Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05/07/2024, 02:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2bb221a79096b4add5b4fc61e68acd2457fdc24611153f905bfab25ce4e20ddb.exe
Resource
win7-20240704-en
5 signatures
150 seconds
General
-
Target
2bb221a79096b4add5b4fc61e68acd2457fdc24611153f905bfab25ce4e20ddb.exe
-
Size
71KB
-
MD5
2cd5da05314eacdcf8ef3dc677252e20
-
SHA1
b3be6cb3803df16d950c33ce0332e008024ac037
-
SHA256
2bb221a79096b4add5b4fc61e68acd2457fdc24611153f905bfab25ce4e20ddb
-
SHA512
a8a68724c1d0182b9b51e583cab65c4ac82e2b706700612b3896bf96e9c2f922a93936b201a28ae178808f843b87990562a04668dc92fdd0dcc504c03a855874
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUwcsbYsRgVq:ymb3NkkiQ3mdBjF0yjcsMsRb
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/1736-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1424-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1424-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1600-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1416-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/988-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1452-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 772 dvpvd.exe 2208 xflffrr.exe 1424 tbbhbb.exe 2720 1vppv.exe 3004 vjdjp.exe 2992 rlrffff.exe 2592 tntthh.exe 2772 nbttbh.exe 2580 jvppv.exe 1624 5vppv.exe 880 lxrflll.exe 2828 3xlllfl.exe 2084 5tnntt.exe 1984 nhntbh.exe 2456 7pdvd.exe 1500 5frfxrr.exe 1048 lxflrxx.exe 3052 1nbhhh.exe 2152 thnntn.exe 1840 7vppp.exe 1600 rfrrxrf.exe 1416 nbnhhn.exe 1620 thtttt.exe 988 dpjdp.exe 1596 rrflrrx.exe 1452 xrffllr.exe 2544 btbntt.exe 1140 vpvpv.exe 836 pdjpp.exe 1052 5rlllfl.exe 2656 llrffrx.exe 2652 tnbtbh.exe 2860 nbnbbh.exe 2172 pdpjj.exe 2812 5ppdj.exe 2844 lrxxrrr.exe 2288 xrflxxx.exe 2108 lxlfxrx.exe 2788 thttbh.exe 2736 5bbbbh.exe 2576 jvjpd.exe 2648 ppdjj.exe 2244 rrflrfr.exe 2392 lxrlxrx.exe 880 thhbbh.exe 1488 nhttnn.exe 1980 thbbhh.exe 2916 dpvvv.exe 2784 dvjdd.exe 2396 3jjvp.exe 1456 flfrxrx.exe 2956 lfxfxxx.exe 2904 thnnnh.exe 2444 thnhhh.exe 1732 9vvjv.exe 2336 dpddj.exe 1892 vpddj.exe 1988 rlflfrr.exe 1556 xlxxxxr.exe 2372 5hhhhn.exe 988 nnnhhb.exe 1552 dvdjj.exe 1336 3dvpp.exe 996 5ffffff.exe -
resource yara_rule behavioral1/memory/1736-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1424-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1424-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1600-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1416-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/988-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1452-250-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 772 1736 