Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 13:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
feddd86c5516e10ffa7c76158734f4a809cb3e67c42e7a737d1c0e72c8fceb3c.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
-
Target
feddd86c5516e10ffa7c76158734f4a809cb3e67c42e7a737d1c0e72c8fceb3c.exe
-
Size
94KB
-
MD5
8d8b90c4e3754ad32505fc40989faaaf
-
SHA1
a95db69036b984a8e9be3a6a9d157228d2c14943
-
SHA256
feddd86c5516e10ffa7c76158734f4a809cb3e67c42e7a737d1c0e72c8fceb3c
-
SHA512
cc96e0b5743026521f49300302ee7e582e1e3034fefc709f69a3330ef3c98c815ec179e0f57e68e56c1d005b19ee891c4df19d356409b488aea42ef621180d34
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLuePjDYlR3hnjKXIQSe9oEq:ymb3NkkiQ3mdBjFoLucjDilOZhoP
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2972-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/312-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 22 IoCs
resource yara_rule behavioral1/memory/2972-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2972-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3032-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2600-24-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2536-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2440-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2416-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2864-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2420-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2420-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2420-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2716-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2908-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2464-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1696-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2148-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1656-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2032-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/312-209-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1584-219-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/856-290-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3032 hbtthn.exe 2600 jjvjd.exe 2536 flfrflr.exe 2440 xrxfxfr.exe 2568 bbntbb.exe 2416 3jjjp.exe 2864 pjdjv.exe 2420 rlxxrrx.exe 2716 hbtbhn.exe 2908 nbhhnh.exe 2464 vjdvd.exe 1520 rfrrllr.exe 1696 rlxlflx.exe 2148 nhntbb.exe 2392 9jpvj.exe 1488 vpjvj.exe 1656 fxlrffr.exe 2032 xrlrfxl.exe 2084 tnbbnt.exe 2020 nbhtnb.exe 312 jjpvd.exe 1584 xrlxxlr.exe 2912 lfrxfrx.exe 1900 9hbntb.exe 412 bnhbnt.exe 1600 vjppv.exe 940 rfllllr.exe 2780 fxrfrlx.exe 2280 3bhntt.exe 856 vdpvv.exe 2704 ddppd.exe 1960 9xxfrrr.exe 1648 nhhnnt.exe 2752 ddpvd.exe 2660 dvpvj.exe 2412 rlfflrf.exe 2696 xffrxfr.exe 2520 hhbhnn.exe 2440 jvddv.exe 2436 vvdjp.exe 2404 rrxlrll.exe 1248 fflrrlf.exe 1924 tthhhb.exe 2756 3vvvv.exe 2724 jjpdj.exe 2860 xlrlfff.exe 2916 llxfxfr.exe 2464 1htbnt.exe 1856 vvvvd.exe 1364 3vjvj.exe 2504 fxfrflr.exe 1912 thtnnh.exe 1560 bbbnbn.exe 1168 dpvvv.exe 1704 1pvpp.exe 1256 5flffxr.exe 2056 llxxxxf.exe 676 3httnh.exe 1632 bthhnt.exe 332 ppdvd.exe 588 1rflrrx.exe 2372 hbbhbh.exe 3056 bthnnt.exe 1900 3dvvj.exe -
