Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 16:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d07110c0b2e0348f7337c112e3f932f_JaffaCakes118.exe
Resource
win7-20240708-en
5 signatures
150 seconds
General
-
Target
2d07110c0b2e0348f7337c112e3f932f_JaffaCakes118.exe
-
Size
53KB
-
MD5
2d07110c0b2e0348f7337c112e3f932f
-
SHA1
c874e8021b789dc3a91efca317fc7cf738af9bf1
-
SHA256
ae769ed0e816e1286f549227fffcb782c94df5dc9f98ec24292b41d91e6ae3ff
-
SHA512
d4cf29f9839fcf75ac11ed7dbc9d966383a31839c02540056f1b369dd02993b81dbc8471fd0400be6d5a711f6399621536236b76f677d6b8b92f7eb72ccc0871
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDod5Rb:ymb3NkkiQ3mdBjFod5V
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/2508-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/588-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-34-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4444-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/784-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1992-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3832-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1152 frfxxfx.exe 588 dvpdd.exe 3248 xlxxxrf.exe 1040 tthhnh.exe 4444 rffrfll.exe 784 vddvv.exe 2220 bthbbb.exe 2432 lxrlfxl.exe 2632 nnttht.exe 2288 ffxrrrl.exe 1924 pdpjd.exe 3196 btbttt.exe 5008 dpvjj.exe 1444 7xrlrlr.exe 1520 btthnb.exe 1244 jjpvj.exe 512 lrrlfrl.exe 1992 thhhnn.exe 5016 jppjp.exe 3660 xlffxxr.exe 4916 hhthtn.exe 2228 fllfffl.exe 3012 htttnn.exe 3632 xllfffl.exe 2356 hnhhtb.exe 1008 fxxfrff.exe 3832 1tbnhh.exe 1752 vdjvv.exe 1468 bnnhbb.exe 3044 vvvpp.exe 3148 lflflxx.exe 2736 btbtbt.exe 944 jjjvj.exe 4484 3lxxxfx.exe 5036 3xxllfr.exe 1420 hntnbh.exe 2132 vvjdv.exe 4004 rrxfrlx.exe 916 rrfxrrl.exe 2964 3tthhn.exe 4404 lfrlrxx.exe 4652 7bhnbb.exe 1512 djdvv.exe 652 lrfxffr.exe 828 hnbthn.exe 3456 jvjpd.exe 1040 lxllfrf.exe 1412 hbnbbb.exe 4444 bbbttn.exe 784 pjjvp.exe 864 ffrflrx.exe 724 3tnnbt.exe 264 jpdjv.exe 920 xlxlxfr.exe 3472 nbtbtt.exe 2212 dvdvj.exe 312 fxxrlll.exe 1728 rfrlxlx.exe 208 5lxxfxf.exe 2536 vdvdv.exe 2416 rxxlxlr.exe 4012 nbbtnn.exe 3188 dpjvd.exe 3008 flrrrxf.exe -
resource yara_rule behavioral2/memory/2508-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/588-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/784-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1992-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1008-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3832-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2508 wrote to memory of 1152 2508 2d07110c0b2e0348f7337c112e3f932f_JaffaCakes118.exe 83 PID 2508 wrote to memory of 1152 2508 2d07110c0b2e0348f7337c112e3f932f_JaffaCakes118.exe 83 PID 2508 wrote to memory of 1152 2508 2d07110c0b2e0348f7337c112e3f932f_JaffaCakes118.exe 83 PID 1152 wrote to memory of 588 1152 frfxxfx.exe 85 PID 1152 wrote to memory of 588 1152 frfxxfx.exe 85 PID 1152 wrote to memory of 588 1152 frfxxfx.exe 85 PID 588 wrote to memory of 3248 588 dvpdd.exe 86 PID 588 wrote to memory of 3248 588 dvpdd.exe 86 PID 588 wrote to memory of 3248 588 dvpdd.exe 86 PID 3248 wrote to memory of 1040 3248 xlxxxrf.exe 87 PID 3248 wrote to memory of 1040 3248 xlxxxrf.exe 87 PID 3248 wrote to memory of 1040 3248 xlxxxrf.exe 87 PID 1040 wrote to memory of 4444 1040 tthhnh.exe 88 PID 