Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 16:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
virussign.com_e015238509e5b81b0e1fb61f1c6487c0.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
virussign.com_e015238509e5b81b0e1fb61f1c6487c0.exe
-
Size
92KB
-
MD5
e015238509e5b81b0e1fb61f1c6487c0
-
SHA1
bafcb33301ddec161c69d7ff4a0b78c44ce8c034
-
SHA256
95926701f5cc48e904b5407d9d56776e8c3749937b6eaafe1d4838376fa099e5
-
SHA512
c51b25b684a271cf3d484fccf7a32b89afb94e390f3d11c0b0f7becfd23f2aa80e930120fade46456a0e0d795094713ba613b6fb8c6c9196360ddf8e4c3e6286
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/21q:ymb3NkkiQ3mdBjFo73PYP1lri3K8GI
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2076-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/524-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1108-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1072-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/740-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2052 xhftjvf.exe 1724 htlbfv.exe 2956 nvbdbvb.exe 524 dxprvh.exe 2716 ptrbnhh.exe 2876 hldnjf.exe 2404 tptxrfr.exe 2544 rvvfv.exe 2440 btjljff.exe 2428 tjhrlvj.exe 2356 thplfx.exe 1108 bxjllbn.exe 1640 rnvpxd.exe 2124 lnpbtbn.exe 1968 lfrrf.exe 1072 jhpjvpd.exe 1976 jrlpv.exe 1536 pffnh.exe 1152 jtrldxr.exe 2240 dxvth.exe 2264 drfpv.exe 2116 trtxdnp.exe 2912 tpffrp.exe 1800 vjjfh.exe 1528 bnlhnb.exe 740 blxjpl.exe 1656 npxnrt.exe 592 lxljvr.exe 2096 jhxfnp.exe 2276 htbbxln.exe 2172 txrbfd.exe 2040 vjjbhd.exe 2076 lvppbnd.exe 2184 hbpdj.exe 1296 lddlp.exe 1384 rhrxxjn.exe 1724 llxjn.exe 2484 bfvhdt.exe 2880 bhrdrp.exe 1036 ptllt.exe 1892 nhxbft.exe 2624 tjdbblf.exe 2876 pjvln.exe 2404 rxbrxv.exe 2452 rbnxhn.exe 2168 vjdxvbx.exe 2448 hffnh.exe 764 flhfb.exe 1348 blrhfn.exe 1284 vhjdpd.exe 2220 vhxjv.exe 1748 lbxbh.exe 828 blbxf.exe 2336 fnjrfrt.exe 2348 nxdptb.exe 1612 hflfvdf.exe 2660 tjrbjh.exe 1536 tlftdt.exe 2968 dxtprt.exe 2072 xfnfb.exe 2244 xtrpf.exe 2776 bnxttt.exe 2736 xvjld.exe 2024 ftjtbd.exe -
resource yara_rule behavioral1/memory/2076-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/524-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/524-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/524-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1108-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1072-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/740-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-301-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2052 2076 virussign.com_e015238509e5b81b0e1fb61f1c6487c0.exe 28 PID 2076 wrote to memory of 2052 2076 virussign.com_e015238509e5b81b0e1fb61f1c6487c0.exe 