Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 22:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
72e60c10220d3647422ce82d911913b4947894c017e4d4c10a66294fc41dda17.exe
Resource
win7-20240708-en
5 signatures
150 seconds
General
-
Target
72e60c10220d3647422ce82d911913b4947894c017e4d4c10a66294fc41dda17.exe
-
Size
417KB
-
MD5
a5895bb9b19158aaa414fc12c7576f5c
-
SHA1
4bbf4aba14ea02c1bf4fe04ab97c0facefcd1924
-
SHA256
72e60c10220d3647422ce82d911913b4947894c017e4d4c10a66294fc41dda17
-
SHA512
61762519aa458bf8ecc8664491d0ed2fb76c356781c8e908a03cf2dcdf225d3201d18515add4aab3e3a385f9d802d6956ea6c391c615fee58e6f039320fab374
-
SSDEEP
12288:n3C9ytvngQj4DtvnV9wLn9UTfC8eieJNBNIsYPj:SgdnJUdnV9D
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1964-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1492-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1480-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1108-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1260-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/796-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-2448-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2300 1vpvj.exe 2040 bbntnh.exe 2420 vdpvd.exe 796 tbnnnt.exe 2832 7pdjj.exe 2820 tnbhnh.exe 2852 dvpvd.exe 2656 xrlxxrr.exe 2624 1bbbnn.exe 2648 jjvjv.exe 1260 xrlllrx.exe 1108 1bthtt.exe 2980 dvjjp.exe 2396 rxxrlxx.exe 1912 ntnbbt.exe 1312 ddpdp.exe 1700 5frxrxx.exe 1760 bbbttb.exe 2092 pvpjd.exe 2180 5fxrlxl.exe 2116 htbnhn.exe 1920 dpdpd.exe 3016 lrlfxll.exe 956 bhnhhh.exe 832 jdpjd.exe 3048 ddppd.exe 580 xrfxfxf.exe 1480 9vvjj.exe 1860 rrlxrfl.exe 1492 1tbhnh.exe 1964 dvpdd.exe 1444 nhthbb.exe 2516 xlrfllr.exe 2456 ffxrflf.exe 1268 hbthnt.exe 2824 jvvvv.exe 2748 lrffxxr.exe 2184 lfxlxfr.exe 2640 1btbhh.exe 2356 5bnbbh.exe 2608 5dvjv.exe 2656 lrflrlr.exe 2636 xxlxxll.exe 1692 nhbhbh.exe 876 btnhnt.exe 2940 3vpvd.exe 2064 dddjp.exe 2576 fllxlxr.exe 2876 bbbhth.exe 2664 ttnhbh.exe 2104 vvpjp.exe 1196 5jjpd.exe 2200 llrxxlf.exe 2056 1llrflf.exe 2232 nhhnbh.exe 2076 jpjdj.exe 2180 pvjjv.exe 1648 lrxxrrl.exe 2584 xrrfrfr.exe 2032 bnhhhh.exe 1864 9bbnbn.exe 2448 dpdjd.exe 824 5jjvd.exe 2436 fllrxfl.exe -
resource yara_rule behavioral1/memory/1964-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1480-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1108-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1260-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/796-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-2448-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1244 wrote to memory of 2300 1244 72e60c10220d3647422ce82d911913b4947894c017e4d4c10a66294fc41dda17.exe 30 PID 1244 wrote to memory of 2300 1244 