1040 wrote to memory of 4444 1040 tthhnh.exe 88 PID 1040 wrote to memory of 4444 1040 tthhnh.exe 88 PID 4444 wrote to memory of 784 4444 rffrfll.exe 89 PID 4444 wrote to memory of 784 4444 rffrfll.exe 89 PID 4444 wrote to memory of 784 4444 rffrfll.exe 89 PID 784 wrote to memory of 2220 784 vddvv.exe 90 PID 784 wrote to memory of 2220 784 vddvv.exe 90 PID 784 wrote to memory of 2220 784 vddvv.exe 90 PID 2220 wrote to memory of 2432 2220 bthbbb.exe 91 PID 2220 wrote to memory of 2432 2220 bthbbb.exe 91 PID 2220 wrote to memory of 2432 2220 bthbbb.exe 91 PID 2432 wrote to memory of 2632 2432 lxrlfxl.exe 93 PID 2432 wrote to memory of 2632 2432 lxrlfxl.exe 93 PID 2432 wrote to memory of 2632 2432 lxrlfxl.exe 93 PID 2632 wrote to memory of 2288 2632 nnttht.exe 94 PID 2632 wrote to memory of 2288 2632 nnttht.exe 94 PID 2632 wrote to memory of 2288 2632 nnttht.exe 94 PID 2288 wrote to memory of 1924 2288 ffxrrrl.exe 95 PID 2288 wrote to memory of 1924 2288 ffxrrrl.exe 95 PID 2288 wrote to memory of 1924 2288 ffxrrrl.exe 95 PID 1924 wrote to memory of 3196 1924 pdpjd.exe 96 PID 1924 wrote to memory of 3196 1924 pdpjd.exe 96 PID 1924 wrote to memory of 3196 1924 pdpjd.exe 96 PID 3196 wrote to memory of 5008 3196 btbttt.exe 97 PID 3196 wrote to memory of 5008 3196 btbttt.exe 97 PID 3196 wrote to memory of 5008 3196 btbttt.exe 97 PID 5008 wrote to memory of 1444 5008 dpvjj.exe 98 PID 5008 wrote to memory of 1444 5008 dpvjj.exe 98 PID 5008 wrote to memory of 1444 5008 dpvjj.exe 98 PID 1444 wrote to memory of 1520 1444 7xrlrlr.exe 99 PID 1444 wrote to memory of 1520 1444 7xrlrlr.exe 99 PID 1444 wrote to memory of 1520 1444 7xrlrlr.exe 99 PID 1520 wrote to memory of 1244 1520 btthnb.exe 100 PID 1520 wrote to memory of 1244 1520 btthnb.exe 100 PID 1520 wrote to memory of 1244 1520 btthnb.exe 100 PID 1244 wrote to memory of 512 1244 jjpvj.exe 101 PID 1244 wrote to memory of 512 1244 jjpvj.exe 101 PID 1244 wrote to memory of 512 1244 jjpvj.exe 101 PID 512 wrote to memory of 1992 512 lrrlfrl.exe 102 PID 512 wrote to memory of 1992 512 lrrlfrl.exe 102 PID 512 wrote to memory of 1992 512 lrrlfrl.exe 102 PID 1992 wrote to memory of 5016 1992 thhhnn.exe 103 PID 1992 wrote to memory of 5016 1992 thhhnn.exe 103 PID 1992 wrote to memory of 5016 1992 thhhnn.exe 103 PID 5016 wrote to memory of 3660 5016 jppjp.exe 104 PID 5016 wrote to memory of 3660 5016 jppjp.exe 104 PID 5016 wrote to memory of 3660 5016 jppjp.exe 104 PID 3660 wrote to memory of 4916 3660 xlffxxr.exe 105 PID 3660 wrote to memory of 4916 3660 xlffxxr.exe 105 PID 3660 wrote to memory of 4916 3660 xlffxxr.exe 105 PID 4916 wrote to memory of 2228 4916 hhthtn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d07110c0b2e0348f7337c112e3f932f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2d07110c0b2e0348f7337c112e3f932f_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\frfxxfx.exec:\frfxxfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\dvpdd.exec:\dvpdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\xlxxxrf.exec:\xlxxxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\tthhnh.exec:\tthhnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\rffrfll.exec:\rffrfll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\vddvv.exec:\vddvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\bthbbb.exec:\bthbