Malware Analysis Report

2025-08-05 08:54

Sample ID 250108-je1sgasmej
Target JaffaCakes118_9350d86d2640e7caf05a04051c3f3cec
SHA256 00e4ccae2ee8d3210ad1d2e99c416c2014ed8cadab6fe8ba34cc3eafacd90cc9
Tags
upx blackmoon banker discovery trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

00e4ccae2ee8d3210ad1d2e99c416c2014ed8cadab6fe8ba34cc3eafacd90cc9

Threat Level: Known bad

The file JaffaCakes118_9350d86d2640e7caf05a04051c3f3cec was found to be: Known bad.

Malicious Activity Summary

upx blackmoon banker discovery trojan

Blackmoon family

Blackmoon, KrBanker

Detect Blackmoon payload

Executes dropped EXE

UPX packed file

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-08 07:35

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-08 07:35

Reported

2025-01-08 07:38

Platform

win7-20240903-en

Max time kernel

150s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9350d86d2640e7caf05a04051c3f3cec.exe"

Signatures

Blackmoon family

blackmoon

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\lfrrffl.exe N/A
N/A N/A \??\c:\5dvjp.exe N/A
N/A N/A \??\c:\vvvjp.exe N/A
N/A N/A \??\c:\7rrfxxf.exe N/A
N/A N/A \??\c:\bbnthn.exe N/A
N/A N/A \??\c:\vpvdj.exe N/A
N/A N/A \??\c:\jdvvv.exe N/A
N/A N/A \??\c:\fxrxlxx.exe N/A
N/A N/A \??\c:\lxrxxfl.exe N/A
N/A N/A \??\c:\hthhnn.exe N/A
N/A N/A \??\c:\dpdvj.exe N/A
N/A N/A \??\c:\lxflrrx.exe N/A
N/A N/A \??\c:\1fxrflr.exe N/A
N/A N/A \??\c:\ttthnt.exe N/A
N/A N/A \??\c:\httttt.exe N/A
N/A N/A \??\c:\ddddd.exe N/A
N/A N/A \??\c:\7rxxffl.exe N/A
N/A N/A \??\c:\frfrxxx.exe N/A
N/A N/A \??\c:\tnhhnn.exe N/A
N/A N/A \??\c:\tttbnt.exe N/A
N/A N/A \??\c:\5dvvj.exe N/A
N/A N/A \??\c:\dvjvp.exe N/A
N/A N/A \??\c:\xxrrlrx.exe N/A
N/A N/A \??\c:\lfxlxxr.exe N/A
N/A N/A \??\c:\htnntb.exe N/A
N/A N/A \??\c:\tnbnht.exe N/A
N/A N/A \??\c:\vpjjv.exe N/A
N/A N/A \??\c:\rrflrrx.exe N/A
N/A N/A \??\c:\xrlrxxx.exe N/A
N/A N/A \??\c:\thnnbb.exe N/A
N/A N/A \??\c:\pvddd.exe N/A
N/A N/A \??\c:\vpdjp.exe N/A
N/A N/A \??\c:\frfxflr.exe N/A
N/A N/A \??\c:\3btbnn.exe N/A
N/A N/A \??\c:\htnhnn.exe N/A
N/A N/A \??\c:\thtbtn.exe N/A
N/A N/A \??\c:\vpvdd.exe N/A
N/A N/A \??\c:\xrllrrx.exe N/A
N/A N/A \??\c:\lfrrfxf.exe N/A
N/A N/A \??\c:\hthnbb.exe N/A
N/A N/A \??\c:\bnttbb.exe N/A
N/A N/A \??\c:\vvpvp.exe N/A
N/A N/A \??\c:\5pvdp.exe N/A
N/A N/A \??\c:\tnttnt.exe N/A
N/A N/A \??\c:\3thbhn.exe N/A
N/A N/A \??\c:\vdjdd.exe N/A
N/A N/A \??\c:\jjdjp.exe N/A
N/A N/A \??\c:\ffrffxf.exe N/A
N/A N/A \??\c:\1frrxfl.exe N/A
N/A N/A \??\c:\lxrrfxf.exe N/A
N/A N/A \??\c:\hbntbt.exe N/A
N/A N/A \??\c:\jdjdd.exe N/A
N/A N/A \??\c:\pjvvd.exe N/A
N/A N/A \??\c:\rrlfrrx.exe N/A
N/A N/A \??\c:\lflrrrx.exe N/A
N/A N/A \??\c:\htbhhh.exe N/A
N/A N/A \??\c:\bhbnnt.exe N/A
N/A N/A \??\c:\ppdjj.exe N/A
N/A N/A \??\c:\vpjdj.exe N/A
N/A N/A \??\c:\rlrlxxf.exe N/A
N/A N/A \??\c:\lflrflr.exe N/A
N/A N/A \??\c:\hhhhbh.exe N/A
N/A N/A \??\c:\7htbtt.exe N/A
N/A N/A \??\c:\pvvvp.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\vvdjp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\7nbbhh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\xrrffrf.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\3fxflrr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\hbhtbb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\fxlrffl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\3btbnn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\7bthbb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\3ntbhn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2504 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9350d86d2640e7caf05a04051c3f3cec.exe \??\c:\lfrrffl.exe
PID 2504 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9350d86d2640e7caf05a04051c3f3cec.exe \??\c:\lfrrffl.exe
PID 2504 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9350d86d2640e7caf05a04051c3f3cec.exe \??\c:\lfrrffl.exe
PID 2504 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9350d86d2640e7caf05a04051c3f3cec.exe \??\c:\lfrrffl.exe
PID 2544 wrote to memory of 2068 N/A \??\c:\lfrrffl.exe \??\c:\5dvjp.exe
PID 2544 wrote to memory of 2068 N/A \??\c:\lfrrffl.exe \??\c:\5dvjp.exe
PID 2544 wrote to memory of 2068 N/A \??\c:\lfrrffl.exe \??\c:\5dvjp.exe
PID 2544 wrote to memory of 2068 N/A \??\c:\lfrrffl.exe \??\c:\5dvjp.exe
PID 2068 wrote to memory of 2132 N/A \??\c:\5dvjp.exe \??\c:\vvvjp.exe
PID 2068 wrote to memory of 2132 N/A \??\c:\5dvjp.exe \??\c:\vvvjp.exe
PID 2068 wrote to memory of 2132 N/A \??\c:\5dvjp.exe \??\c:\vvvjp.exe
PID 2068 wrote to memory of 2132 N/A \??\c:\5dvjp.exe \??\c:\vvvjp.exe
PID 2132 wrote to memory of 2664 N/A \??\c:\vvvjp.exe \??\c:\7rrfxxf.exe
PID 2132 wrote to memory of 2664 N/A \??\c:\vvvjp.exe \??\c:\7rrfxxf.exe
PID 2132 wrote to memory of 2664 N/A \??\c:\vvvjp.exe \??\c:\7rrfxxf.exe
PID 2132 wrote to memory of 2664 N/A \??\c:\vvvjp.exe \??\c:\7rrfxxf.exe
PID 2664 wrote to memory of 592 N/A \??\c:\7rrfxxf.exe \??\c:\bbnthn.exe
PID 2664 wrote to memory of 592 N/A \??\c:\7rrfxxf.exe \??\c:\bbnthn.exe
PID 2664 wrote to memory of 592 N/A \??\c:\7rrfxxf.exe \??\c:\bbnthn.exe
PID 2664 wrote to memory of 592 N/A \??\c:\7rrfxxf.exe \??\c:\bbnthn.exe
PID 592 wrote to memory of 2720 N/A \??\c:\bbnthn.exe \??\c:\vpvdj.exe
PID 592 wrote to memory of 2720 N/A \??\c:\bbnthn.exe \??\c:\vpvdj.exe
PID 592 wrote to memory of 2720 N/A \??\c:\bbnthn.exe \??\c:\vpvdj.exe
PID 592 wrote to memory of 2720 N/A \??\c:\bbnthn.exe \??\c:\vpvdj.exe
PID 2720 wrote to memory of 2848 N/A \??\c:\vpvdj.exe \??\c:\jdvvv.exe
PID 2720 wrote to memory of 2848 N/A \??\c:\vpvdj.exe \??\c:\jdvvv.exe
PID 2720 wrote to memory of 2848 N/A \??\c:\vpvdj.exe \??\c:\jdvvv.exe
PID 2720 wrote to memory of 2848 N/A \??\c:\vpvdj.exe \??\c:\jdvvv.exe
PID 2848 wrote to memory of 2780 N/A \??\c:\jdvvv.exe \??\c:\fxrxlxx.exe
PID 2848 wrote to memory of 2780 N/A \??\c:\jdvvv.exe \??\c:\fxrxlxx.exe
PID 2848 wrote to memory of 2780 N/A \??\c:\jdvvv.exe \??\c:\fxrxlxx.exe
PID 2848 wrote to memory of 2780 N/A \??\c:\jdvvv.exe \??\c:\fxrxlxx.exe
PID 2780 wrote to memory of 2876 N/A \??\c:\fxrxlxx.exe \??\c:\lxrxxfl.exe
PID 2780 wrote to memory of 2876 N/A \??\c:\fxrxlxx.exe \??\c:\lxrxxfl.exe
PID 2780 wrote to memory of 2876 N/A \??\c:\fxrxlxx.exe \??\c:\lxrxxfl.exe
PID 2780 wrote to memory of 2876 N/A \??\c:\fxrxlxx.exe \??\c:\lxrxxfl.exe
PID 2876 wrote to memory of 2376 N/A \??\c:\lxrxxfl.exe \??\c:\hthhnn.exe
PID 2876 wrote to memory of 2376 N/A \??\c:\lxrxxfl.exe \??\c:\hthhnn.exe
PID 2876 wrote to memory of 2376 N/A \??\c:\lxrxxfl.exe \??\c:\hthhnn.exe
PID 2876 wrote to memory of 2376 N/A \??\c:\lxrxxfl.exe \??\c:\hthhnn.exe
PID 2376 wrote to memory of 2580 N/A \??\c:\hthhnn.exe \??\c:\dpdvj.exe
PID 2376 wrote to memory of 2580 N/A \??\c:\hthhnn.exe \??\c:\dpdvj.exe
PID 2376 wrote to memory of 2580 N/A \??\c:\hthhnn.exe \??\c:\dpdvj.exe
PID 2376 wrote to memory of 2580 N/A \??\c:\hthhnn.exe \??\c:\dpdvj.exe
PID 2580 wrote to memory of 2700 N/A \??\c:\dpdvj.exe \??\c:\lxflrrx.exe
PID 2580 wrote to memory of 2700 N/A \??\c:\dpdvj.exe \??\c:\lxflrrx.exe
PID 2580 wrote to memory of 2700 N/A \??\c:\dpdvj.exe \??\c:\lxflrrx.exe
PID 2580 wrote to memory of 2700 N/A \??\c:\dpdvj.exe \??\c:\lxflrrx.exe
PID 2700 wrote to memory of 768 N/A \??\c:\lxflrrx.exe \??\c:\1fxrflr.exe
PID 2700 wrote to memory of 768 N/A \??\c:\lxflrrx.exe \??\c:\1fxrflr.exe
PID 2700 wrote to memory of 768 N/A \??\c:\lxflrrx.exe \??\c:\1fxrflr.exe
PID 2700 wrote to memory of 768 N/A \??\c:\lxflrrx.exe \??\c:\1fxrflr.exe
PID 768 wrote to memory of 1544 N/A \??\c:\1fxrflr.exe \??\c:\ttthnt.exe
PID 768 wrote to memory of 1544 N/A \??\c:\1fxrflr.exe \??\c:\ttthnt.exe
PID 768 wrote to memory of 1544 N/A \??\c:\1fxrflr.exe \??\c:\ttthnt.exe
PID 768 wrote to memory of 1544 N/A \??\c:\1fxrflr.exe \??\c:\ttthnt.exe
PID 1544 wrote to memory of 1984 N/A \??\c:\ttthnt.exe \??\c:\httttt.exe
PID 1544 wrote to memory of 1984 N/A \??\c:\ttthnt.exe \??\c:\httttt.exe
PID 1544 wrote to memory of 1984 N/A \??\c:\ttthnt.exe \??\c:\httttt.exe
PID 1544 wrote to memory of 1984 N/A \??\c:\ttthnt.exe \??\c:\httttt.exe
PID 1984 wrote to memory of 2484 N/A \??\c:\httttt.exe \??\c:\ddddd.exe
PID 1984 wrote to memory of 2484 N/A \??\c:\httttt.exe \??\c:\ddddd.exe
PID 1984 wrote to memory of 2484 N/A \??\c:\httttt.exe \??\c:\ddddd.exe
PID 1984 wrote to memory of 2484 N/A \??\c:\httttt.exe \??\c:\ddddd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9350d86d2640e7caf05a04051c3f3cec.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9350d86d2640e7caf05a04051c3f3cec.exe"

