Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 02:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
042c98f19428ec8a191794325206de3b_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
042c98f19428ec8a191794325206de3b_JaffaCakes118.exe
-
Size
139KB
-
MD5
042c98f19428ec8a191794325206de3b
-
SHA1
1081642f55054153385e4edae01fabdcadc62911
-
SHA256
533efb70d89d37d6bfd475fb63dc7f83d5918639d2f634c426802d805ece5cde
-
SHA512
c064c873572bb26baf6e1a13cd4e69265a22b8ea8208b7aae0aaa6564b744005d87e5594b69eb33702c1bbf78757cfbb7cf5f5affe5bcc17142cc0ed7291c59e
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHVpx+dGoH//UAAX:n3C9BRW0j/1px+dGkHUAAX
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2008-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/832-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vfvnlv.exextvdr.exebvhbbvd.exenjpdh.exeprjfxj.exenxlbh.exejbndb.exerjtljrx.exedjxtbld.exepxjpjp.exerrxftj.exettjjjbh.exefjbdx.exenjjldf.exebdrlf.exedphhfv.exehblbb.exevvrdnhl.exelpxjvf.exetxflvdj.exevjnjd.exenfbfr.exedttfxbb.exepxnxvj.exeblpjfpf.exevjrxnx.exejfbtb.exervnbhjl.exebrfrrb.exefrhrv.exebrrjx.exettbbp.exertjtrr.exelhbvfrr.exevfftn.exelnrhjv.exerlrhfpd.exehxfxpn.exehjrfj.exetxhvxt.exejnjvf.exevjvntrj.exebpjbt.exerljrrbj.exebvldtn.exedbbrpd.exenvttftf.exeltvjd.exerpdlvdv.exelddhnpj.exexvpxlrn.exejfntdp.exejhjrvd.exerxrpvf.exehdjdprd.exendjvdp.exebbvhxth.exefdbjdl.exetldxrpt.exebbvnxl.exexpnxjb.exextlbbhh.exetjjrb.exehprrjf.exepid process 2172 vfvnlv.exe 2332 xtvdr.exe 2836 bvhbbvd.exe 832 njpdh.exe 3000 prjfxj.exe 2972 nxlbh.exe 2772 jbndb.exe 2496 rjtljrx.exe 2400 djxtbld.exe 2372 pxjpjp.exe 2056 rrxftj.exe 1904 ttjjjbh.exe 1908 fjbdx.exe 1568 njjldf.exe 1292 bdrlf.exe 2024 dphhfv.exe 1640 hblbb.exe 1340 vvrdnhl.exe 852 lpxjvf.exe 580 txflvdj.exe 2748 vjnjd.exe 1928 nfbfr.exe 1948 dttfxbb.exe 596 pxnxvj.exe 836 blpjfpf.exe 1204 vjrxnx.exe 1700 jfbtb.exe 1252 rvnbhjl.exe 1972 brfrrb.exe 2152 frhrv.exe 2680 brrjx.exe 2936 ttbbp.exe 2200 rtjtrr.exe 2112 lhbvfrr.exe 2220 vfftn.exe 2192 lnrhjv.exe 2812 rlrhfpd.exe 1604 hxfxpn.exe 1992 hjrfj.exe 2240 txhvxt.exe 2460 jnjvf.exe 2728 vjvntrj.exe 2592 bpjbt.exe 2504 rljrrbj.exe 2512 bvldtn.exe 2632 dbbrpd.exe 2692 nvttftf.exe 2544 ltvjd.exe 2868 rpdlvdv.exe 2388 lddhnpj.exe 3008 xvpxlrn.exe 2080 jfntdp.exe 760 jhjrvd.exe 1940 rxrpvf.exe 1916 hdjdprd.exe 1900 ndjvdp.exe 1628 bbvhxth.exe 2328 fdbjdl.exe 1384 tldxrpt.exe 1760 bbvnxl.exe 852 xpnxjb.exe 2740 xtlbbhh.exe 2088 tjjrb.exe 2572 hprrjf.exe -
