Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 07:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f685f662584f6fac10287c9f3b09c682878f3de6c1a6daa0c9fa1f175ff1ad9c.exe
Resource
win7-20240705-en
5 signatures
150 seconds
General
-
Target
f685f662584f6fac10287c9f3b09c682878f3de6c1a6daa0c9fa1f175ff1ad9c.exe
-
Size
402KB
-
MD5
c1a1293a263eb2f969c195df613a3d19
-
SHA1
0528035e8ae10f6e30716f27d27659a27e1ff4f0
-
SHA256
f685f662584f6fac10287c9f3b09c682878f3de6c1a6daa0c9fa1f175ff1ad9c
-
SHA512
35d9e5c4cc02734c62bea0f44608a571ae367336c8dc58e5f4b7b85a3bc28235d4cf88cd21bd840663fd8ac1bab52aceb2da8ae7c4193ede9733af4e0be99425
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmX5kr+uIBpkJITEEuR9XTVyXmmBv:n3C9BRIG0asYFm71mJkr+uIBe1T8X9
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2808-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/304-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2792 3dpdv.exe 2916 pdddp.exe 2864 djjdp.exe 2608 lxrrxrx.exe 2636 thnhnh.exe 3016 jvjdp.exe 1852 lffrfxl.exe 2976 nntnbn.exe 2164 7ppdd.exe 2768 ttthbh.exe 1920 vpjpj.exe 2012 bhbhnh.exe 1696 vjjvp.exe 2740 1llrrxf.exe 304 1vvvd.exe 1752 1xfrflf.exe 2948 bhhttt.exe 2232 vppvp.exe 2236 jjjvd.exe 2480 hnnbtb.exe 1092 9jjpp.exe 2516 5tnbht.exe 1536 pjvpj.exe 1720 nnthht.exe 1084 9pdjd.exe 1948 llffrxx.exe 1940 nbnnhh.exe 296 pppjp.exe 2296 bhhbth.exe 2076 rrlrfrl.exe 2812 nbttth.exe 1592 rfrlrrr.exe 2420 dpvpj.exe 2676 fllffff.exe 2588 nnbhnn.exe 2672 dpdvv.exe 2696 1rffflr.exe 3012 nhbbnt.exe 1104 nbhhnt.exe 2648 vjddd.exe 1468 9lffrfx.exe 3024 fxlrxfr.exe 2176 bbttbb.exe 2900 dddpd.exe 2268 9lrffff.exe 1920 xxxlrxx.exe 804 tnhtbn.exe 1640 9pjjp.exe 2364 lfxxxxf.exe 1916 flrlfrl.exe 1072 5btbht.exe 1420 vdvjv.exe 2948 vdvpj.exe 1076 xlrxfxl.exe 1724 7nthnt.exe 1872 thhbnh.exe 1156 3jjvd.exe 1052 rrxfxfr.exe 1864 tthbbt.exe 1716 hnhnbh.exe 1972 vvpdj.exe 3068 xxxfrfl.exe 2484 llrfrxx.exe 1700 3tnbnh.exe -
resource yara_rule behavioral1/memory/2808-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/304-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1092-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-130-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2808 wrote to memory of 2792 2808 f685f662584f6fac10287c9f3b09c682878f3de6c1a6daa0c9fa1f175ff1ad9c.exe 31 PID 2808 wrote to memory of 2792 2808 f685f662584f6fac10287c9f3b09c682878f3de6c1a6daa0c9fa1f175ff1ad9c.exe 31 PID 2808 wrote to memory of 2792 2808 f685f662584f6fac10287c9f3b09c682878f3de6c1a6daa0c9fa1f175ff1ad9c.exe 31 PID 2808 wrote to memory of 2792 2808 f685f662584f6fac10287c9f3b09c682878f3de6c1a6daa0c9fa1f175ff1ad9c.exe 