Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 04:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
296e5dd8e88e5755ef56d38c72b77a50N.exe
Resource
win7-20240705-en
windows7-x64
5 signatures
150 seconds
General
-
Target
296e5dd8e88e5755ef56d38c72b77a50N.exe
-
Size
75KB
-
MD5
296e5dd8e88e5755ef56d38c72b77a50
-
SHA1
3b6047ef632279b191ef13c9875c195e29271575
-
SHA256
89af54504034535d5de80f28b00522b96ba18fa7b20d2d63626f835f334de5b0
-
SHA512
a638d922c9656485708a1cf371c801cba896c6eb3be0c28547209ef9899fc7b3c3948be1dad1c9bbc906f538dbf4d745eaefa2691fac16b5d8e6f6c52535fce1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfv7+afCD+QsQbKQPEU:ymb3NkkiQ3mdBjFIfvTfCD+HlQcU
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/3016-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1248-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1116-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1868-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2164 nnhthh.exe 1028 jddvj.exe 2308 djdjp.exe 2060 rlxlffl.exe 2864 hbbhtt.exe 2736 pjppv.exe 2820 lrxlrrf.exe 2768 1lflxlx.exe 2616 nnhbnh.exe 3060 jpjpv.exe 1744 xllxxxr.exe 284 bbhnhn.exe 1248 djjdv.exe 264 xrfrflx.exe 2000 3hbbtb.exe 600 dvdjv.exe 1624 3pjjp.exe 2944 nhtbnh.exe 2916 tbttbb.exe 2212 jdvjd.exe 3044 rxffffr.exe 1116 3rxxrfx.exe 2320 bnnbbn.exe 2988 jvvjd.exe 1736 lrllxlx.exe 1012 nnbttn.exe 2052 dvjdp.exe 1788 frllrlx.exe 1868 fxrffrr.exe 2160 3bhbtb.exe 2316 ttttnt.exe 2152 pjvdp.exe 2168 ttntbt.exe 2956 3vpdj.exe 1604 pdjpd.exe 2288 fflffxr.exe 2708 rlfrfrr.exe 2868 hhhbhb.exe 2824 jjpvv.exe 2720 jvdjp.exe 3040 xrllrrf.exe 2880 llxxfll.exe 2648 hhbhhn.exe 2680 1pjpp.exe 2616 rlxrxrf.exe 2004 ttttbt.exe 1232 thtnht.exe 2664 djvpv.exe 1424 rrrxllf.exe 380 vjdvj.exe 2132 ppjvv.exe 1076 lfxfrlx.exe 1416 lllxxll.exe 1160 htnnhb.exe 2704 9pvdv.exe 2228 xxllffx.exe 1796 9ntnhh.exe 2476 nhbhht.exe 552 pjppv.exe 1920 lxxrllx.exe 2784 xxrlxlf.exe 2320 9hhttb.exe 2472 pdjpd.exe 996 flllfrl.exe -
resource yara_rule behavioral1/memory/3016-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1248-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1116-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1868-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-295-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2164 3016 296e5dd8e88e5755ef56d38c72b77a50N.exe 30 PID 3016 wrote to memory of 2164 3016 296e5dd8e88e5755ef56d38c72b77a50N.exe 30 PID 3016 wrote to memory of 2164 3016 296e5dd8e88e5755ef56d38c72b77a50N.exe 30 PID 3016 wrote to memory of 2164 3016 296e5dd8e88e5755ef56d38c72b77a50N.exe 