Processes:
resource yara_rule behavioral1/memory/2008-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/832-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-294-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
042c98f19428ec8a191794325206de3b_JaffaCakes118.exevfvnlv.exextvdr.exebvhbbvd.exenjpdh.exeprjfxj.exenxlbh.exejbndb.exerjtljrx.exedjxtbld.exepxjpjp.exerrxftj.exettjjjbh.exefjbdx.exenjjldf.exebdrlf.exedescription pid process target process PID 2008 wrote to memory of 2172 2008 042c98f19428ec8a191794325206de3b_JaffaCakes118.exe vfvnlv.exe PID 2008 wrote to memory of 2172 2008 042c98f19428ec8a191794325206de3b_JaffaCakes118.exe vfvnlv.exe PID 2008 wrote to memory of 2172 2008 042c98f19428ec8a191794325206de3b_JaffaCakes118.exe vfvnlv.exe PID 2008 wrote to memory of 2172 2008 042c98f19428ec8a191794325206de3b_JaffaCakes118.exe vfvnlv.exe PID 2172 wrote to memory of 2332 2172 vfvnlv.exe xtvdr.exe PID 2172 wrote to memory of 2332 2172 vfvnlv.exe xtvdr.exe PID 2172 wrote to memory of 2332 2172 vfvnlv.exe xtvdr.exe PID 2172 wrote to memory of 2332 2172 vfvnlv.exe xtvdr.exe PID 2332 wrote to memory of 2836 2332 xtvdr.exe bvhbbvd.exe PID 2332 wrote to memory of 2836 2332 xtvdr.exe bvhbbvd.exe PID 2332 wrote to memory of 2836 2332 xtvdr.exe bvhbbvd.exe PID 2332 wrote to memory of 2836 2332 xtvdr.exe bvhbbvd.exe PID 2836 wrote to memory of 832 2836 bvhbbvd.exe njpdh.exe PID 2836 wrote to memory of 832 2836 bvhbbvd.exe njpdh.exe PID 2836 wrote to memory of 832 2836 bvhbbvd.exe njpdh.exe PID 2836 wrote to memory of 832 2836 bvhbbvd.exe njpdh.exe PID 832 wrote to memory of 3000 832 njpdh.exe prjfxj.exe PID 832 wrote to memory of 3000 832 njpdh.exe prjfxj.exe PID 832 wrote to memory of 3000 832 njpdh.exe prjfxj.exe PID 832 wrote to memory of 3000 832 njpdh.exe prjfxj.exe PID 3000 wrote to memory of 2972 3000 prjfxj.exe nxlbh.exe PID 3000 wrote to memory of 2972 3000 prjfxj.exe nxlbh.exe PID 3000 wrote to memory of 2972 3000 prjfxj.exe nxlbh.exe PID 3000 wrote to memory of 2972 3000 prjfxj.exe nxlbh.exe PID 2972 wrote to memory of 2772 2972 nxlbh.exe jbndb.exe PID 2972 wrote to memory of 2772 2972 nxlbh.exe jbndb.exe PID 2972 wrote to memory of 2772 2972 nxlbh.exe jbndb.exe PID 2972 wrote to memory of 2772 2972 nxlbh.exe jbndb.exe PID 2772 wrote to memory of 2496 2772 jbndb.exe rjtljrx.exe PID 2772 wrote to memory of 2496 2772 