Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 19:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d18142072bcb0f6e248a399c04b87650faebe5d8e87b0f84e4059274c21cc91.exe
Resource
win7-20240708-en
5 signatures
150 seconds
General
-
Target
2d18142072bcb0f6e248a399c04b87650faebe5d8e87b0f84e4059274c21cc91.exe
-
Size
417KB
-
MD5
c10fa53151c92a9ddb8a6ec5f4fbe8df
-
SHA1
99352ef9c706f558ed539256511b4c1b3dd63128
-
SHA256
2d18142072bcb0f6e248a399c04b87650faebe5d8e87b0f84e4059274c21cc91
-
SHA512
a510c3171787391ceb29be2c62bfa2a73f205a626d6168f63a84ca694e03360a6e75a6585005dd1143025e3d71e9da138117b44d270e80a5085ba4cab0d15559
-
SSDEEP
12288:n3C9ytvngQj4DtvnV9wLn9UTfC8eieJNBNIsYPv:SgdnJUdnV9P
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2996-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1128-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/372-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/352-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2876 9rrlrfr.exe 2328 nbbbth.exe 2880 rlfllrr.exe 2684 nhhhtb.exe 2712 tbbnhh.exe 3040 pjvjv.exe 2576 tnbhtb.exe 2668 1pvpd.exe 2624 fflffrx.exe 2976 bttbnn.exe 2280 1pvjv.exe 1976 3lrfxlf.exe 1920 jvjvj.exe 1128 1rrxffr.exe 1944 nnnthh.exe 1540 vpvvj.exe 2800 bbbnhh.exe 2640 1btbhn.exe 1724 lfrrflf.exe 1732 thhhtn.exe 372 ddvdp.exe 2868 lrxllrf.exe 1296 xxrlrxr.exe 1644 fxxxflr.exe 908 httnbh.exe 1188 hhhtnb.exe 2308 pdddd.exe 2184 ffrxllx.exe 352 nhthnn.exe 2304 9lxxlxl.exe 3004 nhthtb.exe 2832 vpvjp.exe 1616 nhhnbb.exe 2328 jjjvp.exe 2880 llfxfxx.exe 2696 rrlfxrx.exe 2660 nbthbh.exe 2844 vjdjv.exe 2588 3vdvj.exe 2720 lfrrffl.exe 2552 5bbnbh.exe 2584 ttntbb.exe 2616 dvjdj.exe 2624 rlxffrf.exe 1656 rxrlrxx.exe 2028 tnnbhn.exe 788 ppjpj.exe 536 ppjjp.exe 276 rrrxlrf.exe 1720 nbnnnt.exe 1044 nnnnth.exe 320 jdjvp.exe 2752 rllfrxl.exe 2416 xrlrffr.exe 2640 nnntht.exe 2372 ddpvj.exe 916 fxxrlrf.exe 2024 flfrfrl.exe 2188 tnnbnn.exe 1740 bbthbb.exe 936 dddpj.exe 1928 7djvj.exe 1652 fflxlrl.exe 2300 nhbnhn.exe -
resource yara_rule behavioral1/memory/2996-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1128-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/372-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2996 wrote to memory of 2876 2996 2d18142072bcb0f6e248a399c04b87650faebe5d8e87b0f84e4059274c21cc91.exe 31 PID 2996 wrote to memory of 2876 2996 2d18142072bcb0f6e248a399c04b87650faebe5d8e87b0f84e4059274c21cc91.exe 31 PID 2996 wrote to memory of 2876 2996 2d18142072bcb0f6e248a399c04b87650faebe5d8e87b0f84e4059274c21cc91.exe 31 PID 2996 wrote to memory of 2876 2996 2d18142072bcb0f6e248a399c04b87650faebe5d8e87b0f84e4059274c21cc91.exe 