2bb221a79096b4add5b4fc61e68acd2457fdc24611153f905bfab25ce4e20ddb.exe 31 PID 1736 wrote to memory of 772 1736 2bb221a79096b4add5b4fc61e68acd2457fdc24611153f905bfab25ce4e20ddb.exe 31 PID 1736 wrote to memory of 772 1736 2bb221a79096b4add5b4fc61e68acd2457fdc24611153f905bfab25ce4e20ddb.exe 31 PID 1736 wrote to memory of 772 1736 2bb221a79096b4add5b4fc61e68acd2457fdc24611153f905bfab25ce4e20ddb.exe 31 PID 772 wrote to memory of 2208 772 dvpvd.exe 32 PID 772 wrote to memory of 2208 772 dvpvd.exe 32 PID 772 wrote to memory of 2208 772 dvpvd.exe 32 PID 772 wrote to memory of 2208 772 dvpvd.exe 32 PID 2208 wrote to memory of 1424 2208 xflffrr.exe 33 PID 2208 wrote to memory of 1424 2208 xflffrr.exe 33 PID 2208 wrote to memory of 1424 2208 xflffrr.exe 33 PID 2208 wrote to memory of 1424 2208 xflffrr.exe 33 PID 1424 wrote to memory of 2720 1424 tbbhbb.exe 34 PID 1424 wrote to memory of 2720 1424 tbbhbb.exe 34 PID 1424 wrote to memory of 2720 1424 tbbhbb.exe 34 PID 1424 wrote to memory of 2720 1424 tbbhbb.exe 34 PID 2720 wrote to memory of 3004 2720 1vppv.exe 35 PID 2720 wrote to memory of 3004 2720 1vppv.exe 35 PID 2720 wrote to memory of 3004 2720 1vppv.exe 35 PID 2720 wrote to memory of 3004 2720 1vppv.exe 35 PID 3004 wrote to memory of 2992 3004 vjdjp.exe 36 PID 3004 wrote to memory of 2992 3004 vjdjp.exe 36 PID 3004 wrote to memory of 2992 3004 vjdjp.exe 36 PID 3004 wrote to memory of 2992 3004 vjdjp.exe 36 PID 2992 wrote to memory of 2592 2992 rlrffff.exe 37 PID 2992 wrote to memory of 2592 2992 rlrffff.exe 37 PID 2992 wrote to memory of 2592 2992 rlrffff.exe 37 PID 2992 wrote to memory of 2592 2992 rlrffff.exe 37 PID 2592 wrote to memory of 2772 2592 tntthh.exe 38 PID 2592 wrote to memory of 2772 2592 tntthh.exe 38 PID 2592 wrote to memory of 2772 2592 tntthh.exe 38 PID 2592 wrote to memory of 2772 2592 tntthh.exe 38 PID 2772 wrote to memory of 2580 2772 nbttbh.exe 39 PID 2772 wrote to memory of 2580 2772 nbttbh.exe 39 PID 2772 wrote to memory of 2580 2772 nbttbh.exe 39 PID 2772 wrote to memory of 2580 2772 nbttbh.exe 39 PID 2580 wrote to memory of 1624 2580 jvppv.exe 40 PID 2580 wrote to memory of 1624 2580 jvppv.exe 40 PID 2580 wrote to memory of 1624 2580 jvppv.exe 40 PID 2580 wrote to memory of 1624 2580 jvppv.exe 40 PID 1624 wrote to memory of 880 1624 5vppv.exe 41 PID 1624 wrote to memory of 880 1624 5vppv.exe 41 PID 1624 wrote to memory of 880 1624 5vppv.exe 41 PID 1624 wrote to memory of 880 1624 5vppv.exe 41 PID 880 wrote to memory of 2828 880 lxrflll.exe 42 PID 880 wrote to memory of 2828 880 lxrflll.exe 42 PID 880 wrote to memory of 2828 880 lxrflll.exe 42 PID 880 wrote to memory of 2828 880 lxrflll.exe 42 PID 2828 wrote to memory of 2084 2828 3xlllfl.exe 43 PID 2828 wrote