Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 23:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9c5d9802b7519827e6b8e2e4615ea30d_JaffaCakes118.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
9c5d9802b7519827e6b8e2e4615ea30d_JaffaCakes118.exe
-
Size
101KB
-
MD5
9c5d9802b7519827e6b8e2e4615ea30d
-
SHA1
cea195526872ae777979cb07e1abcc9add371d85
-
SHA256
d6ce6477e74efb0811c638a609fc11ad1cf0fd13963912df06dc65a20ab4f9d9
-
SHA512
2090dd26b44af877609d72b83db4cec5c1226dbeaf6edf5be3e56365d99bd99aba01003bcdb3c309449e15fe2ed3a83b1fcba90f92d428b887e9608133a6d125
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2lmf6g7xmIi6h7zZ:ymb3NkkiQ3mdBjF+3TU20L46Fd
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2392-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/852-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1088-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/540-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1496-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/452-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2864 btbttn.exe 2996 vjjdj.exe 2280 tthbtn.exe 2676 1nhbbb.exe 2560 ppvvv.exe 2624 xlrrxxl.exe 2044 thtbbh.exe 2432 nhtbnn.exe 2700 ppjjp.exe 2604 1lxrxxf.exe 3040 5xlrflx.exe 852 tthntb.exe 2612 pdppv.exe 1948 7pdpv.exe 2424 fxrrlrf.exe 1404 rlxfflx.exe 1088 btbhnt.exe 1744 ppvvj.exe 1740 vpdpj.exe 948 fxllflf.exe 540 btnhbb.exe 1048 tnbhhb.exe 1496 3pjvp.exe 1996 3flxfrx.exe 452 rlrlflf.exe 2852 9hbnbb.exe 1992 ppdvd.exe 2328 5llxflx.exe 312 3frxxxr.exe 2824 bnbhtt.exe 1064 jdpdj.exe 1920 5ppdp.exe 1608 5rfxxfl.exe 2840 fxrfrrf.exe 2864 hhnbnt.exe 1208 jppdv.exe 2580 3vjvp.exe 2644 rlxrfff.exe 2668 rffllll.exe 2444 hbtthn.exe 2464 5tbnnt.exe 2696 dvjjj.exe 2652 vvpvj.exe 1136 xrrlxfr.exe 2132 nhnntt.exe 2960 nnhtbh.exe 2944 3djjv.exe 1664 vpjpj.exe 1476 rlrrrxf.exe 2732 rlxlxfx.exe 2716 fxlllrx.exe 2956 hhbhtb.exe 1880 thhtbb.exe 1096 5jvdj.exe 1584 vpddp.exe 1952 7rffxxx.exe 1868 bnbthn.exe 1724 7hbnbb.exe 588 jjpdp.exe 1100 3dpjj.exe 1648 7rfflrf.exe 1536 xlflrxf.exe 1152 btbntb.exe 1628 bbnhhh.exe -
resource yara_rule behavioral1/memory/2864-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/852-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1088-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/540-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/452-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-264-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2392 wrote to memory of 2864 2392 9c5d9802b7519827e6b8e2e4615ea30d_JaffaCakes118.exe 28 PID 2392 wrote to memory of 2864 2392 9c5d9802b7519827e6b8e2e4615ea30d_JaffaCakes118.exe 