\??\c:\lfrrffl.exe

c:\lfrrffl.exe

\??\c:\5dvjp.exe

c:\5dvjp.exe

\??\c:\vvvjp.exe

c:\vvvjp.exe

\??\c:\7rrfxxf.exe

c:\7rrfxxf.exe

\??\c:\bbnthn.exe

c:\bbnthn.exe

\??\c:\vpvdj.exe

c:\vpvdj.exe

\??\c:\jdvvv.exe

c:\jdvvv.exe

\??\c:\fxrxlxx.exe

c:\fxrxlxx.exe

\??\c:\lxrxxfl.exe

c:\lxrxxfl.exe

\??\c:\hthhnn.exe

c:\hthhnn.exe

\??\c:\dpdvj.exe

c:\dpdvj.exe

\??\c:\lxflrrx.exe

c:\lxflrrx.exe

\??\c:\1fxrflr.exe

c:\1fxrflr.exe

\??\c:\ttthnt.exe

c:\ttthnt.exe

\??\c:\httttt.exe

c:\httttt.exe

\??\c:\ddddd.exe

c:\ddddd.exe

\??\c:\7rxxffl.exe

c:\7rxxffl.exe

\??\c:\frfrxxx.exe

c:\frfrxxx.exe

\??\c:\tnhhnn.exe

c:\tnhhnn.exe

\??\c:\tttbnt.exe

c:\tttbnt.exe

\??\c:\5dvvj.exe

c:\5dvvj.exe

\??\c:\dvjvp.exe

c:\dvjvp.exe

\??\c:\xxrrlrx.exe

c:\xxrrlrx.exe

\??\c:\lfxlxxr.exe

c:\lfxlxxr.exe

\??\c:\htnntb.exe

c:\htnntb.exe

\??\c:\tnbnht.exe

c:\tnbnht.exe

\??\c:\vpjjv.exe

c:\vpjjv.exe

\??\c:\rrflrrx.exe

c:\rrflrrx.exe

\??\c:\xrlrxxx.exe

c:\xrlrxxx.exe

\??\c:\thnnbb.exe

c:\thnnbb.exe

\??\c:\pvddd.exe

c:\pvddd.exe

\??\c:\vpdjp.exe

c:\vpdjp.exe

\??\c:\frfxflr.exe

c:\frfxflr.exe

\??\c:\3btbnn.exe

c:\3btbnn.exe

\??\c:\htnhnn.exe

c:\htnhnn.exe

\??\c:\thtbtn.exe

c:\thtbtn.exe

\??\c:\vpvdd.exe

c:\vpvdd.exe

\??\c:\xrllrrx.exe

c:\xrllrrx.exe

\??\c:\lfrrfxf.exe

c:\lfrrfxf.exe

\??\c:\hthnbb.exe

c:\hthnbb.exe

\??\c:\bnttbb.exe

c:\bnttbb.exe

\??\c:\vvpvp.exe

c:\vvpvp.exe

\??\c:\5pvdp.exe

c:\5pvdp.exe

\??\c:\tnttnt.exe

c:\tnttnt.exe

\??\c:\3thbhn.exe

c:\3thbhn.exe

\??\c:\vdjdd.exe

c:\vdjdd.exe

\??\c:\jjdjp.exe

c:\jjdjp.exe

\??\c:\ffrffxf.exe

c:\ffrffxf.exe

\??\c:\1frrxfl.exe

c:\1frrxfl.exe

\??\c:\lxrrfxf.exe

c:\lxrrfxf.exe

\??\c:\hbntbt.exe

c:\hbntbt.exe

\??\c:\jdjdd.exe

c:\jdjdd.exe

\??\c:\pjvvd.exe

c:\pjvvd.exe

\??\c:\rrlfrrx.exe

c:\rrlfrrx.exe

\??\c:\lflrrrx.exe

c:\lflrrrx.exe

\??\c:\htbhhh.exe

c:\htbhhh.exe

\??\c:\bhbnnt.exe

c:\bhbnnt.exe

\??\c:\ppdjj.exe

c:\ppdjj.exe

\??\c:\vpjdj.exe

c:\vpjdj.exe

\??\c:\rlrlxxf.exe

c:\rlrlxxf.exe

\??\c:\lflrflr.exe

c:\lflrflr.exe

\??\c:\hhhhbh.exe

c:\hhhhbh.exe

\??\c:\7htbtt.exe

c:\7htbtt.exe

\??\c:\pvvvp.exe

c:\pvvvp.exe

\??\c:\dpvvd.exe

c:\dpvvd.exe

\??\c:\ffxlffl.exe

c:\ffxlffl.exe

\??\c:\xxllrlr.exe

c:\xxllrlr.exe

\??\c:\thnhhh.exe

c:\thnhhh.exe

\??\c:\nhnntn.exe

c:\nhnntn.exe

\??\c:\vvpjd.exe

c:\vvpjd.exe

\??\c:\ppppp.exe

c:\ppppp.exe

\??\c:\xrrlxrr.exe

c:\xrrlxrr.exe

\??\c:\lfrxfxl.exe

c:\lfrxfxl.exe

\??\c:\1bntbb.exe

c:\1bntbb.exe

\??\c:\ttbtbb.exe

c:\ttbtbb.exe

\??\c:\1pvdv.exe

c:\1pvdv.exe

\??\c:\vpddj.exe

c:\vpddj.exe

\??\c:\flrfxrr.exe

c:\flrfxrr.exe

\??\c:\fxrflrf.exe

c:\fxrflrf.exe

\??\c:\3ntnnn.exe

c:\3ntnnn.exe

\??\c:\tnbbhh.exe

c:\tnbbhh.exe

\??\c:\hbhnnb.exe

c:\hbhnnb.exe

\??\c:\rfxxflr.exe

c:\rfxxflr.exe

\??\c:\lxlrxxf.exe

c:\lxlrxxf.exe

\??\c:\nhhhhh.exe

c:\nhhhhh.exe

\??\c:\5btbnh.exe

c:\5btbnh.exe

\??\c:\dvdjd.exe

c:\dvdjd.exe

\??\c:\vddjp.exe

c:\vddjp.exe

\??\c:\rlflffr.exe

c:\rlflffr.exe

\??\c:\lrlrfrl.exe

c:\lrlrfrl.exe

\??\c:\ttntbh.exe

c:\ttntbh.exe

\??\c:\btbhbb.exe

c:\btbhbb.exe

\??\c:\vjpjp.exe

c:\vjpjp.exe

\??\c:\3pddd.exe

c:\3pddd.exe

\??\c:\3frlffr.exe

c:\3frlffr.exe

\??\c:\5rllrxf.exe

c:\5rllrxf.exe

\??\c:\thnnnn.exe

c:\thnnnn.exe

\??\c:\nbntnn.exe

c:\nbntnn.exe

\??\c:\ddpjd.exe

c:\ddpjd.exe

\??\c:\ddpjp.exe

c:\ddpjp.exe

\??\c:\rffflrl.exe

c:\rffflrl.exe

\??\c:\lfrrfxx.exe

c:\lfrrfxx.exe

\??\c:\llrxfxf.exe

c:\llrxfxf.exe

\??\c:\9htbtb.exe

c:\9htbtb.exe

\??\c:\bthnth.exe

c:\bthnth.exe

\??\c:\vdppp.exe

c:\vdppp.exe

\??\c:\jvddp.exe

c:\jvddp.exe

\??\c:\rlxflrl.exe

c:\rlxflrl.exe

\??\c:\ffxlxrl.exe

c:\ffxlxrl.exe

\??\c:\nnhnhh.exe

c:\nnhnhh.exe

\??\c:\tnbbbh.exe

c:\tnbbbh.exe

\??\c:\vpvvv.exe

c:\vpvvv.exe

\??\c:\9vvdv.exe

c:\9vvdv.exe

\??\c:\rfxrrll.exe

c:\rfxrrll.exe

\??\c:\fxlxfxr.exe

c:\fxlxfxr.exe

\??\c:\nbnbhh.exe

c:\nbnbhh.exe

\??\c:\5bbnbh.exe

c:\5bbnbh.exe

\??\c:\dvjjj.exe

c:\dvjjj.exe

\??\c:\9jvdv.exe

c:\9jvdv.exe

\??\c:\jdvvv.exe

c:\jdvvv.exe

\??\c:\3lfxlxf.exe

c:\3lfxlxf.exe

\??\c:\5lflfff.exe

c:\5lflfff.exe

\??\c:\xrlxllx.exe

c:\xrlxllx.exe

\??\c:\nbbnhh.exe

c:\nbbnhh.exe

\??\c:\nthntn.exe

c:\nthntn.exe

\??\c:\tnbbnn.exe

c:\tnbbnn.exe

\??\c:\9dvdj.exe

c:\9dvdj.exe

\??\c:\llrxxlx.exe

c:\llrxxlx.exe

\??\c:\rlrfrrx.exe

c:\rlrfrrx.exe

\??\c:\1xffllr.exe

c:\1xffllr.exe

\??\c:\tnhnnn.exe

c:\tnhnnn.exe

\??\c:\nhtbbt.exe

c:\nhtbbt.exe

\??\c:\1pppd.exe

c:\1pppd.exe

\??\c:\jdjjj.exe

c:\jdjjj.exe

\??\c:\xlrlxxf.exe

c:\xlrlxxf.exe

\??\c:\rrrxfxx.exe

c:\rrrxfxx.exe

\??\c:\xrllxrr.exe

c:\xrllxrr.exe

\??\c:\9bttbb.exe

c:\9bttbb.exe

\??\c:\hhbnhh.exe

c:\hhbnhh.exe

\??\c:\pjpdj.exe

c:\pjpdj.exe

\??\c:\3pjpp.exe

c:\3pjpp.exe

\??\c:\rfrrxxl.exe

c:\rfrrxxl.exe

\??\c:\flrllrx.exe

c:\flrllrx.exe

\??\c:\bnhnnt.exe

c:\bnhnnt.exe

\??\c:\bnttnt.exe

c:\bnttnt.exe

\??\c:\3hthbb.exe

c:\3hthbb.exe

\??\c:\vpjvd.exe

c:\vpjvd.exe

\??\c:\5jjjv.exe

c:\5jjjv.exe

\??\c:\lfrlllr.exe

c:\lfrlllr.exe

\??\c:\3lxxrxf.exe

c:\3lxxrxf.exe

\??\c:\hhthtb.exe

c:\hhthtb.exe

\??\c:\httnhh.exe

c:\httnhh.exe

\??\c:\dvjdj.exe

c:\dvjdj.exe

\??\c:\vdvpv.exe

c:\vdvpv.exe

\??\c:\vvjjd.exe

c:\vvjjd.exe

\??\c:\frrxffr.exe

c:\frrxffr.exe

\??\c:\llflfxl.exe

c:\llflfxl.exe

\??\c:\tthntb.exe

c:\tthntb.exe

\??\c:\bbbbbt.exe

c:\bbbbbt.exe

\??\c:\1jvpd.exe

c:\1jvpd.exe

\??\c:\jdvdd.exe

c:\jdvdd.exe

\??\c:\pjpdp.exe

c:\pjpdp.exe

\??\c:\5lxrxff.exe

c:\5lxrxff.exe

\??\c:\ffxlflr.exe

c:\ffxlflr.exe

\??\c:\bthhth.exe

c:\bthhth.exe

\??\c:\1nhbnt.exe

c:\1nhbnt.exe

\??\c:\dddpj.exe

c:\dddpj.exe

\??\c:\7ddpd.exe

c:\7ddpd.exe

\??\c:\jdpjp.exe

c:\jdpjp.exe

\??\c:\lflllrx.exe

c:\lflllrx.exe

\??\c:\fxlrfll.exe

c:\fxlrfll.exe

\??\c:\7fxlffr.exe

c:\7fxlffr.exe

\??\c:\nnbntn.exe

c:\nnbntn.exe

\??\c:\3htbbh.exe

c:\3htbbh.exe

\??\c:\vpdjv.exe

c:\vpdjv.exe

\??\c:\jdvvd.exe

c:\jdvvd.exe

\??\c:\lfrrxrx.exe

c:\lfrrxrx.exe

\??\c:\rlflxxf.exe

c:\rlflxxf.exe

\??\c:\frxrflr.exe

c:\frxrflr.exe

\??\c:\hbnnnn.exe

c:\hbnnnn.exe

\??\c:\bthbnn.exe

c:\bthbnn.exe

\??\c:\vpvdd.exe

c:\vpvdd.exe

\??\c:\3jvvv.exe

c:\3jvvv.exe

\??\c:\rfrrrrx.exe

c:\rfrrrrx.exe

\??\c:\fxrrxxf.exe

c:\fxrrxxf.exe

\??\c:\hhbbnt.exe

c:\hhbbnt.exe

\??\c:\htbhhb.exe

c:\htbhhb.exe

\??\c:\nhnttt.exe

c:\nhnttt.exe

\??\c:\ppdvd.exe

c:\ppdvd.exe

\??\c:\9pjjp.exe

c:\9pjjp.exe

\??\c:\1xrlxlf.exe

c:\1xrlxlf.exe

\??\c:\frxxxrr.exe

c:\frxxxrr.exe

\??\c:\nbntnt.exe

c:\nbntnt.exe

\??\c:\5hthhh.exe

c:\5hthhh.exe

\??\c:\7jjvp.exe

c:\7jjvp.exe

\??\c:\jvpvv.exe

c:\jvpvv.exe

\??\c:\3vjjp.exe

c:\3vjjp.exe

\??\c:\9rxfrrr.exe

c:\9rxfrrr.exe

\??\c:\3rlxlrr.exe

c:\3rlxlrr.exe

\??\c:\nhttbb.exe

c:\nhttbb.exe

\??\c:\nhnnnt.exe

c:\nhnnnt.exe

\??\c:\7htnhb.exe

c:\7htnhb.exe

\??\c:\vpvvd.exe

c:\vpvvd.exe

\??\c:\ppdjp.exe

c:\ppdjp.exe

\??\c:\frlfllx.exe

c:\frlfllx.exe

\??\c:\flxrfxx.exe

c:\flxrfxx.exe

\??\c:\5nhnbt.exe

c:\5nhnbt.exe

\??\c:\hbnntn.exe

c:\hbnntn.exe

\??\c:\ddjjj.exe

c:\ddjjj.exe

\??\c:\pdjpd.exe

c:\pdjpd.exe

\??\c:\7ddvp.exe

c:\7ddvp.exe

\??\c:\9lrllff.exe

c:\9lrllff.exe

\??\c:\fxlflrx.exe

c:\fxlflrx.exe

\??\c:\9nhbhb.exe

c:\9nhbhb.exe

\??\c:\nnnhnn.exe

c:\nnnhnn.exe

\??\c:\9nhtbn.exe

c:\9nhtbn.exe

\??\c:\dvjjd.exe

c:\dvjjd.exe

\??\c:\jvjvv.exe

c:\jvjvv.exe

\??\c:\lxfxxrf.exe

c:\lxfxxrf.exe

\??\c:\1frrrll.exe

c:\1frrrll.exe

\??\c:\xlrfrrl.exe

c:\xlrfrrl.exe

\??\c:\tnnntb.exe

c:\tnnntb.exe

\??\c:\3btnnn.exe

c:\3btnnn.exe

\??\c:\pjvjj.exe

c:\pjvjj.exe

\??\c:\7nnnnn.exe

c:\7nnnnn.exe

\??\c:\nhntnn.exe

c:\nhntnn.exe

\??\c:\ddpdp.exe

c:\ddpdp.exe

\??\c:\dpddj.exe

c:\dpddj.exe

\??\c:\vvdjd.exe

c:\vvdjd.exe

\??\c:\rfrlrff.exe

c:\rfrlrff.exe

\??\c:\3fxflrr.exe

c:\3fxflrr.exe

\??\c:\nbtntn.exe

c:\nbtntn.exe

\??\c:\nhtbbh.exe

c:\nhtbbh.exe

\??\c:\nhhbhb.exe

c:\nhhbhb.exe

\??\c:\1pddd.exe

c:\1pddd.exe

\??\c:\dvpdj.exe

c:\dvpdj.exe

\??\c:\xxlrfrx.exe

c:\xxlrfrx.exe

\??\c:\xlrfflf.exe

c:\xlrfflf.exe

\??\c:\1fxfxxx.exe

c:\1fxfxxx.exe

\??\c:\3ntbhn.exe

c:\3ntbhn.exe

\??\c:\nhtttt.exe

c:\nhtttt.exe

\??\c:\7nbbhh.exe

c:\7nbbhh.exe

\??\c:\3djjp.exe

c:\3djjp.exe

\??\c:\7jpdj.exe

c:\7jpdj.exe

\??\c:\vpdjv.exe

c:\vpdjv.exe

\??\c:\fxrlfff.exe

c:\fxrlfff.exe

\??\c:\1lrrfrx.exe

c:\1lrrfrx.exe

\??\c:\xrflrrl.exe

c:\xrflrrl.exe

\??\c:\bnhtbt.exe

c:\bnhtbt.exe

\??\c:\thttbt.exe

c:\thttbt.exe

\??\c:\jvdjp.exe

c:\jvdjp.exe

\??\c:\vvddj.exe

c:\vvddj.exe

\??\c:\7dvpv.exe

c:\7dvpv.exe

\??\c:\9rllllr.exe

c:\9rllllr.exe

\??\c:\1nbbnn.exe

c:\1nbbnn.exe

\??\c:\hbnbtb.exe

c:\hbnbtb.exe

\??\c:\7bthbb.exe

c:\7bthbb.exe

\??\c:\jdppv.exe

c:\jdppv.exe

\??\c:\pddpp.exe

c:\pddpp.exe

\??\c:\lfrrffl.exe

c:\lfrrffl.exe

\??\c:\lrfxxlx.exe

c:\lrfxxlx.exe

\??\c:\fxlrxxf.exe

c:\fxlrxxf.exe

\??\c:\nbnnht.exe

c:\nbnnht.exe

\??\c:\hbnbhb.exe

c:\hbnbhb.exe

\??\c:\pjpvv.exe

c:\pjpvv.exe

\??\c:\vpddd.exe

c:\vpddd.exe

\??\c:\5jvvp.exe

c:\5jvvp.exe

\??\c:\jddvv.exe

c:\jddvv.exe

\??\c:\fxlrffl.exe

c:\fxlrffl.exe

\??\c:\7ffflxl.exe

c:\7ffflxl.exe

\??\c:\9tbtbt.exe

c:\9tbtbt.exe

\??\c:\bttbhh.exe

c:\bttbhh.exe

\??\c:\1nhntn.exe

c:\1nhntn.exe

\??\c:\5pjjp.exe

c:\5pjjp.exe

\??\c:\jppdp.exe

c:\jppdp.exe

\??\c:\9lflffl.exe

c:\9lflffl.exe

\??\c:\xrfxflr.exe

c:\xrfxflr.exe

\??\c:\lfrrfxl.exe

c:\lfrrfxl.exe

\??\c:\nbtttb.exe

c:\nbtttb.exe

\??\c:\htnbnh.exe

c:\htnbnh.exe

\??\c:\pjdjj.exe

c:\pjdjj.exe

\??\c:\vpvvd.exe

c:\vpvvd.exe

\??\c:\1vjjd.exe

c:\1vjjd.exe

\??\c:\lxlllff.exe

c:\lxlllff.exe

\??\c:\fxxrlxf.exe

c:\fxxrlxf.exe

\??\c:\tntttt.exe

c:\tntttt.exe

\??\c:\hthhbt.exe

c:\hthhbt.exe

\??\c:\nntbnt.exe

c:\nntbnt.exe

\??\c:\vppjd.exe

c:\vppjd.exe

\??\c:\dvddv.exe

c:\dvddv.exe

\??\c:\3vjvv.exe

c:\3vjvv.exe

\??\c:\5lxxxxf.exe

c:\5lxxxxf.exe

\??\c:\lxlllrl.exe

c:\lxlllrl.exe

\??\c:\tntntt.exe

c:\tntntt.exe

\??\c:\bhbnth.exe

c:\bhbnth.exe

\??\c:\5vjjp.exe

c:\5vjjp.exe

\??\c:\dvdvp.exe

c:\dvdvp.exe

\??\c:\7dvjj.exe

c:\7dvjj.exe

\??\c:\fxlllll.exe

c:\fxlllll.exe

\??\c:\9frflll.exe

c:\9frflll.exe

\??\c:\tthttb.exe

c:\tthttb.exe

\??\c:\1bbbbb.exe

c:\1bbbbb.exe

\??\c:\jvjvd.exe

c:\jvjvd.exe

\??\c:\9vjdj.exe

c:\9vjdj.exe

\??\c:\7jddv.exe

c:\7jddv.exe

\??\c:\rlflrxf.exe

c:\rlflrxf.exe

\??\c:\7rfrrrl.exe

c:\7rfrrrl.exe

\??\c:\lfxlxff.exe

c:\lfxlxff.exe

\??\c:\9nhnnb.exe

c:\9nhnnb.exe

\??\c:\9hbhnn.exe

c:\9hbhnn.exe

\??\c:\hhntbb.exe

c:\hhntbb.exe

\??\c:\jdpvj.exe

c:\jdpvj.exe

\??\c:\vjvpd.exe

c:\vjvpd.exe

\??\c:\pdjpp.exe

c:\pdjpp.exe

\??\c:\xlrrlrx.exe

c:\xlrrlrx.exe

\??\c:\xxrfxxr.exe

c:\xxrfxxr.exe

\??\c:\tntbbt.exe

c:\tntbbt.exe

\??\c:\bbhhht.exe

c:\bbhhht.exe

\??\c:\pdppp.exe

c:\pdppp.exe

\??\c:\dvddj.exe

c:\dvddj.exe

\??\c:\1vpvd.exe

c:\1vpvd.exe

\??\c:\xxffrrx.exe

c:\xxffrrx.exe

\??\c:\xrfflff.exe

c:\xrfflff.exe

\??\c:\9hhbhn.exe

c:\9hhbhn.exe

\??\c:\hthtnh.exe

c:\hthtnh.exe

\??\c:\5vpjj.exe

c:\5vpjj.exe

\??\c:\7djjj.exe

c:\7djjj.exe

\??\c:\vpppp.exe

c:\vpppp.exe

\??\c:\xfrlfll.exe

c:\xfrlfll.exe

\??\c:\lfrfxxf.exe

c:\lfrfxxf.exe

\??\c:\htbtnn.exe

c:\htbtnn.exe

\??\c:\5thhhh.exe

c:\5thhhh.exe

\??\c:\tnbbbh.exe

c:\tnbbbh.exe

\??\c:\jdjjj.exe

c:\jdjjj.exe

\??\c:\3ddjd.exe

c:\3ddjd.exe

\??\c:\jddjp.exe

c:\jddjp.exe

\??\c:\9xrfflx.exe

c:\9xrfflx.exe

\??\c:\5rflrlr.exe

c:\5rflrlr.exe

\??\c:\flrrrll.exe

c:\flrrrll.exe

\??\c:\bnbbhn.exe

c:\bnbbhn.exe

\??\c:\htbtnt.exe

c:\htbtnt.exe

\??\c:\9jvpv.exe

c:\9jvpv.exe

\??\c:\1jjpv.exe

c:\1jjpv.exe

\??\c:\vpjpp.exe

c:\vpjpp.exe

\??\c:\9lxxfxx.exe

c:\9lxxfxx.exe

\??\c:\7lrrxxx.exe

c:\7lrrxxx.exe

\??\c:\bnbbbt.exe

c:\bnbbbt.exe

\??\c:\9hhnnn.exe

c:\9hhnnn.exe

\??\c:\bthnhh.exe

c:\bthnhh.exe

\??\c:\5pjdp.exe

c:\5pjdp.exe

\??\c:\dvjvv.exe

c:\dvjvv.exe

\??\c:\vjpvv.exe

c:\vjpvv.exe

\??\c:\lxfxflr.exe

c:\lxfxflr.exe

\??\c:\fxrxffl.exe

c:\fxrxffl.exe

\??\c:\fxrxxxf.exe

c:\fxrxxxf.exe

\??\c:\htnbhn.exe

c:\htnbhn.exe

\??\c:\thtthb.exe

c:\thtthb.exe

\??\c:\pdpdd.exe

c:\pdpdd.exe

\??\c:\3jvdj.exe

c:\3jvdj.exe

\??\c:\lfrrrrx.exe

c:\lfrrrrx.exe

\??\c:\lxllflr.exe

c:\lxllflr.exe

\??\c:\rllrfll.exe

c:\rllrfll.exe

\??\c:\nhhbbh.exe

c:\nhhbbh.exe

\??\c:\htnntt.exe

c:\htnntt.exe

\??\c:\jvpdd.exe

c:\jvpdd.exe

\??\c:\ddvpv.exe

c:\ddvpv.exe

\??\c:\lxllrlx.exe

c:\lxllrlx.exe

\??\c:\lfrrxxf.exe

c:\lfrrxxf.exe

\??\c:\nbnbbb.exe

c:\nbnbbb.exe

\??\c:\htbbbb.exe

c:\htbbbb.exe

\??\c:\thtbbt.exe

c:\thtbbt.exe

\??\c:\pdddp.exe

c:\pdddp.exe

\??\c:\pppdd.exe

c:\pppdd.exe

\??\c:\xlxrrrl.exe

c:\xlxrrrl.exe

\??\c:\9xllllx.exe

c:\9xllllx.exe

\??\c:\vpddd.exe

c:\vpddd.exe

\??\c:\dvpvd.exe

c:\dvpvd.exe

\??\c:\llrrxrx.exe

c:\llrrxrx.exe

\??\c:\flrrxxr.exe

c:\flrrxxr.exe

\??\c:\ththhh.exe

c:\ththhh.exe

\??\c:\hbnhbb.exe

c:\hbnhbb.exe

\??\c:\htbbnn.exe

c:\htbbnn.exe

\??\c:\7pjpv.exe

c:\7pjpv.exe

\??\c:\pjddv.exe

c:\pjddv.exe

\??\c:\3frrffr.exe

c:\3frrffr.exe

\??\c:\9frffxf.exe

c:\9frffxf.exe

\??\c:\7tbntn.exe

c:\7tbntn.exe

\??\c:\hbbbnt.exe

c:\hbbbnt.exe

\??\c:\tnhnnb.exe

c:\tnhnnb.exe

\??\c:\7pjdj.exe

c:\7pjdj.exe

\??\c:\9jvjj.exe

c:\9jvjj.exe

\??\c:\pdjvd.exe

c:\pdjvd.exe

\??\c:\fxrlfll.exe

c:\fxrlfll.exe

\??\c:\lfxlxfr.exe

c:\lfxlxfr.exe

\??\c:\nbtntn.exe

c:\nbtntn.exe

\??\c:\7htttt.exe

c:\7htttt.exe

\??\c:\hhbnbb.exe

c:\hhbnbb.exe

\??\c:\vjvpv.exe

c:\vjvpv.exe

\??\c:\5jdvv.exe

c:\5jdvv.exe

\??\c:\rflflfx.exe

c:\rflflfx.exe

\??\c:\flxxxxx.exe

c:\flxxxxx.exe

\??\c:\bnthht.exe

c:\bnthht.exe

\??\c:\1nbhtn.exe

c:\1nbhtn.exe

\??\c:\dvdvp.exe

c:\dvdvp.exe

\??\c:\vjvpv.exe

c:\vjvpv.exe

\??\c:\7dvdd.exe

c:\7dvdd.exe

\??\c:\fxlxllx.exe

c:\fxlxllx.exe

\??\c:\frfrrxl.exe

c:\frfrrxl.exe

\??\c:\hbhnbb.exe

c:\hbhnbb.exe

\??\c:\bnbhbt.exe

c:\bnbhbt.exe

\??\c:\pjpvp.exe

c:\pjpvp.exe

\??\c:\vpvpv.exe

c:\vpvpv.exe

\??\c:\5dpjj.exe

c:\5dpjj.exe

\??\c:\3flffll.exe

c:\3flffll.exe

\??\c:\fxflxlr.exe

c:\fxflxlr.exe

\??\c:\nhhhhh.exe

c:\nhhhhh.exe

\??\c:\htbbhh.exe

c:\htbbhh.exe

\??\c:\1tbttb.exe

c:\1tbttb.exe

\??\c:\djvpp.exe

c:\djvpp.exe

\??\c:\jdpvd.exe

c:\jdpvd.exe

\??\c:\5frlfxf.exe

c:\5frlfxf.exe

\??\c:\1lxrrxx.exe

c:\1lxrrxx.exe

\??\c:\fxrfllx.exe

c:\fxrfllx.exe

\??\c:\bttthh.exe

c:\bttthh.exe

\??\c:\hnbhtt.exe

c:\hnbhtt.exe

\??\c:\7pddd.exe

c:\7pddd.exe

\??\c:\jjpjj.exe

c:\jjpjj.exe

\??\c:\1rffllr.exe

c:\1rffllr.exe

\??\c:\3lfllfr.exe

c:\3lfllfr.exe

\??\c:\9hbhnn.exe

c:\9hbhnn.exe

\??\c:\7tnntt.exe

c:\7tnntt.exe

\??\c:\dpjpj.exe

c:\dpjpj.exe

\??\c:\1vdvp.exe

c:\1vdvp.exe

\??\c:\jdpvd.exe

c:\jdpvd.exe

\??\c:\xllfllf.exe

c:\xllfllf.exe

\??\c:\rxxlllf.exe

c:\rxxlllf.exe

\??\c:\bhnnbh.exe

c:\bhnnbh.exe

\??\c:\nnbbtt.exe

c:\nnbbtt.exe

\??\c:\dvjvv.exe

c:\dvjvv.exe

\??\c:\1dvpv.exe

c:\1dvpv.exe

\??\c:\xlrrlff.exe

c:\xlrrlff.exe

\??\c:\rfxfrrr.exe

c:\rfxfrrr.exe

\??\c:\9lxxxrx.exe

c:\9lxxxrx.exe

\??\c:\9htnbh.exe

c:\9htnbh.exe

\??\c:\hbntbb.exe

c:\hbntbb.exe

\??\c:\jvddj.exe

c:\jvddj.exe

\??\c:\vpvvp.exe

c:\vpvvp.exe

\??\c:\vpvvj.exe

c:\vpvvj.exe

\??\c:\rfflfxx.exe

c:\rfflfxx.exe

\??\c:\xxlllfx.exe

c:\xxlllfx.exe

\??\c:\nhtbhn.exe

c:\nhtbhn.exe

\??\c:\nhhhtt.exe

c:\nhhhtt.exe

\??\c:\tnhttn.exe

c:\tnhttn.exe

\??\c:\dvjpv.exe

c:\dvjpv.exe

\??\c:\9jdjv.exe

c:\9jdjv.exe

\??\c:\xrxfflr.exe

c:\xrxfflr.exe

\??\c:\9rfflll.exe

c:\9rfflll.exe

\??\c:\frxrrlf.exe

c:\frxrrlf.exe

\??\c:\tnbhnb.exe

c:\tnbhnb.exe

\??\c:\bntthh.exe

c:\bntthh.exe

\??\c:\jddjp.exe

c:\jddjp.exe

\??\c:\pjvjj.exe

c:\pjvjj.exe

\??\c:\dpdvd.exe

c:\dpdvd.exe

\??\c:\3xrxffx.exe

c:\3xrxffx.exe

\??\c:\xfllrll.exe

c:\xfllrll.exe

\??\c:\bbhhbb.exe

c:\bbhhbb.exe

\??\c:\hbttnh.exe

c:\hbttnh.exe

\??\c:\1vjdj.exe

c:\1vjdj.exe

\??\c:\vvppp.exe

c:\vvppp.exe

\??\c:\1vjdp.exe

c:\1vjdp.exe

\??\c:\lxxxrxx.exe

c:\lxxxrxx.exe

\??\c:\lrlrrfl.exe

c:\lrlrrfl.exe

\??\c:\bnthtt.exe

c:\bnthtt.exe

\??\c:\tntnbb.exe

c:\tntnbb.exe

\??\c:\9hnttn.exe

c:\9hnttn.exe

\??\c:\5pjpv.exe

c:\5pjpv.exe

\??\c:\pdpdv.exe

c:\pdpdv.exe

\??\c:\1rllrxx.exe

c:\1rllrxx.exe

\??\c:\xxfxlxf.exe

c:\xxfxlxf.exe

\??\c:\7htbnn.exe

c:\7htbnn.exe

\??\c:\ntbbbt.exe

c:\ntbbbt.exe

\??\c:\hbnhhh.exe

c:\hbnhhh.exe

\??\c:\7jpdv.exe

c:\7jpdv.exe

\??\c:\pdvjd.exe

c:\pdvjd.exe

\??\c:\rflrrrl.exe

c:\rflrrrl.exe

\??\c:\fxrrflr.exe

c:\fxrrflr.exe

\??\c:\xlxfllr.exe

c:\xlxfllr.exe

\??\c:\hbnhnn.exe

c:\hbnhnn.exe

\??\c:\nnhnnh.exe

c:\nnhnnh.exe

\??\c:\jvdvd.exe

c:\jvdvd.exe

\??\c:\pvdvj.exe

c:\pvdvj.exe

\??\c:\7lxrlfl.exe

c:\7lxrlfl.exe

\??\c:\rxlrrrl.exe

c:\rxlrrrl.exe

\??\c:\bthbht.exe

c:\bthbht.exe

\??\c:\bhbbhh.exe

c:\bhbbhh.exe

\??\c:\9hbtbb.exe

c:\9hbtbb.exe

\??\c:\9jjvj.exe

c:\9jjvj.exe

\??\c:\vpdvj.exe

c:\vpdvj.exe

\??\c:\httthb.exe

c:\httthb.exe

\??\c:\vjvvd.exe

c:\vjvvd.exe

\??\c:\dvdvd.exe

c:\dvdvd.exe

\??\c:\xrflrrx.exe

c:\xrflrrx.exe

\??\c:\ffrfrrr.exe

c:\ffrfrrr.exe

\??\c:\flfflrr.exe

c:\flfflrr.exe

\??\c:\tnhhnn.exe

c:\tnhhnn.exe

\??\c:\bnnttb.exe

c:\bnnttb.exe

\??\c:\pdvvv.exe

c:\pdvvv.exe

\??\c:\dvvdv.exe

c:\dvvdv.exe

\??\c:\9pjpj.exe

c:\9pjpj.exe

\??\c:\9lfrflr.exe

c:\9lfrflr.exe

\??\c:\rxfrlxr.exe

c:\rxfrlxr.exe

\??\c:\hbhntb.exe

c:\hbhntb.exe

\??\c:\nhthbn.exe

c:\nhthbn.exe

\??\c:\vvvvv.exe

c:\vvvvv.exe

\??\c:\jdppp.exe

c:\jdppp.exe

\??\c:\lfxfflf.exe

c:\lfxfflf.exe

\??\c:\lfrrrrr.exe

c:\lfrrrrr.exe

\??\c:\fxlrxxx.exe

c:\fxlrxxx.exe

