Analysis
-
max time kernel
63s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2024 04:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08ffac908feba4ec5c98de62dbbb5675_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
08ffac908feba4ec5c98de62dbbb5675_JaffaCakes118.exe
-
Size
73KB
-
MD5
08ffac908feba4ec5c98de62dbbb5675
-
SHA1
7e46ab811b0daa55abbc6131b26d6d482371ff5d
-
SHA256
30b44745dd4b271b93a12b71a74f4083c397d11ec56635993e8851dc8bb701a7
-
SHA512
eb4aecd010c923a71e147036b5277900ad64cdf652ef19e856ddd05a5a486e51b41680d357367224144423682f332affd3bfd25c782e8a5fa89677214440b0ec
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+DQmqc7EfmV+LS:ymb3NkkiQ3mdBjF+3TCg7Ph
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/4864-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1360-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-37-0x0000000001EF0000-0x0000000001F30000-memory.dmp family_blackmoon behavioral2/memory/1516-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1516-28-0x0000000001EF0000-0x0000000001F30000-memory.dmp family_blackmoon behavioral2/memory/2564-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3756-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3844 ttnhbb.exe 1360 nbbhbt.exe 1516 7djpv.exe 4820 1rrfrlf.exe 3112 7rlxrlx.exe 2336 thhbtn.exe 2564 7nnhtn.exe 3860 dvpjp.exe 1980 fxrfrlf.exe 1332 nbhbhb.exe 1968 5pjvp.exe 1660 ppvpv.exe 2496 rxxlxrx.exe 2852 5nthtn.exe 1144 5pvpv.exe 2832 jvvpd.exe 3236 1xxlxxr.exe 4748 rlflxrl.exe 2808 nbhntb.exe 1764 dpjvj.exe 1380 pjdvp.exe 5080 rrflflx.exe 2376 fxrfrlf.exe 1068 bnhbnb.exe 3756 3djdp.exe 1992 7hhbhb.exe 3924 7tnbhh.exe 2096 jvpdv.exe 3432 xllxlfl.exe 3600 nhtnhb.exe 5100 bhhtnh.exe 808 jvdvj.exe 4384 nbbnbt.exe 1836 bbthtn.exe 4368 dpddp.exe 2688 flfrxxl.exe 4340 rrlfxrf.exe 4736 tnthbt.exe 5044 9hnbhh.exe 5116 1vpjp.exe 2928 lxrflfx.exe 4392 9llfxxr.exe 392 1hbtnh.exe 4540 nnttbh.exe 828 djdpd.exe 1268 frfxrrx.exe 4948 xxfrlxr.exe 1328 hhhbtb.exe 1164 bbbnhb.exe 3108 pdvjd.exe 2768 rlfxllf.exe 1400 xxllxxr.exe 3644 5rlfrlf.exe 1352 hththt.exe 376 5pjpj.exe 5088 ddjpj.exe 3420 lfllxlr.exe 5004 9flxlfx.exe 4292 9ntnhh.exe 3144 ntnbnh.exe 1368 jvvjv.exe 1488 5ddjv.exe 4260 xrfrlll.exe 2672 flfxlfr.exe -
resource yara_rule behavioral2/memory/4864-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3844-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1360-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-28-0x0000000001EF0000-0x0000000001F30000-memory.dmp upx behavioral2/memory/2564-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3756-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-214-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4864 