Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 21:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3691355d4ded4891d1d5fcde9798c61d_JaffaCakes118.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
3691355d4ded4891d1d5fcde9798c61d_JaffaCakes118.exe
-
Size
65KB
-
MD5
3691355d4ded4891d1d5fcde9798c61d
-
SHA1
3892319bfe2101e8f5655fa5a48f9a82c8430bc3
-
SHA256
b4b93077b2468bdc61426082b559255ab61294b493f6a0c5d55b2627b4c63e58
-
SHA512
ab49950d73dd216ebd662b4f3e68f4b100f138c2891b1dea3b4f129b62c038c4fd1b927d38db0ba1553204a35448c7f236b019b1b0d082434a87c87de37e8cfd
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIuyWNSe:ymb3NkkiQ3mdBjFIuyWd
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/1468-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/948-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1528-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1348-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/904-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1468 dvdjj.exe 2400 ffrxflr.exe 2064 hhhtnt.exe 2584 pjvdv.exe 2700 jjdpd.exe 2100 lxxlffx.exe 2720 hhnbbh.exe 2592 hhnnth.exe 2552 vjpjj.exe 2956 llflxfx.exe 1964 xffrffx.exe 2708 5xxflrr.exe 2360 3tthbh.exe 1576 jdddd.exe 948 pvjpp.exe 2568 ffxrfrx.exe 1660 ttnhbn.exe 1528 ttbbnh.exe 2976 jdpdj.exe 2284 pjvdp.exe 2340 fxllxxf.exe 324 3rxllrx.exe 1348 nhbtbh.exe 2664 hbhhnt.exe 904 jjdjv.exe 1452 rrrxrrf.exe 1244 rlrxxrf.exe 2908 hbttbt.exe 1924 5vdjp.exe 2116 dpjpv.exe 2212 dvpdp.exe 2288 llxlrxf.exe 2264 bnhbtb.exe 2372 ntbttb.exe 3016 ppjvj.exe 2396 jddjj.exe 2196 9lfrxxr.exe 2680 fxrxffr.exe 2872 lfffrxf.exe 2628 nhbbnn.exe 2740 bthhtt.exe 2616 dvvjv.exe 2480 pjvvd.exe 2524 rflflfr.exe 2764 fxrxflx.exe 2552 7bthnb.exe 1712 hbtbnn.exe 2808 vvjjv.exe 2208 3pdvd.exe 1900 ffflxfx.exe 2360 rfxxrrx.exe 936 5nhnht.exe 1224 5htbnn.exe 1904 jdjjj.exe 1588 ddvvj.exe 2120 9pppj.exe 2844 ffxxllr.exe 2072 btnbbn.exe 2104 bttbnn.exe 488 3vdpd.exe 1124 ddvjv.exe 976 rlffflr.exe 1324 3rlxflx.exe 1916 nnbhbh.exe -
resource yara_rule behavioral1/memory/2004-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1468-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/948-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1528-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1348-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/904-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2004 wrote to memory of 1468 2004 3691355d4ded4891d1d5fcde9798c61d_JaffaCakes118.exe 28 PID 2004 wrote to memory of 1468 2004 3691355d4ded4891d1d5fcde9798c61d_JaffaCakes118.exe 28 PID 2004 wrote to memory of 1468 2004 