\??\c:\7hbbbh.exe

c:\7hbbbh.exe

\??\c:\5ttbbb.exe

c:\5ttbbb.exe

\??\c:\9nnntn.exe

c:\9nnntn.exe

\??\c:\9dvdj.exe

c:\9dvdj.exe

\??\c:\vppvd.exe

c:\vppvd.exe

\??\c:\lfrrrxx.exe

c:\lfrrrxx.exe

\??\c:\xrxrllr.exe

c:\xrxrllr.exe

\??\c:\3nbhhb.exe

c:\3nbhhb.exe

\??\c:\hbtbbh.exe

c:\hbtbbh.exe

\??\c:\vvdpp.exe

c:\vvdpp.exe

\??\c:\jdvpp.exe

c:\jdvpp.exe

\??\c:\9fxflrx.exe

c:\9fxflrx.exe

\??\c:\fxlrffl.exe

c:\fxlrffl.exe

\??\c:\lrxxlll.exe

c:\lrxxlll.exe

\??\c:\tnbbnn.exe

c:\tnbbnn.exe

\??\c:\9hhhnh.exe

c:\9hhhnh.exe

\??\c:\vvdjp.exe

c:\vvdjp.exe

\??\c:\pjppv.exe

c:\pjppv.exe

\??\c:\jvppp.exe

c:\jvppp.exe

\??\c:\rlxxllr.exe

c:\rlxxllr.exe

\??\c:\frxfrll.exe

c:\frxfrll.exe

\??\c:\5nntbb.exe

c:\5nntbb.exe

\??\c:\5hbhhh.exe

c:\5hbhhh.exe

\??\c:\bnttbh.exe

c:\bnttbh.exe

\??\c:\jpjdp.exe

c:\jpjdp.exe

\??\c:\7dpdj.exe

c:\7dpdj.exe

\??\c:\1xlllrf.exe

c:\1xlllrf.exe

\??\c:\rxxfflx.exe

c:\rxxfflx.exe

\??\c:\thtbhh.exe

c:\thtbhh.exe

\??\c:\htnhhh.exe

c:\htnhhh.exe

\??\c:\1htttn.exe

c:\1htttn.exe

\??\c:\7jdpp.exe

c:\7jdpp.exe

\??\c:\9jddd.exe

c:\9jddd.exe

\??\c:\7jvdp.exe

c:\7jvdp.exe

\??\c:\xrffrlx.exe

c:\xrffrlx.exe

\??\c:\xxrxlrx.exe

c:\xxrxlrx.exe

\??\c:\frflxff.exe

c:\frflxff.exe

\??\c:\nhtbhb.exe

c:\nhtbhb.exe

\??\c:\tnbbnh.exe

c:\tnbbnh.exe

\??\c:\dpvvv.exe

c:\dpvvv.exe

\??\c:\3jvpj.exe

c:\3jvpj.exe

\??\c:\fxxrxxf.exe

c:\fxxrxxf.exe

\??\c:\xrfllfx.exe

c:\xrfllfx.exe

\??\c:\fxrflrf.exe

c:\fxrflrf.exe

\??\c:\7tnhnh.exe

c:\7tnhnh.exe

\??\c:\tnhnbt.exe

c:\tnhnbt.exe

\??\c:\nbnhhh.exe

c:\nbnhhh.exe

\??\c:\7jjpd.exe

c:\7jjpd.exe

\??\c:\5vvvd.exe

c:\5vvvd.exe

\??\c:\rfxlxxl.exe

c:\rfxlxxl.exe

\??\c:\xlxrrlf.exe

c:\xlxrrlf.exe

\??\c:\xrlxffl.exe

c:\xrlxffl.exe

\??\c:\1hbbbn.exe

c:\1hbbbn.exe

\??\c:\btnntn.exe

c:\btnntn.exe

\??\c:\nbhnnt.exe

c:\nbhnnt.exe

\??\c:\5pjdj.exe

c:\5pjdj.exe

\??\c:\djvvp.exe

c:\djvvp.exe

\??\c:\lrlfffl.exe

c:\lrlfffl.exe

\??\c:\rfxfrlf.exe

c:\rfxfrlf.exe

\??\c:\xlxflrr.exe

c:\xlxflrr.exe

\??\c:\hbttbt.exe

c:\hbttbt.exe

\??\c:\tntbbb.exe

c:\tntbbb.exe

\??\c:\nhtttn.exe

c:\nhtttn.exe

\??\c:\vvjjj.exe

c:\vvjjj.exe

\??\c:\pdpjp.exe

c:\pdpjp.exe

\??\c:\vpvvv.exe

c:\vpvvv.exe

\??\c:\lxrrfff.exe

c:\lxrrfff.exe

\??\c:\lfrfllx.exe

c:\lfrfllx.exe

\??\c:\fxlflff.exe

c:\fxlflff.exe

\??\c:\tnnntt.exe

c:\tnnntt.exe

\??\c:\nnbnnt.exe

c:\nnbnnt.exe

\??\c:\nbhbhb.exe

c:\nbhbhb.exe

\??\c:\dpvvd.exe

c:\dpvvd.exe

\??\c:\jdvvd.exe

c:\jdvvd.exe

\??\c:\rxllffl.exe

c:\rxllffl.exe

\??\c:\3lflxfl.exe

c:\3lflxfl.exe

\??\c:\1lfflrf.exe

c:\1lfflrf.exe

\??\c:\bhtnht.exe

c:\bhtnht.exe

\??\c:\bbnnhn.exe

c:\bbnnhn.exe

\??\c:\vjpdj.exe

c:\vjpdj.exe

\??\c:\vpvvj.exe

c:\vpvvj.exe

\??\c:\dvjjv.exe

c:\dvjjv.exe

\??\c:\rfllfff.exe

c:\rfllfff.exe

\??\c:\xrxlrrx.exe

c:\xrxlrrx.exe

\??\c:\btnhtb.exe

c:\btnhtb.exe

\??\c:\1htbhn.exe

c:\1htbhn.exe

\??\c:\dvdjv.exe

c:\dvdjv.exe

\??\c:\ddjjj.exe

c:\ddjjj.exe

\??\c:\5vdvp.exe

c:\5vdvp.exe

\??\c:\xrxxxfl.exe

c:\xrxxxfl.exe

\??\c:\5xlxlrr.exe

c:\5xlxlrr.exe

\??\c:\xlrrffr.exe

c:\xlrrffr.exe

\??\c:\bnbbnt.exe

c:\bnbbnt.exe

\??\c:\1bnbbb.exe

c:\1bnbbb.exe

\??\c:\1pjjp.exe

c:\1pjjp.exe

\??\c:\jdppv.exe

c:\jdppv.exe

\??\c:\5lfxxxx.exe

c:\5lfxxxx.exe

\??\c:\5xlrrfr.exe

c:\5xlrrfr.exe

\??\c:\lfxrxfl.exe

c:\lfxrxfl.exe

\??\c:\nhbhtb.exe

c:\nhbhtb.exe

\??\c:\tntbhn.exe

c:\tntbhn.exe

\??\c:\vpdvj.exe

c:\vpdvj.exe

\??\c:\dvvdj.exe

c:\dvvdj.exe

\??\c:\jvdvd.exe

c:\jvdvd.exe

\??\c:\lflrlff.exe

c:\lflrlff.exe

\??\c:\5lrrxxx.exe

c:\5lrrxxx.exe

\??\c:\bnnnnt.exe

c:\bnnnnt.exe

\??\c:\bnhntt.exe

c:\bnhntt.exe

\??\c:\dpddv.exe

c:\dpddv.exe

\??\c:\vpjpp.exe

c:\vpjpp.exe

\??\c:\pjpdp.exe

c:\pjpdp.exe

\??\c:\lxlrlll.exe

c:\lxlrlll.exe

\??\c:\ffrlrll.exe

c:\ffrlrll.exe

\??\c:\xlrrfxr.exe

c:\xlrrfxr.exe

\??\c:\tntbhn.exe

c:\tntbhn.exe

\??\c:\nbhnbh.exe

c:\nbhnbh.exe

\??\c:\vddpj.exe

c:\vddpj.exe

\??\c:\jvjpd.exe

c:\jvjpd.exe

\??\c:\vpvdp.exe

c:\vpvdp.exe

\??\c:\frlrlrx.exe

c:\frlrlrx.exe

\??\c:\fxxflrf.exe

c:\fxxflrf.exe

\??\c:\btbbhn.exe

c:\btbbhn.exe

\??\c:\nhttbh.exe

c:\nhttbh.exe

\??\c:\vjddj.exe

c:\vjddj.exe

\??\c:\dvjpv.exe

c:\dvjpv.exe

\??\c:\fxlxffr.exe

c:\fxlxffr.exe

\??\c:\fxrlrxf.exe

c:\fxrlrxf.exe

\??\c:\rlflfff.exe

c:\rlflfff.exe

\??\c:\1tnbbt.exe

c:\1tnbbt.exe

\??\c:\hbthnt.exe

c:\hbthnt.exe

\??\c:\dvjvv.exe

c:\dvjvv.exe

\??\c:\vpjdd.exe

c:\vpjdd.exe

\??\c:\jdvjp.exe

c:\jdvjp.exe

\??\c:\fxfllrx.exe

c:\fxfllrx.exe

\??\c:\5fxrxfr.exe

c:\5fxrxfr.exe

\??\c:\rrffxrx.exe

c:\rrffxrx.exe

\??\c:\hbhtbb.exe

c:\hbhtbb.exe

\??\c:\nnbhnb.exe

c:\nnbhnb.exe

\??\c:\1dppj.exe

c:\1dppj.exe

\??\c:\1pjvd.exe

c:\1pjvd.exe

\??\c:\fxrxllr.exe

c:\fxrxllr.exe

\??\c:\7xlrxxl.exe

c:\7xlrxxl.exe

\??\c:\bbtbnn.exe

c:\bbtbnn.exe

\??\c:\nhttnb.exe

c:\nhttnb.exe

\??\c:\jdjpd.exe

c:\jdjpd.exe

\??\c:\dpppv.exe

c:\dpppv.exe

\??\c:\xlrrrll.exe

c:\xlrrrll.exe

\??\c:\1fxlrrf.exe

c:\1fxlrrf.exe

\??\c:\hnbhhb.exe

c:\hnbhhb.exe

\??\c:\tthhtb.exe

c:\tthhtb.exe

\??\c:\nbnbbh.exe

c:\nbnbbh.exe

\??\c:\pjvpv.exe

c:\pjvpv.exe

\??\c:\3dvdd.exe

c:\3dvdd.exe

\??\c:\xrffffl.exe

c:\xrffffl.exe

\??\c:\fxxrlxl.exe

c:\fxxrlxl.exe

\??\c:\tnbbnn.exe

c:\tnbbnn.exe

\??\c:\9nnbhh.exe

c:\9nnbhh.exe

\??\c:\7thhhh.exe

c:\7thhhh.exe

\??\c:\ddjdj.exe

c:\ddjdj.exe

\??\c:\5dpdd.exe

c:\5dpdd.exe

\??\c:\pjvdj.exe

c:\pjvdj.exe

\??\c:\frflllr.exe

c:\frflllr.exe

\??\c:\7rffrrf.exe

c:\7rffrrf.exe

\??\c:\5bttbb.exe

c:\5bttbb.exe

\??\c:\9hhnbh.exe

c:\9hhnbh.exe

\??\c:\nhttbb.exe

c:\nhttbb.exe

\??\c:\5pjvd.exe

c:\5pjvd.exe

\??\c:\pjpvv.exe

c:\pjpvv.exe

\??\c:\fxxlxfl.exe

c:\fxxlxfl.exe

\??\c:\ffrflll.exe

c:\ffrflll.exe

\??\c:\ffxrffl.exe

c:\ffxrffl.exe

\??\c:\thttnn.exe

c:\thttnn.exe

\??\c:\1thhbn.exe

c:\1thhbn.exe

\??\c:\pjvpp.exe

c:\pjvpp.exe

\??\c:\1pppv.exe

c:\1pppv.exe

\??\c:\xfrfflf.exe

c:\xfrfflf.exe

\??\c:\1xrrxxx.exe

c:\1xrrxxx.exe

\??\c:\lxxfrrx.exe

c:\lxxfrrx.exe

\??\c:\hbttbb.exe

c:\hbttbb.exe

\??\c:\nhbbbh.exe

c:\nhbbbh.exe

\??\c:\tnbhnn.exe

c:\tnbhnn.exe

\??\c:\5vpvd.exe

c:\5vpvd.exe

\??\c:\dvvdj.exe

c:\dvvdj.exe

\??\c:\xrllfrl.exe

c:\xrllfrl.exe

\??\c:\lfxfrrx.exe

c:\lfxfrrx.exe

\??\c:\htntbb.exe

c:\htntbb.exe

\??\c:\tnbntt.exe

c:\tnbntt.exe

\??\c:\5tnhth.exe

c:\5tnhth.exe

\??\c:\dpppv.exe

c:\dpppv.exe

\??\c:\dppjp.exe

c:\dppjp.exe

\??\c:\rfxlllr.exe

c:\rfxlllr.exe

\??\c:\fxrrxxf.exe

c:\fxrrxxf.exe

\??\c:\rrlrxxf.exe

c:\rrlrxxf.exe

\??\c:\3tthbb.exe

c:\3tthbb.exe

\??\c:\thbhth.exe

c:\thbhth.exe

\??\c:\jvppd.exe

c:\jvppd.exe

\??\c:\vvppp.exe

c:\vvppp.exe

\??\c:\7rlxxfr.exe

c:\7rlxxfr.exe

\??\c:\lfxllxf.exe

c:\lfxllxf.exe

\??\c:\hhbntt.exe

c:\hhbntt.exe

\??\c:\bhthht.exe

c:\bhthht.exe

\??\c:\7bttnn.exe

c:\7bttnn.exe

\??\c:\dvppj.exe

c:\dvppj.exe

\??\c:\jvddj.exe

c:\jvddj.exe

\??\c:\3llfrxr.exe

c:\3llfrxr.exe

\??\c:\xlxrlxx.exe

c:\xlxrlxx.exe

\??\c:\9lfxffl.exe

c:\9lfxffl.exe

\??\c:\nhntbt.exe

c:\nhntbt.exe

\??\c:\5bttbb.exe

c:\5bttbb.exe

\??\c:\tnbthn.exe

c:\tnbthn.exe

\??\c:\pvvvp.exe

c:\pvvvp.exe

\??\c:\jvddv.exe

c:\jvddv.exe

\??\c:\xrffffl.exe

c:\xrffffl.exe

\??\c:\7xflffl.exe

c:\7xflffl.exe

\??\c:\xlxrxxf.exe

c:\xlxrxxf.exe

\??\c:\htnthn.exe

c:\htnthn.exe

\??\c:\btntbh.exe

c:\btntbh.exe

\??\c:\5vvpv.exe

c:\5vvpv.exe

\??\c:\7dvvd.exe

c:\7dvvd.exe

\??\c:\vpvvp.exe

c:\vpvvp.exe

\??\c:\fxllrxf.exe

c:\fxllrxf.exe

\??\c:\3lrlrrx.exe

c:\3lrlrrx.exe

\??\c:\xrllllx.exe

c:\xrllllx.exe

\??\c:\hbntnt.exe

c:\hbntnt.exe

\??\c:\thtttt.exe

c:\thtttt.exe

\??\c:\pjvvd.exe

c:\pjvvd.exe

\??\c:\ddpvj.exe

c:\ddpvj.exe

\??\c:\frffrrf.exe

c:\frffrrf.exe

\??\c:\xxrxxrf.exe

c:\xxrxxrf.exe

\??\c:\rfrfffx.exe

c:\rfrfffx.exe

\??\c:\3hbnbh.exe

c:\3hbnbh.exe

\??\c:\bnttnn.exe

c:\bnttnn.exe

\??\c:\jjvdj.exe

c:\jjvdj.exe

\??\c:\jvvdd.exe

c:\jvvdd.exe

\??\c:\vdpdd.exe

c:\vdpdd.exe

\??\c:\lflxfrx.exe

c:\lflxfrx.exe

\??\c:\lrrfxlf.exe

c:\lrrfxlf.exe

\??\c:\tnhhhb.exe

c:\tnhhhb.exe

\??\c:\hthhbt.exe

c:\hthhbt.exe

\??\c:\3nhbtn.exe

c:\3nhbtn.exe

\??\c:\5djpv.exe

c:\5djpv.exe

\??\c:\3dpdd.exe

c:\3dpdd.exe

\??\c:\vjddp.exe

c:\vjddp.exe

\??\c:\lxffxrl.exe

c:\lxffxrl.exe

\??\c:\5xrrxxx.exe

c:\5xrrxxx.exe

\??\c:\xrxxrll.exe

c:\xrxxrll.exe

\??\c:\nthhnn.exe

c:\nthhnn.exe

\??\c:\nnbbnn.exe

c:\nnbbnn.exe

\??\c:\1vvvd.exe

c:\1vvvd.exe

\??\c:\jdvvd.exe

c:\jdvvd.exe

\??\c:\xxllfxf.exe

c:\xxllfxf.exe

\??\c:\rlrxfrr.exe

c:\rlrxfrr.exe

\??\c:\rlflrrx.exe

c:\rlflrrx.exe

\??\c:\bhnttt.exe

c:\bhnttt.exe

\??\c:\ttntnb.exe

c:\ttntnb.exe

\??\c:\nbnnnh.exe

c:\nbnnnh.exe

\??\c:\jdppv.exe

c:\jdppv.exe

\??\c:\5ppvj.exe

c:\5ppvj.exe

\??\c:\fxxfrfr.exe

c:\fxxfrfr.exe

\??\c:\xxxflfl.exe

c:\xxxflfl.exe

\??\c:\tnbbtt.exe

c:\tnbbtt.exe

\??\c:\9ddjp.exe

c:\9ddjp.exe

\??\c:\dvddp.exe

c:\dvddp.exe

\??\c:\flrlrxf.exe

c:\flrlrxf.exe

\??\c:\rlxflrr.exe

c:\rlxflrr.exe

\??\c:\xrlxlxr.exe

c:\xrlxlxr.exe

\??\c:\hbthhh.exe

c:\hbthhh.exe

\??\c:\tntnbb.exe

c:\tntnbb.exe

\??\c:\7hbbnn.exe

c:\7hbbnn.exe

\??\c:\jpvpj.exe

c:\jpvpj.exe

\??\c:\dvjjp.exe

c:\dvjjp.exe

\??\c:\xlxxxff.exe

c:\xlxxxff.exe

\??\c:\9rlrxrr.exe

c:\9rlrxrr.exe

\??\c:\7xrrxrx.exe

c:\7xrrxrx.exe

\??\c:\5tthnn.exe

c:\5tthnn.exe

\??\c:\htbttn.exe

c:\htbttn.exe

\??\c:\7ttbnn.exe

c:\7ttbnn.exe

\??\c:\pdppv.exe

c:\pdppv.exe

\??\c:\vvjvj.exe

c:\vvjvj.exe

\??\c:\rxflrrx.exe

c:\rxflrrx.exe

\??\c:\7lrrflr.exe

c:\7lrrflr.exe

\??\c:\httttn.exe

c:\httttn.exe

\??\c:\hbhtbb.exe

c:\hbhtbb.exe

\??\c:\bhnhht.exe

c:\bhnhht.exe

\??\c:\pjppp.exe

c:\pjppp.exe

\??\c:\dppdd.exe

c:\dppdd.exe

\??\c:\jvdjj.exe

c:\jvdjj.exe

\??\c:\xlxrxxf.exe

c:\xlxrxxf.exe

\??\c:\xllrxfl.exe

c:\xllrxfl.exe

\??\c:\7htthh.exe

c:\7htthh.exe

\??\c:\nhhntt.exe

c:\nhhntt.exe

\??\c:\nbbnnh.exe

c:\nbbnnh.exe

\??\c:\dvppv.exe

c:\dvppv.exe

\??\c:\7jvjj.exe

c:\7jvjj.exe

\??\c:\3jvpv.exe

c:\3jvpv.exe

\??\c:\frxlxrx.exe

c:\frxlxrx.exe

\??\c:\1lrrxll.exe

c:\1lrrxll.exe

\??\c:\thhbtn.exe

c:\thhbtn.exe

\??\c:\btbbhb.exe

c:\btbbhb.exe

\??\c:\ppjvv.exe

c:\ppjvv.exe

\??\c:\7vjdd.exe

c:\7vjdd.exe

\??\c:\pddvp.exe

c:\pddvp.exe

\??\c:\fxlxffl.exe

c:\fxlxffl.exe

\??\c:\3xrxfrx.exe

c:\3xrxfrx.exe

\??\c:\7rlxrxf.exe

c:\7rlxrxf.exe

\??\c:\3tbttn.exe

c:\3tbttn.exe

\??\c:\nnhtnb.exe

c:\nnhtnb.exe

\??\c:\1dvvp.exe

c:\1dvvp.exe

\??\c:\dvddd.exe

c:\dvddd.exe

\??\c:\rlrxxxx.exe

c:\rlrxxxx.exe

\??\c:\xrrffrf.exe

c:\xrrffrf.exe

\??\c:\xrlxlrf.exe

c:\xrlxlrf.exe

\??\c:\nbhhhn.exe

c:\nbhhhn.exe

\??\c:\nhbbtt.exe

c:\nhbbtt.exe

\??\c:\pdppp.exe

c:\pdppp.exe

\??\c:\pjddj.exe

c:\pjddj.exe

\??\c:\fxflrrx.exe

c:\fxflrrx.exe

\??\c:\lxfflll.exe

c:\lxfflll.exe

\??\c:\7frrfxf.exe

c:\7frrfxf.exe

\??\c:\3bnntt.exe

c:\3bnntt.exe

\??\c:\9thhth.exe

c:\9thhth.exe

\??\c:\hbnntt.exe

c:\hbnntt.exe

\??\c:\dpdjv.exe

c:\dpdjv.exe

\??\c:\3vjdd.exe

c:\3vjdd.exe

\??\c:\rfxxffl.exe

c:\rfxxffl.exe

\??\c:\7rxxfff.exe

c:\7rxxfff.exe

\??\c:\frfrlll.exe

c:\frfrlll.exe

\??\c:\htbhhh.exe

c:\htbhhh.exe

\??\c:\thtbtn.exe

c:\thtbtn.exe

\??\c:\7pjjd.exe

c:\7pjjd.exe

\??\c:\3pjjd.exe

c:\3pjjd.exe

\??\c:\vjvdd.exe

c:\vjvdd.exe

\??\c:\xrxxfxx.exe

c:\xrxxfxx.exe

\??\c:\rlrrrff.exe

c:\rlrrrff.exe

\??\c:\rfxrrxf.exe

c:\rfxrrxf.exe

\??\c:\hthbhh.exe

c:\hthbhh.exe

\??\c:\thtbbb.exe

c:\thtbbb.exe

\??\c:\hbnnhh.exe

c:\hbnnhh.exe

\??\c:\3jvvv.exe

c:\3jvvv.exe

\??\c:\pdppp.exe

c:\pdppp.exe

\??\c:\lfxxrxx.exe

c:\lfxxrxx.exe

\??\c:\xrxfrrx.exe

c:\xrxfrrx.exe

\??\c:\9nhhbb.exe

c:\9nhhbb.exe

\??\c:\hbnttb.exe

c:\hbnttb.exe

\??\c:\nbtnhh.exe

c:\nbtnhh.exe

\??\c:\jvjdd.exe

c:\jvjdd.exe

\??\c:\djppj.exe

c:\djppj.exe

\??\c:\lfxxxxl.exe

c:\lfxxxxl.exe

\??\c:\lxffffx.exe

c:\lxffffx.exe

\??\c:\9thbhh.exe

c:\9thbhh.exe

\??\c:\bnttbb.exe

c:\bnttbb.exe

\??\c:\bnttnb.exe

c:\bnttnb.exe

\??\c:\3pvvd.exe

c:\3pvvd.exe

\??\c:\pdjvv.exe

c:\pdjvv.exe

\??\c:\lflxrrr.exe

c:\lflxrrr.exe

\??\c:\rlrxffl.exe

c:\rlrxffl.exe

\??\c:\rfrlrll.exe

c:\rfrlrll.exe

\??\c:\bthhhb.exe

c:\bthhhb.exe

\??\c:\9tnbtn.exe

c:\9tnbtn.exe

\??\c:\nbtntt.exe

c:\nbtntt.exe

\??\c:\9pvdj.exe

c:\9pvdj.exe

\??\c:\5jvpp.exe

c:\5jvpp.exe

\??\c:\fxrllrx.exe

c:\fxrllrx.exe

\??\c:\3lxxfxf.exe

c:\3lxxfxf.exe

\??\c:\nhthbh.exe

c:\nhthbh.exe

\??\c:\hbhhbh.exe

c:\hbhhbh.exe

\??\c:\9nnbbh.exe

c:\9nnbbh.exe

\??\c:\7vpvd.exe

c:\7vpvd.exe

\??\c:\vjjjp.exe

c:\vjjjp.exe

\??\c:\lfrrffr.exe

c:\lfrrffr.exe

\??\c:\3xxxxfl.exe

c:\3xxxxfl.exe

\??\c:\7rlxrxf.exe

c:\7rlxrxf.exe

\??\c:\nhtbnh.exe

c:\nhtbnh.exe

\??\c:\thnbbn.exe

c:\thnbbn.exe

\??\c:\dpdjp.exe

c:\dpdjp.exe

\??\c:\5vjvj.exe

c:\5vjvj.exe

\??\c:\lfllrrl.exe

c:\lfllrrl.exe

\??\c:\fxfrxxf.exe

c:\fxfrxxf.exe

\??\c:\lrxrxxx.exe

c:\lrxrxxx.exe

\??\c:\tnttbb.exe

c:\tnttbb.exe

\??\c:\3nhttb.exe

c:\3nhttb.exe

\??\c:\5dpvd.exe

c:\5dpvd.exe

\??\c:\jvppv.exe

c:\jvppv.exe

\??\c:\vpvvv.exe

c:\vpvvv.exe

\??\c:\fxlrxxf.exe

c:\fxlrxxf.exe

\??\c:\1xxxxxl.exe

c:\1xxxxxl.exe

\??\c:\nbbbbb.exe

c:\nbbbbb.exe

\??\c:\hhbhtn.exe

c:\hhbhtn.exe

\??\c:\dvjvd.exe

c:\dvjvd.exe

\??\c:\3pjjp.exe

c:\3pjjp.exe

\??\c:\xfxxlfx.exe

c:\xfxxlfx.exe

\??\c:\3rlxffl.exe

c:\3rlxffl.exe

\??\c:\rlffrrl.exe

c:\rlffrrl.exe

\??\c:\1bhntb.exe

c:\1bhntb.exe

\??\c:\1bnhhb.exe

c:\1bnhhb.exe

\??\c:\dpddd.exe

c:\dpddd.exe

\??\c:\jvpjd.exe

c:\jvpjd.exe

\??\c:\frflrlr.exe

c:\frflrlr.exe

\??\c:\5llxxxx.exe

c:\5llxxxx.exe

\??\c:\bthhtn.exe

c:\bthhtn.exe

\??\c:\1btttt.exe

c:\1btttt.exe

\??\c:\nbnhtt.exe

c:\nbnhtt.exe

\??\c:\3dvdd.exe

c:\3dvdd.exe

\??\c:\ddjdd.exe

c:\ddjdd.exe

\??\c:\xrrxfxf.exe

c:\xrrxfxf.exe

\??\c:\frlllrf.exe

c:\frlllrf.exe

\??\c:\tthtbb.exe

c:\tthtbb.exe

\??\c:\7thnbb.exe

c:\7thnbb.exe

\??\c:\bhnbnn.exe

c:\bhnbnn.exe

\??\c:\dpddv.exe

c:\dpddv.exe

\??\c:\dpvdv.exe

c:\dpvdv.exe

\??\c:\lfxxfxl.exe

c:\lfxxfxl.exe

\??\c:\frxxxxr.exe

c:\frxxxxr.exe

\??\c:\bbntbb.exe

c:\bbntbb.exe

\??\c:\nhbnnn.exe

c:\nhbnnn.exe

\??\c:\vpvvd.exe

c:\vpvvd.exe

\??\c:\jvjjj.exe

c:\jvjjj.exe

\??\c:\5pjpp.exe

c:\5pjpp.exe

\??\c:\lflrxrf.exe

c:\lflrxrf.exe

\??\c:\rlfffff.exe

c:\rlfffff.exe

\??\c:\nbnhbn.exe

c:\nbnhbn.exe

\??\c:\btnnbb.exe

c:\btnnbb.exe

\??\c:\nhthbb.exe

c:\nhthbb.exe

\??\c:\jdpvv.exe

c:\jdpvv.exe

\??\c:\7jppp.exe

c:\7jppp.exe

\??\c:\rlxflxf.exe

c:\rlxflxf.exe

\??\c:\flxffrl.exe

c:\flxffrl.exe

\??\c:\tnhbnt.exe

c:\tnhbnt.exe

\??\c:\btnnnn.exe

c:\btnnnn.exe

\??\c:\5dvvv.exe

c:\5dvvv.exe

\??\c:\vpdvv.exe

c:\vpdvv.exe

\??\c:\jvjpd.exe

c:\jvjpd.exe

\??\c:\xrrfrlf.exe

c:\xrrfrlf.exe

\??\c:\frfxfxx.exe

c:\frfxfxx.exe

\??\c:\hhhttb.exe

c:\hhhttb.exe

\??\c:\5nbhhn.exe

c:\5nbhhn.exe

\??\c:\pdppd.exe

c:\pdppd.exe

\??\c:\vjvvd.exe

c:\vjvvd.exe

\??\c:\xlxlfff.exe

c:\xlxlfff.exe

\??\c:\fxlxrrx.exe

c:\fxlxrrx.exe

\??\c:\btnhnt.exe

c:\btnhnt.exe

\??\c:\hbntbh.exe

c:\hbntbh.exe

\??\c:\hbtnhh.exe

c:\hbtnhh.exe

\??\c:\jdjpp.exe

c:\jdjpp.exe

\??\c:\jdpjj.exe

c:\jdpjj.exe

\??\c:\9xrllrf.exe

c:\9xrllrf.exe

\??\c:\1lfflfl.exe

c:\1lfflfl.exe

\??\c:\bntttn.exe

c:\bntttn.exe

\??\c:\3thtnn.exe

c:\3thtnn.exe

\??\c:\jdppd.exe

c:\jdppd.exe

\??\c:\dvpvv.exe

c:\dvpvv.exe

\??\c:\9lxxrrx.exe

c:\9lxxrrx.exe

\??\c:\xlxxlff.exe

c:\xlxxlff.exe

\??\c:\rflrxxl.exe

c:\rflrxxl.exe

\??\c:\7bnntn.exe

c:\7bnntn.exe

\??\c:\9bthnn.exe

c:\9bthnn.exe

\??\c:\hhnnth.exe

c:\hhnnth.exe

\??\c:\jvvpp.exe

c:\jvvpp.exe

\??\c:\1vpjp.exe

c:\1vpjp.exe

\??\c:\pjvjd.exe

c:\pjvjd.exe

\??\c:\3llxrrf.exe

c:\3llxrrf.exe

\??\c:\rrflllr.exe

c:\rrflllr.exe

\??\c:\btnttt.exe

c:\btnttt.exe

\??\c:\hhnbtt.exe

c:\hhnbtt.exe

\??\c:\9bhhbh.exe

c:\9bhhbh.exe

\??\c:\pjpjp.exe

c:\pjpjp.exe

\??\c:\vpjpd.exe

c:\vpjpd.exe

\??\c:\lfrxffl.exe

c:\lfrxffl.exe

\??\c:\xxxlfrx.exe

c:\xxxlfrx.exe

\??\c:\nthhbn.exe

c:\nthhbn.exe

\??\c:\htbbbt.exe

c:\htbbbt.exe

\??\c:\1dvdd.exe

c:\1dvdd.exe

\??\c:\dvvjj.exe

c:\dvvjj.exe

\??\c:\9ppdp.exe

c:\9ppdp.exe

\??\c:\xlxflrx.exe

c:\xlxflrx.exe

\??\c:\rrxrflr.exe

c:\rrxrflr.exe

\??\c:\nbtntb.exe

c:\nbtntb.exe

\??\c:\nbbnnh.exe

c:\nbbnnh.exe

\??\c:\7dpvv.exe

c:\7dpvv.exe

\??\c:\jjjpj.exe

c:\jjjpj.exe

\??\c:\lrxxfxr.exe

c:\lrxxfxr.exe

\??\c:\lrrrfxf.exe

c:\lrrrfxf.exe

\??\c:\bthhhh.exe

c:\bthhhh.exe

\??\c:\7thtnh.exe

c:\7thtnh.exe

\??\c:\jdpdv.exe

c:\jdpdv.exe

\??\c:\3djvd.exe

c:\3djvd.exe

\??\c:\lrlxrff.exe

c:\lrlxrff.exe

\??\c:\lxlflfl.exe

c:\lxlflfl.exe

\??\c:\xlfllll.exe

c:\xlfllll.exe

\??\c:\hbntnn.exe

c:\hbntnn.exe

\??\c:\5nhhnh.exe

c:\5nhhnh.exe

\??\c:\jddpj.exe

c:\jddpj.exe

\??\c:\jdpdd.exe

c:\jdpdd.exe

\??\c:\dpjdd.exe

c:\dpjdd.exe

\??\c:\xrxfrrr.exe

c:\xrxfrrr.exe

\??\c:\5lxxfxf.exe

c:\5lxxfxf.exe

\??\c:\nhhhbn.exe

c:\nhhhbn.exe

\??\c:\btbnbb.exe

c:\btbnbb.exe

\??\c:\bbnttn.exe

c:\bbnttn.exe

\??\c:\pjpjj.exe

c:\pjpjj.exe

\??\c:\3dpdj.exe

c:\3dpdj.exe

\??\c:\5rrfxrf.exe

c:\5rrfxrf.exe

\??\c:\rfrfrlx.exe

c:\rfrfrlx.exe

\??\c:\nbbtbb.exe

c:\nbbtbb.exe

\??\c:\bbbbtb.exe

c:\bbbbtb.exe

Network

N/A

Files

memory/2504-0-0x0000000000400000-0x0000000000427000-memory.dmp

C:\lfrrffl.exe

MD5 293307767c02b660fdd42205b51be672
SHA1 e418fca7b09fa8ff8251767ff8ef0668eb3a3032
SHA256 e4c28ab3193e55dace4615ff3c3773e12fa7952de83b3bc286d5b4728f60d866
SHA512 11b97d70f592b0256855ab111db3eb7fa2e626f6369c1d3558261b5303de21c0e4ec0e73dc7d5034443f734ea8949953fbd218eda51468f3e9b24e706a8ab745

