Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 23:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b496769513b4829e7e99aa4d959d000N.exe
Resource
win7-20240705-en
5 signatures
120 seconds
General
-
Target
2b496769513b4829e7e99aa4d959d000N.exe
-
Size
68KB
-
MD5
2b496769513b4829e7e99aa4d959d000
-
SHA1
3dfc221ece2143eac1753ae58d28204a834e1ffb
-
SHA256
6d58231936d99404657a49ad23138bbfa9427531d791e38d8e64ba08d2e1f9d9
-
SHA512
f3e8352b9319775494239aeb21508f26ee470692ec9a2b054494c64c619c51bea600474eb2bbcfc6f24bfc43ff3ba011f6014d459fe68056f8b424392fb1f8ef
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfUci4IO:ymb3NkkiQ3mdBjFI4V4ci4IO
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/656-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/668-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/780-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/444-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/948-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3000 bthbnh.exe 2524 vjpvd.exe 2680 lfrrxfl.exe 2796 frflxff.exe 2440 3thnnb.exe 2688 jjvjp.exe 2484 fxrlxll.exe 2944 lfrfrff.exe 668 thbbhn.exe 2720 dvpdd.exe 2760 rrlrrrr.exe 780 thtbbb.exe 1640 btnnhh.exe 580 pdvdd.exe 1812 rrlrxrx.exe 2084 lxflxrx.exe 1764 9tbtbh.exe 2072 btnntn.exe 2676 pjvdp.exe 1668 jdvvp.exe 444 xlxxxxf.exe 2872 nbhbhh.exe 948 nhnttb.exe 2364 pjdpj.exe 1960 5frlrrl.exe 2328 rlxflfl.exe 2120 5nnhtn.exe 1724 ppjpj.exe 2156 pjpjp.exe 2324 fxffffl.exe 2344 3rrxxff.exe 2524 hthhnn.exe 2800 pdvvd.exe 2664 ppdjj.exe 108 xlllllx.exe 1676 hnhbhn.exe 2972 tntntt.exe 2408 vpjpp.exe 2688 jdjjj.exe 1524 jvdvd.exe 1916 lrffxfr.exe 1576 fffxxxr.exe 2660 bnbbtb.exe 2672 nhnbtt.exe 2756 pvvvd.exe 1692 frxxlfl.exe 1848 1rflxff.exe 584 9xfxxxf.exe 2916 tnthnt.exe 1872 pjddj.exe 688 9ddjv.exe 1216 rlffrlx.exe 1044 fxrfllr.exe 1688 nhbhtt.exe 548 thnntt.exe 1240 pjppd.exe 2884 jvjpv.exe 444 lxffllr.exe 2872 xlxfffl.exe 3020 3xflxfl.exe 2028 7thhnn.exe 696 jppjj.exe 2792 7djdd.exe 1652 5fxxxxl.exe -
resource yara_rule behavioral1/memory/656-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/668-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/780-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/444-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/948-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-277-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 656 wrote to memory of 3000 656 2b496769513b4829e7e99aa4d959d000N.exe 29 PID 656 wrote to memory of 3000 656 2b496769513b4829e7e99aa4d959d000N.exe 29 PID 656 wrote to memory of 3000 656 2b496769513b4829e7e99aa4d959d000N.exe 