Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 12:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
37c29458daff98978480a1b7d9bd1e50N.exe
Resource
win7-20240705-en
windows7-x64
5 signatures
150 seconds
General
-
Target
37c29458daff98978480a1b7d9bd1e50N.exe
-
Size
94KB
-
MD5
37c29458daff98978480a1b7d9bd1e50
-
SHA1
28098756c1028aa58efc9edb987e45f78d66e177
-
SHA256
691723493e45bfea37d5f0370f46c4117808b84d2a1af1f4a494e51a273d66d8
-
SHA512
e7ecdccaff6b1c6e5370a3548aef4b979af2f9f7049d5dd8666fb17ee6b16c65bcaeeb797997ff92e35d04c5cf958dc22cfc84789ea639c54c13c5028413e76f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLuePjDYlR3hnjKXIQSe9oEYL:ymb3NkkiQ3mdBjFoLucjDilOZho5
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2456-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/748-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/992-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2100 lfrfllx.exe 2900 268084.exe 2404 26486.exe 2864 086682.exe 2608 tnbhtb.exe 2892 04246.exe 2736 lflrrrx.exe 2596 046446.exe 2688 080664.exe 2616 7lxflrf.exe 1972 xrlxxxf.exe 2536 0868828.exe 2948 vjpjj.exe 2924 48406.exe 2960 4484066.exe 1952 nbhhnn.exe 2480 m6406.exe 2488 jdjvv.exe 748 m8662.exe 1012 462022.exe 2232 2400000.exe 2936 dvpjp.exe 2680 dvdjp.exe 2208 80448.exe 992 1vjpv.exe 1048 jvjpv.exe 1828 jdvjp.exe 1488 w68800.exe 1772 lxlrrrx.exe 580 3jddj.exe 1072 6462840.exe 2264 2824008.exe 2900 frxxfxf.exe 2404 4428860.exe 2828 640644.exe 2708 hhtbtt.exe 1720 i862444.exe 2864 3nbnbb.exe 2940 a2002.exe 1208 nhnntb.exe 2652 bttnht.exe 2664 a4280.exe 2676 20228.exe 1696 7xrrxff.exe 2012 c288848.exe 2056 vppdv.exe 1972 dvpvj.exe 1100 xrxxffr.exe 1324 3pvvj.exe 3036 nnbhhn.exe 2276 82824.exe 2960 ttntnh.exe 2512 rlrlrrx.exe 1108 q86240.exe 956 k64640.exe 1704 80228.exe 748 hbhntb.exe 2084 w28804.exe 2700 nhnhnt.exe 2440 5jdpv.exe 2196 w86240.exe 1900 826844.exe 2308 3hbntt.exe 1736 rfrxxll.exe -
resource yara_rule behavioral1/memory/2456-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/748-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/992-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-286-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2456 wrote to memory of 2100 2456 37c29458daff98978480a1b7d9bd1e50N.exe 29 PID 2456 wrote to memory of 2100 2456 37c29458daff98978480a1b7d9bd1e50N.exe 29 PID 2456 wrote to memory of 2100 2456 37c29458daff98978480a1b7d9bd1e50N.exe 29 PID 2456 wrote to memory of 2100 2456 37c29458daff98978480a1b7d9bd1e50N.exe 29 PID 2100 wrote to memory of 2900 2100 lfrfllx.exe 30 PID 2100 wrote to memory of 2900 2100 lfrfllx.exe 30 PID 2100 wrote to memory of 2900 2100 lfrfllx.exe 30 PID 2100 wrote to memory of 2900 2100 lfrfllx.exe 30 PID 2900 wrote to memory of 2404 2900 268084.exe 31 PID 2900 wrote to memory of 2404 2900 268084.exe 31 PID 2900 wrote to memory of 2404 2900 268084.exe 31 PID 2900 wrote to memory of 2404 2900 268084.exe 31 PID 2404 wrote to memory of 2864 2404 26486.exe 32 PID 2404 wrote to memory of 2864 2404 26486.exe 32 PID 2404 wrote to memory of 2864 2404 26486.exe 32 PID 2404 wrote to memory of 2864 2404 26486.exe 32 PID 2864 wrote to memory of 2608 2864 086682.exe 33 PID 2864 wrote to memory