Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 13:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cebc1a64a7ed0de32b33fb709138dc30N.exe
Resource
win7-20240704-en
5 signatures
120 seconds
General
-
Target
cebc1a64a7ed0de32b33fb709138dc30N.exe
-
Size
62KB
-
MD5
cebc1a64a7ed0de32b33fb709138dc30
-
SHA1
bef083eb4efc70816e6e2f659b4ca283e2fd95c6
-
SHA256
519503ec3d33c77a742a083f092a7453ec9e6c3beb683f85b9cbbeb70b95d76d
-
SHA512
5ef6ec6f54595996f54ebed70a2a4c9269cdb56773691973a66cd16c03313e4c271bba01b670b9ac46b118f8196c1f0f0e8b451d02055fc2f91b4274d4f3e9a6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+M:ymb3NkkiQ3mdBjF0y7M
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2756-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-32-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1528-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2952 q48406.exe 2844 pjvjv.exe 2832 jjdvj.exe 2892 rrrxxfx.exe 1768 820284.exe 592 88086.exe 3016 k86640.exe 2220 1lflxfl.exe 2524 204626.exe 1704 208406.exe 2812 2006668.exe 1776 dpvdd.exe 2988 q80240.exe 2340 86408.exe 844 lxrlxff.exe 1988 44846.exe 1752 080688.exe 2984 m8668.exe 2288 2628402.exe 2152 s6440.exe 1996 i402828.exe 2224 86406.exe 1528 840660.exe 1600 6440884.exe 2300 xrxrrxl.exe 2576 dpdjv.exe 560 e26468.exe 2564 lxrrrrx.exe 2064 5pddv.exe 2756 82022.exe 2724 jdpjp.exe 2732 44662.exe 1572 4428262.exe 2624 04864.exe 2836 vpdpp.exe 2596 k46626.exe 2676 80802.exe 1628 pjppv.exe 988 5pvdd.exe 2928 rllllff.exe 2472 42448.exe 2276 jdjpj.exe 1848 rlllxrf.exe 2392 6824088.exe 2668 8262484.exe 2924 08662.exe 2968 m2806.exe 1776 c840262.exe 1292 xxfrlxr.exe 1696 vpvdp.exe 2512 jpjvv.exe 1304 5vjdp.exe 1988 4204040.exe 2456 frlrxxx.exe 2464 bnhntb.exe 1048 5bnthn.exe 820 6462846.exe 2152 60406.exe 948 ppdvv.exe 1364 0800668.exe 2684 2046600.exe 908 xrlxxfl.exe 1644 i206280.exe 1104 82442.exe -
resource yara_rule behavioral1/memory/2756-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1768-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1528-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-305-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2952 2756 cebc1a64a7ed0de32b33fb709138dc30N.exe 30 PID 2756 wrote to memory of 2952 2756 cebc1a64a7ed0de32b33fb709138dc30N.exe 30 PID 2756 wrote to memory of 2952 2756 cebc1a64a7ed0de32b33fb709138dc30N.exe 30 PID 2756 wrote to memory of 2952 2756 cebc1a64a7ed0de32b33fb709138dc30N.exe 30 PID 2952 wrote to memory of 2844 2952 q48406.exe 31 PID 2952 wrote to memory of 2844 2952 q48406.exe 31 PID 2952 wrote to memory of 2844 2952 q48406.exe 31 PID 2952 wrote to memory of 2844 2952 q48406.exe 31 PID 2844 wrote to memory of 2832 2844 pjvjv.exe 32 PID 2844 wrote to memory of 2832 2844 pjvjv.exe 32 PID 2844 wrote to memory of 2832 2844 pjvjv.exe 32 PID 2844 wrote to memory of 2832 2844 pjvjv.exe 32 PID 2832 wrote to memory of 2892 2832 jjdvj.exe 33 PID 2832 wrote to memory of 2892 2832 jjdvj.exe 33 PID 2832 wrote to memory of 2892 2832 jjdvj.exe 33 PID 2832 wrote to memory of 2892 2832 jjdvj.exe 33 PID 2892 wrote to memory of 1768 2892 rrrxxfx.exe 34 PID 2892 wrote to memory of 1768 2892 rrrxxfx.exe 34 PID 2892 wrote to memory of 