28 PID 2392 wrote to memory of 2864 2392 9c5d9802b7519827e6b8e2e4615ea30d_JaffaCakes118.exe 28 PID 2392 wrote to memory of 2864 2392 9c5d9802b7519827e6b8e2e4615ea30d_JaffaCakes118.exe 28 PID 2864 wrote to memory of 2996 2864 btbttn.exe 29 PID 2864 wrote to memory of 2996 2864 btbttn.exe 29 PID 2864 wrote to memory of 2996 2864 btbttn.exe 29 PID 2864 wrote to memory of 2996 2864 btbttn.exe 29 PID 2996 wrote to memory of 2280 2996 vjjdj.exe 30 PID 2996 wrote to memory of 2280 2996 vjjdj.exe 30 PID 2996 wrote to memory of 2280 2996 vjjdj.exe 30 PID 2996 wrote to memory of 2280 2996 vjjdj.exe 30 PID 2280 wrote to memory of 2676 2280 tthbtn.exe 31 PID 2280 wrote to memory of 2676 2280 tthbtn.exe 31 PID 2280 wrote to memory of 2676 2280 tthbtn.exe 31 PID 2280 wrote to memory of 2676 2280 tthbtn.exe 31 PID 2676 wrote to memory of 2560 2676 1nhbbb.exe 32 PID 2676 wrote to memory of 2560 2676 1nhbbb.exe 32 PID 2676 wrote to memory of 2560 2676 1nhbbb.exe 32 PID 2676 wrote to memory of 2560 2676 1nhbbb.exe 32 PID 2560 wrote to memory of 2624 2560 ppvvv.exe 33 PID 2560 wrote to memory of 2624 2560 ppvvv.exe 33 PID 2560 wrote to memory of 2624 2560 ppvvv.exe 33 PID 2560 wrote to memory of 2624 2560 ppvvv.exe 33 PID 2624 wrote to memory of 2044 2624 xlrrxxl.exe 34 PID 2624 wrote to memory of 2044 2624 xlrrxxl.exe 34 PID 2624 wrote to memory of 2044 2624 xlrrxxl.exe 34 PID 2624 wrote to memory of 2044 2624 xlrrxxl.exe 34 PID 2044 wrote to memory of 2432 2044 thtbbh.exe 35 PID 2044 wrote to memory of 2432 2044 thtbbh.exe 35 PID 2044 wrote to memory of 2432 2044 thtbbh.exe 35 PID 2044 wrote to memory of 2432 2044 thtbbh.exe 35 PID 2432 wrote to memory of 2700 2432 nhtbnn.exe 36 PID 2432 wrote to memory of 2700 2432 nhtbnn.exe 36 PID 2432 wrote to memory of 2700 2432 nhtbnn.exe 36 PID 2432 wrote to memory of 2700 2432 nhtbnn.exe 36 PID 2700 wrote to memory of 2604 2700 ppjjp.exe 37 PID 2700 wrote to memory of 2604 2700 ppjjp.exe 37 PID 2700 wrote to memory of 2604 2700 ppjjp.exe 37 PID 2700 wrote to memory of 2604 2700 ppjjp.exe 37 PID 2604 wrote to memory of 3040 2604 1lxrxxf.exe 38 PID 2604 wrote to memory of 3040 2604 1lxrxxf.exe 38 PID 2604 wrote to memory of 3040 2604 1lxrxxf.exe 38 PID 2604 wrote to memory of 3040 2604 1lxrxxf.exe 38 PID 3040 wrote to memory of 852 3040 5xlrflx.exe 39 PID 3040 wrote to memory of 852 3040 5xlrflx.exe 39 PID 3040 wrote to memory of 852 3040 5xlrflx.exe 39 PID 3040 wrote to memory of 852 3040 5xlrflx.exe 39 PID 852 wrote to memory of 2612 852 tthntb.exe 40 PID 852 wrote to memory of 2612 852 tthntb.exe 40 PID 852 wrote to memory of 2612 852 tthntb.exe 40 PID 852 wrote