Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 12:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bfe9ad8cdebb84d2b3a30415bfa7fd00N.exe
Resource
win7-20240705-en
5 signatures
120 seconds
General
-
Target
bfe9ad8cdebb84d2b3a30415bfa7fd00N.exe
-
Size
84KB
-
MD5
bfe9ad8cdebb84d2b3a30415bfa7fd00
-
SHA1
ab7c3d8dd4785f1255c1ea7284749856e41cce91
-
SHA256
6c036948d3d10bc7277cf78265b70fa58b0c13b888ac77a7afa390e4fd954a17
-
SHA512
9457fa4dd5f2c132008b71de6cfafbea1da98786286e45f28c7571688b71c5c696ce27a0e3b389653eae96bb44f26277fc0e67f4cf590026560f259bd829bc2a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAXPfgr2hKmdbcPi2v/:ymb3NkkiQ3mdBjFo6Pfgy3dbc//
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2392-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/352-17-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/352-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-27-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1944-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-90-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1440-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 352 rlxlrfr.exe 1944 tnbhth.exe 1652 3vpvj.exe 2256 rfrrxfl.exe 2892 hhhtth.exe 2876 7ppvd.exe 2100 rlrlffl.exe 2784 btbbhh.exe 2640 jvdpp.exe 2664 rffrfrf.exe 1628 ffrfxlf.exe 2344 ttnbbh.exe 1812 ppjvj.exe 2176 lrlrlrl.exe 2608 3bthnb.exe 1440 hhbnbn.exe 1984 jjjvj.exe 2140 3xffllx.exe 2252 thttbh.exe 2296 jjpvv.exe 2384 1pjjv.exe 2300 xxrxlrl.exe 1092 thbntt.exe 1820 hhbthn.exe 2952 7vpjv.exe 1292 xrxflfr.exe 2368 nnhthn.exe 1272 vjjdd.exe 1316 rfflxxf.exe 1684 3bbntt.exe 1660 djjdp.exe 1556 dpdjp.exe 2372 xxxxffl.exe 1612 1bbtht.exe 2520 9pvjd.exe 2820 9pdpd.exe 2728 9xfxffr.exe 2764 bthbhb.exe 2892 7hhnbn.exe 2876 djpvd.exe 2644 xrlrlxr.exe 2840 fxlrflf.exe 2684 7nnhnn.exe 2172 jdppd.exe 324 7jvjv.exe 3064 9xrlxxl.exe 1056 bhthhb.exe 1868 9hhbnb.exe 2796 3pdjv.exe 1152 3fxflrf.exe 1996 llllfrx.exe 1808 thnhht.exe 772 vpjvv.exe 1688 1vjdd.exe 2280 9flfffr.exe 2380 bhbnhh.exe 580 nhnntb.exe 2948 pjpdp.exe 1484 fxrxfxf.exe 2184 tbnhhh.exe 3008 7nhhnt.exe 1368 vvjdd.exe 1788 lfrrflx.exe 2952 frxrfxf.exe -
resource yara_rule behavioral1/memory/2392-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1092-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-261-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2392 wrote to memory of 352 2392 bfe9ad8cdebb84d2b3a30415bfa7fd00N.exe 30 PID 2392 wrote to memory of 352 2392 bfe9ad8cdebb84d2b3a30415bfa7fd00N.exe 30 PID 2392 wrote to memory of 352 2392 bfe9ad8cdebb84d2b3a30415bfa7fd00N.exe 30 PID 2392 wrote