Analysis
-
max time kernel
150s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 14:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
63a3c23d75e6fd118022803568ca5570_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
63a3c23d75e6fd118022803568ca5570_JaffaCakes118.exe
-
Size
65KB
-
MD5
63a3c23d75e6fd118022803568ca5570
-
SHA1
74c82fa7d45524cdfe37b8c5a4baefee6f8aaccc
-
SHA256
ff0571504d446fc10182a2b295723ff960f36db1313efc6a049951a28732dffb
-
SHA512
f9f3a4d2c1ceb4803476470dfd1e9a8c52bddf03e4b6501583b4fccb020db468b1b0d71f13722ad02d0771c20a1414f92a6e161c06a9760eb35db810489169a6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIuyWNSW:ymb3NkkiQ3mdBjFIuyWd
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral2/memory/3828-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-35-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2544-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/648-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3800-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
flfrlfx.exexrlffrr.exenbnhbb.exexllrxrf.exebtbbbh.exe404888.exe6826660.exejdppp.exe86248.exe606488.exeq64400.exefxxxrrl.exehhbbbh.exe6800444.exe866600.exedpdjj.exe06404.exea6044.exe2066444.exetntntt.exebtbbnn.exetnhbtt.exei422660.exepjdvd.exei028866.exellxrrrl.exelxxrrxf.exevdjdv.exexxllffx.exe22844.exe08208.exe9nnhbb.exek04260.exe4800200.exe20048.exedjvpd.exeo488262.exerrxfxfx.exeffrfrfr.exe8442086.exedvdvv.exem8482.exe5hbthb.exe28242.exe606002.exe7nnnhb.exejpppj.exe626482.exettbtbn.exevpddj.exefrrfxrf.exe228648.exe884204.exe1vjdp.exefxrrffx.exedvdvj.exe4284260.exefrxrlll.exeddppj.exe02448.exe486066.exe468266.exe88006.exexlxlrlx.exepid process 4256 flfrlfx.exe 2584 xrlffrr.exe 440 nbnhbb.exe 3068 xllrxrf.exe 3544 btbbbh.exe 4528 404888.exe 2544 6826660.exe 3924 jdppp.exe 3228 86248.exe 3964 606488.exe 3916 q64400.exe 2284 fxxxrrl.exe 2892 hhbbbh.exe 4348 6800444.exe 4332 866600.exe 2424 dpdjj.exe 4800 06404.exe 3340 a6044.exe 4196 2066444.exe 4676 tntntt.exe 1156 btbbnn.exe 648 tnhbtt.exe 4768 i422660.exe 404 pjdvd.exe 5008 i028866.exe 1672 llxrrrl.exe 4944 lxxrrxf.exe 1580 vdjdv.exe 3800 xxllffx.exe 3308 22844.exe 4308 08208.exe 396 9nnhbb.exe 2420 k04260.exe 3136 4800200.exe 4200 20048.exe 4748 djvpd.exe 1348 o488262.exe 400 rrxfxfx.exe 468 ffrfrfr.exe 1904 8442086.exe 1960 dvdvv.exe 1916 m8482.exe 1472 5hbthb.exe 3932 28242.exe 3604 606002.exe 4752 7nnnhb.exe 3152 jpppj.exe 932 626482.exe 4116 ttbtbn.exe 3228 vpddj.exe 2100 frrfxrf.exe 3092 228648.exe 4060 884204.exe 2892 1vjdp.exe 3420 fxrrffx.exe 4208 dvdvj.exe 556 4284260.exe 876 frxrlll.exe 1612 ddppj.exe 3440 02448.exe 5056 486066.exe 4196 468266.exe 4676 88006.exe 644 xlxlrlx.exe -
Processes:
resource yara_rule behavioral2/memory/3828-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/648-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3800-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
63a3c23d75e6fd118022803568ca5570_JaffaCakes118.exeflfrlfx.exexrlffrr.exenbnhbb.exexllrxrf.exebtbbbh.exe404888.exe6826660.exejdppp.exe86248.exe606488.exeq64400.exefxxxrrl.exehhbbbh.exe6800444.exe866600.exedpdjj.exe06404.exea6044.exe2066444.exetntntt.exebtbbnn.exedescription pid process target process PID 3828 wrote to memory of 4256 3828 63a3c23d75e6fd118022803568ca5570_JaffaCakes118.exe flfrlfx.exe PID 3828 wrote to memory of 4256 3828 63a3c23d75e6fd118022803568ca5570_JaffaCakes118.exe flfrlfx.exe PID 3828 wrote to memory of 4256 3828 63a3c23d75e6fd118022803568ca5570_JaffaCakes118.exe flfrlfx.exe PID 4256 wrote to memory of 2584 4256 flfrlfx.exe xrlffrr.exe PID 4256 wrote to memory of 2584 4256 flfrlfx.exe xrlffrr.exe PID 4256 wrote to memory of 2584 4256 flfrlfx.exe xrlffrr.exe PID 2584 wrote to memory of 440 2584 xrlffrr.exe nbnhbb.exe PID 2584 wrote to memory of 440 2584 xrlffrr.exe nbnhbb.exe PID 2584 wrote to memory of 440 2584 xrlffrr.exe nbnhbb.exe PID 440 wrote to memory of 3068 440 nbnhbb.exe xllrxrf.exe PID 440 wrote to memory of 3068 440 nbnhbb.exe xllrxrf.exe PID 440 wrote to memory of 3068 440 nbnhbb.exe xllrxrf.exe PID 3068 wrote to memory of 3544 3068 xllrxrf.exe btbbbh.exe PID 3068 wrote to memory of 3544 3068 xllrxrf.exe btbbbh.exe PID 3068 wrote to memory of 3544 3068 xllrxrf.exe btbbbh.exe PID 3544 wrote to memory of 4528 3544 btbbbh.exe 404888.exe PID 3544 wrote to memory of 4528 3544 btbbbh.exe 404888.exe PID 3544 wrote to memory of 4528 3544 btbbbh.exe 404888.exe PID 4528 wrote to memory of 2544 4528 404888.exe 6826660.exe PID 4528 wrote to memory of 2544 4528 404888.exe 6826660.exe PID 4528 wrote to memory of 2544 4528 404888.exe 6826660.exe PID 2544 wrote to memory of 3924 2544 6826660.exe jdppp.exe PID 2544 wrote to memory of 3924 2544 6826660.exe jdppp.exe PID 2544 wrote to memory of 3924 2544 6826660.exe jdppp.exe PID 3924 wrote to memory of 3228 3924 jdppp.exe 86248.exe PID 3924 wrote to memory of 3228 3924 jdppp.exe 86248.exe PID 3924 wrote to memory of 3228 3924 jdppp.exe 86248.exe PID 3228 wrote to memory of 3964 3228 86248.exe 606488.exe PID 3228 wrote to memory of 3964 3228 86248.exe 606488.exe PID 3228 wrote to memory of 3964 3228 86248.exe 606488.exe PID 3964 wrote to memory of 3916 3964 606488.exe q64400.exe PID 3964 wrote to memory of 3916 3964 606488.exe q64400.exe PID 3964 wrote to memory of 3916 3964 606488.exe q64400.exe PID 3916 wrote to memory of 2284 3916 q64400.exe fxxxrrl.exe PID 3916 wrote to memory of 2284 3916 q64400.exe fxxxrrl.exe PID 3916 wrote to memory of 2284 3916 q64400.exe fxxxrrl.exe PID 2284 wrote to memory of 2892 2284 fxxxrrl.exe hhbbbh.exe PID 2284 wrote to memory of 2892 2284 