Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 07:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
11a783f4fe8dc2c925e3fed6e64895b8_JaffaCakes118.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
11a783f4fe8dc2c925e3fed6e64895b8_JaffaCakes118.exe
-
Size
57KB
-
MD5
11a783f4fe8dc2c925e3fed6e64895b8
-
SHA1
79a0364ef4f85bf7c1259b26abaac1945a1b4e0f
-
SHA256
e546d6f3b28a1a9e12a163d9fd5e84c7676d94dc4202bfd71a6ac97fcedc56e1
-
SHA512
a308e35a1684cd4b913fa1dd7f388f3867a1202821004e9161061a4261b5980cc0724ef210e15854e02ff64b70361ae2452cba1ff1f4ff4c71e8c227cd66f7e8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDImXhkf4:ymb3NkkiQ3mdBjFI+M4
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4940-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/904-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3816-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3816 pjjdp.exe 388 fxfxxxr.exe 3100 vpppp.exe 3952 5xlfrxr.exe 904 llllxxx.exe 4972 hnbbbb.exe 3892 1hhhtt.exe 3256 vppjd.exe 4004 3fxrlrr.exe 1340 xrxxrxr.exe 4444 ttttnn.exe 1764 vpvvd.exe 1800 pvpjd.exe 2796 rrrrlll.exe 3940 nhtnnh.exe 2312 dvvdd.exe 4524 rlrlxxx.exe 4532 5xxrllf.exe 3512 hbbbtt.exe 384 vpvpd.exe 4440 9pdvp.exe 3980 xllxrrr.exe 2844 tntttt.exe 1548 7ddpj.exe 4964 rlxxfxx.exe 1680 rrlrlrr.exe 1860 bttnhh.exe 4848 nnbbhn.exe 3228 5fxlrlf.exe 4996 9rxxxxr.exe 3276 nhhbbb.exe 4976 btbbbh.exe 2308 9jvpp.exe 1676 lrxrllf.exe 1528 hhhhnn.exe 4412 jddvv.exe 1672 dvdvp.exe 2996 9fffxxx.exe 3816 xlfflff.exe 388 bbhhhh.exe 1924 jjddv.exe 3100 pdjjv.exe 4448 1lxlfff.exe 4216 nhbbnn.exe 3840 5ntttt.exe 3404 1djdv.exe 3256 vdjpp.exe 2892 fxfffxx.exe 4288 hthhhb.exe 3144 9nnbtt.exe 2280 jdddj.exe 4156 dpvpp.exe 4692 vvjdj.exe 1700 xrxrrll.exe 760 rxffffx.exe 3940 tthhtt.exe 1632 tbbtnt.exe 4652 dvdjj.exe 2904 9djjv.exe 4532 lllffxx.exe 2064 7lrlffx.exe 868 7ntnhh.exe 1028 nnnnhh.exe 2420 9djdv.exe -
resource yara_rule behavioral2/memory/4940-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/904-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/384-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-188-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4940 wrote to memory of 3816 4940 11a783f4fe8dc2c925e3fed6e64895b8_JaffaCakes118.exe 84 PID 4940 wrote to memory of 3816 4940 11a783f4fe8dc2c925e3fed6e64895b8_JaffaCakes118.exe 84 PID 4940 wrote to memory of 3816 4940 11a783f4fe8dc2c925e3fed6e64895b8_JaffaCakes118.exe 84 PID 3816 wrote to memory of 388 3816 pjjdp.exe 85 PID 3816 wrote to memory of 388 3816 pjjdp.exe 85 PID 3816 wrote to