jbndb.exe rjtljrx.exe PID 2772 wrote to memory of 2496 2772 jbndb.exe rjtljrx.exe PID 2772 wrote to memory of 2496 2772 jbndb.exe rjtljrx.exe PID 2496 wrote to memory of 2400 2496 rjtljrx.exe djxtbld.exe PID 2496 wrote to memory of 2400 2496 rjtljrx.exe djxtbld.exe PID 2496 wrote to memory of 2400 2496 rjtljrx.exe djxtbld.exe PID 2496 wrote to memory of 2400 2496 rjtljrx.exe djxtbld.exe PID 2400 wrote to memory of 2372 2400 djxtbld.exe pxjpjp.exe PID 2400 wrote to memory of 2372 2400 djxtbld.exe pxjpjp.exe PID 2400 wrote to memory of 2372 2400 djxtbld.exe pxjpjp.exe PID 2400 wrote to memory of 2372 2400 djxtbld.exe pxjpjp.exe PID 2372 wrote to memory of 2056 2372 pxjpjp.exe rrxftj.exe PID 2372 wrote to memory of 2056 2372 pxjpjp.exe rrxftj.exe PID 2372 wrote to memory of 2056 2372 pxjpjp.exe rrxftj.exe PID 2372 wrote to memory of 2056 2372 pxjpjp.exe rrxftj.exe PID 2056 wrote to memory of 1904 2056 rrxftj.exe ttjjjbh.exe PID 2056 wrote to memory of 1904 2056 rrxftj.exe ttjjjbh.exe PID 2056 wrote to memory of 1904 2056 rrxftj.exe ttjjjbh.exe PID 2056 wrote to memory of 1904 2056 rrxftj.exe ttjjjbh.exe PID 1904 wrote to memory of 1908 1904 ttjjjbh.exe fjbdx.exe PID 1904 wrote to memory of 1908 1904 ttjjjbh.exe fjbdx.exe PID 1904 wrote to memory of 1908 1904 ttjjjbh.exe fjbdx.exe PID 1904 wrote to memory of 1908 1904 ttjjjbh.exe fjbdx.exe PID 1908 wrote to memory of 1568 1908 fjbdx.exe njjldf.exe PID 1908 wrote to memory of 1568 1908 fjbdx.exe njjldf.exe PID 1908 wrote to memory of 1568 1908 fjbdx.exe njjldf.exe PID 1908 wrote to memory of 1568 1908 fjbdx.exe njjldf.exe PID 1568 wrote to memory of 1292 1568 njjldf.exe bdrlf.exe PID 1568 wrote to memory of 1292 1568 njjldf.exe bdrlf.exe PID 1568 wrote to memory of 1292 1568 njjldf.exe bdrlf.exe PID 1568 wrote to memory of 1292 1568 njjldf.exe bdrlf.exe PID 1292 wrote to memory of 2024 1292 bdrlf.exe dphhfv.exe PID 1292 wrote to memory of 2024 1292 bdrlf.exe dphhfv.exe PID 1292 wrote to memory of 2024 1292 bdrlf.exe dphhfv.exe PID 1292 wrote to memory of 2024 1292 bdrlf.exe dphhfv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\042c98f19428ec8a191794325206de3b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\042c98f19428ec8a191794325206de3b_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\vfvnlv.exec:\vfvnlv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\xtvdr.exec:\xtvdr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\bvhbbvd.exec:\bvhbbvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\njpdh.exec:\njpdh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\prjfxj.exec:\prjfxj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\nxlbh.exec:\nxlbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\jbndb.exec:\jbndb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\rjtljrx.exec:\rjtljrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\djxtbld.exec:\djxtbld.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\pxjpjp.exec:\pxjpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\rrxftj.exec:\rrxftj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\ttjjjbh.exec:\ttjjjbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\fjbdx.exec:\fjbdx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\njjldf.exec:\njjldf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\bdrlf.exec:\bdrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\dphhfv.exec:\dphhfv.exe17⤵
- Executes dropped EXE
PID:2024 -
\??\c:\hblbb.exec:\hblbb.exe18⤵
- Executes dropped EXE
PID:1640 -
\??\c:\vvrdnhl.exec:\vvrdnhl.exe19⤵
- Executes dropped EXE
PID:1340 -
\??\c:\lpxjvf.exec:\lpxjvf.exe20⤵
- Executes dropped EXE
PID:852 -
\??\c:\txflvdj.exec:\txflvdj.exe21⤵
- Executes dropped EXE
PID:580 -
\??\c:\vjnjd.exec:\vjnjd.exe22⤵
- Executes dropped EXE
PID:2748 -
\??\c:\nfbfr.exec:\nfbfr.exe23⤵
- Executes dropped EXE
PID:1928 -
\??\c:\dttfxbb.exec:\dttfxbb.exe24⤵
- Executes dropped EXE
PID:1948 -
\??\c:\pxnxvj.exec:\pxnxvj.exe25⤵
- Executes dropped EXE
PID:596 -
\??\c:\blpjfpf.exec:\blpjfpf.exe26⤵
- Executes dropped EXE
PID:836 -
\??\c:\vjrxnx.exec:\vjrxnx.exe27⤵
- Executes dropped EXE
PID:1204 -
\??\c:\jfbtb.exec:\jfbtb.exe28⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rvnbhjl.exec:\rvnbhjl.exe29⤵
- Executes dropped EXE
PID:1252 -
\??\c:\brfrrb.exec:\brfrrb.exe30⤵
- Executes dropped EXE
PID:1972 -
\??\c:\frhrv.exec:\frhrv.exe31⤵
- Executes dropped EXE
PID:2152 -
\??\c:\brrjx.exec:\brrjx.exe32⤵
- Executes dropped EXE
PID:2680 -
\??\c:\ttbbp.exec:\ttbbp.exe33⤵
- Executes dropped EXE
PID:2936 -
\??\c:\rtjtrr.exec:\rtjtrr.exe34⤵
- Executes dropped EXE
PID:2200 -
\??\c:\lhbvfrr.exec:\lhbvfrr.exe35⤵
- Executes dropped EXE
PID:2112 -
\??\c:\vfftn.exec:\vfftn.exe36⤵
- Executes dropped EXE
PID:2220 -
\??\c:\lnrhjv.exec:\lnrhjv.exe37⤵
- Executes dropped EXE
PID:2192 -
\??\c:\rlrhfpd.exec:\rlrhfpd.exe38⤵
- Executes dropped EXE
PID:2812 -