wrote to memory of 3844 4864 08ffac908feba4ec5c98de62dbbb5675_JaffaCakes118.exe 82 PID 4864 wrote to memory of 3844 4864 08ffac908feba4ec5c98de62dbbb5675_JaffaCakes118.exe 82 PID 4864 wrote to memory of 3844 4864 08ffac908feba4ec5c98de62dbbb5675_JaffaCakes118.exe 82 PID 3844 wrote to memory of 1360 3844 ttnhbb.exe 83 PID 3844 wrote to memory of 1360 3844 ttnhbb.exe 83 PID 3844 wrote to memory of 1360 3844 ttnhbb.exe 83 PID 1360 wrote to memory of 1516 1360 nbbhbt.exe 84 PID 1360 wrote to memory of 1516 1360 nbbhbt.exe 84 PID 1360 wrote to memory of 1516 1360 nbbhbt.exe 84 PID 1516 wrote to memory of 4820 1516 7djpv.exe 85 PID 1516 wrote to memory of 4820 1516 7djpv.exe 85 PID 1516 wrote to memory of 4820 1516 7djpv.exe 85 PID 4820 wrote to memory of 3112 4820 1rrfrlf.exe 86 PID 4820 wrote to memory of 3112 4820 1rrfrlf.exe 86 PID 4820 wrote to memory of 3112 4820 1rrfrlf.exe 86 PID 3112 wrote to memory of 2336 3112 7rlxrlx.exe 87 PID 3112 wrote to memory of 2336 3112 7rlxrlx.exe 87 PID 3112 wrote to memory of 2336 3112 7rlxrlx.exe 87 PID 2336 wrote to memory of 2564 2336 thhbtn.exe 88 PID 2336 wrote to memory of 2564 2336 thhbtn.exe 88 PID 2336 wrote to memory of 2564 2336 thhbtn.exe 88 PID 2564 wrote to memory of 3860 2564 7nnhtn.exe 89 PID 2564 wrote to memory of 3860 2564 7nnhtn.exe 89 PID 2564 wrote to memory of 3860 2564 7nnhtn.exe 89 PID 3860 wrote to memory of 1980 3860 dvpjp.exe 90 PID 3860 wrote to memory of 1980 3860 dvpjp.exe 90 PID 3860 wrote to memory of 1980 3860 dvpjp.exe 90 PID 1980 wrote to memory of 1332 1980 fxrfrlf.exe 91 PID 1980 wrote to memory of 1332 1980 fxrfrlf.exe 91 PID 1980 wrote to memory of 1332 1980 fxrfrlf.exe 91 PID 1332 wrote to memory of 1968 1332 nbhbhb.exe 92 PID 1332 wrote to memory of 1968 1332 nbhbhb.exe 92 PID 1332 wrote to memory of 1968 1332 nbhbhb.exe 92 PID 1968 wrote to memory of 1660 1968 5pjvp.exe 93 PID 1968 wrote to memory of 1660 1968 5pjvp.exe 93 PID 1968 wrote to memory of 1660 1968 5pjvp.exe 93 PID 1660 wrote to memory of 2496 1660 ppvpv.exe 94 PID 1660 wrote to memory of 2496 1660 ppvpv.exe 94 PID 1660 wrote to memory of 2496 1660 ppvpv.exe 94 PID 2496 wrote to memory of 2852 2496 rxxlxrx.exe 95 PID 2496 wrote to memory of 2852 2496 rxxlxrx.exe 95 PID 2496 wrote to memory of 2852 2496 rxxlxrx.exe 95 PID 2852 wrote to memory of 1144 2852 5nthtn.exe 96 PID 2852 wrote to memory of 1144 2852 5nthtn.exe 96 PID 2852 wrote to memory of 1144 2852 5nthtn.exe 96 PID 1144 wrote to memory of 2832 1144 5pvpv.exe 97 PID 1144 wrote to memory of 2832 1144 5pvpv.exe 97 PID 1144 wrote to memory of 2832 1144 5pvpv.exe 97 PID 2832 wrote to memory of 3236 2832 