Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 04:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5d4a17d93a4a7158ecf0056404a22acc_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5d4a17d93a4a7158ecf0056404a22acc_JaffaCakes118.exe
-
Size
99KB
-
MD5
5d4a17d93a4a7158ecf0056404a22acc
-
SHA1
58e287112a05b53430c880a1e224224e271639d7
-
SHA256
c559c02682a230708a085e33fce38da5f8e8ecd3d16fddfa3f99554844f9e1f8
-
SHA512
844a21ef917b92fac0e0c3cbe17e21eb61476970f9723f8fc58fb5406b5adcec7811f6c8401917934202f843a06a92b85bf1e698b026d1891c2cd25bb83dc8e5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZ3BVB:ymb3NkkiQ3mdBjFIVLd2hWZGrNVqIf
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/1652-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1292-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/304-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2976-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/876-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
88806.exe860684.exe2028002.exe4408664.exe66064.exek60028.exe82844.exellrlfrf.exebtnnhh.exeddjpp.exe20840.exe424022.exe8240286.exe5rfllrf.exe64620.exehhtbtn.exe26882.exeppjvp.exetnhnhn.exejjdpv.exe9vjdj.exe0242024.exe5fxffrr.exe20240.exeo488068.exebntntn.exe86804.exevdpdj.exerlffrxf.exehbntbh.exe5thhht.exefxrfflf.exeflflrll.exe7vjjp.exe446688.exe6226204.exeddpjd.exee08862.exe4862446.exeq60244.exenbnnnt.exe7fllrlf.exe0462406.exennhtbn.exexrlfrxf.exe3thnbt.exe684282.exe3hhhtn.exepjjpd.exe602602.exe0868280.exe4802402.exe64864.exe9vpdd.exebnhhbh.exenbnnbb.exetnbntb.exe28460.exefxxfrrx.exedvppp.exehnnnhh.exedpdjp.exe606202.exe26802.exepid process 1988 88806.exe 2732 860684.exe 2576 2028002.exe 2604 4408664.exe 2844 66064.exe 3028 k60028.exe 2448 82844.exe 1656 llrlfrf.exe 2960 btnnhh.exe 2536 ddjpp.exe 2976 20840.exe 2648 424022.exe 2196 8240286.exe 2432 5rfllrf.exe 2332 64620.exe 2768 hhtbtn.exe 844 26882.exe 1292 ppjvp.exe 2264 tnhnhn.exe 2868 jjdpv.exe 2628 9vjdj.exe 540 0242024.exe 1604 5fxffrr.exe 2132 20240.exe 1496 o488068.exe 304 bntntn.exe 656 86804.exe 2888 vdpdj.exe 848 rlffrxf.exe 876 hbntbh.exe 2232 5thhht.exe 2168 fxrfflf.exe 1540 flflrll.exe 1696 7vjjp.exe 2732 446688.exe 2600 6226204.exe 2092 ddpjd.exe 2472 e08862.exe 2668 4862446.exe 2584 q60244.exe 1236 nbnnnt.exe 1820 7fllrlf.exe 2608 0462406.exe 2816 nnhtbn.exe 2932 xrlfrxf.exe 2484 3thnbt.exe 1944 684282.exe 1560 3hhhtn.exe 2772 pjjpd.exe 1928 602602.exe 1488 0868280.exe 2800 4802402.exe 1296 64864.exe 1728 9vpdd.exe 2260 bnhhbh.exe 2424 nbnnbb.exe 1428 tnbntb.exe 2868 28460.exe 324 fxxfrrx.exe 632 dvppp.exe 1256 hnnnhh.exe 2988 dpdjp.exe 980 606202.exe 1532 26802.exe -
Processes:
resource yara_rule behavioral1/memory/1652-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1292-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/304-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/876-292-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5d4a17d93a4a7158ecf0056404a22acc_JaffaCakes118.exe88806.exe860684.exe2028002.exe4408664.exe66064.exek60028.exe82844.exellrlfrf.exebtnnhh.exeddjpp.exe20840.exe424022.exe8240286.exe5rfllrf.exe64620.exedescription pid process target process PID 1652 wrote to memory of 1988 1652 5d4a17d93a4a7158ecf0056404a22acc_JaffaCakes118.exe 88806.exe PID 1652 wrote to memory of 1988 1652 5d4a17d93a4a7158ecf0056404a22acc_JaffaCakes118.exe 88806.exe PID 1652 wrote to memory of 1988 1652 5d4a17d93a4a7158ecf0056404a22acc_JaffaCakes118.exe 88806.exe PID 1652 wrote to memory of 1988 1652 5d4a17d93a4a7158ecf0056404a22acc_JaffaCakes118.exe 88806.exe PID 1988 wrote to memory of 2732 1988 88806.exe 446688.exe PID 1988 wrote to memory of 2732 1988 88806.exe 446688.exe PID 1988 wrote to memory of 2732 1988 88806.exe 446688.exe PID 1988 wrote to memory of 2732 1988 88806.exe 446688.exe PID 2732 wrote to memory of 2576 2732 860684.exe 2028002.exe PID 2732 wrote to memory of 2576 2732 860684.exe 2028002.exe PID 2732 wrote to memory of 2576 2732 860684.exe 2028002.exe PID 2732 wrote to memory of 2576 2732 860684.exe 2028002.exe PID 2576 wrote to memory of 2604 2576 2028002.exe 4408664.exe PID 2576 wrote to memory of 2604 2576 2028002.exe 4408664.exe PID 2576 wrote to memory of 2604 2576 2028002.exe 4408664.exe PID 2576 wrote to memory of 2604 2576 2028002.exe 4408664.exe PID 2604 wrote to memory of 2844 2604 4408664.exe 66064.exe PID 2604 wrote to memory of 2844 2604 4408664.exe 66064.exe PID 2604 wrote to memory of 2844 2604 4408664.exe 66064.exe PID 2604 wrote to memory of 2844 2604 4408664.exe 66064.exe PID 2844 wrote to memory of 3028 2844 66064.exe k60028.exe PID 2844 wrote to memory of 3028 2844 66064.exe k60028.exe PID 2844 wrote to memory of 3028 2844 66064.exe k60028.exe PID 2844 wrote to memory of 3028 2844 66064.exe k60028.exe PID 3028 wrote to memory of 2448 3028 k60028.exe 82844.exe PID 3028 wrote to memory of 2448 3028 k60028.exe 82844.exe PID 3028 wrote to memory of 2448 3028 k60028.exe 82844.exe PID 3028 wrote to memory of 2448 3028 k60028.exe 82844.exe PID 2448 wrote to memory of 1656 2448 82844.exe llrlfrf.exe PID 2448 wrote to memory of 1656 2448 82844.exe llrlfrf.exe PID 2448 wrote to memory of 1656 2448 82844.exe llrlfrf.exe PID 2448 wrote to memory of 1656 2448 82844.exe llrlfrf.exe PID 1656 wrote to memory of 2960 1656 llrlfrf.exe btnnhh.exe PID 1656 wrote to memory of 2960 1656 llrlfrf.exe btnnhh.exe PID 1656 wrote to memory of 2960 1656 llrlfrf.exe btnnhh.exe PID 1656 wrote to memory of 2960 1656 llrlfrf.exe btnnhh.exe PID 2960 wrote to memory of 2536 2960 btnnhh.exe ddjpp.exe PID 2960 wrote to memory of 2536 2960 btnnhh.exe ddjpp.exe PID 2960 wrote to memory of 2536 