to memory of 2084 2828 3xlllfl.exe 43 PID 2828 wrote to memory of 2084 2828 3xlllfl.exe 43 PID 2828 wrote to memory of 2084 2828 3xlllfl.exe 43 PID 2084 wrote to memory of 1984 2084 5tnntt.exe 44 PID 2084 wrote to memory of 1984 2084 5tnntt.exe 44 PID 2084 wrote to memory of 1984 2084 5tnntt.exe 44 PID 2084 wrote to memory of 1984 2084 5tnntt.exe 44 PID 1984 wrote to memory of 2456 1984 nhntbh.exe 45 PID 1984 wrote to memory of 2456 1984 nhntbh.exe 45 PID 1984 wrote to memory of 2456 1984 nhntbh.exe 45 PID 1984 wrote to memory of 2456 1984 nhntbh.exe 45 PID 2456 wrote to memory of 1500 2456 7pdvd.exe 46 PID 2456 wrote to memory of 1500 2456 7pdvd.exe 46 PID 2456 wrote to memory of 1500 2456 7pdvd.exe 46 PID 2456 wrote to memory of 1500 2456 7pdvd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bb221a79096b4add5b4fc61e68acd2457fdc24611153f905bfab25ce4e20ddb.exe"C:\Users\Admin\AppData\Local\Temp\2bb221a79096b4add5b4fc61e68acd2457fdc24611153f905bfab25ce4e20ddb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\dvpvd.exec:\dvpvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\xflffrr.exec:\xflffrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\tbbhbb.exec:\tbbhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\1vppv.exec:\1vppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\vjdjp.exec:\vjdjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\rlrffff.exec:\rlrffff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\tntthh.exec:\tntthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\nbttbh.exec:\nbttbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\jvppv.exec:\jvppv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\5vppv.exec:\5vppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\lxrflll.exec:\lxrflll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\3xlllfl.exec:\3xlllfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\5tnntt.exec:\5tnntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\nhntbh.exec:\nhntbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\7pdvd.exec:\7pdvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\5frfxrr.exec:\5frfxrr.exe17⤵
- Executes dropped EXE
PID:1500 -
\??\c:\lxflrxx.exec:\lxflrxx.exe18⤵
- Executes dropped EXE
PID:1048 -
\??\c:\1nbhhh.exec:\1nbhhh.exe19⤵
- Executes dropped EXE
PID:3052 -
\??\c:\thnntn.exec:\thnntn.exe20⤵
- Executes dropped EXE
PID:2152 -
\??\c:\7vppp.exec:\7vppp.exe21⤵
- Executes dropped EXE
PID:1840 -
\??\c:\rfrrxrf.exec:\rfrrxrf.exe22⤵
- Executes dropped EXE
PID:1600 -
\??\c:\nbnhhn.exec:\nbnhhn.exe23⤵
- Executes dropped EXE
PID:1416 -
\??\c:\thtttt.exec:\thtttt.exe24⤵
- Executes dropped EXE
PID:1620 -
\??\c:\dpjdp.exec:\dpjdp.exe25⤵
- Executes dropped EXE
