Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
26s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 06:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
faa6d7023c135572ba5bac85c8ee129e77b426baa651f4aeae6eea41a9b8514a.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
faa6d7023c135572ba5bac85c8ee129e77b426baa651f4aeae6eea41a9b8514a.exe
-
Size
89KB
-
MD5
15e900e05a567435cb68c2f24fa004f6
-
SHA1
38d141f353f54d3f4d43b118e835540b8907db19
-
SHA256
faa6d7023c135572ba5bac85c8ee129e77b426baa651f4aeae6eea41a9b8514a
-
SHA512
001d3435efe3461b3054cdbde46e040afb14c73ee33cdd58ac416d71e397831c45eb5295ac54c7be02c40fdb5d157c5c2e6a9c12a5595f93db0681c4b5808dad
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2iJvRirE0DmmdL2jqWkBk:ymb3NkkiQ3mdBjF+3TU2iBRioSumWS1S
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/1740-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1248-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1380-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1600-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1548-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1232-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/796-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1056-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2864 pvjpj.exe 1248 hhhthh.exe 2596 7xxlrfr.exe 2524 vvpvd.exe 2664 hnhnht.exe 2640 9xfxlff.exe 2440 jddvv.exe 2000 5bnhbn.exe 1380 vjvpv.exe 2584 flllxrx.exe 1600 jdjjj.exe 2096 pddpd.exe 2116 lflrlfl.exe 1548 xrxlffx.exe 1232 vddvd.exe 1692 nthntb.exe 3052 djvdv.exe 1680 thbttn.exe 796 5flrrfl.exe 768 pdvdj.exe 1056 rrflflx.exe 2788 dvpdd.exe 2336 fxxfxff.exe 2860 jdppd.exe 3060 bttthn.exe 1604 bhhnbn.exe 1656 djjdj.exe 752 tbbbtb.exe 2944 ddjvv.exe 2300 rrxxfrf.exe 2132 ddjjv.exe 1432 fxxfrfl.exe 2016 djvjj.exe 1908 frflrxf.exe 2216 hntbht.exe 2560 vvvpp.exe 2556 bbhbbn.exe 2704 vjvvp.exe 2632 rxfrfxl.exe 2488 9djdj.exe 2688 hhnhtn.exe 2528 fxfxxlr.exe 2416 jvvvv.exe 2832 xxrlrxx.exe 1552 vvjvv.exe 2812 tnbhnn.exe 2624 jjjjp.exe 1380 nthbht.exe 2680 xrxfffl.exe 284 hnbtht.exe 1828 rrffrxl.exe 2292 bttbhn.exe 1184 xrlxlrx.exe 1240 nthntn.exe 2008 1flrrff.exe 2176 xrxlflr.exe 1180 pjppp.exe 1624 ffxfxxx.exe 2740 hthtbh.exe 488 tntthn.exe 1404 dvdjp.exe 2792 hthhhh.exe 1080 ddvvp.exe 960 pdvvp.exe -
