Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 18:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3603e55f61dbab09496a2500337d24d2_JaffaCakes118.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
3603e55f61dbab09496a2500337d24d2_JaffaCakes118.exe
-
Size
92KB
-
MD5
3603e55f61dbab09496a2500337d24d2
-
SHA1
3503e371d4c0ba4d3be57ec2beba973c063ae2cd
-
SHA256
41ed94df272672323b3dcaba6860c90eb33999f8cd698f755993cd6f4e713bc5
-
SHA512
ece454da89409fa57578b10e4a6c3443bd159921bdd952ae8e2adbcabfc62562bdaf375a139c28175bfbabd6bb8b5d6c86f9dd9e06b5646940eb4f2bf37cf9e8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDWiekja1br3GGBxfot5lmKaZNkQL:ymb3NkkiQ3mdBjFWXkj7afo4ZERy
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3744-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3776-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3120 ntbbtn.exe 3764 llfrlrr.exe 4012 jvvdd.exe 4544 rrfllxf.exe 3776 9nbhht.exe 4724 jjvvp.exe 4720 nhtnbn.exe 1884 dddvp.exe 624 1tttnt.exe 2956 pjppv.exe 3664 ffxxxff.exe 2228 bbhhbb.exe 3040 rffrxlf.exe 1356 djjvj.exe 4692 llxlfxf.exe 4300 bhhttt.exe 4944 djjvv.exe 1476 5tntnt.exe 2032 ppppj.exe 388 3bbhth.exe 1852 djjjj.exe 1936 fxlrllr.exe 1932 bntntt.exe 4992 vvjpj.exe 3476 lxlfxrr.exe 2652 ppppj.exe 744 pjvvp.exe 3344 xxxrxxf.exe 1588 htbtbb.exe 1576 jjjvd.exe 4736 fllrrxf.exe 3260 hhhtth.exe 1388 jjvvp.exe 3452 rffxxfr.exe 2496 tbhnht.exe 312 hhhnhn.exe 2456 vpvpj.exe 3180 xrfxrrl.exe 3236 xfffllf.exe 2216 nhhbbb.exe 3348 vvvpj.exe 336 fxrfxxr.exe 3480 bnthhn.exe 1400 vppdj.exe 4984 rfxxffr.exe 3508 hbttnn.exe 3424 pppjv.exe 4272 xrfflxf.exe 4664 ttnbtb.exe 3944 vpvpp.exe 2620 3xfxrrl.exe 4860 bthbhh.exe 3556 fxrrrlx.exe 1992 htbtnn.exe 2968 ppjpv.exe 620 fxrffrl.exe 2956 9nhbth.exe 4020 nnbthn.exe 864 ddjjd.exe 2576 xrrrrxx.exe 3040 nbhtnn.exe 4644 pdjdv.exe 1904 jvjpj.exe 2036 tbhnnt.exe -
resource yara_rule behavioral2/memory/3744-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1884-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1356-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3744 wrote to memory of 3120 3744 3603e55f61dbab09496a2500337d24d2_JaffaCakes118.exe 81 PID 3744 wrote to memory of 3120 3744 3603e55f61dbab09496a2500337d24d2_JaffaCakes118.exe 81 PID 3744 wrote to memory of 3120 3744 3603e55f61dbab09496a2500337d24d2_JaffaCakes118.exe 81 PID 3120 wrote to memory of 3764 3120 ntbbtn.exe 82 PID 3120 wrote to memory of 3764 3120 ntbbtn.exe 82 PID 3120 wrote to memory of 3764 3120 ntbbtn.exe 82 PID 3764 wrote to memory of 4012 3764 llfrlrr.exe 83 PID 3764 wrote to memory of 4012 3764 llfrlrr.exe 83 PID 3764 wrote to memory of 4012 3764 llfrlrr.exe 83 PID 4012 wrote to memory of 4544 4012 jvvdd.exe 84 PID 4012 wrote to memory of 4544 4012 jvvdd.exe 84 PID 4012 wrote to memory of 4544 4012 jvvdd.exe 84 PID 4544 wrote to memory of 3776 4544 rrfllxf.exe 85 PID 4544 wrote to memory of 3776 4544 rrfllxf.exe 85 PID 4544 wrote to memory of 3776 4544 rrfllxf.exe 85 PID 3776 wrote to memory of 4724 3776 9nbhht.exe 86 PID 3776 wrote to memory of 4724 3776 9nbhht.exe 86 PID 3776 wrote to memory of 4724 3776 9nbhht.exe 86 PID 4724 wrote to memory of 4720 4724 jjvvp.exe 87 PID 4724 wrote