resource yara_rule behavioral1/memory/2972-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/312-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2972 wrote to memory of 3032 2972 feddd86c5516e10ffa7c76158734f4a809cb3e67c42e7a737d1c0e72c8fceb3c.exe 28 PID 2972 wrote to memory of 3032 2972 feddd86c5516e10ffa7c76158734f4a809cb3e67c42e7a737d1c0e72c8fceb3c.exe 28 PID 2972 wrote to memory of 3032 2972 feddd86c5516e10ffa7c76158734f4a809cb3e67c42e7a737d1c0e72c8fceb3c.exe 28 PID 2972 wrote to memory of 3032 2972 feddd86c5516e10ffa7c76158734f4a809cb3e67c42e7a737d1c0e72c8fceb3c.exe 28 PID 3032 wrote to memory of 2600 3032 hbtthn.exe 29 PID 3032 wrote to memory of 2600 3032 hbtthn.exe 29 PID 3032 wrote to memory of 2600 3032 hbtthn.exe 29 PID 3032 wrote to memory of 2600 3032 hbtthn.exe 29 PID 2600 wrote to memory of 2536 2600 jjvjd.exe 30 PID 2600 wrote to memory of 2536 2600 jjvjd.exe 30 PID 2600 wrote to memory of 2536 2600 jjvjd.exe 30 PID 2600 wrote to memory of 2536 2600 jjvjd.exe 30 PID 2536 wrote to memory of 2440 2536 flfrflr.exe 31 PID 2536 wrote to memory of 2440 2536 flfrflr.exe 31 PID 2536 wrote to memory of 2440 2536 flfrflr.exe 31 PID 2536 wrote to memory of 2440 2536 flfrflr.exe 31 PID 2440 wrote to memory of 2568 2440 xrxfxfr.exe 32 PID 2440 wrote to memory of 2568 2440 xrxfxfr.exe 32 PID 2440 wrote to memory of 2568 2440 xrxfxfr.exe 32 PID 2440 wrote to memory of 2568 2440 xrxfxfr.exe 32 PID 2568 wrote to memory of 2416 2568 bbntbb.exe 33 PID 2568 wrote to memory of 2416 2568 bbntbb.exe 33 PID 2568 wrote to memory of 2416 2568 bbntbb.exe 33 PID 2568 wrote to memory of 2416 2568 bbntbb.exe 33 PID 2416 wrote to memory of 2864 2416 3jjjp.exe 34 PID 2416 wrote to memory of 2864 2416 3jjjp.exe 34 PID 2416 wrote to memory of 2864 2416 3jjjp.exe 34 PID 2416 wrote to memory of 2864 2416 3jjjp.exe 34 PID 2864 wrote to memory of 2420 2864 pjdjv.exe 35 PID 2864 wrote to memory of 2420 2864 pjdjv.exe 35 PID 2864 wrote to memory of 2420 2864 pjdjv.exe 35 PID 2864 wrote to memory of 2420 2864 pjdjv.exe 35 PID 2420 wrote to memory of 2716 2420 rlxxrrx.exe 36 PID 2420 wrote to memory of 2716 2420 rlxxrrx.exe 36 PID 2420 wrote to memory of 2716 2420 rlxxrrx.exe 36 PID 2420 wrote to memory of 2716 2420 rlxxrrx.exe 36 PID 2716 wrote to memory of 2908 2716 hbtbhn.exe 37 PID 2716 wrote to memory of 2908 2716 hbtbhn.exe 37 PID 2716 wrote to memory of 2908 2716 hbtbhn.exe 37 PID 2716 wrote to memory of 2908 2716 hbtbhn.exe 37 PID 2908 wrote to memory of 2464 2908 