31 PID 2876 wrote to memory of 2328 2876 9rrlrfr.exe 32 PID 2876 wrote to memory of 2328 2876 9rrlrfr.exe 32 PID 2876 wrote to memory of 2328 2876 9rrlrfr.exe 32 PID 2876 wrote to memory of 2328 2876 9rrlrfr.exe 32 PID 2328 wrote to memory of 2880 2328 nbbbth.exe 33 PID 2328 wrote to memory of 2880 2328 nbbbth.exe 33 PID 2328 wrote to memory of 2880 2328 nbbbth.exe 33 PID 2328 wrote to memory of 2880 2328 nbbbth.exe 33 PID 2880 wrote to memory of 2684 2880 rlfllrr.exe 34 PID 2880 wrote to memory of 2684 2880 rlfllrr.exe 34 PID 2880 wrote to memory of 2684 2880 rlfllrr.exe 34 PID 2880 wrote to memory of 2684 2880 rlfllrr.exe 34 PID 2684 wrote to memory of 2712 2684 nhhhtb.exe 35 PID 2684 wrote to memory of 2712 2684 nhhhtb.exe 35 PID 2684 wrote to memory of 2712 2684 nhhhtb.exe 35 PID 2684 wrote to memory of 2712 2684 nhhhtb.exe 35 PID 2712 wrote to memory of 3040 2712 tbbnhh.exe 36 PID 2712 wrote to memory of 3040 2712 tbbnhh.exe 36 PID 2712 wrote to memory of 3040 2712 tbbnhh.exe 36 PID 2712 wrote to memory of 3040 2712 tbbnhh.exe 36 PID 3040 wrote to memory of 2576 3040 pjvjv.exe 37 PID 3040 wrote to memory of 2576 3040 pjvjv.exe 37 PID 3040 wrote to memory of 2576 3040 pjvjv.exe 37 PID 3040 wrote to memory of 2576 3040 pjvjv.exe 37 PID 2576 wrote to memory of 2668 2576 tnbhtb.exe 38 PID 2576 wrote to memory of 2668 2576 tnbhtb.exe 38 PID 2576 wrote to memory of 2668 2576 tnbhtb.exe 38 PID 2576 wrote to memory of 2668 2576 tnbhtb.exe 38 PID 2668 wrote to memory of 2624 2668 1pvpd.exe 39 PID 2668 wrote to memory of 2624 2668 1pvpd.exe 39 PID 2668 wrote to memory of 2624 2668 1pvpd.exe 39 PID 2668 wrote to memory of 2624 2668 1pvpd.exe 39 PID 2624 wrote to memory of 2976 2624 fflffrx.exe 40 PID 2624 wrote to memory of 2976 2624 fflffrx.exe 40 PID 2624 wrote to memory of 2976 2624 fflffrx.exe 40 PID 2624 wrote to memory of 2976 2624 fflffrx.exe 40 PID 2976 wrote to memory of 2280 2976 bttbnn.exe 41 PID 2976 wrote to memory of 2280 2976 bttbnn.exe 41 PID 2976 wrote to memory of 2280 2976 bttbnn.exe 41 PID 2976 wrote to memory of 2280 2976 bttbnn.exe 41 PID 2280 wrote to memory of 1976 2280 1pvjv.exe 42 PID 2280 wrote to memory of 1976 2280 1pvjv.exe 42 PID 2280 wrote to memory of 1976 2280 1pvjv.exe 42 PID 2280 wrote to memory of 1976 2280 1pvjv.exe 42 PID 1976 wrote to memory of 1920 1976 3lrfxlf.exe 43 PID 1976 wrote to memory of 1920 1976 3lrfxlf.exe 43 PID 1976 wrote to memory of 1920 1976 3lrfxlf.exe 43 PID 1976 wrote to memory of 1920 1976 3lrfxlf.exe 43 PID 1920 wrote to memory of 1128 1920 jvjvj.exe 44 PID 1920 wrote to memory of 1128 1920 jvjvj.exe 44 PID 1920 wrote