Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 00:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
789e2d6afe1d798b80a152301c912c5bac02d826be68d8ac2eee8801b43f5b92.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
789e2d6afe1d798b80a152301c912c5bac02d826be68d8ac2eee8801b43f5b92.exe
-
Size
122KB
-
MD5
7ce3c13809b0ccbd366c902f1f6717ab
-
SHA1
0048b46b5a725eea3528f1cff109aadbaeafedd2
-
SHA256
789e2d6afe1d798b80a152301c912c5bac02d826be68d8ac2eee8801b43f5b92
-
SHA512
b1210f8f860cf69a2936477935b1f49f1932b50325bce2444c9f87aeb1bf5a7afa624e4114ae34cb309ba0b401c085b9a15435167fd35f969d0eb8772ecc5d63
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDomRGApSuLAR2yPBCQ1nDFu1Q8sp:ymb3NkkiQ3mdBjFomR7UsyJC+n0Gsgc8
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/1276-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-82-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1028-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/812-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2072 jdppd.exe 1912 nhntbb.exe 2724 xrllrxl.exe 2644 nhtbnt.exe 2756 pjvdj.exe 2648 7jvdj.exe 2556 ffxlfrr.exe 2564 nbnntt.exe 1028 5dvdp.exe 2776 vvpdv.exe 2844 rrlrflf.exe 304 7tbnbb.exe 1924 9vjjv.exe 1664 9vpvd.exe 812 lflrfrl.exe 2356 tnhntt.exe 1636 vvjvp.exe 1672 jjvvj.exe 2116 rlxfrrx.exe 1188 hbnttt.exe 2912 vpjpd.exe 536 jvppp.exe 1492 3lxfrxl.exe 1916 nnhhtt.exe 1364 dpjvd.exe 1344 7rffffl.exe 1708 tnhhbh.exe 960 pdjjj.exe 2876 flrlxrr.exe 836 rlffrrx.exe 2168 hhhntt.exe 2884 dpvjp.exe 1088 fxflrxl.exe 2308 nnhntt.exe 3044 3nnbhh.exe 2812 dvddj.exe 2728 vpdvd.exe 2664 ffflflx.exe 2672 nhbntt.exe 2520 jjdvp.exe 2756 dpjvv.exe 2432 ffxxxfl.exe 2524 lxrxxxx.exe 2976 tttbnh.exe 3052 9nbhtb.exe 2784 pjdjp.exe 2704 jjjpv.exe 2848 lllrlrf.exe 792 xrxxflr.exe 1816 tnnbtb.exe 2020 tnthnb.exe 2476 pvppj.exe 1664 ppjjv.exe 2572 fffrxfr.exe 2356 5fxllrf.exe 1148 9nbhtb.exe 2248 9jdjp.exe 2608 dvpdj.exe 2692 dvjvj.exe 2316 1xxrxrf.exe 320 bbbnbb.exe 540 hthnbb.exe 1100 dvvpv.exe 1920 7vdjd.exe -
resource yara_rule behavioral1/memory/1276-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1276-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1028-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/812-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1276 wrote to memory of 2072 1276 789e2d6afe1d798b80a152301c912c5bac02d826be68d8ac2eee8801b43f5b92.exe 28 PID 1276 wrote to memory of 2072 1276 789e2d6afe1d798b80a152301c912c5bac02d826be68d8ac2eee8801b43f5b92.exe 28 PID 1276 wrote to memory of 2072 1276 789e2d6afe1d798b80a152301c912c5bac02d826be68d8ac2eee8801b43f5b92.exe 28 PID 1276 wrote to