memory of 388 3816 pjjdp.exe 85 PID 388 wrote to memory of 3100 388 fxfxxxr.exe 86 PID 388 wrote to memory of 3100 388 fxfxxxr.exe 86 PID 388 wrote to memory of 3100 388 fxfxxxr.exe 86 PID 3100 wrote to memory of 3952 3100 vpppp.exe 87 PID 3100 wrote to memory of 3952 3100 vpppp.exe 87 PID 3100 wrote to memory of 3952 3100 vpppp.exe 87 PID 3952 wrote to memory of 904 3952 5xlfrxr.exe 88 PID 3952 wrote to memory of 904 3952 5xlfrxr.exe 88 PID 3952 wrote to memory of 904 3952 5xlfrxr.exe 88 PID 904 wrote to memory of 4972 904 llllxxx.exe 89 PID 904 wrote to memory of 4972 904 llllxxx.exe 89 PID 904 wrote to memory of 4972 904 llllxxx.exe 89 PID 4972 wrote to memory of 3892 4972 hnbbbb.exe 90 PID 4972 wrote to memory of 3892 4972 hnbbbb.exe 90 PID 4972 wrote to memory of 3892 4972 hnbbbb.exe 90 PID 3892 wrote to memory of 3256 3892 1hhhtt.exe 91 PID 3892 wrote to memory of 3256 3892 1hhhtt.exe 91 PID 3892 wrote to memory of 3256 3892 1hhhtt.exe 91 PID 3256 wrote to memory of 4004 3256 vppjd.exe 92 PID 3256 wrote to memory of 4004 3256 vppjd.exe 92 PID 3256 wrote to memory of 4004 3256 vppjd.exe 92 PID 4004 wrote to memory of 1340 4004 3fxrlrr.exe 93 PID 4004 wrote to memory of 1340 4004 3fxrlrr.exe 93 PID 4004 wrote to memory of 1340 4004 3fxrlrr.exe 93 PID 1340 wrote to memory of 4444 1340 xrxxrxr.exe 94 PID 1340 wrote to memory of 4444 1340 xrxxrxr.exe 94 PID 1340 wrote to memory of 4444 1340 xrxxrxr.exe 94 PID 4444 wrote to memory of 1764 4444 ttttnn.exe 95 PID 4444 wrote to memory of 1764 4444 ttttnn.exe 95 PID 4444 wrote to memory of 1764 4444 ttttnn.exe 95 PID 1764 wrote to memory of 1800 1764 vpvvd.exe 96 PID 1764 wrote to memory of 1800 1764 vpvvd.exe 96 PID 1764 wrote to memory of 1800 1764 vpvvd.exe 96 PID 1800 wrote to memory of 2796 1800 pvpjd.exe 97 PID 1800 wrote to memory of 2796 1800 pvpjd.exe 97 PID 1800 wrote to memory of 2796 1800 pvpjd.exe 97 PID 2796 wrote to memory of 3940 2796 rrrrlll.exe 98 PID 2796 wrote to memory of 3940 2796 rrrrlll.exe 98 PID 2796 wrote to memory of 3940 2796 rrrrlll.exe 98 PID 3940 wrote to memory of 2312 3940 nhtnnh.exe 99 PID 3940 wrote to memory of 2312 3940 nhtnnh.exe 99 PID 3940 wrote to memory of 2312 3940 nhtnnh.exe 99 PID 2312 wrote to memory of 4524 2312 dvvdd.exe 100 PID 2312 wrote to memory of 4524 2312 dvvdd.exe 100 PID 2312 wrote to memory of 4524 2312 dvvdd.exe 100 PID 4524 wrote to memory of 4532 4524 rlrlxxx.exe 101 PID 4524 wrote to memory of 4532 4524 rlrlxxx.exe 101 PID 4524 wrote to memory of 4532 4524 rlrlxxx.exe 101 PID 4532 wrote to memory of 3512 4532 