to memory of 1128 1920 jvjvj.exe 44 PID 1920 wrote to memory of 1128 1920 jvjvj.exe 44 PID 1128 wrote to memory of 1944 1128 1rrxffr.exe 45 PID 1128 wrote to memory of 1944 1128 1rrxffr.exe 45 PID 1128 wrote to memory of 1944 1128 1rrxffr.exe 45 PID 1128 wrote to memory of 1944 1128 1rrxffr.exe 45 PID 1944 wrote to memory of 1540 1944 nnnthh.exe 46 PID 1944 wrote to memory of 1540 1944 nnnthh.exe 46 PID 1944 wrote to memory of 1540 1944 nnnthh.exe 46 PID 1944 wrote to memory of 1540 1944 nnnthh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d18142072bcb0f6e248a399c04b87650faebe5d8e87b0f84e4059274c21cc91.exe"C:\Users\Admin\AppData\Local\Temp\2d18142072bcb0f6e248a399c04b87650faebe5d8e87b0f84e4059274c21cc91.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\9rrlrfr.exec:\9rrlrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\nbbbth.exec:\nbbbth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\rlfllrr.exec:\rlfllrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\nhhhtb.exec:\nhhhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\tbbnhh.exec:\tbbnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\pjvjv.exec:\pjvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\tnbhtb.exec:\tnbhtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\1pvpd.exec:\1pvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\fflffrx.exec:\fflffrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\bttbnn.exec:\bttbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\1pvjv.exec:\1pvjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\3lrfxlf.exec:\3lrfxlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\jvjvj.exec:\jvjvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\1rrxffr.exec:\1rrxffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\nnnthh.exec:\nnnthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\vpvvj.exec:\vpvvj.exe17⤵
- Executes dropped EXE
PID:1540 -
\??\c:\bbbnhh.exec:\bbbnhh.exe18⤵
- Executes dropped EXE
PID:2800 -
\??\c:\1btbhn.exec:\1btbhn.exe19⤵
- Executes dropped EXE
PID:2640 -
\??\c:\lfrrflf.exec:\lfrrflf.exe20⤵
- Executes dropped EXE
PID:1724 -
\??\c:\thhhtn.exec:\thhhtn.exe21⤵
- Executes dropped EXE
PID:1732 -
\??\c:\ddvdp.exec:\ddvdp.exe22⤵
- Executes dropped EXE
PID:372 -
\??\c:\lrxllrf.exec:\lrxllrf.exe23⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xxrlrxr.exec:\xxrlrxr.exe24⤵
- Executes dropped EXE
PID:1296 -
\??\c:\fxxxflr.exec:\fxxxflr.exe25⤵
- Executes dropped EXE
PID:1644 -
\??\c:\httnbh.exec:\httnbh.exe26⤵
- Executes dropped EXE
PID:908 -
\??\c:\hhhtnb.exec:\hhhtnb.exe27⤵
- Executes dropped EXE
PID:1188 -
\??\c:\pdddd.exec:\pdddd.exe28⤵
