Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/04/2024, 04:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08ffac908feba4ec5c98de62dbbb5675_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
08ffac908feba4ec5c98de62dbbb5675_JaffaCakes118.exe
-
Size
73KB
-
MD5
08ffac908feba4ec5c98de62dbbb5675
-
SHA1
7e46ab811b0daa55abbc6131b26d6d482371ff5d
-
SHA256
30b44745dd4b271b93a12b71a74f4083c397d11ec56635993e8851dc8bb701a7
-
SHA512
eb4aecd010c923a71e147036b5277900ad64cdf652ef19e856ddd05a5a486e51b41680d357367224144423682f332affd3bfd25c782e8a5fa89677214440b0ec
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+DQmqc7EfmV+LS:ymb3NkkiQ3mdBjF+3TCg7Ph
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2412-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1352-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1352-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1064-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/828-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1492-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1352 vpjvp.exe 2984 fxlrxxf.exe 2688 nhnntn.exe 2980 pjddv.exe 2652 7rllxxl.exe 2368 frlflrr.exe 2492 nhbthh.exe 2692 7pjjp.exe 1840 vpjvd.exe 2756 xffrfxl.exe 2548 1lrfflx.exe 1668 hbthnh.exe 2044 1jddj.exe 1064 jdpjj.exe 1716 fxrrflr.exe 828 1nhntt.exe 1656 nbhhnn.exe 2264 9pvjp.exe 2300 xfxxxrf.exe 2284 lfrrrxf.exe 2136 btnbnh.exe 692 hbthhn.exe 1492 3jdpd.exe 1704 jdvdj.exe 1568 lxlllll.exe 1636 hbhhnn.exe 1632 vpvvd.exe 1264 jdvdj.exe 2544 fxffxll.exe 1224 fxllxxf.exe 916 tnhnht.exe 2892 5thnnt.exe 2320 jdpvd.exe 1592 xrlrfxl.exe 2656 ffrxffl.exe 2700 tbtthh.exe 2984 7bbttb.exe 2252 pvpvp.exe 2260 vpddj.exe 2640 rlfllrx.exe 2516 xrlffxf.exe 2464 5nhhnn.exe 2480 hhtbbb.exe 2632 bnbbnt.exe 2520 7pvdd.exe 2772 ppdpp.exe 2764 ffxlxlx.exe 2920 bbtbbb.exe 1820 tbbtbn.exe 644 nbnttn.exe 2044 pjjpv.exe 2352 1xxrfxf.exe 1440 rrrlrlr.exe 1644 fxfllrl.exe 3016 btnthb.exe 2108 pjpvd.exe 1772 pdjvv.exe 2180 9xfffrx.exe 2856 3xxxffl.exe 536 nhbbhh.exe 832 5hntbh.exe 3028 3jjjv.exe 2500 ddvvd.exe 624 xrflllf.exe -
resource yara_rule behavioral1/memory/2412-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1352-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1352-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1352-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1064-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/828-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-256-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 1352 2412 08ffac908feba4ec5c98de62dbbb5675_JaffaCakes118.exe 28 PID 2412 wrote to memory of 1352 2412 