PID:988 -
\??\c:\rrflrrx.exec:\rrflrrx.exe26⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xrffllr.exec:\xrffllr.exe27⤵
- Executes dropped EXE
PID:1452 -
\??\c:\btbntt.exec:\btbntt.exe28⤵
- Executes dropped EXE
PID:2544 -
\??\c:\vpvpv.exec:\vpvpv.exe29⤵
- Executes dropped EXE
PID:1140 -
\??\c:\pdjpp.exec:\pdjpp.exe30⤵
- Executes dropped EXE
PID:836 -
\??\c:\5rlllfl.exec:\5rlllfl.exe31⤵
- Executes dropped EXE
PID:1052 -
\??\c:\llrffrx.exec:\llrffrx.exe32⤵
- Executes dropped EXE
PID:2656 -
\??\c:\tnbtbh.exec:\tnbtbh.exe33⤵
- Executes dropped EXE
PID:2652 -
\??\c:\nbnbbh.exec:\nbnbbh.exe34⤵
- Executes dropped EXE
PID:2860 -
\??\c:\pdpjj.exec:\pdpjj.exe35⤵
- Executes dropped EXE
PID:2172 -
\??\c:\5ppdj.exec:\5ppdj.exe36⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lrxxrrr.exec:\lrxxrrr.exe37⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xrflxxx.exec:\xrflxxx.exe38⤵
- Executes dropped EXE
PID:2288 -
\??\c:\lxlfxrx.exec:\lxlfxrx.exe39⤵
- Executes dropped EXE
PID:2108 -
\??\c:\thttbh.exec:\thttbh.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\5bbbbh.exec:\5bbbbh.exe41⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jvjpd.exec:\jvjpd.exe42⤵
- Executes dropped EXE
PID:2576 -
\??\c:\ppdjj.exec:\ppdjj.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rrflrfr.exec:\rrflrfr.exe44⤵
- Executes dropped EXE
PID:2244 -
\??\c:\lxrlxrx.exec:\lxrlxrx.exe45⤵
- Executes dropped EXE
PID:2392 -
\??\c:\thhbbh.exec:\thhbbh.exe46⤵
- Executes dropped EXE
PID:880 -
\??\c:\nhttnn.exec:\nhttnn.exe47⤵
- Executes dropped EXE
PID:1488 -
\??\c:\thbbhh.exec:\thbbhh.exe48⤵
- Executes dropped EXE
PID:1980 -
\??\c:\dpvvv.exec:\dpvvv.exe49⤵
- Executes dropped EXE
PID:2916 -
\??\c:\dvjdd.exec:\dvjdd.exe50⤵
- Executes dropped EXE
PID:2784 -
\??\c:\3jjvp.exec:\3jjvp.exe51⤵
- Executes dropped EXE
PID:2396 -
\??\c:\flfrxrx.exec:\flfrxrx.exe52⤵
- Executes dropped EXE
PID:1456 -
\??\c:\lfxfxxx.exec:\lfxfxxx.exe53⤵
- Executes dropped EXE
PID:2956 -
\??\c:\thnnnh.exec:\thnnnh.exe54⤵
- Executes dropped EXE
PID:2904 -
\??\c:\thnhhh.exec:\thnhhh.exe55⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9vvjv.exec:\9vvjv.exe56⤵
- Executes dropped EXE
PID:1732 -
\??\c:\dpddj.exec:\dpddj.exe57⤵
- Executes dropped EXE
PID:2336 -
\??\c:\vpddj.exec:\vpddj.exe58⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rlflfrr.exec:\rlflfrr.exe59⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xlxxxxr.exec:\xlxxxxr.exe60⤵
- Executes dropped EXE
PID:1556 -
\??\c:\5hhhhn.exec:\5hhhhn.exe61⤵
- Executes dropped EXE
PID:2372 -
\??\c:\nnnhhb.exec:\nnnhhb.exe62⤵
- Executes dropped EXE
PID:988 -
\??\c:\dvdjj.exec:\dvdjj.exe63⤵
- Executes dropped EXE
PID:1552 -