of 2608 2864 086682.exe 33 PID 2864 wrote to memory of 2608 2864 086682.exe 33 PID 2864 wrote to memory of 2608 2864 086682.exe 33 PID 2608 wrote to memory of 2892 2608 tnbhtb.exe 34 PID 2608 wrote to memory of 2892 2608 tnbhtb.exe 34 PID 2608 wrote to memory of 2892 2608 tnbhtb.exe 34 PID 2608 wrote to memory of 2892 2608 tnbhtb.exe 34 PID 2892 wrote to memory of 2736 2892 04246.exe 35 PID 2892 wrote to memory of 2736 2892 04246.exe 35 PID 2892 wrote to memory of 2736 2892 04246.exe 35 PID 2892 wrote to memory of 2736 2892 04246.exe 35 PID 2736 wrote to memory of 2596 2736 lflrrrx.exe 36 PID 2736 wrote to memory of 2596 2736 lflrrrx.exe 36 PID 2736 wrote to memory of 2596 2736 lflrrrx.exe 36 PID 2736 wrote to memory of 2596 2736 lflrrrx.exe 36 PID 2596 wrote to memory of 2688 2596 046446.exe 37 PID 2596 wrote to memory of 2688 2596 046446.exe 37 PID 2596 wrote to memory of 2688 2596 046446.exe 37 PID 2596 wrote to memory of 2688 2596 046446.exe 37 PID 2688 wrote to memory of 2616 2688 080664.exe 38 PID 2688 wrote to memory of 2616 2688 080664.exe 38 PID 2688 wrote to memory of 2616 2688 080664.exe 38 PID 2688 wrote to memory of 2616 2688 080664.exe 38 PID 2616 wrote to memory of 1972 2616 7lxflrf.exe 39 PID 2616 wrote to memory of 1972 2616 7lxflrf.exe 39 PID 2616 wrote to memory of 1972 2616 7lxflrf.exe 39 PID 2616 wrote to memory of 1972 2616 7lxflrf.exe 39 PID 1972 wrote to memory of 2536 1972 xrlxxxf.exe 40 PID 1972 wrote to memory of 2536 1972 xrlxxxf.exe 40 PID 1972 wrote to memory of 2536 1972 xrlxxxf.exe 40 PID 1972 wrote to memory of 2536 1972 xrlxxxf.exe 40 PID 2536 wrote to memory of 2948 2536 0868828.exe 41 PID 2536 wrote to memory of 2948 2536 0868828.exe 41 PID 2536 wrote to memory of 2948 2536 0868828.exe 41 PID 2536 wrote to memory of 2948 2536 0868828.exe 41 PID 2948 wrote to memory of 2924 2948 vjpjj.exe 42 PID 2948 wrote to memory of 2924 2948 vjpjj.exe 42 PID 2948 wrote to memory of 2924 2948 vjpjj.exe 42 PID 2948 wrote to memory of 2924 2948 vjpjj.exe 42 PID 2924 wrote to memory of 2960 2924 48406.exe 43 PID 2924 wrote to memory of 2960 2924 48406.exe 43 PID 2924 wrote to memory of 2960 2924 48406.exe 43 PID 2924 wrote to memory of 2960 2924 48406.exe 43 PID 2960 wrote to memory of 1952 2960 4484066.exe 44 PID 2960 wrote to memory of 1952 2960 4484066.exe 44 PID 2960 wrote to memory of 1952 2960 4484066.exe 44 PID 2960 wrote to memory of 1952 2960 4484066.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\37c29458daff98978480a1b7d9bd1e50N.exe"C:\Users\Admin\AppData\Local\Temp\37c29458daff98978480a1b7d9bd1e50N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\lfrfllx.exec:\lfrfllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\268084.exec:\268084.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\26486.exec:\26486.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\086682.exec:\086682.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\tnbhtb.exec:\tnbhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\04246.exec:\04246.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\lflrrrx.exec:\lflrrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\046446.exec:\046446.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\080664.exec:\080664.