30 PID 2164 wrote to memory of 1028 2164 nnhthh.exe 31 PID 2164 wrote to memory of 1028 2164 nnhthh.exe 31 PID 2164 wrote to memory of 1028 2164 nnhthh.exe 31 PID 2164 wrote to memory of 1028 2164 nnhthh.exe 31 PID 1028 wrote to memory of 2308 1028 jddvj.exe 32 PID 1028 wrote to memory of 2308 1028 jddvj.exe 32 PID 1028 wrote to memory of 2308 1028 jddvj.exe 32 PID 1028 wrote to memory of 2308 1028 jddvj.exe 32 PID 2308 wrote to memory of 2060 2308 djdjp.exe 33 PID 2308 wrote to memory of 2060 2308 djdjp.exe 33 PID 2308 wrote to memory of 2060 2308 djdjp.exe 33 PID 2308 wrote to memory of 2060 2308 djdjp.exe 33 PID 2060 wrote to memory of 2864 2060 rlxlffl.exe 34 PID 2060 wrote to memory of 2864 2060 rlxlffl.exe 34 PID 2060 wrote to memory of 2864 2060 rlxlffl.exe 34 PID 2060 wrote to memory of 2864 2060 rlxlffl.exe 34 PID 2864 wrote to memory of 2736 2864 hbbhtt.exe 35 PID 2864 wrote to memory of 2736 2864 hbbhtt.exe 35 PID 2864 wrote to memory of 2736 2864 hbbhtt.exe 35 PID 2864 wrote to memory of 2736 2864 hbbhtt.exe 35 PID 2736 wrote to memory of 2820 2736 pjppv.exe 36 PID 2736 wrote to memory of 2820 2736 pjppv.exe 36 PID 2736 wrote to memory of 2820 2736 pjppv.exe 36 PID 2736 wrote to memory of 2820 2736 pjppv.exe 36 PID 2820 wrote to memory of 2768 2820 lrxlrrf.exe 37 PID 2820 wrote to memory of 2768 2820 lrxlrrf.exe 37 PID 2820 wrote to memory of 2768 2820 lrxlrrf.exe 37 PID 2820 wrote to memory of 2768 2820 lrxlrrf.exe 37 PID 2768 wrote to memory of 2616 2768 1lflxlx.exe 38 PID 2768 wrote to memory of 2616 2768 1lflxlx.exe 38 PID 2768 wrote to memory of 2616 2768 1lflxlx.exe 38 PID 2768 wrote to memory of 2616 2768 1lflxlx.exe 38 PID 2616 wrote to memory of 3060 2616 nnhbnh.exe 39 PID 2616 wrote to memory of 3060 2616 nnhbnh.exe 39 PID 2616 wrote to memory of 3060 2616 nnhbnh.exe 39 PID 2616 wrote to memory of 3060 2616 nnhbnh.exe 39 PID 3060 wrote to memory of 1744 3060 jpjpv.exe 40 PID 3060 wrote to memory of 1744 3060 jpjpv.exe 40 PID 3060 wrote to memory of 1744 3060 jpjpv.exe 40 PID 3060 wrote to memory of 1744 3060 jpjpv.exe 40 PID 1744 wrote to memory of 284 1744 xllxxxr.exe 41 PID 1744 wrote to memory of 284 1744 xllxxxr.exe 41 PID 1744 wrote to memory of 284 1744 xllxxxr.exe 41 PID 1744 wrote to memory of 284 1744 xllxxxr.exe 41 PID 284 wrote to memory of 1248 284 bbhnhn.exe 42 PID 284 wrote to memory of 1248 284 bbhnhn.exe 42 PID 284 wrote to memory of 1248 284 bbhnhn.exe 42 PID 284 wrote to memory of 1248 284 bbhnhn.exe 42 PID 1248 wrote to memory of 264 1248 djjdv.exe 43 PID 1248 wrote to memory of 264 1248 djjdv.exe 