08ffac908feba4ec5c98de62dbbb5675_JaffaCakes118.exe 28 PID 2412 wrote to memory of 1352 2412 08ffac908feba4ec5c98de62dbbb5675_JaffaCakes118.exe 28 PID 2412 wrote to memory of 1352 2412 08ffac908feba4ec5c98de62dbbb5675_JaffaCakes118.exe 28 PID 1352 wrote to memory of 2984 1352 vpjvp.exe 29 PID 1352 wrote to memory of 2984 1352 vpjvp.exe 29 PID 1352 wrote to memory of 2984 1352 vpjvp.exe 29 PID 1352 wrote to memory of 2984 1352 vpjvp.exe 29 PID 2984 wrote to memory of 2688 2984 fxlrxxf.exe 30 PID 2984 wrote to memory of 2688 2984 fxlrxxf.exe 30 PID 2984 wrote to memory of 2688 2984 fxlrxxf.exe 30 PID 2984 wrote to memory of 2688 2984 fxlrxxf.exe 30 PID 2688 wrote to memory of 2980 2688 nhnntn.exe 31 PID 2688 wrote to memory of 2980 2688 nhnntn.exe 31 PID 2688 wrote to memory of 2980 2688 nhnntn.exe 31 PID 2688 wrote to memory of 2980 2688 nhnntn.exe 31 PID 2980 wrote to memory of 2652 2980 pjddv.exe 32 PID 2980 wrote to memory of 2652 2980 pjddv.exe 32 PID 2980 wrote to memory of 2652 2980 pjddv.exe 32 PID 2980 wrote to memory of 2652 2980 pjddv.exe 32 PID 2652 wrote to memory of 2368 2652 7rllxxl.exe 33 PID 2652 wrote to memory of 2368 2652 7rllxxl.exe 33 PID 2652 wrote to memory of 2368 2652 7rllxxl.exe 33 PID 2652 wrote to memory of 2368 2652 7rllxxl.exe 33 PID 2368 wrote to memory of 2492 2368 frlflrr.exe 34 PID 2368 wrote to memory of 2492 2368 frlflrr.exe 34 PID 2368 wrote to memory of 2492 2368 frlflrr.exe 34 PID 2368 wrote to memory of 2492 2368 frlflrr.exe 34 PID 2492 wrote to memory of 2692 2492 nhbthh.exe 35 PID 2492 wrote to memory of 2692 2492 nhbthh.exe 35 PID 2492 wrote to memory of 2692 2492 nhbthh.exe 35 PID 2492 wrote to memory of 2692 2492 nhbthh.exe 35 PID 2692 wrote to memory of 1840 2692 7pjjp.exe 36 PID 2692 wrote to memory of 1840 2692 7pjjp.exe 36 PID 2692 wrote to memory of 1840 2692 7pjjp.exe 36 PID 2692 wrote to memory of 1840 2692 7pjjp.exe 36 PID 1840 wrote to memory of 2756 1840 vpjvd.exe 37 PID 1840 wrote to memory of 2756 1840 vpjvd.exe 37 PID 1840 wrote to memory of 2756 1840 vpjvd.exe 37 PID 1840 wrote to memory of 2756 1840 vpjvd.exe 37 PID 2756 wrote to memory of 2548 2756 xffrfxl.exe 38 PID 2756 wrote to memory of 2548 2756 xffrfxl.exe 38 PID 2756 wrote to memory of 2548 2756 xffrfxl.exe 38 PID 2756 wrote to memory of 2548 2756 xffrfxl.exe 38 PID 2548 wrote to memory of 1668 2548 1lrfflx.exe 39 PID 2548 wrote to memory of 1668 2548 1lrfflx.exe 39 PID 2548 wrote to memory of 1668 2548 1lrfflx.exe 39 PID 2548 wrote to memory of 1668 2548 1lrfflx.exe 39 PID 1668 wrote to memory of 2044 1668 hbthnh.exe 40 PID 1668 wrote to memory of 2044 1668 hbthnh.exe 40 PID 1668 wrote to memory