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\lxrlfxl.exec:\lxrlfxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\nnttht.exec:\nnttht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\ffxrrrl.exec:\ffxrrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\pdpjd.exec:\pdpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\btbttt.exec:\btbttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\dpvjj.exec:\dpvjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\7xrlrlr.exec:\7xrlrlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\btthnb.exec:\btthnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\jjpvj.exec:\jjpvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\lrrlfrl.exec:\lrrlfrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\thhhnn.exec:\thhhnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\jppjp.exec:\jppjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\xlffxxr.exec:\xlffxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\hhthtn.exec:\hhthtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\fllfffl.exec:\fllfffl.exe23⤵
- Executes dropped EXE
PID:2228 -
\??\c:\htttnn.exec:\htttnn.exe24⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xllfffl.exec:\xllfffl.exe25⤵
- Executes dropped EXE
PID:3632 -
\??\c:\hnhhtb.exec:\hnhhtb.exe26⤵
- Executes dropped EXE
PID:2356 -
\??\c:\fxxfrff.exec:\fxxfrff.exe27⤵
- Executes dropped EXE
PID:1008 -
\??\c:\1tbnhh.exec:\1tbnhh.exe28⤵
- Executes dropped EXE
PID:3832 -
\??\c:\vdjvv.exec:\vdjvv.exe29⤵
- Executes dropped EXE
PID:1752 -
\??\c:\bnnhbb.exec:\bnnhbb.exe30⤵
- Executes dropped EXE
PID:1468 -
\??\c:\vvvpp.exec:\vvvpp.exe31⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lflflxx.exec:\lflflxx.exe32⤵
- Executes dropped EXE
PID:3148 -
\??\c:\btbtbt.exec:\btbtbt.exe33⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jjjvj.exec:\jjjvj.exe34⤵
- Executes dropped EXE
PID:944 -
\??\c:\3lxxxfx.exec:\3lxxxfx.exe35⤵
- Executes dropped EXE
PID:4484 -
\??\c:\3xxllfr.exec:\3xxllfr.exe36⤵
- Executes dropped EXE
PID:5036 -
\??\c:\hntnbh.exec:\hntnbh.exe37⤵
- Executes dropped EXE
PID:1420 -
\??\c:\vvjdv.exec:\vvjdv.exe38⤵
- Executes dropped EXE
PID:2132 -
\??\c:\rrxfrlx.exec:\rrxfrlx.exe39⤵
- Executes dropped EXE
PID:4004 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe40⤵
- Executes dropped EXE
PID:916 -
\??\c:\3tthhn.exec:\3tthhn.exe41⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lfrlrxx.exec:\lfrlrxx.exe42⤵
- Executes dropped EXE
PID:4404 -
\??\c:\7bhnbb.exec:\7bhnbb.exe43⤵
- Executes dropped EXE
PID:4652 -
\??\c:\djdvv.exec:\djdvv.exe44⤵
- Executes dropped EXE
PID:1512 -
\??\c:\lrfxffr.exec:\lrfxffr.exe45⤵
- Executes dropped EXE
PID:652 -
\??\c:\hnbthn.exec:\hnbthn.exe46⤵
- Executes dropped EXE
PID:828 -
\??\c:\jvjpd.exec:\jvjpd.exe47⤵
- Executes dropped EXE
PID:3456 -
\??\c:\lxllfrf.exec:\lxllfrf.exe48⤵
- Executes dropped EXE
PID:1040 -
\??\c:\hbnbbb.exec:\hbnbbb.exe49⤵
- Executes dropped EXE
PID:1412 -
\??\c:\bbbttn.exec:\bbbttn.exe50⤵
- Executes dropped EXE
PID:4444 -
\??\c:\pjjvp.exec:\pjjvp.exe51⤵
- Executes dropped EXE
PID:784 -
\??\c:\ffrflrx.exec:\ffrflrx.exe52⤵
- Executes dropped EXE
PID:864 -
\??\c:\3tnnbt.exec:\3tnnbt.exe53⤵
- Executes dropped EXE
PID:724 -
\??\c:\jpdjv.exec:\jpdjv.exe54⤵
- Executes dropped EXE
PID:264 -
\??\c:\xlxlxfr.exec:\xlxlxfr.exe55⤵