1768 2892 rrrxxfx.exe 34 PID 2892 wrote to memory of 1768 2892 rrrxxfx.exe 34 PID 1768 wrote to memory of 592 1768 820284.exe 35 PID 1768 wrote to memory of 592 1768 820284.exe 35 PID 1768 wrote to memory of 592 1768 820284.exe 35 PID 1768 wrote to memory of 592 1768 820284.exe 35 PID 592 wrote to memory of 3016 592 88086.exe 36 PID 592 wrote to memory of 3016 592 88086.exe 36 PID 592 wrote to memory of 3016 592 88086.exe 36 PID 592 wrote to memory of 3016 592 88086.exe 36 PID 3016 wrote to memory of 2220 3016 k86640.exe 37 PID 3016 wrote to memory of 2220 3016 k86640.exe 37 PID 3016 wrote to memory of 2220 3016 k86640.exe 37 PID 3016 wrote to memory of 2220 3016 k86640.exe 37 PID 2220 wrote to memory of 2524 2220 1lflxfl.exe 38 PID 2220 wrote to memory of 2524 2220 1lflxfl.exe 38 PID 2220 wrote to memory of 2524 2220 1lflxfl.exe 38 PID 2220 wrote to memory of 2524 2220 1lflxfl.exe 38 PID 2524 wrote to memory of 1704 2524 204626.exe 39 PID 2524 wrote to memory of 1704 2524 204626.exe 39 PID 2524 wrote to memory of 1704 2524 204626.exe 39 PID 2524 wrote to memory of 1704 2524 204626.exe 39 PID 1704 wrote to memory of 2812 1704 208406.exe 40 PID 1704 wrote to memory of 2812 1704 208406.exe 40 PID 1704 wrote to memory of 2812 1704 208406.exe 40 PID 1704 wrote to memory of 2812 1704 208406.exe 40 PID 2812 wrote to memory of 1776 2812 2006668.exe 41 PID 2812 wrote to memory of 1776 2812 2006668.exe 41 PID 2812 wrote to memory of 1776 2812 2006668.exe 41 PID 2812 wrote to memory of 1776 2812 2006668.exe 41 PID 1776 wrote to memory of 2988 1776 dpvdd.exe 42 PID 1776 wrote to memory of 2988 1776 dpvdd.exe 42 PID 1776 wrote to memory of 2988 1776 dpvdd.exe 42 PID 1776 wrote to memory of 2988 1776 dpvdd.exe 42 PID 2988 wrote to memory of 2340 2988 q80240.exe 43 PID 2988 wrote to memory of 2340 2988 q80240.exe 43 PID 2988 wrote to memory of 2340 2988 q80240.exe 43 PID 2988 wrote to memory of 2340 2988 q80240.exe 43 PID 2340 wrote to memory of 844 2340 86408.exe 44 PID 2340 wrote to memory of 844 2340 86408.exe 44 PID 2340 wrote to memory of 844 2340 86408.exe 44 PID 2340 wrote to memory of 844 2340 86408.exe 44 PID 844 wrote to memory of 1988 844 lxrlxff.exe 45 PID 844 wrote to memory of 1988 844 lxrlxff.exe 45 PID 844 wrote to memory of 1988 844 lxrlxff.exe 45 PID 844 wrote to memory of 1988 844 lxrlxff.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\cebc1a64a7ed0de32b33fb709138dc30N.exe"C:\Users\Admin\AppData\Local\Temp\cebc1a64a7ed0de32b33fb709138dc30N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\q48406.exec:\q48406.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\pjvjv.exec:\pjvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\jjdvj.exec:\jjdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\rrrxxfx.exec:\rrrxxfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\820284.exec:\820284.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\88086.exec:\88086.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\k86640.exec:\k86640.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\1lflxfl.exec:\1lflxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\204626.exec:\204626.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\208406.exec:\208406.