Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 18:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2eae122ef4461ec2602b32d912c11610_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
2eae122ef4461ec2602b32d912c11610_JaffaCakes118.exe
-
Size
94KB
-
MD5
2eae122ef4461ec2602b32d912c11610
-
SHA1
663ea79659ca156209f987eca93fa42c018e4f52
-
SHA256
13201bc7698d14b4fa70884748dad8b7c2565ad46a8cf1da5879192b7bb5a938
-
SHA512
087505974c0a7457f78e9628d9c5c59c1b91b24a7312a7aa8d2016cf6ef1ba49bf9fda50f31fc6adc7a6beefc6448e5d2edb6a08548d8f1ce2357914367706d8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIS7/b9EUeWpEC3alBlwtn8BLnnI:ymb3NkkiQ3mdBjFIi/REUZnKlbnI
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/1948-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1348-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1776-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1060-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1548-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1388-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1424-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2936 7frrxxr.exe 2756 20266.exe 2572 pjddp.exe 2576 4684668.exe 2692 008862.exe 2344 24400.exe 2436 8240620.exe 2484 httbbn.exe 1348 rfrrxxf.exe 2696 llfrlrl.exe 2860 42068.exe 2156 26642.exe 1992 g8000.exe 2000 djvvd.exe 1776 rlxrxxf.exe 1060 264426.exe 784 9xllffr.exe 2208 1xfffxf.exe 1616 4244062.exe 2256 btbthn.exe 2300 ntnbbh.exe 412 rfxxxxx.exe 3004 dppvd.exe 1548 6480246.exe 1388 ppjjv.exe 1636 pdvdj.exe 604 dvjjp.exe 2176 3jdjp.exe 3028 1vdpv.exe 1500 jdppd.exe 1424 6424062.exe 1592 88282.exe 2836 44020.exe 2944 llxfrrx.exe 1808 vpvjv.exe 2980 g4620.exe 2572 frllrlr.exe 2768 48068.exe 2580 i440880.exe 2536 bnbhnt.exe 2600 ppvpj.exe 2492 rfllfff.exe 1796 s8228.exe 2880 824484.exe 2688 20844.exe 2744 q24684.exe 2520 6842466.exe 1756 pdvpv.exe 2392 7xrrflr.exe 1196 a8406.exe 1220 86266.exe 2000 lxxlxfl.exe 336 806022.exe 1336 280262.exe 780 084466.exe 1484 jdjdp.exe 1208 6428444.exe 2088 q02648.exe 2100 dvvpv.exe 500 086284.exe 3024 pjjvv.exe 452 48628.exe 3004 22280.exe 1328 3lxxfll.exe -
resource yara_rule behavioral1/memory/1948-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1348-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1388-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1424-307-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1948 wrote to memory of 2936 1948 2eae122ef4461ec2602b32d912c11610_JaffaCakes118.exe 28 PID 1948 wrote to memory of 2936 1948 2eae122ef4461ec2602b32d912c11610_JaffaCakes118.exe 28 PID 1948 wrote to memory of 2936 1948 2eae122ef4461ec2602b32d912c11610_JaffaCakes118.exe 28 PID 1948 wrote to memory of 2936 1948 2eae122ef4461ec2602b32d912c11610_JaffaCakes118.exe 28 PID 2936 wrote to memory of 2756 2936 7frrxxr.exe 29 PID 2936 wrote to memory of 2756 2936 7frrxxr.exe 29 PID 2936 wrote to memory of 2756 2936 7frrxxr.exe 29 PID 2936 wrote to memory of 2756 2936 7frrxxr.exe 29 PID 2756 wrote to memory of 2572 2756 20266.exe 30 PID 2756 wrote to memory of 2572 2756 20266.exe 30 PID 2756 wrote to memory of 2572 2756 20266.exe 30 PID 2756 wrote to memory of 2572 2756 20266.exe 30 PID 2572 wrote to memory of 2576 2572 pjddp.exe 31 PID 