memory of 2072 1276 789e2d6afe1d798b80a152301c912c5bac02d826be68d8ac2eee8801b43f5b92.exe 28 PID 2072 wrote to memory of 1912 2072 jdppd.exe 29 PID 2072 wrote to memory of 1912 2072 jdppd.exe 29 PID 2072 wrote to memory of 1912 2072 jdppd.exe 29 PID 2072 wrote to memory of 1912 2072 jdppd.exe 29 PID 1912 wrote to memory of 2724 1912 nhntbb.exe 30 PID 1912 wrote to memory of 2724 1912 nhntbb.exe 30 PID 1912 wrote to memory of 2724 1912 nhntbb.exe 30 PID 1912 wrote to memory of 2724 1912 nhntbb.exe 30 PID 2724 wrote to memory of 2644 2724 xrllrxl.exe 31 PID 2724 wrote to memory of 2644 2724 xrllrxl.exe 31 PID 2724 wrote to memory of 2644 2724 xrllrxl.exe 31 PID 2724 wrote to memory of 2644 2724 xrllrxl.exe 31 PID 2644 wrote to memory of 2756 2644 nhtbnt.exe 32 PID 2644 wrote to memory of 2756 2644 nhtbnt.exe 32 PID 2644 wrote to memory of 2756 2644 nhtbnt.exe 32 PID 2644 wrote to memory of 2756 2644 nhtbnt.exe 32 PID 2756 wrote to memory of 2648 2756 pjvdj.exe 33 PID 2756 wrote to memory of 2648 2756 pjvdj.exe 33 PID 2756 wrote to memory of 2648 2756 pjvdj.exe 33 PID 2756 wrote to memory of 2648 2756 pjvdj.exe 33 PID 2648 wrote to memory of 2556 2648 7jvdj.exe 34 PID 2648 wrote to memory of 2556 2648 7jvdj.exe 34 PID 2648 wrote to memory of 2556 2648 7jvdj.exe 34 PID 2648 wrote to memory of 2556 2648 7jvdj.exe 34 PID 2556 wrote to memory of 2564 2556 ffxlfrr.exe 35 PID 2556 wrote to memory of 2564 2556 ffxlfrr.exe 35 PID 2556 wrote to memory of 2564 2556 ffxlfrr.exe 35 PID 2556 wrote to memory of 2564 2556 ffxlfrr.exe 35 PID 2564 wrote to memory of 1028 2564 nbnntt.exe 36 PID 2564 wrote to memory of 1028 2564 nbnntt.exe 36 PID 2564 wrote to memory of 1028 2564 nbnntt.exe 36 PID 2564 wrote to memory of 1028 2564 nbnntt.exe 36 PID 1028 wrote to memory of 2776 1028 5dvdp.exe 37 PID 1028 wrote to memory of 2776 1028 5dvdp.exe 37 PID 1028 wrote to memory of 2776 1028 5dvdp.exe 37 PID 1028 wrote to memory of 2776 1028 5dvdp.exe 37 PID 2776 wrote to memory of 2844 2776 vvpdv.exe 38 PID 2776 wrote to memory of 2844 2776 vvpdv.exe 38 PID 2776 wrote to memory of 2844 2776 vvpdv.exe 38 PID 2776 wrote to memory of 2844 2776 vvpdv.exe 38 PID 2844 wrote to memory of 304 2844 rrlrflf.exe 39 PID 2844 wrote to memory of 304 2844 rrlrflf.exe 39 PID 2844 wrote to memory of 304 2844 rrlrflf.exe 39 PID 2844 wrote to memory of 304 2844 rrlrflf.exe 39 PID 304 wrote to memory of 1924 304 7tbnbb.exe 40 PID 304 wrote to memory of 1924 304 7tbnbb.exe 40 PID 304 wrote to memory of 1924 304 7tbnbb.exe 40 PID 304 wrote to memory of 1924 304 7tbnbb.exe 40 PID 1924 wrote to memory of 1664 1924 9vjjv.exe 41 PID 1924 wrote