43 PID 1248 wrote to memory of 264 1248 djjdv.exe 43 PID 1248 wrote to memory of 264 1248 djjdv.exe 43 PID 264 wrote to memory of 2000 264 xrfrflx.exe 44 PID 264 wrote to memory of 2000 264 xrfrflx.exe 44 PID 264 wrote to memory of 2000 264 xrfrflx.exe 44 PID 264 wrote to memory of 2000 264 xrfrflx.exe 44 PID 2000 wrote to memory of 600 2000 3hbbtb.exe 45 PID 2000 wrote to memory of 600 2000 3hbbtb.exe 45 PID 2000 wrote to memory of 600 2000 3hbbtb.exe 45 PID 2000 wrote to memory of 600 2000 3hbbtb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\296e5dd8e88e5755ef56d38c72b77a50N.exe"C:\Users\Admin\AppData\Local\Temp\296e5dd8e88e5755ef56d38c72b77a50N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\nnhthh.exec:\nnhthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\jddvj.exec:\jddvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\djdjp.exec:\djdjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\rlxlffl.exec:\rlxlffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\hbbhtt.exec:\hbbhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\pjppv.exec:\pjppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\lrxlrrf.exec:\lrxlrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\1lflxlx.exec:\1lflxlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\nnhbnh.exec:\nnhbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\jpjpv.exec:\jpjpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\xllxxxr.exec:\xllxxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\bbhnhn.exec:\bbhnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:284 -
\??\c:\djjdv.exec:\djjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\xrfrflx.exec:\xrfrflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\3hbbtb.exec:\3hbbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\dvdjv.exec:\dvdjv.exe17⤵
- Executes dropped EXE
PID:600 -
\??\c:\3pjjp.exec:\3pjjp.exe18⤵
- Executes dropped EXE
PID:1624 -
\??\c:\nhtbnh.exec:\nhtbnh.exe19⤵
- Executes dropped EXE
PID:2944 -
\??\c:\tbttbb.exec:\tbttbb.exe20⤵
- Executes dropped EXE
PID:2916 -
\??\c:\jdvjd.exec:\jdvjd.exe21⤵
- Executes dropped EXE
PID:2212 -
\??\c:\rxffffr.exec:\rxffffr.exe22⤵
- Executes dropped EXE
PID:3044 -
\??\c:\3rxxrfx.exec:\3rxxrfx.exe23⤵
- Executes dropped EXE
PID:1116 -
\??\c:\bnnbbn.exec:\bnnbbn.exe24⤵
- Executes dropped EXE
PID:2320 -
\??\c:\jvvjd.exec:\jvvjd.exe25⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lrllxlx.exec:\lrllxlx.exe26⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nnbttn.exec:\nnbttn.exe27⤵
- Executes dropped EXE
PID:1012 -
\??\c:\dvjdp.exec:\dvjdp.exe28⤵