\??\c:\hxfxpn.exec:\hxfxpn.exe39⤵
- Executes dropped EXE
PID:1604 -
\??\c:\hjrfj.exec:\hjrfj.exe40⤵
- Executes dropped EXE
PID:1992 -
\??\c:\txhvxt.exec:\txhvxt.exe41⤵
- Executes dropped EXE
PID:2240 -
\??\c:\jnjvf.exec:\jnjvf.exe42⤵
- Executes dropped EXE
PID:2460 -
\??\c:\vjvntrj.exec:\vjvntrj.exe43⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bpjbt.exec:\bpjbt.exe44⤵
- Executes dropped EXE
PID:2592 -
\??\c:\rljrrbj.exec:\rljrrbj.exe45⤵
- Executes dropped EXE
PID:2504 -
\??\c:\bvldtn.exec:\bvldtn.exe46⤵
- Executes dropped EXE
PID:2512 -
\??\c:\dbbrpd.exec:\dbbrpd.exe47⤵
- Executes dropped EXE
PID:2632 -
\??\c:\nvttftf.exec:\nvttftf.exe48⤵
- Executes dropped EXE
PID:2692 -
\??\c:\ltvjd.exec:\ltvjd.exe49⤵
- Executes dropped EXE
PID:2544 -
\??\c:\rpdlvdv.exec:\rpdlvdv.exe50⤵
- Executes dropped EXE
PID:2868 -
\??\c:\lddhnpj.exec:\lddhnpj.exe51⤵
- Executes dropped EXE
PID:2388 -
\??\c:\xvpxlrn.exec:\xvpxlrn.exe52⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jfntdp.exec:\jfntdp.exe53⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jhjrvd.exec:\jhjrvd.exe54⤵
- Executes dropped EXE
PID:760 -
\??\c:\rxrpvf.exec:\rxrpvf.exe55⤵
- Executes dropped EXE
PID:1940 -
\??\c:\hdjdprd.exec:\hdjdprd.exe56⤵
- Executes dropped EXE
PID:1916 -
\??\c:\ndjvdp.exec:\ndjvdp.exe57⤵
- Executes dropped EXE
PID:1900 -
\??\c:\bbvhxth.exec:\bbvhxth.exe58⤵
- Executes dropped EXE
PID:1628 -
\??\c:\fdbjdl.exec:\fdbjdl.exe59⤵
- Executes dropped EXE
PID:2328 -
\??\c:\tldxrpt.exec:\tldxrpt.exe60⤵
- Executes dropped EXE
PID:1384 -
\??\c:\bbvnxl.exec:\bbvnxl.exe61⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xpnxjb.exec:\xpnxjb.exe62⤵
- Executes dropped EXE
PID:852 -
\??\c:\xtlbbhh.exec:\xtlbbhh.exe63⤵
- Executes dropped EXE
PID:2740 -
\??\c:\tjjrb.exec:\tjjrb.exe64⤵
- Executes dropped EXE
PID:2088 -
\??\c:\hprrjf.exec:\hprrjf.exe65⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xprfd.exec:\xprfd.exe66⤵PID:1064
-
\??\c:\rdhtppt.exec:\rdhtppt.exe67⤵PID:1684
-
\??\c:\fdvhxj.exec:\fdvhxj.exe68⤵PID:2264
-
\??\c:\bhjlltv.exec:\bhjlltv.exe69⤵PID:1116
-
\??\c:\tpvpf.exec:\tpvpf.exe70⤵PID:2256
-
\??\c:\htttfvt.exec:\htttfvt.exe71⤵PID:1720
-
\??\c:\hjbdnxn.exec:\hjbdnxn.exe72⤵PID:1120
-
\??\c:\jhtfjj.exec:\jhtfjj.exe73⤵PID:2788
-
\??\c:\njjlx.exec:\njjlx.exe74⤵PID:2076
-
\??\c:\hhpxj.exec:\hhpxj.exe75⤵PID:2920
-
\??\c:\vnxrpp.exec:\vnxrpp.exe76⤵PID:2828
-
\??\c:\xdnfnt.exec:\xdnfnt.exe77⤵PID:2084
-