to memory of 1664 1924 9vjjv.exe 41 PID 1924 wrote to memory of 1664 1924 9vjjv.exe 41 PID 1924 wrote to memory of 1664 1924 9vjjv.exe 41 PID 1664 wrote to memory of 812 1664 9vpvd.exe 42 PID 1664 wrote to memory of 812 1664 9vpvd.exe 42 PID 1664 wrote to memory of 812 1664 9vpvd.exe 42 PID 1664 wrote to memory of 812 1664 9vpvd.exe 42 PID 812 wrote to memory of 2356 812 lflrfrl.exe 43 PID 812 wrote to memory of 2356 812 lflrfrl.exe 43 PID 812 wrote to memory of 2356 812 lflrfrl.exe 43 PID 812 wrote to memory of 2356 812 lflrfrl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\789e2d6afe1d798b80a152301c912c5bac02d826be68d8ac2eee8801b43f5b92.exe"C:\Users\Admin\AppData\Local\Temp\789e2d6afe1d798b80a152301c912c5bac02d826be68d8ac2eee8801b43f5b92.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\jdppd.exec:\jdppd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\nhntbb.exec:\nhntbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\xrllrxl.exec:\xrllrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\nhtbnt.exec:\nhtbnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\pjvdj.exec:\pjvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\7jvdj.exec:\7jvdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\ffxlfrr.exec:\ffxlfrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\nbnntt.exec:\nbnntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\5dvdp.exec:\5dvdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\vvpdv.exec:\vvpdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\rrlrflf.exec:\rrlrflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\7tbnbb.exec:\7tbnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:304 -
\??\c:\9vjjv.exec:\9vjjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\9vpvd.exec:\9vpvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\lflrfrl.exec:\lflrfrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\tnhntt.exec:\tnhntt.exe17⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vvjvp.exec:\vvjvp.exe18⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jjvvj.exec:\jjvvj.exe19⤵
- Executes dropped EXE
PID:1672 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe20⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hbnttt.exec:\hbnttt.exe21⤵
- Executes dropped EXE
PID:1188 -
\??\c:\vpjpd.exec:\vpjpd.exe22⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jvppp.exec:\jvppp.exe23⤵
- Executes dropped EXE
PID:536 -
\??\c:\3lxfrxl.exec:\3lxfrxl.exe24⤵
- Executes dropped EXE
PID:1492 -
\??\c:\nnhhtt.exec:\nnhhtt.exe25⤵
- Executes dropped EXE
PID:1916 -
\??\c:\dpjvd.exec:\dpjvd.exe26⤵
- Executes dropped EXE
PID:1364 -