of 2044 1668 hbthnh.exe 40 PID 1668 wrote to memory of 2044 1668 hbthnh.exe 40 PID 2044 wrote to memory of 1064 2044 1jddj.exe 41 PID 2044 wrote to memory of 1064 2044 1jddj.exe 41 PID 2044 wrote to memory of 1064 2044 1jddj.exe 41 PID 2044 wrote to memory of 1064 2044 1jddj.exe 41 PID 1064 wrote to memory of 1716 1064 jdpjj.exe 42 PID 1064 wrote to memory of 1716 1064 jdpjj.exe 42 PID 1064 wrote to memory of 1716 1064 jdpjj.exe 42 PID 1064 wrote to memory of 1716 1064 jdpjj.exe 42 PID 1716 wrote to memory of 828 1716 fxrrflr.exe 43 PID 1716 wrote to memory of 828 1716 fxrrflr.exe 43 PID 1716 wrote to memory of 828 1716 fxrrflr.exe 43 PID 1716 wrote to memory of 828 1716 fxrrflr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\08ffac908feba4ec5c98de62dbbb5675_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\08ffac908feba4ec5c98de62dbbb5675_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\vpjvp.exec:\vpjvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\nhnntn.exec:\nhnntn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\pjddv.exec:\pjddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\7rllxxl.exec:\7rllxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\frlflrr.exec:\frlflrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\nhbthh.exec:\nhbthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\7pjjp.exec:\7pjjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\vpjvd.exec:\vpjvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\xffrfxl.exec:\xffrfxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\1lrfflx.exec:\1lrfflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\hbthnh.exec:\hbthnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\1jddj.exec:\1jddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\jdpjj.exec:\jdpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\fxrrflr.exec:\fxrrflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\1nhntt.exec:\1nhntt.exe17⤵
- Executes dropped EXE
PID:828 -
\??\c:\nbhhnn.exec:\nbhhnn.exe18⤵
- Executes dropped EXE
PID:1656 -
\??\c:\9pvjp.exec:\9pvjp.exe19⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xfxxxrf.exec:\xfxxxrf.exe20⤵
- Executes dropped EXE
PID:2300 -
\??\c:\lfrrrxf.exec:\lfrrrxf.exe21⤵
- Executes dropped EXE
PID:2284 -
\??\c:\btnbnh.exec:\btnbnh.exe22⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hbthhn.exec:\hbthhn.exe23⤵
- Executes dropped EXE
PID:692 -
\??\c:\3jdpd.exec:\3jdpd.exe24⤵
- Executes dropped EXE
PID:1492 -
\??\c:\jdvdj.exec:\jdvdj.exe25⤵
- Executes dropped EXE
PID:1704 -
\??\c:\lxlllll.exec:\lxlllll.exe26⤵
- Executes dropped EXE
PID:1568 -
\??\c:\hbhhnn.exec:\hbhhnn.exe27⤵