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\2006668.exec:\2006668.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\dpvdd.exec:\dpvdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\q80240.exec:\q80240.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\86408.exec:\86408.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\lxrlxff.exec:\lxrlxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\44846.exec:\44846.exe17⤵
- Executes dropped EXE
PID:1988 -
\??\c:\080688.exec:\080688.exe18⤵
- Executes dropped EXE
PID:1752 -
\??\c:\m8668.exec:\m8668.exe19⤵
- Executes dropped EXE
PID:2984 -
\??\c:\2628402.exec:\2628402.exe20⤵
- Executes dropped EXE
PID:2288 -
\??\c:\s6440.exec:\s6440.exe21⤵
- Executes dropped EXE
PID:2152 -
\??\c:\i402828.exec:\i402828.exe22⤵
- Executes dropped EXE
PID:1996 -
\??\c:\86406.exec:\86406.exe23⤵
- Executes dropped EXE
PID:2224 -
\??\c:\840660.exec:\840660.exe24⤵
- Executes dropped EXE
PID:1528 -
\??\c:\6440884.exec:\6440884.exe25⤵
- Executes dropped EXE
PID:1600 -
\??\c:\xrxrrxl.exec:\xrxrrxl.exe26⤵
- Executes dropped EXE
PID:2300 -
\??\c:\dpdjv.exec:\dpdjv.exe27⤵
- Executes dropped EXE
PID:2576 -
\??\c:\e26468.exec:\e26468.exe28⤵
- Executes dropped EXE
PID:560 -
\??\c:\lxrrrrx.exec:\lxrrrrx.exe29⤵
- Executes dropped EXE
PID:2564 -
\??\c:\5pddv.exec:\5pddv.exe30⤵
- Executes dropped EXE
PID:2064 -
\??\c:\82022.exec:\82022.exe31⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jdpjp.exec:\jdpjp.exe32⤵
- Executes dropped EXE
PID:2724 -
\??\c:\44662.exec:\44662.exe33⤵
- Executes dropped EXE
PID:2732 -
\??\c:\4428262.exec:\4428262.exe34⤵
- Executes dropped EXE
PID:1572 -
\??\c:\04864.exec:\04864.exe35⤵
- Executes dropped EXE
PID:2624 -
\??\c:\vpdpp.exec:\vpdpp.exe36⤵
- Executes dropped EXE
PID:2836 -
\??\c:\k46626.exec:\k46626.exe37⤵
- Executes dropped EXE
PID:2596 -
\??\c:\80802.exec:\80802.exe38⤵
- Executes dropped EXE
PID:2676 -
\??\c:\pjppv.exec:\pjppv.exe39⤵
- Executes dropped EXE
PID:1628 -
\??\c:\5pvdd.exec:\5pvdd.exe40⤵
- Executes dropped EXE
PID:988 -
\??\c:\rllllff.exec:\rllllff.exe41⤵
- Executes dropped EXE
PID:2928 -
\??\c:\42448.exec:\42448.exe42⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jdjpj.exec:\jdjpj.exe43⤵
- Executes dropped EXE
PID:2276 -
\??\c:\rlllxrf.exec:\rlllxrf.exe44⤵
- Executes dropped EXE
PID:1848 -
\??\c:\6824088.exec:\6824088.exe45⤵
- Executes dropped EXE
PID:2392 -
\??\c:\8262484.exec:\8262484.exe46⤵
- Executes dropped EXE
PID:2668 -
\??\c:\08662.exec:\08662.exe47⤵
- Executes dropped EXE
PID:2924 -
\??\c:\m2806.exec:\m2806.exe48⤵
- Executes dropped EXE
PID:2968 -
\??\c:\c840262.exec:\c840262.exe49⤵
- Executes dropped EXE
PID:1776 -
\??\c:\xxfrlxr.exec:\xxfrlxr.exe50⤵
- Executes dropped EXE
PID:1292 -
\??\c:\vpvdp.exec:\vpvdp.exe51⤵
- Executes dropped EXE
PID:1696 -
\??\c:\jpjvv.exec:\jpjvv.exe52⤵
- Executes dropped EXE
PID:2512 -
\??\c:\5vjdp.exec:\5vjdp.exe53⤵
- Executes dropped EXE
PID:1304 -
\??\c:\4204040.exec:\4204040.exe54⤵
- Executes dropped EXE
PID:1988 -
\??\c:\frlrxxx.exec:\frlrxxx.exe55⤵
- Executes dropped EXE
PID:2456 -
\??\c:\bnhntb.exec:\bnhntb.exe56⤵
- Executes dropped EXE
PID:2464 -