29 PID 656 wrote to memory of 3000 656 2b496769513b4829e7e99aa4d959d000N.exe 29 PID 3000 wrote to memory of 2524 3000 bthbnh.exe 30 PID 3000 wrote to memory of 2524 3000 bthbnh.exe 30 PID 3000 wrote to memory of 2524 3000 bthbnh.exe 30 PID 3000 wrote to memory of 2524 3000 bthbnh.exe 30 PID 2524 wrote to memory of 2680 2524 vjpvd.exe 31 PID 2524 wrote to memory of 2680 2524 vjpvd.exe 31 PID 2524 wrote to memory of 2680 2524 vjpvd.exe 31 PID 2524 wrote to memory of 2680 2524 vjpvd.exe 31 PID 2680 wrote to memory of 2796 2680 lfrrxfl.exe 32 PID 2680 wrote to memory of 2796 2680 lfrrxfl.exe 32 PID 2680 wrote to memory of 2796 2680 lfrrxfl.exe 32 PID 2680 wrote to memory of 2796 2680 lfrrxfl.exe 32 PID 2796 wrote to memory of 2440 2796 frflxff.exe 33 PID 2796 wrote to memory of 2440 2796 frflxff.exe 33 PID 2796 wrote to memory of 2440 2796 frflxff.exe 33 PID 2796 wrote to memory of 2440 2796 frflxff.exe 33 PID 2440 wrote to memory of 2688 2440 3thnnb.exe 34 PID 2440 wrote to memory of 2688 2440 3thnnb.exe 34 PID 2440 wrote to memory of 2688 2440 3thnnb.exe 34 PID 2440 wrote to memory of 2688 2440 3thnnb.exe 34 PID 2688 wrote to memory of 2484 2688 jjvjp.exe 35 PID 2688 wrote to memory of 2484 2688 jjvjp.exe 35 PID 2688 wrote to memory of 2484 2688 jjvjp.exe 35 PID 2688 wrote to memory of 2484 2688 jjvjp.exe 35 PID 2484 wrote to memory of 2944 2484 fxrlxll.exe 36 PID 2484 wrote to memory of 2944 2484 fxrlxll.exe 36 PID 2484 wrote to memory of 2944 2484 fxrlxll.exe 36 PID 2484 wrote to memory of 2944 2484 fxrlxll.exe 36 PID 2944 wrote to memory of 668 2944 lfrfrff.exe 37 PID 2944 wrote to memory of 668 2944 lfrfrff.exe 37 PID 2944 wrote to memory of 668 2944 lfrfrff.exe 37 PID 2944 wrote to memory of 668 2944 lfrfrff.exe 37 PID 668 wrote to memory of 2720 668 thbbhn.exe 38 PID 668 wrote to memory of 2720 668 thbbhn.exe 38 PID 668 wrote to memory of 2720 668 thbbhn.exe 38 PID 668 wrote to memory of 2720 668 thbbhn.exe 38 PID 2720 wrote to memory of 2760 2720 dvpdd.exe 39 PID 2720 wrote to memory of 2760 2720 dvpdd.exe 39 PID 2720 wrote to memory of 2760 2720 dvpdd.exe 39 PID 2720 wrote to memory of 2760 2720 dvpdd.exe 39 PID 2760 wrote to memory of 780 2760 rrlrrrr.exe 40 PID 2760 wrote to memory of 780 2760 rrlrrrr.exe 40 PID 2760 wrote to memory of 780 2760 rrlrrrr.exe 40 PID 2760 wrote to memory of 780 2760 rrlrrrr.exe 40 PID 780 wrote to memory of 1640 780 thtbbb.exe 41 PID 780 wrote to memory of 1640 780 thtbbb.exe 41 PID 780 wrote to memory of 1640 780 thtbbb.exe 41 PID 780 wrote to memory of 1640 780 thtbbb.exe 41 PID 1640 wrote to memory of 