Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 16:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
virussign.com_e015238509e5b81b0e1fb61f1c6487c0.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
virussign.com_e015238509e5b81b0e1fb61f1c6487c0.exe
-
Size
92KB
-
MD5
e015238509e5b81b0e1fb61f1c6487c0
-
SHA1
bafcb33301ddec161c69d7ff4a0b78c44ce8c034
-
SHA256
95926701f5cc48e904b5407d9d56776e8c3749937b6eaafe1d4838376fa099e5
-
SHA512
c51b25b684a271cf3d484fccf7a32b89afb94e390f3d11c0b0f7becfd23f2aa80e930120fade46456a0e0d795094713ba613b6fb8c6c9196360ddf8e4c3e6286
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/21q:ymb3NkkiQ3mdBjFo73PYP1lri3K8GI
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4064-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2076-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3776-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1844-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/380-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4064 ttbbnn.exe 2664 tntnbb.exe 3840 dvddd.exe 4612 fflfllx.exe 1820 pppjj.exe 3528 lflfxrx.exe 3684 lfrllll.exe 2076 nbbbtt.exe 1240 5pdvp.exe 3776 flflffr.exe 4748 nhtbhn.exe 3064 pjjjp.exe 3200 xrfrlxx.exe 4520 fflfxxr.exe 4640 jjjjv.exe 4784 5vdjp.exe 4532 3hnnnt.exe 3692 pjjjd.exe 1844 djddd.exe 2412 lfllxlf.exe 4620 vdjdd.exe 1244 djvvv.exe 3084 xfffxff.exe 3460 nntbhn.exe 232 vpjjd.exe 3256 5lrlfrr.exe 2928 xlrxxll.exe 212 7hnnnt.exe 3632 jpvdd.exe 1856 1pddj.exe 380 flxxxfl.exe 1940 nthhbb.exe 2132 pvvpd.exe 2104 dpddj.exe 4332 5xfllll.exe 4432 rllrrxx.exe 2992 thnbtn.exe 464 jddjj.exe 904 jjvpj.exe 2276 rrllrxf.exe 3524 xlfflll.exe 2136 bbbbbb.exe 876 htbntb.exe 3840 dvjvv.exe 2144 jjppp.exe 4040 llfflrf.exe 4864 hnbbbb.exe 4248 ddppp.exe 4704 xlrxrrr.exe 2912 hbhntb.exe 832 bbhhnn.exe 2624 vvjjp.exe 4748 vddjj.exe 4692 1fffxff.exe 1684 lxfrxff.exe 3288 hhtbhn.exe 1380 nhhbtb.exe 4996 ddddp.exe 4640 lffxxrr.exe 1732 1lffflf.exe 4508 nnhbbb.exe 4532 tbtbbb.exe 4468 vddjj.exe 4968 vpdvp.exe -
resource yara_rule behavioral2/memory/4064-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1844-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/380-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1856-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4800 wrote to memory of 4064 4800 virussign.com_e015238509e5b81b0e1fb61f1c6487c0.exe 83 PID 4800 wrote to memory of 4064 4800 virussign.com_e015238509e5b81b0e1fb61f1c6487c0.exe 83 PID 4800 wrote to memory of 4064 4800 virussign.com_e015238509e5b81b0e1fb61f1c6487c0.exe 83 PID 4064 wrote to memory of 2664 4064 