2960 btnnhh.exe ddjpp.exe PID 2960 wrote to memory of 2536 2960 btnnhh.exe ddjpp.exe PID 2536 wrote to memory of 2976 2536 ddjpp.exe 20840.exe PID 2536 wrote to memory of 2976 2536 ddjpp.exe 20840.exe PID 2536 wrote to memory of 2976 2536 ddjpp.exe 20840.exe PID 2536 wrote to memory of 2976 2536 ddjpp.exe 20840.exe PID 2976 wrote to memory of 2648 2976 20840.exe 424022.exe PID 2976 wrote to memory of 2648 2976 20840.exe 424022.exe PID 2976 wrote to memory of 2648 2976 20840.exe 424022.exe PID 2976 wrote to memory of 2648 2976 20840.exe 424022.exe PID 2648 wrote to memory of 2196 2648 424022.exe 8240286.exe PID 2648 wrote to memory of 2196 2648 424022.exe 8240286.exe PID 2648 wrote to memory of 2196 2648 424022.exe 8240286.exe PID 2648 wrote to memory of 2196 2648 424022.exe 8240286.exe PID 2196 wrote to memory of 2432 2196 8240286.exe 5rfllrf.exe PID 2196 wrote to memory of 2432 2196 8240286.exe 5rfllrf.exe PID 2196 wrote to memory of 2432 2196 8240286.exe 5rfllrf.exe PID 2196 wrote to memory of 2432 2196 8240286.exe 5rfllrf.exe PID 2432 wrote to memory of 2332 2432 5rfllrf.exe 64620.exe PID 2432 wrote to memory of 2332 2432 5rfllrf.exe 64620.exe PID 2432 wrote to memory of 2332 2432 5rfllrf.exe 64620.exe PID 2432 wrote to memory of 2332 2432 5rfllrf.exe 64620.exe PID 2332 wrote to memory of 2768 2332 64620.exe hhtbtn.exe PID 2332 wrote to memory of 2768 2332 64620.exe hhtbtn.exe PID 2332 wrote to memory of 2768 2332 64620.exe hhtbtn.exe PID 2332 wrote to memory of 2768 2332 64620.exe hhtbtn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d4a17d93a4a7158ecf0056404a22acc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d4a17d93a4a7158ecf0056404a22acc_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\88806.exec:\88806.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\860684.exec:\860684.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\2028002.exec:\2028002.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\4408664.exec:\4408664.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\66064.exec:\66064.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\k60028.exec:\k60028.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\82844.exec:\82844.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\llrlfrf.exec:\llrlfrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\btnnhh.exec:\btnnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\ddjpp.exec:\ddjpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\20840.exec:\20840.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\424022.exec:\424022.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\8240286.exec:\8240286.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\5rfllrf.exec:\5rfllrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\64620.exec:\64620.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\hhtbtn.exec:\hhtbtn.exe17⤵