3691355d4ded4891d1d5fcde9798c61d_JaffaCakes118.exe 28 PID 2004 wrote to memory of 1468 2004 3691355d4ded4891d1d5fcde9798c61d_JaffaCakes118.exe 28 PID 1468 wrote to memory of 2400 1468 dvdjj.exe 29 PID 1468 wrote to memory of 2400 1468 dvdjj.exe 29 PID 1468 wrote to memory of 2400 1468 dvdjj.exe 29 PID 1468 wrote to memory of 2400 1468 dvdjj.exe 29 PID 2400 wrote to memory of 2064 2400 ffrxflr.exe 30 PID 2400 wrote to memory of 2064 2400 ffrxflr.exe 30 PID 2400 wrote to memory of 2064 2400 ffrxflr.exe 30 PID 2400 wrote to memory of 2064 2400 ffrxflr.exe 30 PID 2064 wrote to memory of 2584 2064 hhhtnt.exe 31 PID 2064 wrote to memory of 2584 2064 hhhtnt.exe 31 PID 2064 wrote to memory of 2584 2064 hhhtnt.exe 31 PID 2064 wrote to memory of 2584 2064 hhhtnt.exe 31 PID 2584 wrote to memory of 2700 2584 pjvdv.exe 32 PID 2584 wrote to memory of 2700 2584 pjvdv.exe 32 PID 2584 wrote to memory of 2700 2584 pjvdv.exe 32 PID 2584 wrote to memory of 2700 2584 pjvdv.exe 32 PID 2700 wrote to memory of 2100 2700 jjdpd.exe 33 PID 2700 wrote to memory of 2100 2700 jjdpd.exe 33 PID 2700 wrote to memory of 2100 2700 jjdpd.exe 33 PID 2700 wrote to memory of 2100 2700 jjdpd.exe 33 PID 2100 wrote to memory of 2720 2100 lxxlffx.exe 34 PID 2100 wrote to memory of 2720 2100 lxxlffx.exe 34 PID 2100 wrote to memory of 2720 2100 lxxlffx.exe 34 PID 2100 wrote to memory of 2720 2100 lxxlffx.exe 34 PID 2720 wrote to memory of 2592 2720 hhnbbh.exe 35 PID 2720 wrote to memory of 2592 2720 hhnbbh.exe 35 PID 2720 wrote to memory of 2592 2720 hhnbbh.exe 35 PID 2720 wrote to memory of 2592 2720 hhnbbh.exe 35 PID 2592 wrote to memory of 2552 2592 hhnnth.exe 36 PID 2592 wrote to memory of 2552 2592 hhnnth.exe 36 PID 2592 wrote to memory of 2552 2592 hhnnth.exe 36 PID 2592 wrote to memory of 2552 2592 hhnnth.exe 36 PID 2552 wrote to memory of 2956 2552 vjpjj.exe 37 PID 2552 wrote to memory of 2956 2552 vjpjj.exe 37 PID 2552 wrote to memory of 2956 2552 vjpjj.exe 37 PID 2552 wrote to memory of 2956 2552 vjpjj.exe 37 PID 2956 wrote to memory of 1964 2956 llflxfx.exe 38 PID 2956 wrote to memory of 1964 2956 llflxfx.exe 38 PID 2956 wrote to memory of 1964 2956 llflxfx.exe 38 PID 2956 wrote to memory of 1964 2956 llflxfx.exe 38 PID 1964 wrote to memory of 2708 1964 xffrffx.exe 39 PID 1964 wrote to memory of 2708 1964 xffrffx.exe 39 PID 1964 wrote to memory of 2708 1964 xffrffx.exe 39 PID 1964 wrote to memory of 2708 1964 xffrffx.exe 39 PID 2708 wrote to memory of 2360 2708 5xxflrr.exe 40 PID 2708 wrote to memory of 2360 2708 5xxflrr.exe 40 PID 2708 wrote to memory of 2360 2708 5xxflrr.exe 40 PID 2708 wrote to memory of 2360 2708 