jdvvv.exe 1620 fxfrlfl.exe 1456 9rrrxxl.exe 1708 bbtthh.exe 2236 1bhhnn.exe 2356 jdjvj.exe 2064 pdjjj.exe 612 9rflflr.exe 592 7nbhnn.exe 964 tnnnhb.exe 656 pdppv.exe 1196 3djjj.exe 724 1rfxffl.exe -
resource yara_rule behavioral1/memory/2972-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1900-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-272-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2972 2040 245b9a7d6db0293d516aa2b4b5fbe8431a736f209e84b7af13ceca1273b858ed.exe 28 PID 2040 wrote to memory of 2972 2040 245b9a7d6db0293d516aa2b4b5fbe8431a736f209e84b7af13ceca1273b858ed.exe 28 PID 2040 wrote to memory of 2972 2040 245b9a7d6db0293d516aa2b4b5fbe8431a736f209e84b7af13ceca1273b858ed.exe 28 PID 2040 wrote to memory of 2972 2040 245b9a7d6db0293d516aa2b4b5fbe8431a736f209e84b7af13ceca1273b858ed.exe 28 PID 2972 wrote to memory of 2560 2972 5lxflll.exe 29 PID 2972 wrote to memory of 2560 2972 5lxflll.exe 29 PID 2972 wrote to memory of 2560 2972 5lxflll.exe 29 PID 2972 wrote to memory of 2560 2972 5lxflll.exe 29 PID 2560 wrote to memory of 2168 2560 lxrxxrr.exe 30 PID 2560 wrote to memory of 2168 2560 lxrxxrr.exe 30 PID 2560 wrote to memory of 2168 2560 lxrxxrr.exe 30 PID 2560 wrote to memory of 2168 2560 lxrxxrr.exe 30 PID 2168 wrote to memory of 2808 2168 bnhhhn.exe 31 PID 2168 wrote to memory of 2808 2168 bnhhhn.exe 31 PID 2168 wrote to memory of 2808 2168 bnhhhn.exe 31 PID 2168 wrote to memory of 2808 2168 bnhhhn.exe 31 PID 2808 wrote to memory of 2600 2808 jjvvv.exe 32 PID 2808 wrote to memory of 2600 2808 jjvvv.exe 32 PID 2808 wrote to memory of 2600 2808 jjvvv.exe 32 PID 2808 wrote to memory of 2600 2808 jjvvv.exe 32 PID 2600 wrote to memory of 2428 2600 lfllxxf.exe 33 PID 2600 wrote to memory of 2428 2600 lfllxxf.exe 33 PID 2600 wrote to memory of 2428 2600 lfllxxf.exe 33 PID 2600 wrote to memory of 2428 2600 lfllxxf.exe 33 PID 2428 wrote to memory of 2404 2428 lxrllxf.exe 34 PID 2428 wrote to memory of 2404 2428 lxrllxf.exe 34 PID 2428 wrote to memory of 2404 2428 lxrllxf.exe 34 PID 2428 wrote to memory of 2404 2428 lxrllxf.exe 34 PID 2404 wrote to memory of 1900 2404 nhbhtt.exe 35 PID 2404 wrote to memory of 1900 2404 nhbhtt.exe 35 PID 2404 wrote to memory of 1900 2404 nhbhtt.exe 35 PID 2404 wrote to memory of 1900 2404 nhbhtt.exe 35 PID 1900 wrote to memory of 2608 1900 vjddd.exe 36 PID 1900 wrote to memory of 2608 1900 vjddd.exe 36 PID 1900 wrote to memory of 2608 1900 vjddd.exe 36 PID 1900 wrote to memory of 2608 1900 vjddd.exe 36 PID 2608 wrote to memory of 2788 2608 dvjpj.exe 37 PID 2608 wrote to memory of 2788 2608 dvjpj.exe 37 PID 2608 wrote to memory of 2788 2608 dvjpj.exe 37 PID 2608 wrote to memory of 2788 2608 dvjpj.exe 37 PID 2788 wrote to memory of 2720 2788 xlxxfxf.exe 38 PID 2788 wrote to memory of 2720 2788 xlxxfxf.exe 38 PID 