5xxrllf.exe 102 PID 4532 wrote to memory of 3512 4532 5xxrllf.exe 102 PID 4532 wrote to memory of 3512 4532 5xxrllf.exe 102 PID 3512 wrote to memory of 384 3512 hbbbtt.exe 103 PID 3512 wrote to memory of 384 3512 hbbbtt.exe 103 PID 3512 wrote to memory of 384 3512 hbbbtt.exe 103 PID 384 wrote to memory of 4440 384 vpvpd.exe 104 PID 384 wrote to memory of 4440 384 vpvpd.exe 104 PID 384 wrote to memory of 4440 384 vpvpd.exe 104 PID 4440 wrote to memory of 3980 4440 9pdvp.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\11a783f4fe8dc2c925e3fed6e64895b8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\11a783f4fe8dc2c925e3fed6e64895b8_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\pjjdp.exec:\pjjdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\vpppp.exec:\vpppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\5xlfrxr.exec:\5xlfrxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\llllxxx.exec:\llllxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
\??\c:\hnbbbb.exec:\hnbbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\1hhhtt.exec:\1hhhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\vppjd.exec:\vppjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\3fxrlrr.exec:\3fxrlrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\xrxxrxr.exec:\xrxxrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\ttttnn.exec:\ttttnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\vpvvd.exec:\vpvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\pvpjd.exec:\pvpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\rrrrlll.exec:\rrrrlll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\nhtnnh.exec:\nhtnnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\dvvdd.exec:\dvvdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\rlrlxxx.exec:\rlrlxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\5xxrllf.exec:\5xxrllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\hbbbtt.exec:\hbbbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\vpvpd.exec:\vpvpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\9pdvp.exec:\9pdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\xllxrrr.exec:\xllxrrr.exe23⤵
- Executes dropped EXE
PID:3980 -
\??\c:\tntttt.exec:\tntttt.exe24⤵
- Executes dropped EXE
PID:2844 -
\??\c:\7ddpj.exec:\7ddpj.exe25⤵
- Executes dropped EXE
PID:1548 -
\??\c:\rlxxfxx.exec:\rlxxfxx.exe26⤵
- Executes dropped EXE
PID:4964 -
\??\c:\rrlrlrr.exec:\rrlrlrr.exe27⤵
- Executes dropped EXE
PID:1680 -
\??\c:\bttnhh.exec:\bttnhh.exe28⤵
- Executes dropped EXE
PID:1860 -
\??\c:\nnbbhn.exec:\nnbbhn.exe29⤵