31 PID 2792 wrote to memory of 2916 2792 3dpdv.exe 32 PID 2792 wrote to memory of 2916 2792 3dpdv.exe 32 PID 2792 wrote to memory of 2916 2792 3dpdv.exe 32 PID 2792 wrote to memory of 2916 2792 3dpdv.exe 32 PID 2916 wrote to memory of 2864 2916 pdddp.exe 33 PID 2916 wrote to memory of 2864 2916 pdddp.exe 33 PID 2916 wrote to memory of 2864 2916 pdddp.exe 33 PID 2916 wrote to memory of 2864 2916 pdddp.exe 33 PID 2864 wrote to memory of 2608 2864 djjdp.exe 34 PID 2864 wrote to memory of 2608 2864 djjdp.exe 34 PID 2864 wrote to memory of 2608 2864 djjdp.exe 34 PID 2864 wrote to memory of 2608 2864 djjdp.exe 34 PID 2608 wrote to memory of 2636 2608 lxrrxrx.exe 35 PID 2608 wrote to memory of 2636 2608 lxrrxrx.exe 35 PID 2608 wrote to memory of 2636 2608 lxrrxrx.exe 35 PID 2608 wrote to memory of 2636 2608 lxrrxrx.exe 35 PID 2636 wrote to memory of 3016 2636 thnhnh.exe 36 PID 2636 wrote to memory of 3016 2636 thnhnh.exe 36 PID 2636 wrote to memory of 3016 2636 thnhnh.exe 36 PID 2636 wrote to memory of 3016 2636 thnhnh.exe 36 PID 3016 wrote to memory of 1852 3016 jvjdp.exe 37 PID 3016 wrote to memory of 1852 3016 jvjdp.exe 37 PID 3016 wrote to memory of 1852 3016 jvjdp.exe 37 PID 3016 wrote to memory of 1852 3016 jvjdp.exe 37 PID 1852 wrote to memory of 2976 1852 lffrfxl.exe 38 PID 1852 wrote to memory of 2976 1852 lffrfxl.exe 38 PID 1852 wrote to memory of 2976 1852 lffrfxl.exe 38 PID 1852 wrote to memory of 2976 1852 lffrfxl.exe 38 PID 2976 wrote to memory of 2164 2976 nntnbn.exe 39 PID 2976 wrote to memory of 2164 2976 nntnbn.exe 39 PID 2976 wrote to memory of 2164 2976 nntnbn.exe 39 PID 2976 wrote to memory of 2164 2976 nntnbn.exe 39 PID 2164 wrote to memory of 2768 2164 7ppdd.exe 40 PID 2164 wrote to memory of 2768 2164 7ppdd.exe 40 PID 2164 wrote to memory of 2768 2164 7ppdd.exe 40 PID 2164 wrote to memory of 2768 2164 7ppdd.exe 40 PID 2768 wrote to memory of 1920 2768 ttthbh.exe 41 PID 2768 wrote to memory of 1920 2768 ttthbh.exe 41 PID 2768 wrote to memory of 1920 2768 ttthbh.exe 41 PID 2768 wrote to memory of 1920 2768 ttthbh.exe 41 PID 1920 wrote to memory of 2012 1920 vpjpj.exe 42 PID 1920 wrote to memory of 2012 1920 vpjpj.exe 42 PID 1920 wrote to memory of 2012 1920 vpjpj.exe 42 PID 1920 wrote to memory of 2012 1920 vpjpj.exe 42 PID 2012 wrote to memory of 1696 2012 bhbhnh.exe 118 PID 2012 wrote to memory of 1696 2012 bhbhnh.exe 118 PID 2012 wrote to memory of 1696 2012 bhbhnh.exe 118 PID 2012 wrote to memory of 1696 2012 bhbhnh.exe 118 PID 1696 wrote to memory of 2740 1696 vjjvp.exe 44 PID 1696 wrote to memory of 2740 1696 vjjvp.exe 44 PID 1696 wrote to