resource yara_rule behavioral1/memory/1740-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1248-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1380-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1600-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/796-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2864 1740 faa6d7023c135572ba5bac85c8ee129e77b426baa651f4aeae6eea41a9b8514a.exe 28 PID 1740 wrote to memory of 2864 1740 faa6d7023c135572ba5bac85c8ee129e77b426baa651f4aeae6eea41a9b8514a.exe 28 PID 1740 wrote to memory of 2864 1740 faa6d7023c135572ba5bac85c8ee129e77b426baa651f4aeae6eea41a9b8514a.exe 28 PID 1740 wrote to memory of 2864 1740 faa6d7023c135572ba5bac85c8ee129e77b426baa651f4aeae6eea41a9b8514a.exe 28 PID 2864 wrote to memory of 1248 2864 pvjpj.exe 29 PID 2864 wrote to memory of 1248 2864 pvjpj.exe 29 PID 2864 wrote to memory of 1248 2864 pvjpj.exe 29 PID 2864 wrote to memory of 1248 2864 pvjpj.exe 29 PID 1248 wrote to memory of 2596 1248 hhhthh.exe 30 PID 1248 wrote to memory of 2596 1248 hhhthh.exe 30 PID 1248 wrote to memory of 2596 1248 hhhthh.exe 30 PID 1248 wrote to memory of 2596 1248 hhhthh.exe 30 PID 2596 wrote to memory of 2524 2596 7xxlrfr.exe 31 PID 2596 wrote to memory of 2524 2596 7xxlrfr.exe 31 PID 2596 wrote to memory of 2524 2596 7xxlrfr.exe 31 PID 2596 wrote to memory of 2524 2596 7xxlrfr.exe 31 PID 2524 wrote to memory of 2664 2524 vvpvd.exe 32 PID 2524 wrote to memory of 2664 2524 vvpvd.exe 32 PID 2524 wrote to memory of 2664 2524 vvpvd.exe 32 PID 2524 wrote to memory of 2664 2524 vvpvd.exe 32 PID 2664 wrote to memory of 2640 2664 hnhnht.exe 33 PID 2664 wrote to memory of 2640 2664 hnhnht.exe 33 PID 2664 wrote to memory of 2640 2664 hnhnht.exe 33 PID 2664 wrote to memory of 2640 2664 hnhnht.exe 33 PID 2640 wrote to memory of 2440 2640 9xfxlff.exe 34 PID 2640 wrote to memory of 2440 2640 9xfxlff.exe 34 PID 2640 wrote to memory of 2440 2640 9xfxlff.exe 34 PID 2640 wrote to memory of 2440 2640 9xfxlff.exe 34 PID 2440 wrote to memory of 2000 2440 jddvv.exe 116 PID 2440 wrote to memory of 2000 2440 jddvv.exe 116 PID 2440 wrote to memory of 2000 2440 jddvv.exe 116 PID 2440 wrote to memory of 2000 2440 jddvv.exe 116 PID 2000 wrote to memory of 1380 2000 5bnhbn.exe 75 PID 2000 wrote to memory of 1380 2000 5bnhbn.exe 75 PID 2000 wrote to memory of 1380 2000 5bnhbn.exe 75 PID 2000 wrote to memory of 1380 2000 5bnhbn.exe 75 PID 1380 wrote to memory of 2584 1380 vjvpv.exe 37 PID 1380 wrote to memory of 2584 1380 vjvpv.exe 37 PID 1380 wrote to memory of 2584 1380 vjvpv.exe 37 PID 1380 wrote to memory of 2584 1380 vjvpv.exe 37 PID 2584 wrote to memory of 1600 2584 flllxrx.exe 38 PID 2584 wrote to memory of 1600 2584 flllxrx.exe 38 PID 2584 wrote to memory of 1600 2584 flllxrx.exe 38 PID 2584 wrote to memory of 1600 2584 flllxrx.exe 38 PID 1600 wrote to memory of 2096 1600 jdjjj.exe 39 PID 1600 wrote to memory of 2096 1600 jdjjj.exe 39 PID 1600 wrote to memory of 2096 1600 jdjjj.exe 39 PID 1600 wrote to memory of 2096 1600 jdjjj.exe 39 PID 2096 wrote to memory of 2116 2096 pddpd.exe 40 PID 2096 wrote to