to memory of 352 2392 bfe9ad8cdebb84d2b3a30415bfa7fd00N.exe 30 PID 352 wrote to memory of 1944 352 rlxlrfr.exe 31 PID 352 wrote to memory of 1944 352 rlxlrfr.exe 31 PID 352 wrote to memory of 1944 352 rlxlrfr.exe 31 PID 352 wrote to memory of 1944 352 rlxlrfr.exe 31 PID 1944 wrote to memory of 1652 1944 tnbhth.exe 32 PID 1944 wrote to memory of 1652 1944 tnbhth.exe 32 PID 1944 wrote to memory of 1652 1944 tnbhth.exe 32 PID 1944 wrote to memory of 1652 1944 tnbhth.exe 32 PID 1652 wrote to memory of 2256 1652 3vpvj.exe 33 PID 1652 wrote to memory of 2256 1652 3vpvj.exe 33 PID 1652 wrote to memory of 2256 1652 3vpvj.exe 33 PID 1652 wrote to memory of 2256 1652 3vpvj.exe 33 PID 2256 wrote to memory of 2892 2256 rfrrxfl.exe 34 PID 2256 wrote to memory of 2892 2256 rfrrxfl.exe 34 PID 2256 wrote to memory of 2892 2256 rfrrxfl.exe 34 PID 2256 wrote to memory of 2892 2256 rfrrxfl.exe 34 PID 2892 wrote to memory of 2876 2892 hhhtth.exe 35 PID 2892 wrote to memory of 2876 2892 hhhtth.exe 35 PID 2892 wrote to memory of 2876 2892 hhhtth.exe 35 PID 2892 wrote to memory of 2876 2892 hhhtth.exe 35 PID 2876 wrote to memory of 2100 2876 7ppvd.exe 36 PID 2876 wrote to memory of 2100 2876 7ppvd.exe 36 PID 2876 wrote to memory of 2100 2876 7ppvd.exe 36 PID 2876 wrote to memory of 2100 2876 7ppvd.exe 36 PID 2100 wrote to memory of 2784 2100 rlrlffl.exe 37 PID 2100 wrote to memory of 2784 2100 rlrlffl.exe 37 PID 2100 wrote to memory of 2784 2100 rlrlffl.exe 37 PID 2100 wrote to memory of 2784 2100 rlrlffl.exe 37 PID 2784 wrote to memory of 2640 2784 btbbhh.exe 38 PID 2784 wrote to memory of 2640 2784 btbbhh.exe 38 PID 2784 wrote to memory of 2640 2784 btbbhh.exe 38 PID 2784 wrote to memory of 2640 2784 btbbhh.exe 38 PID 2640 wrote to memory of 2664 2640 jvdpp.exe 39 PID 2640 wrote to memory of 2664 2640 jvdpp.exe 39 PID 2640 wrote to memory of 2664 2640 jvdpp.exe 39 PID 2640 wrote to memory of 2664 2640 jvdpp.exe 39 PID 2664 wrote to memory of 1628 2664 rffrfrf.exe 40 PID 2664 wrote to memory of 1628 2664 rffrfrf.exe 40 PID 2664 wrote to memory of 1628 2664 rffrfrf.exe 40 PID 2664 wrote to memory of 1628 2664 rffrfrf.exe 40 PID 1628 wrote to memory of 2344 1628 ffrfxlf.exe 41 PID 1628 wrote to memory of 2344 1628 ffrfxlf.exe 41 PID 1628 wrote to memory of 2344 1628 ffrfxlf.exe 41 PID 1628 wrote to memory of 2344 1628 ffrfxlf.exe 41 PID 2344 wrote to memory of 1812 2344 ttnbbh.exe 42 PID 2344 wrote to memory of 1812 2344 ttnbbh.exe 42 PID 2344 wrote to memory of 1812 2344 ttnbbh.exe 42 PID 2344 wrote to memory of 1812 2344 ttnbbh.exe 42 PID 1812 wrote to memory of 2176 1812 ppjvj.exe 