72e60c10220d3647422ce82d911913b4947894c017e4d4c10a66294fc41dda17.exe 30 PID 1244 wrote to memory of 2300 1244 72e60c10220d3647422ce82d911913b4947894c017e4d4c10a66294fc41dda17.exe 30 PID 1244 wrote to memory of 2300 1244 72e60c10220d3647422ce82d911913b4947894c017e4d4c10a66294fc41dda17.exe 30 PID 2300 wrote to memory of 2040 2300 1vpvj.exe 31 PID 2300 wrote to memory of 2040 2300 1vpvj.exe 31 PID 2300 wrote to memory of 2040 2300 1vpvj.exe 31 PID 2300 wrote to memory of 2040 2300 1vpvj.exe 31 PID 2040 wrote to memory of 2420 2040 bbntnh.exe 32 PID 2040 wrote to memory of 2420 2040 bbntnh.exe 32 PID 2040 wrote to memory of 2420 2040 bbntnh.exe 32 PID 2040 wrote to memory of 2420 2040 bbntnh.exe 32 PID 2420 wrote to memory of 796 2420 vdpvd.exe 33 PID 2420 wrote to memory of 796 2420 vdpvd.exe 33 PID 2420 wrote to memory of 796 2420 vdpvd.exe 33 PID 2420 wrote to memory of 796 2420 vdpvd.exe 33 PID 796 wrote to memory of 2832 796 tbnnnt.exe 34 PID 796 wrote to memory of 2832 796 tbnnnt.exe 34 PID 796 wrote to memory of 2832 796 tbnnnt.exe 34 PID 796 wrote to memory of 2832 796 tbnnnt.exe 34 PID 2832 wrote to memory of 2820 2832 7pdjj.exe 35 PID 2832 wrote to memory of 2820 2832 7pdjj.exe 35 PID 2832 wrote to memory of 2820 2832 7pdjj.exe 35 PID 2832 wrote to memory of 2820 2832 7pdjj.exe 35 PID 2820 wrote to memory of 2852 2820 tnbhnh.exe 36 PID 2820 wrote to memory of 2852 2820 tnbhnh.exe 36 PID 2820 wrote to memory of 2852 2820 tnbhnh.exe 36 PID 2820 wrote to memory of 2852 2820 tnbhnh.exe 36 PID 2852 wrote to memory of 2656 2852 dvpvd.exe 37 PID 2852 wrote to memory of 2656 2852 dvpvd.exe 37 PID 2852 wrote to memory of 2656 2852 dvpvd.exe 37 PID 2852 wrote to memory of 2656 2852 dvpvd.exe 37 PID 2656 wrote to memory of 2624 2656 xrlxxrr.exe 38 PID 2656 wrote to memory of 2624 2656 xrlxxrr.exe 38 PID 2656 wrote to memory of 2624 2656 xrlxxrr.exe 38 PID 2656 wrote to memory of 2624 2656 xrlxxrr.exe 38 PID 2624 wrote to memory of 2648 2624 1bbbnn.exe 39 PID 2624 wrote to memory of 2648 2624 1bbbnn.exe 39 PID 2624 wrote to memory of 2648 2624 1bbbnn.exe 39 PID 2624 wrote to memory of 2648 2624 1bbbnn.exe 39 PID 2648 wrote to memory of 1260 2648 jjvjv.exe 40 PID 2648 wrote to memory of 1260 2648 jjvjv.exe 40 PID 2648 wrote to memory of 1260 2648 jjvjv.exe 40 PID 2648 wrote to memory of 1260 2648 jjvjv.exe 40 PID 1260 wrote to memory of 1108 1260 xrlllrx.exe 41 PID 1260 wrote to memory of 1108 1260 xrlllrx.exe 41 PID 1260 wrote to memory of 1108 1260 xrlllrx.exe 41 PID 1260 wrote to memory of 1108 1260 xrlllrx.exe 41 PID 1108 wrote to memory of 2980 1108 1bthtt.exe 117 PID 1108 wrote to memory of 2980 1108 1bthtt.exe 117 PID 1108 wrote to memory of 2980 1108 1bthtt.exe 117 PID 1108 wrote to memory