\??\c:\5bnthn.exec:\5bnthn.exe57⤵
- Executes dropped EXE
PID:1048 -
\??\c:\6462846.exec:\6462846.exe58⤵
- Executes dropped EXE
PID:820 -
\??\c:\60406.exec:\60406.exe59⤵
- Executes dropped EXE
PID:2152 -
\??\c:\ppdvv.exec:\ppdvv.exe60⤵
- Executes dropped EXE
PID:948 -
\??\c:\0800668.exec:\0800668.exe61⤵
- Executes dropped EXE
PID:1364 -
\??\c:\2046600.exec:\2046600.exe62⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xrlxxfl.exec:\xrlxxfl.exe63⤵
- Executes dropped EXE
PID:908 -
\??\c:\i206280.exec:\i206280.exe64⤵
- Executes dropped EXE
PID:1644 -
\??\c:\82442.exec:\82442.exe65⤵
- Executes dropped EXE
PID:1104 -
\??\c:\bthntb.exec:\bthntb.exe66⤵PID:2312
-
\??\c:\42246.exec:\42246.exe67⤵PID:1928
-
\??\c:\nhttbb.exec:\nhttbb.exe68⤵PID:108
-
\??\c:\dvdvp.exec:\dvdvp.exe69⤵PID:876
-
\??\c:\02026.exec:\02026.exe70⤵PID:2064
-
\??\c:\dddpv.exec:\dddpv.exe71⤵PID:2004
-
\??\c:\602806.exec:\602806.exe72⤵PID:2880
-
\??\c:\2080262.exec:\2080262.exe73⤵PID:2608
-
\??\c:\btnbnb.exec:\btnbnb.exe74⤵PID:2784
-
\??\c:\rflrrrf.exec:\rflrrrf.exe75⤵PID:2900
-
\??\c:\04406.exec:\04406.exe76⤵PID:2768
-
\??\c:\rrlllxf.exec:\rrlllxf.exe77⤵PID:2620
-
\??\c:\dvdvp.exec:\dvdvp.exe78⤵PID:2892
-
\??\c:\vpjdd.exec:\vpjdd.exe79⤵PID:376
-
\??\c:\028288.exec:\028288.exe80⤵PID:2100
-
\??\c:\dpvvv.exec:\dpvvv.exe81⤵PID:988
-
\??\c:\08640.exec:\08640.exe82⤵PID:2396
-
\??\c:\xxfflrf.exec:\xxfflrf.exe83⤵PID:2520
-
\??\c:\480004.exec:\480004.exe84⤵PID:2528
-
\??\c:\3fxllrx.exec:\3fxllrx.exe85⤵PID:2992
-
\??\c:\1jpvv.exec:\1jpvv.exe86⤵PID:2792
-
\??\c:\pjjpd.exec:\pjjpd.exe87⤵PID:2776
-
\??\c:\dvjpp.exec:\dvjpp.exe88⤵PID:3004
-
\??\c:\xfrffxx.exec:\xfrffxx.exe89⤵PID:2348
-
\??\c:\nhtttt.exec:\nhtttt.exe90⤵PID:2328
-
\??\c:\hhhtnt.exec:\hhhtnt.exe91⤵PID:2944
-
\??\c:\48868.exec:\48868.exe92⤵PID:1448
-
\??\c:\1bbnnb.exec:\1bbnnb.exe93⤵PID:704
-
\??\c:\ttntbt.exec:\ttntbt.exe94⤵PID:380
-
\??\c:\1flxffl.exec:\1flxffl.exe95⤵PID:2284
-
\??\c:\tttnhb.exec:\tttnhb.exe96⤵PID:2216
-
\??\c:\5rxrrll.exec:\5rxrrll.exe97⤵PID:2364
-
\??\c:\w02442.exec:\w02442.exe98⤵PID:2228
-
\??\c:\llfrrxx.exec:\llfrrxx.exe99⤵PID:276
-
\??\c:\hbbbnb.exec:\hbbbnb.exe100⤵PID:1856
-
\??\c:\9lfflll.exec:\9lfflll.exe101⤵PID:840
-
\??\c:\xrlxrxx.exec:\xrlxrxx.exe102⤵PID:1656
-
\??\c:\08006.exec:\08006.exe103⤵PID:756
-
\??\c:\820240.exec:\820240.exe104⤵PID:1860
-
\??\c:\c202844.exec:\c202844.exe105⤵PID:2360
-
\??\c:\826806.exec:\826806.exe106⤵PID:344
-
\??\c:\hhnbbn.exec:\hhnbbn.exe107⤵PID:1748
-
\??\c:\btthtn.exec:\btthtn.exe108⤵PID:2408
-
\??\c:\q82402.exec:\q82402.exe109⤵PID:548
-
\??\c:\0804880.exec:\0804880.exe110⤵PID:2860
-
\??\c:\004224.exec:\004224.exe111⤵PID:2424
-
\??\c:\q48288.exec:\q48288.exe112⤵PID:2952
-
\??\c:\6466844.exec:\6466844.exe113⤵PID:2732
-
\??\c:\q02848.exec:\q02848.exe114⤵PID:1572
-
\??\c:\vpvpj.exec:\vpvpj.exe115⤵PID:2772
-
\??\c:\jjddj.exec:\jjddj.exe116⤵PID:2832
-
\??\c:\804600.exec:\804600.exe117⤵PID:2596
-
\??\c:\u480644.exec:\u480644.exe118⤵PID:2676
-
\??\c:\u082284.exec:\u082284.exe119⤵PID:2136
-
\??\c:\42066.exec:\42066.exe120⤵PID:2936
-
\??\c:\7lrffrf.exec:\7lrffrf.exe121⤵PID:2928
-
\??\c:\3xrllxl.exec:\3xrllxl.exe122⤵PID:2472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-