memory of 2116 2096 pddpd.exe 40 PID 2096 wrote to memory of 2116 2096 pddpd.exe 40 PID 2096 wrote to memory of 2116 2096 pddpd.exe 40 PID 2116 wrote to memory of 1548 2116 lflrlfl.exe 41 PID 2116 wrote to memory of 1548 2116 lflrlfl.exe 41 PID 2116 wrote to memory of 1548 2116 lflrlfl.exe 41 PID 2116 wrote to memory of 1548 2116 lflrlfl.exe 41 PID 1548 wrote to memory of 1232 1548 xrxlffx.exe 42 PID 1548 wrote to memory of 1232 1548 xrxlffx.exe 42 PID 1548 wrote to memory of 1232 1548 xrxlffx.exe 42 PID 1548 wrote to memory of 1232 1548 xrxlffx.exe 42 PID 1232 wrote to memory of 1692 1232 vddvd.exe 43 PID 1232 wrote to memory of 1692 1232 vddvd.exe 43 PID 1232 wrote to memory of 1692 1232 vddvd.exe 43 PID 1232 wrote to memory of 1692 1232 vddvd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\faa6d7023c135572ba5bac85c8ee129e77b426baa651f4aeae6eea41a9b8514a.exe"C:\Users\Admin\AppData\Local\Temp\faa6d7023c135572ba5bac85c8ee129e77b426baa651f4aeae6eea41a9b8514a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\pvjpj.exec:\pvjpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\hhhthh.exec:\hhhthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\7xxlrfr.exec:\7xxlrfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\vvpvd.exec:\vvpvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\hnhnht.exec:\hnhnht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\9xfxlff.exec:\9xfxlff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\jddvv.exec:\jddvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\5bnhbn.exec:\5bnhbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\vjvpv.exec:\vjvpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\flllxrx.exec:\flllxrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\jdjjj.exec:\jdjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\pddpd.exec:\pddpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\lflrlfl.exec:\lflrlfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\xrxlffx.exec:\xrxlffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\vddvd.exec:\vddvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\nthntb.exec:\nthntb.exe17⤵
- Executes dropped EXE
PID:1692 -
\??\c:\djvdv.exec:\djvdv.exe18⤵
- Executes dropped EXE
PID:3052 -
\??\c:\thbttn.exec:\thbttn.exe19⤵
- Executes dropped EXE
PID:1680 -
\??\c:\5flrrfl.exec:\5flrrfl.exe20⤵
- Executes dropped EXE
PID:796 -
\??\c:\pdvdj.exec:\pdvdj.exe21⤵
- Executes dropped EXE
PID:768 -
\??\c:\rrflflx.exec:\rrflflx.exe22⤵
- Executes dropped EXE
PID:1056 -
\??\c:\dvpdd.exec:\dvpdd.exe23⤵
- Executes dropped EXE
PID:2788 -
\??\c:\fxxfxff.exec:\fxxfxff.exe24⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jdppd.exec:\jdppd.exe25⤵
- Executes dropped EXE