to memory of 4720 4724 jjvvp.exe 87 PID 4724 wrote to memory of 4720 4724 jjvvp.exe 87 PID 4720 wrote to memory of 1884 4720 nhtnbn.exe 88 PID 4720 wrote to memory of 1884 4720 nhtnbn.exe 88 PID 4720 wrote to memory of 1884 4720 nhtnbn.exe 88 PID 1884 wrote to memory of 624 1884 dddvp.exe 89 PID 1884 wrote to memory of 624 1884 dddvp.exe 89 PID 1884 wrote to memory of 624 1884 dddvp.exe 89 PID 624 wrote to memory of 2956 624 1tttnt.exe 90 PID 624 wrote to memory of 2956 624 1tttnt.exe 90 PID 624 wrote to memory of 2956 624 1tttnt.exe 90 PID 2956 wrote to memory of 3664 2956 pjppv.exe 92 PID 2956 wrote to memory of 3664 2956 pjppv.exe 92 PID 2956 wrote to memory of 3664 2956 pjppv.exe 92 PID 3664 wrote to memory of 2228 3664 ffxxxff.exe 93 PID 3664 wrote to memory of 2228 3664 ffxxxff.exe 93 PID 3664 wrote to memory of 2228 3664 ffxxxff.exe 93 PID 2228 wrote to memory of 3040 2228 bbhhbb.exe 94 PID 2228 wrote to memory of 3040 2228 bbhhbb.exe 94 PID 2228 wrote to memory of 3040 2228 bbhhbb.exe 94 PID 3040 wrote to memory of 1356 3040 rffrxlf.exe 96 PID 3040 wrote to memory of 1356 3040 rffrxlf.exe 96 PID 3040 wrote to memory of 1356 3040 rffrxlf.exe 96 PID 1356 wrote to memory of 4692 1356 djjvj.exe 97 PID 1356 wrote to memory of 4692 1356 djjvj.exe 97 PID 1356 wrote to memory of 4692 1356 djjvj.exe 97 PID 4692 wrote to memory of 4300 4692 llxlfxf.exe 98 PID 4692 wrote to memory of 4300 4692 llxlfxf.exe 98 PID 4692 wrote to memory of 4300 4692 llxlfxf.exe 98 PID 4300 wrote to memory of 4944 4300 bhhttt.exe 99 PID 4300 wrote to memory of 4944 4300 bhhttt.exe 99 PID 4300 wrote to memory of 4944 4300 bhhttt.exe 99 PID 4944 wrote to memory of 1476 4944 djjvv.exe 100 PID 4944 wrote to memory of 1476 4944 djjvv.exe 100 PID 4944 wrote to memory of 1476 4944 djjvv.exe 100 PID 1476 wrote to memory of 2032 1476 5tntnt.exe 101 PID 1476 wrote to memory of 2032 1476 5tntnt.exe 101 PID 1476 wrote to memory of 2032 1476 5tntnt.exe 101 PID 2032 wrote to memory of 388 2032 ppppj.exe 102 PID 2032 wrote to memory of 388 2032 ppppj.exe 102 PID 2032 wrote to memory of 388 2032 ppppj.exe 102 PID 388 wrote to memory of 1852 388 3bbhth.exe 104 PID 388 wrote to memory of 1852 388 3bbhth.exe 104 PID 388 wrote to memory of 1852 388 3bbhth.exe 104 PID 1852 wrote to memory of 1936 1852 djjjj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\3603e55f61dbab09496a2500337d24d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3603e55f61dbab09496a2500337d24d2_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\ntbbtn.exec:\ntbbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\llfrlrr.exec:\llfrlrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\jvvdd.exec:\jvvdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\rrfllxf.exec:\rrfllxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\9nbhht.exec:\9nbhht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\jjvvp.exec:\jjvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\nhtnbn.exec:\nhtnbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\dddvp.exec:\dddvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\1tttnt.exec:\1tttnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\pjppv.exec:\pjppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\ffxxxff.exec:\ffxxxff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\bbhhbb.exec:\bbhhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\rffrxlf.exec:\rffrxlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\djjvj.exec:\djjvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\llxlfxf.exec:\llxlfxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\bhhttt.exec:\bhhttt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\djjvv.exec:\djjvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\5tntnt.exec:\5tntnt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\ppppj.exec:\ppppj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\3bbhth.exec:\3bbhth.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\djjjj.exec:\djjjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\fxlrllr.exec:\fxlrllr.exe23⤵
- Executes dropped EXE
PID:1936 -
\??\c:\bntntt.exec:\bntntt.exe24⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vvjpj.exec:\vvjpj.exe25⤵
- Executes dropped EXE
PID:4992 -
\??\c:\lxlfxrr.exec:\lxlfxrr.exe26⤵
- Executes dropped EXE
PID:3476 -
\??\c:\ppppj.exec:\ppppj.exe27⤵
- Executes dropped EXE
PID:2652 -
\??\c:\pjvvp.exec:\pjvvp.exe28⤵
- Executes dropped EXE
PID:744 -
\??\c:\xxxrxxf.exec:\xxxrxxf.exe29⤵
- Executes dropped EXE
PID:3344 -
\??\c:\htbtbb.exec:\htbtbb.exe30⤵
- Executes dropped EXE
PID:1588 -
\??\c:\jjjvd.exec:\jjjvd.exe31⤵
- Executes dropped EXE
PID:1576 -
\??\c:\fllrrxf.exec:\fllrrxf.exe32⤵
- Executes dropped EXE
PID:4736 -
\??\c:\hhhtth.exec:\hhhtth.exe33⤵
- Executes dropped EXE
PID:3260 -
\??\c:\jjvvp.exec:\jjvvp.exe34⤵
- Executes dropped EXE
PID:1388 -
\??\c:\rffxxfr.exec:\rffxxfr.exe35⤵
- Executes dropped EXE
PID:3452 -
\??\c:\tbhnht.exec:\tbhnht.exe36⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hhhnhn.exec:\hhhnhn.exe37⤵
- Executes dropped EXE
PID:312 -
\??\c:\vpvpj.exec:\vpvpj.exe38⤵
- Executes dropped EXE
PID:2456 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe39⤵
- Executes dropped EXE
PID:3180 -
\??\c:\xfffllf.exec:\xfffllf.exe40⤵
- Executes dropped EXE
PID:3236 -
\??\c:\nhhbbb.exec:\nhhbbb.exe41⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vvvpj.exec:\vvvpj.exe42⤵
- Executes dropped EXE
PID:3348 -
\??\c:\fxrfxxr.exec:\fxrfxxr.exe43⤵
- Executes dropped EXE
PID:336 -
\??\c:\bnthhn.exec:\bnthhn.exe44⤵
- Executes dropped EXE
PID:3480 -
\??\c:\vppdj.exec:\vppdj.exe45⤵
- Executes dropped EXE
PID:1400 -
\??\c:\rfxxffr.exec:\rfxxffr.exe46⤵
- Executes dropped EXE
PID:4984 -
\??\c:\hbttnn.exec:\hbttnn.exe47⤵
- Executes dropped EXE
PID:3508 -
\??\c:\pppjv.exec:\pppjv.exe48⤵
- Executes dropped EXE
PID:3424 -
\??\c:\xrfflxf.exec:\xrfflxf.exe49⤵
- Executes dropped EXE
PID:4272 -
\??\c:\ttnbtb.exec:\ttnbtb.exe50⤵
- Executes dropped EXE
PID:4664 -
\??\c:\vpvpp.exec:\vpvpp.exe51⤵
- Executes dropped EXE
PID:3944 -
\??\c:\3xfxrrl.exec:\3xfxrrl.exe52⤵
- Executes dropped EXE
PID:2620 -
\??\c:\bthbhh.exec:\bthbhh.exe53⤵
- Executes dropped EXE
PID:4860 -
\??\c:\fxrrrlx.exec:\fxrrrlx.exe54⤵
- Executes dropped EXE
PID:3556 -
\??\c:\htbtnn.exec:\htbtnn.exe55⤵
- Executes dropped EXE
PID:1992 -
\??\c:\ppjpv.exec:\ppjpv.exe56⤵
- Executes dropped EXE
PID:2968 -