nbhhnh.exe 38 PID 2908 wrote to memory of 2464 2908 nbhhnh.exe 38 PID 2908 wrote to memory of 2464 2908 nbhhnh.exe 38 PID 2908 wrote to memory of 2464 2908 nbhhnh.exe 38 PID 2464 wrote to memory of 1520 2464 vjdvd.exe 39 PID 2464 wrote to memory of 1520 2464 vjdvd.exe 39 PID 2464 wrote to memory of 1520 2464 vjdvd.exe 39 PID 2464 wrote to memory of 1520 2464 vjdvd.exe 39 PID 1520 wrote to memory of 1696 1520 rfrrllr.exe 40 PID 1520 wrote to memory of 1696 1520 rfrrllr.exe 40 PID 1520 wrote to memory of 1696 1520 rfrrllr.exe 40 PID 1520 wrote to memory of 1696 1520 rfrrllr.exe 40 PID 1696 wrote to memory of 2148 1696 rlxlflx.exe 41 PID 1696 wrote to memory of 2148 1696 rlxlflx.exe 41 PID 1696 wrote to memory of 2148 1696 rlxlflx.exe 41 PID 1696 wrote to memory of 2148 1696 rlxlflx.exe 41 PID 2148 wrote to memory of 2392 2148 nhntbb.exe 42 PID 2148 wrote to memory of 2392 2148 nhntbb.exe 42 PID 2148 wrote to memory of 2392 2148 nhntbb.exe 42 PID 2148 wrote to memory of 2392 2148 nhntbb.exe 42 PID 2392 wrote to memory of 1488 2392 9jpvj.exe 43 PID 2392 wrote to memory of 1488 2392 9jpvj.exe 43 PID 2392 wrote to memory of 1488 2392 9jpvj.exe 43 PID 2392 wrote to memory of 1488 2392 9jpvj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\feddd86c5516e10ffa7c76158734f4a809cb3e67c42e7a737d1c0e72c8fceb3c.exe"C:\Users\Admin\AppData\Local\Temp\feddd86c5516e10ffa7c76158734f4a809cb3e67c42e7a737d1c0e72c8fceb3c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\hbtthn.exec:\hbtthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\jjvjd.exec:\jjvjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\flfrflr.exec:\flfrflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\xrxfxfr.exec:\xrxfxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\bbntbb.exec:\bbntbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\3jjjp.exec:\3jjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\pjdjv.exec:\pjdjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\rlxxrrx.exec:\rlxxrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\hbtbhn.exec:\hbtbhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\nbhhnh.exec:\nbhhnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\vjdvd.exec:\vjdvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\rfrrllr.exec:\rfrrllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\rlxlflx.exec:\rlxlflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\nhntbb.exec:\nhntbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\9jpvj.exec:\9jpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\vpjvj.exec:\vpjvj.exe17⤵
- Executes dropped EXE
PID:1488 -
\??\c:\fxlrffr.exec:\fxlrffr.exe18⤵
- Executes dropped EXE
PID:1656 -
\??\c:\xrlrfxl.exec:\xrlrfxl.exe19⤵
- Executes dropped EXE
PID:2032 -
\??\c:\tnbbnt.exec:\tnbbnt.exe20⤵
- Executes dropped EXE
PID:2084 -