- Executes dropped EXE
PID:2308 -
\??\c:\ffrxllx.exec:\ffrxllx.exe29⤵
- Executes dropped EXE
PID:2184 -
\??\c:\nhthnn.exec:\nhthnn.exe30⤵
- Executes dropped EXE
PID:352 -
\??\c:\9lxxlxl.exec:\9lxxlxl.exe31⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nhthtb.exec:\nhthtb.exe32⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vpvjp.exec:\vpvjp.exe33⤵
- Executes dropped EXE
PID:2832 -
\??\c:\nhhnbb.exec:\nhhnbb.exe34⤵
- Executes dropped EXE
PID:1616 -
\??\c:\jjjvp.exec:\jjjvp.exe35⤵
- Executes dropped EXE
PID:2328 -
\??\c:\llfxfxx.exec:\llfxfxx.exe36⤵
- Executes dropped EXE
PID:2880 -
\??\c:\rrlfxrx.exec:\rrlfxrx.exe37⤵
- Executes dropped EXE
PID:2696 -
\??\c:\nbthbh.exec:\nbthbh.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\vjdjv.exec:\vjdjv.exe39⤵
- Executes dropped EXE
PID:2844 -
\??\c:\3vdvj.exec:\3vdvj.exe40⤵
- Executes dropped EXE
PID:2588 -
\??\c:\lfrrffl.exec:\lfrrffl.exe41⤵
- Executes dropped EXE
PID:2720 -
\??\c:\5bbnbh.exec:\5bbnbh.exe42⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ttntbb.exec:\ttntbb.exe43⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dvjdj.exec:\dvjdj.exe44⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rlxffrf.exec:\rlxffrf.exe45⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rxrlrxx.exec:\rxrlrxx.exe46⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tnnbhn.exec:\tnnbhn.exe47⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ppjpj.exec:\ppjpj.exe48⤵
- Executes dropped EXE
PID:788 -
\??\c:\ppjjp.exec:\ppjjp.exe49⤵
- Executes dropped EXE
PID:536 -
\??\c:\rrrxlrf.exec:\rrrxlrf.exe50⤵
- Executes dropped EXE
PID:276 -
\??\c:\nbnnnt.exec:\nbnnnt.exe51⤵
- Executes dropped EXE
PID:1720 -
\??\c:\nnnnth.exec:\nnnnth.exe52⤵
- Executes dropped EXE
PID:1044 -
\??\c:\jdjvp.exec:\jdjvp.exe53⤵
- Executes dropped EXE
PID:320 -
\??\c:\rllfrxl.exec:\rllfrxl.exe54⤵
- Executes dropped EXE
PID:2752 -
\??\c:\xrlrffr.exec:\xrlrffr.exe55⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nnntht.exec:\nnntht.exe56⤵
- Executes dropped EXE
PID:2640 -
\??\c:\ddpvj.exec:\ddpvj.exe57⤵
- Executes dropped EXE
PID:2372 -
\??\c:\fxxrlrf.exec:\fxxrlrf.exe58⤵
- Executes dropped EXE
PID:916 -
\??\c:\flfrfrl.exec:\flfrfrl.exe59⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tnnbnn.exec:\tnnbnn.exe60⤵
- Executes dropped EXE
PID:2188 -
\??\c:\bbthbb.exec:\bbthbb.exe61⤵
- Executes dropped EXE
PID:1740 -
\??\c:\dddpj.exec:\dddpj.exe62⤵
- Executes dropped EXE
PID:936 -
\??\c:\7djvj.exec:\7djvj.exe63⤵
- Executes dropped EXE
PID:1928 -
\??\c:\fflxlrl.exec:\fflxlrl.exe64⤵
- Executes dropped EXE
PID:1652 -
\??\c:\nhbnhn.exec:\nhbnhn.exe65⤵