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\7lxflrf.exec:\7lxflrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\xrlxxxf.exec:\xrlxxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\0868828.exec:\0868828.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\vjpjj.exec:\vjpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\48406.exec:\48406.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\4484066.exec:\4484066.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\nbhhnn.exec:\nbhhnn.exe17⤵
- Executes dropped EXE
PID:1952 -
\??\c:\m6406.exec:\m6406.exe18⤵
- Executes dropped EXE
PID:2480 -
\??\c:\jdjvv.exec:\jdjvv.exe19⤵
- Executes dropped EXE
PID:2488 -
\??\c:\m8662.exec:\m8662.exe20⤵
- Executes dropped EXE
PID:748 -
\??\c:\462022.exec:\462022.exe21⤵
- Executes dropped EXE
PID:1012 -
\??\c:\2400000.exec:\2400000.exe22⤵
- Executes dropped EXE
PID:2232 -
\??\c:\dvpjp.exec:\dvpjp.exe23⤵
- Executes dropped EXE
PID:2936 -
\??\c:\dvdjp.exec:\dvdjp.exe24⤵
- Executes dropped EXE
PID:2680 -
\??\c:\80448.exec:\80448.exe25⤵
- Executes dropped EXE
PID:2208 -
\??\c:\1vjpv.exec:\1vjpv.exe26⤵
- Executes dropped EXE
PID:992 -
\??\c:\jvjpv.exec:\jvjpv.exe27⤵
- Executes dropped EXE
PID:1048 -
\??\c:\jdvjp.exec:\jdvjp.exe28⤵
- Executes dropped EXE
PID:1828 -
\??\c:\w68800.exec:\w68800.exe29⤵
- Executes dropped EXE
PID:1488 -
\??\c:\lxlrrrx.exec:\lxlrrrx.exe30⤵
- Executes dropped EXE
PID:1772 -
\??\c:\3jddj.exec:\3jddj.exe31⤵
- Executes dropped EXE
PID:580 -
\??\c:\6462840.exec:\6462840.exe32⤵
- Executes dropped EXE
PID:1072 -
\??\c:\2824008.exec:\2824008.exe33⤵
- Executes dropped EXE
PID:2264 -
\??\c:\frxxfxf.exec:\frxxfxf.exe34⤵
- Executes dropped EXE
PID:2900 -
\??\c:\4428860.exec:\4428860.exe35⤵
- Executes dropped EXE
PID:2404 -
\??\c:\640644.exec:\640644.exe36⤵
- Executes dropped EXE
PID:2828 -
\??\c:\hhtbtt.exec:\hhtbtt.exe37⤵
- Executes dropped EXE
PID:2708 -
\??\c:\i862444.exec:\i862444.exe38⤵
- Executes dropped EXE
PID:1720 -
\??\c:\3nbnbb.exec:\3nbnbb.exe39⤵
- Executes dropped EXE
PID:2864 -
\??\c:\a2002.exec:\a2002.exe40⤵
- Executes dropped EXE
PID:2940 -
\??\c:\nhnntb.exec:\nhnntb.exe41⤵
- Executes dropped EXE
PID:1208 -
\??\c:\bttnht.exec:\bttnht.exe42⤵
- Executes dropped EXE
PID:2652 -
\??\c:\a4280.exec:\a4280.exe43⤵
- Executes dropped EXE
PID:2664 -
\??\c:\20228.exec:\20228.exe44⤵
- Executes dropped EXE
PID:2676 -
\??\c:\7xrrxff.exec:\7xrrxff.exe45⤵
- Executes dropped EXE
PID:1696 -
\??\c:\c288848.exec:\c288848.exe46⤵
- Executes dropped EXE
PID:2012 -
\??\c:\vppdv.exec:\vppdv.exe47⤵
- Executes dropped EXE
PID:2056 -
\??\c:\dvpvj.exec:\dvpvj.exe48⤵
- Executes dropped EXE
PID:1972 -
\??\c:\xrxxffr.exec:\xrxxffr.exe49⤵
- Executes dropped EXE
PID:1100 -
\??\c:\3pvvj.exec:\3pvvj.exe50⤵
- Executes dropped EXE
PID:1324 -
\??\c:\nnbhhn.exec:\nnbhhn.exe51⤵
- Executes dropped EXE
PID:3036 -
\??\c:\82824.exec:\82824.exe52⤵
- Executes dropped EXE
PID:2276 -
\??\c:\ttntnh.exec:\ttntnh.exe53⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe54⤵
- Executes dropped EXE
PID:2512 -
\??\c:\q86240.exec:\q86240.exe55⤵
- Executes dropped EXE
PID:1108 -
\??\c:\k64640.exec:\k64640.exe56⤵
- Executes dropped EXE
PID:956 -