580 1640 btnnhh.exe 42 PID 1640 wrote to memory of 580 1640 btnnhh.exe 42 PID 1640 wrote to memory of 580 1640 btnnhh.exe 42 PID 1640 wrote to memory of 580 1640 btnnhh.exe 42 PID 580 wrote to memory of 1812 580 pdvdd.exe 43 PID 580 wrote to memory of 1812 580 pdvdd.exe 43 PID 580 wrote to memory of 1812 580 pdvdd.exe 43 PID 580 wrote to memory of 1812 580 pdvdd.exe 43 PID 1812 wrote to memory of 2084 1812 rrlrxrx.exe 44 PID 1812 wrote to memory of 2084 1812 rrlrxrx.exe 44 PID 1812 wrote to memory of 2084 1812 rrlrxrx.exe 44 PID 1812 wrote to memory of 2084 1812 rrlrxrx.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b496769513b4829e7e99aa4d959d000N.exe"C:\Users\Admin\AppData\Local\Temp\2b496769513b4829e7e99aa4d959d000N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\bthbnh.exec:\bthbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\vjpvd.exec:\vjpvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\lfrrxfl.exec:\lfrrxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\frflxff.exec:\frflxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\3thnnb.exec:\3thnnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\jjvjp.exec:\jjvjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\fxrlxll.exec:\fxrlxll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\lfrfrff.exec:\lfrfrff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\thbbhn.exec:\thbbhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\dvpdd.exec:\dvpdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\rrlrrrr.exec:\rrlrrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\thtbbb.exec:\thtbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\btnnhh.exec:\btnnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\pdvdd.exec:\pdvdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\rrlrxrx.exec:\rrlrxrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\lxflxrx.exec:\lxflxrx.exe17⤵
- Executes dropped EXE
PID:2084 -
\??\c:\9tbtbh.exec:\9tbtbh.exe18⤵
- Executes dropped EXE
PID:1764 -
\??\c:\btnntn.exec:\btnntn.exe19⤵
- Executes dropped EXE
PID:2072 -
\??\c:\pjvdp.exec:\pjvdp.exe20⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jdvvp.exec:\jdvvp.exe21⤵
- Executes dropped EXE
PID:1668 -
\??\c:\xlxxxxf.exec:\xlxxxxf.exe22⤵
- Executes dropped EXE
PID:444 -
\??\c:\nbhbhh.exec:\nbhbhh.exe23⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nhnttb.exec:\nhnttb.exe24⤵
- Executes dropped EXE
PID:948 -
\??\c:\pjdpj.exec:\pjdpj.exe25⤵
- Executes dropped EXE
PID:2364 -
\??\c:\5frlrrl.exec:\5frlrrl.exe26⤵
- Executes dropped EXE
PID:1960 -
\??\c:\rlxflfl.exec:\rlxflfl.exe27⤵