fxxxrrl.exe hhbbbh.exe PID 2284 wrote to memory of 2892 2284 fxxxrrl.exe hhbbbh.exe PID 2892 wrote to memory of 4348 2892 hhbbbh.exe 6800444.exe PID 2892 wrote to memory of 4348 2892 hhbbbh.exe 6800444.exe PID 2892 wrote to memory of 4348 2892 hhbbbh.exe 6800444.exe PID 4348 wrote to memory of 4332 4348 6800444.exe 866600.exe PID 4348 wrote to memory of 4332 4348 6800444.exe 866600.exe PID 4348 wrote to memory of 4332 4348 6800444.exe 866600.exe PID 4332 wrote to memory of 2424 4332 866600.exe dpdjj.exe PID 4332 wrote to memory of 2424 4332 866600.exe dpdjj.exe PID 4332 wrote to memory of 2424 4332 866600.exe dpdjj.exe PID 2424 wrote to memory of 4800 2424 dpdjj.exe 06404.exe PID 2424 wrote to memory of 4800 2424 dpdjj.exe 06404.exe PID 2424 wrote to memory of 4800 2424 dpdjj.exe 06404.exe PID 4800 wrote to memory of 3340 4800 06404.exe a6044.exe PID 4800 wrote to memory of 3340 4800 06404.exe a6044.exe PID 4800 wrote to memory of 3340 4800 06404.exe a6044.exe PID 3340 wrote to memory of 4196 3340 a6044.exe 2066444.exe PID 3340 wrote to memory of 4196 3340 a6044.exe 2066444.exe PID 3340 wrote to memory of 4196 3340 a6044.exe 2066444.exe PID 4196 wrote to memory of 4676 4196 2066444.exe tntntt.exe PID 4196 wrote to memory of 4676 4196 2066444.exe tntntt.exe PID 4196 wrote to memory of 4676 4196 2066444.exe tntntt.exe PID 4676 wrote to memory of 1156 4676 tntntt.exe btbbnn.exe PID 4676 wrote to memory of 1156 4676 tntntt.exe btbbnn.exe PID 4676 wrote to memory of 1156 4676 tntntt.exe btbbnn.exe PID 1156 wrote to memory of 648 1156 btbbnn.exe tnhbtt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63a3c23d75e6fd118022803568ca5570_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\63a3c23d75e6fd118022803568ca5570_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\flfrlfx.exec:\flfrlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\xrlffrr.exec:\xrlffrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\nbnhbb.exec:\nbnhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\xllrxrf.exec:\xllrxrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\btbbbh.exec:\btbbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\404888.exec:\404888.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\6826660.exec:\6826660.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\jdppp.exec:\jdppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\86248.exec:\86248.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\606488.exec:\606488.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\q64400.exec:\q64400.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\hhbbbh.exec:\hhbbbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\6800444.exec:\6800444.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\866600.exec:\866600.