\??\c:\llrvx.exec:\llrvx.exe78⤵PID:804
-
\??\c:\jfdjpj.exec:\jfdjpj.exe79⤵PID:2184
-
\??\c:\vfnvfn.exec:\vfnvfn.exe80⤵PID:2308
-
\??\c:\fnnvxn.exec:\fnnvxn.exe81⤵PID:2220
-
\??\c:\drljv.exec:\drljv.exe82⤵PID:2816
-
\??\c:\hrfjt.exec:\hrfjt.exe83⤵PID:1608
-
\??\c:\ntjjvfr.exec:\ntjjvfr.exe84⤵PID:2824
-
\??\c:\jrbfrht.exec:\jrbfrht.exe85⤵PID:2836
-
\??\c:\dlrxlpj.exec:\dlrxlpj.exe86⤵PID:1648
-
\??\c:\dthlbn.exec:\dthlbn.exe87⤵PID:2948
-
\??\c:\dpvnhl.exec:\dpvnhl.exe88⤵PID:2604
-
\??\c:\hnxrpxb.exec:\hnxrpxb.exe89⤵PID:2640
-
\??\c:\prthxrt.exec:\prthxrt.exe90⤵PID:2292
-
\??\c:\jpdvv.exec:\jpdvv.exe91⤵PID:2624
-
\??\c:\nbhtpjh.exec:\nbhtpjh.exe92⤵PID:2188
-
\??\c:\dxrtl.exec:\dxrtl.exe93⤵PID:2432
-
\??\c:\bxrhrdn.exec:\bxrhrdn.exe94⤵PID:2376
-
\??\c:\lfphn.exec:\lfphn.exe95⤵PID:2436
-
\??\c:\hnhpxph.exec:\hnhpxph.exe96⤵PID:2428
-
\??\c:\pxdbjl.exec:\pxdbjl.exe97⤵PID:2356
-
\??\c:\jdbjhp.exec:\jdbjhp.exe98⤵PID:2860
-
\??\c:\dbnndd.exec:\dbnndd.exe99⤵PID:640
-
\??\c:\hfdhtrx.exec:\hfdhtrx.exe100⤵PID:1568
-
\??\c:\njhjv.exec:\njhjv.exe101⤵PID:2180
-
\??\c:\jprbxrf.exec:\jprbxrf.exe102⤵PID:1536
-
\??\c:\rtptnh.exec:\rtptnh.exe103⤵PID:520
-
\??\c:\hdnfjd.exec:\hdnfjd.exe104⤵PID:1452
-
\??\c:\tfxlf.exec:\tfxlf.exe105⤵PID:2440
-
\??\c:\jpffjjt.exec:\jpffjjt.exe106⤵PID:780
-
\??\c:\xxrfdn.exec:\xxrfdn.exe107⤵PID:2556
-
\??\c:\jhvdlvj.exec:\jhvdlvj.exe108⤵PID:2720
-
\??\c:\vhnjrvn.exec:\vhnjrvn.exe109⤵PID:2944
-
\??\c:\lltrf.exec:\lltrf.exe110⤵PID:1928
-
\??\c:\btvhtj.exec:\btvhtj.exe111⤵PID:1060
-
\??\c:\thvrpdt.exec:\thvrpdt.exe112⤵PID:1224
-
\??\c:\vpbjxvf.exec:\vpbjxvf.exe113⤵PID:1140
-
\??\c:\jfnfhl.exec:\jfnfhl.exe114⤵PID:1820
-
\??\c:\xvrxt.exec:\xvrxt.exe115⤵PID:3012
-
\??\c:\jjjntn.exec:\jjjntn.exe116⤵PID:1700
-
\??\c:\jvtdnp.exec:\jvtdnp.exe117⤵PID:904
-
\??\c:\vlbjhrp.exec:\vlbjhrp.exe118⤵PID:1456
-
\??\c:\ltpjj.exec:\ltpjj.exe119⤵PID:2148
-
\??\c:\llpvbvb.exec:\llpvbvb.exe120⤵PID:1248
-
\??\c:\dhjbd.exec:\dhjbd.exe121⤵PID:2904
-
\??\c:\xxprtl.exec:\xxprtl.exe122⤵PID:936
-
\??\c:\nprdxnd.exec:\nprdxnd.exe123⤵PID:1772
-
\??\c:\rjlxdbr.exec:\rjlxdbr.exe124⤵PID:2960
-
\??\c:\rvvxth.exec:\rvvxth.exe125⤵PID:2980
-
\??\c:\frxtn.exec:\frxtn.exe126⤵PID:2000
-
\??\c:\fvdvhr.exec:\fvdvhr.exe127⤵PID:1988
-
\??\c:\hlxdnb.exec:\hlxdnb.exe128⤵PID:1612
-
\??\c:\jhhxbrx.exec:\jhhxbrx.exe129⤵PID:1680
-
\??\c:\xvrtrfv.exec:\xvrtrfv.exe130⤵PID:2824
-
\??\c:\nttfl.exec:\nttfl.exe131⤵PID:2912
-
\??\c:\hfnhl.exec:\hfnhl.exe132⤵PID:2660
