Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 02:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
31796bcd14dd04f9bea0103d42898750N.exe
Resource
win7-20240708-en
5 signatures
120 seconds
General
-
Target
31796bcd14dd04f9bea0103d42898750N.exe
-
Size
72KB
-
MD5
31796bcd14dd04f9bea0103d42898750
-
SHA1
2d7cc1cc45af53adaf89eedaae26fb15fc65eb45
-
SHA256
69b6b4b694d571546315401d5fc9fb6a3e24df6ecca152e2568e84916d7ab180
-
SHA512
ce58763be0b5f7d6889a3e8d25a9974fd3246750f61b5c81f0e615118a345e4609c486ef163348360b6666c914471cadb9b1fad602089e7c8bbf32d39b579964
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7tAHEqSCkKWy:ymb3NkkiQ3mdBjFIynIKh
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2416-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-88-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/568-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2416 7fxxrlf.exe 3044 tnnhth.exe 2968 xlflfrl.exe 2460 flrrrll.exe 2820 nnntbb.exe 1796 vvpdj.exe 2632 5rllxfl.exe 1668 hbhhnt.exe 2648 7jdjp.exe 2300 vpvvv.exe 2352 1rflrrx.exe 2692 1ththn.exe 1624 9nhhnn.exe 840 dvppp.exe 2024 jjvjp.exe 1660 xfrlxrx.exe 1804 nnbhnb.exe 2932 1tbntn.exe 2220 pjvdp.exe 2124 jdjjd.exe 2540 9rrrllx.exe 2056 bthhnt.exe 2784 pjpjv.exe 1616 vpvvd.exe 1012 xrrlrrx.exe 2052 hbhnnt.exe 568 hhtbhh.exe 1264 9jddv.exe 1672 pjdjp.exe 1224 rflrrrx.exe 2096 nnhtnt.exe 1596 9hbhnt.exe 2200 pjjvd.exe 2120 xrxllrr.exe 2792 nbnnnt.exe 804 hhbhnn.exe 2824 dpddd.exe 2748 9dvdp.exe 2980 lxfxxxx.exe 2764 9xlrxff.exe 2976 9nnbnn.exe 2892 9tbnnt.exe 2856 vpjjp.exe 1668 vjpjj.exe 2332 rlrxxff.exe 1764 9lrfrrr.exe 856 hbnhhh.exe 2904 nhttbb.exe 2692 pjppp.exe 1120 pjppv.exe 2672 xrrxrxl.exe 492 3lffllf.exe 1048 lfrffrx.exe 1660 1bbhbt.exe 3056 htnhht.exe 1948 jvvvj.exe 1084 jjvdd.exe 2644 rrflffr.exe 2288 rrfxxrx.exe 1132 tnhthh.exe 2468 hbttbh.exe 1080 9vjpp.exe 900 ddddj.exe 2504 vvvdp.exe -
resource yara_rule behavioral1/memory/2416-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1264-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-304-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1572 wrote to memory of 2416 1572 31796bcd14dd04f9bea0103d42898750N.exe 30 PID 1572 wrote to memory of 2416 1572 31796bcd14dd04f9bea0103d42898750N.exe 30 PID 1572 wrote to memory of 2416 1572 31796bcd14dd04f9bea0103d42898750N.exe 30 PID 1572 wrote to memory of 2416 1572 31796bcd14dd04f9bea0103d42898750N.exe 30 PID 2416 wrote to memory of 3044 2416 7fxxrlf.exe 31 PID 2416 wrote to memory of 3044 2416 7fxxrlf.exe 31 PID 2416 wrote to memory of 