memory/2504-7-0x0000000000220000-0x0000000000247000-memory.dmp

memory/2544-9-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2504-6-0x0000000000400000-0x0000000000427000-memory.dmp

C:\5dvjp.exe

MD5 21ebf23de28b67ed694994ed6e701a93
SHA1 9e5f42e2df1ac89b1c2986539d6ae9653c933a40
SHA256 094a2299e438c16ae85126940e1c6e75dec3a2d2b830a10056c1a0e17ec181ec
SHA512 41da304bd588a17c679e9ac982798c52287b9b23b089d67905c2fabef6cede6397b06f12c6f69a1af03717b9442b2df3ff546affa1a35ce012e1e7b6f7ad173a

memory/2544-18-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2544-16-0x00000000002B0000-0x00000000002D7000-memory.dmp

C:\vvvjp.exe

MD5 df8a2220a9228afd9b5c6e7422f12908
SHA1 1a83798cfddb764020d2631013e6316a3bf8c3a2
SHA256 7f721adc1cf214bde66a73f8c1b1169a6473f511e7ac77e4c9b952eaa5ea1f37
SHA512 90ca8e568c02ff7c632fa79f119500faf50dcc3c190056babd544ad4372540bf1de1d3aff974491e0c80f89135b740d0f12df58aa42b85f8e88755a83b7f5ff8

memory/2068-22-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2132-33-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2504-36-0x0000000000220000-0x0000000000247000-memory.dmp

C:\7rrfxxf.exe

MD5 8ca7fb85f870b75c4a8150109ac0fcce
SHA1 76c1e26bc98a622d5426ffc67c05e9973ba2c939
SHA256 1c377bded9a6850558a1bb80c66bc44166241011b1bd84c32ffd8123859e80d4
SHA512 21c41e5f0b24cfa53d149857833c58264a164e9db1bae53d4835948d9b7fb5ad7f5fa4c7e8499e1bfef2599c62ca13b2394f68ba6fb8aebc4a0715ecf2d79211

memory/2132-34-0x0000000000220000-0x0000000000247000-memory.dmp

memory/2664-44-0x0000000000400000-0x0000000000427000-memory.dmp

C:\bbnthn.exe

MD5 ded7545444ade49dbdebe30adb2df2b7
SHA1 93723e1b28e37c74ab1d13ee75f6ecaf717d82c3
SHA256 ca97dd51b665024a6fac1ba9d66bd72a1cc00a1cf83075464d3762dd1e75cc1e
SHA512 e1a5558991fe66f1ec23fc56018d0d9e3739b8dd0a40b56abd8e7b6b4628c3c4c63238fa4709b4aace0575a527e264449ed54d3e64fc92a8aed4063f92b97bda

memory/592-51-0x00000000002B0000-0x00000000002D7000-memory.dmp

\??\c:\vpvdj.exe

MD5 f346a9e68599c7858302917c28b677cb
SHA1 dd249a1711989f858c26ff90620c858f1f0de4aa
SHA256 579de8c206710a0962b4f2985cc301d2227271beff306f2e99c71daec7d0103a
SHA512 45e4e4ae96d4dd0ea6e40906591cb6833d83316b8f744248d9a444382391b76ef3b40696126e16297e5bb4c0ea6abd6b20a30dbb432de8de67b66de5cb1063cf

C:\jdvvv.exe

MD5 b16b1b95faef2b98278d58cf60f4ceea
SHA1 f392a0323842dfe1be2faaf429efd1fb5fb08777
SHA256 4e93ddeeeab77e2282206f23ce22533eff5462a30d697d7e7d102deb1be7f968
SHA512 dc6db599a1f41c12e3d56e1e2857e813640032095db6e92f581a13a6fbae87ed0fe5758e0bd1190ef3224e49da1908f601ba089e38dd2dce95b75bcbd76509b7

memory/2848-62-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2132-61-0x0000000000220000-0x0000000000247000-memory.dmp

memory/2720-59-0x0000000000400000-0x0000000000427000-memory.dmp

C:\fxrxlxx.exe

MD5 45c80657bf71dbce0516458858a2f63b
SHA1 b3d56cc1bfb9e995c27a1a1007a14725371775bf
SHA256 a71239c936e7a2ee0892004313b86c71738cc4cc155e0fecc409baf4ce1165d5
SHA512 245d82d64b0d252d075adf190490267b2b920739efbd43ffa99297a86bc0e1dd680906044c4bf59f51df8961fe85ad058cfbf991e6b0053cbe616fc4a60c27d3

memory/2848-70-0x0000000000400000-0x0000000000427000-memory.dmp

C:\lxrxxfl.exe

MD5 d17ed302c5c6233863d7670ddf079502
SHA1 3676d1c846b897d88410a95a7d53ad31c7fb35b2
SHA256 cbb8b19454b727bbabc6aa2b1c08658fec5a446503aca59f7dba11a0c2b5b59d
SHA512 1679494d75862487d184f91dc527bc6887baddcd08e6a5d93dcb5e01ecad38316cc716ac245a436565c813b09d89527809cd7a935cb2e86ecc6e4c0993400af5

memory/2780-78-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2780-77-0x0000000000220000-0x0000000000247000-memory.dmp

C:\hthhnn.exe

MD5 b8e6f3edfa77ee4552e7e2a01f4c0a1d
SHA1 d1b74fa0ee333023ade531c32a4b8eb7decfc97c
SHA256 23966edc501cbec88524c734cfd860573dcd7ead5f72c0143e1e2a49e1ec6eb5
SHA512 6596c33c613bf1339e481512aa6d727878c66f217c5dd00ad574c99fbd86583ad5f6315aed99ca9735484e82b1cef19b9708847e641cecdc4bb6e1273ad64755

memory/2876-87-0x0000000000400000-0x0000000000427000-memory.dmp

C:\dpdvj.exe

MD5 b336d084d2bc658dd5098d0202d2ef44
SHA1 941c6430f3d5f5b01e963ad4eec8d5dc8cb5c3be
SHA256 f187c970f5e873285b8a280c1417a7c9d075fe1febe2f3d01ca9b5c92b8fb46c
SHA512 34667a3a0ba1734cb29f65412c159d1bb3fe33a43f23e40f6188ae858ada6c6401c1356611c2ebc5f845fad1912a01057aa45f1eeda826e9740a23f2fb96a880

memory/2376-94-0x0000000000400000-0x0000000000427000-memory.dmp

C:\lxflrrx.exe

MD5 717ead2040edcced7234be1cba345b6d
SHA1 e7a5aeb33ae145da1ab5ba1019ab02629b70b3a5
SHA256 fce9a83c7299594ae9f5c69b05c029b1d52edbb80410c11cffb43d479cf84553
SHA512 b8fed57e32785fef494504969a6f1626b27f3407fc60df330523dba31321e33aa392be02ecefed0d267808ee9a2ea0f32a016e36acfac9257ad9371377654cf1

memory/2580-102-0x0000000000220000-0x0000000000247000-memory.dmp

C:\1fxrflr.exe

MD5 9ed925d8d59d03fcd602ccbeebfc9de8
SHA1 e2c51fa703d355a856ed2e4467128ecf41503c95
SHA256 2a94da54a062e0f5bc97a9357b4eb831801f2a2da9e7e177506f8b121d887248
SHA512 4505521ba2a4c842599219c5fd6363f750a81f42bbd4c24a0fa283c0795c600c63d8bf8a2795604e03b146ba36859074c47da413468d455c8ee3666a72a3b5d7

C:\ttthnt.exe

MD5 269d1bd63bf7913cd312a521d266c37d
SHA1 be2d5c07e8ffb1075c9cb8a3dd533f90ffd356b2
SHA256 7deb0de331a856a1e471d3eb034e898d27507982499b557bf85ffac9173de6fa
SHA512 d0f450d91906e18409f18dc03b5fc5d600939ab1929bd49b18ee9696a24a3736eea7f8af0c39f083d3a20a379620253d596ed4ed744a993038e04829fbda1793

memory/768-118-0x0000000000400000-0x0000000000427000-memory.dmp

C:\httttt.exe

MD5 323a7c39e717b50f82f920255dbf561c
SHA1 97fcd510e10cafde4eba1929930938188197084f
SHA256 3ab325bf6fb0bfb62ca46de1ced4d90a90cd36678b6917d68cf3684e2150cca0
SHA512 738bcdb6a644f54c5177cb83772570d1ee9e3ca95e700c7853116cf9a56f8ba540f15578ee14b8ed4945a8da86acd01869e8f471878de734ded38edf02a7dfd0

memory/1544-125-0x0000000000400000-0x0000000000427000-memory.dmp

memory/1984-133-0x0000000000220000-0x0000000000247000-memory.dmp

\??\c:\ddddd.exe

MD5 cf725691e6a8128020215519616052bb
SHA1 c21f55acb4df2bda02f4e0c8db416690f684aaba
SHA256 2bb7b3eb0494660eb51f1faa3247a3862f4c3f8e252921622822046fbb55014b
SHA512 83a8446ae8415cd43ac1ec4d281a2b1fa16873329fac07ce184aee9b8f513f23b6ca90245c2f397a334fa0ae56bf098e845e8b2c6e9014e5219f6e940a302bf8

memory/2484-135-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2484-143-0x0000000000400000-0x0000000000427000-memory.dmp

C:\7rxxffl.exe

MD5 5bc86feef7685a369e020cd1e8ec08a1
SHA1 be55159723ffe68265e0ea8f7bd824620103e191
SHA256 d2a8f60c01c1489277610ef0575e01539971feb5162c74fd512e8295270177f7
SHA512 c79823218ca1ddd422e4f7b3c257fe5e7d5988000481ddd4208f70b31ca81c6510f36255be89ec17842dcb9b5c12341f035bf5187c63d1dfddae934c74bbc265

memory/1636-150-0x0000000000400000-0x0000000000427000-memory.dmp

C:\frfrxxx.exe

MD5 f38713cd2ccb7eea57a5359cc590d1a6
SHA1 d6a60e4862aa725826ad8ea54eaa44f264b60710
SHA256 9ed01f44eb81a6409162e334f18f1506453a62d7f104e092a4400039681491f3
SHA512 ac6caf575a3bf77cd575078bbfd76154dec8bc0f630dbf0d721dbc2171c9fa3fb24822d572103053a873cd015438279912f99cabfa82b708d969755df879dec0

memory/1636-152-0x0000000000220000-0x0000000000247000-memory.dmp

C:\tnhhnn.exe

MD5 d8ff40f835786bfaa40ed6be12cfbc22
SHA1 04eb88b1fd91916bab7efbbd3a81d8b305f1973b
SHA256 688eeb99bdf4d8e5000ae1c0ad488a9598de53cb33c11c23cb2f38f82495199f
SHA512 b02259094e463f03f788ec43e0630c09424dc3b4781faa0ed7a92c27fa864229d1ced60325fdd3868226a39cdce0d0c6e7fba4c27c00acbd60691ae4f054978d

memory/1196-168-0x0000000000400000-0x0000000000427000-memory.dmp

\??\c:\tttbnt.exe

MD5 412adf9d0c7e09c6b4984ec14f93843a
SHA1 3eb567b9ef003426fe4d72a09c2fd2fa3f7c4b08
SHA256 dddb0092fbd106a5a739f809930083660fd17bd74769cce782081d3d72d0e321
SHA512 3c57d4eff10636483a69b1b4802386f5a17162c19a66235830e811bad96986e650ea89eebe00ab15b1964c6a9e03c505f31e1950649c5c7581942d17d46532dc

C:\5dvvj.exe

MD5 b4ffc6e2be1c3a52afe7890cbb3b18b5
SHA1 c84d8bdb37c596675de98f72ea162710f0d30483
SHA256 b0f91276315ed5673827883511d1ce641f1a3be1ed75022b1a92a14053e5494f
SHA512 afeac5cdd3a25f59a39d7b83ea7e23337952739785615af80364c60cdaab1d262fff8f77ace9f48c8dc40b7e69a9ca30a4f9ed76e8f18264f1239e8f0c474747

memory/2896-181-0x0000000000220000-0x0000000000247000-memory.dmp

C:\dvjvp.exe

MD5 dad4bdec951ec942108d5270e7210b27
SHA1 be67beeaf1f4ce9b8c9d6ea9924c011b46e2f241
SHA256 e2b1745577799490949203ebda88b16112d7366add2c56633abef767884c478e
SHA512 0ce20ae9e6287c84127c1da02c5e879c61b47b5a904bee37184f61fa901d9edb2692af30543fdb0ed1df47d9279d5f7bae79aeb92e46df06d4a8e2df969faa61

C:\xxrrlrx.exe

MD5 cddf6cabf9158d4081426715b220f1b8
SHA1 b875bafb89ea37f658bdda479cdee6cc6571de88
SHA256 801669ddb95b5722253e33e65c504c37e4794b8f743da214e5d435c640a3d225
SHA512 679fd0dc0a1788b5bafe1ab2a8f383b33d02e28e7295f0b128e61324065202564d6bc50b27879e8ec366ba0d6fc8ca2273d06d536472de0b453e799258ada14e

C:\lfxlxxr.exe

MD5 29198043204dc9f4cf1a38bfd2e6c7c5
SHA1 04c05259d833a8e0d3f062cff51ed3b00f707fe7
SHA256 d529ac79fb87696274982cc95a789586cb5eb5b200e28e7999ad0b5c5be607a9
SHA512 95149988dcc198182c8b0d3c81a1d8c5553f93b089059cc976a8d3d4cf1c429dab2db6f1ca9595b86bb8ec72d6799859d885baf8266b2e3ef623b39ba8e71310

memory/1800-196-0x0000000000220000-0x0000000000247000-memory.dmp

C:\htnntb.exe

MD5 ffc36c377359e037bc65dd4e701a7741
SHA1 f7538b31e7c97079d898dda3ced46df5aef84c4c
SHA256 88236bf1aea2d563ea3b3a865a5d7ac9b3e9ce37f103eb23f422ff4c6269f65c
SHA512 3391434063c1be5ba1a41b5a1c29e98dd6f733a314178da7ad5d0c4eaa70152fe836d33a89fb6f5f131e9213584bcfc7ef20dc672916fa2e881987af60451109

\??\c:\tnbnht.exe

MD5 d327734e9c8b780dae62950491ede5cc
SHA1 b88ea9217cbbf7225de88175179d5016980d047a
SHA256 af63b1dbcc1be968620d7385c47ffb3349ea52b400b2e3e56e2ba89d37a4579b
SHA512 6cd5195e1046fa7546d1fa474369a235818a983dde4a4f71d4fe50f857ff2fcc45f7347fdbaebef193ef1201caf341121c67307e2a6ece4f2d4e57190b6ffd29

memory/916-211-0x0000000000400000-0x0000000000427000-memory.dmp

C:\vpjjv.exe

MD5 7982fb2c2b87bdbf9ebd0042e1cb3755
SHA1 8620be9a0c9b18754a28a6d9bfaeb3d0fbd5b10b
SHA256 879c47df4e05e80fb4309cc8ea91c2b0e518cf157fec5c3186b2da2fd2a97a4c
SHA512 71e4ed72b458bee253bbea549709ce56695a01161927257a1333d2777e390d31d17809afcb6cd6322c0cd4d47e2a27669dffefe67e22989722af4cbcb9fdf8d4

memory/2292-219-0x00000000002B0000-0x00000000002D7000-memory.dmp

C:\rrflrrx.exe

MD5 8f31c11a4f60aaf1026e22e34a1fee7f
SHA1 0ab23bcd779cdec7b5850f1c01b09bc55c389979
SHA256 61d9bbdcea8f3cd0603327cd10131178ea97abfdc3edec35c4091ed7d09a94fb
SHA512 dcbe792eb140350fc881d2b645a3d2b255e6195ad41f16e0fdc5b8bb57cfcf7083ea345a95729a76d6a11d90ea2c0764fa5442ec2d8610c30383b5db66eebc56

memory/1832-227-0x0000000000400000-0x0000000000427000-memory.dmp

C:\xrlrxxx.exe

MD5 bfa787cbea9a1c2fa2fa43a39e740a7f
SHA1 5579bbe92c5abafa9a0ace823207993573dd1e0b
SHA256 4045d24937884addb12becfbe251ebfcbeaa8440fb552cae585835ebacd8dae2
SHA512 315f602b346637d8a1e46caa59416a9f3eda14f008f329e12c964decfd16f30915de91703e4ef028ab77321ac91afaafb0e4c1cb4c0ace108ac659253d64ff5c

C:\thnnbb.exe

MD5 d24e0e119d15facfb1f06f43a29f7759
SHA1 78aee77915fbc0c9afd11b68adec84aaf45a2e79
SHA256 9cd71d86f740a13365c358547f051b26d45c173b8ff94bb38d4056667ad3d465
SHA512 458eea3b4af26d487661c1cc9ba76f7ceef9bb7a3f46672139944c51c12f79223c566fef2825ad8af8cf4403c5485dca344dc7f55a2b02b9b9852892b964d04a

memory/2944-243-0x0000000000400000-0x0000000000427000-memory.dmp

C:\pvddd.exe

MD5 085d5594b6ab2639e04af2d190df0839
SHA1 a720e9c725491ae1c26d439dfb3ed51fe05a997f
SHA256 04a7ce66252be08cf2bfa842e86274c7a20290e8245f06714c6c477aa1bc74ee
SHA512 3645e271240cdef2bb367ccc8169601225965491fe8b9a71ed2aaed04eae5f0d00b3ed24a314703ab4ae21b23e6138776a1c13f1284381c91d7718a8452ecbb1

memory/1396-257-0x0000000000400000-0x0000000000427000-memory.dmp

C:\vpdjp.exe

MD5 ebc7d9d1f00db441a4e98ac92af73d88
SHA1 61e9e4e749865d7ae22d410d794a888d96fdd080
SHA256 b71371285a2f8a7f89afbef8a5667af4be9acca0a00e5440dbf8d4c288e4038f
SHA512 2607feb9204f24b6220e941e16b64fe13ec0e0ee63ee99ad15f670c16eb8113e56f51f8b68304861150e42c0b16753ff077189977b8454696b5c4a54080df2e3

memory/2120-265-0x0000000000400000-0x0000000000427000-memory.dmp

memory/880-271-0x0000000000400000-0x0000000000427000-memory.dmp

memory/1480-287-0x0000000000220000-0x0000000000247000-memory.dmp

memory/2552-293-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2548-299-0x00000000003C0000-0x00000000003E7000-memory.dmp

memory/2548-298-0x00000000003C0000-0x00000000003E7000-memory.dmp

memory/844-306-0x0000000000220000-0x0000000000247000-memory.dmp

memory/2084-312-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2664-318-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2016-329-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2952-335-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2812-341-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2384-372-0x0000000000400000-0x0000000000427000-memory.dmp

memory/1880-418-0x0000000000400000-0x0000000000427000-memory.dmp

memory/1948-424-0x0000000000230000-0x0000000000257000-memory.dmp

memory/1268-425-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2680-441-0x0000000000230000-0x0000000000257000-memory.dmp

memory/2832-447-0x0000000000220000-0x0000000000247000-memory.dmp

memory/2676-453-0x0000000000220000-0x0000000000247000-memory.dmp

memory/1732-459-0x0000000000400000-0x0000000000427000-memory.dmp

memory/1732-465-0x0000000000400000-0x0000000000427000-memory.dmp

memory/1608-473-0x0000000000400000-0x0000000000427000-memory.dmp

memory/444-472-0x0000000000220000-0x0000000000247000-memory.dmp

memory/444-471-0x0000000000220000-0x0000000000247000-memory.dmp

memory/1608-479-0x0000000000400000-0x0000000000427000-memory.dmp

memory/1992-490-0x00000000002A0000-0x00000000002C7000-memory.dmp

memory/2900-495-0x00000000002B0000-0x00000000002D7000-memory.dmp

memory/2284-497-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2284-503-0x00000000002C0000-0x00000000002E7000-memory.dmp

memory/2284-504-0x00000000002C0000-0x00000000002E7000-memory.dmp

memory/2260-510-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2096-532-0x00000000772C0000-0x00000000773BA000-memory.dmp

memory/2096-531-0x00000000771A0000-0x00000000772BF000-memory.dmp

memory/2064-538-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2320-574-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2588-595-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2776-606-0x0000000000400000-0x0000000000427000-memory.dmp

memory/3032-617-0x00000000001B0000-0x00000000001D7000-memory.dmp

memory/2744-623-0x0000000000220000-0x0000000000247000-memory.dmp

memory/1708-639-0x0000000000250000-0x0000000000277000-memory.dmp

memory/3028-645-0x00000000002B0000-0x00000000002D7000-memory.dmp

memory/1492-651-0x00000000005C0000-0x00000000005E7000-memory.dmp

memory/1636-672-0x0000000000220000-0x0000000000247000-memory.dmp

memory/2828-693-0x00000000002C0000-0x00000000002E7000-memory.dmp

memory/2828-692-0x00000000002C0000-0x00000000002E7000-memory.dmp

memory/2904-695-0x0000000000400000-0x0000000000427000-memory.dmp

memory/916-724-0x0000000000220000-0x0000000000247000-memory.dmp

memory/2216-787-0x00000000003C0000-0x00000000003E7000-memory.dmp

memory/2864-843-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2256-964-0x0000000000400000-0x0000000000427000-memory.dmp

memory/1832-995-0x0000000000220000-0x0000000000247000-memory.dmp

memory/1552-1016-0x0000000000400000-0x0000000000427000-memory.dmp

memory/1552-1022-0x0000000000220000-0x0000000000247000-memory.dmp

memory/1076-1058-0x0000000000220000-0x0000000000247000-memory.dmp

memory/2548-1074-0x0000000000220000-0x0000000000247000-memory.dmp

memory/2688-1085-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2688-1091-0x0000000000220000-0x0000000000247000-memory.dmp

memory/2608-1122-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2580-1133-0x0000000000220000-0x0000000000247000-memory.dmp

memory/3016-1143-0x00000000001B0000-0x00000000001D7000-memory.dmp

memory/2872-1150-0x0000000000220000-0x0000000000247000-memory.dmp

memory/1820-1161-0x00000000002C0000-0x00000000002E7000-memory.dmp

memory/2096-2036-0x00000000772C0000-0x00000000773BA000-memory.dmp

memory/2096-2035-0x00000000771A0000-0x00000000772BF000-memory.dmp

memory/2096-2767-0x00000000771A0000-0x00000000772BF000-memory.dmp

memory/2096-4474-0x00000000771A0000-0x00000000772BF000-memory.dmp

memory/2096-6186-0x00000000771A0000-0x00000000772BF000-memory.dmp

memory/2096-6187-0x00000000772C0000-0x00000000773BA000-memory.dmp

memory/2096-8159-0x00000000772C0000-0x00000000773BA000-memory.dmp

memory/2096-8158-0x00000000771A0000-0x00000000772BF000-memory.dmp

memory/2096-11095-0x00000000771A0000-0x00000000772BF000-memory.dmp

memory/2096-11096-0x00000000772C0000-0x00000000773BA000-memory.dmp

memory/2096-13538-0x00000000772C0000-0x00000000773BA000-memory.dmp

memory/2096-13537-0x00000000771A0000-0x00000000772BF000-memory.dmp

memory/2096-16454-0x00000000772C0000-0x00000000773BA000-memory.dmp

memory/2096-16453-0x00000000771A0000-0x00000000772BF000-memory.dmp

memory/2096-20901-0x00000000772C0000-0x00000000773BA000-memory.dmp

memory/2096-20900-0x00000000771A0000-0x00000000772BF000-memory.dmp

memory/2096-21173-0x00000000772C0000-0x00000000773BA000-memory.dmp

memory/2096-21172-0x00000000771A0000-0x00000000772BF000-memory.dmp

memory/2096-21445-0x00000000772C0000-0x00000000773BA000-memory.dmp

memory/2096-21444-0x00000000771A0000-0x00000000772BF000-memory.dmp

memory/2096-21717-0x00000000772C0000-0x00000000773BA000-memory.dmp

memory/2096-21716-0x00000000771A0000-0x00000000772BF000-memory.dmp

memory/2096-22524-0x00000000772C0000-0x00000000773BA000-memory.dmp

memory/2096-22523-0x00000000771A0000-0x00000000772BF000-memory.dmp

memory/2096-22796-0x00000000772C0000-0x00000000773BA000-memory.dmp

memory/2096-23067-0x00000000771A0000-0x00000000772BF000-memory.dmp

memory/2096-23068-0x00000000772C0000-0x00000000773BA000-memory.dmp

memory/2096-27418-0x00000000771A0000-0x00000000772BF000-memory.dmp

memory/2096-27419-0x00000000772C0000-0x00000000773BA000-memory.dmp

memory/2096-30691-0x00000000772C0000-0x00000000773BA000-memory.dmp

memory/2096-30690-0x00000000771A0000-0x00000000772BF000-memory.dmp

memory/2096-32598-0x00000000772C0000-0x00000000773BA000-memory.dmp

memory/2096-32597-0x00000000771A0000-0x00000000772BF000-memory.dmp

memory/2096-35890-0x00000000772C0000-0x00000000773BA000-memory.dmp

memory/2096-35889-0x00000000771A0000-0x00000000772BF000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-08 07:35

