Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 22:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
63c3010ed6f7badd46914efe5167ec52fc5933244bc6b943f3bbfc99e9c3f790.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
63c3010ed6f7badd46914efe5167ec52fc5933244bc6b943f3bbfc99e9c3f790.exe
-
Size
57KB
-
MD5
2e756b8f6120f9284cc85b08bfb15f9d
-
SHA1
b36854304104b8b31811cc68cb03e76b100880e5
-
SHA256
63c3010ed6f7badd46914efe5167ec52fc5933244bc6b943f3bbfc99e9c3f790
-
SHA512
9e749952eb1990c523e7f0b25ddbbf0b7deb923e092192d95165cbcea1b0a7f4834008bfc77a98c56ca4eacf89a39e8899e21af447742c6351283b5b02029d25
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chVVA:ymb3NkkiQ3mdBjF0crVA
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2108-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-80-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1600-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/588-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 20 IoCs
resource yara_rule behavioral1/memory/2108-6-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2796-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2652-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2652-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2652-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2652-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2660-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2776-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1976-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2520-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3004-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2208-109-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1928-117-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2496-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1600-135-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2008-145-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2440-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1660-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/588-235-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2980-288-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2308 lxlxrxl.exe 2796 7hnbth.exe 2652 btnnnn.exe 2660 lllffxx.exe 2516 nhhhnn.exe 2776 pjpvd.exe 1976 vjdpj.exe 2520 rrflrrx.exe 3004 1btntt.exe 2208 bttbnh.exe 1928 9jjjp.exe 2496 rfflrrx.exe 1600 flxrfrf.exe 2008 nhnbnn.exe 1256 jdjvd.exe 2440 pjvdp.exe 1660 xxfffxr.exe 1872 bbnhbh.exe 1752 7htbbh.exe 2860 5pdjp.exe 1744 lfrxfrx.exe 2332 rlflrrx.exe 652 bthntb.exe 588 nhttbt.exe 1768 jjvdp.exe 2372 dvddp.exe 1592 5frxxlx.exe 3008 rlxfrxx.exe 2912 7hbnnn.exe 2980 9dpjj.exe 2172 xrxfllf.exe 2468 lfrlxxl.exe 2240 nhtthh.exe 2800 5hbnbn.exe 2864 jpvvd.exe 2736 ffrlxfr.exe 3024 xrlfrxx.exe 3044 bthtbn.exe 2628 nhhhhn.exe 2872 jdjpd.exe 2560 pjddj.exe 2552 5fxfflr.exe 2624 fxlrxxf.exe 1360 hhtbtn.exe 268 1ththn.exe 2208 5vvvd.exe 2772 dpdpd.exe 1092 5ffllxl.exe 304 3fxlxrr.exe 1972 bbnnbn.exe 2432 1vppj.exe 1256 ppdjd.exe 1804 rffflxf.exe 316 xxllffl.exe 2836 btnbbh.exe 2384 hbthtb.exe 1752 1jpdd.exe 2288 ddvpv.exe 2808 xxrxxlx.exe 264 3rrrffl.exe 1020 ttbhnt.exe 580 hthnnn.exe 640 dvvvj.exe 2336 vpdvv.exe -