- Executes dropped EXE
PID:2052 -
\??\c:\frllrlx.exec:\frllrlx.exe29⤵
- Executes dropped EXE
PID:1788 -
\??\c:\fxrffrr.exec:\fxrffrr.exe30⤵
- Executes dropped EXE
PID:1868 -
\??\c:\3bhbtb.exec:\3bhbtb.exe31⤵
- Executes dropped EXE
PID:2160 -
\??\c:\ttttnt.exec:\ttttnt.exe32⤵
- Executes dropped EXE
PID:2316 -
\??\c:\pjvdp.exec:\pjvdp.exe33⤵
- Executes dropped EXE
PID:2152 -
\??\c:\ttntbt.exec:\ttntbt.exe34⤵
- Executes dropped EXE
PID:2168 -
\??\c:\3vpdj.exec:\3vpdj.exe35⤵
- Executes dropped EXE
PID:2956 -
\??\c:\pdjpd.exec:\pdjpd.exe36⤵
- Executes dropped EXE
PID:1604 -
\??\c:\fflffxr.exec:\fflffxr.exe37⤵
- Executes dropped EXE
PID:2288 -
\??\c:\rlfrfrr.exec:\rlfrfrr.exe38⤵
- Executes dropped EXE
PID:2708 -
\??\c:\hhhbhb.exec:\hhhbhb.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\jjpvv.exec:\jjpvv.exe40⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jvdjp.exec:\jvdjp.exe41⤵
- Executes dropped EXE
PID:2720 -
\??\c:\xrllrrf.exec:\xrllrrf.exe42⤵
- Executes dropped EXE
PID:3040 -
\??\c:\llxxfll.exec:\llxxfll.exe43⤵
- Executes dropped EXE
PID:2880 -
\??\c:\hhbhhn.exec:\hhbhhn.exe44⤵
- Executes dropped EXE
PID:2648 -
\??\c:\1pjpp.exec:\1pjpp.exe45⤵
- Executes dropped EXE
PID:2680 -
\??\c:\rlxrxrf.exec:\rlxrxrf.exe46⤵
- Executes dropped EXE
PID:2616 -
\??\c:\ttttbt.exec:\ttttbt.exe47⤵
- Executes dropped EXE
PID:2004 -
\??\c:\thtnht.exec:\thtnht.exe48⤵
- Executes dropped EXE
PID:1232 -
\??\c:\djvpv.exec:\djvpv.exe49⤵
- Executes dropped EXE
PID:2664 -
\??\c:\rrrxllf.exec:\rrrxllf.exe50⤵
- Executes dropped EXE
PID:1424 -
\??\c:\vjdvj.exec:\vjdvj.exe51⤵
- Executes dropped EXE
PID:380 -
\??\c:\ppjvv.exec:\ppjvv.exe52⤵
- Executes dropped EXE
PID:2132 -
\??\c:\lfxfrlx.exec:\lfxfrlx.exe53⤵
- Executes dropped EXE
PID:1076 -
\??\c:\lllxxll.exec:\lllxxll.exe54⤵
- Executes dropped EXE
PID:1416 -
\??\c:\htnnhb.exec:\htnnhb.exe55⤵
- Executes dropped EXE
PID:1160 -
\??\c:\9pvdv.exec:\9pvdv.exe56⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xxllffx.exec:\xxllffx.exe57⤵
- Executes dropped EXE
PID:2228 -
\??\c:\9ntnhh.exec:\9ntnhh.exe58⤵
- Executes dropped EXE
PID:1796 -
\??\c:\nhbhht.exec:\nhbhht.exe59⤵
- Executes dropped EXE
PID:2476 -
\??\c:\pjppv.exec:\pjppv.exe60⤵
- Executes dropped EXE
PID:552 -
\??\c:\lxxrllx.exec:\lxxrllx.exe61⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xxrlxlf.exec:\xxrlxlf.exe62⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9hhttb.exec:\9hhttb.exe63⤵
- Executes dropped EXE
PID:2320 -
\??\c:\pdjpd.exec:\pdjpd.exe64⤵
- Executes dropped EXE
PID:2472 -
\??\c:\flllfrl.exec:\flllfrl.exe65⤵
- Executes dropped EXE