to memory of 2612 852 tthntb.exe 40 PID 2612 wrote to memory of 1948 2612 pdppv.exe 41 PID 2612 wrote to memory of 1948 2612 pdppv.exe 41 PID 2612 wrote to memory of 1948 2612 pdppv.exe 41 PID 2612 wrote to memory of 1948 2612 pdppv.exe 41 PID 1948 wrote to memory of 2424 1948 7pdpv.exe 42 PID 1948 wrote to memory of 2424 1948 7pdpv.exe 42 PID 1948 wrote to memory of 2424 1948 7pdpv.exe 42 PID 1948 wrote to memory of 2424 1948 7pdpv.exe 42 PID 2424 wrote to memory of 1404 2424 fxrrlrf.exe 43 PID 2424 wrote to memory of 1404 2424 fxrrlrf.exe 43 PID 2424 wrote to memory of 1404 2424 fxrrlrf.exe 43 PID 2424 wrote to memory of 1404 2424 fxrrlrf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c5d9802b7519827e6b8e2e4615ea30d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9c5d9802b7519827e6b8e2e4615ea30d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\btbttn.exec:\btbttn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\vjjdj.exec:\vjjdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\tthbtn.exec:\tthbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\1nhbbb.exec:\1nhbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\ppvvv.exec:\ppvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\xlrrxxl.exec:\xlrrxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\thtbbh.exec:\thtbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\nhtbnn.exec:\nhtbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\ppjjp.exec:\ppjjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\1lxrxxf.exec:\1lxrxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\5xlrflx.exec:\5xlrflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\tthntb.exec:\tthntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\pdppv.exec:\pdppv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\7pdpv.exec:\7pdpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\fxrrlrf.exec:\fxrrlrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\rlxfflx.exec:\rlxfflx.exe17⤵
- Executes dropped EXE
PID:1404 -
\??\c:\btbhnt.exec:\btbhnt.exe18⤵
- Executes dropped EXE
PID:1088 -
\??\c:\ppvvj.exec:\ppvvj.exe19⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vpdpj.exec:\vpdpj.exe20⤵
- Executes dropped EXE
PID:1740 -
\??\c:\fxllflf.exec:\fxllflf.exe21⤵
- Executes dropped EXE
PID:948 -
\??\c:\btnhbb.exec:\btnhbb.exe22⤵
- Executes dropped EXE
PID:540 -
\??\c:\tnbhhb.exec:\tnbhhb.exe23⤵
- Executes dropped EXE
PID:1048 -
\??\c:\3pjvp.exec:\3pjvp.exe24⤵
- Executes dropped EXE
PID:1496 -
\??\c:\3flxfrx.exec:\3flxfrx.exe25⤵
- Executes dropped EXE
PID:1996 -
\??\c:\rlrlflf.exec:\rlrlflf.exe26⤵
- Executes dropped EXE
PID:452 -
\??\c:\9hbnbb.exec:\9hbnbb.exe27⤵