3044 2416 7fxxrlf.exe 31 PID 2416 wrote to memory of 3044 2416 7fxxrlf.exe 31 PID 3044 wrote to memory of 2968 3044 tnnhth.exe 32 PID 3044 wrote to memory of 2968 3044 tnnhth.exe 32 PID 3044 wrote to memory of 2968 3044 tnnhth.exe 32 PID 3044 wrote to memory of 2968 3044 tnnhth.exe 32 PID 2968 wrote to memory of 2460 2968 xlflfrl.exe 33 PID 2968 wrote to memory of 2460 2968 xlflfrl.exe 33 PID 2968 wrote to memory of 2460 2968 xlflfrl.exe 33 PID 2968 wrote to memory of 2460 2968 xlflfrl.exe 33 PID 2460 wrote to memory of 2820 2460 flrrrll.exe 34 PID 2460 wrote to memory of 2820 2460 flrrrll.exe 34 PID 2460 wrote to memory of 2820 2460 flrrrll.exe 34 PID 2460 wrote to memory of 2820 2460 flrrrll.exe 34 PID 2820 wrote to memory of 1796 2820 nnntbb.exe 35 PID 2820 wrote to memory of 1796 2820 nnntbb.exe 35 PID 2820 wrote to memory of 1796 2820 nnntbb.exe 35 PID 2820 wrote to memory of 1796 2820 nnntbb.exe 35 PID 1796 wrote to memory of 2632 1796 vvpdj.exe 36 PID 1796 wrote to memory of 2632 1796 vvpdj.exe 36 PID 1796 wrote to memory of 2632 1796 vvpdj.exe 36 PID 1796 wrote to memory of 2632 1796 vvpdj.exe 36 PID 2632 wrote to memory of 1668 2632 5rllxfl.exe 37 PID 2632 wrote to memory of 1668 2632 5rllxfl.exe 37 PID 2632 wrote to memory of 1668 2632 5rllxfl.exe 37 PID 2632 wrote to memory of 1668 2632 5rllxfl.exe 37 PID 1668 wrote to memory of 2648 1668 hbhhnt.exe 38 PID 1668 wrote to memory of 2648 1668 hbhhnt.exe 38 PID 1668 wrote to memory of 2648 1668 hbhhnt.exe 38 PID 1668 wrote to memory of 2648 1668 hbhhnt.exe 38 PID 2648 wrote to memory of 2300 2648 7jdjp.exe 39 PID 2648 wrote to memory of 2300 2648 7jdjp.exe 39 PID 2648 wrote to memory of 2300 2648 7jdjp.exe 39 PID 2648 wrote to memory of 2300 2648 7jdjp.exe 39 PID 2300 wrote to memory of 2352 2300 vpvvv.exe 40 PID 2300 wrote to memory of 2352 2300 vpvvv.exe 40 PID 2300 wrote to memory of 2352 2300 vpvvv.exe 40 PID 2300 wrote to memory of 2352 2300 vpvvv.exe 40 PID 2352 wrote to memory of 2692 2352 1rflrrx.exe 41 PID 2352 wrote to memory of 2692 2352 1rflrrx.exe 41 PID 2352 wrote to memory of 2692 2352 1rflrrx.exe 41 PID 2352 wrote to memory of 2692 2352 1rflrrx.exe 41 PID 2692 wrote to memory of 1624 2692 1ththn.exe 42 PID 2692 wrote to memory of 1624 2692 1ththn.exe 42 PID 2692 wrote to memory of 1624 2692 1ththn.exe 42 PID 2692 wrote to memory of 1624 2692 1ththn.exe 42 PID 1624 wrote to memory of 840 1624 9nhhnn.exe 43 PID 1624 wrote to memory of 840 1624 9nhhnn.exe 43 PID 1624 wrote to memory of 840 1624 9nhhnn.exe 43 PID 1624 wrote to memory of 840 