- Executes dropped EXE
PID:2328 -
\??\c:\5nnhtn.exec:\5nnhtn.exe28⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ppjpj.exec:\ppjpj.exe29⤵
- Executes dropped EXE
PID:1724 -
\??\c:\pjpjp.exec:\pjpjp.exe30⤵
- Executes dropped EXE
PID:2156 -
\??\c:\fxffffl.exec:\fxffffl.exe31⤵
- Executes dropped EXE
PID:2324 -
\??\c:\3rrxxff.exec:\3rrxxff.exe32⤵
- Executes dropped EXE
PID:2344 -
\??\c:\hthhnn.exec:\hthhnn.exe33⤵
- Executes dropped EXE
PID:2524 -
\??\c:\pdvvd.exec:\pdvvd.exe34⤵
- Executes dropped EXE
PID:2800 -
\??\c:\ppdjj.exec:\ppdjj.exe35⤵
- Executes dropped EXE
PID:2664 -
\??\c:\xlllllx.exec:\xlllllx.exe36⤵
- Executes dropped EXE
PID:108 -
\??\c:\hnhbhn.exec:\hnhbhn.exe37⤵
- Executes dropped EXE
PID:1676 -
\??\c:\tntntt.exec:\tntntt.exe38⤵
- Executes dropped EXE
PID:2972 -
\??\c:\vpjpp.exec:\vpjpp.exe39⤵
- Executes dropped EXE
PID:2408 -
\??\c:\jdjjj.exec:\jdjjj.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jvdvd.exec:\jvdvd.exe41⤵
- Executes dropped EXE
PID:1524 -
\??\c:\lrffxfr.exec:\lrffxfr.exe42⤵
- Executes dropped EXE
PID:1916 -
\??\c:\fffxxxr.exec:\fffxxxr.exe43⤵
- Executes dropped EXE
PID:1576 -
\??\c:\bnbbtb.exec:\bnbbtb.exe44⤵
- Executes dropped EXE
PID:2660 -
\??\c:\nhnbtt.exec:\nhnbtt.exe45⤵
- Executes dropped EXE
PID:2672 -
\??\c:\pvvvd.exec:\pvvvd.exe46⤵
- Executes dropped EXE
PID:2756 -
\??\c:\frxxlfl.exec:\frxxlfl.exe47⤵
- Executes dropped EXE
PID:1692 -
\??\c:\1rflxff.exec:\1rflxff.exe48⤵
- Executes dropped EXE
PID:1848 -
\??\c:\9xfxxxf.exec:\9xfxxxf.exe49⤵
- Executes dropped EXE
PID:584 -
\??\c:\tnthnt.exec:\tnthnt.exe50⤵
- Executes dropped EXE
PID:2916 -
\??\c:\pjddj.exec:\pjddj.exe51⤵
- Executes dropped EXE
PID:1872 -
\??\c:\9ddjv.exec:\9ddjv.exe52⤵
- Executes dropped EXE
PID:688 -
\??\c:\rlffrlx.exec:\rlffrlx.exe53⤵
- Executes dropped EXE
PID:1216 -
\??\c:\fxrfllr.exec:\fxrfllr.exe54⤵
- Executes dropped EXE
PID:1044 -
\??\c:\nhbhtt.exec:\nhbhtt.exe55⤵
- Executes dropped EXE
PID:1688 -
\??\c:\thnntt.exec:\thnntt.exe56⤵
- Executes dropped EXE
PID:548 -
\??\c:\pjppd.exec:\pjppd.exe57⤵
- Executes dropped EXE
PID:1240 -
\??\c:\jvjpv.exec:\jvjpv.exe58⤵
- Executes dropped EXE
PID:2884 -
\??\c:\lxffllr.exec:\lxffllr.exe59⤵
- Executes dropped EXE
PID:444 -
\??\c:\xlxfffl.exec:\xlxfffl.exe60⤵
- Executes dropped EXE
PID:2872 -
\??\c:\3xflxfl.exec:\3xflxfl.exe61⤵
- Executes dropped EXE
PID:3020 -
\??\c:\7thhnn.exec:\7thhnn.exe62⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jppjj.exec:\jppjj.exe63⤵
- Executes dropped EXE
PID:696 -
\??\c:\7djdd.exec:\7djdd.exe64⤵
- Executes dropped EXE
PID:2792 -
\??\c:\5fxxxxl.exec:\5fxxxxl.exe65⤵