PID:996 -
\??\c:\vvvpv.exec:\vvvpv.exe66⤵PID:2464
-
\??\c:\vdppv.exec:\vdppv.exe67⤵PID:1844
-
\??\c:\lrxrxxf.exec:\lrxrxxf.exe68⤵PID:2432
-
\??\c:\bbbtbt.exec:\bbbtbt.exe69⤵PID:2064
-
\??\c:\djjjj.exec:\djjjj.exe70⤵PID:308
-
\??\c:\fxffxll.exec:\fxffxll.exe71⤵PID:1828
-
\??\c:\hhhbnh.exec:\hhhbnh.exe72⤵PID:3024
-
\??\c:\jjvvv.exec:\jjvvv.exe73⤵PID:2508
-
\??\c:\vjvpp.exec:\vjvpp.exe74⤵PID:2688
-
\??\c:\rfxlflx.exec:\rfxlflx.exe75⤵PID:2892
-
\??\c:\7nhhtb.exec:\7nhhtb.exe76⤵PID:2244
-
\??\c:\hthbbt.exec:\hthbbt.exe77⤵PID:1604
-
\??\c:\djpjj.exec:\djpjj.exe78⤵PID:2832
-
\??\c:\rlrxrxr.exec:\rlrxrxr.exe79⤵PID:2760
-
\??\c:\9bbhhn.exec:\9bbhhn.exe80⤵PID:2864
-
\??\c:\pjddv.exec:\pjddv.exe81⤵PID:2636
-
\??\c:\dvjjv.exec:\dvjjv.exe82⤵PID:2624
-
\??\c:\lxrflll.exec:\lxrflll.exe83⤵PID:2776
-
\??\c:\hbnbnn.exec:\hbnbnn.exe84⤵PID:2632
-
\??\c:\9nhnnb.exec:\9nhnnb.exe85⤵PID:2304
-
\??\c:\vdddp.exec:\vdddp.exe86⤵PID:1660
-
\??\c:\lxlffrr.exec:\lxlffrr.exe87⤵PID:2424
-
\??\c:\tthbbb.exec:\tthbbb.exe88⤵PID:304
-
\??\c:\bnbntb.exec:\bnbntb.exe89⤵PID:2420
-
\??\c:\pvvpv.exec:\pvvpv.exe90⤵PID:1248
-
\??\c:\ffllffr.exec:\ffllffr.exe91⤵PID:664
-
\??\c:\nbhnbb.exec:\nbhnbb.exe92⤵PID:764
-
\??\c:\hnthhb.exec:\hnthhb.exe93⤵PID:1928
-
\??\c:\7djdj.exec:\7djdj.exe94⤵PID:2852
-
\??\c:\ffxxxrf.exec:\ffxxxrf.exe95⤵PID:2692
-
\??\c:\nnthnb.exec:\nnthnb.exe96⤵PID:1764
-
\??\c:\btbhtb.exec:\btbhtb.exe97⤵PID:2700
-
\??\c:\7vvdv.exec:\7vvdv.exe98⤵PID:1532
-
\??\c:\llrrflr.exec:\llrrflr.exe99⤵PID:1692
-
\??\c:\3rxffll.exec:\3rxffll.exe100⤵PID:3028
-
\??\c:\bntnbn.exec:\bntnbn.exe101⤵PID:448
-
\??\c:\vjjvd.exec:\vjjvd.exe102⤵PID:2580
-
\??\c:\rxlfxrr.exec:\rxlfxrr.exe103⤵PID:1336
-
\??\c:\tttthh.exec:\tttthh.exe104⤵PID:1864
-
\??\c:\3bhnht.exec:\3bhnht.exe105⤵PID:1880
-
\??\c:\pjjdv.exec:\pjjdv.exe106⤵PID:2332
-
\??\c:\rrrffff.exec:\rrrffff.exe107⤵PID:2464
-
\??\c:\1nttht.exec:\1nttht.exe108⤵PID:884
-
\??\c:\vjvdj.exec:\vjvdj.exe109⤵PID:628
-
\??\c:\jvvvd.exec:\jvvvd.exe110⤵PID:2480
-
\??\c:\5xffflf.exec:\5xffflf.exe111⤵PID:2392
-
\??\c:\flxxrlr.exec:\flxxrlr.exe112⤵PID:1976
-
\??\c:\nntttn.exec:\nntttn.exe113⤵PID:3024
-
\??\c:\9tnbtt.exec:\9tnbtt.exe114⤵PID:2408
-
\??\c:\vvjdp.exec:\vvjdp.exe115⤵PID:1668
-
\??\c:\fllrrrl.exec:\fllrrrl.exe116⤵PID:2888
-
\??\c:\tbttnb.exec:\tbttnb.exe117⤵PID:1780
-
\??\c:\bbhntt.exec:\bbhntt.exe118⤵PID:1604
-
\??\c:\vjpvj.exec:\vjpvj.exe119⤵PID:2972
-
\??\c:\fxllrrl.exec:\fxllrrl.exe120⤵PID:2748
-
\??\c:\hnbhbn.exec:\hnbhbn.exe121⤵PID:2904
-
\??\c:\nnttnb.exec:\nnttnb.exe122⤵PID:2636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-