1624 9nhhnn.exe 43 PID 840 wrote to memory of 2024 840 dvppp.exe 44 PID 840 wrote to memory of 2024 840 dvppp.exe 44 PID 840 wrote to memory of 2024 840 dvppp.exe 44 PID 840 wrote to memory of 2024 840 dvppp.exe 44 PID 2024 wrote to memory of 1660 2024 jjvjp.exe 45 PID 2024 wrote to memory of 1660 2024 jjvjp.exe 45 PID 2024 wrote to memory of 1660 2024 jjvjp.exe 45 PID 2024 wrote to memory of 1660 2024 jjvjp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\31796bcd14dd04f9bea0103d42898750N.exe"C:\Users\Admin\AppData\Local\Temp\31796bcd14dd04f9bea0103d42898750N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\7fxxrlf.exec:\7fxxrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\tnnhth.exec:\tnnhth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\xlflfrl.exec:\xlflfrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\flrrrll.exec:\flrrrll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\nnntbb.exec:\nnntbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\vvpdj.exec:\vvpdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\5rllxfl.exec:\5rllxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\hbhhnt.exec:\hbhhnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\7jdjp.exec:\7jdjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\vpvvv.exec:\vpvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\1rflrrx.exec:\1rflrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\1ththn.exec:\1ththn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\9nhhnn.exec:\9nhhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\dvppp.exec:\dvppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\jjvjp.exec:\jjvjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\xfrlxrx.exec:\xfrlxrx.exe17⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nnbhnb.exec:\nnbhnb.exe18⤵
- Executes dropped EXE
PID:1804 -
\??\c:\1tbntn.exec:\1tbntn.exe19⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pjvdp.exec:\pjvdp.exe20⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jdjjd.exec:\jdjjd.exe21⤵
- Executes dropped EXE
PID:2124 -
\??\c:\9rrrllx.exec:\9rrrllx.exe22⤵
- Executes dropped EXE
PID:2540 -
\??\c:\bthhnt.exec:\bthhnt.exe23⤵
- Executes dropped EXE
PID:2056 -
\??\c:\pjpjv.exec:\pjpjv.exe24⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vpvvd.exec:\vpvvd.exe25⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xrrlrrx.exec:\xrrlrrx.exe26⤵
- Executes dropped EXE
PID:1012 -
\??\c:\hbhnnt.exec:\hbhnnt.exe27⤵
- Executes dropped EXE
PID:2052 -
\??\c:\hhtbhh.exec:\hhtbhh.exe28⤵
- Executes dropped EXE