43 PID 1812 wrote to memory of 2176 1812 ppjvj.exe 43 PID 1812 wrote to memory of 2176 1812 ppjvj.exe 43 PID 1812 wrote to memory of 2176 1812 ppjvj.exe 43 PID 2176 wrote to memory of 2608 2176 lrlrlrl.exe 44 PID 2176 wrote to memory of 2608 2176 lrlrlrl.exe 44 PID 2176 wrote to memory of 2608 2176 lrlrlrl.exe 44 PID 2176 wrote to memory of 2608 2176 lrlrlrl.exe 44 PID 2608 wrote to memory of 1440 2608 3bthnb.exe 45 PID 2608 wrote to memory of 1440 2608 3bthnb.exe 45 PID 2608 wrote to memory of 1440 2608 3bthnb.exe 45 PID 2608 wrote to memory of 1440 2608 3bthnb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfe9ad8cdebb84d2b3a30415bfa7fd00N.exe"C:\Users\Admin\AppData\Local\Temp\bfe9ad8cdebb84d2b3a30415bfa7fd00N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\rlxlrfr.exec:\rlxlrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\tnbhth.exec:\tnbhth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\3vpvj.exec:\3vpvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\rfrrxfl.exec:\rfrrxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\hhhtth.exec:\hhhtth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\7ppvd.exec:\7ppvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\rlrlffl.exec:\rlrlffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\btbbhh.exec:\btbbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\jvdpp.exec:\jvdpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\rffrfrf.exec:\rffrfrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\ffrfxlf.exec:\ffrfxlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\ttnbbh.exec:\ttnbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\ppjvj.exec:\ppjvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\lrlrlrl.exec:\lrlrlrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\3bthnb.exec:\3bthnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\hhbnbn.exec:\hhbnbn.exe17⤵
- Executes dropped EXE
PID:1440 -
\??\c:\jjjvj.exec:\jjjvj.exe18⤵
- Executes dropped EXE
PID:1984 -
\??\c:\3xffllx.exec:\3xffllx.exe19⤵
- Executes dropped EXE
PID:2140 -
\??\c:\thttbh.exec:\thttbh.exe20⤵
- Executes dropped EXE
PID:2252 -
\??\c:\jjpvv.exec:\jjpvv.exe21⤵
- Executes dropped EXE
PID:2296 -
\??\c:\1pjjv.exec:\1pjjv.exe22⤵
- Executes dropped EXE
PID:2384 -
\??\c:\xxrxlrl.exec:\xxrxlrl.exe23⤵
- Executes dropped EXE
PID:2300 -
\??\c:\thbntt.exec:\thbntt.exe24⤵
- Executes dropped EXE
PID:1092 -
\??\c:\hhbthn.exec:\hhbthn.exe25⤵
- Executes dropped EXE
PID:1820 -
\??\c:\7vpjv.exec:\7vpjv.exe26⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xrxflfr.exec:\xrxflfr.exe27⤵
- Executes dropped EXE