28 PID 2076 wrote to memory of 2052 2076 virussign.com_e015238509e5b81b0e1fb61f1c6487c0.exe 28 PID 2076 wrote to memory of 2052 2076 virussign.com_e015238509e5b81b0e1fb61f1c6487c0.exe 28 PID 2052 wrote to memory of 1724 2052 xhftjvf.exe 29 PID 2052 wrote to memory of 1724 2052 xhftjvf.exe 29 PID 2052 wrote to memory of 1724 2052 xhftjvf.exe 29 PID 2052 wrote to memory of 1724 2052 xhftjvf.exe 29 PID 1724 wrote to memory of 2956 1724 htlbfv.exe 30 PID 1724 wrote to memory of 2956 1724 htlbfv.exe 30 PID 1724 wrote to memory of 2956 1724 htlbfv.exe 30 PID 1724 wrote to memory of 2956 1724 htlbfv.exe 30 PID 2956 wrote to memory of 524 2956 nvbdbvb.exe 31 PID 2956 wrote to memory of 524 2956 nvbdbvb.exe 31 PID 2956 wrote to memory of 524 2956 nvbdbvb.exe 31 PID 2956 wrote to memory of 524 2956 nvbdbvb.exe 31 PID 524 wrote to memory of 2716 524 dxprvh.exe 32 PID 524 wrote to memory of 2716 524 dxprvh.exe 32 PID 524 wrote to memory of 2716 524 dxprvh.exe 32 PID 524 wrote to memory of 2716 524 dxprvh.exe 32 PID 2716 wrote to memory of 2876 2716 ptrbnhh.exe 33 PID 2716 wrote to memory of 2876 2716 ptrbnhh.exe 33 PID 2716 wrote to memory of 2876 2716 ptrbnhh.exe 33 PID 2716 wrote to memory of 2876 2716 ptrbnhh.exe 33 PID 2876 wrote to memory of 2404 2876 hldnjf.exe 34 PID 2876 wrote to memory of 2404 2876 hldnjf.exe 34 PID 2876 wrote to memory of 2404 2876 hldnjf.exe 34 PID 2876 wrote to memory of 2404 2876 hldnjf.exe 34 PID 2404 wrote to memory of 2544 2404 tptxrfr.exe 35 PID 2404 wrote to memory of 2544 2404 tptxrfr.exe 35 PID 2404 wrote to memory of 2544 2404 tptxrfr.exe 35 PID 2404 wrote to memory of 2544 2404 tptxrfr.exe 35 PID 2544 wrote to memory of 2440 2544 rvvfv.exe 36 PID 2544 wrote to memory of 2440 2544 rvvfv.exe 36 PID 2544 wrote to memory of 2440 2544 rvvfv.exe 36 PID 2544 wrote to memory of 2440 2544 rvvfv.exe 36 PID 2440 wrote to memory of 2428 2440 btjljff.exe 37 PID 2440 wrote to memory of 2428 2440 btjljff.exe 37 PID 2440 wrote to memory of 2428 2440 btjljff.exe 37 PID 2440 wrote to memory of 2428 2440 btjljff.exe 37 PID 2428 wrote to memory of 2356 2428 tjhrlvj.exe 38 PID 2428 wrote to memory of 2356 2428 tjhrlvj.exe 38 PID 2428 wrote to memory of 2356 2428 tjhrlvj.exe 38 PID 2428 wrote to memory of 2356 2428 tjhrlvj.exe 38 PID 2356 wrote to memory of 1108 2356 thplfx.exe 39 PID 2356 wrote to memory of 1108 2356 thplfx.exe 39 PID 2356 wrote to memory of 1108 2356 thplfx.exe 39 PID 2356 wrote to memory of 1108 2356 thplfx.exe 39 PID 1108 wrote to memory of 1640 1108 bxjllbn.exe 40 PID 1108 wrote to memory of 1640 1108 bxjllbn.exe 40 PID 1108 wrote to memory of 1640 1108 