jvvpd.exe 98 PID 2832 wrote to memory of 3236 2832 jvvpd.exe 98 PID 2832 wrote to memory of 3236 2832 jvvpd.exe 98 PID 3236 wrote to memory of 4748 3236 1xxlxxr.exe 99 PID 3236 wrote to memory of 4748 3236 1xxlxxr.exe 99 PID 3236 wrote to memory of 4748 3236 1xxlxxr.exe 99 PID 4748 wrote to memory of 2808 4748 rlflxrl.exe 100 PID 4748 wrote to memory of 2808 4748 rlflxrl.exe 100 PID 4748 wrote to memory of 2808 4748 rlflxrl.exe 100 PID 2808 wrote to memory of 1764 2808 nbhntb.exe 101 PID 2808 wrote to memory of 1764 2808 nbhntb.exe 101 PID 2808 wrote to memory of 1764 2808 nbhntb.exe 101 PID 1764 wrote to memory of 1380 1764 dpjvj.exe 103 PID 1764 wrote to memory of 1380 1764 dpjvj.exe 103 PID 1764 wrote to memory of 1380 1764 dpjvj.exe 103 PID 1380 wrote to memory of 5080 1380 pjdvp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\08ffac908feba4ec5c98de62dbbb5675_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\08ffac908feba4ec5c98de62dbbb5675_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\ttnhbb.exec:\ttnhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\nbbhbt.exec:\nbbhbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\7djpv.exec:\7djpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\1rrfrlf.exec:\1rrfrlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\7rlxrlx.exec:\7rlxrlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\thhbtn.exec:\thhbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\7nnhtn.exec:\7nnhtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\dvpjp.exec:\dvpjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\fxrfrlf.exec:\fxrfrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\nbhbhb.exec:\nbhbhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\5pjvp.exec:\5pjvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\ppvpv.exec:\ppvpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\rxxlxrx.exec:\rxxlxrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\5nthtn.exec:\5nthtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\5pvpv.exec:\5pvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\jvvpd.exec:\jvvpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\1xxlxxr.exec:\1xxlxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\rlflxrl.exec:\rlflxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\nbhntb.exec:\nbhntb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\dpjvj.exec:\dpjvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\pjdvp.exec:\pjdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\rrflflx.exec:\rrflflx.exe23⤵
- Executes dropped EXE
PID:5080 -
\??\c:\fxrfrlf.exec:\fxrfrlf.exe24⤵
- Executes dropped EXE
PID:2376 -
\??\c:\bnhbnb.exec:\bnhbnb.exe25⤵