PID:1292 -
\??\c:\nnhthn.exec:\nnhthn.exe28⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vjjdd.exec:\vjjdd.exe29⤵
- Executes dropped EXE
PID:1272 -
\??\c:\rfflxxf.exec:\rfflxxf.exe30⤵
- Executes dropped EXE
PID:1316 -
\??\c:\3bbntt.exec:\3bbntt.exe31⤵
- Executes dropped EXE
PID:1684 -
\??\c:\djjdp.exec:\djjdp.exe32⤵
- Executes dropped EXE
PID:1660 -
\??\c:\dpdjp.exec:\dpdjp.exe33⤵
- Executes dropped EXE
PID:1556 -
\??\c:\xxxxffl.exec:\xxxxffl.exe34⤵
- Executes dropped EXE
PID:2372 -
\??\c:\1bbtht.exec:\1bbtht.exe35⤵
- Executes dropped EXE
PID:1612 -
\??\c:\9pvjd.exec:\9pvjd.exe36⤵
- Executes dropped EXE
PID:2520 -
\??\c:\9pdpd.exec:\9pdpd.exe37⤵
- Executes dropped EXE
PID:2820 -
\??\c:\9xfxffr.exec:\9xfxffr.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bthbhb.exec:\bthbhb.exe39⤵
- Executes dropped EXE
PID:2764 -
\??\c:\7hhnbn.exec:\7hhnbn.exe40⤵
- Executes dropped EXE
PID:2892 -
\??\c:\djpvd.exec:\djpvd.exe41⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xrlrlxr.exec:\xrlrlxr.exe42⤵
- Executes dropped EXE
PID:2644 -
\??\c:\fxlrflf.exec:\fxlrflf.exe43⤵
- Executes dropped EXE
PID:2840 -
\??\c:\7nnhnn.exec:\7nnhnn.exe44⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jdppd.exec:\jdppd.exe45⤵
- Executes dropped EXE
PID:2172 -
\??\c:\7jvjv.exec:\7jvjv.exe46⤵
- Executes dropped EXE
PID:324 -
\??\c:\9xrlxxl.exec:\9xrlxxl.exe47⤵
- Executes dropped EXE
PID:3064 -
\??\c:\bhthhb.exec:\bhthhb.exe48⤵
- Executes dropped EXE
PID:1056 -
\??\c:\9hhbnb.exec:\9hhbnb.exe49⤵
- Executes dropped EXE
PID:1868 -
\??\c:\3pdjv.exec:\3pdjv.exe50⤵
- Executes dropped EXE
PID:2796 -
\??\c:\3fxflrf.exec:\3fxflrf.exe51⤵
- Executes dropped EXE
PID:1152 -
\??\c:\llllfrx.exec:\llllfrx.exe52⤵
- Executes dropped EXE
PID:1996 -
\??\c:\thnhht.exec:\thnhht.exe53⤵
- Executes dropped EXE
PID:1808 -
\??\c:\vpjvv.exec:\vpjvv.exe54⤵
- Executes dropped EXE
PID:772 -
\??\c:\1vjdd.exec:\1vjdd.exe55⤵
- Executes dropped EXE
PID:1688 -
\??\c:\9flfffr.exec:\9flfffr.exe56⤵
- Executes dropped EXE
PID:2280 -
\??\c:\bhbnhh.exec:\bhbnhh.exe57⤵
- Executes dropped EXE
PID:2380 -
\??\c:\nhnntb.exec:\nhnntb.exe58⤵
- Executes dropped EXE
PID:580 -
\??\c:\pjpdp.exec:\pjpdp.exe59⤵
- Executes dropped EXE
PID:2948 -
\??\c:\fxrxfxf.exec:\fxrxfxf.exe60⤵
- Executes dropped EXE
PID:1484 -
\??\c:\tbnhhh.exec:\tbnhhh.exe61⤵
- Executes dropped EXE
PID:2184 -
\??\c:\7nhhnt.exec:\7nhhnt.exe62⤵
- Executes dropped EXE
PID:3008 -
\??\c:\vvjdd.exec:\vvjdd.exe63⤵
- Executes dropped EXE
PID:1368 -
\??\c:\lfrrflx.exec:\lfrrflx.exe64⤵
- Executes dropped EXE
PID:1788 -