resource yara_rule behavioral1/memory/2108-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1600-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/588-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-288-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2308 2108 63c3010ed6f7badd46914efe5167ec52fc5933244bc6b943f3bbfc99e9c3f790.exe 29 PID 2108 wrote to memory of 2308 2108 63c3010ed6f7badd46914efe5167ec52fc5933244bc6b943f3bbfc99e9c3f790.exe 29 PID 2108 wrote to memory of 2308 2108 63c3010ed6f7badd46914efe5167ec52fc5933244bc6b943f3bbfc99e9c3f790.exe 29 PID 2108 wrote to memory of 2308 2108 63c3010ed6f7badd46914efe5167ec52fc5933244bc6b943f3bbfc99e9c3f790.exe 29 PID 2308 wrote to memory of 2796 2308 lxlxrxl.exe 30 PID 2308 wrote to memory of 2796 2308 lxlxrxl.exe 30 PID 2308 wrote to memory of 2796 2308 lxlxrxl.exe 30 PID 2308 wrote to memory of 2796 2308 lxlxrxl.exe 30 PID 2796 wrote to memory of 2652 2796 7hnbth.exe 31 PID 2796 wrote to memory of 2652 2796 7hnbth.exe 31 PID 2796 wrote to memory of 2652 2796 7hnbth.exe 31 PID 2796 wrote to memory of 2652 2796 7hnbth.exe 31 PID 2652 wrote to memory of 2660 2652 btnnnn.exe 32 PID 2652 wrote to memory of 2660 2652 btnnnn.exe 32 PID 2652 wrote to memory of 2660 2652 btnnnn.exe 32 PID 2652 wrote to memory of 2660 2652 btnnnn.exe 32 PID 2660 wrote to memory of 2516 2660 lllffxx.exe 33 PID 2660 wrote to memory of 2516 2660 lllffxx.exe 33 PID 2660 wrote to memory of 2516 2660 lllffxx.exe 33 PID 2660 wrote to memory of 2516 2660 lllffxx.exe 33 PID 2516 wrote to memory of 2776 2516 nhhhnn.exe 34 PID 2516 wrote to memory of 2776 2516 nhhhnn.exe 34 PID 2516 wrote to memory of 2776 2516 nhhhnn.exe 34 PID 2516 wrote to memory of 2776 2516 nhhhnn.exe 34 PID 2776 wrote to memory of 1976 2776 pjpvd.exe 35 PID 2776 wrote to memory of 1976 2776 pjpvd.exe 35 PID 2776 wrote to memory of 1976 2776 pjpvd.exe 35 PID 2776 wrote to memory of 1976 2776 pjpvd.exe 35 PID 1976 wrote to memory of 2520 1976 vjdpj.exe 36 PID 1976 wrote to memory of 2520 1976 vjdpj.exe 36 PID 1976 wrote to memory of 2520 1976 vjdpj.exe 36 PID 1976 wrote to memory of 2520 1976 vjdpj.exe 36 PID 2520 wrote to memory of 3004 2520 rrflrrx.exe 37 PID 2520 wrote to memory of 3004 2520 rrflrrx.exe 37 PID 2520 wrote to memory of 3004 2520 rrflrrx.exe 37 PID 2520 wrote to memory of 3004 2520 rrflrrx.exe 37 PID 3004 wrote to memory of 2208 3004 1btntt.exe 38 PID 3004 wrote to memory of 2208 3004 1btntt.exe 38 PID 3004 wrote to memory of 2208 3004 1btntt.exe 38 PID 3004 