- Executes dropped EXE
PID:2300 -
\??\c:\7jdjp.exec:\7jdjp.exe66⤵PID:1416
-
\??\c:\jjjdp.exec:\jjjdp.exe67⤵PID:2196
-
\??\c:\rrllffl.exec:\rrllffl.exe68⤵PID:1216
-
\??\c:\7ntbtt.exec:\7ntbtt.exe69⤵PID:2448
-
\??\c:\3dvdv.exec:\3dvdv.exe70⤵PID:2632
-
\??\c:\jjvdv.exec:\jjvdv.exe71⤵PID:2304
-
\??\c:\rlffllx.exec:\rlffllx.exe72⤵PID:1568
-
\??\c:\bbntbh.exec:\bbntbh.exe73⤵PID:2936
-
\??\c:\3jpjv.exec:\3jpjv.exe74⤵PID:1524
-
\??\c:\jdpvp.exec:\jdpvp.exe75⤵PID:2056
-
\??\c:\rlxrflf.exec:\rlxrflf.exe76⤵PID:2964
-
\??\c:\5thntt.exec:\5thntt.exe77⤵PID:2708
-
\??\c:\bhhnhn.exec:\bhhnhn.exe78⤵PID:2688
-
\??\c:\7ppdj.exec:\7ppdj.exe79⤵PID:2744
-
\??\c:\1lrlxrl.exec:\1lrlxrl.exe80⤵PID:2692
-
\??\c:\9flxffr.exec:\9flxffr.exe81⤵PID:2596
-
\??\c:\nhtnht.exec:\nhtnht.exe82⤵PID:780
-
\??\c:\vpvdv.exec:\vpvdv.exe83⤵PID:2600
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe84⤵PID:2460
-
\??\c:\9lllffr.exec:\9lllffr.exe85⤵PID:1912
-
\??\c:\nhbnbn.exec:\nhbnbn.exe86⤵PID:996
-
\??\c:\3pvvj.exec:\3pvvj.exe87⤵PID:2088
-
\??\c:\rrrxflx.exec:\rrrxflx.exe88⤵PID:1852
-
\??\c:\frfxrfr.exec:\frfxrfr.exe89⤵PID:1000
-
\??\c:\ttnbtb.exec:\ttnbtb.exe90⤵PID:1500
-
\??\c:\dpddj.exec:\dpddj.exe91⤵PID:1776
-
\??\c:\pjddp.exec:\pjddp.exe92⤵PID:1576
-
\??\c:\rflxfrx.exec:\rflxfrx.exe93⤵PID:1864
-
\??\c:\nbthtb.exec:\nbthtb.exe94⤵PID:2540
-
\??\c:\ppddv.exec:\ppddv.exe95⤵PID:2620
-
\??\c:\7jvpd.exec:\7jvpd.exe96⤵PID:656
-
\??\c:\xxxfflf.exec:\xxxfflf.exe97⤵PID:448
-
\??\c:\ntthnb.exec:\ntthnb.exe98⤵PID:2852
-
\??\c:\jvjjv.exec:\jvjjv.exe99⤵PID:2420
-
\??\c:\ffflffx.exec:\ffflffx.exe100⤵PID:2152
-
\??\c:\rlflllx.exec:\rlflllx.exe101⤵PID:2264
-
\??\c:\tnbhnb.exec:\tnbhnb.exe102⤵PID:108
-
\??\c:\jdvdp.exec:\jdvdp.exe103⤵PID:908
-
\??\c:\xllrfrx.exec:\xllrfrx.exe104⤵PID:1652
-
\??\c:\ffxfflf.exec:\ffxfflf.exe105⤵PID:768
-
\??\c:\ttnbhn.exec:\ttnbhn.exe106⤵PID:2100
-
\??\c:\jvjpd.exec:\jvjpd.exe107⤵PID:1672
-
\??\c:\jpjdj.exec:\jpjdj.exe108⤵PID:352
-
\??\c:\lfxfxfx.exec:\lfxfxfx.exe109⤵PID:2476
-
\??\c:\nhthnt.exec:\nhthnt.exe110⤵PID:692
-
\??\c:\5nnbhn.exec:\5nnbhn.exe111⤵PID:236
-
\??\c:\7djvd.exec:\7djvd.exe112⤵PID:1496
-
\??\c:\5xlllrl.exec:\5xlllrl.exe113⤵PID:2836
-
\??\c:\tbthtb.exec:\tbthtb.exe114⤵PID:2236
-
\??\c:\9hnbnb.exec:\9hnbnb.exe115⤵PID:2756
-
\??\c:\pjpvv.exec:\pjpvv.exe116⤵PID:2772
-
\??\c:\lflxrrl.exec:\lflxrrl.exe117⤵PID:2892
-
\??\c:\btnbhh.exec:\btnbhh.exe118⤵PID:2712
-
\??\c:\nnhhth.exec:\nnhhth.exe119⤵PID:2200
-
\??\c:\vvvjv.exec:\vvvjv.exe120⤵PID:2728
-
\??\c:\xxrflxl.exec:\xxrflxl.exe121⤵PID:1884
-
\??\c:\rxrfrrl.exec:\rxrfrrl.exe122⤵PID:2960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-