PID:2860 -
\??\c:\bttthn.exec:\bttthn.exe26⤵
- Executes dropped EXE
PID:3060 -
\??\c:\bhhnbn.exec:\bhhnbn.exe27⤵
- Executes dropped EXE
PID:1604 -
\??\c:\djjdj.exec:\djjdj.exe28⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tbbbtb.exec:\tbbbtb.exe29⤵
- Executes dropped EXE
PID:752 -
\??\c:\ddjvv.exec:\ddjvv.exe30⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rrxxfrf.exec:\rrxxfrf.exe31⤵
- Executes dropped EXE
PID:2300 -
\??\c:\ddjjv.exec:\ddjjv.exe32⤵
- Executes dropped EXE
PID:2132 -
\??\c:\fxxfrfl.exec:\fxxfrfl.exe33⤵
- Executes dropped EXE
PID:1432 -
\??\c:\djvjj.exec:\djvjj.exe34⤵
- Executes dropped EXE
PID:2016 -
\??\c:\frflrxf.exec:\frflrxf.exe35⤵
- Executes dropped EXE
PID:1908 -
\??\c:\hntbht.exec:\hntbht.exe36⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vvvpp.exec:\vvvpp.exe37⤵
- Executes dropped EXE
PID:2560 -
\??\c:\bbhbbn.exec:\bbhbbn.exe38⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vjvvp.exec:\vjvvp.exe39⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rxfrfxl.exec:\rxfrfxl.exe40⤵
- Executes dropped EXE
PID:2632 -
\??\c:\9djdj.exec:\9djdj.exe41⤵
- Executes dropped EXE
PID:2488 -
\??\c:\hhnhtn.exec:\hhnhtn.exe42⤵
- Executes dropped EXE
PID:2688 -
\??\c:\fxfxxlr.exec:\fxfxxlr.exe43⤵
- Executes dropped EXE
PID:2528 -
\??\c:\jvvvv.exec:\jvvvv.exe44⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xxrlrxx.exec:\xxrlrxx.exe45⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vvjvv.exec:\vvjvv.exe46⤵
- Executes dropped EXE
PID:1552 -
\??\c:\tnbhnn.exec:\tnbhnn.exe47⤵
- Executes dropped EXE
PID:2812 -
\??\c:\jjjjp.exec:\jjjjp.exe48⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nthbht.exec:\nthbht.exe49⤵
- Executes dropped EXE
PID:1380 -
\??\c:\xrxfffl.exec:\xrxfffl.exe50⤵
- Executes dropped EXE
PID:2680 -
\??\c:\hnbtht.exec:\hnbtht.exe51⤵
- Executes dropped EXE
PID:284 -
\??\c:\rrffrxl.exec:\rrffrxl.exe52⤵
- Executes dropped EXE
PID:1828 -
\??\c:\bttbhn.exec:\bttbhn.exe53⤵
- Executes dropped EXE
PID:2292 -
\??\c:\xrlxlrx.exec:\xrlxlrx.exe54⤵
- Executes dropped EXE
PID:1184 -
\??\c:\nthntn.exec:\nthntn.exe55⤵
- Executes dropped EXE
PID:1240 -
\??\c:\1flrrff.exec:\1flrrff.exe56⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xrxlflr.exec:\xrxlflr.exe57⤵
- Executes dropped EXE
PID:2176 -
\??\c:\pjppp.exec:\pjppp.exe58⤵
- Executes dropped EXE
PID:1180 -
\??\c:\ffxfxxx.exec:\ffxfxxx.exe59⤵
- Executes dropped EXE
PID:1624 -
\??\c:\hthtbh.exec:\hthtbh.exe60⤵
- Executes dropped EXE
PID:2740 -
\??\c:\tntthn.exec:\tntthn.exe61⤵
- Executes dropped EXE
PID:488 -
\??\c:\dvdjp.exec:\dvdjp.exe62⤵
- Executes dropped EXE
PID:1404 -
\??\c:\hthhhh.exec:\hthhhh.exe63⤵
- Executes dropped EXE
PID:2792 -