-
\??\c:\dtjrbr.exec:\dtjrbr.exe133⤵PID:2528
-
\??\c:\nhpvfv.exec:\nhpvfv.exe134⤵PID:2972
-
\??\c:\vprxnd.exec:\vprxnd.exe135⤵PID:2564
-
\??\c:\vhjtbx.exec:\vhjtbx.exe136⤵PID:2612
-
\??\c:\bhdllj.exec:\bhdllj.exe137⤵PID:2772
-
\??\c:\xrbfxtp.exec:\xrbfxtp.exe138⤵PID:2736
-
\??\c:\jnbtdx.exec:\jnbtdx.exe139⤵PID:2420
-
\??\c:\hnxdx.exec:\hnxdx.exe140⤵PID:2852
-
\??\c:\pjfhl.exec:\pjfhl.exe141⤵PID:2372
-
\??\c:\lphrhxl.exec:\lphrhxl.exe142⤵PID:1904
-
\??\c:\ljrrn.exec:\ljrrn.exe143⤵PID:2080
-
\??\c:\jrrnlr.exec:\jrrnlr.exe144⤵PID:760
-
\??\c:\rhrlf.exec:\rhrlf.exe145⤵PID:1436
-
\??\c:\fldjvp.exec:\fldjvp.exe146⤵PID:1916
-
\??\c:\ffbtxnl.exec:\ffbtxnl.exe147⤵PID:1900
-
\??\c:\dvfpdb.exec:\dvfpdb.exe148⤵PID:1952
-
\??\c:\tvnhdv.exec:\tvnhdv.exe149⤵PID:1528
-
\??\c:\tthfj.exec:\tthfj.exe150⤵PID:2684
-
\??\c:\bpbddtr.exec:\bpbddtr.exe151⤵PID:592
-
\??\c:\rthptn.exec:\rthptn.exe152⤵PID:2712
-
\??\c:\llnnt.exec:\llnnt.exe153⤵PID:2648
-
\??\c:\xrxtx.exec:\xrxtx.exe154⤵PID:2088
-
\??\c:\pprtt.exec:\pprtt.exe155⤵PID:2572
-
\??\c:\jvndpd.exec:\jvndpd.exe156⤵PID:2352
-
\??\c:\jlbdv.exec:\jlbdv.exe157⤵PID:2132
-
\??\c:\vtrxbl.exec:\vtrxbl.exe158⤵PID:2264
-
\??\c:\pldbbt.exec:\pldbbt.exe159⤵PID:1556
-
\??\c:\ptpvnp.exec:\ptpvnp.exe160⤵PID:1560
-
\??\c:\hldfvf.exec:\hldfvf.exe161⤵PID:1796
-
\??\c:\xjxrn.exec:\xjxrn.exe162⤵PID:1700
-
\??\c:\rjnhj.exec:\rjnhj.exe163⤵PID:2788
-
\??\c:\nrhhhrf.exec:\nrhhhrf.exe164⤵PID:2152
-
\??\c:\hhvdnr.exec:\hhvdnr.exe165⤵PID:2120
-
\??\c:\bpflpv.exec:\bpflpv.exe166⤵PID:2144
-
\??\c:\fddhjhj.exec:\fddhjhj.exe167⤵PID:1748
-
\??\c:\nvfxp.exec:\nvfxp.exe168⤵PID:804
-
\??\c:\xfphp.exec:\xfphp.exe169⤵PID:2184
-
\??\c:\bnnldt.exec:\bnnldt.exe170⤵PID:2244
-
\??\c:\jprbh.exec:\jprbh.exe171⤵PID:2880
-
\??\c:\vpndxxd.exec:\vpndxxd.exe172⤵PID:2816
-
\??\c:\ddxtj.exec:\ddxtj.exe173⤵PID:1896
-
\??\c:\jthlnfb.exec:\jthlnfb.exe174⤵PID:2276
-
\??\c:\hlfpd.exec:\hlfpd.exe175⤵PID:3040
-
\??\c:\npnfxpd.exec:\npnfxpd.exe176⤵PID:2488
-
\??\c:\drlrjx.exec:\drlrjx.exe177⤵PID:2608
-
\??\c:\ldbvvb.exec:\ldbvvb.exe178⤵PID:2384
-
\??\c:\nfvjjpv.exec:\nfvjjpv.exe179⤵PID:1620
-
\??\c:\fnjtf.exec:\fnjtf.exe180⤵PID:2292
-
\??\c:\frjrf.exec:\frjrf.exe181⤵PID:2768
-
\??\c:\rdbll.exec:\rdbll.exe182⤵PID:2404
-
\??\c:\rjbvn.exec:\rjbvn.exe183⤵PID:2304
-
\??\c:\bvtjp.exec:\bvtjp.exe184⤵PID:2452
-
\??\c:\pnpvj.exec:\pnpvj.exe185⤵PID:2456
-
\??\c:\xdbpflf.exec:\xdbpflf.exe186⤵PID:2428
-