- Executes dropped EXE
PID:2768 -
\??\c:\26882.exec:\26882.exe18⤵
- Executes dropped EXE
PID:844 -
\??\c:\ppjvp.exec:\ppjvp.exe19⤵
- Executes dropped EXE
PID:1292 -
\??\c:\tnhnhn.exec:\tnhnhn.exe20⤵
- Executes dropped EXE
PID:2264 -
\??\c:\jjdpv.exec:\jjdpv.exe21⤵
- Executes dropped EXE
PID:2868 -
\??\c:\9vjdj.exec:\9vjdj.exe22⤵
- Executes dropped EXE
PID:2628 -
\??\c:\0242024.exec:\0242024.exe23⤵
- Executes dropped EXE
PID:540 -
\??\c:\5fxffrr.exec:\5fxffrr.exe24⤵
- Executes dropped EXE
PID:1604 -
\??\c:\20240.exec:\20240.exe25⤵
- Executes dropped EXE
PID:2132 -
\??\c:\o488068.exec:\o488068.exe26⤵
- Executes dropped EXE
PID:1496 -
\??\c:\bntntn.exec:\bntntn.exe27⤵
- Executes dropped EXE
PID:304 -
\??\c:\86804.exec:\86804.exe28⤵
- Executes dropped EXE
PID:656 -
\??\c:\vdpdj.exec:\vdpdj.exe29⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rlffrxf.exec:\rlffrxf.exe30⤵
- Executes dropped EXE
PID:848 -
\??\c:\hbntbh.exec:\hbntbh.exe31⤵
- Executes dropped EXE
PID:876 -
\??\c:\5thhht.exec:\5thhht.exe32⤵
- Executes dropped EXE
PID:2232 -
\??\c:\fxrfflf.exec:\fxrfflf.exe33⤵
- Executes dropped EXE
PID:2168 -
\??\c:\flflrll.exec:\flflrll.exe34⤵
- Executes dropped EXE
PID:1540 -
\??\c:\7vjjp.exec:\7vjjp.exe35⤵
- Executes dropped EXE
PID:1696 -
\??\c:\446688.exec:\446688.exe36⤵
- Executes dropped EXE
PID:2732 -
\??\c:\6226204.exec:\6226204.exe37⤵
- Executes dropped EXE
PID:2600 -
\??\c:\ddpjd.exec:\ddpjd.exe38⤵
- Executes dropped EXE
PID:2092 -
\??\c:\e08862.exec:\e08862.exe39⤵
- Executes dropped EXE
PID:2472 -
\??\c:\4862446.exec:\4862446.exe40⤵
- Executes dropped EXE
PID:2668 -
\??\c:\q60244.exec:\q60244.exe41⤵
- Executes dropped EXE
PID:2584 -
\??\c:\nbnnnt.exec:\nbnnnt.exe42⤵
- Executes dropped EXE
PID:1236 -
\??\c:\7fllrlf.exec:\7fllrlf.exe43⤵
- Executes dropped EXE
PID:1820 -
\??\c:\0462406.exec:\0462406.exe44⤵
- Executes dropped EXE
PID:2608 -
\??\c:\nnhtbn.exec:\nnhtbn.exe45⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xrlfrxf.exec:\xrlfrxf.exe46⤵
- Executes dropped EXE
PID:2932 -
\??\c:\3thnbt.exec:\3thnbt.exe47⤵
- Executes dropped EXE
PID:2484 -
\??\c:\684282.exec:\684282.exe48⤵
- Executes dropped EXE
PID:1944 -
\??\c:\3hhhtn.exec:\3hhhtn.exe49⤵
- Executes dropped EXE
PID:1560 -
\??\c:\pjjpd.exec:\pjjpd.exe50⤵
- Executes dropped EXE
PID:2772 -
\??\c:\602602.exec:\602602.exe51⤵
- Executes dropped EXE
PID:1928 -
\??\c:\0868280.exec:\0868280.exe52⤵
- Executes dropped EXE
PID:1488 -
\??\c:\4802402.exec:\4802402.exe53⤵
- Executes dropped EXE
PID:2800 -
\??\c:\64864.exec:\64864.exe54⤵
- Executes dropped EXE
PID:1296 -
\??\c:\9vpdd.exec:\9vpdd.exe55⤵
- Executes dropped EXE
PID:1728 -
\??\c:\bnhhbh.exec:\bnhhbh.exe56⤵
- Executes dropped EXE
PID:2260 -
\??\c:\nbnnbb.exec:\nbnnbb.exe57⤵
- Executes dropped EXE
PID:2424 -
