Analysis
-
max time kernel
149s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 09:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
12180c3605b3e9d5bfa6e6f990b012d8_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
12180c3605b3e9d5bfa6e6f990b012d8_JaffaCakes118.exe
-
Size
75KB
-
MD5
12180c3605b3e9d5bfa6e6f990b012d8
-
SHA1
f21b1314e7b1fb3adb109958c9904ae7f966ead3
-
SHA256
1de64702f8f94e5a6b28fa6a699c1d5dc782a4d691181efe86f63d7967c1af2b
-
SHA512
09269e8ad9ebe80e4895e3082dd66a728a1094cad3eb0dcd0270cf29695e874c01e94208fa371c26a6ab0fd7699cc84173ffad2f82a1e6fa701242dc01353b18
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+DQmqc7vMohS:ymb3NkkiQ3mdBjF+3TCg7EQS
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2072-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/380-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/808-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1336-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1300-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2712 xxxlfrr.exe 5096 hbnnhh.exe 4684 1vpjd.exe 3700 jjjdv.exe 2292 rllfxxr.exe 2560 xxxrrll.exe 4392 tnbbtt.exe 436 bhhhhn.exe 4724 dpjpd.exe 380 5lrrlll.exe 808 nbhhhh.exe 2520 jdjjd.exe 5100 vjvvp.exe 3752 fxfxxrr.exe 1336 hbnntt.exe 4824 dpppj.exe 4084 ppvpj.exe 4672 rxffxlx.exe 3084 nhhbtt.exe 3404 3dvvj.exe 5044 1xfxrlf.exe 1300 nhhhbb.exe 4304 pdjpp.exe 1908 xxxrlxx.exe 4584 fxlxxxf.exe 3316 ttthnh.exe 1328 3vdvv.exe 2028 rlrrrrr.exe 4924 bhnttb.exe 2416 vjpdd.exe 3212 djvjv.exe 1432 xrlxlfr.exe 2888 bbhhbb.exe 1888 hnbnnt.exe 4236 jvddv.exe 5028 ppvvv.exe 1448 hbhhbb.exe 2900 nhhhbb.exe 540 vvvdd.exe 2036 xrllrrx.exe 4316 xxxxrrr.exe 1616 nhnhtn.exe 5096 hntnhh.exe 1876 rrxlrxr.exe 2376 bbtbtt.exe 4432 nhhbtt.exe 3808 pdjpj.exe 4848 5vvpj.exe 3924 xlrrlll.exe 736 bnbbbb.exe 3204 jpppp.exe 244 nnhhhh.exe 4696 vppjd.exe 3892 lxxxrxl.exe 2084 hhhhhn.exe 1092 bhtttt.exe 3752 jpjpv.exe 1336 ppjdp.exe 4556 3fxlxrx.exe 4084 rfxrfrl.exe 1444 hhtbhh.exe 2052 nbnhtn.exe 3660 jvddv.exe 1796 pjjdv.exe -
resource yara_rule behavioral2/memory/2072-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4392-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/380-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/808-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1300-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2072 wrote to memory of 2712 2072 12180c3605b3e9d5bfa6e6f990b012d8_JaffaCakes118.exe 83 PID 2072 wrote to memory of 2712 2072 12180c3605b3e9d5bfa6e6f990b012d8_JaffaCakes118.exe 83 PID 2072 wrote to memory of 2712 2072 