2788 wrote to memory of 2720 2788 xlxxfxf.exe 38 PID 2788 wrote to memory of 2720 2788 xlxxfxf.exe 38 PID 2720 wrote to memory of 2140 2720 1lfffxl.exe 39 PID 2720 wrote to memory of 2140 2720 1lfffxl.exe 39 PID 2720 wrote to memory of 2140 2720 1lfffxl.exe 39 PID 2720 wrote to memory of 2140 2720 1lfffxl.exe 39 PID 2140 wrote to memory of 1960 2140 tnbtnn.exe 40 PID 2140 wrote to memory of 1960 2140 tnbtnn.exe 40 PID 2140 wrote to memory of 1960 2140 tnbtnn.exe 40 PID 2140 wrote to memory of 1960 2140 tnbtnn.exe 40 PID 1960 wrote to memory of 2252 1960 tntnnh.exe 41 PID 1960 wrote to memory of 2252 1960 tntnnh.exe 41 PID 1960 wrote to memory of 2252 1960 tntnnh.exe 41 PID 1960 wrote to memory of 2252 1960 tntnnh.exe 41 PID 2252 wrote to memory of 872 2252 vjpvv.exe 42 PID 2252 wrote to memory of 872 2252 vjpvv.exe 42 PID 2252 wrote to memory of 872 2252 vjpvv.exe 42 PID 2252 wrote to memory of 872 2252 vjpvv.exe 42 PID 872 wrote to memory of 1872 872 rlfrflx.exe 43 PID 872 wrote to memory of 1872 872 rlfrflx.exe 43 PID 872 wrote to memory of 1872 872 rlfrflx.exe 43 PID 872 wrote to memory of 1872 872 rlfrflx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\245b9a7d6db0293d516aa2b4b5fbe8431a736f209e84b7af13ceca1273b858ed.exe"C:\Users\Admin\AppData\Local\Temp\245b9a7d6db0293d516aa2b4b5fbe8431a736f209e84b7af13ceca1273b858ed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\5lxflll.exec:\5lxflll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\lxrxxrr.exec:\lxrxxrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\bnhhhn.exec:\bnhhhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\jjvvv.exec:\jjvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\lfllxxf.exec:\lfllxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\lxrllxf.exec:\lxrllxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\nhbhtt.exec:\nhbhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\vjddd.exec:\vjddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\dvjpj.exec:\dvjpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\xlxxfxf.exec:\xlxxfxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\1lfffxl.exec:\1lfffxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\tnbtnn.exec:\tnbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\tntnnh.exec:\tntnnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\vjpvv.exec:\vjpvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\rlfrflx.exec:\rlfrflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\xrxfrfl.exec:\xrxfrfl.exe17⤵
- Executes dropped EXE
PID:1872 -
\??\c:\3thtbb.exec:\3thtbb.exe18⤵
- Executes dropped EXE
PID:1556 -
\??\c:\9ppvv.exec:\9ppvv.exe19⤵
- Executes dropped EXE
PID:1372 -
\??\c:\jddvp.exec:\jddvp.exe20⤵
- Executes dropped EXE
PID:1964 -
\??\c:\fxffxlx.exec:\fxffxlx.exe21⤵
- Executes dropped EXE