2572 wrote to memory of 2576 2572 pjddp.exe 31 PID 2572 wrote to memory of 2576 2572 pjddp.exe 31 PID 2572 wrote to memory of 2576 2572 pjddp.exe 31 PID 2576 wrote to memory of 2692 2576 4684668.exe 32 PID 2576 wrote to memory of 2692 2576 4684668.exe 32 PID 2576 wrote to memory of 2692 2576 4684668.exe 32 PID 2576 wrote to memory of 2692 2576 4684668.exe 32 PID 2692 wrote to memory of 2344 2692 008862.exe 33 PID 2692 wrote to memory of 2344 2692 008862.exe 33 PID 2692 wrote to memory of 2344 2692 008862.exe 33 PID 2692 wrote to memory of 2344 2692 008862.exe 33 PID 2344 wrote to memory of 2436 2344 24400.exe 34 PID 2344 wrote to memory of 2436 2344 24400.exe 34 PID 2344 wrote to memory of 2436 2344 24400.exe 34 PID 2344 wrote to memory of 2436 2344 24400.exe 34 PID 2436 wrote to memory of 2484 2436 8240620.exe 35 PID 2436 wrote to memory of 2484 2436 8240620.exe 35 PID 2436 wrote to memory of 2484 2436 8240620.exe 35 PID 2436 wrote to memory of 2484 2436 8240620.exe 35 PID 2484 wrote to memory of 1348 2484 httbbn.exe 36 PID 2484 wrote to memory of 1348 2484 httbbn.exe 36 PID 2484 wrote to memory of 1348 2484 httbbn.exe 36 PID 2484 wrote to memory of 1348 2484 httbbn.exe 36 PID 1348 wrote to memory of 2696 1348 rfrrxxf.exe 37 PID 1348 wrote to memory of 2696 1348 rfrrxxf.exe 37 PID 1348 wrote to memory of 2696 1348 rfrrxxf.exe 37 PID 1348 wrote to memory of 2696 1348 rfrrxxf.exe 37 PID 2696 wrote to memory of 2860 2696 llfrlrl.exe 38 PID 2696 wrote to memory of 2860 2696 llfrlrl.exe 38 PID 2696 wrote to memory of 2860 2696 llfrlrl.exe 38 PID 2696 wrote to memory of 2860 2696 llfrlrl.exe 38 PID 2860 wrote to memory of 2156 2860 42068.exe 39 PID 2860 wrote to memory of 2156 2860 42068.exe 39 PID 2860 wrote to memory of 2156 2860 42068.exe 39 PID 2860 wrote to memory of 2156 2860 42068.exe 39 PID 2156 wrote to memory of 1992 2156 26642.exe 40 PID 2156 wrote to memory of 1992 2156 26642.exe 40 PID 2156 wrote to memory of 1992 2156 26642.exe 40 PID 2156 wrote to memory of 1992 2156 26642.exe 40 PID 1992 wrote to memory of 2000 1992 g8000.exe 41 PID 1992 wrote to memory of 2000 1992 g8000.exe 41 PID 1992 wrote to memory of 2000 1992 g8000.exe 41 PID 1992 wrote to memory of 2000 1992 g8000.exe 41 PID 2000 wrote to memory of 1776 2000 djvvd.exe 42 PID 2000 wrote to memory of 1776 2000 djvvd.exe 42 PID 2000 wrote to memory of 1776 2000 djvvd.exe 42 PID 2000 wrote to memory of 1776 2000 djvvd.exe 42 PID 1776 wrote to memory of 1060 1776 rlxrxxf.exe 43 PID 1776 wrote to memory of 1060 1776 rlxrxxf.exe 43 PID 1776 wrote to memory of 1060 1776 rlxrxxf.exe 43 PID 1776 wrote to memory of 1060 1776 rlxrxxf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2eae122ef4461ec2602b32d912c11610_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2eae122ef4461ec2602b32d912c11610_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\7frrxxr.exec:\7frrxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\20266.exec:\20266.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\pjddp.exec:\pjddp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\4684668.exec:\4684668.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\008862.exec:\008862.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\24400.exec:\24400.