- Executes dropped EXE
PID:4848 -
\??\c:\5fxlrlf.exec:\5fxlrlf.exe30⤵
- Executes dropped EXE
PID:3228 -
\??\c:\9rxxxxr.exec:\9rxxxxr.exe31⤵
- Executes dropped EXE
PID:4996 -
\??\c:\nhhbbb.exec:\nhhbbb.exe32⤵
- Executes dropped EXE
PID:3276 -
\??\c:\btbbbh.exec:\btbbbh.exe33⤵
- Executes dropped EXE
PID:4976 -
\??\c:\9jvpp.exec:\9jvpp.exe34⤵
- Executes dropped EXE
PID:2308 -
\??\c:\lrxrllf.exec:\lrxrllf.exe35⤵
- Executes dropped EXE
PID:1676 -
\??\c:\hhhhnn.exec:\hhhhnn.exe36⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jddvv.exec:\jddvv.exe37⤵
- Executes dropped EXE
PID:4412 -
\??\c:\dvdvp.exec:\dvdvp.exe38⤵
- Executes dropped EXE
PID:1672 -
\??\c:\9fffxxx.exec:\9fffxxx.exe39⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xlfflff.exec:\xlfflff.exe40⤵
- Executes dropped EXE
PID:3816 -
\??\c:\bbhhhh.exec:\bbhhhh.exe41⤵
- Executes dropped EXE
PID:388 -
\??\c:\jjddv.exec:\jjddv.exe42⤵
- Executes dropped EXE
PID:1924 -
\??\c:\pdjjv.exec:\pdjjv.exe43⤵
- Executes dropped EXE
PID:3100 -
\??\c:\1lxlfff.exec:\1lxlfff.exe44⤵
- Executes dropped EXE
PID:4448 -
\??\c:\nhbbnn.exec:\nhbbnn.exe45⤵
- Executes dropped EXE
PID:4216 -
\??\c:\5ntttt.exec:\5ntttt.exe46⤵
- Executes dropped EXE
PID:3840 -
\??\c:\1djdv.exec:\1djdv.exe47⤵
- Executes dropped EXE
PID:3404 -
\??\c:\vdjpp.exec:\vdjpp.exe48⤵
- Executes dropped EXE
PID:3256 -
\??\c:\fxfffxx.exec:\fxfffxx.exe49⤵
- Executes dropped EXE
PID:2892 -
\??\c:\hthhhb.exec:\hthhhb.exe50⤵
- Executes dropped EXE
PID:4288 -
\??\c:\9nnbtt.exec:\9nnbtt.exe51⤵
- Executes dropped EXE
PID:3144 -
\??\c:\jdddj.exec:\jdddj.exe52⤵
- Executes dropped EXE
PID:2280 -
\??\c:\dpvpp.exec:\dpvpp.exe53⤵
- Executes dropped EXE
PID:4156 -
\??\c:\vvjdj.exec:\vvjdj.exe54⤵
- Executes dropped EXE
PID:4692 -
\??\c:\xrxrrll.exec:\xrxrrll.exe55⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rxffffx.exec:\rxffffx.exe56⤵
- Executes dropped EXE
PID:760 -
\??\c:\tthhtt.exec:\tthhtt.exe57⤵
- Executes dropped EXE
PID:3940 -
\??\c:\tbbtnt.exec:\tbbtnt.exe58⤵
- Executes dropped EXE
PID:1632 -
\??\c:\dvdjj.exec:\dvdjj.exe59⤵
- Executes dropped EXE
PID:4652 -
\??\c:\9djjv.exec:\9djjv.exe60⤵
- Executes dropped EXE
PID:2904 -
\??\c:\lllffxx.exec:\lllffxx.exe61⤵
- Executes dropped EXE
PID:4532 -
\??\c:\7lrlffx.exec:\7lrlffx.exe62⤵
- Executes dropped EXE
PID:2064 -
\??\c:\7ntnhh.exec:\7ntnhh.exe63⤵
- Executes dropped EXE
PID:868 -
\??\c:\nnnnhh.exec:\nnnnhh.exe64⤵
- Executes dropped EXE
PID:1028 -
\??\c:\9djdv.exec:\9djdv.exe65⤵
- Executes dropped EXE
PID:2420 -
\??\c:\pvjdv.exec:\pvjdv.exe66⤵PID:1488
-