PID:568 -
\??\c:\9jddv.exec:\9jddv.exe29⤵
- Executes dropped EXE
PID:1264 -
\??\c:\pjdjp.exec:\pjdjp.exe30⤵
- Executes dropped EXE
PID:1672 -
\??\c:\rflrrrx.exec:\rflrrrx.exe31⤵
- Executes dropped EXE
PID:1224 -
\??\c:\nnhtnt.exec:\nnhtnt.exe32⤵
- Executes dropped EXE
PID:2096 -
\??\c:\9hbhnt.exec:\9hbhnt.exe33⤵
- Executes dropped EXE
PID:1596 -
\??\c:\pjjvd.exec:\pjjvd.exe34⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xrxllrr.exec:\xrxllrr.exe35⤵
- Executes dropped EXE
PID:2120 -
\??\c:\nbnnnt.exec:\nbnnnt.exe36⤵
- Executes dropped EXE
PID:2792 -
\??\c:\hhbhnn.exec:\hhbhnn.exe37⤵
- Executes dropped EXE
PID:804 -
\??\c:\dpddd.exec:\dpddd.exe38⤵
- Executes dropped EXE
PID:2824 -
\??\c:\9dvdp.exec:\9dvdp.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\lxfxxxx.exec:\lxfxxxx.exe40⤵
- Executes dropped EXE
PID:2980 -
\??\c:\9xlrxff.exec:\9xlrxff.exe41⤵
- Executes dropped EXE
PID:2764 -
\??\c:\9nnbnn.exec:\9nnbnn.exe42⤵
- Executes dropped EXE
PID:2976 -
\??\c:\9tbnnt.exec:\9tbnnt.exe43⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vpjjp.exec:\vpjjp.exe44⤵
- Executes dropped EXE
PID:2856 -
\??\c:\vjpjj.exec:\vjpjj.exe45⤵
- Executes dropped EXE
PID:1668 -
\??\c:\rlrxxff.exec:\rlrxxff.exe46⤵
- Executes dropped EXE
PID:2332 -
\??\c:\9lrfrrr.exec:\9lrfrrr.exe47⤵
- Executes dropped EXE
PID:1764 -
\??\c:\hbnhhh.exec:\hbnhhh.exe48⤵
- Executes dropped EXE
PID:856 -
\??\c:\nhttbb.exec:\nhttbb.exe49⤵
- Executes dropped EXE
PID:2904 -
\??\c:\pjppp.exec:\pjppp.exe50⤵
- Executes dropped EXE
PID:2692 -
\??\c:\pjppv.exec:\pjppv.exe51⤵
- Executes dropped EXE
PID:1120 -
\??\c:\xrrxrxl.exec:\xrrxrxl.exe52⤵
- Executes dropped EXE
PID:2672 -
\??\c:\3lffllf.exec:\3lffllf.exe53⤵
- Executes dropped EXE
PID:492 -
\??\c:\lfrffrx.exec:\lfrffrx.exe54⤵
- Executes dropped EXE
PID:1048 -
\??\c:\1bbhbt.exec:\1bbhbt.exe55⤵
- Executes dropped EXE
PID:1660 -
\??\c:\htnhht.exec:\htnhht.exe56⤵
- Executes dropped EXE
PID:3056 -
\??\c:\jvvvj.exec:\jvvvj.exe57⤵
- Executes dropped EXE
PID:1948 -
\??\c:\jjvdd.exec:\jjvdd.exe58⤵
- Executes dropped EXE
PID:1084 -
\??\c:\rrflffr.exec:\rrflffr.exe59⤵
- Executes dropped EXE
PID:2644 -
\??\c:\rrfxxrx.exec:\rrfxxrx.exe60⤵
- Executes dropped EXE
PID:2288 -
\??\c:\tnhthh.exec:\tnhthh.exe61⤵
- Executes dropped EXE
PID:1132 -
\??\c:\hbttbh.exec:\hbttbh.exe62⤵
- Executes dropped EXE
PID:2468 -
\??\c:\9vjpp.exec:\9vjpp.exe63⤵
- Executes dropped EXE
PID:1080 -
\??\c:\ddddj.exec:\ddddj.exe64⤵
- Executes dropped EXE
PID:900 -
\??\c:\vvvdp.exec:\vvvdp.exe65⤵
- Executes dropped EXE
PID:2504 -