PID:2592 -
\??\c:\tnbtbh.exec:\tnbtbh.exe22⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tnbbhh.exec:\tnbbhh.exe23⤵
- Executes dropped EXE
PID:1004 -
\??\c:\dpvjp.exec:\dpvjp.exe24⤵
- Executes dropped EXE
PID:2840 -
\??\c:\vpjdd.exec:\vpjdd.exe25⤵
- Executes dropped EXE
PID:1764 -
\??\c:\fxfxfxl.exec:\fxfxfxl.exe26⤵
- Executes dropped EXE
PID:2240 -
\??\c:\tntntn.exec:\tntntn.exe27⤵
- Executes dropped EXE
PID:1640 -
\??\c:\jvjpp.exec:\jvjpp.exe28⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pjppd.exec:\pjppd.exe29⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rfffllr.exec:\rfffllr.exe30⤵
- Executes dropped EXE
PID:1272 -
\??\c:\lxrflff.exec:\lxrflff.exe31⤵
- Executes dropped EXE
PID:1628 -
\??\c:\hthhnn.exec:\hthhnn.exe32⤵
- Executes dropped EXE
PID:900 -
\??\c:\jdjpj.exec:\jdjpj.exe33⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xrxrrxf.exec:\xrxrrxf.exe34⤵
- Executes dropped EXE
PID:2584 -
\??\c:\hbtnbb.exec:\hbtnbb.exe35⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nnhnbn.exec:\nnhnbn.exe36⤵
- Executes dropped EXE
PID:2480 -
\??\c:\9pdjj.exec:\9pdjj.exe37⤵
- Executes dropped EXE
PID:2500 -
\??\c:\fxfxfxx.exec:\fxfxfxx.exe38⤵
- Executes dropped EXE
PID:2692 -
\??\c:\fxxrxxf.exec:\fxxrxxf.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe40⤵
- Executes dropped EXE
PID:2400 -
\??\c:\thhhnh.exec:\thhhnh.exe41⤵
- Executes dropped EXE
PID:2376 -
\??\c:\jjpvv.exec:\jjpvv.exe42⤵
- Executes dropped EXE
PID:2132 -
\??\c:\jdpvd.exec:\jdpvd.exe43⤵
- Executes dropped EXE
PID:2424 -
\??\c:\vpddj.exec:\vpddj.exe44⤵
- Executes dropped EXE
PID:1944 -
\??\c:\flrxfxf.exec:\flrxfxf.exe45⤵
- Executes dropped EXE
PID:2604 -
\??\c:\7bbtbn.exec:\7bbtbn.exe46⤵
- Executes dropped EXE
PID:2608 -
\??\c:\5nhhnn.exec:\5nhhnn.exe47⤵
- Executes dropped EXE
PID:1616 -
\??\c:\5vpdd.exec:\5vpdd.exe48⤵
- Executes dropped EXE
PID:1940 -
\??\c:\fxflrxr.exec:\fxflrxr.exe49⤵
- Executes dropped EXE
PID:1916 -
\??\c:\fxfflrx.exec:\fxfflrx.exe50⤵
- Executes dropped EXE
PID:2140 -
\??\c:\bthhhh.exec:\bthhhh.exe51⤵
- Executes dropped EXE
PID:1932 -
\??\c:\1vvdj.exec:\1vvdj.exe52⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jdvvv.exec:\jdvvv.exe53⤵
- Executes dropped EXE
PID:2144 -
\??\c:\fxfrlfl.exec:\fxfrlfl.exe54⤵
- Executes dropped EXE
PID:1620 -
\??\c:\9rrrxxl.exec:\9rrrxxl.exe55⤵
- Executes dropped EXE
PID:1456 -
\??\c:\bbtthh.exec:\bbtthh.exe56⤵
- Executes dropped EXE
PID:1708 -
\??\c:\1bhhnn.exec:\1bhhnn.exe57⤵
- Executes dropped EXE
PID:2236 -
\??\c:\jdjvj.exec:\jdjvj.exe58⤵
- Executes dropped EXE
PID:2356 -
\??\c:\pdjjj.exec:\pdjjj.exe59⤵
- Executes dropped EXE
PID:2064 -
\??\c:\9rflflr.exec:\9rflflr.exe60⤵
- Executes dropped EXE
PID:612 -
\??\c:\7nbhnn.exec:\7nbhnn.exe61⤵
- Executes dropped EXE
PID:592 -
\??\c:\tnnnhb.exec:\tnnnhb.exe62⤵