of 2980 1108 1bthtt.exe 117 PID 2980 wrote to memory of 2396 2980 dvjjp.exe 43 PID 2980 wrote to memory of 2396 2980 dvjjp.exe 43 PID 2980 wrote to memory of 2396 2980 dvjjp.exe 43 PID 2980 wrote to memory of 2396 2980 dvjjp.exe 43 PID 2396 wrote to memory of 1912 2396 rxxrlxx.exe 44 PID 2396 wrote to memory of 1912 2396 rxxrlxx.exe 44 PID 2396 wrote to memory of 1912 2396 rxxrlxx.exe 44 PID 2396 wrote to memory of 1912 2396 rxxrlxx.exe 44 PID 1912 wrote to memory of 1312 1912 ntnbbt.exe 45 PID 1912 wrote to memory of 1312 1912 ntnbbt.exe 45 PID 1912 wrote to memory of 1312 1912 ntnbbt.exe 45 PID 1912 wrote to memory of 1312 1912 ntnbbt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2952451617\zmstage.exeC:\Users\Admin\AppData\Local\Temp\2952451617\zmstage.exe1⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\72e60c10220d3647422ce82d911913b4947894c017e4d4c10a66294fc41dda17.exe"C:\Users\Admin\AppData\Local\Temp\72e60c10220d3647422ce82d911913b4947894c017e4d4c10a66294fc41dda17.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\1vpvj.exec:\1vpvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\bbntnh.exec:\bbntnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\vdpvd.exec:\vdpvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\tbnnnt.exec:\tbnnnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\7pdjj.exec:\7pdjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\tnbhnh.exec:\tnbhnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\dvpvd.exec:\dvpvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\xrlxxrr.exec:\xrlxxrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\1bbbnn.exec:\1bbbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\jjvjv.exec:\jjvjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\xrlllrx.exec:\xrlllrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\1bthtt.exec:\1bthtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\dvjjp.exec:\dvjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\rxxrlxx.exec:\rxxrlxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\ntnbbt.exec:\ntnbbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\ddpdp.exec:\ddpdp.exe17⤵
- Executes dropped EXE
PID:1312 -
\??\c:\5frxrxx.exec:\5frxrxx.exe18⤵
- Executes dropped EXE
PID:1700 -
\??\c:\bbbttb.exec:\bbbttb.exe19⤵
- Executes dropped EXE
PID:1760 -
\??\c:\pvpjd.exec:\pvpjd.exe20⤵
- Executes dropped EXE
PID:2092 -
\??\c:\5fxrlxl.exec:\5fxrlxl.exe21⤵
- Executes dropped EXE
PID:2180 -
\??\c:\htbnhn.exec:\htbnhn.exe22⤵
- Executes dropped EXE
PID:2116 -
\??\c:\dpdpd.exec:\dpdpd.exe23⤵
- Executes dropped EXE
PID:1920 -
\??\c:\lrlfxll.exec:\lrlfxll.exe24⤵
- Executes dropped EXE
PID:3016 -
\??\c:\bhnhhh.exec:\bhnhhh.exe25⤵
- Executes dropped EXE