bxjllbn.exe 40 PID 1108 wrote to memory of 1640 1108 bxjllbn.exe 40 PID 1640 wrote to memory of 2124 1640 rnvpxd.exe 41 PID 1640 wrote to memory of 2124 1640 rnvpxd.exe 41 PID 1640 wrote to memory of 2124 1640 rnvpxd.exe 41 PID 1640 wrote to memory of 2124 1640 rnvpxd.exe 41 PID 2124 wrote to memory of 1968 2124 lnpbtbn.exe 42 PID 2124 wrote to memory of 1968 2124 lnpbtbn.exe 42 PID 2124 wrote to memory of 1968 2124 lnpbtbn.exe 42 PID 2124 wrote to memory of 1968 2124 lnpbtbn.exe 42 PID 1968 wrote to memory of 1072 1968 lfrrf.exe 43 PID 1968 wrote to memory of 1072 1968 lfrrf.exe 43 PID 1968 wrote to memory of 1072 1968 lfrrf.exe 43 PID 1968 wrote to memory of 1072 1968 lfrrf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\virussign.com_e015238509e5b81b0e1fb61f1c6487c0.exe"C:\Users\Admin\AppData\Local\Temp\virussign.com_e015238509e5b81b0e1fb61f1c6487c0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\xhftjvf.exec:\xhftjvf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\htlbfv.exec:\htlbfv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\nvbdbvb.exec:\nvbdbvb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\dxprvh.exec:\dxprvh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524 -
\??\c:\ptrbnhh.exec:\ptrbnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\hldnjf.exec:\hldnjf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\tptxrfr.exec:\tptxrfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\rvvfv.exec:\rvvfv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\btjljff.exec:\btjljff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\tjhrlvj.exec:\tjhrlvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\thplfx.exec:\thplfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\bxjllbn.exec:\bxjllbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\rnvpxd.exec:\rnvpxd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\lnpbtbn.exec:\lnpbtbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\lfrrf.exec:\lfrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\jhpjvpd.exec:\jhpjvpd.exe17⤵
- Executes dropped EXE
PID:1072 -
\??\c:\jrlpv.exec:\jrlpv.exe18⤵
- Executes dropped EXE
PID:1976 -
\??\c:\pffnh.exec:\pffnh.exe19⤵
- Executes dropped EXE
PID:1536 -
\??\c:\jtrldxr.exec:\jtrldxr.exe20⤵
- Executes dropped EXE
PID:1152 -
\??\c:\dxvth.exec:\dxvth.exe21⤵
- Executes dropped EXE
PID:2240 -
\??\c:\drfpv.exec:\drfpv.exe22⤵
- Executes dropped EXE
PID:2264 -
\??\c:\trtxdnp.exec:\trtxdnp.exe23⤵
- Executes dropped EXE
PID:2116 -
\??\c:\tpffrp.exec:\tpffrp.exe24⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vjjfh.exec:\vjjfh.exe25⤵
- Executes dropped EXE
PID:1800 -