\??\c:\vhfrjr.exec:\vhfrjr.exe187⤵PID:1112
-
\??\c:\rdtnvd.exec:\rdtnvd.exe188⤵PID:1904
-
\??\c:\dxprn.exec:\dxprn.exe189⤵PID:2080
-
\??\c:\txtljnv.exec:\txtljnv.exe190⤵PID:760
-
\??\c:\tnlxp.exec:\tnlxp.exe191⤵PID:1436
-
\??\c:\vdvllxr.exec:\vdvllxr.exe192⤵PID:1916
-
\??\c:\dfnpthh.exec:\dfnpthh.exe193⤵PID:1900
-
\??\c:\bhblvv.exec:\bhblvv.exe194⤵PID:828
-
\??\c:\tbbrv.exec:\tbbrv.exe195⤵PID:564
-
\??\c:\fppvh.exec:\fppvh.exe196⤵PID:612
-
\??\c:\jltxh.exec:\jltxh.exe197⤵PID:580
-
\??\c:\xrfxtdn.exec:\xrfxtdn.exe198⤵PID:3032
-
\??\c:\dfhjj.exec:\dfhjj.exe199⤵PID:2648
-
\??\c:\rldfdrd.exec:\rldfdrd.exe200⤵PID:2088
-
\??\c:\jvbbjnn.exec:\jvbbjnn.exe201⤵PID:2572
-
\??\c:\htnbntd.exec:\htnbntd.exe202⤵PID:2352
-
\??\c:\dfnnlj.exec:\dfnnlj.exe203⤵PID:2132
-
\??\c:\hxrhthr.exec:\hxrhthr.exe204⤵PID:2264
-
\??\c:\bjtfh.exec:\bjtfh.exe205⤵PID:1096
-
\??\c:\vhfnxll.exec:\vhfnxll.exe206⤵PID:1560
-
\??\c:\vpnfnn.exec:\vpnfnn.exe207⤵PID:1796
-
\??\c:\dnvjx.exec:\dnvjx.exe208⤵PID:1700
-
\??\c:\rdllxl.exec:\rdllxl.exe209⤵PID:2788
-
\??\c:\rlljj.exec:\rlljj.exe210⤵PID:2104
-
\??\c:\nhdntnv.exec:\nhdntnv.exe211⤵PID:2120
-
\??\c:\vfhtn.exec:\vfhtn.exe212⤵PID:1756
-
\??\c:\rrfbp.exec:\rrfbp.exe213⤵PID:1912
-
\??\c:\bxjvbfp.exec:\bxjvbfp.exe214⤵PID:2172
-
\??\c:\ndrrv.exec:\ndrrv.exe215⤵PID:2820
-
\??\c:\dbhpv.exec:\dbhpv.exe216⤵PID:2812
-
\??\c:\fjrbjbj.exec:\fjrbjbj.exe217⤵PID:2880
-
\??\c:\pvbxxl.exec:\pvbxxl.exe218⤵PID:2884
-
\??\c:\djfxfbd.exec:\djfxfbd.exe219⤵PID:1896
-
\??\c:\hptblr.exec:\hptblr.exe220⤵PID:2276
-
\??\c:\rvvxn.exec:\rvvxn.exe221⤵PID:1708
-
\??\c:\ddfxn.exec:\ddfxn.exe222⤵PID:2596
-
\??\c:\hrhtrp.exec:\hrhtrp.exe223⤵PID:2300
-
\??\c:\jrnjfd.exec:\jrnjfd.exe224⤵PID:2540
-
\??\c:\njlxd.exec:\njlxd.exe225⤵PID:2424
-
\??\c:\ppjjx.exec:\ppjjx.exe226⤵PID:2516
-
\??\c:\ffxtr.exec:\ffxtr.exe227⤵PID:2856
-
\??\c:\flpdnf.exec:\flpdnf.exe228⤵PID:2056
-
\??\c:\hbfdhfr.exec:\hbfdhfr.exe229⤵PID:560
-
\??\c:\brtpnhl.exec:\brtpnhl.exe230⤵PID:1944
-
\??\c:\nnrbxb.exec:\nnrbxb.exe231⤵PID:1764
-
\??\c:\ptflx.exec:\ptflx.exe232⤵PID:1940
-
\??\c:\ttjlfb.exec:\ttjlfb.exe233⤵PID:2168
-
\??\c:\tbbff.exec:\tbbff.exe234⤵PID:1716
-
\??\c:\jhptr.exec:\jhptr.exe235⤵PID:1472
-
\??\c:\xjdlhvx.exec:\xjdlhvx.exe236⤵PID:1836
-
\??\c:\fntvj.exec:\fntvj.exe237⤵PID:1488
-
\??\c:\btxhlpt.exec:\btxhlpt.exe238⤵PID:1104
-
\??\c:\pnjdr.exec:\pnjdr.exe239⤵PID:780
-
\??\c:\lpbxb.exec:\lpbxb.exe240⤵PID:612
-
\??\c:\ffjrfj.exec:\ffjrfj.exe241⤵PID:2416
-