Reported

2025-01-08 07:38

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9350d86d2640e7caf05a04051c3f3cec.exe"

Signatures

Blackmoon family

blackmoon

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\bnnhhb.exe N/A
N/A N/A \??\c:\7pdpj.exe N/A
N/A N/A \??\c:\fxlfxrl.exe N/A
N/A N/A \??\c:\xfxlxrf.exe N/A
N/A N/A \??\c:\httnbb.exe N/A
N/A N/A \??\c:\ntnhbt.exe N/A
N/A N/A \??\c:\3ppdv.exe N/A
N/A N/A \??\c:\9xfllrr.exe N/A
N/A N/A \??\c:\hthbnh.exe N/A
N/A N/A \??\c:\pvdpd.exe N/A
N/A N/A \??\c:\vjjdp.exe N/A
N/A N/A \??\c:\rrxrrll.exe N/A
N/A N/A \??\c:\nbnhbt.exe N/A
N/A N/A \??\c:\hhbtht.exe N/A
N/A N/A \??\c:\9vppj.exe N/A
N/A N/A \??\c:\pvdvj.exe N/A
N/A N/A \??\c:\rflfllf.exe N/A
N/A N/A \??\c:\nnhhbb.exe N/A
N/A N/A \??\c:\ddvpj.exe N/A
N/A N/A \??\c:\xlrrrll.exe N/A
N/A N/A \??\c:\thnbth.exe N/A
N/A N/A \??\c:\nbthbt.exe N/A
N/A N/A \??\c:\vvdvv.exe N/A
N/A N/A \??\c:\dvpjj.exe N/A
N/A N/A \??\c:\tnhtbt.exe N/A
N/A N/A \??\c:\tbbnbb.exe N/A
N/A N/A \??\c:\jdpjv.exe N/A
N/A N/A \??\c:\fxrfxrl.exe N/A
N/A N/A \??\c:\5nnhtn.exe N/A
N/A N/A \??\c:\pvdpd.exe N/A
N/A N/A \??\c:\dpvvj.exe N/A
N/A N/A \??\c:\lrfrrfx.exe N/A
N/A N/A \??\c:\bnnhhh.exe N/A
N/A N/A \??\c:\ttnnbb.exe N/A
N/A N/A \??\c:\bbbtbt.exe N/A
N/A N/A \??\c:\xllflfl.exe N/A
N/A N/A \??\c:\hbthbt.exe N/A
N/A N/A \??\c:\tbhthh.exe N/A
N/A N/A \??\c:\pdvpd.exe N/A
N/A N/A \??\c:\1flxrlx.exe N/A
N/A N/A \??\c:\xlfxlfr.exe N/A
N/A N/A \??\c:\tnnhtt.exe N/A
N/A N/A \??\c:\nhtnnh.exe N/A
N/A N/A \??\c:\vpjdd.exe N/A
N/A N/A \??\c:\rfxxrrl.exe N/A
N/A N/A \??\c:\rlrlxxl.exe N/A
N/A N/A \??\c:\nbbtnh.exe N/A
N/A N/A \??\c:\3vdvp.exe N/A
N/A N/A \??\c:\5pvjd.exe N/A
N/A N/A \??\c:\rfxrxrr.exe N/A
N/A N/A \??\c:\hbbbtt.exe N/A
N/A N/A \??\c:\7btnbt.exe N/A
N/A N/A \??\c:\dpvjv.exe N/A
N/A N/A \??\c:\lrfxllf.exe N/A
N/A N/A \??\c:\nbbnhb.exe N/A
N/A N/A \??\c:\vjpjd.exe N/A
N/A N/A \??\c:\xlxxlrr.exe N/A
N/A N/A \??\c:\bhnhbt.exe N/A
N/A N/A \??\c:\dvjdj.exe N/A
N/A N/A \??\c:\jdjpj.exe N/A
N/A N/A \??\c:\fxllrll.exe N/A
N/A N/A \??\c:\xrrllfx.exe N/A
N/A N/A \??\c:\nbbnbh.exe N/A
N/A N/A \??\c:\vjdvd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\nbhbnn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\lxrfxrl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\pjvdp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\rfxxrrl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\ntnhbt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 948 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9350d86d2640e7caf05a04051c3f3cec.exe \??\c:\bnnhhb.exe
PID 948 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9350d86d2640e7caf05a04051c3f3cec.exe \??\c:\bnnhhb.exe
PID 948 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9350d86d2640e7caf05a04051c3f3cec.exe \??\c:\bnnhhb.exe
PID 2764 wrote to memory of 544 N/A \??\c:\bnnhhb.exe \??\c:\7pdpj.exe
PID 2764 wrote to memory of 544 N/A \??\c:\bnnhhb.exe \??\c:\7pdpj.exe
PID 2764 wrote to memory of 544 N/A \??\c:\bnnhhb.exe \??\c:\7pdpj.exe
PID 544 wrote to memory of 4668 N/A \??\c:\7pdpj.exe \??\c:\fxlfxrl.exe
PID 544 wrote to memory of 4668 N/A \??\c:\7pdpj.exe \??\c:\fxlfxrl.exe
PID 544 wrote to memory of 4668 N/A \??\c:\7pdpj.exe \??\c:\fxlfxrl.exe
PID 4668 wrote to memory of 1612 N/A \??\c:\fxlfxrl.exe \??\c:\xfxlxrf.exe
PID 4668 wrote to memory of 1612 N/A \??\c:\fxlfxrl.exe \??\c:\xfxlxrf.exe
PID 4668 wrote to memory of 1612 N/A \??\c:\fxlfxrl.exe \??\c:\xfxlxrf.exe
PID 1612 wrote to memory of 3480 N/A \??\c:\xfxlxrf.exe \??\c:\httnbb.exe
PID 1612 wrote to memory of 3480 N/A \??\c:\xfxlxrf.exe \??\c:\httnbb.exe
PID 1612 wrote to memory of 3480 N/A \??\c:\xfxlxrf.exe \??\c:\httnbb.exe
PID 3480 wrote to memory of 1120 N/A \??\c:\httnbb.exe \??\c:\ntnhbt.exe
PID 3480 wrote to memory of 1120 N/A \??\c:\httnbb.exe \??\c:\ntnhbt.exe
PID 3480 wrote to memory of 1120 N/A \??\c:\httnbb.exe \??\c:\ntnhbt.exe
PID 1120 wrote to memory of 4800 N/A \??\c:\ntnhbt.exe \??\c:\3ppdv.exe
PID 1120 wrote to memory of 4800 N/A \??\c:\ntnhbt.exe \??\c:\3ppdv.exe
PID 1120 wrote to memory of 4800 N/A \??\c:\ntnhbt.exe \??\c:\3ppdv.exe
PID 4800 wrote to memory of 2080 N/A \??\c:\3ppdv.exe \??\c:\9xfllrr.exe
PID 4800 wrote to memory of 2080 N/A \??\c:\3ppdv.exe \??\c:\9xfllrr.exe
PID 4800 wrote to memory of 2080 N/A \??\c:\3ppdv.exe \??\c:\9xfllrr.exe
PID 2080 wrote to memory of 4584 N/A \??\c:\9xfllrr.exe \??\c:\hthbnh.exe
PID 2080 wrote to memory of 4584 N/A \??\c:\9xfllrr.exe \??\c:\hthbnh.exe
PID 2080 wrote to memory of 4584 N/A \??\c:\9xfllrr.exe \??\c:\hthbnh.exe
PID 4584 wrote to memory of 4040 N/A \??\c:\hthbnh.exe \??\c:\pvdpd.exe
PID 4584 wrote to memory of 4040 N/A \??\c:\hthbnh.exe \??\c:\pvdpd.exe
PID 4584 wrote to memory of 4040 N/A \??\c:\hthbnh.exe \??\c:\pvdpd.exe
PID 4040 wrote to memory of 3200 N/A \??\c:\pvdpd.exe \??\c:\vjjdp.exe
PID 4040 wrote to memory of 3200 N/A \??\c:\pvdpd.exe \??\c:\vjjdp.exe
PID 4040 wrote to memory of 3200 N/A \??\c:\pvdpd.exe \??\c:\vjjdp.exe
PID 3200 wrote to memory of 4256 N/A \??\c:\vjjdp.exe \??\c:\rrxrrll.exe
PID 3200 wrote to memory of 4256 N/A \??\c:\vjjdp.exe \??\c:\rrxrrll.exe
PID 3200 wrote to memory of 4256 N/A \??\c:\vjjdp.exe \??\c:\rrxrrll.exe
PID 4256 wrote to memory of 4952 N/A \??\c:\rrxrrll.exe \??\c:\nbnhbt.exe
PID 4256 wrote to memory of 4952 N/A \??\c:\rrxrrll.exe \??\c:\nbnhbt.exe
PID 4256 wrote to memory of 4952 N/A \??\c:\rrxrrll.exe \??\c:\nbnhbt.exe
PID 4952 wrote to memory of 1784 N/A \??\c:\nbnhbt.exe \??\c:\hhbtht.exe
PID 4952 wrote to memory of 1784 N/A \??\c:\nbnhbt.exe \??\c:\hhbtht.exe
PID 4952 wrote to memory of 1784 N/A \??\c:\nbnhbt.exe \??\c:\hhbtht.exe
PID 1784 wrote to memory of 100 N/A \??\c:\hhbtht.exe \??\c:\9vppj.exe
PID 1784 wrote to memory of 100 N/A \??\c:\hhbtht.exe \??\c:\9vppj.exe
PID 1784 wrote to memory of 100 N/A \??\c:\hhbtht.exe \??\c:\9vppj.exe
PID 100 wrote to memory of 824 N/A \??\c:\9vppj.exe \??\c:\pvdvj.exe
PID 100 wrote to memory of 824 N/A \??\c:\9vppj.exe \??\c:\pvdvj.exe
PID 100 wrote to memory of 824 N/A \??\c:\9vppj.exe \??\c:\pvdvj.exe
PID 824 wrote to memory of 1724 N/A \??\c:\pvdvj.exe \??\c:\rflfllf.exe
PID 824 wrote to memory of 1724 N/A \??\c:\pvdvj.exe \??\c:\rflfllf.exe
PID 824 wrote to memory of 1724 N/A \??\c:\pvdvj.exe \??\c:\rflfllf.exe
PID 1724 wrote to memory of 3928 N/A \??\c:\rflfllf.exe \??\c:\nnhhbb.exe
PID 1724 wrote to memory of 3928 N/A \??\c:\rflfllf.exe \??\c:\nnhhbb.exe
PID 1724 wrote to memory of 3928 N/A \??\c:\rflfllf.exe \??\c:\nnhhbb.exe
PID 3928 wrote to memory of 3712 N/A \??\c:\nnhhbb.exe \??\c:\ddvpj.exe
PID 3928 wrote to memory of 3712 N/A \??\c:\nnhhbb.exe \??\c:\ddvpj.exe
PID 3928 wrote to memory of 3712 N/A \??\c:\nnhhbb.exe \??\c:\ddvpj.exe
PID 3712 wrote to memory of 2512 N/A \??\c:\ddvpj.exe \??\c:\xlrrrll.exe
PID 3712 wrote to memory of 2512 N/A \??\c:\ddvpj.exe \??\c:\xlrrrll.exe
PID 3712 wrote to memory of 2512 N/A \??\c:\ddvpj.exe \??\c:\xlrrrll.exe
PID 2512 wrote to memory of 3988 N/A \??\c:\xlrrrll.exe \??\c:\thnbth.exe
PID 2512 wrote to memory of 3988 N/A \??\c:\xlrrrll.exe \??\c:\thnbth.exe
PID 2512 wrote to memory of 3988 N/A \??\c:\xlrrrll.exe \??\c:\thnbth.exe
PID 3988 wrote to memory of 1508 N/A \??\c:\thnbth.exe \??\c:\nbthbt.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9350d86d2640e7caf05a04051c3f3cec.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9350d86d2640e7caf05a04051c3f3cec.exe"