12180c3605b3e9d5bfa6e6f990b012d8_JaffaCakes118.exe 83 PID 2712 wrote to memory of 5096 2712 xxxlfrr.exe 84 PID 2712 wrote to memory of 5096 2712 xxxlfrr.exe 84 PID 2712 wrote to memory of 5096 2712 xxxlfrr.exe 84 PID 5096 wrote to memory of 4684 5096 hbnnhh.exe 85 PID 5096 wrote to memory of 4684 5096 hbnnhh.exe 85 PID 5096 wrote to memory of 4684 5096 hbnnhh.exe 85 PID 4684 wrote to memory of 3700 4684 1vpjd.exe 86 PID 4684 wrote to memory of 3700 4684 1vpjd.exe 86 PID 4684 wrote to memory of 3700 4684 1vpjd.exe 86 PID 3700 wrote to memory of 2292 3700 jjjdv.exe 87 PID 3700 wrote to memory of 2292 3700 jjjdv.exe 87 PID 3700 wrote to memory of 2292 3700 jjjdv.exe 87 PID 2292 wrote to memory of 2560 2292 rllfxxr.exe 88 PID 2292 wrote to memory of 2560 2292 rllfxxr.exe 88 PID 2292 wrote to memory of 2560 2292 rllfxxr.exe 88 PID 2560 wrote to memory of 4392 2560 xxxrrll.exe 89 PID 2560 wrote to memory of 4392 2560 xxxrrll.exe 89 PID 2560 wrote to memory of 4392 2560 xxxrrll.exe 89 PID 4392 wrote to memory of 436 4392 tnbbtt.exe 90 PID 4392 wrote to memory of 436 4392 tnbbtt.exe 90 PID 4392 wrote to memory of 436 4392 tnbbtt.exe 90 PID 436 wrote to memory of 4724 436 bhhhhn.exe 91 PID 436 wrote to memory of 4724 436 bhhhhn.exe 91 PID 436 wrote to memory of 4724 436 bhhhhn.exe 91 PID 4724 wrote to memory of 380 4724 dpjpd.exe 92 PID 4724 wrote to memory of 380 4724 dpjpd.exe 92 PID 4724 wrote to memory of 380 4724 dpjpd.exe 92 PID 380 wrote to memory of 808 380 5lrrlll.exe 93 PID 380 wrote to memory of 808 380 5lrrlll.exe 93 PID 380 wrote to memory of 808 380 5lrrlll.exe 93 PID 808 wrote to memory of 2520 808 nbhhhh.exe 94 PID 808 wrote to memory of 2520 808 nbhhhh.exe 94 PID 808 wrote to memory of 2520 808 nbhhhh.exe 94 PID 2520 wrote to memory of 5100 2520 jdjjd.exe 95 PID 2520 wrote to memory of 5100 2520 jdjjd.exe 95 PID 2520 wrote to memory of 5100 2520 jdjjd.exe 95 PID 5100 wrote to memory of 3752 5100 vjvvp.exe 96 PID 5100 wrote to memory of 3752 5100 vjvvp.exe 96 PID 5100 wrote to memory of 3752 5100 vjvvp.exe 96 PID 3752 wrote to memory of 1336 3752 fxfxxrr.exe 97 PID 3752 wrote to memory of 1336 3752 fxfxxrr.exe 97 PID 3752 wrote to memory of 1336 3752 fxfxxrr.exe 97 PID 1336 wrote to memory of 4824 1336 hbnntt.exe 98 PID 1336 wrote to memory of 4824 1336 hbnntt.exe 98 PID 1336 wrote to memory of 4824 1336 hbnntt.exe 98 PID 4824 wrote to memory of 4084 4824 dpppj.exe 99 PID 4824 wrote to memory of 4084 4824 dpppj.exe 99 PID 4824 wrote to memory of 4084 4824 dpppj.exe 99 PID 4084 wrote to memory of 4672 4084 ppvpj.exe 100 PID 4084 wrote to memory of 4672 4084 