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\dpdjj.exec:\dpdjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\06404.exec:\06404.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\a6044.exec:\a6044.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\2066444.exec:\2066444.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\tntntt.exec:\tntntt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\btbbnn.exec:\btbbnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\tnhbtt.exec:\tnhbtt.exe23⤵
- Executes dropped EXE
PID:648 -
\??\c:\i422660.exec:\i422660.exe24⤵
- Executes dropped EXE
PID:4768 -
\??\c:\pjdvd.exec:\pjdvd.exe25⤵
- Executes dropped EXE
PID:404 -
\??\c:\i028866.exec:\i028866.exe26⤵
- Executes dropped EXE
PID:5008 -
\??\c:\llxrrrl.exec:\llxrrrl.exe27⤵
- Executes dropped EXE
PID:1672 -
\??\c:\lxxrrxf.exec:\lxxrrxf.exe28⤵
- Executes dropped EXE
PID:4944 -
\??\c:\vdjdv.exec:\vdjdv.exe29⤵
- Executes dropped EXE
PID:1580 -
\??\c:\xxllffx.exec:\xxllffx.exe30⤵
- Executes dropped EXE
PID:3800 -
\??\c:\22844.exec:\22844.exe31⤵
- Executes dropped EXE
PID:3308 -
\??\c:\08208.exec:\08208.exe32⤵
- Executes dropped EXE
PID:4308 -
\??\c:\9nnhbb.exec:\9nnhbb.exe33⤵
- Executes dropped EXE
PID:396 -
\??\c:\k04260.exec:\k04260.exe34⤵
- Executes dropped EXE
PID:2420 -
\??\c:\4800200.exec:\4800200.exe35⤵
- Executes dropped EXE
PID:3136 -
\??\c:\20048.exec:\20048.exe36⤵
- Executes dropped EXE
PID:4200 -
\??\c:\djvpd.exec:\djvpd.exe37⤵
- Executes dropped EXE
PID:4748 -
\??\c:\o488262.exec:\o488262.exe38⤵
- Executes dropped EXE
PID:1348 -
\??\c:\rrxfxfx.exec:\rrxfxfx.exe39⤵
- Executes dropped EXE
PID:400 -
\??\c:\ffrfrfr.exec:\ffrfrfr.exe40⤵
- Executes dropped EXE
PID:468 -
\??\c:\e02626.exec:\e02626.exe41⤵PID:4144
-
\??\c:\8442086.exec:\8442086.exe42⤵
- Executes dropped EXE
PID:1904 -
\??\c:\dvdvv.exec:\dvdvv.exe43⤵
- Executes dropped EXE
PID:1960 -
\??\c:\m8482.exec:\m8482.exe44⤵
- Executes dropped EXE
PID:1916 -
\??\c:\5hbthb.exec:\5hbthb.exe45⤵
- Executes dropped EXE
PID:1472 -
\??\c:\28242.exec:\28242.exe46⤵
- Executes dropped EXE
PID:3932 -
\??\c:\606002.exec:\606002.exe47⤵
- Executes dropped EXE
PID:3604 -
\??\c:\7nnnhb.exec:\7nnnhb.exe48⤵
- Executes dropped EXE
PID:4752 -
\??\c:\jpppj.exec:\jpppj.exe49⤵
- Executes dropped EXE
PID:3152 -
\??\c:\626482.exec:\626482.exe50⤵
- Executes dropped EXE
PID:932 -
\??\c:\ttbtbn.exec:\ttbtbn.exe51⤵
- Executes dropped EXE
PID:4116 -
\??\c:\vpddj.exec:\vpddj.exe52⤵
- Executes dropped EXE
PID:3228 -
\??\c:\frrfxrf.exec:\frrfxrf.exe53⤵
- Executes dropped EXE
PID:2100 -
\??\c:\228648.exec:\228648.exe54⤵
- Executes dropped EXE
PID:3092 -
\??\c:\884204.exec:\884204.exe55⤵
- Executes dropped EXE
PID:4060 -
\??\c:\1vjdp.exec:\1vjdp.exe56⤵
- Executes dropped EXE
PID:2892 -
\??\c:\fxrrffx.exec:\fxrrffx.exe57⤵
- Executes dropped EXE
PID:3420 -