\??\c:\bnnhhb.exe

c:\bnnhhb.exe

\??\c:\7pdpj.exe

c:\7pdpj.exe

\??\c:\fxlfxrl.exe

c:\fxlfxrl.exe

\??\c:\xfxlxrf.exe

c:\xfxlxrf.exe

\??\c:\httnbb.exe

c:\httnbb.exe

\??\c:\ntnhbt.exe

c:\ntnhbt.exe

\??\c:\3ppdv.exe

c:\3ppdv.exe

\??\c:\9xfllrr.exe

c:\9xfllrr.exe

\??\c:\hthbnh.exe

c:\hthbnh.exe

\??\c:\pvdpd.exe

c:\pvdpd.exe

\??\c:\vjjdp.exe

c:\vjjdp.exe

\??\c:\rrxrrll.exe

c:\rrxrrll.exe

\??\c:\nbnhbt.exe

c:\nbnhbt.exe

\??\c:\hhbtht.exe

c:\hhbtht.exe

\??\c:\9vppj.exe

c:\9vppj.exe

\??\c:\pvdvj.exe

c:\pvdvj.exe

\??\c:\rflfllf.exe

c:\rflfllf.exe

\??\c:\nnhhbb.exe

c:\nnhhbb.exe

\??\c:\ddvpj.exe

c:\ddvpj.exe

\??\c:\xlrrrll.exe

c:\xlrrrll.exe

\??\c:\thnbth.exe

c:\thnbth.exe

\??\c:\nbthbt.exe

c:\nbthbt.exe

\??\c:\vvdvv.exe

c:\vvdvv.exe

\??\c:\dvpjj.exe

c:\dvpjj.exe

\??\c:\tnhtbt.exe

c:\tnhtbt.exe

\??\c:\tbbnbb.exe

c:\tbbnbb.exe

\??\c:\jdpjv.exe

c:\jdpjv.exe

\??\c:\fxrfxrl.exe

c:\fxrfxrl.exe

\??\c:\5nnhtn.exe

c:\5nnhtn.exe

\??\c:\pvdpd.exe

c:\pvdpd.exe

\??\c:\dpvvj.exe

c:\dpvvj.exe

\??\c:\lrfrrfx.exe

c:\lrfrrfx.exe

\??\c:\bnnhhh.exe

c:\bnnhhh.exe

\??\c:\ttnnbb.exe

c:\ttnnbb.exe

\??\c:\bbbtbt.exe

c:\bbbtbt.exe

\??\c:\xllflfl.exe

c:\xllflfl.exe

\??\c:\hbthbt.exe

c:\hbthbt.exe

\??\c:\tbhthh.exe

c:\tbhthh.exe

\??\c:\pdvpd.exe

c:\pdvpd.exe

\??\c:\1flxrlx.exe

c:\1flxrlx.exe

\??\c:\xlfxlfr.exe

c:\xlfxlfr.exe

\??\c:\tnnhtt.exe

c:\tnnhtt.exe

\??\c:\nhtnnh.exe

c:\nhtnnh.exe

\??\c:\vpjdd.exe

c:\vpjdd.exe

\??\c:\rfxxrrl.exe

c:\rfxxrrl.exe

\??\c:\rlrlxxl.exe

c:\rlrlxxl.exe

\??\c:\nbbtnh.exe

c:\nbbtnh.exe

\??\c:\3vdvp.exe

c:\3vdvp.exe

\??\c:\5pvjd.exe

c:\5pvjd.exe

\??\c:\rfxrxrr.exe

c:\rfxrxrr.exe

\??\c:\hbbbtt.exe

c:\hbbbtt.exe

\??\c:\7btnbt.exe

c:\7btnbt.exe

\??\c:\dpvjv.exe

c:\dpvjv.exe

\??\c:\lrfxllf.exe

c:\lrfxllf.exe

\??\c:\nbbnhb.exe

c:\nbbnhb.exe

\??\c:\nthtnn.exe

c:\nthtnn.exe

\??\c:\vjpjd.exe

c:\vjpjd.exe

\??\c:\xlxxlrr.exe

c:\xlxxlrr.exe

\??\c:\bhnhbt.exe

c:\bhnhbt.exe

\??\c:\dvjdj.exe

c:\dvjdj.exe

\??\c:\jdjpj.exe

c:\jdjpj.exe

\??\c:\fxllrll.exe

c:\fxllrll.exe

\??\c:\xrrllfx.exe

c:\xrrllfx.exe

\??\c:\nbbnbh.exe

c:\nbbnbh.exe

\??\c:\vjdvd.exe

c:\vjdvd.exe

\??\c:\vpjdv.exe

c:\vpjdv.exe

\??\c:\fxfxfrx.exe

c:\fxfxfrx.exe

\??\c:\7rxxrlf.exe

c:\7rxxrlf.exe

\??\c:\nbtnbb.exe

c:\nbtnbb.exe

\??\c:\vpdvp.exe

c:\vpdvp.exe

\??\c:\jvvpd.exe

c:\jvvpd.exe

\??\c:\7flfxxr.exe

c:\7flfxxr.exe

\??\c:\3flxrrl.exe

c:\3flxrrl.exe

\??\c:\ntnhth.exe

c:\ntnhth.exe

\??\c:\tnnhtn.exe

c:\tnnhtn.exe

\??\c:\vjpdd.exe

c:\vjpdd.exe

\??\c:\lrlfrll.exe

c:\lrlfrll.exe

\??\c:\rffrfxr.exe

c:\rffrfxr.exe

\??\c:\nhbtnh.exe

c:\nhbtnh.exe

\??\c:\5pvpp.exe

c:\5pvpp.exe

\??\c:\jppvj.exe

c:\jppvj.exe

\??\c:\lxxlflf.exe

c:\lxxlflf.exe

\??\c:\ttbthb.exe

c:\ttbthb.exe

\??\c:\bbhhbb.exe

c:\bbhhbb.exe

\??\c:\jppjd.exe

c:\jppjd.exe

\??\c:\pddpd.exe

c:\pddpd.exe

\??\c:\fflxrlf.exe

c:\fflxrlf.exe

\??\c:\btthbt.exe

c:\btthbt.exe

\??\c:\pddpv.exe

c:\pddpv.exe

\??\c:\ddjdv.exe

c:\ddjdv.exe

\??\c:\ffxrrrl.exe

c:\ffxrrrl.exe

\??\c:\lfxxllr.exe

c:\lfxxllr.exe

\??\c:\hbnhnh.exe

c:\hbnhnh.exe

\??\c:\vvvpj.exe

c:\vvvpj.exe

\??\c:\dpppj.exe

c:\dpppj.exe

\??\c:\9xfxxxx.exe

c:\9xfxxxx.exe

\??\c:\xrfxfxl.exe

c:\xrfxfxl.exe

\??\c:\btnhbt.exe

c:\btnhbt.exe

\??\c:\hhttbb.exe

c:\hhttbb.exe

\??\c:\dppdp.exe

c:\dppdp.exe

\??\c:\jdjdp.exe

c:\jdjdp.exe

\??\c:\7xxrlfr.exe

c:\7xxrlfr.exe

\??\c:\lfxrffx.exe

c:\lfxrffx.exe

\??\c:\hbbbnn.exe

c:\hbbbnn.exe

\??\c:\btnbnh.exe

c:\btnbnh.exe

\??\c:\jpjdp.exe

c:\jpjdp.exe

\??\c:\lxxfrxr.exe

c:\lxxfrxr.exe

\??\c:\hnthhn.exe

c:\hnthhn.exe

\??\c:\jddjv.exe

c:\jddjv.exe

\??\c:\jvvpd.exe

c:\jvvpd.exe

\??\c:\jpvpd.exe

c:\jpvpd.exe

\??\c:\lxrxllx.exe

c:\lxrxllx.exe

\??\c:\flxxrrl.exe

c:\flxxrrl.exe

\??\c:\nhbtnh.exe

c:\nhbtnh.exe

\??\c:\bnnbnh.exe

c:\bnnbnh.exe

\??\c:\jvpjv.exe

c:\jvpjv.exe

\??\c:\rxfrfxr.exe

c:\rxfrfxr.exe

\??\c:\flrrrxf.exe

c:\flrrrxf.exe

\??\c:\thhbbb.exe

c:\thhbbb.exe

\??\c:\btbbtt.exe

c:\btbbtt.exe

\??\c:\3jjvp.exe

c:\3jjvp.exe

\??\c:\djvpd.exe

c:\djvpd.exe

\??\c:\lxfrffx.exe

c:\lxfrffx.exe

\??\c:\5ffxlfr.exe

c:\5ffxlfr.exe

\??\c:\hthbht.exe

c:\hthbht.exe

\??\c:\tnnhhh.exe

c:\tnnhhh.exe

\??\c:\3ddpj.exe

c:\3ddpj.exe

\??\c:\ffrfxrl.exe

c:\ffrfxrl.exe

\??\c:\rlrlfff.exe

c:\rlrlfff.exe

\??\c:\1bthbt.exe

c:\1bthbt.exe

\??\c:\vjjjd.exe

c:\vjjjd.exe

\??\c:\vpjvp.exe

c:\vpjvp.exe

\??\c:\pjdjd.exe

c:\pjdjd.exe

\??\c:\xxllflf.exe

c:\xxllflf.exe

\??\c:\hthhbb.exe

c:\hthhbb.exe

\??\c:\thhbtt.exe

c:\thhbtt.exe

\??\c:\vjpjp.exe

c:\vjpjp.exe

\??\c:\1xrfllx.exe

c:\1xrfllx.exe

\??\c:\bhhhbb.exe

c:\bhhhbb.exe

\??\c:\pjpjj.exe

c:\pjpjj.exe

\??\c:\pdddd.exe

c:\pdddd.exe

\??\c:\rlrrlrr.exe

c:\rlrrlrr.exe

\??\c:\lfrrffx.exe

c:\lfrrffx.exe

\??\c:\nhnhnh.exe

c:\nhnhnh.exe

\??\c:\dvdvd.exe

c:\dvdvd.exe

\??\c:\ppppd.exe

c:\ppppd.exe

\??\c:\rxxlxlf.exe

c:\rxxlxlf.exe

\??\c:\tnttnn.exe

c:\tnttnn.exe

\??\c:\hnnnbn.exe

c:\hnnnbn.exe

\??\c:\ddpvd.exe

c:\ddpvd.exe

\??\c:\9dpjp.exe

c:\9dpjp.exe

\??\c:\rlrlffx.exe

c:\rlrlffx.exe

\??\c:\frxrxrx.exe

c:\frxrxrx.exe

\??\c:\hbthtb.exe

c:\hbthtb.exe

\??\c:\nbtnbt.exe

c:\nbtnbt.exe

\??\c:\pjpdv.exe

c:\pjpdv.exe

\??\c:\xrlfffr.exe

c:\xrlfffr.exe

\??\c:\flrlfxl.exe

c:\flrlfxl.exe

\??\c:\hnhnbn.exe

c:\hnhnbn.exe

\??\c:\tnthhb.exe

c:\tnthhb.exe

\??\c:\pjdvj.exe

c:\pjdvj.exe

\??\c:\9jpdd.exe

c:\9jpdd.exe

\??\c:\xrrlxrl.exe

c:\xrrlxrl.exe

\??\c:\bnttbt.exe

c:\bnttbt.exe

\??\c:\bbhtht.exe

c:\bbhtht.exe

\??\c:\thnhnh.exe

c:\thnhnh.exe

\??\c:\jpjdp.exe

c:\jpjdp.exe

\??\c:\dvdpj.exe

c:\dvdpj.exe

\??\c:\xllfxxx.exe

c:\xllfxxx.exe

\??\c:\hbbnnb.exe

c:\hbbnnb.exe

\??\c:\hhthtn.exe

c:\hhthtn.exe

\??\c:\vjvvv.exe

c:\vjvvv.exe

\??\c:\pdvjv.exe

c:\pdvjv.exe

\??\c:\xllxllf.exe

c:\xllxllf.exe

\??\c:\xrxrlfr.exe

c:\xrxrlfr.exe

\??\c:\nhbhbt.exe

c:\nhbhbt.exe

\??\c:\tbnbnh.exe

c:\tbnbnh.exe

\??\c:\pddvj.exe

c:\pddvj.exe

\??\c:\vjpdj.exe

c:\vjpdj.exe

\??\c:\5rrllfr.exe

c:\5rrllfr.exe

\??\c:\tnnhnn.exe

c:\tnnhnn.exe

\??\c:\hbbtbt.exe

c:\hbbtbt.exe

\??\c:\ppjvp.exe

c:\ppjvp.exe

\??\c:\pvvpj.exe

c:\pvvpj.exe

\??\c:\1xllffx.exe

c:\1xllffx.exe

\??\c:\xxffxxx.exe

c:\xxffxxx.exe

\??\c:\hbtnht.exe

c:\hbtnht.exe

\??\c:\bntttn.exe

c:\bntttn.exe

\??\c:\jddjv.exe

c:\jddjv.exe

\??\c:\7rlxlfx.exe

c:\7rlxlfx.exe

\??\c:\frlfxrl.exe

c:\frlfxrl.exe

\??\c:\nbhbnn.exe

c:\nbhbnn.exe

\??\c:\vjdvj.exe

c:\vjdvj.exe

\??\c:\dpjdp.exe

c:\dpjdp.exe

\??\c:\lrxrlff.exe

c:\lrxrlff.exe

\??\c:\xllxxrf.exe

c:\xllxxrf.exe

\??\c:\1nhbtn.exe

c:\1nhbtn.exe

\??\c:\9thhbb.exe

c:\9thhbb.exe

\??\c:\jvpjv.exe

c:\jvpjv.exe

\??\c:\ddjvj.exe

c:\ddjvj.exe

\??\c:\flrrffx.exe

c:\flrrffx.exe

\??\c:\flffxxr.exe

c:\flffxxr.exe

\??\c:\7ttnhh.exe

c:\7ttnhh.exe

\??\c:\nhbnhb.exe

c:\nhbnhb.exe

\??\c:\9jjdp.exe

c:\9jjdp.exe

\??\c:\dddvp.exe

c:\dddvp.exe

\??\c:\lllfrlf.exe

c:\lllfrlf.exe

\??\c:\rflrfxl.exe

c:\rflrfxl.exe

\??\c:\hbbtnn.exe

c:\hbbtnn.exe

\??\c:\btnnnn.exe

c:\btnnnn.exe

\??\c:\pdvvv.exe

c:\pdvvv.exe

\??\c:\vpvvp.exe

c:\vpvvp.exe

\??\c:\fxxlfxl.exe

c:\fxxlfxl.exe

\??\c:\fxffxfr.exe

c:\fxffxfr.exe

\??\c:\5nnhtn.exe

c:\5nnhtn.exe

\??\c:\nbnhtn.exe

c:\nbnhtn.exe

\??\c:\jvpjj.exe

c:\jvpjj.exe

\??\c:\vppjd.exe

c:\vppjd.exe

\??\c:\1xxrfxr.exe

c:\1xxrfxr.exe

\??\c:\tbhbtn.exe

c:\tbhbtn.exe

\??\c:\thnhbh.exe

c:\thnhbh.exe

\??\c:\hbtnhb.exe

c:\hbtnhb.exe

\??\c:\vpvpd.exe

c:\vpvpd.exe

\??\c:\ddvjv.exe

c:\ddvjv.exe

\??\c:\xlrfxxx.exe

c:\xlrfxxx.exe

\??\c:\tntnhb.exe

c:\tntnhb.exe

\??\c:\hbtnhb.exe

c:\hbtnhb.exe

\??\c:\dvdpj.exe

c:\dvdpj.exe

\??\c:\vpvvj.exe

c:\vpvvj.exe

\??\c:\xxrfxrl.exe

c:\xxrfxrl.exe

\??\c:\rfrfxll.exe

c:\rfrfxll.exe

\??\c:\bnbnht.exe

c:\bnbnht.exe

\??\c:\bnnbtn.exe

c:\bnnbtn.exe

\??\c:\dpvpv.exe

c:\dpvpv.exe

\??\c:\9lllxxr.exe

c:\9lllxxr.exe

\??\c:\flfxlfx.exe

c:\flfxlfx.exe

\??\c:\thbtnh.exe

c:\thbtnh.exe

\??\c:\bntnbt.exe

c:\bntnbt.exe

\??\c:\hnhbtn.exe

c:\hnhbtn.exe

\??\c:\vjpjd.exe

c:\vjpjd.exe

\??\c:\pjvjv.exe

c:\pjvjv.exe

\??\c:\rfxrffx.exe

c:\rfxrffx.exe

\??\c:\lxxlfrl.exe

c:\lxxlfrl.exe

\??\c:\3nbtnt.exe

c:\3nbtnt.exe

\??\c:\hbbbht.exe

c:\hbbbht.exe

\??\c:\5pjdp.exe

c:\5pjdp.exe

\??\c:\dpvdp.exe

c:\dpvdp.exe

\??\c:\flxlfxr.exe

c:\flxlfxr.exe

\??\c:\fllfrlx.exe

c:\fllfrlx.exe

\??\c:\nhhbtn.exe

c:\nhhbtn.exe

\??\c:\htnhtn.exe

c:\htnhtn.exe

\??\c:\3ppdj.exe

c:\3ppdj.exe

\??\c:\pvpdv.exe

c:\pvpdv.exe

\??\c:\5rrfrrr.exe

c:\5rrfrrr.exe

\??\c:\thbthb.exe

c:\thbthb.exe

\??\c:\bnntnh.exe

c:\bnntnh.exe

\??\c:\djpjv.exe

c:\djpjv.exe

\??\c:\pvdpj.exe

c:\pvdpj.exe

\??\c:\5llfllf.exe

c:\5llfllf.exe

\??\c:\xllxfxr.exe

c:\xllxfxr.exe

\??\c:\hbhbnt.exe

c:\hbhbnt.exe

\??\c:\dpvpj.exe

c:\dpvpj.exe

\??\c:\vppjv.exe

c:\vppjv.exe

\??\c:\xflxlfx.exe

c:\xflxlfx.exe

\??\c:\xxrfxrl.exe

c:\xxrfxrl.exe

\??\c:\rllxxrr.exe

c:\rllxxrr.exe

\??\c:\nbtthn.exe

c:\nbtthn.exe

\??\c:\pjpjj.exe

c:\pjpjj.exe

\??\c:\jvdpd.exe

c:\jvdpd.exe

\??\c:\vvjdv.exe

c:\vvjdv.exe

\??\c:\lllfxlf.exe

c:\lllfxlf.exe

\??\c:\nhhbtb.exe

c:\nhhbtb.exe

\??\c:\httbnn.exe

c:\httbnn.exe

\??\c:\bhnbtn.exe

c:\bhnbtn.exe

\??\c:\jpdvj.exe

c:\jpdvj.exe

\??\c:\rrlfrlf.exe

c:\rrlfrlf.exe

\??\c:\frlfxxl.exe

c:\frlfxxl.exe

\??\c:\xlrxrxf.exe

c:\xlrxrxf.exe

\??\c:\bhtthb.exe

c:\bhtthb.exe

\??\c:\thhbnh.exe

c:\thhbnh.exe

\??\c:\jvpjd.exe

c:\jvpjd.exe

\??\c:\rxrxlxr.exe

c:\rxrxlxr.exe

\??\c:\rxlxrrx.exe

c:\rxlxrrx.exe

\??\c:\1nnhbt.exe

c:\1nnhbt.exe

\??\c:\btbtbt.exe

c:\btbtbt.exe

\??\c:\1bnhtn.exe

c:\1bnhtn.exe

\??\c:\vpvdp.exe

c:\vpvdp.exe

\??\c:\dpjdp.exe

c:\dpjdp.exe

\??\c:\xrrfrlf.exe

c:\xrrfrlf.exe

\??\c:\3nnnbb.exe

c:\3nnnbb.exe

\??\c:\bnthbt.exe

c:\bnthbt.exe

\??\c:\9btnbt.exe

c:\9btnbt.exe

\??\c:\dvvpj.exe

c:\dvvpj.exe

\??\c:\llrlxrf.exe

c:\llrlxrf.exe

\??\c:\lfxxrxr.exe

c:\lfxxrxr.exe

\??\c:\nbtnbb.exe

c:\nbtnbb.exe

\??\c:\tnnnhb.exe

c:\tnnnhb.exe

\??\c:\dvvvp.exe

c:\dvvvp.exe

\??\c:\jdvpd.exe

c:\jdvpd.exe

\??\c:\lxfxlll.exe

c:\lxfxlll.exe

\??\c:\xlrlffx.exe

c:\xlrlffx.exe

\??\c:\rrxxllr.exe

c:\rrxxllr.exe

\??\c:\bnhbnt.exe

c:\bnhbnt.exe

\??\c:\1jvjp.exe

c:\1jvjp.exe

\??\c:\dvvjd.exe

c:\dvvjd.exe

\??\c:\xlfxlfx.exe

c:\xlfxlfx.exe

\??\c:\rllfrll.exe

c:\rllfrll.exe

\??\c:\3hhthb.exe

c:\3hhthb.exe

\??\c:\htthtt.exe

c:\htthtt.exe

\??\c:\3jjjd.exe

c:\3jjjd.exe

\??\c:\pddvp.exe

c:\pddvp.exe

\??\c:\xxxlrrf.exe

c:\xxxlrrf.exe

\??\c:\fxfxllf.exe

c:\fxfxllf.exe

\??\c:\tnnhbt.exe

c:\tnnhbt.exe

\??\c:\7nntbt.exe

c:\7nntbt.exe

\??\c:\ddvjv.exe

c:\ddvjv.exe

\??\c:\vpjvv.exe

c:\vpjvv.exe

\??\c:\llrfxrl.exe

c:\llrfxrl.exe

\??\c:\rflfxrl.exe

c:\rflfxrl.exe

\??\c:\nbbthh.exe

c:\nbbthh.exe

\??\c:\djjdv.exe

c:\djjdv.exe

\??\c:\jppvv.exe

c:\jppvv.exe

\??\c:\dddvj.exe

c:\dddvj.exe

\??\c:\xrfxrxr.exe

c:\xrfxrxr.exe

\??\c:\ttbthh.exe

c:\ttbthh.exe

\??\c:\btnbth.exe

c:\btnbth.exe

\??\c:\pjjvp.exe

c:\pjjvp.exe

\??\c:\ddjvj.exe

c:\ddjvj.exe

\??\c:\rffxrrr.exe

c:\rffxrrr.exe

\??\c:\flllfxr.exe

c:\flllfxr.exe

\??\c:\tntnnn.exe

c:\tntnnn.exe

\??\c:\jvdvp.exe

c:\jvdvp.exe

\??\c:\jdpjv.exe

c:\jdpjv.exe

\??\c:\7djjv.exe

c:\7djjv.exe

\??\c:\lxxfrlf.exe

c:\lxxfrlf.exe

\??\c:\nbbntn.exe

c:\nbbntn.exe

\??\c:\7nhthb.exe

c:\7nhthb.exe

\??\c:\jjpjv.exe

c:\jjpjv.exe

\??\c:\ppvpd.exe

c:\ppvpd.exe

\??\c:\7xfflxr.exe

c:\7xfflxr.exe

\??\c:\fxxllfl.exe

c:\fxxllfl.exe

\??\c:\hbhhbt.exe

c:\hbhhbt.exe

\??\c:\nbbtnh.exe

c:\nbbtnh.exe

\??\c:\5jvjj.exe

c:\5jvjj.exe

\??\c:\pdpdd.exe

c:\pdpdd.exe

\??\c:\1rxrlfx.exe

c:\1rxrlfx.exe

\??\c:\1lxxlfx.exe

c:\1lxxlfx.exe

\??\c:\9hbtnn.exe

c:\9hbtnn.exe

\??\c:\vppdd.exe

c:\vppdd.exe

\??\c:\frllfff.exe

c:\frllfff.exe

\??\c:\lxrlfxl.exe

c:\lxrlfxl.exe

\??\c:\7nbbtt.exe

c:\7nbbtt.exe

\??\c:\ntbthh.exe

c:\ntbthh.exe

\??\c:\pdvpp.exe

c:\pdvpp.exe

\??\c:\vvpvj.exe

c:\vvpvj.exe

\??\c:\rxrrlll.exe

c:\rxrrlll.exe

\??\c:\hnnhtn.exe

c:\hnnhtn.exe

\??\c:\nttnhh.exe

c:\nttnhh.exe

\??\c:\hnttnb.exe

c:\hnttnb.exe

\??\c:\dvjjv.exe

c:\dvjjv.exe

\??\c:\rrlfrff.exe

c:\rrlfrff.exe

\??\c:\5lfrlfr.exe

c:\5lfrlfr.exe

\??\c:\nbhbbt.exe

c:\nbhbbt.exe

\??\c:\nhhbtt.exe

c:\nhhbtt.exe

\??\c:\ddjdp.exe

c:\ddjdp.exe

\??\c:\vddvj.exe

c:\vddvj.exe

\??\c:\rlffxfx.exe

c:\rlffxfx.exe

\??\c:\xrffffl.exe

c:\xrffffl.exe

\??\c:\bbhbtn.exe

c:\bbhbtn.exe

\??\c:\bbbtbt.exe

c:\bbbtbt.exe

\??\c:\pjvpd.exe

c:\pjvpd.exe

\??\c:\jjdvp.exe

c:\jjdvp.exe

\??\c:\fxrllrr.exe

c:\fxrllrr.exe

\??\c:\nbhbtb.exe

c:\nbhbtb.exe

\??\c:\7htttb.exe

c:\7htttb.exe

\??\c:\vdppp.exe

c:\vdppp.exe

\??\c:\dpdvj.exe

c:\dpdvj.exe

\??\c:\7rrlxxx.exe

c:\7rrlxxx.exe

\??\c:\hbbbbb.exe

c:\hbbbbb.exe

\??\c:\nhnhbb.exe

c:\nhnhbb.exe

\??\c:\pjvdd.exe

c:\pjvdd.exe

\??\c:\5dddp.exe

c:\5dddp.exe

\??\c:\lxfxrrl.exe

c:\lxfxrrl.exe

\??\c:\5xfffff.exe

c:\5xfffff.exe

\??\c:\hnnhbt.exe

c:\hnnhbt.exe

\??\c:\ppjdd.exe

c:\ppjdd.exe

\??\c:\vjppp.exe

c:\vjppp.exe

\??\c:\frrlfrl.exe

c:\frrlfrl.exe

\??\c:\9xfxrrl.exe

c:\9xfxrrl.exe

\??\c:\bbhnnn.exe

c:\bbhnnn.exe

\??\c:\jjvjd.exe

c:\jjvjd.exe

\??\c:\pddjv.exe

c:\pddjv.exe

\??\c:\ddjpj.exe

c:\ddjpj.exe

\??\c:\frlxlfx.exe

c:\frlxlfx.exe

\??\c:\xrrrlll.exe

c:\xrrrlll.exe

\??\c:\bntnht.exe

c:\bntnht.exe

\??\c:\tbhbtt.exe

c:\tbhbtt.exe

\??\c:\vjjjj.exe

c:\vjjjj.exe

\??\c:\5dpdp.exe

c:\5dpdp.exe

\??\c:\lrlfxxr.exe

c:\lrlfxxr.exe

\??\c:\3fllrlr.exe

c:\3fllrlr.exe

\??\c:\nbhbtt.exe

c:\nbhbtt.exe

\??\c:\pjjjj.exe

c:\pjjjj.exe

\??\c:\5dddp.exe

c:\5dddp.exe

\??\c:\rrrrlfx.exe

c:\rrrrlfx.exe

\??\c:\htbhtt.exe

c:\htbhtt.exe

\??\c:\nnnnnn.exe

c:\nnnnnn.exe

\??\c:\pvjjd.exe

c:\pvjjd.exe

\??\c:\1vdpj.exe

c:\1vdpj.exe

\??\c:\rlxxxfl.exe

c:\rlxxxfl.exe

\??\c:\nbtnnn.exe

c:\nbtnnn.exe

\??\c:\7pjvp.exe

c:\7pjvp.exe

\??\c:\vddvp.exe

c:\vddvp.exe

\??\c:\frxrrrl.exe

c:\frxrrrl.exe

\??\c:\9lrrlff.exe

c:\9lrrlff.exe

\??\c:\ntnnnn.exe

c:\ntnnnn.exe

\??\c:\dvpjv.exe

c:\dvpjv.exe

\??\c:\pdvpj.exe

c:\pdvpj.exe

\??\c:\xxfrxfl.exe

c:\xxfrxfl.exe

\??\c:\xlxxrrr.exe

c:\xlxxrrr.exe

\??\c:\hbbbth.exe

c:\hbbbth.exe

\??\c:\hbhbtn.exe

c:\hbhbtn.exe

\??\c:\jjppj.exe

c:\jjppj.exe

\??\c:\ppvpj.exe

c:\ppvpj.exe

\??\c:\lffxllf.exe

c:\lffxllf.exe

\??\c:\nbbhbt.exe

c:\nbbhbt.exe

\??\c:\tnbbbb.exe

c:\tnbbbb.exe

\??\c:\ddpvd.exe

c:\ddpvd.exe

\??\c:\vvvpj.exe

c:\vvvpj.exe

\??\c:\lxfxffx.exe

c:\lxfxffx.exe

\??\c:\tnhhtn.exe

c:\tnhhtn.exe

\??\c:\nhbthb.exe

c:\nhbthb.exe

\??\c:\pdddj.exe

c:\pdddj.exe

\??\c:\jvdpj.exe

c:\jvdpj.exe

\??\c:\dvpjj.exe

c:\dvpjj.exe

\??\c:\frflxrf.exe

c:\frflxrf.exe

\??\c:\5bhbtb.exe

c:\5bhbtb.exe

\??\c:\btnthh.exe

c:\btnthh.exe

\??\c:\dpddd.exe

c:\dpddd.exe

\??\c:\dpvjd.exe

c:\dpvjd.exe

\??\c:\lflrflx.exe

c:\lflrflx.exe

\??\c:\rfffxxx.exe

c:\rfffxxx.exe

\??\c:\nhhbhb.exe

c:\nhhbhb.exe

\??\c:\tbbttn.exe

c:\tbbttn.exe

\??\c:\vvvpj.exe

c:\vvvpj.exe

\??\c:\jdddd.exe

c:\jdddd.exe

\??\c:\7lrlffx.exe

c:\7lrlffx.exe

\??\c:\nbbhbb.exe

c:\nbbhbb.exe

\??\c:\ttbthh.exe

c:\ttbthh.exe

\??\c:\dvpjp.exe

c:\dvpjp.exe

\??\c:\jddvv.exe

c:\jddvv.exe

\??\c:\9llxrrr.exe

c:\9llxrrr.exe

\??\c:\llrxxxx.exe

c:\llrxxxx.exe

\??\c:\rlfxllf.exe

c:\rlfxllf.exe

\??\c:\btnhbb.exe

c:\btnhbb.exe

\??\c:\vvvvv.exe

c:\vvvvv.exe

\??\c:\jdvpv.exe

c:\jdvpv.exe

\??\c:\dvvvj.exe

c:\dvvvj.exe

\??\c:\fflxrfx.exe

c:\fflxrfx.exe

\??\c:\hntnnn.exe

c:\hntnnn.exe

\??\c:\hthbtt.exe

c:\hthbtt.exe

\??\c:\vvjpd.exe

c:\vvjpd.exe

\??\c:\jjjdj.exe

c:\jjjdj.exe

\??\c:\dvddv.exe

c:\dvddv.exe

\??\c:\xfffxxx.exe

c:\xfffxxx.exe

\??\c:\frffffl.exe

c:\frffffl.exe

\??\c:\hthhbb.exe

c:\hthhbb.exe

\??\c:\5hnnnn.exe

c:\5hnnnn.exe

\??\c:\nhnhbb.exe

c:\nhnhbb.exe

\??\c:\jdpjv.exe

c:\jdpjv.exe

\??\c:\jvdpp.exe

c:\jvdpp.exe

\??\c:\bbthbt.exe

c:\bbthbt.exe

\??\c:\9jdvp.exe

c:\9jdvp.exe

\??\c:\rlrllrr.exe

c:\rlrllrr.exe

\??\c:\thbtnh.exe

c:\thbtnh.exe

\??\c:\lrxfxll.exe

c:\lrxfxll.exe

\??\c:\hbnnnn.exe

c:\hbnnnn.exe

\??\c:\nbhhhh.exe

c:\nbhhhh.exe

\??\c:\pvvpd.exe

c:\pvvpd.exe

\??\c:\9rxrxfl.exe

c:\9rxrxfl.exe

\??\c:\lrfxlfx.exe

c:\lrfxlfx.exe