ppvpj.exe 100 PID 4084 wrote to memory of 4672 4084 ppvpj.exe 100 PID 4672 wrote to memory of 3084 4672 rxffxlx.exe 101 PID 4672 wrote to memory of 3084 4672 rxffxlx.exe 101 PID 4672 wrote to memory of 3084 4672 rxffxlx.exe 101 PID 3084 wrote to memory of 3404 3084 nhhbtt.exe 102 PID 3084 wrote to memory of 3404 3084 nhhbtt.exe 102 PID 3084 wrote to memory of 3404 3084 nhhbtt.exe 102 PID 3404 wrote to memory of 5044 3404 3dvvj.exe 103 PID 3404 wrote to memory of 5044 3404 3dvvj.exe 103 PID 3404 wrote to memory of 5044 3404 3dvvj.exe 103 PID 5044 wrote to memory of 1300 5044 1xfxrlf.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\12180c3605b3e9d5bfa6e6f990b012d8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\12180c3605b3e9d5bfa6e6f990b012d8_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\xxxlfrr.exec:\xxxlfrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\hbnnhh.exec:\hbnnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\1vpjd.exec:\1vpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\jjjdv.exec:\jjjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\rllfxxr.exec:\rllfxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\xxxrrll.exec:\xxxrrll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\tnbbtt.exec:\tnbbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\bhhhhn.exec:\bhhhhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\dpjpd.exec:\dpjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\5lrrlll.exec:\5lrrlll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\nbhhhh.exec:\nbhhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\jdjjd.exec:\jdjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\vjvvp.exec:\vjvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\hbnntt.exec:\hbnntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\dpppj.exec:\dpppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\ppvpj.exec:\ppvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\rxffxlx.exec:\rxffxlx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\nhhbtt.exec:\nhhbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\3dvvj.exec:\3dvvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\1xfxrlf.exec:\1xfxrlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\nhhhbb.exec:\nhhhbb.exe23⤵
- Executes dropped EXE
PID:1300 -
\??\c:\pdjpp.exec:\pdjpp.exe24⤵
- Executes dropped EXE
PID:4304 -
\??\c:\xxxrlxx.exec:\xxxrlxx.exe25⤵
- Executes dropped EXE
PID:1908 -
\??\c:\fxlxxxf.exec:\fxlxxxf.exe26⤵
- Executes dropped EXE
PID:4584 -
\??\c:\ttthnh.exec:\ttthnh.exe27⤵
- Executes dropped EXE
PID:3316 -
\??\c:\3vdvv.exec:\3vdvv.exe28⤵
