Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
16/04/2024, 15:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f3c6cb40a2380d1e8fcc0d894adc8623_JaffaCakes118.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
f3c6cb40a2380d1e8fcc0d894adc8623_JaffaCakes118.exe
-
Size
444KB
-
MD5
f3c6cb40a2380d1e8fcc0d894adc8623
-
SHA1
cba93ba3e160c8455f6ef0c5267c8212b0d334b4
-
SHA256
c59b6aaa89857754bb4e6be79a372f15875e42a079fc6b0c90bdaceaa04c9948
-
SHA512
eefdfa0fff35901aeb144aeabe433cf0b023bb38240c38280b4cdbc9f1a81cf42c3b66296b6cee42f9329ef9b8bd6ce4d99cea276b020d5ff43864a607a14695
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq78yoyfx93sEqkeGLo:n3C9yMo+S0L9xRnoq7H9xqYLo
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
resource yara_rule behavioral1/memory/2908-2-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1196-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1248-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/876-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-371-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/400-425-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/848-473-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-640-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-656-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-433-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-416-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1548-409-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/448-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/664-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/268-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1488-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1868-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2228 frxrrrf.exe 2500 jdjjj.exe 2680 nhbhnt.exe 1196 pjjpp.exe 2772 3hhhtb.exe 2440 vvpjp.exe 2436 nntthh.exe 2444 tnbhnh.exe 1868 1lffffl.exe 2696 rlrflfr.exe 2620 pvppj.exe 1248 tntntt.exe 2124 fxxxxfx.exe 772 dddpp.exe 1488 hthbht.exe 2852 rxlrlxx.exe 2044 dvdjp.exe 2216 rrxxllx.exe 268 jjddv.exe 1052 rfxflfl.exe 2736 9vjjp.exe 664 7lrxffl.exe 448 dpdvj.exe 708 1xllfrl.exe 996 djddp.exe 2980 5xlxflx.exe 876 jjppv.exe 2192 5dpdj.exe 3004 7tthnn.exe 2668 flxrffr.exe 892 fxxfrxl.exe 2252 bbbnbh.exe 2908 1xxrxrx.exe 2496 tbthbt.exe 2712 ddddp.exe 2692 btnbnn.exe 2432 rrrxlxf.exe 2588 3djdd.exe 2772 xflfffx.exe 2544 nhnhnh.exe 2080 xlflrrl.exe 108 pjppp.exe 1516 flxxlrl.exe 1548 vvpdv.exe 2296 ffrflrx.exe 400 vpdjp.exe 2604 rxrlxff.exe 1880 jvpdj.exe 640 tttttt.exe 1096 vpjjj.exe 2892 thttnh.exe 848 vdddp.exe 1260 llxlflx.exe 600 vvpjp.exe 576 xxrxlxr.exe 1780 ddppv.exe 1140 rrllxlx.exe 3032 5htbnt.exe 2964 1jvvv.exe 448 lfxflrf.exe 1792 jpddp.exe 1928 lxrfllf.exe 1648 pvvvj.exe 2236 hbtthb.exe -
resource yara_rule behavioral1/memory/2908-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1196-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1248-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/876-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-347-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-371-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/400-425-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1096-457-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-473-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-624-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-640-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-686-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-656-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-701-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-567-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-552-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-716-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-504-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-472-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-433-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-416-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-409-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-362-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/448-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/448-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/664-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/664-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/268-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1488-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1868-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-13-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2228 2908 f3c6cb40a2380d1e8fcc0d894adc8623_JaffaCakes118.exe 28 PID 2908 wrote to memory of 2228 2908 f3c6cb40a2380d1e8fcc0d894adc8623_JaffaCakes118.exe 28 PID 2908 wrote to memory of 2228 2908 f3c6cb40a2380d1e8fcc0d894adc8623_JaffaCakes118.exe 28 PID 2908 wrote to memory of 2228 2908 f3c6cb40a2380d1e8fcc0d894adc8623_JaffaCakes118.exe 28 PID 2228 wrote to memory of 2500 2228 