\??\c:\lrxfrfx.exec:\lrxfrfx.exe66⤵PID:1012
-
\??\c:\fxfrrxf.exec:\fxfrrxf.exe67⤵PID:2500
-
\??\c:\7httbb.exec:\7httbb.exe68⤵PID:2224
-
\??\c:\nttbbh.exec:\nttbbh.exe69⤵PID:992
-
\??\c:\9dpjv.exec:\9dpjv.exe70⤵PID:600
-
\??\c:\jdppj.exec:\jdppj.exe71⤵PID:2212
-
\??\c:\vpvdv.exec:\vpvdv.exe72⤵PID:1224
-
\??\c:\lllflfl.exec:\lllflfl.exe73⤵PID:1808
-
\??\c:\lxflrxf.exec:\lxflrxf.exe74⤵PID:2184
-
\??\c:\hhntth.exec:\hhntth.exe75⤵PID:1304
-
\??\c:\nhhttt.exec:\nhhttt.exe76⤵PID:3028
-
\??\c:\ppppv.exec:\ppppv.exe77⤵PID:2320
-
\??\c:\1dpvv.exec:\1dpvv.exe78⤵PID:1568
-
\??\c:\5jpvv.exec:\5jpvv.exe79⤵PID:532
-
\??\c:\rffxrrl.exec:\rffxrrl.exe80⤵PID:640
-
\??\c:\frffllx.exec:\frffllx.exe81⤵PID:2860
-
\??\c:\bbhnbb.exec:\bbhnbb.exe82⤵PID:2804
-
\??\c:\bthnbh.exec:\bthnbh.exe83⤵PID:1676
-
\??\c:\9vpdj.exec:\9vpdj.exe84⤵PID:2716
-
\??\c:\dvddd.exec:\dvddd.exe85⤵PID:2668
-
\??\c:\frxffff.exec:\frxffff.exe86⤵PID:2188
-
\??\c:\fxrflrx.exec:\fxrflrx.exe87⤵PID:2160
-
\??\c:\5hbhtn.exec:\5hbhtn.exe88⤵PID:2180
-
\??\c:\7btbht.exec:\7btbht.exe89⤵PID:2920
-
\??\c:\dvddd.exec:\dvddd.exe90⤵PID:1644
-
\??\c:\7ddjp.exec:\7ddjp.exe91⤵PID:2800
-
\??\c:\xrrlrxf.exec:\xrrlrxf.exe92⤵PID:2428
-
\??\c:\rlxfllf.exec:\rlxfllf.exe93⤵PID:840
-
\??\c:\hhtnhh.exec:\hhtnhh.exe94⤵PID:2936
-
\??\c:\hbnbtt.exec:\hbnbtt.exe95⤵PID:2024
-
\??\c:\jjdpp.exec:\jjdpp.exe96⤵PID:1688
-
\??\c:\ppdpj.exec:\ppdpj.exe97⤵PID:2924
-
\??\c:\fxflrxf.exec:\fxflrxf.exe98⤵PID:1188
-
\??\c:\rfrffxf.exec:\rfrffxf.exe99⤵PID:2472
-
\??\c:\nbnntt.exec:\nbnntt.exe100⤵PID:2276
-
\??\c:\nnhbtb.exec:\nnhbtb.exe101⤵PID:880
-
\??\c:\pjvpp.exec:\pjvpp.exe102⤵PID:2584
-
\??\c:\1dvjv.exec:\1dvjv.exe103⤵PID:1536
-
\??\c:\lfrxrxf.exec:\lfrxrxf.exe104⤵PID:2436
-
\??\c:\lfxxfxx.exec:\lfxxfxx.exe105⤵PID:900
-
\??\c:\nntbbh.exec:\nntbbh.exe106⤵PID:964
-
\??\c:\bthbnn.exec:\bthbnn.exe107⤵PID:2780
-
\??\c:\jdpdv.exec:\jdpdv.exe108⤵PID:2488
-
\??\c:\jvdjp.exec:\jvdjp.exe109⤵PID:2080
-
\??\c:\1xrfxfr.exec:\1xrfxfr.exe110⤵PID:2496
-
\??\c:\fxrxlff.exec:\fxrxlff.exe111⤵PID:1780
-
\??\c:\hbthtt.exec:\hbthtt.exe112⤵PID:2464
-
\??\c:\3tnnhh.exec:\3tnnhh.exe113⤵PID:1816
-
\??\c:\jvjpv.exec:\jvjpv.exe114⤵PID:1564
-
\??\c:\vvjpp.exec:\vvjpp.exe115⤵PID:2192
-
\??\c:\fxxflxf.exec:\fxxflxf.exe116⤵PID:2112
-
\??\c:\7flrxxr.exec:\7flrxxr.exe117⤵PID:2252
-
\??\c:\thnbnn.exec:\thnbnn.exe118⤵PID:2760
-
\??\c:\tnhnnn.exec:\tnhnnn.exe119⤵PID:804
-
\??\c:\jdpvv.exec:\jdpvv.exe120⤵PID:2824
-
\??\c:\vjpjj.exec:\vjpjj.exe121⤵PID:2756
-
\??\c:\9llxllr.exec:\9llxllr.exe122⤵PID:2848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-