- Executes dropped EXE
PID:1068 -
\??\c:\3djdp.exec:\3djdp.exe26⤵
- Executes dropped EXE
PID:3756 -
\??\c:\7hhbhb.exec:\7hhbhb.exe27⤵
- Executes dropped EXE
PID:1992 -
\??\c:\7tnbhh.exec:\7tnbhh.exe28⤵
- Executes dropped EXE
PID:3924 -
\??\c:\jvpdv.exec:\jvpdv.exe29⤵
- Executes dropped EXE
PID:2096 -
\??\c:\xllxlfl.exec:\xllxlfl.exe30⤵
- Executes dropped EXE
PID:3432 -
\??\c:\nhtnhb.exec:\nhtnhb.exe31⤵
- Executes dropped EXE
PID:3600 -
\??\c:\bhhtnh.exec:\bhhtnh.exe32⤵
- Executes dropped EXE
PID:5100 -
\??\c:\jvdvj.exec:\jvdvj.exe33⤵
- Executes dropped EXE
PID:808 -
\??\c:\nbbnbt.exec:\nbbnbt.exe34⤵
- Executes dropped EXE
PID:4384 -
\??\c:\bbthtn.exec:\bbthtn.exe35⤵
- Executes dropped EXE
PID:1836 -
\??\c:\dpddp.exec:\dpddp.exe36⤵
- Executes dropped EXE
PID:4368 -
\??\c:\flfrxxl.exec:\flfrxxl.exe37⤵
- Executes dropped EXE
PID:2688 -
\??\c:\rrlfxrf.exec:\rrlfxrf.exe38⤵
- Executes dropped EXE
PID:4340 -
\??\c:\tnthbt.exec:\tnthbt.exe39⤵
- Executes dropped EXE
PID:4736 -
\??\c:\9hnbhh.exec:\9hnbhh.exe40⤵
- Executes dropped EXE
PID:5044 -
\??\c:\1vpjp.exec:\1vpjp.exe41⤵
- Executes dropped EXE
PID:5116 -
\??\c:\lxrflfx.exec:\lxrflfx.exe42⤵
- Executes dropped EXE
PID:2928 -
\??\c:\9llfxxr.exec:\9llfxxr.exe43⤵
- Executes dropped EXE
PID:4392 -
\??\c:\1hbtnh.exec:\1hbtnh.exe44⤵
- Executes dropped EXE
PID:392 -
\??\c:\nnttbh.exec:\nnttbh.exe45⤵
- Executes dropped EXE
PID:4540 -
\??\c:\djdpd.exec:\djdpd.exe46⤵
- Executes dropped EXE
PID:828 -
\??\c:\frfxrrx.exec:\frfxrrx.exe47⤵
- Executes dropped EXE
PID:1268 -
\??\c:\xxfrlxr.exec:\xxfrlxr.exe48⤵
- Executes dropped EXE
PID:4948 -
\??\c:\hhhbtb.exec:\hhhbtb.exe49⤵
- Executes dropped EXE
PID:1328 -
\??\c:\bbbnhb.exec:\bbbnhb.exe50⤵
- Executes dropped EXE
PID:1164 -
\??\c:\pdvjd.exec:\pdvjd.exe51⤵
- Executes dropped EXE
PID:3108 -
\??\c:\rlfxllf.exec:\rlfxllf.exe52⤵
- Executes dropped EXE
PID:2768 -
\??\c:\xxllxxr.exec:\xxllxxr.exe53⤵
- Executes dropped EXE
PID:1400 -
\??\c:\5rlfrlf.exec:\5rlfrlf.exe54⤵
- Executes dropped EXE
PID:3644 -
\??\c:\hththt.exec:\hththt.exe55⤵
- Executes dropped EXE
PID:1352 -
\??\c:\5pjpj.exec:\5pjpj.exe56⤵
- Executes dropped EXE
PID:376 -
\??\c:\ddjpj.exec:\ddjpj.exe57⤵
- Executes dropped EXE
PID:5088 -
\??\c:\lfllxlr.exec:\lfllxlr.exe58⤵
- Executes dropped EXE
PID:3420 -
\??\c:\9flxlfx.exec:\9flxlfx.exe59⤵
- Executes dropped EXE
PID:5004 -
\??\c:\9ntnhh.exec:\9ntnhh.exe60⤵
- Executes dropped EXE
PID:4292 -
\??\c:\ntnbnh.exec:\ntnbnh.exe61⤵
- Executes dropped EXE
PID:3144 -
\??\c:\jvvjv.exec:\jvvjv.exe62⤵
- Executes dropped EXE
PID:1368 -
\??\c:\5ddjv.exec:\5ddjv.exe63⤵
- Executes dropped EXE
PID:1488 -
\??\c:\xrfrlll.exec:\xrfrlll.exe64⤵