wrote to memory of 2208 3004 1btntt.exe 38 PID 2208 wrote to memory of 1928 2208 bttbnh.exe 39 PID 2208 wrote to memory of 1928 2208 bttbnh.exe 39 PID 2208 wrote to memory of 1928 2208 bttbnh.exe 39 PID 2208 wrote to memory of 1928 2208 bttbnh.exe 39 PID 1928 wrote to memory of 2496 1928 9jjjp.exe 40 PID 1928 wrote to memory of 2496 1928 9jjjp.exe 40 PID 1928 wrote to memory of 2496 1928 9jjjp.exe 40 PID 1928 wrote to memory of 2496 1928 9jjjp.exe 40 PID 2496 wrote to memory of 1600 2496 rfflrrx.exe 41 PID 2496 wrote to memory of 1600 2496 rfflrrx.exe 41 PID 2496 wrote to memory of 1600 2496 rfflrrx.exe 41 PID 2496 wrote to memory of 1600 2496 rfflrrx.exe 41 PID 1600 wrote to memory of 2008 1600 flxrfrf.exe 42 PID 1600 wrote to memory of 2008 1600 flxrfrf.exe 42 PID 1600 wrote to memory of 2008 1600 flxrfrf.exe 42 PID 1600 wrote to memory of 2008 1600 flxrfrf.exe 42 PID 2008 wrote to memory of 1256 2008 nhnbnn.exe 43 PID 2008 wrote to memory of 1256 2008 nhnbnn.exe 43 PID 2008 wrote to memory of 1256 2008 nhnbnn.exe 43 PID 2008 wrote to memory of 1256 2008 nhnbnn.exe 43 PID 1256 wrote to memory of 2440 1256 jdjvd.exe 44 PID 1256 wrote to memory of 2440 1256 jdjvd.exe 44 PID 1256 wrote to memory of 2440 1256 jdjvd.exe 44 PID 1256 wrote to memory of 2440 1256 jdjvd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\63c3010ed6f7badd46914efe5167ec52fc5933244bc6b943f3bbfc99e9c3f790.exe"C:\Users\Admin\AppData\Local\Temp\63c3010ed6f7badd46914efe5167ec52fc5933244bc6b943f3bbfc99e9c3f790.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\lxlxrxl.exec:\lxlxrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\7hnbth.exec:\7hnbth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\btnnnn.exec:\btnnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\lllffxx.exec:\lllffxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\nhhhnn.exec:\nhhhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\pjpvd.exec:\pjpvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\vjdpj.exec:\vjdpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\rrflrrx.exec:\rrflrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\1btntt.exec:\1btntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\bttbnh.exec:\bttbnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\9jjjp.exec:\9jjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\rfflrrx.exec:\rfflrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\flxrfrf.exec:\flxrfrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\nhnbnn.exec:\nhnbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\jdjvd.exec:\jdjvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\pjvdp.exec:\pjvdp.exe17⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xxfffxr.exec:\xxfffxr.exe18⤵
- Executes dropped EXE
PID:1660 -
\??\c:\bbnhbh.exec:\bbnhbh.exe19⤵
- Executes dropped EXE
PID:1872 -
\??\c:\7htbbh.exec:\7htbbh.exe20⤵