PID:956 -
\??\c:\jdpjd.exec:\jdpjd.exe26⤵
- Executes dropped EXE
PID:832 -
\??\c:\ddppd.exec:\ddppd.exe27⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xrfxfxf.exec:\xrfxfxf.exe28⤵
- Executes dropped EXE
PID:580 -
\??\c:\9vvjj.exec:\9vvjj.exe29⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rrlxrfl.exec:\rrlxrfl.exe30⤵
- Executes dropped EXE
PID:1860 -
\??\c:\1tbhnh.exec:\1tbhnh.exe31⤵
- Executes dropped EXE
PID:1492 -
\??\c:\dvpdd.exec:\dvpdd.exe32⤵
- Executes dropped EXE
PID:1964 -
\??\c:\fxfflxf.exec:\fxfflxf.exe33⤵PID:2376
-
\??\c:\nhthbb.exec:\nhthbb.exe34⤵
- Executes dropped EXE
PID:1444 -
\??\c:\xlrfllr.exec:\xlrfllr.exe35⤵
- Executes dropped EXE
PID:2516 -
\??\c:\ffxrflf.exec:\ffxrflf.exe36⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hbthnt.exec:\hbthnt.exe37⤵
- Executes dropped EXE
PID:1268 -
\??\c:\jvvvv.exec:\jvvvv.exe38⤵
- Executes dropped EXE
PID:2824 -
\??\c:\lrffxxr.exec:\lrffxxr.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\lfxlxfr.exec:\lfxlxfr.exe40⤵
- Executes dropped EXE
PID:2184 -
\??\c:\1btbhh.exec:\1btbhh.exe41⤵
- Executes dropped EXE
PID:2640 -
\??\c:\5bnbbh.exec:\5bnbbh.exe42⤵
- Executes dropped EXE
PID:2356 -
\??\c:\5dvjv.exec:\5dvjv.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\lrflrlr.exec:\lrflrlr.exe44⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xxlxxll.exec:\xxlxxll.exe45⤵
- Executes dropped EXE
PID:2636 -
\??\c:\nhbhbh.exec:\nhbhbh.exe46⤵
- Executes dropped EXE
PID:1692 -
\??\c:\btnhnt.exec:\btnhnt.exe47⤵
- Executes dropped EXE
PID:876 -
\??\c:\3vpvd.exec:\3vpvd.exe48⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dddjp.exec:\dddjp.exe49⤵
- Executes dropped EXE
PID:2064 -
\??\c:\fllxlxr.exec:\fllxlxr.exe50⤵
- Executes dropped EXE
PID:2576 -
\??\c:\bbbhth.exec:\bbbhth.exe51⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ttnhbh.exec:\ttnhbh.exe52⤵
- Executes dropped EXE
PID:2664 -
\??\c:\vvpjp.exec:\vvpjp.exe53⤵
- Executes dropped EXE
PID:2104 -
\??\c:\5jjpd.exec:\5jjpd.exe54⤵
- Executes dropped EXE
PID:1196 -
\??\c:\llrxxlf.exec:\llrxxlf.exe55⤵
- Executes dropped EXE
PID:2200 -
\??\c:\1llrflf.exec:\1llrflf.exe56⤵
- Executes dropped EXE
PID:2056 -
\??\c:\nhhnbh.exec:\nhhnbh.exe57⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jpjdj.exec:\jpjdj.exe58⤵
- Executes dropped EXE
PID:2076 -
\??\c:\pvjjv.exec:\pvjjv.exe59⤵
- Executes dropped EXE
PID:2180 -
\??\c:\lrxxrrl.exec:\lrxxrrl.exe60⤵
- Executes dropped EXE
PID:1648 -
\??\c:\xrrfrfr.exec:\xrrfrfr.exe61⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bnhhhh.exec:\bnhhhh.exe62⤵
- Executes dropped EXE
PID:2032 -
\??\c:\9bbnbn.exec:\9bbnbn.exe63⤵
- Executes dropped EXE
PID:1864 -
\??\c:\dpdjd.exec:\dpdjd.exe64⤵
- Executes dropped EXE