ttbbnn.exe 84 PID 4064 wrote to memory of 2664 4064 ttbbnn.exe 84 PID 4064 wrote to memory of 2664 4064 ttbbnn.exe 84 PID 2664 wrote to memory of 3840 2664 tntnbb.exe 85 PID 2664 wrote to memory of 3840 2664 tntnbb.exe 85 PID 2664 wrote to memory of 3840 2664 tntnbb.exe 85 PID 3840 wrote to memory of 4612 3840 dvddd.exe 86 PID 3840 wrote to memory of 4612 3840 dvddd.exe 86 PID 3840 wrote to memory of 4612 3840 dvddd.exe 86 PID 4612 wrote to memory of 1820 4612 fflfllx.exe 87 PID 4612 wrote to memory of 1820 4612 fflfllx.exe 87 PID 4612 wrote to memory of 1820 4612 fflfllx.exe 87 PID 1820 wrote to memory of 3528 1820 pppjj.exe 88 PID 1820 wrote to memory of 3528 1820 pppjj.exe 88 PID 1820 wrote to memory of 3528 1820 pppjj.exe 88 PID 3528 wrote to memory of 3684 3528 lflfxrx.exe 89 PID 3528 wrote to memory of 3684 3528 lflfxrx.exe 89 PID 3528 wrote to memory of 3684 3528 lflfxrx.exe 89 PID 3684 wrote to memory of 2076 3684 lfrllll.exe 90 PID 3684 wrote to memory of 2076 3684 lfrllll.exe 90 PID 3684 wrote to memory of 2076 3684 lfrllll.exe 90 PID 2076 wrote to memory of 1240 2076 nbbbtt.exe 91 PID 2076 wrote to memory of 1240 2076 nbbbtt.exe 91 PID 2076 wrote to memory of 1240 2076 nbbbtt.exe 91 PID 1240 wrote to memory of 3776 1240 5pdvp.exe 92 PID 1240 wrote to memory of 3776 1240 5pdvp.exe 92 PID 1240 wrote to memory of 3776 1240 5pdvp.exe 92 PID 3776 wrote to memory of 4748 3776 flflffr.exe 93 PID 3776 wrote to memory of 4748 3776 flflffr.exe 93 PID 3776 wrote to memory of 4748 3776 flflffr.exe 93 PID 4748 wrote to memory of 3064 4748 nhtbhn.exe 94 PID 4748 wrote to memory of 3064 4748 nhtbhn.exe 94 PID 4748 wrote to memory of 3064 4748 nhtbhn.exe 94 PID 3064 wrote to memory of 3200 3064 pjjjp.exe 95 PID 3064 wrote to memory of 3200 3064 pjjjp.exe 95 PID 3064 wrote to memory of 3200 3064 pjjjp.exe 95 PID 3200 wrote to memory of 4520 3200 xrfrlxx.exe 96 PID 3200 wrote to memory of 4520 3200 xrfrlxx.exe 96 PID 3200 wrote to memory of 4520 3200 xrfrlxx.exe 96 PID 4520 wrote to memory of 4640 4520 fflfxxr.exe 97 PID 4520 wrote to memory of 4640 4520 fflfxxr.exe 97 PID 4520 wrote to memory of 4640 4520 fflfxxr.exe 97 PID 4640 wrote to memory of 4784 4640 jjjjv.exe 98 PID 4640 wrote to memory of 4784 4640 jjjjv.exe 98 PID 4640 wrote to memory of 4784 4640 jjjjv.exe 98 PID 4784 wrote to memory of 4532 4784 5vdjp.exe 99 PID 4784 wrote to memory of 4532 4784 5vdjp.exe 99 PID 4784 wrote to memory of 4532 4784 5vdjp.exe 99 PID 4532 wrote to memory of 3692 4532 3hnnnt.exe 100 PID 4532 wrote to memory of 3692 4532 3hnnnt.exe 100 PID 4532 wrote to memory of 3692 