\??\c:\80228.exec:\80228.exe57⤵
- Executes dropped EXE
PID:1704 -
\??\c:\hbhntb.exec:\hbhntb.exe58⤵
- Executes dropped EXE
PID:748 -
\??\c:\w28804.exec:\w28804.exe59⤵
- Executes dropped EXE
PID:2084 -
\??\c:\nhnhnt.exec:\nhnhnt.exe60⤵
- Executes dropped EXE
PID:2700 -
\??\c:\5jdpv.exec:\5jdpv.exe61⤵
- Executes dropped EXE
PID:2440 -
\??\c:\w86240.exec:\w86240.exe62⤵
- Executes dropped EXE
PID:2196 -
\??\c:\826844.exec:\826844.exe63⤵
- Executes dropped EXE
PID:1900 -
\??\c:\3hbntt.exec:\3hbntt.exe64⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rfrxxll.exec:\rfrxxll.exe65⤵
- Executes dropped EXE
PID:1736 -
\??\c:\s4060.exec:\s4060.exe66⤵PID:1048
-
\??\c:\a2468.exec:\a2468.exe67⤵PID:1096
-
\??\c:\fxllrxl.exec:\fxllrxl.exe68⤵PID:1828
-
\??\c:\9dpvd.exec:\9dpvd.exe69⤵PID:1044
-
\??\c:\82064.exec:\82064.exe70⤵PID:2028
-
\??\c:\tntthn.exec:\tntthn.exe71⤵PID:860
-
\??\c:\bhtbnt.exec:\bhtbnt.exe72⤵PID:2472
-
\??\c:\e80000.exec:\e80000.exe73⤵PID:1944
-
\??\c:\22644.exec:\22644.exe74⤵PID:1968
-
\??\c:\k08466.exec:\k08466.exe75⤵PID:2288
-
\??\c:\0426444.exec:\0426444.exe76⤵PID:2748
-
\??\c:\4240602.exec:\4240602.exe77⤵PID:1620
-
\??\c:\42406.exec:\42406.exe78⤵PID:2840
-
\??\c:\1htbnt.exec:\1htbnt.exe79⤵PID:1720
-
\??\c:\1jpjj.exec:\1jpjj.exe80⤵PID:2864
-
\??\c:\vjvvp.exec:\vjvvp.exe81⤵PID:2940
-
\??\c:\thhbnn.exec:\thhbnn.exe82⤵PID:2816
-
\??\c:\btbhhb.exec:\btbhhb.exe83⤵PID:2656
-
\??\c:\s2828.exec:\s2828.exe84⤵PID:2248
-
\??\c:\nnthbn.exec:\nnthbn.exe85⤵PID:2052
-
\??\c:\9lrrflx.exec:\9lrrflx.exe86⤵PID:1552
-
\??\c:\lfrxlrx.exec:\lfrxlrx.exe87⤵PID:1644
-
\??\c:\1dvvd.exec:\1dvvd.exe88⤵PID:2332
-
\??\c:\9bttbb.exec:\9bttbb.exe89⤵PID:2640
-
\??\c:\llrrllf.exec:\llrrllf.exe90⤵PID:564
-
\??\c:\u862282.exec:\u862282.exe91⤵PID:2984
-
\??\c:\e02848.exec:\e02848.exe92⤵PID:2272
-
\??\c:\nbhnbh.exec:\nbhnbh.exe93⤵PID:1952
-
\??\c:\frrlrlr.exec:\frrlrlr.exe94⤵PID:2972
-
\??\c:\1rffffl.exec:\1rffffl.exe95⤵PID:2568
-
\??\c:\dppdp.exec:\dppdp.exe96⤵PID:1692
-
\??\c:\5llxfxx.exec:\5llxfxx.exe97⤵PID:1068
-
\??\c:\3jvjp.exec:\3jvjp.exe98⤵PID:1704
-
\??\c:\xfffrxx.exec:\xfffrxx.exe99⤵PID:2408
-
\??\c:\xllflll.exec:\xllflll.exe100⤵PID:2876
-
\??\c:\24068.exec:\24068.exe101⤵PID:2444
-
\??\c:\tnbhtn.exec:\tnbhtn.exe102⤵PID:2416
-
\??\c:\8246280.exec:\8246280.exe103⤵PID:2788
-
\??\c:\xlfrrxx.exec:\xlfrrxx.exe104⤵PID:864
-
\??\c:\hbhhnt.exec:\hbhhnt.exe105⤵PID:2308
-
\??\c:\606468.exec:\606468.exe106⤵PID:688
-
\??\c:\4284628.exec:\4284628.exe107⤵PID:1820
-
\??\c:\ppddj.exec:\ppddj.exe108⤵PID:1096
-
\??\c:\646022.exec:\646022.exe109⤵PID:1980
-
\??\c:\5lrffxf.exec:\5lrffxf.exe110⤵PID:2032
-
\??\c:\6080008.exec:\6080008.exe111⤵PID:1888
-
\??\c:\7nnnnt.exec:\7nnnnt.exe112⤵PID:2200
-
\??\c:\2666606.exec:\2666606.exe113⤵PID:1920
-
\??\c:\422682.exec:\422682.exe114⤵PID:1688
-
\??\c:\i040880.exec:\i040880.exe115⤵PID:1968
-
\??\c:\5flrxxf.exec:\5flrxxf.exe116⤵PID:1716
-
\??\c:\rflrrrx.exec:\rflrrrx.exe117⤵PID:1584
-
\??\c:\3xllllr.exec:\3xllllr.exe118⤵PID:2240
-
\??\c:\w80626.exec:\w80626.exe119⤵PID:2804
-
\??\c:\w06860.exec:\w06860.exe120⤵PID:2624
-
\??\c:\rflxfxx.exec:\rflxfxx.exe121⤵PID:2764
-
\??\c:\8624062.exec:\8624062.exe122⤵PID:2712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-