\??\c:\7rffffl.exec:\7rffffl.exe27⤵
- Executes dropped EXE
PID:1344 -
\??\c:\tnhhbh.exec:\tnhhbh.exe28⤵
- Executes dropped EXE
PID:1708 -
\??\c:\pdjjj.exec:\pdjjj.exe29⤵
- Executes dropped EXE
PID:960 -
\??\c:\flrlxrr.exec:\flrlxrr.exe30⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rlffrrx.exec:\rlffrrx.exe31⤵
- Executes dropped EXE
PID:836 -
\??\c:\hhhntt.exec:\hhhntt.exe32⤵
- Executes dropped EXE
PID:2168 -
\??\c:\dpvjp.exec:\dpvjp.exe33⤵
- Executes dropped EXE
PID:2884 -
\??\c:\fxflrxl.exec:\fxflrxl.exe34⤵
- Executes dropped EXE
PID:1088 -
\??\c:\nnhntt.exec:\nnhntt.exe35⤵
- Executes dropped EXE
PID:2308 -
\??\c:\3nnbhh.exec:\3nnbhh.exe36⤵
- Executes dropped EXE
PID:3044 -
\??\c:\dvddj.exec:\dvddj.exe37⤵
- Executes dropped EXE
PID:2812 -
\??\c:\vpdvd.exec:\vpdvd.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\ffflflx.exec:\ffflflx.exe39⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nhbntt.exec:\nhbntt.exe40⤵
- Executes dropped EXE
PID:2672 -
\??\c:\jjdvp.exec:\jjdvp.exe41⤵
- Executes dropped EXE
PID:2520 -
\??\c:\dpjvv.exec:\dpjvv.exe42⤵
- Executes dropped EXE
PID:2756 -
\??\c:\ffxxxfl.exec:\ffxxxfl.exe43⤵
- Executes dropped EXE
PID:2432 -
\??\c:\lxrxxxx.exec:\lxrxxxx.exe44⤵
- Executes dropped EXE
PID:2524 -
\??\c:\tttbnh.exec:\tttbnh.exe45⤵
- Executes dropped EXE
PID:2976 -
\??\c:\9nbhtb.exec:\9nbhtb.exe46⤵
- Executes dropped EXE
PID:3052 -
\??\c:\pjdjp.exec:\pjdjp.exe47⤵
- Executes dropped EXE
PID:2784 -
\??\c:\jjjpv.exec:\jjjpv.exe48⤵
- Executes dropped EXE
PID:2704 -
\??\c:\lllrlrf.exec:\lllrlrf.exe49⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xrxxflr.exec:\xrxxflr.exe50⤵
- Executes dropped EXE
PID:792 -
\??\c:\tnnbtb.exec:\tnnbtb.exe51⤵
- Executes dropped EXE
PID:1816 -
\??\c:\tnthnb.exec:\tnthnb.exe52⤵
- Executes dropped EXE
PID:2020 -
\??\c:\pvppj.exec:\pvppj.exe53⤵
- Executes dropped EXE
PID:2476 -
\??\c:\ppjjv.exec:\ppjjv.exe54⤵
- Executes dropped EXE
PID:1664 -
\??\c:\fffrxfr.exec:\fffrxfr.exe55⤵
- Executes dropped EXE
PID:2572 -
\??\c:\5fxllrf.exec:\5fxllrf.exe56⤵
- Executes dropped EXE
PID:2356 -
\??\c:\9nbhtb.exec:\9nbhtb.exe57⤵
- Executes dropped EXE
PID:1148 -
\??\c:\9jdjp.exec:\9jdjp.exe58⤵
- Executes dropped EXE
PID:2248 -
\??\c:\dvpdj.exec:\dvpdj.exe59⤵
- Executes dropped EXE
PID:2608 -
\??\c:\dvjvj.exec:\dvjvj.exe60⤵
- Executes dropped EXE
PID:2692 -
\??\c:\1xxrxrf.exec:\1xxrxrf.exe61⤵
- Executes dropped EXE
PID:2316 -
\??\c:\bbbnbb.exec:\bbbnbb.exe62⤵
- Executes dropped EXE
PID:320 -
\??\c:\hthnbb.exec:\hthnbb.exe63⤵
- Executes dropped EXE
PID:540 -
\??\c:\dvvpv.exec:\dvvpv.exe64⤵
- Executes dropped EXE
PID:1100 -