4532 3hnnnt.exe 100 PID 3692 wrote to memory of 1844 3692 pjjjd.exe 101 PID 3692 wrote to memory of 1844 3692 pjjjd.exe 101 PID 3692 wrote to memory of 1844 3692 pjjjd.exe 101 PID 1844 wrote to memory of 2412 1844 djddd.exe 103 PID 1844 wrote to memory of 2412 1844 djddd.exe 103 PID 1844 wrote to memory of 2412 1844 djddd.exe 103 PID 2412 wrote to memory of 4620 2412 lfllxlf.exe 104 PID 2412 wrote to memory of 4620 2412 lfllxlf.exe 104 PID 2412 wrote to memory of 4620 2412 lfllxlf.exe 104 PID 4620 wrote to memory of 1244 4620 vdjdd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\virussign.com_e015238509e5b81b0e1fb61f1c6487c0.exe"C:\Users\Admin\AppData\Local\Temp\virussign.com_e015238509e5b81b0e1fb61f1c6487c0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\ttbbnn.exec:\ttbbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\tntnbb.exec:\tntnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\dvddd.exec:\dvddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\fflfllx.exec:\fflfllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\pppjj.exec:\pppjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\lflfxrx.exec:\lflfxrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\lfrllll.exec:\lfrllll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\nbbbtt.exec:\nbbbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\5pdvp.exec:\5pdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\flflffr.exec:\flflffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\nhtbhn.exec:\nhtbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\pjjjp.exec:\pjjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\xrfrlxx.exec:\xrfrlxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\fflfxxr.exec:\fflfxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\jjjjv.exec:\jjjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\5vdjp.exec:\5vdjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\3hnnnt.exec:\3hnnnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\pjjjd.exec:\pjjjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\djddd.exec:\djddd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\lfllxlf.exec:\lfllxlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\vdjdd.exec:\vdjdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\djvvv.exec:\djvvv.exe23⤵
- Executes dropped EXE
PID:1244 -
\??\c:\xfffxff.exec:\xfffxff.exe24⤵
- Executes dropped EXE
PID:3084 -
\??\c:\nntbhn.exec:\nntbhn.exe25⤵
- Executes dropped EXE
PID:3460 -
\??\c:\vpjjd.exec:\vpjjd.exe26⤵
- Executes dropped EXE
PID:232 -
\??\c:\5lrlfrr.exec:\5lrlfrr.exe27⤵
- Executes dropped EXE