\??\c:\dvdvj.exec:\dvdvj.exe58⤵
- Executes dropped EXE
PID:4208 -
\??\c:\4284260.exec:\4284260.exe59⤵
- Executes dropped EXE
PID:556 -
\??\c:\frxrlll.exec:\frxrlll.exe60⤵
- Executes dropped EXE
PID:876 -
\??\c:\ddppj.exec:\ddppj.exe61⤵
- Executes dropped EXE
PID:1612 -
\??\c:\02448.exec:\02448.exe62⤵
- Executes dropped EXE
PID:3440 -
\??\c:\486066.exec:\486066.exe63⤵
- Executes dropped EXE
PID:5056 -
\??\c:\468266.exec:\468266.exe64⤵
- Executes dropped EXE
PID:4196 -
\??\c:\88006.exec:\88006.exe65⤵
- Executes dropped EXE
PID:4676 -
\??\c:\xlxlrlx.exec:\xlxlrlx.exe66⤵
- Executes dropped EXE
PID:644 -
\??\c:\822222.exec:\822222.exe67⤵PID:732
-
\??\c:\vvpjj.exec:\vvpjj.exe68⤵PID:2292
-
\??\c:\606044.exec:\606044.exe69⤵PID:4680
-
\??\c:\6800000.exec:\6800000.exe70⤵PID:464
-
\??\c:\840488.exec:\840488.exe71⤵PID:4260
-
\??\c:\8022226.exec:\8022226.exe72⤵PID:1672
-
\??\c:\20042.exec:\20042.exe73⤵PID:2792
-
\??\c:\08488.exec:\08488.exe74⤵PID:3960
-
\??\c:\86028.exec:\86028.exe75⤵PID:2532
-
\??\c:\lxrlfff.exec:\lxrlfff.exe76⤵PID:1976
-
\??\c:\w40022.exec:\w40022.exe77⤵PID:3140
-
\??\c:\0404444.exec:\0404444.exe78⤵PID:1352
-
\??\c:\26484.exec:\26484.exe79⤵PID:2412
-
\??\c:\rffxxxl.exec:\rffxxxl.exe80⤵PID:396
-
\??\c:\40600.exec:\40600.exe81⤵PID:3104
-
\??\c:\1xxrxxr.exec:\1xxrxxr.exe82⤵PID:3136
-
\??\c:\5pvvd.exec:\5pvvd.exe83⤵PID:3532
-
\??\c:\280000.exec:\280000.exe84⤵PID:4748
-
\??\c:\6804222.exec:\6804222.exe85⤵PID:1348
-
\??\c:\pvvvv.exec:\pvvvv.exe86⤵PID:468
-
\??\c:\624488.exec:\624488.exe87⤵PID:4264
-
\??\c:\a2882.exec:\a2882.exe88⤵PID:1280
-
\??\c:\484828.exec:\484828.exe89⤵PID:1960
-
\??\c:\m0622.exec:\m0622.exe90⤵PID:2316
-
\??\c:\48482.exec:\48482.exe91⤵PID:880
-
\??\c:\644822.exec:\644822.exe92⤵PID:3036
-
\??\c:\420444.exec:\420444.exe93⤵PID:5080
-
\??\c:\4066882.exec:\4066882.exe94⤵PID:4100
-
\??\c:\66888.exec:\66888.exe95⤵PID:2340
-
\??\c:\vdvvv.exec:\vdvvv.exe96⤵PID:4064
-
\??\c:\86828.exec:\86828.exe97⤵PID:3096
-
\??\c:\c404666.exec:\c404666.exe98⤵PID:1800
-
\??\c:\000482.exec:\000482.exe99⤵PID:860
-
\??\c:\020444.exec:\020444.exe100⤵PID:4792
-
\??\c:\042222.exec:\042222.exe101⤵PID:1160
-
\??\c:\e66600.exec:\e66600.exe102⤵PID:4628
-
\??\c:\82606.exec:\82606.exe103⤵PID:4004
-
\??\c:\o804888.exec:\o804888.exe104⤵PID:1620
-
\??\c:\jdppp.exec:\jdppp.exe105⤵PID:2836
-
\??\c:\04644.exec:\04644.exe106⤵PID:4832
-
\??\c:\dvpjj.exec:\dvpjj.exe107⤵PID:5036
-
\??\c:\fxfxfff.exec:\fxfxfff.exe108⤵PID:556
-
\??\c:\208882.exec:\208882.exe109⤵PID:392
-
\??\c:\9pjdd.exec:\9pjdd.exe110⤵PID:3008
-
\??\c:\thhnbt.exec:\thhnbt.exe111⤵PID:2296
-
\??\c:\rxrrxxx.exec:\rxrrxxx.exe112⤵PID:4196
-
\??\c:\682466.exec:\682466.exe113⤵PID:4636
-
\??\c:\3hbttt.exec:\3hbttt.exe114⤵PID:4768
-
\??\c:\xrlrllf.exec:\xrlrllf.exe115⤵PID:2864
-
\??\c:\0400000.exec:\0400000.exe116⤵PID:1812
-