- Executes dropped EXE
PID:1636 -
\??\c:\vpvvd.exec:\vpvvd.exe28⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jdvdj.exec:\jdvdj.exe29⤵
- Executes dropped EXE
PID:1264 -
\??\c:\fxffxll.exec:\fxffxll.exe30⤵
- Executes dropped EXE
PID:2544 -
\??\c:\fxllxxf.exec:\fxllxxf.exe31⤵
- Executes dropped EXE
PID:1224 -
\??\c:\tnhnht.exec:\tnhnht.exe32⤵
- Executes dropped EXE
PID:916 -
\??\c:\5thnnt.exec:\5thnnt.exe33⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jdpvd.exec:\jdpvd.exe34⤵
- Executes dropped EXE
PID:2320 -
\??\c:\xrlrfxl.exec:\xrlrfxl.exe35⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ffrxffl.exec:\ffrxffl.exe36⤵
- Executes dropped EXE
PID:2656 -
\??\c:\tbtthh.exec:\tbtthh.exe37⤵
- Executes dropped EXE
PID:2700 -
\??\c:\7bbttb.exec:\7bbttb.exe38⤵
- Executes dropped EXE
PID:2984 -
\??\c:\pvpvp.exec:\pvpvp.exe39⤵
- Executes dropped EXE
PID:2252 -
\??\c:\vpddj.exec:\vpddj.exe40⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rlfllrx.exec:\rlfllrx.exe41⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xrlffxf.exec:\xrlffxf.exe42⤵
- Executes dropped EXE
PID:2516 -
\??\c:\5nhhnn.exec:\5nhhnn.exe43⤵
- Executes dropped EXE
PID:2464 -
\??\c:\hhtbbb.exec:\hhtbbb.exe44⤵
- Executes dropped EXE
PID:2480 -
\??\c:\bnbbnt.exec:\bnbbnt.exe45⤵
- Executes dropped EXE
PID:2632 -
\??\c:\7pvdd.exec:\7pvdd.exe46⤵
- Executes dropped EXE
PID:2520 -
\??\c:\ppdpp.exec:\ppdpp.exe47⤵
- Executes dropped EXE
PID:2772 -
\??\c:\ffxlxlx.exec:\ffxlxlx.exe48⤵
- Executes dropped EXE
PID:2764 -
\??\c:\bbtbbb.exec:\bbtbbb.exe49⤵
- Executes dropped EXE
PID:2920 -
\??\c:\tbbtbn.exec:\tbbtbn.exe50⤵
- Executes dropped EXE
PID:1820 -
\??\c:\nbnttn.exec:\nbnttn.exe51⤵
- Executes dropped EXE
PID:644 -
\??\c:\pjjpv.exec:\pjjpv.exe52⤵
- Executes dropped EXE
PID:2044 -
\??\c:\1xxrfxf.exec:\1xxrfxf.exe53⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rrrlrlr.exec:\rrrlrlr.exe54⤵
- Executes dropped EXE
PID:1440 -
\??\c:\fxfllrl.exec:\fxfllrl.exe55⤵
- Executes dropped EXE
PID:1644 -
\??\c:\btnthb.exec:\btnthb.exe56⤵
- Executes dropped EXE
PID:3016 -
\??\c:\pjpvd.exec:\pjpvd.exe57⤵
- Executes dropped EXE
PID:2108 -
\??\c:\pdjvv.exec:\pdjvv.exe58⤵
- Executes dropped EXE
PID:1772 -
\??\c:\9xfffrx.exec:\9xfffrx.exe59⤵
- Executes dropped EXE
PID:2180 -
\??\c:\3xxxffl.exec:\3xxxffl.exe60⤵
- Executes dropped EXE
PID:2856 -
\??\c:\nhbbhh.exec:\nhbbhh.exe61⤵
- Executes dropped EXE
PID:536 -
\??\c:\5hntbh.exec:\5hntbh.exe62⤵
- Executes dropped EXE
PID:832 -
\??\c:\3jjjv.exec:\3jjjv.exe63⤵
- Executes dropped EXE
PID:3028 -
\??\c:\ddvvd.exec:\ddvvd.exe64⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xrflllf.exec:\xrflllf.exe65⤵