\??\c:\nbbbtt.exe

c:\nbbbtt.exe

\??\c:\btbttt.exe

c:\btbttt.exe

\??\c:\vjjpp.exe

c:\vjjpp.exe

\??\c:\vjppj.exe

c:\vjppj.exe

\??\c:\frlxrrl.exe

c:\frlxrrl.exe

\??\c:\3rlfxrr.exe

c:\3rlfxrr.exe

\??\c:\hhhhhh.exe

c:\hhhhhh.exe

\??\c:\tnhhhn.exe

c:\tnhhhn.exe

\??\c:\dvpjd.exe

c:\dvpjd.exe

\??\c:\lfxlxxr.exe

c:\lfxlxxr.exe

\??\c:\frxrxrr.exe

c:\frxrxrr.exe

\??\c:\nhhbnh.exe

c:\nhhbnh.exe

\??\c:\bhthbb.exe

c:\bhthbb.exe

\??\c:\ppjjd.exe

c:\ppjjd.exe

\??\c:\vpvpj.exe

c:\vpvpj.exe

\??\c:\xxrxrxx.exe

c:\xxrxrxx.exe

\??\c:\rxffxxr.exe

c:\rxffxxr.exe

\??\c:\xfllllr.exe

c:\xfllllr.exe

\??\c:\hbnntn.exe

c:\hbnntn.exe

\??\c:\vpddj.exe

c:\vpddj.exe

\??\c:\rfffrrx.exe

c:\rfffrrx.exe

\??\c:\fxxxllf.exe

c:\fxxxllf.exe

\??\c:\nbttnn.exe

c:\nbttnn.exe

\??\c:\ttnhbt.exe

c:\ttnhbt.exe

\??\c:\ppvpj.exe

c:\ppvpj.exe

\??\c:\ddvvv.exe

c:\ddvvv.exe

\??\c:\lxlxlfl.exe

c:\lxlxlfl.exe

\??\c:\tthbtn.exe

c:\tthbtn.exe

\??\c:\hnnhth.exe

c:\hnnhth.exe

\??\c:\pdpvj.exe

c:\pdpvj.exe

\??\c:\pvdvp.exe

c:\pvdvp.exe

\??\c:\fxrfrrf.exe

c:\fxrfrrf.exe

\??\c:\fxxrxrf.exe

c:\fxxrxrf.exe

\??\c:\bbhhht.exe

c:\bbhhht.exe

\??\c:\tnhnnn.exe

c:\tnhnnn.exe

\??\c:\9pdjd.exe

c:\9pdjd.exe

\??\c:\5vpjd.exe

c:\5vpjd.exe

\??\c:\ffxrllf.exe

c:\ffxrllf.exe

\??\c:\rlrrllf.exe

c:\rlrrllf.exe

\??\c:\9nnhhb.exe

c:\9nnhhb.exe

\??\c:\pvppp.exe

c:\pvppp.exe

\??\c:\jvjjp.exe

c:\jvjjp.exe

\??\c:\3xxlxff.exe

c:\3xxlxff.exe

\??\c:\xllfxrl.exe

c:\xllfxrl.exe

\??\c:\7bbbtb.exe

c:\7bbbtb.exe

\??\c:\bbnhnn.exe

c:\bbnhnn.exe

\??\c:\vvvpj.exe

c:\vvvpj.exe

\??\c:\vpvpj.exe

c:\vpvpj.exe

\??\c:\vppvj.exe

c:\vppvj.exe

\??\c:\ffllxxx.exe

c:\ffllxxx.exe

\??\c:\nbbthb.exe

c:\nbbthb.exe

\??\c:\1ppdj.exe

c:\1ppdj.exe

\??\c:\dvvpj.exe

c:\dvvpj.exe

\??\c:\vdddd.exe

c:\vdddd.exe

\??\c:\5rlfrrl.exe

c:\5rlfrrl.exe

\??\c:\nttnhb.exe

c:\nttnhb.exe

\??\c:\nbhntt.exe

c:\nbhntt.exe

\??\c:\pjdpv.exe

c:\pjdpv.exe

\??\c:\5rxrrrx.exe

c:\5rxrrrx.exe

\??\c:\frxrrlx.exe

c:\frxrrlx.exe

\??\c:\nhbtnb.exe

c:\nhbtnb.exe

\??\c:\nnhbtt.exe

c:\nnhbtt.exe

\??\c:\ppjvp.exe

c:\ppjvp.exe

\??\c:\jppjj.exe

c:\jppjj.exe

\??\c:\frrlffr.exe

c:\frrlffr.exe

\??\c:\3hhhhh.exe

c:\3hhhhh.exe

\??\c:\7nnbtt.exe

c:\7nnbtt.exe

\??\c:\dvvjd.exe

c:\dvvjd.exe

\??\c:\pdjvp.exe

c:\pdjvp.exe

\??\c:\fxrlxxr.exe

c:\fxrlxxr.exe

\??\c:\xlflllf.exe

c:\xlflllf.exe

\??\c:\hnbntb.exe

c:\hnbntb.exe

\??\c:\tnnbbh.exe

c:\tnnbbh.exe

\??\c:\3dpjd.exe

c:\3dpjd.exe

\??\c:\pjvpj.exe

c:\pjvpj.exe

\??\c:\7xffxff.exe

c:\7xffxff.exe

\??\c:\nbtnhh.exe

c:\nbtnhh.exe

\??\c:\dppjj.exe

c:\dppjj.exe

\??\c:\jpjdp.exe

c:\jpjdp.exe

\??\c:\5rfxfxf.exe

c:\5rfxfxf.exe

\??\c:\xfrlffx.exe

c:\xfrlffx.exe

\??\c:\bntnhh.exe

c:\bntnhh.exe

\??\c:\hbtnnn.exe

c:\hbtnnn.exe

\??\c:\jvvdv.exe

c:\jvvdv.exe

\??\c:\ppjdd.exe

c:\ppjdd.exe

\??\c:\1rxxrfx.exe

c:\1rxxrfx.exe

\??\c:\rrflrxx.exe

c:\rrflrxx.exe

\??\c:\bhnbtt.exe

c:\bhnbtt.exe

\??\c:\tntnhh.exe

c:\tntnhh.exe

\??\c:\jppdv.exe

c:\jppdv.exe

\??\c:\9dpjv.exe

c:\9dpjv.exe

\??\c:\9frfffl.exe

c:\9frfffl.exe

\??\c:\9hnhbb.exe

c:\9hnhbb.exe

\??\c:\nhbtbb.exe

c:\nhbtbb.exe

\??\c:\7jjdp.exe

c:\7jjdp.exe

\??\c:\jpjjd.exe

c:\jpjjd.exe

\??\c:\1lrfxrx.exe

c:\1lrfxrx.exe

\??\c:\tthnnn.exe

c:\tthnnn.exe

\??\c:\ttnnhh.exe

c:\ttnnhh.exe

\??\c:\pppjp.exe

c:\pppjp.exe

\??\c:\dvvpv.exe

c:\dvvpv.exe

\??\c:\lffxllf.exe

c:\lffxllf.exe

\??\c:\rlxrfxr.exe

c:\rlxrfxr.exe

\??\c:\tbhbbb.exe

c:\tbhbbb.exe

\??\c:\btbtnn.exe

c:\btbtnn.exe

\??\c:\vpvvp.exe

c:\vpvvp.exe

\??\c:\ddvpp.exe

c:\ddvpp.exe

\??\c:\fxllllr.exe

c:\fxllllr.exe

\??\c:\3ttbtt.exe

c:\3ttbtt.exe

\??\c:\7bhhbb.exe

c:\7bhhbb.exe

\??\c:\vppjj.exe

c:\vppjj.exe

\??\c:\rflxlfx.exe

c:\rflxlfx.exe

\??\c:\flxrllf.exe

c:\flxrllf.exe

\??\c:\rflllrr.exe

c:\rflllrr.exe

\??\c:\btbbhh.exe

c:\btbbhh.exe

\??\c:\5jdjv.exe

c:\5jdjv.exe

\??\c:\jjvpd.exe

c:\jjvpd.exe

\??\c:\xlxrffx.exe

c:\xlxrffx.exe

\??\c:\lrlfrlf.exe

c:\lrlfrlf.exe

\??\c:\hhbhht.exe

c:\hhbhht.exe

\??\c:\jddvv.exe

c:\jddvv.exe

\??\c:\vvpjj.exe

c:\vvpjj.exe

\??\c:\llrfrlx.exe

c:\llrfrlx.exe

\??\c:\3hbnhb.exe

c:\3hbnhb.exe

\??\c:\tnhbnn.exe

c:\tnhbnn.exe

\??\c:\vppjv.exe

c:\vppjv.exe

\??\c:\vjvpj.exe

c:\vjvpj.exe

\??\c:\5djdv.exe

c:\5djdv.exe

\??\c:\lxlfxxr.exe

c:\lxlfxxr.exe

\??\c:\nhtnhb.exe

c:\nhtnhb.exe

\??\c:\bbhbtt.exe

c:\bbhbtt.exe

\??\c:\pjdvp.exe

c:\pjdvp.exe

\??\c:\lrlxrll.exe

c:\lrlxrll.exe

\??\c:\rffxrrl.exe

c:\rffxrrl.exe

\??\c:\thhhbb.exe

c:\thhhbb.exe

\??\c:\7ttbnn.exe

c:\7ttbnn.exe

\??\c:\dvddd.exe

c:\dvddd.exe

\??\c:\dppjv.exe

c:\dppjv.exe

\??\c:\1fxlrlf.exe

c:\1fxlrlf.exe

\??\c:\htnhbt.exe

c:\htnhbt.exe

\??\c:\7hbttt.exe

c:\7hbttt.exe

\??\c:\bhbbbb.exe

c:\bhbbbb.exe

\??\c:\3pppd.exe

c:\3pppd.exe

\??\c:\lxxxrrl.exe

c:\lxxxrrl.exe

\??\c:\xflrlll.exe

c:\xflrlll.exe

\??\c:\tbbtbt.exe

c:\tbbtbt.exe

\??\c:\pdjdp.exe

c:\pdjdp.exe

\??\c:\dvpvd.exe

c:\dvpvd.exe

\??\c:\rfxfrrl.exe

c:\rfxfrrl.exe

\??\c:\rrffxfr.exe

c:\rrffxfr.exe

\??\c:\hnnhbb.exe

c:\hnnhbb.exe

\??\c:\tntnbt.exe

c:\tntnbt.exe

\??\c:\vppjd.exe

c:\vppjd.exe

\??\c:\9vdpv.exe

c:\9vdpv.exe

\??\c:\fffxllx.exe

c:\fffxllx.exe

\??\c:\bntnhh.exe

c:\bntnhh.exe

\??\c:\btbbnn.exe

c:\btbbnn.exe

\??\c:\nttbtt.exe

c:\nttbtt.exe

\??\c:\djvjd.exe

c:\djvjd.exe

\??\c:\3ffxrrl.exe

c:\3ffxrrl.exe

\??\c:\llflflf.exe

c:\llflflf.exe

\??\c:\7btnhh.exe

c:\7btnhh.exe

\??\c:\bttnbh.exe

c:\bttnbh.exe

\??\c:\vppjv.exe

c:\vppjv.exe

\??\c:\rlxlllr.exe

c:\rlxlllr.exe

\??\c:\xxrfffx.exe

c:\xxrfffx.exe

\??\c:\9hhhhh.exe

c:\9hhhhh.exe

\??\c:\bnnhhh.exe

c:\bnnhhh.exe

\??\c:\pjpjv.exe

c:\pjpjv.exe

\??\c:\fxrfrll.exe

c:\fxrfrll.exe

\??\c:\rxxxllf.exe

c:\rxxxllf.exe

\??\c:\3nbtnh.exe

c:\3nbtnh.exe

\??\c:\vjvvp.exe

c:\vjvvp.exe

\??\c:\vvpjj.exe

c:\vvpjj.exe

\??\c:\3vdvd.exe

c:\3vdvd.exe

\??\c:\frxlffx.exe

c:\frxlffx.exe

\??\c:\9xxxrrr.exe

c:\9xxxrrr.exe

\??\c:\nnbtbb.exe

c:\nnbtbb.exe

\??\c:\bttbtb.exe

c:\bttbtb.exe

\??\c:\pjvvd.exe

c:\pjvvd.exe

\??\c:\jdvpj.exe

c:\jdvpj.exe

\??\c:\fxrlfff.exe

c:\fxrlfff.exe

\??\c:\hbbtnh.exe

c:\hbbtnh.exe

\??\c:\bnthtn.exe

c:\bnthtn.exe

\??\c:\bthbbb.exe

c:\bthbbb.exe

\??\c:\vpvjj.exe

c:\vpvjj.exe

\??\c:\vdpjj.exe

c:\vdpjj.exe

\??\c:\lrflfll.exe

c:\lrflfll.exe

\??\c:\lfxrxrx.exe

c:\lfxrxrx.exe

\??\c:\tnhbtt.exe

c:\tnhbtt.exe

\??\c:\dpvvp.exe

c:\dpvvp.exe

\??\c:\vppjd.exe

c:\vppjd.exe

\??\c:\xrrlflf.exe

c:\xrrlflf.exe

\??\c:\lflfxlf.exe

c:\lflfxlf.exe

\??\c:\thnntt.exe

c:\thnntt.exe

\??\c:\tnbhnn.exe

c:\tnbhnn.exe

\??\c:\jjjjj.exe

c:\jjjjj.exe

\??\c:\vpddp.exe

c:\vpddp.exe

\??\c:\rlrlxxr.exe

c:\rlrlxxr.exe

\??\c:\nhhbtn.exe

c:\nhhbtn.exe

\??\c:\bthbbb.exe

c:\bthbbb.exe

\??\c:\bthbbb.exe

c:\bthbbb.exe

\??\c:\7jjjj.exe

c:\7jjjj.exe

\??\c:\vppvp.exe

c:\vppvp.exe

\??\c:\3rrllfx.exe

c:\3rrllfx.exe

\??\c:\lflrrfx.exe

c:\lflrrfx.exe

\??\c:\thnhbt.exe

c:\thnhbt.exe

\??\c:\hnnhbh.exe

c:\hnnhbh.exe

\??\c:\jjpjp.exe

c:\jjpjp.exe

\??\c:\ffxlfrf.exe

c:\ffxlfrf.exe

\??\c:\rxxrrrr.exe

c:\rxxrrrr.exe

\??\c:\xrxxxxx.exe

c:\xrxxxxx.exe

\??\c:\tnbnnh.exe

c:\tnbnnh.exe

\??\c:\1nnhbh.exe

c:\1nnhbh.exe

\??\c:\pddvv.exe

c:\pddvv.exe

\??\c:\pdjdv.exe

c:\pdjdv.exe

\??\c:\llllxff.exe

c:\llllxff.exe

\??\c:\xxlxlll.exe

c:\xxlxlll.exe

\??\c:\flrrrrr.exe

c:\flrrrrr.exe

\??\c:\btnnnh.exe

c:\btnnnh.exe

\??\c:\bhbbnn.exe

c:\bhbbnn.exe

\??\c:\ddvvj.exe

c:\ddvvj.exe

\??\c:\llfffll.exe

c:\llfffll.exe

\??\c:\vpvvd.exe

c:\vpvvd.exe

\??\c:\9lllflf.exe

c:\9lllflf.exe

\??\c:\fxlxxxx.exe

c:\fxlxxxx.exe

\??\c:\bthhnn.exe

c:\bthhnn.exe

\??\c:\nbnnbb.exe

c:\nbnnbb.exe

\??\c:\7jjdv.exe

c:\7jjdv.exe

\??\c:\jjpvj.exe

c:\jjpvj.exe

\??\c:\lxxrllf.exe

c:\lxxrllf.exe

\??\c:\xrllrrx.exe

c:\xrllrrx.exe

\??\c:\tnntnb.exe

c:\tnntnb.exe

\??\c:\btttbb.exe

c:\btttbb.exe

\??\c:\ddppd.exe

c:\ddppd.exe

\??\c:\dvdvv.exe

c:\dvdvv.exe

\??\c:\xrxxllf.exe

c:\xrxxllf.exe

\??\c:\lxrrrrl.exe

c:\lxrrrrl.exe

\??\c:\1nbbhb.exe

c:\1nbbhb.exe

\??\c:\hhntnt.exe

c:\hhntnt.exe

\??\c:\jvddv.exe

c:\jvddv.exe

\??\c:\dvdvp.exe

c:\dvdvp.exe

\??\c:\rllxrfx.exe

c:\rllxrfx.exe

\??\c:\xxfflrx.exe

c:\xxfflrx.exe

\??\c:\nhnnbh.exe

c:\nhnnbh.exe

\??\c:\vpvpj.exe

c:\vpvpj.exe

\??\c:\ddddp.exe

c:\ddddp.exe

\??\c:\9rxrlll.exe

c:\9rxrlll.exe

\??\c:\rfflffx.exe

c:\rfflffx.exe

\??\c:\httnhh.exe

c:\httnhh.exe

\??\c:\tnnttt.exe

c:\tnnttt.exe

\??\c:\pdddv.exe

c:\pdddv.exe

\??\c:\vdppp.exe

c:\vdppp.exe

\??\c:\jjppj.exe

c:\jjppj.exe

\??\c:\lxlfxfx.exe

c:\lxlfxfx.exe

\??\c:\lxllxxl.exe

c:\lxllxxl.exe

\??\c:\7btnhh.exe

c:\7btnhh.exe

\??\c:\vppjd.exe

c:\vppjd.exe

\??\c:\pddvj.exe

c:\pddvj.exe

\??\c:\fxxlxxx.exe

c:\fxxlxxx.exe

\??\c:\xxfflxf.exe

c:\xxfflxf.exe

\??\c:\tbhnnn.exe

c:\tbhnnn.exe

\??\c:\djppj.exe

c:\djppj.exe

\??\c:\jdpjp.exe

c:\jdpjp.exe

\??\c:\xrrlfxx.exe

c:\xrrlfxx.exe

\??\c:\rrxrrrl.exe

c:\rrxrrrl.exe

\??\c:\btttnn.exe

c:\btttnn.exe

\??\c:\hbnhnn.exe

c:\hbnhnn.exe

\??\c:\vdjjd.exe

c:\vdjjd.exe

\??\c:\fflfxxr.exe

c:\fflfxxr.exe

\??\c:\xrxrllf.exe

c:\xrxrllf.exe

\??\c:\htttnb.exe

c:\htttnb.exe

\??\c:\1nnntb.exe

c:\1nnntb.exe

\??\c:\jvddv.exe

c:\jvddv.exe

\??\c:\vvpjv.exe

c:\vvpjv.exe

\??\c:\fxrlffx.exe

c:\fxrlffx.exe

\??\c:\llllllf.exe

c:\llllllf.exe

\??\c:\hhtbbb.exe

c:\hhtbbb.exe

\??\c:\hbhnhh.exe

c:\hbhnhh.exe

\??\c:\dvdvp.exe

c:\dvdvp.exe

\??\c:\vpvpd.exe

c:\vpvpd.exe

\??\c:\fxllllr.exe

c:\fxllllr.exe

\??\c:\xffffll.exe

c:\xffffll.exe

\??\c:\thbbnb.exe

c:\thbbnb.exe

\??\c:\tbhbtt.exe

c:\tbhbtt.exe

\??\c:\pjjpd.exe

c:\pjjpd.exe

\??\c:\djpjp.exe

c:\djpjp.exe

\??\c:\7lfxrrl.exe

c:\7lfxrrl.exe

\??\c:\tnbbnn.exe

c:\tnbbnn.exe

\??\c:\hhtntb.exe

c:\hhtntb.exe

\??\c:\jjddd.exe

c:\jjddd.exe

\??\c:\lffxlxf.exe

c:\lffxlxf.exe

\??\c:\xrfxffl.exe

c:\xrfxffl.exe

\??\c:\nhbbtt.exe

c:\nhbbtt.exe

\??\c:\bbbthh.exe

c:\bbbthh.exe

\??\c:\pddvp.exe

c:\pddvp.exe

\??\c:\pvddv.exe

c:\pvddv.exe

\??\c:\rfxrllf.exe

c:\rfxrllf.exe

\??\c:\hhttnt.exe

c:\hhttnt.exe

\??\c:\tntnbt.exe

c:\tntnbt.exe

\??\c:\pjdjd.exe

c:\pjdjd.exe

\??\c:\vpppp.exe

c:\vpppp.exe

\??\c:\rfrlllr.exe

c:\rfrlllr.exe

\??\c:\xlllffx.exe

c:\xlllffx.exe

\??\c:\bnnhbb.exe

c:\bnnhbb.exe

\??\c:\3pdvj.exe

c:\3pdvj.exe

\??\c:\dvvvj.exe

c:\dvvvj.exe

\??\c:\fxxlrrl.exe

c:\fxxlrrl.exe

\??\c:\lffxxxl.exe

c:\lffxxxl.exe

\??\c:\thnnnn.exe

c:\thnnnn.exe

\??\c:\tnthnn.exe

c:\tnthnn.exe

\??\c:\ddjpj.exe

c:\ddjpj.exe

\??\c:\vvvvp.exe

c:\vvvvp.exe

\??\c:\3rrlffx.exe

c:\3rrlffx.exe

\??\c:\9lffxrl.exe

c:\9lffxrl.exe

\??\c:\nnbtnt.exe

c:\nnbtnt.exe

\??\c:\nhnnhn.exe

c:\nhnnhn.exe

\??\c:\pjjjj.exe

c:\pjjjj.exe

\??\c:\9vvpv.exe

c:\9vvpv.exe

\??\c:\lxrlffx.exe

c:\lxrlffx.exe

\??\c:\xxxlrxl.exe

c:\xxxlrxl.exe

\??\c:\tnhhbt.exe

c:\tnhhbt.exe

\??\c:\btbbtb.exe

c:\btbbtb.exe

\??\c:\pjvdp.exe

c:\pjvdp.exe

\??\c:\vjdvv.exe

c:\vjdvv.exe

\??\c:\rlfxlll.exe

c:\rlfxlll.exe

\??\c:\5nnnnh.exe

c:\5nnnnh.exe

\??\c:\tnnnhh.exe

c:\tnnnhh.exe

\??\c:\jddpp.exe

c:\jddpp.exe

\??\c:\djjdp.exe

c:\djjdp.exe

\??\c:\fxfxrlf.exe

c:\fxfxrlf.exe

\??\c:\nbhbtn.exe

c:\nbhbtn.exe

\??\c:\hbbtth.exe

c:\hbbtth.exe

\??\c:\vppdp.exe

c:\vppdp.exe

\??\c:\llrlxxr.exe

c:\llrlxxr.exe

\??\c:\xxlffrr.exe

c:\xxlffrr.exe

\??\c:\ttbbbn.exe

c:\ttbbbn.exe

\??\c:\nbtnnn.exe

c:\nbtnnn.exe

\??\c:\3jdjp.exe

c:\3jdjp.exe

\??\c:\dddvv.exe

c:\dddvv.exe

\??\c:\xxxrllr.exe

c:\xxxrllr.exe

\??\c:\9xflllr.exe

c:\9xflllr.exe

\??\c:\jjpjp.exe

c:\jjpjp.exe

\??\c:\pjpjd.exe

c:\pjpjd.exe

\??\c:\fxxxrfx.exe

c:\fxxxrfx.exe

\??\c:\lrfxrll.exe

c:\lrfxrll.exe

\??\c:\tnnnhb.exe

c:\tnnnhb.exe

\??\c:\ttntbh.exe

c:\ttntbh.exe

\??\c:\tnnhhh.exe

c:\tnnhhh.exe

\??\c:\dppjp.exe

c:\dppjp.exe

\??\c:\lrxlfff.exe

c:\lrxlfff.exe

\??\c:\9xrlrlx.exe

c:\9xrlrlx.exe

\??\c:\9nnnhb.exe

c:\9nnnhb.exe

\??\c:\nnnhtt.exe

c:\nnnhtt.exe

\??\c:\pjdvj.exe

c:\pjdvj.exe

\??\c:\pvjjv.exe

c:\pvjjv.exe

\??\c:\lffxrrr.exe

c:\lffxrrr.exe

\??\c:\bnnhnn.exe

c:\bnnhnn.exe

\??\c:\httnhh.exe

c:\httnhh.exe

\??\c:\nhnhhh.exe

c:\nhnhhh.exe

\??\c:\3djvp.exe

c:\3djvp.exe

\??\c:\xxrfrlx.exe

c:\xxrfrlx.exe

\??\c:\lllfxxl.exe

c:\lllfxxl.exe

\??\c:\3bbtnh.exe

c:\3bbtnh.exe

\??\c:\bhbhnh.exe

c:\bhbhnh.exe

\??\c:\vppjj.exe

c:\vppjj.exe

\??\c:\jdvpd.exe

c:\jdvpd.exe

\??\c:\fxxrlll.exe

c:\fxxrlll.exe

\??\c:\7rrlffx.exe

c:\7rrlffx.exe

\??\c:\nbhhhn.exe

c:\nbhhhn.exe

\??\c:\pjdpj.exe

c:\pjdpj.exe

\??\c:\dpvjj.exe

c:\dpvjj.exe

\??\c:\9rfxxxf.exe

c:\9rfxxxf.exe

\??\c:\3fffxrr.exe

c:\3fffxrr.exe

\??\c:\hbhhnn.exe

c:\hbhhnn.exe

\??\c:\hhtttt.exe

c:\hhtttt.exe

\??\c:\jjddd.exe

c:\jjddd.exe

\??\c:\jdjvd.exe

c:\jdjvd.exe

\??\c:\frfxllf.exe

c:\frfxllf.exe

\??\c:\lrxfxrl.exe

c:\lrxfxrl.exe

\??\c:\ttnntt.exe

c:\ttnntt.exe

\??\c:\nhbhth.exe

c:\nhbhth.exe

\??\c:\5ddvj.exe

c:\5ddvj.exe

\??\c:\vjjjv.exe

c:\vjjjv.exe

\??\c:\lrrfxrf.exe

c:\lrrfxrf.exe

\??\c:\lxffrrr.exe

c:\lxffrrr.exe

\??\c:\ttttnh.exe

c:\ttttnh.exe

\??\c:\nhbtnh.exe

c:\nhbtnh.exe

\??\c:\pjpjp.exe

c:\pjpjp.exe

\??\c:\1ppdv.exe

c:\1ppdv.exe

\??\c:\xlllffx.exe

c:\xlllffx.exe

\??\c:\rfxlxrl.exe

c:\rfxlxrl.exe

\??\c:\ntbhbb.exe

c:\ntbhbb.exe

\??\c:\hbtnhb.exe

c:\hbtnhb.exe

\??\c:\7htnnn.exe

c:\7htnnn.exe

\??\c:\5dpjj.exe

c:\5dpjj.exe

\??\c:\9jdpd.exe

c:\9jdpd.exe

\??\c:\vjjdv.exe

c:\vjjdv.exe

\??\c:\xflxrlx.exe

c:\xflxrlx.exe

\??\c:\rfrllfl.exe

c:\rfrllfl.exe

\??\c:\thtnhh.exe

c:\thtnhh.exe

\??\c:\nbtnbt.exe

c:\nbtnbt.exe

\??\c:\3dvdv.exe

c:\3dvdv.exe

\??\c:\ppjdv.exe

c:\ppjdv.exe

\??\c:\rxxxrff.exe

c:\rxxxrff.exe

\??\c:\rllxxrf.exe

c:\rllxxrf.exe

\??\c:\thbbnh.exe

c:\thbbnh.exe

\??\c:\hbtnhb.exe

c:\hbtnhb.exe

\??\c:\pvvvv.exe

c:\pvvvv.exe

\??\c:\5jjdp.exe

c:\5jjdp.exe

\??\c:\pddpj.exe

c:\pddpj.exe

\??\c:\rlrfxxr.exe

c:\rlrfxxr.exe

\??\c:\hhhhbt.exe

c:\hhhhbt.exe

\??\c:\dpjdj.exe

c:\dpjdj.exe

\??\c:\dppdj.exe

c:\dppdj.exe

\??\c:\lxrfxrl.exe

c:\lxrfxrl.exe

\??\c:\1nnhhb.exe

c:\1nnhhb.exe

\??\c:\nbbttt.exe

c:\nbbttt.exe

\??\c:\1xrxxff.exe

c:\1xrxxff.exe

\??\c:\nhhhbh.exe

c:\nhhhbh.exe

\??\c:\5bhbtb.exe

c:\5bhbtb.exe

\??\c:\llrlffl.exe

c:\llrlffl.exe

\??\c:\bhbtnh.exe

c:\bhbtnh.exe

\??\c:\vpdvj.exe

c:\vpdvj.exe

\??\c:\vvdvd.exe

c:\vvdvd.exe

\??\c:\ffxrllf.exe

c:\ffxrllf.exe

\??\c:\lxrlffx.exe

c:\lxrlffx.exe

\??\c:\7nhbnh.exe

c:\7nhbnh.exe

\??\c:\tbbthh.exe

c:\tbbthh.exe

\??\c:\dvpdv.exe

c:\dvpdv.exe

\??\c:\xrrllff.exe

c:\xrrllff.exe

\??\c:\rlllxrr.exe

c:\rlllxrr.exe

\??\c:\tbthtn.exe

c:\tbthtn.exe

\??\c:\thhthb.exe

c:\thhthb.exe

\??\c:\pdvjv.exe

c:\pdvjv.exe

\??\c:\3jjvp.exe

c:\3jjvp.exe

\??\c:\fxrrfxf.exe

c:\fxrrfxf.exe

\??\c:\7lffxxr.exe

c:\7lffxxr.exe

\??\c:\ttnnhh.exe

c:\ttnnhh.exe

\??\c:\9tnhtt.exe

c:\9tnhtt.exe

\??\c:\pdjjd.exe

c:\pdjjd.exe

\??\c:\pjjpj.exe

c:\pjjpj.exe

\??\c:\llflrrf.exe

c:\llflrrf.exe

\??\c:\fxrlffx.exe

c:\fxrlffx.exe

\??\c:\hhnhhn.exe

c:\hhnhhn.exe

\??\c:\5pdvj.exe

c:\5pdvj.exe

\??\c:\1dvjd.exe

c:\1dvjd.exe

\??\c:\vdvjd.exe

c:\vdvjd.exe

\??\c:\frllxfx.exe

c:\frllxfx.exe

\??\c:\nhhbtn.exe

c:\nhhbtn.exe

\??\c:\hbhhtn.exe

c:\hbhhtn.exe

\??\c:\ppvjp.exe

c:\ppvjp.exe

\??\c:\ddjdp.exe

c:\ddjdp.exe

\??\c:\1xrfxrl.exe

c:\1xrfxrl.exe

\??\c:\frrlfxx.exe

c:\frrlfxx.exe

\??\c:\bnhbnh.exe

c:\bnhbnh.exe

\??\c:\bttnhb.exe

c:\bttnhb.exe

\??\c:\vpjvv.exe

c:\vpjvv.exe

\??\c:\pdppd.exe

c:\pdppd.exe

\??\c:\fffrfxl.exe

c:\fffrfxl.exe

\??\c:\fxflrfl.exe

c:\fxflrfl.exe

\??\c:\tnhtnn.exe

c:\tnhtnn.exe

\??\c:\ddjpv.exe

c:\ddjpv.exe

\??\c:\jvvpj.exe

c:\jvvpj.exe

\??\c:\ffrlrll.exe

c:\ffrlrll.exe

\??\c:\frlffxr.exe

c:\frlffxr.exe

\??\c:\nntnbh.exe

c:\nntnbh.exe

\??\c:\hbhbbt.exe

c:\hbhbbt.exe

\??\c:\vvdvj.exe

c:\vvdvj.exe

\??\c:\pvvpv.exe

c:\pvvpv.exe

\??\c:\lflrrll.exe

c:\lflrrll.exe

\??\c:\fflxlfx.exe

c:\fflxlfx.exe

\??\c:\ntbtnh.exe

c:\ntbtnh.exe

\??\c:\thbthb.exe

c:\thbthb.exe

\??\c:\3vdvp.exe

c:\3vdvp.exe

\??\c:\1vpjd.exe

c:\1vpjd.exe

\??\c:\xlxlrrf.exe

c:\xlxlrrf.exe

\??\c:\hbntnn.exe

c:\hbntnn.exe

\??\c:\hhbbnn.exe

c:\hhbbnn.exe

\??\c:\pddvj.exe

c:\pddvj.exe

\??\c:\5djdd.exe