- Executes dropped EXE
PID:1328 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe29⤵
- Executes dropped EXE
PID:2028 -
\??\c:\bhnttb.exec:\bhnttb.exe30⤵
- Executes dropped EXE
PID:4924 -
\??\c:\vjpdd.exec:\vjpdd.exe31⤵
- Executes dropped EXE
PID:2416 -
\??\c:\djvjv.exec:\djvjv.exe32⤵
- Executes dropped EXE
PID:3212 -
\??\c:\xrlxlfr.exec:\xrlxlfr.exe33⤵
- Executes dropped EXE
PID:1432 -
\??\c:\bbhhbb.exec:\bbhhbb.exe34⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hnbnnt.exec:\hnbnnt.exe35⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jvddv.exec:\jvddv.exe36⤵
- Executes dropped EXE
PID:4236 -
\??\c:\ppvvv.exec:\ppvvv.exe37⤵
- Executes dropped EXE
PID:5028 -
\??\c:\hbhhbb.exec:\hbhhbb.exe38⤵
- Executes dropped EXE
PID:1448 -
\??\c:\nhhhbb.exec:\nhhhbb.exe39⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vvvdd.exec:\vvvdd.exe40⤵
- Executes dropped EXE
PID:540 -
\??\c:\xrllrrx.exec:\xrllrrx.exe41⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xxxxrrr.exec:\xxxxrrr.exe42⤵
- Executes dropped EXE
PID:4316 -
\??\c:\nhnhtn.exec:\nhnhtn.exe43⤵
- Executes dropped EXE
PID:1616 -
\??\c:\hntnhh.exec:\hntnhh.exe44⤵
- Executes dropped EXE
PID:5096 -
\??\c:\rrxlrxr.exec:\rrxlrxr.exe45⤵
- Executes dropped EXE
PID:1876 -
\??\c:\bbtbtt.exec:\bbtbtt.exe46⤵
- Executes dropped EXE
PID:2376 -
\??\c:\nhhbtt.exec:\nhhbtt.exe47⤵
- Executes dropped EXE
PID:4432 -
\??\c:\pdjpj.exec:\pdjpj.exe48⤵
- Executes dropped EXE
PID:3808 -
\??\c:\5vvpj.exec:\5vvpj.exe49⤵
- Executes dropped EXE
PID:4848 -
\??\c:\xlrrlll.exec:\xlrrlll.exe50⤵
- Executes dropped EXE
PID:3924 -
\??\c:\bnbbbb.exec:\bnbbbb.exe51⤵
- Executes dropped EXE
PID:736 -
\??\c:\jpppp.exec:\jpppp.exe52⤵
- Executes dropped EXE
PID:3204 -
\??\c:\nnhhhh.exec:\nnhhhh.exe53⤵
- Executes dropped EXE
PID:244 -
\??\c:\vppjd.exec:\vppjd.exe54⤵
- Executes dropped EXE
PID:4696 -
\??\c:\lxxxrxl.exec:\lxxxrxl.exe55⤵
- Executes dropped EXE
PID:3892 -
\??\c:\hhhhhn.exec:\hhhhhn.exe56⤵
- Executes dropped EXE
PID:2084 -
\??\c:\bhtttt.exec:\bhtttt.exe57⤵
- Executes dropped EXE
PID:1092 -
\??\c:\jpjpv.exec:\jpjpv.exe58⤵
- Executes dropped EXE
PID:3752 -
\??\c:\ppjdp.exec:\ppjdp.exe59⤵
- Executes dropped EXE
PID:1336 -
\??\c:\3fxlxrx.exec:\3fxlxrx.exe60⤵
- Executes dropped EXE
PID:4556 -
\??\c:\rfxrfrl.exec:\rfxrfrl.exe61⤵
- Executes dropped EXE
PID:4084 -
\??\c:\hhtbhh.exec:\hhtbhh.exe62⤵
- Executes dropped EXE
PID:1444 -
\??\c:\nbnhtn.exec:\nbnhtn.exe63⤵
- Executes dropped EXE
PID:2052 -
\??\c:\jvddv.exec:\jvddv.exe64⤵
- Executes dropped EXE
PID:3660 -
\??\c:\pjjdv.exec:\pjjdv.exe65⤵
- Executes dropped EXE