\??\c:\tnbntb.exec:\tnbntb.exe58⤵
- Executes dropped EXE
PID:1428 -
\??\c:\28460.exec:\28460.exe59⤵
- Executes dropped EXE
PID:2868 -
\??\c:\fxxfrrx.exec:\fxxfrrx.exe60⤵
- Executes dropped EXE
PID:324 -
\??\c:\dvppp.exec:\dvppp.exe61⤵
- Executes dropped EXE
PID:632 -
\??\c:\hnnnhh.exec:\hnnnhh.exe62⤵
- Executes dropped EXE
PID:1256 -
\??\c:\dpdjp.exec:\dpdjp.exe63⤵
- Executes dropped EXE
PID:2988 -
\??\c:\606202.exec:\606202.exe64⤵
- Executes dropped EXE
PID:980 -
\??\c:\26802.exec:\26802.exe65⤵
- Executes dropped EXE
PID:1532 -
\??\c:\60220.exec:\60220.exe66⤵PID:384
-
\??\c:\ddppj.exec:\ddppj.exe67⤵PID:572
-
\??\c:\4446688.exec:\4446688.exe68⤵PID:1796
-
\??\c:\ntbnnn.exec:\ntbnnn.exe69⤵PID:1148
-
\??\c:\lrxxxxr.exec:\lrxxxxr.exe70⤵PID:352
-
\??\c:\08628.exec:\08628.exe71⤵PID:1680
-
\??\c:\hhhntb.exec:\hhhntb.exe72⤵PID:2240
-
\??\c:\480244.exec:\480244.exe73⤵PID:3068
-
\??\c:\q64022.exec:\q64022.exe74⤵PID:1652
-
\??\c:\xfrlrfr.exec:\xfrlrfr.exe75⤵PID:2636
-
\??\c:\486622.exec:\486622.exe76⤵PID:1996
-
\??\c:\424022.exec:\424022.exe77⤵PID:2672
-
\??\c:\ttbnnb.exec:\ttbnnb.exe78⤵PID:2732
-
\??\c:\660264.exec:\660264.exe79⤵PID:2600
-
\??\c:\lfxlflr.exec:\lfxlflr.exe80⤵PID:2684
-
\??\c:\bbtbbt.exec:\bbtbbt.exe81⤵PID:2472
-
\??\c:\82626.exec:\82626.exe82⤵PID:2560
-
\??\c:\btntnn.exec:\btntnn.exe83⤵PID:2860
-
\??\c:\9llrf.exec:\9llrf.exe84⤵PID:2496
-
\??\c:\vpjpd.exec:\vpjpd.exe85⤵PID:1820
-
\??\c:\3ppvj.exec:\3ppvj.exe86⤵PID:2928
-
\??\c:\rrllfll.exec:\rrllfll.exe87⤵PID:2816
-
\??\c:\rfxfllr.exec:\rfxfllr.exe88⤵PID:2488
-
\??\c:\jjpvd.exec:\jjpvd.exe89⤵PID:2064
-
\??\c:\1rfrrxl.exec:\1rfrrxl.exe90⤵PID:1944
-
\??\c:\6486606.exec:\6486606.exe91⤵PID:1560
-
\??\c:\42664.exec:\42664.exe92⤵PID:2772
-
\??\c:\1jvvj.exec:\1jvvj.exe93⤵PID:2548
-
\??\c:\k44684.exec:\k44684.exe94⤵PID:1488
-
\??\c:\226060.exec:\226060.exe95⤵PID:2800
-
\??\c:\602802.exec:\602802.exe96⤵PID:1108
-
\??\c:\c046282.exec:\c046282.exe97⤵PID:1728
-
\??\c:\fffrxlr.exec:\fffrxlr.exe98⤵PID:2296
-
\??\c:\frfrflx.exec:\frfrflx.exe99⤵PID:2424
-
\??\c:\4824604.exec:\4824604.exe100⤵PID:2100
-
\??\c:\xrfllrr.exec:\xrfllrr.exe101⤵PID:2868
-
\??\c:\c424628.exec:\c424628.exe102⤵PID:324
-
\??\c:\m0848.exec:\m0848.exe103⤵PID:632
-
\??\c:\tbhthb.exec:\tbhthb.exe104⤵PID:2056
-
\??\c:\486244.exec:\486244.exe105⤵PID:2988
-
\??\c:\4008440.exec:\4008440.exe106⤵PID:1824
-
\??\c:\4464244.exec:\4464244.exe107⤵PID:1532
-
\??\c:\660662.exec:\660662.exe108⤵PID:384
-
\??\c:\224662.exec:\224662.exe109⤵PID:1272
-
\??\c:\u066424.exec:\u066424.exe110⤵PID:1788
-
\??\c:\flllrrr.exec:\flllrrr.exe111⤵PID:1148
-
\??\c:\xrrxxfr.exec:\xrrxxfr.exe112⤵PID:352
-
\??\c:\vvjvj.exec:\vvjvj.exe113⤵PID:1680
-
\??\c:\8266464.exec:\8266464.exe114⤵PID:1568
-
\??\c:\bbnbnt.exec:\bbnbnt.exe115⤵PID:2096
-
\??\c:\82402.exec:\82402.exe116⤵PID:1628
-
\??\c:\0462006.exec:\0462006.exe117⤵PID:1576