- Executes dropped EXE
PID:2852 -
\??\c:\ppdvd.exec:\ppdvd.exe28⤵
- Executes dropped EXE
PID:1992 -
\??\c:\5llxflx.exec:\5llxflx.exe29⤵
- Executes dropped EXE
PID:2328 -
\??\c:\3frxxxr.exec:\3frxxxr.exe30⤵
- Executes dropped EXE
PID:312 -
\??\c:\bnbhtt.exec:\bnbhtt.exe31⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jdpdj.exec:\jdpdj.exe32⤵
- Executes dropped EXE
PID:1064 -
\??\c:\5ppdp.exec:\5ppdp.exe33⤵
- Executes dropped EXE
PID:1920 -
\??\c:\5rfxxfl.exec:\5rfxxfl.exe34⤵
- Executes dropped EXE
PID:1608 -
\??\c:\fxrfrrf.exec:\fxrfrrf.exe35⤵
- Executes dropped EXE
PID:2840 -
\??\c:\hhnbnt.exec:\hhnbnt.exe36⤵
- Executes dropped EXE
PID:2864 -
\??\c:\jppdv.exec:\jppdv.exe37⤵
- Executes dropped EXE
PID:1208 -
\??\c:\3vjvp.exec:\3vjvp.exe38⤵
- Executes dropped EXE
PID:2580 -
\??\c:\rlxrfff.exec:\rlxrfff.exe39⤵
- Executes dropped EXE
PID:2644 -
\??\c:\rffllll.exec:\rffllll.exe40⤵
- Executes dropped EXE
PID:2668 -
\??\c:\hbtthn.exec:\hbtthn.exe41⤵
- Executes dropped EXE
PID:2444 -
\??\c:\5tbnnt.exec:\5tbnnt.exe42⤵
- Executes dropped EXE
PID:2464 -
\??\c:\dvjjj.exec:\dvjjj.exe43⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vvpvj.exec:\vvpvj.exe44⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xrrlxfr.exec:\xrrlxfr.exe45⤵
- Executes dropped EXE
PID:1136 -
\??\c:\nhnntt.exec:\nhnntt.exe46⤵
- Executes dropped EXE
PID:2132 -
\??\c:\nnhtbh.exec:\nnhtbh.exe47⤵
- Executes dropped EXE
PID:2960 -
\??\c:\3djjv.exec:\3djjv.exe48⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vpjpj.exec:\vpjpj.exe49⤵
- Executes dropped EXE
PID:1664 -
\??\c:\rlrrrxf.exec:\rlrrrxf.exe50⤵
- Executes dropped EXE
PID:1476 -
\??\c:\rlxlxfx.exec:\rlxlxfx.exe51⤵
- Executes dropped EXE
PID:2732 -
\??\c:\fxlllrx.exec:\fxlllrx.exe52⤵
- Executes dropped EXE
PID:2716 -
\??\c:\hhbhtb.exec:\hhbhtb.exe53⤵
- Executes dropped EXE
PID:2956 -
\??\c:\thhtbb.exec:\thhtbb.exe54⤵
- Executes dropped EXE
PID:1880 -
\??\c:\5jvdj.exec:\5jvdj.exe55⤵
- Executes dropped EXE
PID:1096 -
\??\c:\vpddp.exec:\vpddp.exe56⤵
- Executes dropped EXE
PID:1584 -
\??\c:\7rffxxx.exec:\7rffxxx.exe57⤵
- Executes dropped EXE
PID:1952 -
\??\c:\bnbthn.exec:\bnbthn.exe58⤵
- Executes dropped EXE
PID:1868 -
\??\c:\7hbnbb.exec:\7hbnbb.exe59⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jjpdp.exec:\jjpdp.exe60⤵
- Executes dropped EXE
PID:588 -
\??\c:\3dpjj.exec:\3dpjj.exe61⤵
- Executes dropped EXE
PID:1100 -
\??\c:\7rfflrf.exec:\7rfflrf.exe62⤵
- Executes dropped EXE
PID:1648 -
\??\c:\xlflrxf.exec:\xlflrxf.exe63⤵
- Executes dropped EXE
PID:1536 -
\??\c:\btbntb.exec:\btbntb.exe64⤵
- Executes dropped EXE
PID:1152 -