PID:3256 -
\??\c:\xlrxxll.exec:\xlrxxll.exe28⤵
- Executes dropped EXE
PID:2928 -
\??\c:\7hnnnt.exec:\7hnnnt.exe29⤵
- Executes dropped EXE
PID:212 -
\??\c:\jpvdd.exec:\jpvdd.exe30⤵
- Executes dropped EXE
PID:3632 -
\??\c:\1pddj.exec:\1pddj.exe31⤵
- Executes dropped EXE
PID:1856 -
\??\c:\flxxxfl.exec:\flxxxfl.exe32⤵
- Executes dropped EXE
PID:380 -
\??\c:\nthhbb.exec:\nthhbb.exe33⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pvvpd.exec:\pvvpd.exe34⤵
- Executes dropped EXE
PID:2132 -
\??\c:\dpddj.exec:\dpddj.exe35⤵
- Executes dropped EXE
PID:2104 -
\??\c:\5xfllll.exec:\5xfllll.exe36⤵
- Executes dropped EXE
PID:4332 -
\??\c:\rllrrxx.exec:\rllrrxx.exe37⤵
- Executes dropped EXE
PID:4432 -
\??\c:\thnbtn.exec:\thnbtn.exe38⤵
- Executes dropped EXE
PID:2992 -
\??\c:\jddjj.exec:\jddjj.exe39⤵
- Executes dropped EXE
PID:464 -
\??\c:\jjvpj.exec:\jjvpj.exe40⤵
- Executes dropped EXE
PID:904 -
\??\c:\rrllrxf.exec:\rrllrxf.exe41⤵
- Executes dropped EXE
PID:2276 -
\??\c:\xlfflll.exec:\xlfflll.exe42⤵
- Executes dropped EXE
PID:3524 -
\??\c:\bbbbbb.exec:\bbbbbb.exe43⤵
- Executes dropped EXE
PID:2136 -
\??\c:\htbntb.exec:\htbntb.exe44⤵
- Executes dropped EXE
PID:876 -
\??\c:\dvjvv.exec:\dvjvv.exe45⤵
- Executes dropped EXE
PID:3840 -
\??\c:\jjppp.exec:\jjppp.exe46⤵
- Executes dropped EXE
PID:2144 -
\??\c:\llfflrf.exec:\llfflrf.exe47⤵
- Executes dropped EXE
PID:4040 -
\??\c:\hnbbbb.exec:\hnbbbb.exe48⤵
- Executes dropped EXE
PID:4864 -
\??\c:\ddppp.exec:\ddppp.exe49⤵
- Executes dropped EXE
PID:4248 -
\??\c:\xlrxrrr.exec:\xlrxrrr.exe50⤵
- Executes dropped EXE
PID:4704 -
\??\c:\hbhntb.exec:\hbhntb.exe51⤵
- Executes dropped EXE
PID:2912 -
\??\c:\bbhhnn.exec:\bbhhnn.exe52⤵
- Executes dropped EXE
PID:832 -
\??\c:\vvjjp.exec:\vvjjp.exe53⤵
- Executes dropped EXE
PID:2624 -
\??\c:\vddjj.exec:\vddjj.exe54⤵
- Executes dropped EXE
PID:4748 -
\??\c:\1fffxff.exec:\1fffxff.exe55⤵
- Executes dropped EXE
PID:4692 -
\??\c:\lxfrxff.exec:\lxfrxff.exe56⤵
- Executes dropped EXE
PID:1684 -
\??\c:\hhtbhn.exec:\hhtbhn.exe57⤵
- Executes dropped EXE
PID:3288 -
\??\c:\nhhbtb.exec:\nhhbtb.exe58⤵
- Executes dropped EXE
PID:1380 -
\??\c:\ddddp.exec:\ddddp.exe59⤵
- Executes dropped EXE
PID:4996 -
\??\c:\lffxxrr.exec:\lffxxrr.exe60⤵
- Executes dropped EXE
PID:4640 -
\??\c:\1lffflf.exec:\1lffflf.exe61⤵
- Executes dropped EXE
PID:1732 -
\??\c:\nnhbbb.exec:\nnhbbb.exe62⤵
- Executes dropped EXE
PID:4508 -
\??\c:\tbtbbb.exec:\tbtbbb.exe63⤵
- Executes dropped EXE
PID:4532 -
\??\c:\vddjj.exec:\vddjj.exe64⤵
- Executes dropped EXE
PID:4468 -
\??\c:\vpdvp.exec:\vpdvp.exe65⤵
- Executes dropped EXE
PID:4968 -