\??\c:\7vdjd.exec:\7vdjd.exe65⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xrxfllr.exec:\xrxfllr.exe66⤵PID:1080
-
\??\c:\3bbhhn.exec:\3bbhhn.exe67⤵PID:1096
-
\??\c:\nhtbhb.exec:\nhtbhb.exe68⤵PID:376
-
\??\c:\dvjvd.exec:\dvjvd.exe69⤵PID:2340
-
\??\c:\xxxxlrf.exec:\xxxxlrf.exe70⤵PID:2352
-
\??\c:\xrfflfr.exec:\xrfflfr.exe71⤵PID:2412
-
\??\c:\7tbttn.exec:\7tbttn.exe72⤵PID:984
-
\??\c:\tnbbhn.exec:\tnbbhn.exe73⤵PID:1624
-
\??\c:\dvpvv.exec:\dvpvv.exe74⤵PID:2944
-
\??\c:\3pvjj.exec:\3pvjj.exe75⤵PID:1260
-
\??\c:\rlxrrrf.exec:\rlxrrrf.exe76⤵PID:2884
-
\??\c:\tttbth.exec:\tttbth.exe77⤵PID:2472
-
\??\c:\bbntnt.exec:\bbntnt.exe78⤵PID:2620
-
\??\c:\ddvdp.exec:\ddvdp.exe79⤵PID:2292
-
\??\c:\7rflllx.exec:\7rflllx.exe80⤵PID:1292
-
\??\c:\lxllrxl.exec:\lxllrxl.exe81⤵PID:2732
-
\??\c:\tnbhtb.exec:\tnbhtb.exe82⤵PID:2892
-
\??\c:\jdvdv.exec:\jdvdv.exe83⤵PID:2668
-
\??\c:\jdpvd.exec:\jdpvd.exe84⤵PID:2624
-
\??\c:\lllfxrr.exec:\lllfxrr.exe85⤵PID:2532
-
\??\c:\nhbhtb.exec:\nhbhtb.exe86⤵PID:2556
-
\??\c:\bbnntt.exec:\bbnntt.exe87⤵PID:2440
-
\??\c:\9ppvp.exec:\9ppvp.exe88⤵PID:1748
-
\??\c:\3pjjj.exec:\3pjjj.exe89⤵PID:1884
-
\??\c:\rrrfflr.exec:\rrrfflr.exe90⤵PID:2600
-
\??\c:\ffrrffl.exec:\ffrrffl.exe91⤵PID:2688
-
\??\c:\hbntbb.exec:\hbntbb.exe92⤵PID:764
-
\??\c:\5httbb.exec:\5httbb.exe93⤵PID:2200
-
\??\c:\dvjdj.exec:\dvjdj.exe94⤵PID:1820
-
\??\c:\rlrxxfr.exec:\rlrxxfr.exe95⤵PID:1924
-
\??\c:\9lffffl.exec:\9lffffl.exe96⤵PID:2488
-
\??\c:\nhtntt.exec:\nhtntt.exe97⤵PID:1584
-
\??\c:\nhbhtb.exec:\nhbhtb.exe98⤵PID:1668
-
\??\c:\7ddpd.exec:\7ddpd.exe99⤵PID:2056
-
\??\c:\ddjdp.exec:\ddjdp.exe100⤵PID:1552
-
\??\c:\rlrlrrf.exec:\rlrlrrf.exe101⤵PID:1904
-
\??\c:\nhtbhn.exec:\nhtbhn.exe102⤵PID:2128
-
\??\c:\tttbnt.exec:\tttbnt.exe103⤵PID:2920
-
\??\c:\pjdjp.exec:\pjdjp.exe104⤵PID:772
-
\??\c:\fxllrfx.exec:\fxllrfx.exe105⤵PID:484
-
\??\c:\7ffrrlx.exec:\7ffrrlx.exe106⤵PID:596
-
\??\c:\9hhhnn.exec:\9hhhnn.exe107⤵PID:2240
-
\??\c:\vjvvv.exec:\vjvvv.exe108⤵PID:340
-
\??\c:\jjdvv.exec:\jjdvv.exe109⤵PID:640
-
\??\c:\rlxxffl.exec:\rlxxffl.exe110⤵PID:1344
-
\??\c:\llfffrr.exec:\llfffrr.exe111⤵PID:1644
-
\??\c:\hbttbt.exec:\hbttbt.exe112⤵PID:1792
-
\??\c:\ttnttt.exec:\ttnttt.exe113⤵PID:556
-
\??\c:\7vvvj.exec:\7vvvj.exe114⤵PID:2876
-
\??\c:\lllfxxl.exec:\lllfxxl.exe115⤵PID:1244
-
\??\c:\1fxfffl.exec:\1fxfffl.exe116⤵PID:2168
-
\??\c:\3bnnnn.exec:\3bnnnn.exe117⤵PID:3060
-
\??\c:\pppdp.exec:\pppdp.exe118⤵PID:1828
-
\??\c:\1jvpp.exec:\1jvpp.exe119⤵PID:1088
-
\??\c:\xrfrrrr.exec:\xrfrrrr.exe120⤵PID:3048
-
\??\c:\fxffflr.exec:\fxffflr.exe121⤵PID:2656
-
\??\c:\hbnttb.exec:\hbnttb.exe122⤵PID:2752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-