\??\c:\8684020.exec:\8684020.exe117⤵PID:2896
-
\??\c:\jjppj.exec:\jjppj.exe118⤵PID:4260
-
\??\c:\w66000.exec:\w66000.exe119⤵PID:1672
-
\??\c:\lxrrxxx.exec:\lxrrxxx.exe120⤵PID:2792
-
\??\c:\2844882.exec:\2844882.exe121⤵PID:3800
-
\??\c:\nhbbtb.exec:\nhbbtb.exe122⤵PID:3624
-
\??\c:\4404444.exec:\4404444.exe123⤵PID:1976
-
\??\c:\a2400.exec:\a2400.exe124⤵PID:3140
-
\??\c:\vpppv.exec:\vpppv.exe125⤵PID:372
-
\??\c:\llllflf.exec:\llllflf.exe126⤵PID:2412
-
\??\c:\o662266.exec:\o662266.exe127⤵PID:4684
-
\??\c:\tnbnhh.exec:\tnbnhh.exe128⤵PID:3104
-
\??\c:\822286.exec:\822286.exe129⤵PID:2736
-
\??\c:\02060.exec:\02060.exe130⤵PID:912
-
\??\c:\4806026.exec:\4806026.exe131⤵PID:1148
-
\??\c:\tthttt.exec:\tthttt.exe132⤵PID:1904
-
\??\c:\dvjjd.exec:\dvjjd.exe133⤵PID:1664
-
\??\c:\402488.exec:\402488.exe134⤵PID:3656
-
\??\c:\2284062.exec:\2284062.exe135⤵PID:2604
-
\??\c:\2664668.exec:\2664668.exe136⤵PID:2460
-
\??\c:\i626626.exec:\i626626.exe137⤵PID:4376
-
\??\c:\vvddd.exec:\vvddd.exe138⤵PID:1936
-
\??\c:\jjpjj.exec:\jjpjj.exe139⤵PID:4100
-
\??\c:\02466.exec:\02466.exe140⤵PID:2340
-
\??\c:\dddvp.exec:\dddvp.exe141⤵PID:4064
-
\??\c:\vddjd.exec:\vddjd.exe142⤵PID:4896
-
\??\c:\260022.exec:\260022.exe143⤵PID:3228
-
\??\c:\628822.exec:\628822.exe144⤵PID:3260
-
\??\c:\8226666.exec:\8226666.exe145⤵PID:3396
-
\??\c:\204006.exec:\204006.exe146⤵PID:4352
-
\??\c:\0084844.exec:\0084844.exe147⤵PID:5020
-
\??\c:\nthhbb.exec:\nthhbb.exe148⤵PID:2892
-
\??\c:\26006.exec:\26006.exe149⤵PID:4332
-
\??\c:\tnhbnn.exec:\tnhbnn.exe150⤵PID:2832
-
\??\c:\064428.exec:\064428.exe151⤵PID:4600
-
\??\c:\846666.exec:\846666.exe152⤵PID:4292
-
\??\c:\0408248.exec:\0408248.exe153⤵PID:4908
-
\??\c:\k06628.exec:\k06628.exe154⤵PID:4676
-
\??\c:\406044.exec:\406044.exe155⤵PID:4108
-
\??\c:\42888.exec:\42888.exe156⤵PID:512
-
\??\c:\80482.exec:\80482.exe157⤵PID:3968
-
\??\c:\606628.exec:\606628.exe158⤵PID:4372
-
\??\c:\bttnnn.exec:\bttnnn.exe159⤵PID:4900
-
\??\c:\6022666.exec:\6022666.exe160⤵PID:4532
-
\??\c:\dpvvv.exec:\dpvvv.exe161⤵PID:4468
-
\??\c:\0060004.exec:\0060004.exe162⤵PID:2668
-
\??\c:\xrrxrxx.exec:\xrrxrxx.exe163⤵PID:452
-
\??\c:\264660.exec:\264660.exe164⤵PID:4328
-
\??\c:\4062888.exec:\4062888.exe165⤵PID:2420
-
\??\c:\hnhhtn.exec:\hnhhtn.exe166⤵PID:3224
-
\??\c:\dpvvd.exec:\dpvvd.exe167⤵PID:2164
-
\??\c:\26884.exec:\26884.exe168⤵PID:2736
-
\??\c:\vjjjd.exec:\vjjjd.exe169⤵PID:5092
-
\??\c:\60884.exec:\60884.exe170⤵PID:1272
-
\??\c:\86824.exec:\86824.exe171⤵PID:1904
-
\??\c:\26226.exec:\26226.exe172⤵PID:1472
-
\??\c:\6800882.exec:\6800882.exe173⤵PID:1916
-
\??\c:\822666.exec:\822666.exe174⤵PID:3648
-
\??\c:\pjpjp.exec:\pjpjp.exe175⤵PID:3932
-
\??\c:\7ntttb.exec:\7ntttb.exe176⤵PID:4752
-
\??\c:\tntbhn.exec:\tntbhn.exe177⤵PID:3728
-
\??\c:\nnbbbn.exec:\nnbbbn.exe178⤵PID:2740
-
\??\c:\nbhbhn.exec:\nbhbhn.exe179⤵PID:4320