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\8240620.exec:\8240620.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\httbbn.exec:\httbbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\llfrlrl.exec:\llfrlrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\42068.exec:\42068.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\26642.exec:\26642.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\g8000.exec:\g8000.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\djvvd.exec:\djvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\264426.exec:\264426.exe17⤵
- Executes dropped EXE
PID:1060 -
\??\c:\9xllffr.exec:\9xllffr.exe18⤵
- Executes dropped EXE
PID:784 -
\??\c:\1xfffxf.exec:\1xfffxf.exe19⤵
- Executes dropped EXE
PID:2208 -
\??\c:\4244062.exec:\4244062.exe20⤵
- Executes dropped EXE
PID:1616 -
\??\c:\btbthn.exec:\btbthn.exe21⤵
- Executes dropped EXE
PID:2256 -
\??\c:\ntnbbh.exec:\ntnbbh.exe22⤵
- Executes dropped EXE
PID:2300 -
\??\c:\rfxxxxx.exec:\rfxxxxx.exe23⤵
- Executes dropped EXE
PID:412 -
\??\c:\dppvd.exec:\dppvd.exe24⤵
- Executes dropped EXE
PID:3004 -
\??\c:\6480246.exec:\6480246.exe25⤵
- Executes dropped EXE
PID:1548 -
\??\c:\ppjjv.exec:\ppjjv.exe26⤵
- Executes dropped EXE
PID:1388 -
\??\c:\pdvdj.exec:\pdvdj.exe27⤵
- Executes dropped EXE
PID:1636 -
\??\c:\dvjjp.exec:\dvjjp.exe28⤵
- Executes dropped EXE
PID:604 -
\??\c:\3jdjp.exec:\3jdjp.exe29⤵
- Executes dropped EXE
PID:2176 -
\??\c:\1vdpv.exec:\1vdpv.exe30⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jdppd.exec:\jdppd.exe31⤵
- Executes dropped EXE
PID:1500 -
\??\c:\6424062.exec:\6424062.exe32⤵
- Executes dropped EXE
PID:1424 -
\??\c:\88282.exec:\88282.exe33⤵
- Executes dropped EXE
PID:1592 -
\??\c:\44020.exec:\44020.exe34⤵
- Executes dropped EXE
PID:2836 -
\??\c:\llxfrrx.exec:\llxfrrx.exe35⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vpvjv.exec:\vpvjv.exe36⤵
- Executes dropped EXE
PID:1808 -
\??\c:\g4620.exec:\g4620.exe37⤵
- Executes dropped EXE
PID:2980 -
\??\c:\frllrlr.exec:\frllrlr.exe38⤵
- Executes dropped EXE
PID:2572 -
\??\c:\48068.exec:\48068.exe39⤵
- Executes dropped EXE
PID:2768 -
\??\c:\i440880.exec:\i440880.exe40⤵
- Executes dropped EXE
PID:2580 -
\??\c:\bnbhnt.exec:\bnbhnt.exe41⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ppvpj.exec:\ppvpj.exe42⤵
- Executes dropped EXE
PID:2600 -
\??\c:\rfllfff.exec:\rfllfff.exe43⤵
- Executes dropped EXE
PID:2492 -
\??\c:\s8228.exec:\s8228.exe44⤵
- Executes dropped EXE
PID:1796 -
\??\c:\824484.exec:\824484.exe45⤵
- Executes dropped EXE
PID:2880 -
\??\c:\20844.exec:\20844.exe46⤵
- Executes dropped EXE
PID:2688 -
\??\c:\q24684.exec:\q24684.exe47⤵
- Executes dropped EXE
PID:2744 -
\??\c:\6842466.exec:\6842466.exe48⤵
- Executes dropped EXE
PID:2520 -
\??\c:\pdvpv.exec:\pdvpv.exe49⤵
- Executes dropped EXE
PID:1756 -
\??\c:\7xrrflr.exec:\7xrrflr.exe50⤵
- Executes dropped EXE
PID:2392 -
\??\c:\a8406.exec:\a8406.exe51⤵
- Executes dropped EXE
PID:1196 -
\??\c:\86266.exec:\86266.exe52⤵
- Executes dropped EXE
PID:1220 -
\??\c:\lxxlxfl.exec:\lxxlxfl.exe53⤵
- Executes dropped EXE
PID:2000 -
\??\c:\806022.exec:\806022.exe54⤵
- Executes dropped EXE
PID:336 -
\??\c:\280262.exec:\280262.exe55⤵
- Executes dropped EXE
PID:1336 -
\??\c:\084466.exec:\084466.exe56⤵