-
\??\c:\0860840.exec:\0860840.exe118⤵PID:3056
-
\??\c:\hbnthh.exec:\hbnthh.exe119⤵PID:2720
-
\??\c:\7bnnhn.exec:\7bnnhn.exe120⤵PID:2640
-
\??\c:\bbbnbn.exec:\bbbnbn.exe121⤵PID:2408
-
\??\c:\424466.exec:\424466.exe122⤵PID:2688
-
\??\c:\djvdp.exec:\djvdp.exe123⤵PID:2696
-
\??\c:\420288.exec:\420288.exe124⤵PID:2440
-
\??\c:\6264682.exec:\6264682.exe125⤵PID:2660
-
\??\c:\w60046.exec:\w60046.exe126⤵PID:1600
-
\??\c:\4868402.exec:\4868402.exe127⤵PID:2736
-
\??\c:\8080002.exec:\8080002.exe128⤵PID:2968
-
\??\c:\4260004.exec:\4260004.exe129⤵PID:2124
-
\??\c:\88682.exec:\88682.exe130⤵PID:1644
-
\??\c:\dvpth.exec:\dvpth.exe131⤵PID:2780
-
\??\c:\6044680.exec:\6044680.exe132⤵PID:2016
-
\??\c:\8446042.exec:\8446042.exe133⤵PID:2972
-
\??\c:\5btthn.exec:\5btthn.exe134⤵PID:1640
-
\??\c:\0468440.exec:\0468440.exe135⤵PID:1700
-
\??\c:\442868.exec:\442868.exe136⤵PID:868
-
\??\c:\7nbbhb.exec:\7nbbhb.exe137⤵PID:2632
-
\??\c:\08684.exec:\08684.exe138⤵PID:2260
-
\??\c:\2422682.exec:\2422682.exe139⤵PID:1252
-
\??\c:\684882.exec:\684882.exe140⤵PID:1872
-
\??\c:\0428068.exec:\0428068.exe141⤵PID:2072
-
\??\c:\04280.exec:\04280.exe142⤵PID:1028
-
\??\c:\dvppd.exec:\dvppd.exe143⤵PID:1736
-
\??\c:\48440.exec:\48440.exe144⤵PID:824
-
\??\c:\1lxxlrx.exec:\1lxxlrx.exe145⤵PID:2132
-
\??\c:\1fxxffr.exec:\1fxxffr.exe146⤵PID:1792
-
\??\c:\2646002.exec:\2646002.exe147⤵PID:2872
-
\??\c:\jjjvj.exec:\jjjvj.exe148⤵PID:3048
-
\??\c:\22808.exec:\22808.exe149⤵PID:1856
-
\??\c:\0466840.exec:\0466840.exe150⤵PID:2352
-
\??\c:\8242286.exec:\8242286.exe151⤵PID:692
-
\??\c:\8640840.exec:\8640840.exe152⤵PID:1976
-
\??\c:\hhtbtb.exec:\hhtbtb.exe153⤵PID:876
-
\??\c:\26468.exec:\26468.exe154⤵PID:2240
-
\??\c:\fxffllr.exec:\fxffllr.exe155⤵PID:2136
-
\??\c:\xrxrffl.exec:\xrxrffl.exe156⤵PID:2128
-
\??\c:\8242840.exec:\8242840.exe157⤵PID:2636
-
\??\c:\668042.exec:\668042.exe158⤵PID:3064
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe159⤵PID:2848
-
\??\c:\08624.exec:\08624.exe160⤵PID:2572
-
\??\c:\24444.exec:\24444.exe161⤵PID:2604
-
\??\c:\hnhbnb.exec:\hnhbnb.exe162⤵PID:2444
-
\??\c:\ddjjv.exec:\ddjjv.exe163⤵PID:2456
-
\??\c:\nhtbnt.exec:\nhtbnt.exe164⤵PID:2668
-
\??\c:\vvjvp.exec:\vvjvp.exe165⤵PID:2860
-
\??\c:\60684.exec:\60684.exe166⤵PID:2692
-
\??\c:\ddpvp.exec:\ddpvp.exe167⤵PID:2820
-
\??\c:\0846880.exec:\0846880.exe168⤵PID:2824
-
\??\c:\5rxxxxf.exec:\5rxxxxf.exe169⤵PID:2736
-
\??\c:\4024080.exec:\4024080.exe170⤵PID:2968
-
\??\c:\pjpjp.exec:\pjpjp.exe171⤵PID:2420
-
\??\c:\5lfrflx.exec:\5lfrflx.exe172⤵PID:2648
-
\??\c:\042802.exec:\042802.exe173⤵PID:2432
-
\??\c:\bnhtbt.exec:\bnhtbt.exe174⤵PID:1424
-
\??\c:\s4880.exec:\s4880.exe175⤵PID:1928
-
\??\c:\64668.exec:\64668.exe176⤵PID:1412
-
\??\c:\o084662.exec:\o084662.exe177⤵PID:2212
-
\??\c:\7dpvj.exec:\7dpvj.exe178⤵PID:1476
-
\??\c:\pjvdj.exec:\pjvdj.exe179⤵PID:1760