memory of 2740 1696 vjjvp.exe 44 PID 1696 wrote to memory of 2740 1696 vjjvp.exe 44 PID 2740 wrote to memory of 304 2740 1llrrxf.exe 120 PID 2740 wrote to memory of 304 2740 1llrrxf.exe 120 PID 2740 wrote to memory of 304 2740 1llrrxf.exe 120 PID 2740 wrote to memory of 304 2740 1llrrxf.exe 120 PID 304 wrote to memory of 1752 304 1vvvd.exe 46 PID 304 wrote to memory of 1752 304 1vvvd.exe 46 PID 304 wrote to memory of 1752 304 1vvvd.exe 46 PID 304 wrote to memory of 1752 304 1vvvd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\f685f662584f6fac10287c9f3b09c682878f3de6c1a6daa0c9fa1f175ff1ad9c.exe"C:\Users\Admin\AppData\Local\Temp\f685f662584f6fac10287c9f3b09c682878f3de6c1a6daa0c9fa1f175ff1ad9c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\3dpdv.exec:\3dpdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\pdddp.exec:\pdddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\djjdp.exec:\djjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\lxrrxrx.exec:\lxrrxrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\thnhnh.exec:\thnhnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\jvjdp.exec:\jvjdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\lffrfxl.exec:\lffrfxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\nntnbn.exec:\nntnbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\7ppdd.exec:\7ppdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\ttthbh.exec:\ttthbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\vpjpj.exec:\vpjpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\bhbhnh.exec:\bhbhnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\vjjvp.exec:\vjjvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\1llrrxf.exec:\1llrrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\1vvvd.exec:\1vvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:304 -
\??\c:\1xfrflf.exec:\1xfrflf.exe17⤵
- Executes dropped EXE
PID:1752 -
\??\c:\bhhttt.exec:\bhhttt.exe18⤵
- Executes dropped EXE
PID:2948 -
\??\c:\vppvp.exec:\vppvp.exe19⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jjjvd.exec:\jjjvd.exe20⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hnnbtb.exec:\hnnbtb.exe21⤵
- Executes dropped EXE
PID:2480 -
\??\c:\9jjpp.exec:\9jjpp.exe22⤵
- Executes dropped EXE
PID:1092 -
\??\c:\5tnbht.exec:\5tnbht.exe23⤵
- Executes dropped EXE
PID:2516 -
\??\c:\pjvpj.exec:\pjvpj.exe24⤵
- Executes dropped EXE
PID:1536 -
\??\c:\nnthht.exec:\nnthht.exe25⤵
- Executes dropped EXE
PID:1720 -
\??\c:\9pdjd.exec:\9pdjd.exe26⤵
- Executes dropped EXE
PID:1084 -
\??\c:\llffrxx.exec:\llffrxx.exe27⤵
- Executes dropped EXE
PID:1948 -