- Executes dropped EXE
PID:964 -
\??\c:\pdppv.exec:\pdppv.exe63⤵
- Executes dropped EXE
PID:656 -
\??\c:\3djjj.exec:\3djjj.exe64⤵
- Executes dropped EXE
PID:1196 -
\??\c:\1rfxffl.exec:\1rfxffl.exe65⤵
- Executes dropped EXE
PID:724 -
\??\c:\ttbhtb.exec:\ttbhtb.exe66⤵PID:1600
-
\??\c:\thtntb.exec:\thtntb.exe67⤵PID:1248
-
\??\c:\pddjd.exec:\pddjd.exe68⤵PID:828
-
\??\c:\5rlfxfl.exec:\5rlfxfl.exe69⤵PID:3020
-
\??\c:\nhhbht.exec:\nhhbht.exe70⤵PID:1704
-
\??\c:\hbtbtt.exec:\hbtbtt.exe71⤵PID:1440
-
\??\c:\dpdjv.exec:\dpdjv.exe72⤵PID:1628
-
\??\c:\jvjdj.exec:\jvjdj.exe73⤵PID:2148
-
\??\c:\rrlrflx.exec:\rrlrflx.exe74⤵PID:1536
-
\??\c:\lrlffxx.exec:\lrlffxx.exe75⤵PID:2576
-
\??\c:\btnnbb.exec:\btnnbb.exe76⤵PID:2568
-
\??\c:\bbhhhh.exec:\bbhhhh.exe77⤵PID:2084
-
\??\c:\jppjj.exec:\jppjj.exe78⤵PID:2820
-
\??\c:\jjvpj.exec:\jjvpj.exe79⤵PID:2168
-
\??\c:\7xxrxfl.exec:\7xxrxfl.exe80⤵PID:2692
-
\??\c:\xrfllrf.exec:\xrfllrf.exe81⤵PID:2396
-
\??\c:\9btntb.exec:\9btntb.exe82⤵PID:2416
-
\??\c:\9ntttt.exec:\9ntttt.exe83⤵PID:2888
-
\??\c:\hnbhnh.exec:\hnbhnh.exe84⤵PID:2404
-
\??\c:\1vppv.exec:\1vppv.exe85⤵PID:2588
-
\??\c:\7llxffl.exec:\7llxffl.exe86⤵PID:2696
-
\??\c:\lflxffr.exec:\lflxffr.exe87⤵PID:2724
-
\??\c:\7nhhtb.exec:\7nhhtb.exe88⤵PID:2608
-
\??\c:\tbbtnt.exec:\tbbtnt.exe89⤵PID:2472
-
\??\c:\ppvpv.exec:\ppvpv.exe90⤵PID:812
-
\??\c:\rflflfr.exec:\rflflfr.exe91⤵PID:1644
-
\??\c:\ffxlrxl.exec:\ffxlrxl.exe92⤵PID:1732
-
\??\c:\xfllfxx.exec:\xfllfxx.exe93⤵PID:2360
-
\??\c:\nhtbht.exec:\nhtbht.exe94⤵PID:1572
-
\??\c:\tbtbnt.exec:\tbtbnt.exe95⤵PID:1360
-
\??\c:\vvvdd.exec:\vvvdd.exe96⤵PID:1620
-
\??\c:\vjppv.exec:\vjppv.exe97⤵PID:2908
-
\??\c:\3xllrfl.exec:\3xllrfl.exe98⤵PID:2032
-
\??\c:\3ffrllx.exec:\3ffrllx.exe99⤵PID:1860
-
\??\c:\llffrrf.exec:\llffrrf.exe100⤵PID:2204
-
\??\c:\hhbhtn.exec:\hhbhtn.exe101⤵PID:296
-
\??\c:\jjvjp.exec:\jjvjp.exe102⤵PID:612
-
\??\c:\jdvpv.exec:\jdvpv.exe103⤵PID:2752
-
\??\c:\rlflxlx.exec:\rlflxlx.exe104⤵PID:2340
-
\??\c:\ffxfrlr.exec:\ffxfrlr.exe105⤵PID:1468
-
\??\c:\nhtttb.exec:\nhtttb.exe106⤵PID:1280
-
\??\c:\thnntt.exec:\thnntt.exe107⤵PID:1304
-
\??\c:\3pjpj.exec:\3pjpj.exe108⤵PID:1052
-
\??\c:\3vpvv.exec:\3vpvv.exe109⤵PID:2328
-
\??\c:\3rlrxfl.exec:\3rlrxfl.exe110⤵PID:684
-
\??\c:\fxflrrf.exec:\fxflrrf.exe111⤵PID:1212
-
\??\c:\1nhhtt.exec:\1nhhtt.exe112⤵PID:2804
-
\??\c:\hbnhbh.exec:\hbnhbh.exe113⤵PID:2844
-
\??\c:\7vpvj.exec:\7vpvj.exe114⤵PID:900
-
\??\c:\djvdd.exec:\djvdd.exe115⤵PID:864
-
\??\c:\lxfxffl.exec:\lxfxffl.exe116⤵PID:2220
-
\??\c:\5rllfxl.exec:\5rllfxl.exe117⤵PID:2984
-
\??\c:\nnhnbh.exec:\nnhnbh.exe118⤵PID:2812
-
\??\c:\7nntbt.exec:\7nntbt.exe119⤵PID:2532
-
\??\c:\3pdjp.exec:\3pdjp.exe120⤵PID:2012
-
\??\c:\pdpdp.exec:\pdpdp.exe121⤵PID:2684
-
\??\c:\rlfflrl.exec:\rlfflrl.exe122⤵PID:2692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-