- Executes dropped EXE
PID:780 -
\??\c:\jdjdp.exec:\jdjdp.exe57⤵
- Executes dropped EXE
PID:1484 -
\??\c:\6428444.exec:\6428444.exe58⤵
- Executes dropped EXE
PID:1208 -
\??\c:\q02648.exec:\q02648.exe59⤵
- Executes dropped EXE
PID:2088 -
\??\c:\dvvpv.exec:\dvvpv.exe60⤵
- Executes dropped EXE
PID:2100 -
\??\c:\086284.exec:\086284.exe61⤵
- Executes dropped EXE
PID:500 -
\??\c:\pjjvv.exec:\pjjvv.exe62⤵
- Executes dropped EXE
PID:3024 -
\??\c:\48628.exec:\48628.exe63⤵
- Executes dropped EXE
PID:452 -
\??\c:\22280.exec:\22280.exe64⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3lxxfll.exec:\3lxxfll.exe65⤵
- Executes dropped EXE
PID:1328 -
\??\c:\pppdp.exec:\pppdp.exe66⤵PID:1628
-
\??\c:\4866666.exec:\4866666.exe67⤵PID:924
-
\??\c:\tntbnb.exec:\tntbnb.exe68⤵PID:644
-
\??\c:\pdvvp.exec:\pdvvp.exe69⤵PID:1712
-
\??\c:\60406.exec:\60406.exe70⤵PID:2956
-
\??\c:\0224886.exec:\0224886.exe71⤵PID:2140
-
\??\c:\m0082.exec:\m0082.exe72⤵PID:2352
-
\??\c:\4244662.exec:\4244662.exe73⤵PID:1152
-
\??\c:\m2462.exec:\m2462.exe74⤵PID:868
-
\??\c:\jvjpv.exec:\jvjpv.exe75⤵PID:1592
-
\??\c:\c848682.exec:\c848682.exe76⤵PID:1704
-
\??\c:\lrrxfrf.exec:\lrrxfrf.exe77⤵PID:2240
-
\??\c:\g4224.exec:\g4224.exe78⤵PID:2564
-
\??\c:\8260220.exec:\8260220.exe79⤵PID:2612
-
\??\c:\442268.exec:\442268.exe80⤵PID:2284
-
\??\c:\nhthtb.exec:\nhthtb.exe81⤵PID:2584
-
\??\c:\nhnthb.exec:\nhnthb.exe82⤵PID:2576
-
\??\c:\frffllx.exec:\frffllx.exe83⤵PID:2652
-
\??\c:\1rffxll.exec:\1rffxll.exe84⤵PID:2412
-
\??\c:\04688.exec:\04688.exe85⤵PID:2120
-
\??\c:\4240620.exec:\4240620.exe86⤵PID:2592
-
\??\c:\bhhbbt.exec:\bhhbbt.exe87⤵PID:2488
-
\??\c:\a2208.exec:\a2208.exe88⤵PID:2724
-
\??\c:\llfrlxl.exec:\llfrlxl.exe89⤵PID:2840
-
\??\c:\xxrfrrx.exec:\xxrfrrx.exe90⤵PID:2860
-
\??\c:\28286.exec:\28286.exe91⤵PID:1324
-
\??\c:\006806.exec:\006806.exe92⤵PID:1072
-
\??\c:\llrlxfl.exec:\llrlxfl.exe93⤵PID:1992
-
\??\c:\vpjvd.exec:\vpjvd.exe94⤵PID:1972
-
\??\c:\42840.exec:\42840.exe95⤵PID:1724
-
\??\c:\w20688.exec:\w20688.exe96⤵PID:488
-
\??\c:\k66866.exec:\k66866.exe97⤵PID:1104
-
\??\c:\thbbnt.exec:\thbbnt.exe98⤵PID:1544
-
\??\c:\lfxxrxx.exec:\lfxxrxx.exe99⤵PID:2208
-
\??\c:\bhbttn.exec:\bhbttn.exe100⤵PID:1524
-
\??\c:\bttnnh.exec:\bttnnh.exe101⤵PID:2272
-
\??\c:\fllrlxl.exec:\fllrlxl.exe102⤵PID:2300
-
\??\c:\004024.exec:\004024.exe103⤵PID:2368
-
\??\c:\xrflrxl.exec:\xrflrxl.exe104⤵PID:3012
-
\??\c:\20246.exec:\20246.exe105⤵PID:2996
-
\??\c:\9lllrfr.exec:\9lllrfr.exe106⤵PID:1816
-
\??\c:\g2842.exec:\g2842.exe107⤵PID:1860
-
\??\c:\0006802.exec:\0006802.exe108⤵PID:2960
-
\??\c:\q82284.exec:\q82284.exe109⤵PID:1636
-
\??\c:\nntnbh.exec:\nntnbh.exe110⤵PID:2804
-
\??\c:\g2802.exec:\g2802.exe111⤵PID:292
-
\??\c:\bnhhnn.exec:\bnhhnn.exe112⤵PID:1716
-
\??\c:\5dpdj.exec:\5dpdj.exe113⤵PID:1360
-
\??\c:\lllrlll.exec:\lllrlll.exe114⤵PID:2932
-
\??\c:\k20200.exec:\k20200.exe115⤵PID:2388
-
\??\c:\w64428.exec:\w64428.exe116⤵PID:1600
-
\??\c:\xrfxlfr.exec:\xrfxlfr.exe117⤵PID:1800
-
\??\c:\3nbtbt.exec:\3nbtbt.exe118⤵PID:2512
-
\??\c:\g8246.exec:\g8246.exe119⤵PID:2568
-
\??\c:\frxxrrf.exec:\frxxrrf.exe120⤵PID:2648
-
\??\c:\1lrxflr.exec:\1lrxflr.exe121⤵PID:2424
-
\??\c:\60840.exec:\60840.exe122⤵PID:1736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-