\??\c:\nbnnhh.exec:\nbnnhh.exe28⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pppjp.exec:\pppjp.exe29⤵
- Executes dropped EXE
PID:296 -
\??\c:\bhhbth.exec:\bhhbth.exe30⤵
- Executes dropped EXE
PID:2296 -
\??\c:\rrlrfrl.exec:\rrlrfrl.exe31⤵
- Executes dropped EXE
PID:2076 -
\??\c:\nbttth.exec:\nbttth.exe32⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rfrlrrr.exec:\rfrlrrr.exe33⤵
- Executes dropped EXE
PID:1592 -
\??\c:\dpvpj.exec:\dpvpj.exe34⤵
- Executes dropped EXE
PID:2420 -
\??\c:\fllffff.exec:\fllffff.exe35⤵
- Executes dropped EXE
PID:2676 -
\??\c:\nnbhnn.exec:\nnbhnn.exe36⤵
- Executes dropped EXE
PID:2588 -
\??\c:\dpdvv.exec:\dpdvv.exe37⤵
- Executes dropped EXE
PID:2672 -
\??\c:\1rffflr.exec:\1rffflr.exe38⤵
- Executes dropped EXE
PID:2696 -
\??\c:\nhbbnt.exec:\nhbbnt.exe39⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nbhhnt.exec:\nbhhnt.exe40⤵
- Executes dropped EXE
PID:1104 -
\??\c:\vjddd.exec:\vjddd.exe41⤵
- Executes dropped EXE
PID:2648 -
\??\c:\9lffrfx.exec:\9lffrfx.exe42⤵
- Executes dropped EXE
PID:1468 -
\??\c:\fxlrxfr.exec:\fxlrxfr.exe43⤵
- Executes dropped EXE
PID:3024 -
\??\c:\bbttbb.exec:\bbttbb.exe44⤵
- Executes dropped EXE
PID:2176 -
\??\c:\dddpd.exec:\dddpd.exe45⤵
- Executes dropped EXE
PID:2900 -
\??\c:\9lrffff.exec:\9lrffff.exe46⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xxxlrxx.exec:\xxxlrxx.exe47⤵
- Executes dropped EXE
PID:1920 -
\??\c:\tnhtbn.exec:\tnhtbn.exe48⤵
- Executes dropped EXE
PID:804 -
\??\c:\9pjjp.exec:\9pjjp.exe49⤵
- Executes dropped EXE
PID:1640 -
\??\c:\lfxxxxf.exec:\lfxxxxf.exe50⤵
- Executes dropped EXE
PID:2364 -
\??\c:\flrlfrl.exec:\flrlfrl.exe51⤵
- Executes dropped EXE
PID:1916 -
\??\c:\5btbht.exec:\5btbht.exe52⤵
- Executes dropped EXE
PID:1072 -
\??\c:\vdvjv.exec:\vdvjv.exe53⤵
- Executes dropped EXE
PID:1420 -
\??\c:\vdvpj.exec:\vdvpj.exe54⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xlrxfxl.exec:\xlrxfxl.exe55⤵
- Executes dropped EXE
PID:1076 -
\??\c:\7nthnt.exec:\7nthnt.exe56⤵
- Executes dropped EXE
PID:1724 -
\??\c:\thhbnh.exec:\thhbnh.exe57⤵
- Executes dropped EXE
PID:1872 -
\??\c:\3jjvd.exec:\3jjvd.exe58⤵
- Executes dropped EXE
PID:1156 -
\??\c:\rrxfxfr.exec:\rrxfxfr.exe59⤵
- Executes dropped EXE
PID:1052 -
\??\c:\tthbbt.exec:\tthbbt.exe60⤵
- Executes dropped EXE
PID:1864 -
\??\c:\hnhnbh.exec:\hnhnbh.exe61⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vvpdj.exec:\vvpdj.exe62⤵
- Executes dropped EXE
PID:1972 -
\??\c:\xxxfrfl.exec:\xxxfrfl.exe63⤵
- Executes dropped EXE
PID:3068 -
\??\c:\llrfrxx.exec:\llrfrxx.exe64⤵
- Executes dropped EXE
PID:2484 -