\??\c:\nbhtnb.exec:\nbhtnb.exe21⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jjpvd.exec:\jjpvd.exe22⤵
- Executes dropped EXE
PID:312 -
\??\c:\xrlxxlr.exec:\xrlxxlr.exe23⤵
- Executes dropped EXE
PID:1584 -
\??\c:\lfrxfrx.exec:\lfrxfrx.exe24⤵
- Executes dropped EXE
PID:2912 -
\??\c:\9hbntb.exec:\9hbntb.exe25⤵
- Executes dropped EXE
PID:1900 -
\??\c:\bnhbnt.exec:\bnhbnt.exe26⤵
- Executes dropped EXE
PID:412 -
\??\c:\vjppv.exec:\vjppv.exe27⤵
- Executes dropped EXE
PID:1600 -
\??\c:\rfllllr.exec:\rfllllr.exe28⤵
- Executes dropped EXE
PID:940 -
\??\c:\fxrfrlx.exec:\fxrfrlx.exe29⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3bhntt.exec:\3bhntt.exe30⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vdpvv.exec:\vdpvv.exe31⤵
- Executes dropped EXE
PID:856 -
\??\c:\ddppd.exec:\ddppd.exe32⤵
- Executes dropped EXE
PID:2704 -
\??\c:\9xxfrrr.exec:\9xxfrrr.exe33⤵
- Executes dropped EXE
PID:1960 -
\??\c:\nhhnnt.exec:\nhhnnt.exe34⤵
- Executes dropped EXE
PID:1648 -
\??\c:\ddpvd.exec:\ddpvd.exe35⤵
- Executes dropped EXE
PID:2752 -
\??\c:\dvpvj.exec:\dvpvj.exe36⤵
- Executes dropped EXE
PID:2660 -
\??\c:\rlfflrf.exec:\rlfflrf.exe37⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xffrxfr.exec:\xffrxfr.exe38⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hhbhnn.exec:\hhbhnn.exe39⤵
- Executes dropped EXE
PID:2520 -
\??\c:\jvddv.exec:\jvddv.exe40⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vvdjp.exec:\vvdjp.exe41⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rrxlrll.exec:\rrxlrll.exe42⤵
- Executes dropped EXE
PID:2404 -
\??\c:\fflrrlf.exec:\fflrrlf.exe43⤵
- Executes dropped EXE
PID:1248 -
\??\c:\tthhhb.exec:\tthhhb.exe44⤵
- Executes dropped EXE
PID:1924 -
\??\c:\3vvvv.exec:\3vvvv.exe45⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jjpdj.exec:\jjpdj.exe46⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xlrlfff.exec:\xlrlfff.exe47⤵
- Executes dropped EXE
PID:2860 -
\??\c:\llxfxfr.exec:\llxfxfr.exe48⤵
- Executes dropped EXE
PID:2916 -
\??\c:\1htbnt.exec:\1htbnt.exe49⤵
- Executes dropped EXE
PID:2464 -
\??\c:\vvvvd.exec:\vvvvd.exe50⤵
- Executes dropped EXE
PID:1856 -
\??\c:\3vjvj.exec:\3vjvj.exe51⤵
- Executes dropped EXE
PID:1364 -
\??\c:\fxfrflr.exec:\fxfrflr.exe52⤵
- Executes dropped EXE
PID:2504 -
\??\c:\thtnnh.exec:\thtnnh.exe53⤵
- Executes dropped EXE
PID:1912 -
\??\c:\bbbnbn.exec:\bbbnbn.exe54⤵
- Executes dropped EXE
PID:1560 -
\??\c:\dpvvv.exec:\dpvvv.exe55⤵
- Executes dropped EXE
PID:1168 -
\??\c:\1pvpp.exec:\1pvpp.exe56⤵
- Executes dropped EXE
PID:1704 -
\??\c:\5flffxr.exec:\5flffxr.exe57⤵
- Executes dropped EXE
PID:1256 -
\??\c:\llxxxxf.exec:\llxxxxf.exe58⤵
- Executes dropped EXE
PID:2056 -
\??\c:\3httnh.exec:\3httnh.exe59⤵
- Executes dropped EXE
PID:676 -
\??\c:\bthhnt.exec:\bthhnt.exe60⤵
- Executes dropped EXE
PID:1632 -
\??\c:\ppdvd.exec:\ppdvd.exe61⤵
- Executes dropped EXE
PID:332 -