- Executes dropped EXE
PID:1752 -
\??\c:\5pdjp.exec:\5pdjp.exe21⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lfrxfrx.exec:\lfrxfrx.exe22⤵
- Executes dropped EXE
PID:1744 -
\??\c:\rlflrrx.exec:\rlflrrx.exe23⤵
- Executes dropped EXE
PID:2332 -
\??\c:\bthntb.exec:\bthntb.exe24⤵
- Executes dropped EXE
PID:652 -
\??\c:\nhttbt.exec:\nhttbt.exe25⤵
- Executes dropped EXE
PID:588 -
\??\c:\jjvdp.exec:\jjvdp.exe26⤵
- Executes dropped EXE
PID:1768 -
\??\c:\dvddp.exec:\dvddp.exe27⤵
- Executes dropped EXE
PID:2372 -
\??\c:\5frxxlx.exec:\5frxxlx.exe28⤵
- Executes dropped EXE
PID:1592 -
\??\c:\rlxfrxx.exec:\rlxfrxx.exe29⤵
- Executes dropped EXE
PID:3008 -
\??\c:\7hbnnn.exec:\7hbnnn.exe30⤵
- Executes dropped EXE
PID:2912 -
\??\c:\9dpjj.exec:\9dpjj.exe31⤵
- Executes dropped EXE
PID:2980 -
\??\c:\xrxfllf.exec:\xrxfllf.exe32⤵
- Executes dropped EXE
PID:2172 -
\??\c:\lfrlxxl.exec:\lfrlxxl.exe33⤵
- Executes dropped EXE
PID:2468 -
\??\c:\nhtthh.exec:\nhtthh.exe34⤵
- Executes dropped EXE
PID:2240 -
\??\c:\5hbnbn.exec:\5hbnbn.exe35⤵
- Executes dropped EXE
PID:2800 -
\??\c:\jpvvd.exec:\jpvvd.exe36⤵
- Executes dropped EXE
PID:2864 -
\??\c:\ffrlxfr.exec:\ffrlxfr.exe37⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xrlfrxx.exec:\xrlfrxx.exe38⤵
- Executes dropped EXE
PID:3024 -
\??\c:\bthtbn.exec:\bthtbn.exe39⤵
- Executes dropped EXE
PID:3044 -
\??\c:\nhhhhn.exec:\nhhhhn.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jdjpd.exec:\jdjpd.exe41⤵
- Executes dropped EXE
PID:2872 -
\??\c:\pjddj.exec:\pjddj.exe42⤵
- Executes dropped EXE
PID:2560 -
\??\c:\5fxfflr.exec:\5fxfflr.exe43⤵
- Executes dropped EXE
PID:2552 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe44⤵
- Executes dropped EXE
PID:2624 -
\??\c:\hhtbtn.exec:\hhtbtn.exe45⤵
- Executes dropped EXE
PID:1360 -
\??\c:\1ththn.exec:\1ththn.exe46⤵
- Executes dropped EXE
PID:268 -
\??\c:\5vvvd.exec:\5vvvd.exe47⤵
- Executes dropped EXE
PID:2208 -
\??\c:\dpdpd.exec:\dpdpd.exe48⤵
- Executes dropped EXE
PID:2772 -
\??\c:\5ffllxl.exec:\5ffllxl.exe49⤵
- Executes dropped EXE
PID:1092 -
\??\c:\3fxlxrr.exec:\3fxlxrr.exe50⤵
- Executes dropped EXE
PID:304 -
\??\c:\bbnnbn.exec:\bbnnbn.exe51⤵
- Executes dropped EXE
PID:1972 -
\??\c:\1vppj.exec:\1vppj.exe52⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ppdjd.exec:\ppdjd.exe53⤵
- Executes dropped EXE
PID:1256 -
\??\c:\rffflxf.exec:\rffflxf.exe54⤵
- Executes dropped EXE
PID:1804 -
\??\c:\xxllffl.exec:\xxllffl.exe55⤵
- Executes dropped EXE
PID:316 -
\??\c:\btnbbh.exec:\btnbbh.exe56⤵
- Executes dropped EXE
PID:2836 -
\??\c:\hbthtb.exec:\hbthtb.exe57⤵
- Executes dropped EXE
PID:2384 -
\??\c:\1jpdd.exec:\1jpdd.exe58⤵
- Executes dropped EXE
PID:1752 -
\??\c:\ddvpv.exec:\ddvpv.exe59⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xxrxxlx.exec:\xxrxxlx.exe60⤵
- Executes dropped EXE
PID:2808 -
\??\c:\3rrrffl.exec:\3rrrffl.exe61⤵
- Executes dropped EXE