- Executes dropped EXE
PID:1652 -
\??\c:\3lxfllr.exec:\3lxfllr.exe66⤵PID:1556
-
\??\c:\hbnbbn.exec:\hbnbbn.exe67⤵PID:1728
-
\??\c:\jjpdd.exec:\jjpdd.exe68⤵PID:2332
-
\??\c:\5vdvp.exec:\5vdvp.exe69⤵PID:2008
-
\??\c:\rlflrfl.exec:\rlflrfl.exe70⤵PID:3000
-
\??\c:\llrxffl.exec:\llrxffl.exe71⤵PID:2784
-
\??\c:\bnthnn.exec:\bnthnn.exe72⤵PID:2608
-
\??\c:\9thhnn.exec:\9thhnn.exe73⤵PID:2632
-
\??\c:\vpddj.exec:\vpddj.exe74⤵PID:2644
-
\??\c:\vvvjd.exec:\vvvjd.exe75⤵PID:2696
-
\??\c:\llflxlf.exec:\llflxlf.exe76⤵PID:1568
-
\??\c:\ttntnt.exec:\ttntnt.exe77⤵PID:2580
-
\??\c:\bbbbtb.exec:\bbbbtb.exe78⤵PID:2424
-
\??\c:\dppjj.exec:\dppjj.exe79⤵PID:2176
-
\??\c:\fxlrlxl.exec:\fxlrlxl.exe80⤵PID:2948
-
\??\c:\lflxrfr.exec:\lflxrfr.exe81⤵PID:1064
-
\??\c:\tnhnbn.exec:\tnhnbn.exe82⤵PID:1868
-
\??\c:\3nnhbn.exec:\3nnhbn.exe83⤵PID:2472
-
\??\c:\jvddj.exec:\jvddj.exe84⤵PID:2768
-
\??\c:\pjvpv.exec:\pjvpv.exe85⤵PID:1864
-
\??\c:\lfflllx.exec:\lfflllx.exe86⤵PID:1200
-
\??\c:\9flrflr.exec:\9flrflr.exe87⤵PID:1932
-
\??\c:\bttttt.exec:\bttttt.exe88⤵PID:1856
-
\??\c:\5hnbnn.exec:\5hnbnn.exe89⤵PID:584
-
\??\c:\pdjjv.exec:\pdjjv.exe90⤵PID:2916
-
\??\c:\jvvdp.exec:\jvvdp.exe91⤵PID:1444
-
\??\c:\frffflr.exec:\frffflr.exe92⤵PID:296
-
\??\c:\7tbbnn.exec:\7tbbnn.exe93⤵PID:2092
-
\??\c:\nhtbhn.exec:\nhtbhn.exe94⤵PID:1764
-
\??\c:\7djjp.exec:\7djjp.exe95⤵PID:3040
-
\??\c:\9dppv.exec:\9dppv.exe96⤵PID:2016
-
\??\c:\llrrxff.exec:\llrrxff.exe97⤵PID:2772
-
\??\c:\7xflxfl.exec:\7xflxfl.exe98⤵PID:2868
-
\??\c:\thttbh.exec:\thttbh.exe99⤵PID:1580
-
\??\c:\nnbhtn.exec:\nnbhtn.exe100⤵PID:1808
-
\??\c:\pvjpp.exec:\pvjpp.exe101⤵PID:1736
-
\??\c:\dpvdj.exec:\dpvdj.exe102⤵PID:1968
-
\??\c:\xlrllfx.exec:\xlrllfx.exe103⤵PID:1520
-
\??\c:\llflffx.exec:\llflffx.exe104⤵PID:2288
-
\??\c:\hbnbhh.exec:\hbnbhh.exe105⤵PID:1652
-
\??\c:\nhtbbh.exec:\nhtbbh.exe106⤵PID:1556
-
\??\c:\5hthtn.exec:\5hthtn.exe107⤵PID:2180
-
\??\c:\pdpvj.exec:\pdpvj.exe108⤵PID:1684
-
\??\c:\9rrxxff.exec:\9rrxxff.exe109⤵PID:1632
-
\??\c:\lxrxfxf.exec:\lxrxfxf.exe110⤵PID:3000
-
\??\c:\rlrrfff.exec:\rlrrfff.exe111⤵PID:1700
-
\??\c:\5tbhnn.exec:\5tbhnn.exe112⤵PID:2368
-
\??\c:\thnnhn.exec:\thnnhn.exe113⤵PID:2216
-
\??\c:\ddvpd.exec:\ddvpd.exe114⤵PID:2532
-
\??\c:\pjjjj.exec:\pjjjj.exe115⤵PID:2796
-
\??\c:\ddvdv.exec:\ddvdv.exe116⤵PID:2440
-
\??\c:\rfrrxlr.exec:\rfrrxlr.exe117⤵PID:2652
-
\??\c:\rllfrrx.exec:\rllfrrx.exe118⤵PID:2528
-
\??\c:\7nhhht.exec:\7nhhht.exe119⤵PID:2976
-
\??\c:\thnbhn.exec:\thnbhn.exe120⤵PID:1900
-
\??\c:\1dpdj.exec:\1dpdj.exe121⤵PID:1468
-
\??\c:\vjdvv.exec:\vjdvv.exe122⤵PID:2668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-