5xxflrr.exe 40 PID 2360 wrote to memory of 1576 2360 3tthbh.exe 41 PID 2360 wrote to memory of 1576 2360 3tthbh.exe 41 PID 2360 wrote to memory of 1576 2360 3tthbh.exe 41 PID 2360 wrote to memory of 1576 2360 3tthbh.exe 41 PID 1576 wrote to memory of 948 1576 jdddd.exe 42 PID 1576 wrote to memory of 948 1576 jdddd.exe 42 PID 1576 wrote to memory of 948 1576 jdddd.exe 42 PID 1576 wrote to memory of 948 1576 jdddd.exe 42 PID 948 wrote to memory of 2568 948 pvjpp.exe 43 PID 948 wrote to memory of 2568 948 pvjpp.exe 43 PID 948 wrote to memory of 2568 948 pvjpp.exe 43 PID 948 wrote to memory of 2568 948 pvjpp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\3691355d4ded4891d1d5fcde9798c61d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3691355d4ded4891d1d5fcde9798c61d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\dvdjj.exec:\dvdjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\ffrxflr.exec:\ffrxflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\hhhtnt.exec:\hhhtnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\pjvdv.exec:\pjvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\jjdpd.exec:\jjdpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\lxxlffx.exec:\lxxlffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\hhnbbh.exec:\hhnbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\hhnnth.exec:\hhnnth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\vjpjj.exec:\vjpjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\llflxfx.exec:\llflxfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\xffrffx.exec:\xffrffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\5xxflrr.exec:\5xxflrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\3tthbh.exec:\3tthbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\jdddd.exec:\jdddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\pvjpp.exec:\pvjpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\ffxrfrx.exec:\ffxrfrx.exe17⤵
- Executes dropped EXE
PID:2568 -
\??\c:\ttnhbn.exec:\ttnhbn.exe18⤵
- Executes dropped EXE
PID:1660 -
\??\c:\ttbbnh.exec:\ttbbnh.exe19⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jdpdj.exec:\jdpdj.exe20⤵
- Executes dropped EXE
PID:2976 -
\??\c:\pjvdp.exec:\pjvdp.exe21⤵
- Executes dropped EXE
PID:2284 -
\??\c:\fxllxxf.exec:\fxllxxf.exe22⤵
- Executes dropped EXE
PID:2340 -
\??\c:\3rxllrx.exec:\3rxllrx.exe23⤵
- Executes dropped EXE
PID:324 -
\??\c:\nhbtbh.exec:\nhbtbh.exe24⤵
- Executes dropped EXE
PID:1348 -
\??\c:\hbhhnt.exec:\hbhhnt.exe25⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jjdjv.exec:\jjdjv.exe26⤵
- Executes dropped EXE
PID:904 -
\??\c:\rrrxrrf.exec:\rrrxrrf.exe27⤵