-
\??\c:\0888848.exec:\0888848.exe180⤵PID:4116
-
\??\c:\024406.exec:\024406.exe181⤵PID:4996
-
\??\c:\828840.exec:\828840.exe182⤵PID:4792
-
\??\c:\ppdjj.exec:\ppdjj.exe183⤵PID:1160
-
\??\c:\20006.exec:\20006.exe184⤵PID:3664
-
\??\c:\pjddj.exec:\pjddj.exe185⤵PID:4348
-
\??\c:\8844222.exec:\8844222.exe186⤵PID:5020
-
\??\c:\rxffxxr.exec:\rxffxxr.exe187⤵PID:4168
-
\??\c:\840062.exec:\840062.exe188⤵PID:4456
-
\??\c:\dvddv.exec:\dvddv.exe189⤵PID:2832
-
\??\c:\08220.exec:\08220.exe190⤵PID:392
-
\??\c:\8862888.exec:\8862888.exe191⤵PID:4292
-
\??\c:\482266.exec:\482266.exe192⤵PID:4428
-
\??\c:\086662.exec:\086662.exe193⤵PID:1096
-
\??\c:\m2260.exec:\m2260.exe194⤵PID:2072
-
\??\c:\nhnnhh.exec:\nhnnhh.exe195⤵PID:1840
-
\??\c:\680488.exec:\680488.exe196⤵PID:4944
-
\??\c:\frxrlll.exec:\frxrlll.exe197⤵PID:1580
-
\??\c:\vpvpp.exec:\vpvpp.exe198⤵PID:4480
-
\??\c:\006088.exec:\006088.exe199⤵PID:4212
-
\??\c:\k62668.exec:\k62668.exe200⤵PID:4876
-
\??\c:\488046.exec:\488046.exe201⤵PID:3216
-
\??\c:\pjpjv.exec:\pjpjv.exe202⤵PID:2436
-
\??\c:\xffxxxr.exec:\xffxxxr.exe203⤵PID:2772
-
\??\c:\2422440.exec:\2422440.exe204⤵PID:4684
-
\??\c:\0400228.exec:\0400228.exe205⤵PID:2388
-
\??\c:\4826228.exec:\4826228.exe206⤵PID:4276
-
\??\c:\0200444.exec:\0200444.exe207⤵PID:912
-
\??\c:\nhttbh.exec:\nhttbh.exe208⤵PID:1148
-
\??\c:\nhhnnb.exec:\nhhnnb.exe209⤵PID:3540
-
\??\c:\084262.exec:\084262.exe210⤵PID:1664
-
\??\c:\htttnn.exec:\htttnn.exe211⤵PID:880
-
\??\c:\4280460.exec:\4280460.exe212⤵PID:3068
-
\??\c:\88060.exec:\88060.exe213⤵PID:3036
-
\??\c:\jddvv.exec:\jddvv.exe214⤵PID:3152
-
\??\c:\tnnhtt.exec:\tnnhtt.exe215⤵PID:1924
-
\??\c:\0826000.exec:\0826000.exe216⤵PID:932
-
\??\c:\ddjjp.exec:\ddjjp.exe217⤵PID:4340
-
\??\c:\802822.exec:\802822.exe218⤵PID:2948
-
\??\c:\vvvvv.exec:\vvvvv.exe219⤵PID:2400
-
\??\c:\2282226.exec:\2282226.exe220⤵PID:2284
-
\??\c:\g6866.exec:\g6866.exe221⤵PID:3396
-
\??\c:\0604664.exec:\0604664.exe222⤵PID:4352
-
\??\c:\vdvpp.exec:\vdvpp.exe223⤵PID:4464
-
\??\c:\nhntnt.exec:\nhntnt.exe224⤵PID:2892
-
\??\c:\s6682.exec:\s6682.exe225⤵PID:4332
-
\??\c:\26626.exec:\26626.exe226⤵PID:556
-
\??\c:\8226660.exec:\8226660.exe227⤵PID:4600
-
\??\c:\06486.exec:\06486.exe228⤵PID:4440
-
\??\c:\5ttnbt.exec:\5ttnbt.exe229⤵PID:4292
-
\??\c:\fxlxffr.exec:\fxlxffr.exe230⤵PID:2036
-
\??\c:\xlflxrx.exec:\xlflxrx.exe231⤵PID:5008
-
\??\c:\frrlffx.exec:\frrlffx.exe232⤵PID:808
-
\??\c:\c844404.exec:\c844404.exe233⤵PID:4372
-
\??\c:\o826004.exec:\o826004.exe234⤵PID:3600
-
\??\c:\0000666.exec:\0000666.exe235⤵PID:1580
-
\??\c:\q28844.exec:\q28844.exe236⤵PID:1976
-
\??\c:\28026.exec:\28026.exe237⤵PID:1464
-
\??\c:\djdjj.exec:\djdjj.exe238⤵PID:1080
-
\??\c:\4288448.exec:\4288448.exe239⤵PID:4200
-
\??\c:\1vddj.exec:\1vddj.exe240⤵PID:4572
-
\??\c:\9bbbtt.exec:\9bbbtt.exe241⤵PID:3532
-