\??\c:\fxrffrl.exec:\fxrffrl.exe57⤵
- Executes dropped EXE
PID:620 -
\??\c:\9nhbth.exec:\9nhbth.exe58⤵
- Executes dropped EXE
PID:2956 -
\??\c:\nnbthn.exec:\nnbthn.exe59⤵
- Executes dropped EXE
PID:4020 -
\??\c:\ddjjd.exec:\ddjjd.exe60⤵
- Executes dropped EXE
PID:864 -
\??\c:\xrrrrxx.exec:\xrrrrxx.exe61⤵
- Executes dropped EXE
PID:2576 -
\??\c:\nbhtnn.exec:\nbhtnn.exe62⤵
- Executes dropped EXE
PID:3040 -
\??\c:\pdjdv.exec:\pdjdv.exe63⤵
- Executes dropped EXE
PID:4644 -
\??\c:\jvjpj.exec:\jvjpj.exe64⤵
- Executes dropped EXE
PID:1904 -
\??\c:\tbhnnt.exec:\tbhnnt.exe65⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bhhhnh.exec:\bhhhnh.exe66⤵PID:2028
-
\??\c:\1pdpv.exec:\1pdpv.exe67⤵PID:1448
-
\??\c:\5xllxff.exec:\5xllxff.exe68⤵PID:1812
-
\??\c:\nntnnn.exec:\nntnnn.exe69⤵PID:1476
-
\??\c:\httnnn.exec:\httnnn.exe70⤵PID:4656
-
\??\c:\7jjdd.exec:\7jjdd.exe71⤵PID:4084
-
\??\c:\vdjpj.exec:\vdjpj.exe72⤵PID:4828
-
\??\c:\xrxxxrx.exec:\xrxxxrx.exe73⤵PID:2744
-
\??\c:\1tbntt.exec:\1tbntt.exe74⤵PID:3176
-
\??\c:\nnhnth.exec:\nnhnth.exe75⤵PID:4992
-
\??\c:\dppdd.exec:\dppdd.exe76⤵PID:3248
-
\??\c:\xflxllr.exec:\xflxllr.exe77⤵PID:2652
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe78⤵PID:1948
-
\??\c:\tbnhhb.exec:\tbnhhb.exe79⤵PID:1364
-
\??\c:\ppjvv.exec:\ppjvv.exe80⤵PID:3188
-
\??\c:\thtbhb.exec:\thtbhb.exe81⤵PID:3276
-
\??\c:\jppvj.exec:\jppvj.exe82⤵PID:3520
-
\??\c:\lffxxll.exec:\lffxxll.exe83⤵PID:4736
-
\??\c:\bntttn.exec:\bntttn.exe84⤵PID:3260
-
\??\c:\vjpdd.exec:\vjpdd.exe85⤵PID:4696
-
\??\c:\jvdvv.exec:\jvdvv.exe86⤵PID:1844
-
\??\c:\xfrlxfr.exec:\xfrlxfr.exe87⤵PID:2976
-
\??\c:\vvjdp.exec:\vvjdp.exe88⤵PID:2504
-
\??\c:\dvppj.exec:\dvppj.exe89⤵PID:380
-
\??\c:\lxlxxxf.exec:\lxlxxxf.exe90⤵PID:4432
-
\??\c:\rlrrlll.exec:\rlrrlll.exe91⤵PID:4336
-
\??\c:\tbhhbb.exec:\tbhhbb.exe92⤵PID:3744
-
\??\c:\bhnbbb.exec:\bhnbbb.exe93⤵PID:4676
-
\??\c:\jvppp.exec:\jvppp.exe94⤵PID:4368
-
\??\c:\fffxrff.exec:\fffxrff.exe95⤵PID:3748
-
\??\c:\thhhth.exec:\thhhth.exe96⤵PID:4228
-
\??\c:\pvjvv.exec:\pvjvv.exe97⤵PID:4012
-
\??\c:\xxlrrfr.exec:\xxlrrfr.exe98⤵PID:524
-
\??\c:\xxxflrf.exec:\xxxflrf.exe99⤵PID:2252
-
\??\c:\hbnbtn.exec:\hbnbtn.exe100⤵PID:4664
-
\??\c:\ttbtnt.exec:\ttbtnt.exe101⤵PID:3944
-
\??\c:\jpvpp.exec:\jpvpp.exe102⤵PID:5076
-
\??\c:\lrrfflf.exec:\lrrfflf.exe103⤵PID:4892
-
\??\c:\ffrxfrl.exec:\ffrxfrl.exe104⤵PID:5036
-
\??\c:\ttttnh.exec:\ttttnh.exe105⤵PID:3820
-
\??\c:\dvvvj.exec:\dvvvj.exe106⤵PID:4216
-
\??\c:\9rxxrlr.exec:\9rxxrlr.exe107⤵PID:3140
-
\??\c:\tttnnt.exec:\tttnnt.exe108⤵PID:1900
-
\??\c:\tbnhbb.exec:\tbnhbb.exe109⤵PID:3756
-
\??\c:\vvvjj.exec:\vvvjj.exe110⤵PID:3340
-
\??\c:\llrllxl.exec:\llrllxl.exe111⤵PID:2576
-
\??\c:\tnbtnb.exec:\tnbtnb.exe112⤵PID:1600
-
\??\c:\hhnbtn.exec:\hhnbtn.exe113⤵PID:4644
-
\??\c:\dvppj.exec:\dvppj.exe114⤵PID:4636
-
\??\c:\5vddv.exec:\5vddv.exe115⤵PID:1384
-
\??\c:\ntnhtn.exec:\ntnhtn.exe116⤵PID:2136
-
\??\c:\1nbbhh.exec:\1nbbhh.exe117⤵PID:1720
-
\??\c:\ppppd.exec:\ppppd.exe118⤵PID:3896
-
\??\c:\djjdd.exec:\djjdd.exe119⤵PID:1044
-
\??\c:\5lxrrrr.exec:\5lxrrrr.exe120⤵PID:4492
-
\??\c:\nbhbbb.exec:\nbhbbb.exe121⤵PID:4064
-
\??\c:\tnhnhh.exec:\tnhnhh.exe122⤵PID:5116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-