c:\5djdd.exe

\??\c:\lffxlll.exe

c:\lffxlll.exe

\??\c:\lrfxrrf.exe

c:\lrfxrrf.exe

\??\c:\tntttt.exe

c:\tntttt.exe

\??\c:\nnthbh.exe

c:\nnthbh.exe

\??\c:\dvddv.exe

c:\dvddv.exe

\??\c:\9dvpd.exe

c:\9dvpd.exe

\??\c:\lfxrlff.exe

c:\lfxrlff.exe

\??\c:\rlllfff.exe

c:\rlllfff.exe

\??\c:\bhbttt.exe

c:\bhbttt.exe

\??\c:\bnntnn.exe

c:\bnntnn.exe

\??\c:\5ddvp.exe

c:\5ddvp.exe

\??\c:\llxlxrl.exe

c:\llxlxrl.exe

\??\c:\rlrlrlr.exe

c:\rlrlrlr.exe

\??\c:\9ttthb.exe

c:\9ttthb.exe

\??\c:\tnnnhh.exe

c:\tnnnhh.exe

\??\c:\5hhtbb.exe

c:\5hhtbb.exe

\??\c:\vvvpv.exe

c:\vvvpv.exe

\??\c:\fxffxrr.exe

c:\fxffxrr.exe

\??\c:\rllllll.exe

c:\rllllll.exe

\??\c:\tntttn.exe

c:\tntttn.exe

\??\c:\hbtnbb.exe

c:\hbtnbb.exe

\??\c:\5vdvj.exe

c:\5vdvj.exe

\??\c:\1jjjd.exe

c:\1jjjd.exe

\??\c:\flfrrlf.exe

c:\flfrrlf.exe

\??\c:\bbhbnn.exe

c:\bbhbnn.exe

\??\c:\thhhhn.exe

c:\thhhhn.exe

\??\c:\7vjjv.exe

c:\7vjjv.exe

\??\c:\ddvpj.exe

c:\ddvpj.exe

\??\c:\vdpvp.exe

c:\vdpvp.exe

\??\c:\7lfrfxr.exe

c:\7lfrfxr.exe

\??\c:\5bbtnh.exe

c:\5bbtnh.exe

\??\c:\nhnnbb.exe

c:\nhnnbb.exe

\??\c:\jjpdv.exe

c:\jjpdv.exe

\??\c:\pjjjd.exe

c:\pjjjd.exe

\??\c:\7frlxrl.exe

c:\7frlxrl.exe

\??\c:\5hbtnh.exe

c:\5hbtnh.exe

\??\c:\nbnbtt.exe

c:\nbnbtt.exe

\??\c:\pvvpj.exe

c:\pvvpj.exe

\??\c:\1dvvv.exe

c:\1dvvv.exe

\??\c:\7xxrllf.exe

c:\7xxrllf.exe

\??\c:\lxrlllf.exe

c:\lxrlllf.exe

\??\c:\hbttnn.exe

c:\hbttnn.exe

\??\c:\pjjdv.exe

c:\pjjdv.exe

\??\c:\vjvpp.exe

c:\vjvpp.exe

\??\c:\frrxrrr.exe

c:\frrxrrr.exe

\??\c:\rxfxxxr.exe

c:\rxfxxxr.exe

\??\c:\nnttbb.exe

c:\nnttbb.exe

\??\c:\bbhbtn.exe

c:\bbhbtn.exe

\??\c:\ddjdv.exe

c:\ddjdv.exe

\??\c:\jjvjd.exe

c:\jjvjd.exe

\??\c:\xlfxllx.exe

c:\xlfxllx.exe

\??\c:\lxxrllf.exe

c:\lxxrllf.exe

\??\c:\bttthh.exe

c:\bttthh.exe

\??\c:\dpvjd.exe

c:\dpvjd.exe

\??\c:\5jvpj.exe

c:\5jvpj.exe

\??\c:\xflfxxl.exe

c:\xflfxxl.exe

\??\c:\lrxrllf.exe

c:\lrxrllf.exe

\??\c:\tbhhbb.exe

c:\tbhhbb.exe

\??\c:\httnbb.exe

c:\httnbb.exe

\??\c:\jjpjp.exe

c:\jjpjp.exe

\??\c:\pjvvp.exe

c:\pjvvp.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 180.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

memory/948-0-0x0000000000400000-0x0000000000427000-memory.dmp

C:\bnnhhb.exe

MD5 b06629ea3d31cbb5abbf0660140fa8f6
SHA1 f4810d70be844f8a30de334a088587291a2cb654
SHA256 ac9aa6f38a612942818608ed894007710d9d22b3ed1dffc41e32f17bd62cbc48
SHA512 0c761b1fece3529dc2bf45719b2874e20e6b9cdb9e933028ee622595e3cdf3bb49e45db70123c78a36232469b36d7e09f7434f3e157719a0df82648ac0fc8b9f

memory/948-5-0x0000000000400000-0x0000000000427000-memory.dmp

C:\7pdpj.exe

MD5 b570f58e12cae7d81f04c1c860b18a79
SHA1 7dfad6116ee2263541184aba7971a22d1422db00
SHA256 9a2053a6a7352356228483a0c8c253ab10890e409696687495f63b2df7c7fae0
SHA512 abd99c2e75c8715c0de5531dbdc24b60f00abce383830b90c54d5816bbc132ed4f365b067002fe9c54313562d48b53bdd780acf39e5b8fd33294f7cc51d1536c

memory/2764-8-0x0000000000400000-0x0000000000427000-memory.dmp

memory/544-11-0x0000000000400000-0x0000000000427000-memory.dmp

C:\fxlfxrl.exe

MD5 a18fbfb92b39e5045686918630eadb6f
SHA1 62f52831d12a01b0345e29cb7f1339d38bfbfdc4
SHA256 ed4a265ddf7ec5c4d99849441a336aa9c08a396fcdc40309e78f7596d4b9d069
SHA512 8df5dee2be245caeabddb17f2264f1a9bf9b599098905c51f1d0230137d0ec3ad6ed2ff85ee4aa3f60e2156f3790edbd45ce57a3cbf82cedc77a01391a5ca0fb

memory/4668-17-0x0000000000400000-0x0000000000427000-memory.dmp

C:\xfxlxrf.exe

MD5 1c0d55d2724233c83780e3520f95c84c
SHA1 e9c3abdb71d260754d888afc437a5faa01e82c52
SHA256 c34b17b8bd462042bf04469db79798fffbeb1ad219b860dee41a699811647e56
SHA512 1ad3169f94e0055dfd8a0a841a2b1a1d202a250d35dd9dd4300f8a147be0c5021bae0e5e55df09d42b4d7b3a4ab0845792c049c41cc67bf812d2ce8982ccf05c

memory/1612-22-0x0000000000400000-0x0000000000427000-memory.dmp

C:\httnbb.exe

MD5 81b5b380f7f9b3e0a5f0029fce18faf4
SHA1 58965fe052783cb8bb1777e1653bfe41dce99888
SHA256 64d4de467e271783c718eecef031540cef30ac5b122352ebd7aacf535a77c79e
SHA512 3ab6fe1c929628b2d5d9fc7ab35cfc35cc1c53aa6fbd31eda179cebaccc2e0a1b7f383f64d634c1984ddcb01b05bc3664d2adbb4f63ebfced6ad8d412bfede68

memory/3480-29-0x0000000000400000-0x0000000000427000-memory.dmp

C:\ntnhbt.exe

MD5 89f564a4f8560060679f1088f086f34c
SHA1 8d5579dbad015fb4149bdedc575467130e72ec27
SHA256 653c0d681ab2d6302196e443ff8f23cff5dad49836e862573c0b036e67c98356
SHA512 b79646f6a339923699c5e8a42a557114e7552e47fc6ca3f761c97a6cf91ba3a1b31047fcc7830a336e746f6585903ba0f19845e8e945c4b2aa4312b27613232a

C:\3ppdv.exe

MD5 a7bc80e7e2438292b2230cd9fa0ba05e
SHA1 80e5ae14b5c7dab0e5c46ec9ee137c91c7d23325
SHA256 3c68a4a531541f5f7ae8ec1dae7623226ae40aa24a82fb4fe66c97802d5a9ae2
SHA512 f23b6d1696e2d714e341682e7a88e74a57b53ea966ca0c022591390472c91099a14fb260839cb324cf75b51f63a695acae088e5465de8d4b8e124434eb91da8b

memory/1120-35-0x0000000000400000-0x0000000000427000-memory.dmp

memory/4800-36-0x0000000000400000-0x0000000000427000-memory.dmp

C:\9xfllrr.exe

MD5 ead17422d531fff30198d84e929edefc
SHA1 d13ce327b352da03a599fff5277806e3875263d8
SHA256 d6f9e959b0e688c5c63af4d2cfc4c9f6504a10d8a1cb5962b7fcef0ff88224ea
SHA512 ff14ce3452f547e1e77dcc248192121bc1c17c025e5919824b35555beafad1e4f31604c965ba1010c96d8bb817120815e56c60a4311b7ed11113e7b08ec2aa91

memory/4800-40-0x0000000000400000-0x0000000000427000-memory.dmp

C:\hthbnh.exe

MD5 c976df737b67135e194eb83c77d8f20a
SHA1 8df9265cdd346828dc8f0852fd2b69983978f62e
SHA256 18ada4a2cc00b11862b9fd538997bb733093ffe511cb921dbe681f363ed41649
SHA512 da3e06df8aa8445b0288ac10a3a47b95f439c73ea37d0af595c4afdaf6e575a18ab5e7145254dceff4cf425871ea75253d6bf8b5c60da4cbbab0d08d30c1488e

memory/2080-45-0x0000000000400000-0x0000000000427000-memory.dmp

memory/4584-50-0x0000000000400000-0x0000000000427000-memory.dmp

C:\pvdpd.exe

MD5 d5e1314456bf8eb92e6e0ecc6ec10aa7
SHA1 1f0d7dfd979a50eeb87a63d48201bff4b48bbc15
SHA256 7713054c38d2bdbba96fcd8d911d0bd543bcf2790bd82b3e92669190110df13c
SHA512 0e569f44dab391a6a6241aff2ae13e2feb6d395a08828c1aff0e24be0ba64ed8ae382f7eba024175b007e9b862d0ee7b405d38f6066f5bec8867d29ea490252a

C:\vjjdp.exe

MD5 ef7dafae9bf4a55c730ad9e239b1e0f0
SHA1 b47d9cdfd869120b5dbb1f86c217ad477c47cf0f
SHA256 cb47af2e36430f406ab43fd21a1f3b7a583c24e5d729f227c4a13f1c3052c938
SHA512 adeb4a3b2c6a8cc68edc7f90d4c2c34825c3ffc9fd18e395bf8d7b853e1342ba608fc0a8f130d282627a4f529d3e1d6fd93e833e5faccb12e769268596a257de

C:\rrxrrll.exe

MD5 da0082946a1fe5f11d43a714123bee01
SHA1 52e4b9d57533c7bb13bac85103abf2c12a6e6a48
SHA256 e6f51d2e752db8c44786acfd40d41222be4eb1ae691b70b6d95a9f7ef6b1dc36
SHA512 6b4c5990f1ddbceb48276900fd7c007d9a68d74259f703c139323d77f5a2991d9e43d82aefae7f7d22d3892d69f44a2d035979769f7090a13bfc0dee0751746a

memory/3200-59-0x0000000000400000-0x0000000000427000-memory.dmp

C:\nbnhbt.exe

MD5 4ade1c65113f56ca9afd2c17c13658fc
SHA1 fc28edd6b5bb38c434eccbe98db6ff6f1d338b30
SHA256 816be41c8be0f668fe44a257239fc8cb73a1efe77ffcbaf3303c37e6a45612f9
SHA512 0af16a8f50f26ed5ab1c4e3470a2a8385d82e4cc7d79783965828f739c932451617c3887f88963d3219bc25ee2f6db4f40cbacf569ed919fa1cfcb1fd8b6a1b8

memory/4256-64-0x0000000000400000-0x0000000000427000-memory.dmp

memory/4952-69-0x0000000000400000-0x0000000000427000-memory.dmp

C:\hhbtht.exe

MD5 8fe0fb2ea8970e30b0a9b5cb4a0c6709
SHA1 ab65a4e19a3f9c33d84ea3549e06c503f10480f3
SHA256 16e6469edca838c89ee7cea117d7b595962a12e15b1c8e58380d98c18e304329
SHA512 7aef0db91a8be087e9a7faa0bfbca6b100ec7b6e8e1cd53fbd803faf68d8fbd245553dc8505e053bd61094438164079dc5a4a98140ba54fc6f04bf640b613c26

memory/1784-73-0x0000000000400000-0x0000000000427000-memory.dmp

C:\9vppj.exe

MD5 bbdd28bb8a410c54142f81740945bbd6
SHA1 18ccec64c76594ae1b60ff2655ceca1a615b763a
SHA256 fb3f7d455f68e37dc20243d9a7b6158f61ab6d4398594a3d25447bb7d7e9c3f5
SHA512 34bbaf8ad3cd0dc9c457faaa0483b142a6f8b37192642dab8067c2d53af623d5bdf12bed4da86d82d7882b8bea4ebcc8f6ead3427c811c130f0286a6315c80b5

memory/100-77-0x0000000000400000-0x0000000000427000-memory.dmp

C:\pvdvj.exe

MD5 eaf5d9618bebf274a4e80b0ecf58eed2
SHA1 aeaf5721ec4244b0456000450e619ff778f3823e
SHA256 7b219d3f6164544c09aa3bef2a8e6ba99db871ccc7347dad19402048fafcb000
SHA512 974349d4647d4e19c904a738c964b02efe148712a63a0a29ddc2f63c3e26738bdd5a6d8e1f4711e54b04c7ef619a683cf2099aa214cacf49415294c3c31c4439

C:\rflfllf.exe

MD5 afb6c45efa9a9538d3e35a2435060ecf
SHA1 08bd9fdb8de157ed01a1d641a49451cf56db75e3
SHA256 1002e6db103f55afc6785f8ba98347147df65ee7b963015eb2d0e9de13d8b164
SHA512 893969c2f52995df32e581f266fbb9f711e265fc5b0c9782a06e107b416a0171670b60b876eb9fdd4d502b1834826a284011c2a28e3a3db41260e77a90c9b800

memory/1724-88-0x0000000000400000-0x0000000000427000-memory.dmp

C:\nnhhbb.exe

MD5 d35c29f5c509d9edceac8a1cb17d9935
SHA1 8c801106806d9c326cf9cadcaeef891274bccfa2
SHA256 ca833efce333b2a83fbed89246c52827a81dcb079a6b03757105123f0d8105dc
SHA512 7af5fff01b57c31432253ef08d62286488ab32e86bd3cda8c02604aa296e2d82b55eb85fd02dd43184df83253dabe9f2392fb960e6bdbeac03d2d7dd5111cfea

C:\ddvpj.exe

MD5 6920731950c5ba6f28a831e11616ef5a
SHA1 62e39b67e32d086d2e13055be07c90f9e29c52d8
SHA256 f8e49d4d3651b8fc4b4bebbf2bbc175cee87dd139ad777c781c3fb7e449ad7de
SHA512 cf84eee536657ee979bdbb95dbc483b34cfdf3dac591c687b11c2e539f1c40342faffe6297238c0eba83eed2d23b23a5979237db346215c67bb57190c0fef807

memory/3928-93-0x0000000000400000-0x0000000000427000-memory.dmp

memory/3712-98-0x0000000000400000-0x0000000000427000-memory.dmp

\??\c:\xlrrrll.exe

MD5 27491e5b37d76771b3471a222a739ea9
SHA1 cd0b146e67baa3e6476a334737a0de6c1215d87a
SHA256 c74dd5fcab0e70e621aeb2ab827a83fd61a55d9be2d28090cefaefe77ff3e718
SHA512 1d8fa16413fc8b217e87bcf071d68e4329f671fd60406a2bf517606fb04e7511f6ddd842732cb27fd7c4e6b06ebe6c53a5dd746de57714808829bbebc7fce80f

C:\thnbth.exe

MD5 d64e6687a16cb99244af7df72696a454
SHA1 7641de9eacb52b8e27406d843a730b65a35f526f
SHA256 52c1592e0cab6905fb143abfc0990b93e40dd0a500298122e54ce19eee02701b
SHA512 2610babcf08697983ae5d71ae4929b107f98f80b81fae69ce26aff0a265152fccf8d2db8a757290099566fd8ca36b2471f4e671400a3bdad64f78aeb8b112d30

C:\nbthbt.exe

MD5 bca3b9b3d897c44a662d805ee5c83d11
SHA1 c3cb7571447dfa565c0c05cc706655ab21fd0e2f
SHA256 f386f7e6d578243617022fa541feb4c5414dc49fd1b4217e9f78ae5a608c6a17
SHA512 1cbcee7e6f74ea8d1051739d9fd385a1e5b2d3ed16a236f58ff0758289740475354424210780ce5784ae2a09851657f376ab007763fd32df4ba3651892aeba22

C:\vvdvv.exe

MD5 378eee0bbc2cc1e838dd2f8d3b7bf234
SHA1 d0879b3c15e30876f8428650e252c304c09632bc
SHA256 60116e8f009873e91f6d0bb2a3e1a27c13bd9b2fffd265b1af31ab7af295f1a3
SHA512 0391561104b03e1eea4238a0adbf63643c7218358fa01909150cf765ceaf13348f71eef35b56f30ea772eb806b75c017bd8189ae82ada191d934a38adc23f2cc

C:\dvpjj.exe

MD5 0f9c934da32b99af33a1fd374a0e09d9
SHA1 d6100033fcc0f567950c2da26e44c062d2814ef2
SHA256 7c383e32a821792b6870074171e2d99d9fc30af61c614529ee156468d73754a5
SHA512 4248bf27b3bf7470ac138ce14366ef380a27f3db73bceeaf68086a90f11e57065d746bfcfe18228c9dba665bc12a04d7e3d1cd6fc0b4adedfba53df656178c5b

memory/1528-114-0x0000000000400000-0x0000000000427000-memory.dmp

C:\tnhtbt.exe

MD5 53e17e95bef1dad51af75787887c7bbb
SHA1 3fa3cafcdb431902793c439f0ae77b109825dfae
SHA256 e159449b96639a97c14163c4107a63aca7db0710fa315056b46daa08b3462eca
SHA512 d0d4d127196f1857b473a65a52d048bd9e306f89d600e84060332bd13d50fed5f8e9469055d7c469d5f590ad04782e9f5707387d27b65d45476c210238cbbc7d

memory/4840-122-0x0000000000400000-0x0000000000427000-memory.dmp

\??\c:\tbbnbb.exe

MD5 12ee7a54037bf3cd8b0f460b8c145d8a
SHA1 a7178778864948118cbd90b6cd6fe9434721f566
SHA256 0284e4082e095cec03f0dabcead210e189d58786165a47dce29804c00096062a
SHA512 9330b7a36aa45113051e2749881c83952f9a4f4a3f8fe1e4065fb4d00b98191b1e7ec7784fde4549c0e0ca38f2969455429db8dccb35d33d08cd92b05aee3538

memory/536-126-0x0000000000400000-0x0000000000427000-memory.dmp

\??\c:\jdpjv.exe

MD5 654fd4bc63d59ec3969b67080e5b1541
SHA1 c393066c5d884d2691c44527a61fe82720a0732a
SHA256 5913e7e0acaaff356ef300b51d20ec8673148198d690ea2169991139d21d20a9
SHA512 4f30d22a1fbf34056cc8245f62c022f55e297dd1fc5848f27101f2bd75c862979c88f0f7afd917a5c530764faf69b68fbb7387e2bf6e7e0532f2b8c42a082bc2

memory/748-132-0x0000000000400000-0x0000000000427000-memory.dmp

\??\c:\fxrfxrl.exe

MD5 90096ee36ab6a227157c5dd8812a7549
SHA1 000ac6b1008b52878e5f7761de53304530430cbc
SHA256 f865f23a6b0504ef060377faf9f5762e9c97aa2f01e7ccd6c5e0e762e3aea0d0
SHA512 d04747933b9802cfcf122ed6e0975de9547e624a0357e862f1bbbda7f250fb20c19fb6c089a89a175ba907753ee3e82f74e9262b2163f8fa83228023f1922dc7

memory/2032-139-0x0000000000400000-0x0000000000427000-memory.dmp

C:\5nnhtn.exe

MD5 40280a0622cd4078f02f9aa024d3b566
SHA1 fece1849f5fd44113884e411101f65988d1a708d
SHA256 f3155f4fae20fd4f58a097c999c5f629e489e9359989b4c1097f416f0e361d82
SHA512 da888e3083ba5c94297454023f5b3d581efd897b910f2636fcbfdaf1739c5b97533b1678eed0bda0cf833f54dc02194784c74c761a3a1f6037c9f78575eca426

C:\pvdpd.exe

MD5 2dad886ab36019aa352eae6ee9b74dd7
SHA1 ad6bcf5a73b02ab90ce4d2aca43c1a9d58d3f009
SHA256 fbd14992bcb0fc07cfea3980ad102eca8e44cdd8c919e0e2a5f715ab8751667c
SHA512 bf388ce53f629a68f2392b84aa8c18970720baeefc53a37a87b214229b30f55aed85ee0c19abfa64ee2f0e71c7949b980a24e7c0741204fb85cc080582461ed4

memory/2796-145-0x0000000000400000-0x0000000000427000-memory.dmp

C:\dpvvj.exe

MD5 9981fc4bdf3854796eae81e3f113c153
SHA1 1a9607f0eb5eae776c839e29941aa8d168264077
SHA256 e2815ba007cad128cdc260148bb1ac11717b462e3821b8ea13815786416272fa
SHA512 69e795374dd4e4fb922afa31100aa41855d9fea1a9ba1efd5a96b3e9b6507c815d5a3d20760e7a3fe4a4c8a467f97a23c391a1efeda597bc5e6eb9e7d2f40c7e

C:\lrfrrfx.exe

MD5 c6ba232d1500b11461b5773a195070fb
SHA1 a2006df1a1b921f6a2fe04d6776b81e1d79061c2
SHA256 0d2652fa12614b85eaccf04e2ee01910c0de75d7aeddbfd534c575dd4d25de4c
SHA512 6c3bf83efdddc36c0d3f493b36282db1448ea13e7a125da2a23638e7c59afa2f987ae3bf3f1e40aaf698c10c0163d8848736e600224952a9468d19b30ab7648b

memory/4844-152-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2544-157-0x0000000000400000-0x0000000000427000-memory.dmp

memory/3564-160-0x0000000000400000-0x0000000000427000-memory.dmp

memory/1184-163-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2176-168-0x0000000000400000-0x0000000000427000-memory.dmp

memory/624-171-0x0000000000400000-0x0000000000427000-memory.dmp

memory/1224-178-0x0000000000400000-0x0000000000427000-memory.dmp

memory/4888-182-0x0000000000400000-0x0000000000427000-memory.dmp

memory/3036-184-0x0000000000400000-0x0000000000427000-memory.dmp

memory/3240-195-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2612-198-0x0000000000400000-0x0000000000427000-memory.dmp

memory/4732-201-0x0000000000400000-0x0000000000427000-memory.dmp

memory/4736-206-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2824-211-0x0000000000400000-0x0000000000427000-memory.dmp

memory/4308-216-0x0000000000400000-0x0000000000427000-memory.dmp

memory/4884-223-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2588-228-0x0000000000400000-0x0000000000427000-memory.dmp

memory/1120-239-0x0000000000400000-0x0000000000427000-memory.dmp

memory/32-244-0x0000000000400000-0x0000000000427000-memory.dmp

memory/4876-254-0x0000000000400000-0x0000000000427000-memory.dmp

memory/1164-256-0x0000000000400000-0x0000000000427000-memory.dmp

memory/4932-265-0x0000000000400000-0x0000000000427000-memory.dmp

memory/116-270-0x0000000000400000-0x0000000000427000-memory.dmp

memory/4980-287-0x0000000000400000-0x0000000000427000-memory.dmp

memory/3872-292-0x0000000000400000-0x0000000000427000-memory.dmp

memory/4452-323-0x0000000000400000-0x0000000000427000-memory.dmp

memory/3020-326-0x0000000000400000-0x0000000000427000-memory.dmp

memory/1184-331-0x0000000000400000-0x0000000000427000-memory.dmp

memory/3300-336-0x0000000000400000-0x0000000000427000-memory.dmp

memory/4588-357-0x0000000000400000-0x0000000000427000-memory.dmp

memory/3340-390-0x0000000000400000-0x0000000000427000-memory.dmp

memory/4744-395-0x0000000000400000-0x0000000000427000-memory.dmp

memory/460-398-0x0000000000400000-0x0000000000427000-memory.dmp

memory/4868-411-0x0000000000400000-0x0000000000427000-memory.dmp

memory/4200-548-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2276-575-0x0000000000400000-0x0000000000427000-memory.dmp

memory/4004-578-0x0000000000400000-0x0000000000427000-memory.dmp

memory/3332-589-0x0000000000400000-0x0000000000427000-memory.dmp

memory/324-742-0x0000000000400000-0x0000000000427000-memory.dmp

memory/2024-1123-0x0000000000400000-0x0000000000427000-memory.dmp