\??\c:\3tnbnh.exec:\3tnbnh.exe65⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vpjpd.exec:\vpjpd.exe66⤵PID:2956
-
\??\c:\xxfrxlf.exec:\xxfrxlf.exe67⤵PID:2964
-
\??\c:\ntbbth.exec:\ntbbth.exe68⤵PID:268
-
\??\c:\hnbhnt.exec:\hnbhnt.exe69⤵PID:2348
-
\??\c:\vdjvv.exec:\vdjvv.exe70⤵PID:2716
-
\??\c:\rrllrxl.exec:\rrllrxl.exe71⤵PID:1708
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe72⤵PID:2796
-
\??\c:\hthhhh.exec:\hthhhh.exe73⤵PID:2880
-
\??\c:\djjvp.exec:\djjvp.exe74⤵PID:2920
-
\??\c:\vvpvd.exec:\vvpvd.exe75⤵PID:1476
-
\??\c:\lxxlllf.exec:\lxxlllf.exe76⤵PID:2632
-
\??\c:\bthhhn.exec:\bthhhn.exe77⤵PID:3004
-
\??\c:\pdppv.exec:\pdppv.exe78⤵PID:2732
-
\??\c:\vjpdj.exec:\vjpdj.exe79⤵PID:2184
-
\??\c:\llfflrl.exec:\llfflrl.exe80⤵PID:2084
-
\??\c:\nbbnth.exec:\nbbnth.exe81⤵PID:1996
-
\??\c:\hbnbnb.exec:\hbnbnb.exe82⤵PID:2892
-
\??\c:\1ddvj.exec:\1ddvj.exe83⤵PID:344
-
\??\c:\fxxxrlf.exec:\fxxxrlf.exe84⤵PID:1960
-
\??\c:\5llrffr.exec:\5llrffr.exe85⤵PID:1336
-
\??\c:\htntth.exec:\htntth.exe86⤵PID:1936
-
\??\c:\vdvjd.exec:\vdvjd.exe87⤵PID:2628
-
\??\c:\ddjvv.exec:\ddjvv.exe88⤵PID:2868
-
\??\c:\1fxxfff.exec:\1fxxfff.exe89⤵PID:1696
-
\??\c:\bbbtnb.exec:\bbbtnb.exe90⤵PID:1552
-
\??\c:\btnhtt.exec:\btnhtt.exe91⤵PID:304
-
\??\c:\9vdpd.exec:\9vdpd.exe92⤵PID:1504
-
\??\c:\9xrrflf.exec:\9xrrflf.exe93⤵PID:2276
-
\??\c:\fxxflrf.exec:\fxxflrf.exe94⤵PID:1064
-
\??\c:\3bthbn.exec:\3bthbn.exe95⤵PID:1060
-
\??\c:\vpdpd.exec:\vpdpd.exe96⤵PID:1176
-
\??\c:\3jjdv.exec:\3jjdv.exe97⤵PID:632
-
\??\c:\rfxrllr.exec:\rfxrllr.exe98⤵PID:2044
-
\??\c:\pjjpd.exec:\pjjpd.exe99⤵PID:2516
-
\??\c:\lffrfrl.exec:\lffrfrl.exe100⤵PID:2152
-
\??\c:\pdpdd.exec:\pdpdd.exe101⤵PID:1736
-
\??\c:\rffffrx.exec:\rffffrx.exe102⤵PID:1720
-
\??\c:\pdjdj.exec:\pdjdj.exe103⤵PID:952
-
\??\c:\jdjpd.exec:\jdjpd.exe104⤵PID:2924
-
\??\c:\flfxxlr.exec:\flfxxlr.exe105⤵PID:2360
-
\??\c:\5bbnht.exec:\5bbnht.exe106⤵PID:992
-
\??\c:\jpvpv.exec:\jpvpv.exe107⤵PID:556
-
\??\c:\xffxxrr.exec:\xffxxrr.exe108⤵PID:764
-
\??\c:\hhthnn.exec:\hhthnn.exe109⤵PID:2824
-
\??\c:\lxfflfr.exec:\lxfflfr.exe110⤵PID:2952
-
\??\c:\tbbtbn.exec:\tbbtbn.exe111⤵PID:2720
-
\??\c:\pjjjd.exec:\pjjjd.exe112⤵PID:2596
-
\??\c:\jdddp.exec:\jdddp.exe113⤵PID:3048
-
\??\c:\rrlrfrf.exec:\rrlrfrf.exe114⤵PID:2832
-
\??\c:\3frflxr.exec:\3frflxr.exe115⤵PID:2860
-
\??\c:\htbntt.exec:\htbntt.exe116⤵PID:2728
-
\??\c:\llfffxf.exec:\llfffxf.exe117⤵PID:2928
-
\??\c:\nhhnbh.exec:\nhhnbh.exe118⤵PID:1524
-
\??\c:\jvdpj.exec:\jvdpj.exe119⤵PID:3016
-
\??\c:\3frlrfl.exec:\3frlrfl.exe120⤵PID:2380
-
\??\c:\nbbnht.exec:\nbbnht.exe121⤵PID:2996
-
\??\c:\ddpjv.exec:\ddpjv.exe122⤵PID:1800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-