\??\c:\3dvpp.exec:\3dvpp.exe64⤵
- Executes dropped EXE
PID:1336 -
\??\c:\5ffffff.exec:\5ffffff.exe65⤵
- Executes dropped EXE
PID:996 -
\??\c:\rlflffx.exec:\rlflffx.exe66⤵PID:992
-
\??\c:\lxfllrr.exec:\lxfllrr.exe67⤵PID:1140
-
\??\c:\btnthn.exec:\btnthn.exe68⤵PID:836
-
\??\c:\bttntn.exec:\bttntn.exe69⤵PID:832
-
\??\c:\dvjvv.exec:\dvjvv.exe70⤵PID:2032
-
\??\c:\xfxxlxf.exec:\xfxxlxf.exe71⤵PID:2980
-
\??\c:\fffrfrf.exec:\fffrfrf.exe72⤵PID:2224
-
\??\c:\hthbhh.exec:\hthbhh.exe73⤵PID:1940
-
\??\c:\bhnhth.exec:\bhnhth.exe74⤵PID:2172
-
\??\c:\1jdpp.exec:\1jdpp.exe75⤵PID:1580
-
\??\c:\xfxrxxf.exec:\xfxrxxf.exe76⤵PID:2844
-
\??\c:\rffxlfl.exec:\rffxlfl.exe77⤵PID:2600
-
\??\c:\tbhbnt.exec:\tbhbnt.exe78⤵PID:2108
-
\??\c:\5vpjv.exec:\5vpjv.exe79⤵PID:2788
-
\??\c:\1pddd.exec:\1pddd.exe80⤵PID:2736
-
\??\c:\7rlxrlr.exec:\7rlxrlr.exe81⤵PID:2060
-
\??\c:\3lfrxxr.exec:\3lfrxxr.exe82⤵PID:2692
-
\??\c:\nbhbhh.exec:\nbhbhh.exe83⤵PID:1108
-
\??\c:\vvpdp.exec:\vvpdp.exe84⤵PID:2392
-
\??\c:\pdjdd.exec:\pdjdd.exe85⤵PID:1348
-
\??\c:\xlxrxrx.exec:\xlxrxrx.exe86⤵PID:1488
-
\??\c:\7lrxxxx.exec:\7lrxxxx.exe87⤵PID:1980
-
\??\c:\bhtnbt.exec:\bhtnbt.exe88⤵PID:1572
-
\??\c:\jdjpv.exec:\jdjpv.exe89⤵PID:1800
-
\??\c:\vpvvd.exec:\vpvvd.exe90⤵PID:2396
-
\??\c:\3rfflll.exec:\3rfflll.exe91⤵PID:1456
-
\??\c:\hhhhhb.exec:\hhhhhb.exe92⤵PID:2956
-
\??\c:\1hhhhn.exec:\1hhhhn.exe93⤵PID:2904
-
\??\c:\vjvvv.exec:\vjvvv.exe94⤵PID:2444
-
\??\c:\vpdvd.exec:\vpdvd.exe95⤵PID:1732
-
\??\c:\xrfrfxr.exec:\xrfrfxr.exe96⤵PID:2336
-
\??\c:\9xfrxrx.exec:\9xfrxrx.exe97⤵PID:1680
-
\??\c:\7thbth.exec:\7thbth.exe98⤵PID:1988
-
\??\c:\ttnbhn.exec:\ttnbhn.exe99⤵PID:1556
-
\??\c:\dddjv.exec:\dddjv.exe100⤵PID:2372
-
\??\c:\ddjjv.exec:\ddjjv.exe101⤵PID:900
-
\??\c:\rxxlfxf.exec:\rxxlfxf.exe102⤵PID:1552
-
\??\c:\tnbbhb.exec:\tnbbhb.exe103⤵PID:1868
-
\??\c:\bbnttb.exec:\bbnttb.exe104⤵PID:996
-
\??\c:\vpvpd.exec:\vpvpd.exe105⤵PID:992
-
\??\c:\pdvdd.exec:\pdvdd.exe106⤵PID:1140
-
\??\c:\xlxffxf.exec:\xlxffxf.exe107⤵PID:836
-
\??\c:\fxrrffx.exec:\fxrrffx.exe108⤵PID:832
-
\??\c:\thntnn.exec:\thntnn.exe109⤵PID:2032
-
\??\c:\jvjpp.exec:\jvjpp.exe110⤵PID:2980
-
\??\c:\vjpjp.exec:\vjpjp.exe111⤵PID:2224
-
\??\c:\xrlrlfl.exec:\xrlrlfl.exe112⤵PID:1940
-
\??\c:\nhhhbb.exec:\nhhhbb.exe113⤵PID:2716
-
\??\c:\tnbbnt.exec:\tnbbnt.exe114⤵PID:1580
-
\??\c:\pjvjp.exec:\pjvjp.exe115⤵PID:2976
-
\??\c:\jjdjd.exec:\jjdjd.exe116⤵PID:2600
-
\??\c:\rlrfxrl.exec:\rlrfxrl.exe117⤵PID:1036
-
\??\c:\xrfrfxf.exec:\xrfrfxf.exe118⤵PID:2788
-
\??\c:\hhtnhh.exec:\hhtnhh.exe119⤵PID:2580
-
\??\c:\bnbhtt.exec:\bnbhtt.exe120⤵PID:632
-
\??\c:\1pddd.exec:\1pddd.exe121⤵PID:2648
-
\??\c:\pddjj.exec:\pddjj.exe122⤵PID:1108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-