PID:2448 -
\??\c:\5jjvd.exec:\5jjvd.exe65⤵
- Executes dropped EXE
PID:824 -
\??\c:\fllrxfl.exec:\fllrxfl.exe66⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rxfrxll.exec:\rxfrxll.exe67⤵PID:2264
-
\??\c:\tnnbtn.exec:\tnnbtn.exe68⤵PID:1604
-
\??\c:\djpvj.exec:\djpvj.exe69⤵PID:880
-
\??\c:\3ppdj.exec:\3ppdj.exe70⤵PID:2684
-
\??\c:\rlxlrxr.exec:\rlxlrxr.exe71⤵PID:1492
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe72⤵PID:2540
-
\??\c:\7tntth.exec:\7tntth.exe73⤵PID:1968
-
\??\c:\thhbht.exec:\thhbht.exe74⤵PID:1444
-
\??\c:\pjpdp.exec:\pjpdp.exe75⤵PID:2988
-
\??\c:\rflrlfr.exec:\rflrlfr.exe76⤵PID:2696
-
\??\c:\tnthtb.exec:\tnthtb.exe77⤵PID:2420
-
\??\c:\bttbtt.exec:\bttbtt.exe78⤵PID:2872
-
\??\c:\jpddd.exec:\jpddd.exe79⤵PID:2724
-
\??\c:\vdpvj.exec:\vdpvj.exe80⤵PID:2776
-
\??\c:\lrlffrl.exec:\lrlffrl.exe81⤵PID:2632
-
\??\c:\hthntb.exec:\hthntb.exe82⤵PID:1712
-
\??\c:\nttbtb.exec:\nttbtb.exe83⤵PID:2812
-
\??\c:\jdjpj.exec:\jdjpj.exe84⤵PID:2676
-
\??\c:\rrffllr.exec:\rrffllr.exe85⤵PID:2592
-
\??\c:\xrfxxrr.exec:\xrfxxrr.exe86⤵PID:1320
-
\??\c:\bhbtth.exec:\bhbtth.exe87⤵PID:768
-
\??\c:\ppddj.exec:\ppddj.exe88⤵PID:2936
-
\??\c:\fflfxxl.exec:\fflfxxl.exe89⤵PID:2980
-
\??\c:\lfrrfrf.exec:\lfrrfrf.exe90⤵PID:2672
-
\??\c:\tnnntt.exec:\tnnntt.exe91⤵PID:2904
-
\??\c:\vvddj.exec:\vvddj.exe92⤵PID:2400
-
\??\c:\7lflxxl.exec:\7lflxxl.exe93⤵PID:1292
-
\??\c:\5hbnnt.exec:\5hbnnt.exe94⤵PID:1844
-
\??\c:\pvppd.exec:\pvppd.exe95⤵PID:1944
-
\??\c:\3xxffrx.exec:\3xxffrx.exe96⤵PID:1760
-
\??\c:\1nbtnn.exec:\1nbtnn.exe97⤵PID:2112
-
\??\c:\vvjdj.exec:\vvjdj.exe98⤵PID:304
-
\??\c:\lxfxxrx.exec:\lxfxxrx.exe99⤵PID:1524
-
\??\c:\tnhnbh.exec:\tnhnbh.exe100⤵PID:916
-
\??\c:\1vppp.exec:\1vppp.exe101⤵PID:1288
-
\??\c:\jdppp.exec:\jdppp.exe102⤵PID:628
-
\??\c:\frllrrf.exec:\frllrrf.exe103⤵PID:992
-
\??\c:\thntbb.exec:\thntbb.exe104⤵PID:1060
-
\??\c:\ddvpd.exec:\ddvpd.exe105⤵PID:2444
-
\??\c:\lllfrfx.exec:\lllfrfx.exe106⤵PID:1952
-
\??\c:\3xrflrf.exec:\3xrflrf.exe107⤵PID:2404
-
\??\c:\tbbnbn.exec:\tbbnbn.exe108⤵PID:3064
-
\??\c:\7pjdp.exec:\7pjdp.exe109⤵PID:1500
-
\??\c:\9xrfrxl.exec:\9xrfrxl.exe110⤵PID:1732
-
\??\c:\bnhhth.exec:\bnhhth.exe111⤵PID:2528
-
\??\c:\ppjvd.exec:\ppjvd.exe112⤵PID:2540
-
\??\c:\1pjdp.exec:\1pjdp.exe113⤵PID:2556
-
\??\c:\rlxfflx.exec:\rlxfflx.exe114⤵PID:2156
-
\??\c:\nhtthb.exec:\nhtthb.exe115⤵PID:2516
-
\??\c:\djdvd.exec:\djdvd.exe116⤵PID:2456
-
\??\c:\pvpdp.exec:\pvpdp.exe117⤵PID:2612
-
\??\c:\xflfxxr.exec:\xflfxxr.exe118⤵PID:2824
-
\??\c:\bhbhnt.exec:\bhbhnt.exe119⤵PID:2748
-
\??\c:\rffxlrf.exec:\rffxlrf.exe120⤵PID:2860
-
\??\c:\xxrfxfx.exec:\xxrfxfx.exe121⤵PID:2620
-
\??\c:\ntbbbn.exec:\ntbbbn.exe122⤵PID:2356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-