\??\c:\bnlhnb.exec:\bnlhnb.exe26⤵
- Executes dropped EXE
PID:1528 -
\??\c:\blxjpl.exec:\blxjpl.exe27⤵
- Executes dropped EXE
PID:740 -
\??\c:\npxnrt.exec:\npxnrt.exe28⤵
- Executes dropped EXE
PID:1656 -
\??\c:\lxljvr.exec:\lxljvr.exe29⤵
- Executes dropped EXE
PID:592 -
\??\c:\jhxfnp.exec:\jhxfnp.exe30⤵
- Executes dropped EXE
PID:2096 -
\??\c:\htbbxln.exec:\htbbxln.exe31⤵
- Executes dropped EXE
PID:2276 -
\??\c:\txrbfd.exec:\txrbfd.exe32⤵
- Executes dropped EXE
PID:2172 -
\??\c:\vjjbhd.exec:\vjjbhd.exe33⤵
- Executes dropped EXE
PID:2040 -
\??\c:\lvppbnd.exec:\lvppbnd.exe34⤵
- Executes dropped EXE
PID:2076 -
\??\c:\hbpdj.exec:\hbpdj.exe35⤵
- Executes dropped EXE
PID:2184 -
\??\c:\lddlp.exec:\lddlp.exe36⤵
- Executes dropped EXE
PID:1296 -
\??\c:\rhrxxjn.exec:\rhrxxjn.exe37⤵
- Executes dropped EXE
PID:1384 -
\??\c:\llxjn.exec:\llxjn.exe38⤵
- Executes dropped EXE
PID:1724 -
\??\c:\bfvhdt.exec:\bfvhdt.exe39⤵
- Executes dropped EXE
PID:2484 -
\??\c:\bhrdrp.exec:\bhrdrp.exe40⤵
- Executes dropped EXE
PID:2880 -
\??\c:\ptllt.exec:\ptllt.exe41⤵
- Executes dropped EXE
PID:1036 -
\??\c:\nhxbft.exec:\nhxbft.exe42⤵
- Executes dropped EXE
PID:1892 -
\??\c:\tjdbblf.exec:\tjdbblf.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\pjvln.exec:\pjvln.exe44⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rxbrxv.exec:\rxbrxv.exe45⤵
- Executes dropped EXE
PID:2404 -
\??\c:\rbnxhn.exec:\rbnxhn.exe46⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vjdxvbx.exec:\vjdxvbx.exe47⤵
- Executes dropped EXE
PID:2168 -
\??\c:\hffnh.exec:\hffnh.exe48⤵
- Executes dropped EXE
PID:2448 -
\??\c:\flhfb.exec:\flhfb.exe49⤵
- Executes dropped EXE
PID:764 -
\??\c:\blrhfn.exec:\blrhfn.exe50⤵
- Executes dropped EXE
PID:1348 -
\??\c:\vhjdpd.exec:\vhjdpd.exe51⤵
- Executes dropped EXE
PID:1284 -
\??\c:\vhxjv.exec:\vhxjv.exe52⤵
- Executes dropped EXE
PID:2220 -
\??\c:\lbxbh.exec:\lbxbh.exe53⤵
- Executes dropped EXE
PID:1748 -
\??\c:\blbxf.exec:\blbxf.exe54⤵
- Executes dropped EXE
PID:828 -
\??\c:\fnjrfrt.exec:\fnjrfrt.exe55⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nxdptb.exec:\nxdptb.exe56⤵
- Executes dropped EXE
PID:2348 -
\??\c:\hflfvdf.exec:\hflfvdf.exe57⤵
- Executes dropped EXE
PID:1612 -
\??\c:\tjrbjh.exec:\tjrbjh.exe58⤵
- Executes dropped EXE
PID:2660 -
\??\c:\tlftdt.exec:\tlftdt.exe59⤵
- Executes dropped EXE
PID:1536 -
\??\c:\dxtprt.exec:\dxtprt.exe60⤵
- Executes dropped EXE
PID:2968 -
\??\c:\xfnfb.exec:\xfnfb.exe61⤵
- Executes dropped EXE
PID:2072 -
\??\c:\xtrpf.exec:\xtrpf.exe62⤵
- Executes dropped EXE
PID:2244 -
\??\c:\bnxttt.exec:\bnxttt.exe63⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xvjld.exec:\xvjld.exe64⤵
- Executes dropped EXE