\??\c:\frxrfxf.exec:\frxrfxf.exe65⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hbtbhh.exec:\hbtbhh.exe66⤵PID:1292
-
\??\c:\9ppdv.exec:\9ppdv.exe67⤵PID:2108
-
\??\c:\pdvdp.exec:\pdvdp.exe68⤵PID:2216
-
\??\c:\rrlxrfr.exec:\rrlxrfr.exe69⤵PID:2268
-
\??\c:\btnttt.exec:\btnttt.exe70⤵PID:1316
-
\??\c:\nhbnhn.exec:\nhbnhn.exe71⤵PID:2232
-
\??\c:\pvpdd.exec:\pvpdd.exe72⤵PID:2392
-
\??\c:\fxlfrxl.exec:\fxlfrxl.exe73⤵PID:2420
-
\??\c:\llxxllf.exec:\llxxllf.exe74⤵PID:1608
-
\??\c:\nhnhtb.exec:\nhnhtb.exe75⤵PID:2376
-
\??\c:\dvpdp.exec:\dvpdp.exe76⤵PID:1008
-
\??\c:\pjdpd.exec:\pjdpd.exe77⤵PID:2308
-
\??\c:\xrfffll.exec:\xrfffll.exe78⤵PID:2848
-
\??\c:\xxrxrlx.exec:\xxrxrlx.exe79⤵PID:2744
-
\??\c:\5tnnbh.exec:\5tnnbh.exe80⤵PID:2124
-
\??\c:\5hbtth.exec:\5hbtth.exe81⤵PID:2896
-
\??\c:\vpvdd.exec:\vpvdd.exe82⤵PID:2976
-
\??\c:\rrxxlxl.exec:\rrxxlxl.exe83⤵PID:2636
-
\??\c:\lfxflrf.exec:\lfxflrf.exe84⤵PID:2740
-
\??\c:\nhnbnb.exec:\nhnbnb.exe85⤵PID:1728
-
\??\c:\hhbhht.exec:\hhbhht.exe86⤵PID:2164
-
\??\c:\ppjpj.exec:\ppjpj.exe87⤵PID:2924
-
\??\c:\ffrrxlr.exec:\ffrrxlr.exe88⤵PID:2044
-
\??\c:\lxlfrrx.exec:\lxlfrrx.exe89⤵PID:1248
-
\??\c:\ntbtbb.exec:\ntbtbb.exe90⤵PID:1976
-
\??\c:\nnhhtt.exec:\nnhhtt.exe91⤵PID:1992
-
\??\c:\3ppdp.exec:\3ppdp.exe92⤵PID:1500
-
\??\c:\jvvjd.exec:\jvvjd.exe93⤵PID:1996
-
\??\c:\rfxxfxf.exec:\rfxxfxf.exe94⤵PID:1284
-
\??\c:\5hnnhh.exec:\5hnnhh.exe95⤵PID:1940
-
\??\c:\tbthth.exec:\tbthth.exe96⤵PID:2120
-
\??\c:\djjpp.exec:\djjpp.exe97⤵PID:1644
-
\??\c:\5rflrxf.exec:\5rflrxf.exe98⤵PID:924
-
\??\c:\fxflffl.exec:\fxflffl.exe99⤵PID:1456
-
\??\c:\tnbhnn.exec:\tnbhnn.exe100⤵PID:2384
-
\??\c:\nththt.exec:\nththt.exe101⤵PID:852
-
\??\c:\djjvj.exec:\djjvj.exe102⤵PID:2184
-
\??\c:\xlxllxx.exec:\xlxllxx.exe103⤵PID:1620
-
\??\c:\fxlrxrf.exec:\fxlrxrf.exe104⤵PID:2504
-
\??\c:\3nbbbh.exec:\3nbbbh.exe105⤵PID:620
-
\??\c:\hhthnn.exec:\hhthnn.exe106⤵PID:3028
-
\??\c:\jvpdp.exec:\jvpdp.exe107⤵PID:2492
-
\??\c:\dvvjp.exec:\dvvjp.exe108⤵PID:2240
-
\??\c:\xllrlfl.exec:\xllrlfl.exe109⤵PID:2216
-
\??\c:\ttnbht.exec:\ttnbht.exe110⤵PID:1528
-
\??\c:\5ddjp.exec:\5ddjp.exe111⤵PID:1624
-
\??\c:\ddjvv.exec:\ddjvv.exe112⤵PID:704
-
\??\c:\rllrflf.exec:\rllrflf.exe113⤵PID:2704
-
\??\c:\xxrxrxl.exec:\xxrxrxl.exe114⤵PID:2408
-
\??\c:\ttbnnn.exec:\ttbnnn.exe115⤵PID:2404
-
\??\c:\9pdvj.exec:\9pdvj.exe116⤵PID:2768
-
\??\c:\dpjpd.exec:\dpjpd.exe117⤵PID:2092
-
\??\c:\fxlrflx.exec:\fxlrflx.exe118⤵PID:2816
-
\??\c:\ttnnbh.exec:\ttnnbh.exe119⤵PID:2992
-
\??\c:\tnhntb.exec:\tnhntb.exe120⤵PID:2880
-
\??\c:\1dpdp.exec:\1dpdp.exe121⤵PID:2780
-
\??\c:\vpddp.exec:\vpddp.exe122⤵PID:2732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-