- Executes dropped EXE
PID:4260 -
\??\c:\flfxlfr.exec:\flfxlfr.exe65⤵
- Executes dropped EXE
PID:2672 -
\??\c:\tbbnht.exec:\tbbnht.exe66⤵PID:2884
-
\??\c:\5nnhnn.exec:\5nnhnn.exe67⤵PID:4748
-
\??\c:\9vpjp.exec:\9vpjp.exe68⤵PID:4008
-
\??\c:\vjjdp.exec:\vjjdp.exe69⤵PID:2560
-
\??\c:\5xxxfxr.exec:\5xxxfxr.exe70⤵PID:1356
-
\??\c:\5hhtnb.exec:\5hhtnb.exe71⤵PID:4884
-
\??\c:\nbbnbb.exec:\nbbnbb.exe72⤵PID:1704
-
\??\c:\7xrlrlr.exec:\7xrlrlr.exe73⤵PID:1992
-
\??\c:\bhttnb.exec:\bhttnb.exe74⤵PID:1296
-
\??\c:\3pjdp.exec:\3pjdp.exe75⤵PID:5092
-
\??\c:\5nbthh.exec:\5nbthh.exe76⤵PID:3012
-
\??\c:\vpdvj.exec:\vpdvj.exe77⤵PID:4876
-
\??\c:\djdpd.exec:\djdpd.exe78⤵PID:3600
-
\??\c:\lfffxxr.exec:\lfffxxr.exe79⤵PID:4832
-
\??\c:\rxxlfxr.exec:\rxxlfxr.exe80⤵PID:936
-
\??\c:\btbtbt.exec:\btbtbt.exe81⤵PID:1888
-
\??\c:\5ttttn.exec:\5ttttn.exe82⤵PID:4404
-
\??\c:\jdvpp.exec:\jdvpp.exe83⤵PID:1692
-
\??\c:\dvjpd.exec:\dvjpd.exe84⤵PID:1204
-
\??\c:\lflflfr.exec:\lflflfr.exe85⤵PID:1264
-
\??\c:\flfxrlf.exec:\flfxrlf.exe86⤵PID:3248
-
\??\c:\thhbnh.exec:\thhbnh.exe87⤵PID:3388
-
\??\c:\bhhthb.exec:\bhhthb.exe88⤵PID:4472
-
\??\c:\jvpdp.exec:\jvpdp.exe89⤵PID:4516
-
\??\c:\dvpdp.exec:\dvpdp.exe90⤵PID:2352
-
\??\c:\9rrfxrf.exec:\9rrfxrf.exe91⤵PID:3184
-
\??\c:\btnttb.exec:\btnttb.exe92⤵PID:2052
-
\??\c:\htnbnh.exec:\htnbnh.exe93⤵PID:1716
-
\??\c:\pjddp.exec:\pjddp.exe94⤵PID:1796
-
\??\c:\pdjdp.exec:\pdjdp.exe95⤵PID:4528
-
\??\c:\xllfxxx.exec:\xllfxxx.exe96⤵PID:2456
-
\??\c:\1rlxrlf.exec:\1rlxrlf.exe97⤵PID:4976
-
\??\c:\nhntnn.exec:\nhntnn.exe98⤵PID:724
-
\??\c:\5pppp.exec:\5pppp.exe99⤵PID:3960
-
\??\c:\ddvjv.exec:\ddvjv.exe100⤵PID:4108
-
\??\c:\9rrfrlf.exec:\9rrfrlf.exe101⤵PID:3108
-
\??\c:\5rrfrlx.exec:\5rrfrlx.exe102⤵PID:3860
-
\??\c:\nhbtbb.exec:\nhbtbb.exe103⤵PID:3944
-
\??\c:\btnbhb.exec:\btnbhb.exe104⤵PID:3644
-
\??\c:\vpdvj.exec:\vpdvj.exe105⤵PID:2124
-
\??\c:\xrfxfxr.exec:\xrfxfxr.exe106⤵PID:5024
-
\??\c:\fllfxrl.exec:\fllfxrl.exe107⤵PID:1660
-
\??\c:\bnbtnh.exec:\bnbtnh.exe108⤵PID:3928
-
\??\c:\thhnbt.exec:\thhnbt.exe109⤵PID:1552
-
\??\c:\1dvjj.exec:\1dvjj.exe110⤵PID:3532
-
\??\c:\dvjvp.exec:\dvjvp.exe111⤵PID:4360
-
\??\c:\frxrxxf.exec:\frxrxxf.exe112⤵PID:4012
-
\??\c:\ntnhbt.exec:\ntnhbt.exe113⤵PID:2808
-
\??\c:\ntntnh.exec:\ntntnh.exe114⤵PID:2880
-
\??\c:\vpjjv.exec:\vpjjv.exe115⤵PID:3664
-
\??\c:\9rxlrlf.exec:\9rxlrlf.exe116⤵PID:3656
-
\??\c:\bhhbtn.exec:\bhhbtn.exe117⤵PID:3028
-
\??\c:\7nnntt.exec:\7nnntt.exe118⤵PID:5072
-
\??\c:\djvpj.exec:\djvpj.exe119⤵PID:3676
-
\??\c:\xrlxrll.exec:\xrlxrll.exe120⤵PID:1068
-
\??\c:\rxrlxrf.exec:\rxrlxrf.exe121⤵PID:3112
-
\??\c:\bbtnhh.exec:\bbtnhh.exe122⤵PID:2356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-