PID:2736 -
\??\c:\ftjtbd.exec:\ftjtbd.exe65⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rlxxxf.exec:\rlxxxf.exe66⤵PID:1512
-
\??\c:\bnpvbb.exec:\bnpvbb.exe67⤵PID:940
-
\??\c:\pdxjfv.exec:\pdxjfv.exe68⤵PID:1648
-
\??\c:\fthtv.exec:\fthtv.exe69⤵PID:1812
-
\??\c:\bdpblt.exec:\bdpblt.exe70⤵PID:848
-
\??\c:\rfflrl.exec:\rfflrl.exe71⤵PID:2832
-
\??\c:\bnhhb.exec:\bnhhb.exe72⤵PID:2768
-
\??\c:\xxrbrnt.exec:\xxrbrnt.exe73⤵PID:2836
-
\??\c:\pjfnr.exec:\pjfnr.exe74⤵PID:852
-
\??\c:\rhxdbd.exec:\rhxdbd.exe75⤵PID:2940
-
\??\c:\xjtdf.exec:\xjtdf.exe76⤵PID:2040
-
\??\c:\rrnbt.exec:\rrnbt.exe77⤵PID:1716
-
\??\c:\xnbrrx.exec:\xnbrrx.exe78⤵PID:1720
-
\??\c:\vpthr.exec:\vpthr.exe79⤵PID:1056
-
\??\c:\xfbvxb.exec:\xfbvxb.exe80⤵PID:2656
-
\??\c:\hnjlff.exec:\hnjlff.exe81⤵PID:1292
-
\??\c:\lbvrdpf.exec:\lbvrdpf.exe82⤵PID:2596
-
\??\c:\hndrbt.exec:\hndrbt.exe83⤵PID:2532
-
\??\c:\rvbjnjr.exec:\rvbjnjr.exe84⤵PID:2412
-
\??\c:\vdjfpxr.exec:\vdjfpxr.exe85⤵PID:2632
-
\??\c:\njtptr.exec:\njtptr.exe86⤵PID:2556
-
\??\c:\jxrrr.exec:\jxrrr.exe87⤵PID:2432
-
\??\c:\dxrtfl.exec:\dxrtfl.exe88⤵PID:2408
-
\??\c:\djpjx.exec:\djpjx.exe89⤵PID:2792
-
\??\c:\vvflx.exec:\vvflx.exe90⤵PID:2160
-
\??\c:\vndhln.exec:\vndhln.exe91⤵PID:2440
-
\??\c:\vxtrff.exec:\vxtrff.exe92⤵PID:968
-
\??\c:\lxxlhff.exec:\lxxlhff.exe93⤵PID:2128
-
\??\c:\lbbhht.exec:\lbbhht.exe94⤵PID:1188
-
\??\c:\ptpnt.exec:\ptpnt.exe95⤵PID:2312
-
\??\c:\rbxxl.exec:\rbxxl.exe96⤵PID:1160
-
\??\c:\vprjpb.exec:\vprjpb.exe97⤵PID:1368
-
\??\c:\nlfpjfr.exec:\nlfpjfr.exe98⤵PID:2120
-
\??\c:\bbhtnn.exec:\bbhtnn.exe99⤵PID:1620
-
\??\c:\tlndbf.exec:\tlndbf.exe100⤵PID:1492
-
\??\c:\xxxjf.exec:\xxxjf.exe101⤵PID:2620
-
\??\c:\lllvlhj.exec:\lllvlhj.exe102⤵PID:2688
-
\??\c:\vvbljn.exec:\vvbljn.exe103⤵PID:2472
-
\??\c:\hvdpdtn.exec:\hvdpdtn.exe104⤵PID:1452
-
\??\c:\vbpbnvn.exec:\vbpbnvn.exe105⤵PID:2804
-
\??\c:\rddvb.exec:\rddvb.exe106⤵PID:2728
-
\??\c:\lfhpr.exec:\lfhpr.exe107⤵PID:1268
-
\??\c:\rhvdft.exec:\rhvdft.exe108⤵PID:1472
-
\??\c:\nhtrn.exec:\nhtrn.exe109⤵PID:2268
-
\??\c:\tlnlb.exec:\tlnlb.exe110⤵PID:1528
-
\??\c:\jfptb.exec:\jfptb.exe111⤵PID:1608
-
\??\c:\brfrxb.exec:\brfrxb.exe112⤵PID:1044
-
\??\c:\jpldv.exec:\jpldv.exe113⤵PID:2944
-
\??\c:\hbvbb.exec:\hbvbb.exe114⤵PID:2760
-
\??\c:\nvnhnbn.exec:\nvnhnbn.exe115⤵PID:2772
-
\??\c:\btbhr.exec:\btbhr.exe116⤵PID:2680
-
\??\c:\lfbxr.exec:\lfbxr.exe117⤵PID:2740
-
\??\c:\rxjrln.exec:\rxjrln.exe118⤵PID:2844
-
\??\c:\tlrbhr.exec:\tlrbhr.exe119⤵PID:1592
-
\??\c:\hndbplr.exec:\hndbplr.exe120⤵PID:2212
-
\??\c:\ptpbddl.exec:\ptpbddl.exe121⤵PID:1116
-
\??\c:\xfbxht.exec:\xfbxht.exe122⤵PID:2564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-