\??\c:\1rflrrx.exec:\1rflrrx.exe62⤵
- Executes dropped EXE
PID:588 -
\??\c:\hbbhbh.exec:\hbbhbh.exe63⤵
- Executes dropped EXE
PID:2372 -
\??\c:\bthnnt.exec:\bthnnt.exe64⤵
- Executes dropped EXE
PID:3056 -
\??\c:\3dvvj.exec:\3dvvj.exe65⤵
- Executes dropped EXE
PID:1900 -
\??\c:\jvdvd.exec:\jvdvd.exe66⤵PID:448
-
\??\c:\flrrlll.exec:\flrrlll.exe67⤵PID:1020
-
\??\c:\rlfrlfl.exec:\rlfrlfl.exe68⤵PID:2176
-
\??\c:\bhnhht.exec:\bhnhht.exe69⤵PID:1956
-
\??\c:\hthhbb.exec:\hthhbb.exe70⤵PID:664
-
\??\c:\vppjj.exec:\vppjj.exe71⤵PID:704
-
\??\c:\pvdpj.exec:\pvdpj.exe72⤵PID:2120
-
\??\c:\lfrxxxx.exec:\lfrxxxx.exe73⤵PID:904
-
\??\c:\3rrrllr.exec:\3rrrllr.exe74⤵PID:2328
-
\??\c:\lffflrx.exec:\lffflrx.exe75⤵PID:2552
-
\??\c:\nhtbbb.exec:\nhtbbb.exe76⤵PID:1516
-
\??\c:\bthntt.exec:\bthntt.exe77⤵PID:2204
-
\??\c:\pjpdd.exec:\pjpdd.exe78⤵PID:2600
-
\??\c:\jpdjj.exec:\jpdjj.exe79⤵PID:2676
-
\??\c:\xrrlllr.exec:\xrrlllr.exe80⤵PID:2688
-
\??\c:\fxfxflf.exec:\fxfxflf.exe81⤵PID:296
-
\??\c:\tnhnbh.exec:\tnhnbh.exe82⤵PID:2452
-
\??\c:\hbntnb.exec:\hbntnb.exe83⤵PID:2876
-
\??\c:\5jdjp.exec:\5jdjp.exe84⤵PID:2872
-
\??\c:\ppppv.exec:\ppppv.exe85⤵PID:2712
-
\??\c:\1lffrrf.exec:\1lffrrf.exe86⤵PID:2296
-
\??\c:\3ffflrx.exec:\3ffflrx.exe87⤵PID:2888
-
\??\c:\hthntt.exec:\hthntt.exe88⤵PID:2380
-
\??\c:\bttnth.exec:\bttnth.exe89⤵PID:1884
-
\??\c:\ddvjj.exec:\ddvjj.exe90⤵PID:2908
-
\??\c:\jvpjp.exec:\jvpjp.exe91⤵PID:2016
-
\??\c:\vpvvd.exec:\vpvvd.exe92⤵PID:1620
-
\??\c:\frxxffl.exec:\frxxffl.exe93⤵PID:556
-
\??\c:\xrlxlrx.exec:\xrlxlrx.exe94⤵PID:2680
-
\??\c:\3hhnbh.exec:\3hhnbh.exe95⤵PID:1200
-
\??\c:\7htbhh.exec:\7htbhh.exe96⤵PID:2216
-
\??\c:\pjvvd.exec:\pjvvd.exe97⤵PID:2024
-
\??\c:\vvppv.exec:\vvppv.exe98⤵PID:2064
-
\??\c:\xflxfff.exec:\xflxfff.exe99⤵PID:1260
-
\??\c:\fxrlrxf.exec:\fxrlrxf.exe100⤵PID:780
-
\??\c:\btnbht.exec:\btnbht.exe101⤵PID:772
-
\??\c:\hhhhhn.exec:\hhhhhn.exe102⤵PID:2020
-
\??\c:\dvvdp.exec:\dvvdp.exe103⤵PID:1744
-
\??\c:\vvvvd.exec:\vvvvd.exe104⤵PID:2444
-
\??\c:\9lxrxrx.exec:\9lxrxrx.exe105⤵PID:1732
-
\??\c:\lllfxfx.exec:\lllfxfx.exe106⤵PID:2092
-
\??\c:\bbtbtb.exec:\bbtbtb.exe107⤵PID:2488
-
\??\c:\btbbnn.exec:\btbbnn.exe108⤵PID:412
-
\??\c:\9jdpj.exec:\9jdpj.exe109⤵PID:1028
-
\??\c:\7dvdj.exec:\7dvdj.exe110⤵PID:2940
-
\??\c:\1vddj.exec:\1vddj.exe111⤵PID:2836
-
\??\c:\9llrfrl.exec:\9llrfrl.exe112⤵PID:2780
-
\??\c:\9rrfrxl.exec:\9rrfrxl.exe113⤵PID:1444
-
\??\c:\hhntbh.exec:\hhntbh.exe114⤵PID:2168
-
\??\c:\ttbbbh.exec:\ttbbbh.exe115⤵PID:2496
-
\??\c:\dvpdj.exec:\dvpdj.exe116⤵PID:1536
-
\??\c:\jvjjp.exec:\jvjjp.exe117⤵PID:1540
-
\??\c:\rlxflrx.exec:\rlxflrx.exe118⤵PID:2752
-
\??\c:\rflllll.exec:\rflllll.exe119⤵PID:2660
-
\??\c:\bbhtbt.exec:\bbhtbt.exe120⤵PID:2544
-
\??\c:\tntthn.exec:\tntthn.exe121⤵PID:2944
-
\??\c:\3vvjv.exec:\3vvjv.exe122⤵PID:2520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-