- Executes dropped EXE
PID:1452 -
\??\c:\rlrxxrf.exec:\rlrxxrf.exe28⤵
- Executes dropped EXE
PID:1244 -
\??\c:\hbttbt.exec:\hbttbt.exe29⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5vdjp.exec:\5vdjp.exe30⤵
- Executes dropped EXE
PID:1924 -
\??\c:\dpjpv.exec:\dpjpv.exe31⤵
- Executes dropped EXE
PID:2116 -
\??\c:\dvpdp.exec:\dvpdp.exe32⤵
- Executes dropped EXE
PID:2212 -
\??\c:\llxlrxf.exec:\llxlrxf.exe33⤵
- Executes dropped EXE
PID:2288 -
\??\c:\bnhbtb.exec:\bnhbtb.exe34⤵
- Executes dropped EXE
PID:2264 -
\??\c:\ntbttb.exec:\ntbttb.exe35⤵
- Executes dropped EXE
PID:2372 -
\??\c:\ppjvj.exec:\ppjvj.exe36⤵
- Executes dropped EXE
PID:3016 -
\??\c:\jddjj.exec:\jddjj.exe37⤵
- Executes dropped EXE
PID:2396 -
\??\c:\9lfrxxr.exec:\9lfrxxr.exe38⤵
- Executes dropped EXE
PID:2196 -
\??\c:\fxrxffr.exec:\fxrxffr.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\lfffrxf.exec:\lfffrxf.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nhbbnn.exec:\nhbbnn.exe41⤵
- Executes dropped EXE
PID:2628 -
\??\c:\bthhtt.exec:\bthhtt.exe42⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dvvjv.exec:\dvvjv.exe43⤵
- Executes dropped EXE
PID:2616 -
\??\c:\pjvvd.exec:\pjvvd.exe44⤵
- Executes dropped EXE
PID:2480 -
\??\c:\rflflfr.exec:\rflflfr.exe45⤵
- Executes dropped EXE
PID:2524 -
\??\c:\fxrxflx.exec:\fxrxflx.exe46⤵
- Executes dropped EXE
PID:2764 -
\??\c:\7bthnb.exec:\7bthnb.exe47⤵
- Executes dropped EXE
PID:2552 -
\??\c:\hbtbnn.exec:\hbtbnn.exe48⤵
- Executes dropped EXE
PID:1712 -
\??\c:\vvjjv.exec:\vvjjv.exe49⤵
- Executes dropped EXE
PID:2808 -
\??\c:\3pdvd.exec:\3pdvd.exe50⤵
- Executes dropped EXE
PID:2208 -
\??\c:\ffflxfx.exec:\ffflxfx.exe51⤵
- Executes dropped EXE
PID:1900 -
\??\c:\rfxxrrx.exec:\rfxxrrx.exe52⤵
- Executes dropped EXE
PID:2360 -
\??\c:\5nhnht.exec:\5nhnht.exe53⤵
- Executes dropped EXE
PID:936 -
\??\c:\5htbnn.exec:\5htbnn.exe54⤵
- Executes dropped EXE
PID:1224 -
\??\c:\jdjjj.exec:\jdjjj.exe55⤵
- Executes dropped EXE
PID:1904 -
\??\c:\ddvvj.exec:\ddvvj.exe56⤵
- Executes dropped EXE
PID:1588 -
\??\c:\9pppj.exec:\9pppj.exe57⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ffxxllr.exec:\ffxxllr.exe58⤵
- Executes dropped EXE
PID:2844 -
\??\c:\btnbbn.exec:\btnbbn.exe59⤵
- Executes dropped EXE
PID:2072 -
\??\c:\bttbnn.exec:\bttbnn.exe60⤵
- Executes dropped EXE
PID:2104 -
\??\c:\3vdpd.exec:\3vdpd.exe61⤵
- Executes dropped EXE
PID:488 -
\??\c:\ddvjv.exec:\ddvjv.exe62⤵
- Executes dropped EXE
PID:1124 -
\??\c:\rlffflr.exec:\rlffflr.exe63⤵
- Executes dropped EXE
PID:976 -
\??\c:\3rlxflx.exec:\3rlxflx.exe64⤵
- Executes dropped EXE
PID:1324 -
\??\c:\nnbhbh.exec:\nnbhbh.exe65⤵