- Executes dropped EXE
PID:920 -
\??\c:\nbtbtt.exec:\nbtbtt.exe56⤵
- Executes dropped EXE
PID:3472 -
\??\c:\dvdvj.exec:\dvdvj.exe57⤵
- Executes dropped EXE
PID:2212 -
\??\c:\fxxrlll.exec:\fxxrlll.exe58⤵
- Executes dropped EXE
PID:312 -
\??\c:\rfrlxlx.exec:\rfrlxlx.exe59⤵
- Executes dropped EXE
PID:1728 -
\??\c:\5lxxfxf.exec:\5lxxfxf.exe60⤵
- Executes dropped EXE
PID:208 -
\??\c:\vdvdv.exec:\vdvdv.exe61⤵
- Executes dropped EXE
PID:2536 -
\??\c:\rxxlxlr.exec:\rxxlxlr.exe62⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nbbtnn.exec:\nbbtnn.exe63⤵
- Executes dropped EXE
PID:4012 -
\??\c:\dpjvd.exec:\dpjvd.exe64⤵
- Executes dropped EXE
PID:3188 -
\??\c:\flrrrxf.exec:\flrrrxf.exe65⤵
- Executes dropped EXE
PID:3008 -
\??\c:\bbhnnn.exec:\bbhnnn.exe66⤵PID:116
-
\??\c:\nbnnbn.exec:\nbnnbn.exe67⤵PID:2008
-
\??\c:\pdvpv.exec:\pdvpv.exe68⤵PID:3252
-
\??\c:\xrrffll.exec:\xrrffll.exe69⤵PID:3620
-
\??\c:\thhnth.exec:\thhnth.exe70⤵PID:3096
-
\??\c:\vjdpd.exec:\vjdpd.exe71⤵PID:4576
-
\??\c:\lrlxlfr.exec:\lrlxlfr.exe72⤵PID:4644
-
\??\c:\bbbhht.exec:\bbbhht.exe73⤵PID:4148
-
\??\c:\hhtnbh.exec:\hhtnbh.exe74⤵PID:3020
-
\??\c:\dvjjj.exec:\dvjjj.exe75⤵PID:3540
-
\??\c:\rffrlxr.exec:\rffrlxr.exe76⤵PID:1868
-
\??\c:\lllrrlf.exec:\lllrrlf.exe77⤵PID:1108
-
\??\c:\tbbbnt.exec:\tbbbnt.exe78⤵PID:392
-
\??\c:\jdvvj.exec:\jdvvj.exe79⤵PID:1160
-
\??\c:\rlxrrxf.exec:\rlxrrxf.exe80⤵PID:2072
-
\??\c:\llllffx.exec:\llllffx.exe81⤵PID:4088
-
\??\c:\bbbbhh.exec:\bbbbhh.exe82⤵PID:1752
-
\??\c:\bnttnn.exec:\bnttnn.exe83⤵PID:464
-
\??\c:\jvvvp.exec:\jvvvp.exe84⤵PID:2872
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe85⤵PID:3784
-
\??\c:\lrlfrxl.exec:\lrlfrxl.exe86⤵PID:4936
-
\??\c:\nhhbtn.exec:\nhhbtn.exe87⤵PID:3484
-
\??\c:\ddjdv.exec:\ddjdv.exe88⤵PID:4612
-
\??\c:\rfflffx.exec:\rfflffx.exe89⤵PID:3392
-
\??\c:\tnnnhh.exec:\tnnnhh.exe90⤵PID:2024
-
\??\c:\ddppj.exec:\ddppj.exe91⤵PID:4212
-
\??\c:\xxllrxf.exec:\xxllrxf.exe92⤵PID:1260
-
\??\c:\hnnhnh.exec:\hnnhnh.exe93⤵PID:2412
-
\??\c:\jvvpp.exec:\jvvpp.exe94⤵PID:4464
-
\??\c:\xlrrflf.exec:\xlrrflf.exe95⤵PID:8
-
\??\c:\hhbthb.exec:\hhbthb.exe96⤵PID:2164
-
\??\c:\bthtnn.exec:\bthtnn.exe97⤵PID:1852
-
\??\c:\pvpvd.exec:\pvpvd.exe98⤵PID:5096
-
\??\c:\rxllxfr.exec:\rxllxfr.exe99⤵PID:588
-
\??\c:\nbhttb.exec:\nbhttb.exe100⤵PID:4664
-
\??\c:\djppv.exec:\djppv.exe101⤵PID:4264
-
\??\c:\fxfllrx.exec:\fxfllrx.exe102⤵PID:3760
-
\??\c:\rxfrrrx.exec:\rxfrrrx.exe103⤵PID:4312
-
\??\c:\bhtnhn.exec:\bhtnhn.exe104⤵PID:4428
-
\??\c:\llrxfll.exec:\llrxfll.exe105⤵PID:2496
-
\??\c:\lfrxrxr.exec:\lfrxrxr.exe106⤵PID:3896
-
\??\c:\nttnnh.exec:\nttnnh.exe107⤵PID:2904
-
\??\c:\vvjjd.exec:\vvjjd.exe108⤵PID:264
-
\??\c:\rrlxxxr.exec:\rrlxxxr.exe109⤵PID:3472
-
\??\c:\rxxlrlr.exec:\rxxlrlr.exe110⤵PID:1112
-
\??\c:\nhnntn.exec:\nhnntn.exe111⤵PID:3500
-
\??\c:\vpvjj.exec:\vpvjj.exe112⤵PID:1924
-
\??\c:\xlxlffr.exec:\xlxlffr.exe113⤵PID:3212
-
\??\c:\lffrrlx.exec:\lffrrlx.exe114⤵PID:2196
-
\??\c:\tbhbnt.exec:\tbhbnt.exe115⤵PID:956
-
\??\c:\jdpvp.exec:\jdpvp.exe116⤵PID:4640
-
\??\c:\rrxffxr.exec:\rrxffxr.exe117⤵PID:400
-
\??\c:\3rxxxff.exec:\3rxxxff.exe118⤵PID:1028
-
\??\c:\bbbtbh.exec:\bbbtbh.exe119⤵PID:4840
-
\??\c:\vjddj.exec:\vjddj.exe120⤵PID:1992
-
\??\c:\lfrxffx.exec:\lfrxffx.exe121⤵PID:5080
-
\??\c:\5ntbbb.exec:\5ntbbb.exe122⤵PID:4196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-