-
\??\c:\lrrlxll.exec:\lrrlxll.exe180⤵PID:2788
-
\??\c:\rrflxfx.exec:\rrflxfx.exe181⤵PID:2104
-
\??\c:\djvvd.exec:\djvvd.exe182⤵PID:2424
-
\??\c:\4204068.exec:\4204068.exe183⤵PID:1872
-
\??\c:\bhntnb.exec:\bhntnb.exe184⤵PID:2868
-
\??\c:\xxxxffl.exec:\xxxxffl.exe185⤵PID:736
-
\??\c:\06640.exec:\06640.exe186⤵PID:632
-
\??\c:\222462.exec:\222462.exe187⤵PID:2840
-
\??\c:\6428446.exec:\6428446.exe188⤵PID:2132
-
\??\c:\pjvpd.exec:\pjvpd.exe189⤵PID:612
-
\??\c:\82640.exec:\82640.exe190⤵PID:656
-
\??\c:\26842.exec:\26842.exe191⤵PID:412
-
\??\c:\4240680.exec:\4240680.exe192⤵PID:1796
-
\??\c:\e40220.exec:\e40220.exe193⤵PID:1672
-
\??\c:\004028.exec:\004028.exe194⤵PID:1148
-
\??\c:\208400.exec:\208400.exe195⤵PID:1976
-
\??\c:\9hnbnb.exec:\9hnbnb.exe196⤵PID:2184
-
\??\c:\7jdjj.exec:\7jdjj.exe197⤵PID:2232
-
\??\c:\0460444.exec:\0460444.exe198⤵PID:2164
-
\??\c:\826480.exec:\826480.exe199⤵PID:1696
-
\??\c:\u240884.exec:\u240884.exe200⤵PID:1576
-
\??\c:\lllxrfr.exec:\lllxrfr.exe201⤵PID:2120
-
\??\c:\046406.exec:\046406.exe202⤵PID:2720
-
\??\c:\pjvdj.exec:\pjvdj.exe203⤵PID:2640
-
\??\c:\q48064.exec:\q48064.exe204⤵PID:2464
-
\??\c:\664666.exec:\664666.exe205⤵PID:2584
-
\??\c:\5bntbb.exec:\5bntbb.exe206⤵PID:2948
-
\??\c:\m4024.exec:\m4024.exe207⤵PID:2252
-
\??\c:\9dvjd.exec:\9dvjd.exe208⤵PID:1648
-
\??\c:\8206224.exec:\8206224.exe209⤵PID:2536
-
\??\c:\xlfxlrl.exec:\xlfxlrl.exe210⤵PID:2524
-
\??\c:\tnhhbn.exec:\tnhhbn.exe211⤵PID:3000
-
\??\c:\vvjdj.exec:\vvjdj.exe212⤵PID:2064
-
\??\c:\4666240.exec:\4666240.exe213⤵PID:2792
-
\??\c:\c084620.exec:\c084620.exe214⤵PID:1592
-
\??\c:\5nntth.exec:\5nntth.exe215⤵PID:2804
-
\??\c:\jdvvd.exec:\jdvvd.exe216⤵PID:288
-
\??\c:\fflxxrl.exec:\fflxxrl.exe217⤵PID:1640
-
\??\c:\9rlrflf.exec:\9rlrflf.exe218⤵PID:2084
-
\??\c:\0484846.exec:\0484846.exe219⤵PID:2272
-
\??\c:\0420224.exec:\0420224.exe220⤵PID:1676
-
\??\c:\tnhthh.exec:\tnhthh.exe221⤵PID:1728
-
\??\c:\26264.exec:\26264.exe222⤵PID:1492
-
\??\c:\o022280.exec:\o022280.exe223⤵PID:800
-
\??\c:\9rxrrrr.exec:\9rxrrrr.exe224⤵PID:2876
-
\??\c:\xxlfllx.exec:\xxlfllx.exe225⤵PID:540
-
\??\c:\ddvdp.exec:\ddvdp.exe226⤵PID:1864
-
\??\c:\86008.exec:\86008.exe227⤵PID:952
-
\??\c:\48880.exec:\48880.exe228⤵PID:824
-
\??\c:\hnhnht.exec:\hnhnht.exe229⤵PID:2416
-
\??\c:\40028.exec:\40028.exe230⤵PID:1084
-
\??\c:\rxlflxr.exec:\rxlflxr.exe231⤵PID:2872
-
\??\c:\dpvjp.exec:\dpvjp.exe232⤵PID:3048
-
\??\c:\jjvvv.exec:\jjvvv.exe233⤵PID:1856
-
\??\c:\428848.exec:\428848.exe234⤵PID:2352
-
\??\c:\dddpj.exec:\dddpj.exe235⤵PID:692
-
\??\c:\9rflfrl.exec:\9rflfrl.exe236⤵PID:864
-
\??\c:\280400.exec:\280400.exe237⤵PID:876
-
\??\c:\428222.exec:\428222.exe238⤵PID:1972
-
\??\c:\jdppj.exec:\jdppj.exe239⤵PID:3020
-
\??\c:\08006.exec:\08006.exe240⤵PID:2676
-
\??\c:\6404284.exec:\6404284.exe241⤵PID:2656
-
\??\c:\484084.exec:\484084.exe242⤵PID:2292