- Executes dropped EXE
PID:1916 -
\??\c:\3nbhnb.exec:\3nbhnb.exe66⤵PID:1296
-
\??\c:\vpjpp.exec:\vpjpp.exe67⤵PID:1692
-
\??\c:\9rfxflf.exec:\9rfxflf.exe68⤵PID:1684
-
\??\c:\lfrlfrr.exec:\lfrlfrr.exe69⤵PID:1244
-
\??\c:\rlxflrf.exec:\rlxflrf.exe70⤵PID:2908
-
\??\c:\7bbhnn.exec:\7bbhnn.exe71⤵PID:2020
-
\??\c:\pjdjp.exec:\pjdjp.exe72⤵PID:2916
-
\??\c:\pjddj.exec:\pjddj.exe73⤵PID:2888
-
\??\c:\3flxflf.exec:\3flxflf.exe74⤵PID:1276
-
\??\c:\xrlxrff.exec:\xrlxrff.exe75⤵PID:2288
-
\??\c:\9tntbh.exec:\9tntbh.exe76⤵PID:1044
-
\??\c:\vppdp.exec:\vppdp.exe77⤵PID:2376
-
\??\c:\lrffrrr.exec:\lrffrrr.exe78⤵PID:1940
-
\??\c:\ffxrxxx.exec:\ffxrxxx.exe79⤵PID:2944
-
\??\c:\thtnhh.exec:\thtnhh.exe80⤵PID:2064
-
\??\c:\bthhbb.exec:\bthhbb.exe81⤵PID:2608
-
\??\c:\djpjj.exec:\djpjj.exe82⤵PID:2736
-
\??\c:\vpddj.exec:\vpddj.exe83⤵PID:2884
-
\??\c:\xrrlrrx.exec:\xrrlrrx.exe84⤵PID:2840
-
\??\c:\1xxfllx.exec:\1xxfllx.exe85⤵PID:2644
-
\??\c:\hhtnbt.exec:\hhtnbt.exe86⤵PID:2504
-
\??\c:\btnthn.exec:\btnthn.exe87⤵PID:2592
-
\??\c:\jdjpv.exec:\jdjpv.exe88⤵PID:1956
-
\??\c:\ppdvd.exec:\ppdvd.exe89⤵PID:1912
-
\??\c:\9fllflr.exec:\9fllflr.exe90⤵PID:2960
-
\??\c:\fxllflr.exec:\fxllflr.exe91⤵PID:1680
-
\??\c:\lxlllfr.exec:\lxlllfr.exe92⤵PID:1888
-
\??\c:\5htbhn.exec:\5htbhn.exe93⤵PID:1260
-
\??\c:\nhtbnn.exec:\nhtbnn.exe94⤵PID:1708
-
\??\c:\jvjjv.exec:\jvjjv.exe95⤵PID:2832
-
\??\c:\jdppv.exec:\jdppv.exe96⤵PID:2768
-
\??\c:\ffxlrrx.exec:\ffxlrrx.exe97⤵PID:1648
-
\??\c:\lfxflrf.exec:\lfxflrf.exe98⤵PID:1764
-
\??\c:\7xfxrrf.exec:\7xfxrrf.exe99⤵PID:2948
-
\??\c:\nbntbb.exec:\nbntbb.exe100⤵PID:2228
-
\??\c:\hhhnth.exec:\hhhnth.exe101⤵PID:1460
-
\??\c:\dpvvj.exec:\dpvvj.exe102⤵PID:2336
-
\??\c:\ppdjd.exec:\ppdjd.exe103⤵PID:540
-
\??\c:\pjvvp.exec:\pjvvp.exe104⤵PID:1028
-
\??\c:\1lxrrlr.exec:\1lxrrlr.exe105⤵PID:1144
-
\??\c:\1lflrrx.exec:\1lflrrx.exe106⤵PID:1400
-
\??\c:\hhbbnt.exec:\hhbbnt.exe107⤵PID:1796
-
\??\c:\hntttt.exec:\hntttt.exe108⤵PID:1696
-
\??\c:\vdjpv.exec:\vdjpv.exe109⤵PID:1196
-
\??\c:\jdjjj.exec:\jdjjj.exe110⤵PID:700
-
\??\c:\rlrlxrf.exec:\rlrlxrf.exe111⤵PID:2184
-
\??\c:\lrxfxxx.exec:\lrxfxxx.exe112⤵PID:1340
-
\??\c:\nbnntb.exec:\nbnntb.exe113⤵PID:3024
-
\??\c:\1tnnhn.exec:\1tnnhn.exe114⤵PID:880
-
\??\c:\pjpdd.exec:\pjpdd.exe115⤵PID:2304
-
\??\c:\jddjj.exec:\jddjj.exe116⤵PID:1752
-
\??\c:\rllxrxl.exec:\rllxrxl.exe117⤵PID:1600
-
\??\c:\fxrfrlx.exec:\fxrfrlx.exe118⤵PID:3040
-
\??\c:\hhbntb.exec:\hhbntb.exe119⤵PID:2380
-
\??\c:\5ttnnh.exec:\5ttnnh.exe120⤵PID:3004
-
\??\c:\nnhthh.exec:\nnhthh.exe121⤵PID:2848
-
\??\c:\dpvpj.exec:\dpvpj.exe122⤵PID:2620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-