\??\c:\fxlfllr.exec:\fxlfllr.exe67⤵PID:1052
-
\??\c:\3xllllr.exec:\3xllllr.exe68⤵PID:2564
-
\??\c:\7hhhnn.exec:\7hhhnn.exe69⤵PID:4984
-
\??\c:\5httbb.exec:\5httbb.exe70⤵PID:1728
-
\??\c:\djdjj.exec:\djdjj.exe71⤵PID:1788
-
\??\c:\vvdvd.exec:\vvdvd.exe72⤵PID:3664
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe73⤵PID:3584
-
\??\c:\9flfxxr.exec:\9flfxxr.exe74⤵PID:3616
-
\??\c:\hbhbtt.exec:\hbhbtt.exe75⤵PID:3864
-
\??\c:\9hnhbb.exec:\9hnhbb.exe76⤵PID:2708
-
\??\c:\5pvpj.exec:\5pvpj.exe77⤵PID:4872
-
\??\c:\7jpvv.exec:\7jpvv.exe78⤵PID:3788
-
\??\c:\vvpjj.exec:\vvpjj.exe79⤵PID:3716
-
\??\c:\lfrxrfx.exec:\lfrxrfx.exe80⤵PID:2028
-
\??\c:\7fxxxrl.exec:\7fxxxrl.exe81⤵PID:880
-
\??\c:\7hhnnn.exec:\7hhnnn.exe82⤵PID:4408
-
\??\c:\bbhbtn.exec:\bbhbtn.exe83⤵PID:1992
-
\??\c:\xxlrrxx.exec:\xxlrrxx.exe84⤵PID:2680
-
\??\c:\bbtnhn.exec:\bbtnhn.exe85⤵PID:2832
-
\??\c:\bbhhbh.exec:\bbhhbh.exe86⤵PID:4108
-
\??\c:\vddpp.exec:\vddpp.exe87⤵PID:3052
-
\??\c:\lrrlfff.exec:\lrrlfff.exe88⤵PID:3956
-
\??\c:\rflllff.exec:\rflllff.exe89⤵PID:3640
-
\??\c:\bhbbnh.exec:\bhbbnh.exe90⤵PID:3400
-
\??\c:\1ntntt.exec:\1ntntt.exe91⤵PID:4092
-
\??\c:\vpjpp.exec:\vpjpp.exe92⤵PID:4232
-
\??\c:\xrxrlrr.exec:\xrxrlrr.exe93⤵PID:3420
-
\??\c:\lrrrfff.exec:\lrrrfff.exe94⤵PID:4828
-
\??\c:\btbttn.exec:\btbttn.exe95⤵PID:3712
-
\??\c:\dvjvd.exec:\dvjvd.exe96⤵PID:1384
-
\??\c:\vddvj.exec:\vddvj.exe97⤵PID:4312
-
\??\c:\9rxrfrl.exec:\9rxrfrl.exe98⤵PID:1852
-
\??\c:\xfxxrrr.exec:\xfxxrrr.exe99⤵PID:3852
-
\??\c:\btbhtt.exec:\btbhtt.exe100⤵PID:1700
-
\??\c:\thhtnh.exec:\thhtnh.exe101⤵PID:2184
-
\??\c:\7ppjv.exec:\7ppjv.exe102⤵PID:3940
-
\??\c:\pddpj.exec:\pddpj.exe103⤵PID:4524
-
\??\c:\rxrfrlf.exec:\rxrfrlf.exe104⤵PID:3880
-
\??\c:\llffrrr.exec:\llffrrr.exe105⤵PID:4576
-
\??\c:\bbbtbb.exec:\bbbtbb.exe106⤵PID:1912
-
\??\c:\nhhbnn.exec:\nhhbnn.exe107⤵PID:3532
-
\??\c:\5pjdp.exec:\5pjdp.exe108⤵PID:868
-
\??\c:\3pdpj.exec:\3pdpj.exe109⤵PID:3672
-
\??\c:\rrxxllx.exec:\rrxxllx.exe110⤵PID:556
-
\??\c:\7xrfxlf.exec:\7xrfxlf.exe111⤵PID:4892
-
\??\c:\nhnhbt.exec:\nhnhbt.exe112⤵PID:4068
-
\??\c:\5nnhnh.exec:\5nnhnh.exe113⤵PID:3232
-
\??\c:\9pjjv.exec:\9pjjv.exe114⤵PID:4484
-
\??\c:\lllxlfr.exec:\lllxlfr.exe115⤵PID:3708
-
\??\c:\lffxlll.exec:\lffxlll.exe116⤵PID:4852
-
\??\c:\bbbtht.exec:\bbbtht.exe117⤵PID:3200
-
\??\c:\pdjjj.exec:\pdjjj.exe118⤵PID:3772
-
\??\c:\1ddpd.exec:\1ddpd.exe119⤵PID:3596
-
\??\c:\xrrfrlf.exec:\xrrfrlf.exe120⤵PID:820
-
\??\c:\xrxxxxr.exec:\xrxxxxr.exe121⤵PID:4976
-
\??\c:\thttnn.exec:\thttnn.exe122⤵PID:3224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-