\??\c:\ddvvp.exec:\ddvvp.exe64⤵
- Executes dropped EXE
PID:1080 -
\??\c:\pdvvp.exec:\pdvvp.exe65⤵
- Executes dropped EXE
PID:960 -
\??\c:\rxfxrff.exec:\rxfxrff.exe66⤵PID:1104
-
\??\c:\nhbtnh.exec:\nhbtnh.exe67⤵PID:2996
-
\??\c:\jpppd.exec:\jpppd.exe68⤵PID:956
-
\??\c:\3ddvp.exec:\3ddvp.exe69⤵PID:3060
-
\??\c:\bnnnnb.exec:\bnnnnb.exe70⤵PID:1604
-
\??\c:\xfxxxlf.exec:\xfxxxlf.exe71⤵PID:1212
-
\??\c:\5xxxllr.exec:\5xxxllr.exe72⤵PID:2136
-
\??\c:\jpdvp.exec:\jpdvp.exe73⤵PID:2156
-
\??\c:\3frllfr.exec:\3frllfr.exe74⤵PID:2200
-
\??\c:\vvdpd.exec:\vvdpd.exe75⤵PID:2300
-
\??\c:\lxxlrxl.exec:\lxxlrxl.exe76⤵PID:996
-
\??\c:\bhbntn.exec:\bhbntn.exe77⤵PID:1956
-
\??\c:\llfxffr.exec:\llfxffr.exe78⤵PID:2896
-
\??\c:\xlxlrrx.exec:\xlxlrrx.exe79⤵PID:2648
-
\??\c:\bbthhb.exec:\bbthhb.exe80⤵PID:2216
-
\??\c:\jjvdd.exec:\jjvdd.exe81⤵PID:2600
-
\??\c:\bbbbbn.exec:\bbbbbn.exe82⤵PID:2556
-
\??\c:\vddvv.exec:\vddvv.exe83⤵PID:2480
-
\??\c:\ttnbtt.exec:\ttnbtt.exe84⤵PID:2512
-
\??\c:\pddpd.exec:\pddpd.exe85⤵PID:2464
-
\??\c:\dpjdp.exec:\dpjdp.exe86⤵PID:2376
-
\??\c:\bbthtn.exec:\bbthtn.exe87⤵PID:2360
-
\??\c:\dpjjj.exec:\dpjjj.exe88⤵PID:2408
-
\??\c:\xrfflxl.exec:\xrfflxl.exe89⤵PID:1572
-
\??\c:\vpvpv.exec:\vpvpv.exe90⤵PID:2000
-
\??\c:\fllxxrx.exec:\fllxxrx.exe91⤵PID:2588
-
\??\c:\nnbhtn.exec:\nnbhtn.exe92⤵PID:2668
-
\??\c:\vpddv.exec:\vpddv.exe93⤵PID:1800
-
\??\c:\9hbhhh.exec:\9hbhhh.exe94⤵PID:1556
-
\??\c:\jvdjp.exec:\jvdjp.exe95⤵PID:1456
-
\??\c:\llrfllf.exec:\llrfllf.exe96⤵PID:2284
-
\??\c:\1bnbbt.exec:\1bnbbt.exe97⤵PID:1228
-
\??\c:\9jvpj.exec:\9jvpj.exe98⤵PID:832
-
\??\c:\nhthbn.exec:\nhthbn.exe99⤵PID:1136
-
\??\c:\vvpvp.exec:\vvpvp.exe100⤵PID:1252
-
\??\c:\xflxxff.exec:\xflxxff.exe101⤵PID:2044
-
\??\c:\dpvpd.exec:\dpvpd.exe102⤵PID:2452
-
\??\c:\3hhtbh.exec:\3hhtbh.exe103⤵PID:2732
-
\??\c:\flfrffl.exec:\flfrffl.exe104⤵PID:808
-
\??\c:\xlxfffr.exec:\xlxfffr.exe105⤵PID:812
-
\??\c:\htntnh.exec:\htntnh.exe106⤵PID:2160
-
\??\c:\pvjpp.exec:\pvjpp.exe107⤵PID:1744
-
\??\c:\thbbtn.exec:\thbbtn.exe108⤵PID:2332
-
\??\c:\lxrflfr.exec:\lxrflfr.exe109⤵PID:2912
-
\??\c:\jjjjj.exec:\jjjjj.exe110⤵PID:1664
-
\??\c:\rffrlxx.exec:\rffrlxx.exe111⤵PID:2860
-
\??\c:\tnhnht.exec:\tnhnht.exe112⤵PID:1836
-
\??\c:\ddjdd.exec:\ddjdd.exe113⤵PID:2196
-
\??\c:\xlrxlll.exec:\xlrxlll.exe114⤵PID:904
-
\??\c:\ppdpj.exec:\ppdpj.exe115⤵PID:1604
-
\??\c:\3xlrxff.exec:\3xlrxff.exe116⤵PID:556
-
\??\c:\nbntbh.exec:\nbntbh.exe117⤵PID:1736
-
\??\c:\lrxxrlr.exec:\lrxxrlr.exe118⤵PID:576
-
\??\c:\thtthn.exec:\thtthn.exe119⤵PID:1440
-
\??\c:\vpdjj.exec:\vpdjj.exe120⤵PID:1964
-
\??\c:\nthbnt.exec:\nthbnt.exe121⤵PID:1740
-
\??\c:\rffxlrf.exec:\rffxlrf.exe122⤵PID:2168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-