PID:1796 -
\??\c:\rxrfxxf.exec:\rxrfxxf.exe66⤵PID:5044
-
\??\c:\llffxxr.exec:\llffxxr.exe67⤵PID:2008
-
\??\c:\ttnbtt.exec:\ttnbtt.exe68⤵PID:944
-
\??\c:\nhnhtb.exec:\nhnhtb.exe69⤵PID:3112
-
\??\c:\vvvvv.exec:\vvvvv.exe70⤵PID:3816
-
\??\c:\rxfxxfx.exec:\rxfxxfx.exe71⤵PID:1208
-
\??\c:\hbbthh.exec:\hbbthh.exe72⤵PID:3316
-
\??\c:\dpvpj.exec:\dpvpj.exe73⤵PID:2216
-
\??\c:\rrxxrxx.exec:\rrxxrxx.exe74⤵PID:3584
-
\??\c:\rflffxr.exec:\rflffxr.exe75⤵PID:2028
-
\??\c:\nhntnh.exec:\nhntnh.exe76⤵PID:1800
-
\??\c:\ntbnbt.exec:\ntbnbt.exe77⤵PID:1576
-
\??\c:\pvvvp.exec:\pvvvp.exe78⤵PID:3448
-
\??\c:\vpvpj.exec:\vpvpj.exe79⤵PID:3212
-
\??\c:\xllfxfx.exec:\xllfxfx.exe80⤵PID:4036
-
\??\c:\bhhnnn.exec:\bhhnnn.exe81⤵PID:1872
-
\??\c:\ttbttn.exec:\ttbttn.exe82⤵PID:5076
-
\??\c:\vpppd.exec:\vpppd.exe83⤵PID:1176
-
\??\c:\vjjpd.exec:\vjjpd.exe84⤵PID:744
-
\??\c:\fxxrffx.exec:\fxxrffx.exe85⤵PID:2540
-
\??\c:\frlfllx.exec:\frlfllx.exe86⤵PID:4336
-
\??\c:\hbtnhh.exec:\hbtnhh.exe87⤵PID:2740
-
\??\c:\7nhbtt.exec:\7nhbtt.exe88⤵PID:1532
-
\??\c:\jpvpv.exec:\jpvpv.exe89⤵PID:2380
-
\??\c:\djvpp.exec:\djvpp.exe90⤵PID:3176
-
\??\c:\rlrxxxx.exec:\rlrxxxx.exe91⤵PID:3188
-
\??\c:\1xrlffx.exec:\1xrlffx.exe92⤵PID:2292
-
\??\c:\bbtnhh.exec:\bbtnhh.exe93⤵PID:4432
-
\??\c:\tnnnbn.exec:\tnnnbn.exe94⤵PID:2940
-
\??\c:\7pvjv.exec:\7pvjv.exe95⤵PID:4848
-
\??\c:\pdjdp.exec:\pdjdp.exe96⤵PID:5064
-
\??\c:\lrxllfx.exec:\lrxllfx.exe97⤵PID:3924
-
\??\c:\rrrxfrr.exec:\rrrxfrr.exe98⤵PID:3976
-
\??\c:\bntttt.exec:\bntttt.exe99⤵PID:2276
-
\??\c:\5bbnnn.exec:\5bbnnn.exe100⤵PID:2728
-
\??\c:\pjdpd.exec:\pjdpd.exe101⤵PID:1544
-
\??\c:\jvddv.exec:\jvddv.exe102⤵PID:3684
-
\??\c:\fxrrfrr.exec:\fxrrfrr.exe103⤵PID:3880
-
\??\c:\9rrlffx.exec:\9rrlffx.exe104⤵PID:2220
-
\??\c:\nbhnhn.exec:\nbhnhn.exe105⤵PID:3788
-
\??\c:\hbbbnb.exec:\hbbbnb.exe106⤵PID:1336
-
\??\c:\ddjdj.exec:\ddjdj.exe107⤵PID:2288
-
\??\c:\rllfxrl.exec:\rllfxrl.exe108⤵PID:4084
-
\??\c:\5fxlflr.exec:\5fxlflr.exe109⤵PID:3084
-
\??\c:\hnhbbh.exec:\hnhbbh.exe110⤵PID:3932
-
\??\c:\htttnn.exec:\htttnn.exe111⤵PID:4396
-
\??\c:\3jjjv.exec:\3jjjv.exe112⤵PID:1796
-
\??\c:\dpvvj.exec:\dpvvj.exe113⤵PID:5044
-
\??\c:\llrlffx.exec:\llrlffx.exe114⤵PID:2008
-
\??\c:\ntbttn.exec:\ntbttn.exe115⤵PID:1908
-
\??\c:\ntbbbb.exec:\ntbbbb.exe116⤵PID:2736
-
\??\c:\dvvpj.exec:\dvvpj.exe117⤵PID:4820
-
\??\c:\7pddv.exec:\7pddv.exe118⤵PID:2328
-
\??\c:\lxxrfff.exec:\lxxrfff.exe119⤵PID:3936
-
\??\c:\lflfxxx.exec:\lflfxxx.exe120⤵PID:2216
-
\??\c:\hhnhhh.exec:\hhnhhh.exe121⤵PID:3556
-
\??\c:\djjjd.exec:\djjjd.exe122⤵PID:2028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-