\??\c:\bbnhhh.exec:\bbnhhh.exe65⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vpjvj.exec:\vpjvj.exe66⤵PID:2024
-
\??\c:\vvjjp.exec:\vvjjp.exe67⤵PID:2016
-
\??\c:\frfxrrx.exec:\frfxrrx.exe68⤵PID:984
-
\??\c:\xxxllrr.exec:\xxxllrr.exe69⤵PID:2896
-
\??\c:\3htthn.exec:\3htthn.exe70⤵PID:1916
-
\??\c:\hnnhtb.exec:\hnnhtb.exe71⤵PID:2924
-
\??\c:\tttbtb.exec:\tttbtb.exe72⤵PID:1760
-
\??\c:\jjjvp.exec:\jjjvp.exe73⤵PID:2920
-
\??\c:\rfxxffr.exec:\rfxxffr.exe74⤵PID:1940
-
\??\c:\lfrflrx.exec:\lfrflrx.exe75⤵PID:1920
-
\??\c:\3nbbhh.exec:\3nbbhh.exe76⤵PID:1388
-
\??\c:\tnhhbt.exec:\tnhhbt.exe77⤵PID:2376
-
\??\c:\dvpvd.exec:\dvpvd.exe78⤵PID:3036
-
\??\c:\jdvvp.exec:\jdvvp.exe79⤵PID:2156
-
\??\c:\pppdp.exec:\pppdp.exe80⤵PID:2584
-
\??\c:\ffxfflx.exec:\ffxfflx.exe81⤵PID:2588
-
\??\c:\ffxrrff.exec:\ffxrrff.exe82⤵PID:2628
-
\??\c:\btnbnt.exec:\btnbnt.exe83⤵PID:2444
-
\??\c:\9nbhnn.exec:\9nbhnn.exe84⤵PID:2728
-
\??\c:\jjdvd.exec:\jjdvd.exe85⤵PID:2492
-
\??\c:\3vvdv.exec:\3vvdv.exe86⤵PID:2652
-
\??\c:\lfxrrxl.exec:\lfxrrxl.exe87⤵PID:2556
-
\??\c:\1rrxflx.exec:\1rrxflx.exe88⤵PID:2496
-
\??\c:\7bnntb.exec:\7bnntb.exe89⤵PID:1820
-
\??\c:\nnbbhn.exec:\nnbbhn.exe90⤵PID:2412
-
\??\c:\5hhntt.exec:\5hhntt.exe91⤵PID:1936
-
\??\c:\djdpv.exec:\djdpv.exe92⤵PID:2620
-
\??\c:\jvjjp.exec:\jvjjp.exe93⤵PID:2612
-
\??\c:\lfrrxlx.exec:\lfrrxlx.exe94⤵PID:2716
-
\??\c:\rrlxlrl.exec:\rrlxlrl.exe95⤵PID:2836
-
\??\c:\ttbhbh.exec:\ttbhbh.exe96⤵PID:1404
-
\??\c:\bthnbh.exec:\bthnbh.exe97⤵PID:672
-
\??\c:\dvpvd.exec:\dvpvd.exe98⤵PID:2052
-
\??\c:\5vjdp.exec:\5vjdp.exe99⤵PID:2112
-
\??\c:\pjvdd.exec:\pjvdd.exe100⤵PID:1564
-
\??\c:\rlxfrrl.exec:\rlxfrrl.exe101⤵PID:1724
-
\??\c:\fxfrlrl.exec:\fxfrlrl.exe102⤵PID:684
-
\??\c:\nhnnbh.exec:\nhnnbh.exe103⤵PID:788
-
\??\c:\nnhhbn.exec:\nnhhbn.exe104⤵PID:1972
-
\??\c:\vvjjj.exec:\vvjjj.exe105⤵PID:1984
-
\??\c:\3dvjv.exec:\3dvjv.exe106⤵PID:1152
-
\??\c:\ffffxfr.exec:\ffffxfr.exe107⤵PID:1636
-
\??\c:\fxrfflf.exec:\fxrfflf.exe108⤵PID:2000
-
\??\c:\btntnt.exec:\btntnt.exe109⤵PID:2036
-
\??\c:\thtbbb.exec:\thtbbb.exe110⤵PID:1912
-
\??\c:\9ddjj.exec:\9ddjj.exe111⤵PID:1052
-
\??\c:\9jdjj.exec:\9jdjj.exe112⤵PID:2328
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe113⤵PID:892
-
\??\c:\lxrflfr.exec:\lxrflfr.exe114⤵PID:1760
-
\??\c:\hbtthb.exec:\hbtthb.exe115⤵PID:1900
-
\??\c:\thtbtn.exec:\thtbtn.exe116⤵PID:2708
-
\??\c:\pdpjj.exec:\pdpjj.exe117⤵PID:1712
-
\??\c:\flrrxlr.exec:\flrrxlr.exe118⤵PID:1388
-
\??\c:\3lfrxff.exec:\3lfrxff.exe119⤵PID:3008
-
\??\c:\7nbbhb.exec:\7nbbhb.exe120⤵PID:2992
-
\??\c:\tbttnn.exec:\tbttnn.exe121⤵PID:2156
-
\??\c:\dvdjd.exec:\dvdjd.exe122⤵PID:2676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-