- Executes dropped EXE
PID:624 -
\??\c:\lrflxxr.exec:\lrflxxr.exe66⤵PID:848
-
\??\c:\tnbnnt.exec:\tnbnnt.exe67⤵PID:1856
-
\??\c:\bhttnt.exec:\bhttnt.exe68⤵PID:984
-
\??\c:\jdvdj.exec:\jdvdj.exe69⤵PID:2388
-
\??\c:\jdpvd.exec:\jdpvd.exe70⤵PID:708
-
\??\c:\xrrfffx.exec:\xrrfffx.exe71⤵PID:1528
-
\??\c:\xxxlrxl.exec:\xxxlrxl.exe72⤵PID:1516
-
\??\c:\vvppd.exec:\vvppd.exe73⤵PID:2820
-
\??\c:\dpjpj.exec:\dpjpj.exe74⤵PID:2328
-
\??\c:\9xrxxxf.exec:\9xrxxxf.exe75⤵PID:1768
-
\??\c:\1frllff.exec:\1frllff.exe76⤵PID:1624
-
\??\c:\hbtbbb.exec:\hbtbbb.exe77⤵PID:2256
-
\??\c:\1hhnhn.exec:\1hhnhn.exe78⤵PID:2748
-
\??\c:\jvjvj.exec:\jvjvj.exe79⤵PID:2664
-
\??\c:\9xrxrrx.exec:\9xrxrrx.exe80⤵PID:2280
-
\??\c:\htbbnn.exec:\htbbnn.exe81⤵PID:3004
-
\??\c:\nhhttb.exec:\nhhttb.exe82⤵PID:2736
-
\??\c:\1pppv.exec:\1pppv.exe83⤵PID:2208
-
\??\c:\jdvjd.exec:\jdvjd.exe84⤵PID:2572
-
\??\c:\frrlrlr.exec:\frrlrlr.exe85⤵PID:2536
-
\??\c:\bntnnn.exec:\bntnnn.exe86⤵PID:2924
-
\??\c:\bthbhh.exec:\bthbhh.exe87⤵PID:2956
-
\??\c:\5vddv.exec:\5vddv.exe88⤵PID:2716
-
\??\c:\vpddj.exec:\vpddj.exe89⤵PID:2776
-
\??\c:\7rlrrrf.exec:\7rlrrrf.exe90⤵PID:2768
-
\??\c:\hbtbhn.exec:\hbtbhn.exe91⤵PID:2648
-
\??\c:\thtttb.exec:\thtttb.exe92⤵PID:1668
-
\??\c:\vjvdv.exec:\vjvdv.exe93⤵PID:2392
-
\??\c:\dpdvp.exec:\dpdvp.exe94⤵PID:1288
-
\??\c:\fxrrlrr.exec:\fxrrlrr.exe95⤵PID:2220
-
\??\c:\bthhtt.exec:\bthhtt.exe96⤵PID:920
-
\??\c:\nbhnhn.exec:\nbhnhn.exe97⤵PID:816
-
\??\c:\jdjdj.exec:\jdjdj.exe98⤵PID:2088
-
\??\c:\pjvvv.exec:\pjvvv.exe99⤵PID:2556
-
\??\c:\dvjpp.exec:\dvjpp.exe100⤵PID:2440
-
\??\c:\xxlrflr.exec:\xxlrflr.exe101⤵PID:2144
-
\??\c:\1fllrrr.exec:\1fllrrr.exe102⤵PID:1924
-
\??\c:\1thhnt.exec:\1thhnt.exe103⤵PID:716
-
\??\c:\nbhbhb.exec:\nbhbhb.exe104⤵PID:580
-
\??\c:\jdjjv.exec:\jdjjv.exe105⤵PID:1076
-
\??\c:\dvddj.exec:\dvddj.exe106⤵PID:1824
-
\??\c:\vpdjj.exec:\vpdjj.exe107⤵PID:2332
-
\??\c:\lfrlrrf.exec:\lfrlrrf.exe108⤵PID:1876
-
\??\c:\rlflrfr.exec:\rlflrfr.exe109⤵PID:1636
-
\??\c:\htttbb.exec:\htttbb.exe110⤵PID:2292
-
\??\c:\7nhttb.exec:\7nhttb.exe111⤵PID:2868
-
\??\c:\jvvjp.exec:\jvvjp.exe112⤵PID:360
-
\??\c:\jvpjp.exec:\jvpjp.exe113⤵PID:1012
-
\??\c:\xrlllrx.exec:\xrlllrx.exe114⤵PID:2384
-
\??\c:\rflrxfl.exec:\rflrxfl.exe115⤵PID:2232
-
\??\c:\nhthtn.exec:\nhthtn.exe116⤵PID:904
-
\??\c:\tnhntt.exec:\tnhntt.exe117⤵PID:1612
-
\??\c:\pjjpj.exec:\pjjpj.exe118⤵PID:2552
-
\??\c:\jdvvv.exec:\jdvvv.exe119⤵PID:1712
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe120⤵PID:2612
-
\??\c:\xlrrfll.exec:\xlrrfll.exe121⤵PID:2584
-
\??\c:\ththnh.exec:\ththnh.exe122⤵PID:2568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-