PID:264 -
\??\c:\ttbhnt.exec:\ttbhnt.exe62⤵
- Executes dropped EXE
PID:1020 -
\??\c:\hthnnn.exec:\hthnnn.exe63⤵
- Executes dropped EXE
PID:580 -
\??\c:\dvvvj.exec:\dvvvj.exe64⤵
- Executes dropped EXE
PID:640 -
\??\c:\vpdvv.exec:\vpdvv.exe65⤵
- Executes dropped EXE
PID:2336 -
\??\c:\fxrrffx.exec:\fxrrffx.exe66⤵PID:1352
-
\??\c:\xlrffll.exec:\xlrffll.exe67⤵PID:1812
-
\??\c:\hbbhhn.exec:\hbbhhn.exe68⤵PID:2112
-
\??\c:\tntnbh.exec:\tntnbh.exe69⤵PID:1948
-
\??\c:\btthnn.exec:\btthnn.exe70⤵PID:3032
-
\??\c:\7ppvd.exec:\7ppvd.exe71⤵PID:2456
-
\??\c:\vjddd.exec:\vjddd.exe72⤵PID:1772
-
\??\c:\lrlrxfl.exec:\lrlrxfl.exe73⤵PID:2588
-
\??\c:\lfrlxlx.exec:\lfrlxlx.exe74⤵PID:1532
-
\??\c:\nhbhhh.exec:\nhbhhh.exe75⤵PID:1708
-
\??\c:\btbntt.exec:\btbntt.exe76⤵PID:2856
-
\??\c:\pjdjp.exec:\pjdjp.exe77⤵PID:2720
-
\??\c:\lfrxxxf.exec:\lfrxxxf.exe78⤵PID:2612
-
\??\c:\fxlrxff.exec:\fxlrxff.exe79⤵PID:2636
-
\??\c:\fxxlfrf.exec:\fxxlfrf.exe80⤵PID:2360
-
\??\c:\5hbbnt.exec:\5hbbnt.exe81⤵PID:2696
-
\??\c:\3nhhnt.exec:\3nhhnt.exe82⤵PID:2564
-
\??\c:\dvjjd.exec:\dvjjd.exe83⤵PID:2528
-
\??\c:\1vjpd.exec:\1vjpd.exe84⤵PID:548
-
\??\c:\xlrrrxf.exec:\xlrrrxf.exe85⤵PID:2144
-
\??\c:\lfxxllx.exec:\lfxxllx.exe86⤵PID:1240
-
\??\c:\nntbhb.exec:\nntbhb.exe87⤵PID:1952
-
\??\c:\9bhtnb.exec:\9bhtnb.exe88⤵PID:2568
-
\??\c:\vjdpv.exec:\vjdpv.exe89⤵PID:1904
-
\??\c:\jddvd.exec:\jddvd.exe90⤵PID:2496
-
\??\c:\lfrxrxx.exec:\lfrxrxx.exe91⤵PID:1900
-
\??\c:\3rlrflx.exec:\3rlrflx.exe92⤵PID:2008
-
\??\c:\tnbbnn.exec:\tnbbnn.exe93⤵PID:2416
-
\??\c:\hhbnhh.exec:\hhbnhh.exe94⤵PID:2168
-
\??\c:\9vvjp.exec:\9vvjp.exe95⤵PID:2408
-
\??\c:\vvjdj.exec:\vvjdj.exe96⤵PID:1888
-
\??\c:\xrxflrf.exec:\xrxflrf.exe97⤵PID:2548
-
\??\c:\rfrfrxl.exec:\rfrfrxl.exe98⤵PID:2148
-
\??\c:\1tnbbh.exec:\1tnbbh.exe99⤵PID:2848
-
\??\c:\nnnbth.exec:\nnnbth.exe100⤵PID:2892
-
\??\c:\3vvdj.exec:\3vvdj.exe101⤵PID:536
-
\??\c:\3jjvd.exec:\3jjvd.exe102⤵PID:2332
-
\??\c:\9rfxflx.exec:\9rfxflx.exe103⤵PID:652
-
\??\c:\rrlfrxf.exec:\rrlfrxf.exe104⤵PID:908
-
\??\c:\hbntbt.exec:\hbntbt.exe105⤵PID:344
-
\??\c:\hhhtbt.exec:\hhhtbt.exe106⤵PID:948
-
\??\c:\vpdpj.exec:\vpdpj.exe107⤵PID:704
-
\??\c:\rrlrrxf.exec:\rrlrrxf.exe108⤵PID:1592
-
\??\c:\3rlxlll.exec:\3rlxlll.exe109⤵PID:2004
-
\??\c:\nhhthh.exec:\nhhthh.exe110⤵PID:2072
-
\??\c:\nbtbbb.exec:\nbtbbb.exe111⤵PID:2064
-
\??\c:\nhtbhh.exec:\nhtbhh.exe112⤵PID:2940
-
\??\c:\1jvjp.exec:\1jvjp.exe113⤵PID:1800
-
\??\c:\vjvvp.exec:\vjvvp.exe114⤵PID:1580
-
\??\c:\lfllxxf.exec:\lfllxxf.exe115⤵PID:2060
-
\??\c:\rlfrrfl.exec:\rlfrrfl.exe116⤵PID:1260
-
\??\c:\tnhhbb.exec:\tnhhbb.exe117⤵PID:2796
-
\??\c:\9htbht.exec:\9htbht.exe118⤵PID:3048
-
\??\c:\jvjdj.exec:\jvjdj.exe119⤵PID:2712
-
\??\c:\pppdd.exec:\pppdd.exe120⤵PID:2664
-
\??\c:\1lllrxf.exec:\1lllrxf.exe121⤵PID:2692
-
\??\c:\xrllxfr.exec:\xrllxfr.exe122⤵PID:2616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-