\??\c:\rrrrxxf.exec:\rrrrxxf.exe66⤵PID:1916
-
\??\c:\llrfxxl.exec:\llrfxxl.exe67⤵PID:2480
-
\??\c:\nbbbbh.exec:\nbbbbh.exe68⤵PID:800
-
\??\c:\ttbhhh.exec:\ttbhhh.exe69⤵PID:4636
-
\??\c:\djvdd.exec:\djvdd.exe70⤵PID:2056
-
\??\c:\pvvvv.exec:\pvvvv.exe71⤵PID:3460
-
\??\c:\ffffxff.exec:\ffffxff.exe72⤵PID:1932
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe73⤵PID:4504
-
\??\c:\tbhhhn.exec:\tbhhhn.exe74⤵PID:3552
-
\??\c:\jddjd.exec:\jddjd.exe75⤵PID:2688
-
\??\c:\pdpdv.exec:\pdpdv.exe76⤵PID:212
-
\??\c:\fffrrxx.exec:\fffrrxx.exe77⤵PID:3188
-
\??\c:\rfxxlff.exec:\rfxxlff.exe78⤵PID:2600
-
\??\c:\hhhhbh.exec:\hhhhbh.exe79⤵PID:740
-
\??\c:\dvdjj.exec:\dvdjj.exe80⤵PID:2220
-
\??\c:\pvpvj.exec:\pvpvj.exe81⤵PID:4460
-
\??\c:\xxfrflf.exec:\xxfrflf.exe82⤵PID:1908
-
\??\c:\xlfxxff.exec:\xlfxxff.exe83⤵PID:2228
-
\??\c:\nhnttt.exec:\nhnttt.exe84⤵PID:4332
-
\??\c:\tthtbb.exec:\tthtbb.exe85⤵PID:2468
-
\??\c:\vjppj.exec:\vjppj.exe86⤵PID:3080
-
\??\c:\fxxflrr.exec:\fxxflrr.exe87⤵PID:464
-
\??\c:\xrxxxfx.exec:\xrxxxfx.exe88⤵PID:904
-
\??\c:\nttnnn.exec:\nttnnn.exe89⤵PID:3768
-
\??\c:\ppjpv.exec:\ppjpv.exe90⤵PID:4424
-
\??\c:\pppvp.exec:\pppvp.exe91⤵PID:752
-
\??\c:\llfffrr.exec:\llfffrr.exe92⤵PID:2636
-
\??\c:\lffxxxx.exec:\lffxxxx.exe93⤵PID:3840
-
\??\c:\nhtbbh.exec:\nhtbbh.exe94⤵PID:3344
-
\??\c:\hbnbtt.exec:\hbnbtt.exe95⤵PID:644
-
\??\c:\vvpdd.exec:\vvpdd.exe96⤵PID:3520
-
\??\c:\rrlxrrr.exec:\rrlxrrr.exe97⤵PID:4864
-
\??\c:\ffllrxx.exec:\ffllrxx.exe98⤵PID:1536
-
\??\c:\lfffflr.exec:\lfffflr.exe99⤵PID:3372
-
\??\c:\ntttnn.exec:\ntttnn.exe100⤵PID:3184
-
\??\c:\nhnnhn.exec:\nhnnhn.exe101⤵PID:5000
-
\??\c:\vddpp.exec:\vddpp.exe102⤵PID:4088
-
\??\c:\ppjdd.exec:\ppjdd.exe103⤵PID:4692
-
\??\c:\frfllfl.exec:\frfllfl.exe104⤵PID:1368
-
\??\c:\ttbtbb.exec:\ttbtbb.exe105⤵PID:1084
-
\??\c:\hntbht.exec:\hntbht.exe106⤵PID:1044
-
\??\c:\hbhhbh.exec:\hbhhbh.exe107⤵PID:2336
-
\??\c:\dpppp.exec:\dpppp.exe108⤵PID:4640
-
\??\c:\lflrlfx.exec:\lflrlfx.exe109⤵PID:2764
-
\??\c:\lrflrrx.exec:\lrflrrx.exe110⤵PID:2868
-
\??\c:\btbbhh.exec:\btbbhh.exe111⤵PID:4488
-
\??\c:\hthnhh.exec:\hthnhh.exe112⤵PID:4468
-
\??\c:\dvjjp.exec:\dvjjp.exe113⤵PID:388
-
\??\c:\jjvdj.exec:\jjvdj.exe114⤵PID:536
-
\??\c:\rxxffll.exec:\rxxffll.exe115⤵PID:2480
-
\??\c:\lxfflrr.exec:\lxfflrr.exe116⤵PID:1720
-
\??\c:\bhnttb.exec:\bhnttb.exe117⤵PID:2916
-
\??\c:\btbtbb.exec:\btbtbb.exe118⤵PID:2056
-
\??\c:\btthhh.exec:\btthhh.exe119⤵PID:1448
-
\??\c:\pvjdd.exec:\pvjdd.exe120⤵PID:1904
-
\??\c:\rrffflr.exec:\rrffflr.exe121⤵PID:4504
-
\??\c:\hnnnnb.exec:\hnnnnb.exe122⤵PID:3552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-