frxrrrf.exe 29 PID 2228 wrote to memory of 2500 2228 frxrrrf.exe 29 PID 2228 wrote to memory of 2500 2228 frxrrrf.exe 29 PID 2228 wrote to memory of 2500 2228 frxrrrf.exe 29 PID 2500 wrote to memory of 2680 2500 jdjjj.exe 30 PID 2500 wrote to memory of 2680 2500 jdjjj.exe 30 PID 2500 wrote to memory of 2680 2500 jdjjj.exe 30 PID 2500 wrote to memory of 2680 2500 jdjjj.exe 30 PID 2680 wrote to memory of 1196 2680 nhbhnt.exe 31 PID 2680 wrote to memory of 1196 2680 nhbhnt.exe 31 PID 2680 wrote to memory of 1196 2680 nhbhnt.exe 31 PID 2680 wrote to memory of 1196 2680 nhbhnt.exe 31 PID 1196 wrote to memory of 2772 1196 pjjpp.exe 32 PID 1196 wrote to memory of 2772 1196 pjjpp.exe 32 PID 1196 wrote to memory of 2772 1196 pjjpp.exe 32 PID 1196 wrote to memory of 2772 1196 pjjpp.exe 32 PID 2772 wrote to memory of 2440 2772 3hhhtb.exe 33 PID 2772 wrote to memory of 2440 2772 3hhhtb.exe 33 PID 2772 wrote to memory of 2440 2772 3hhhtb.exe 33 PID 2772 wrote to memory of 2440 2772 3hhhtb.exe 33 PID 2440 wrote to memory of 2436 2440 vvpjp.exe 34 PID 2440 wrote to memory of 2436 2440 vvpjp.exe 34 PID 2440 wrote to memory of 2436 2440 vvpjp.exe 34 PID 2440 wrote to memory of 2436 2440 vvpjp.exe 34 PID 2436 wrote to memory of 2444 2436 nntthh.exe 35 PID 2436 wrote to memory of 2444 2436 nntthh.exe 35 PID 2436 wrote to memory of 2444 2436 nntthh.exe 35 PID 2436 wrote to memory of 2444 2436 nntthh.exe 35 PID 2444 wrote to memory of 1868 2444 tnbhnh.exe 36 PID 2444 wrote to memory of 1868 2444 tnbhnh.exe 36 PID 2444 wrote to memory of 1868 2444 tnbhnh.exe 36 PID 2444 wrote to memory of 1868 2444 tnbhnh.exe 36 PID 1868 wrote to memory of 2696 1868 1lffffl.exe 37 PID 1868 wrote to memory of 2696 1868 1lffffl.exe 37 PID 1868 wrote to memory of 2696 1868 1lffffl.exe 37 PID 1868 wrote to memory of 2696 1868 1lffffl.exe 37 PID 2696 wrote to memory of 2620 2696 rlrflfr.exe 38 PID 2696 wrote to memory of 2620 2696 rlrflfr.exe 38 PID 2696 wrote to memory of 2620 2696 rlrflfr.exe 38 PID 2696 wrote to memory of 2620 2696 rlrflfr.exe 38 PID 2620 wrote to memory of 1248 2620 pvppj.exe 39 PID 2620 wrote to memory of 1248 2620 pvppj.exe 39 PID 2620 wrote to memory of 1248 2620 pvppj.exe 39 PID 2620 wrote to memory of 1248 2620 pvppj.exe 39 PID 1248 wrote to memory of 2124 1248 tntntt.exe 40 PID 1248 wrote to memory of 2124 1248 tntntt.exe 40 PID 1248 wrote to memory of 2124 1248 tntntt.exe 40 PID 1248 wrote to memory of 2124 1248 tntntt.exe 40 PID 2124 wrote to memory of 772 2124 fxxxxfx.exe 41 PID 2124 wrote to memory of 772 2124 fxxxxfx.exe 41 PID 2124 wrote to memory of 772 2124 fxxxxfx.exe 41 PID 2124 wrote to memory of 772 2124 fxxxxfx.exe 41 PID 772 wrote to memory of 1488 772 dddpp.exe 42 PID 772 wrote to memory of 1488 772 dddpp.exe 42 PID 772 wrote to memory of 1488 772 dddpp.exe 42 PID 772 wrote to memory of 1488 772 dddpp.exe 42 PID 1488 wrote to memory of 2852 1488 hthbht.exe 43 PID 1488 wrote to memory of 2852 1488 hthbht.exe 43 PID 1488 wrote to memory of 2852 1488 hthbht.exe 43 PID 1488 wrote to memory of 2852 1488 hthbht.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3c6cb40a2380d1e8fcc0d894adc8623_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f3c6cb40a2380d1e8fcc0d894adc8623_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\frxrrrf.exec:\frxrrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\jdjjj.exec:\jdjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\nhbhnt.exec:\nhbhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\pjjpp.exec:\pjjpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\3hhhtb.exec:\3hhhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\vvpjp.exec:\vvpjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\nntthh.exec:\nntthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\tnbhnh.exec:\tnbhnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\1lffffl.exec:\1lffffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\rlrflfr.exec:\rlrflfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\pvppj.exec:\pvppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\tntntt.exec:\tntntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\fxxxxfx.exec:\fxxxxfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\dddpp.exec:\dddpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\hthbht.exec:\hthbht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\rxlrlxx.exec:\rxlrlxx.exe17⤵
- Executes dropped EXE
PID:2852 -
\??\c:\dvdjp.exec:\dvdjp.exe18⤵
- Executes dropped EXE
PID:2044 -
\??\c:\rrxxllx.exec:\rrxxllx.exe19⤵
- Executes dropped EXE
PID:2216 -
\??\c:\jjddv.exec:\jjddv.exe20⤵
- Executes dropped EXE
PID:268 -
\??\c:\rfxflfl.exec:\rfxflfl.exe21⤵
- Executes dropped EXE
PID:1052 -
\??\c:\9vjjp.exec:\9vjjp.exe22⤵
- Executes dropped EXE
PID:2736 -
\??\c:\7lrxffl.exec:\7lrxffl.exe23⤵
- Executes dropped EXE
PID:664 -
\??\c:\dpdvj.exec:\dpdvj.exe24⤵
- Executes dropped EXE
PID:448 -
\??\c:\1xllfrl.exec:\1xllfrl.exe25⤵
- Executes dropped EXE
PID:708 -
\??\c:\djddp.exec:\djddp.exe26⤵
- Executes dropped EXE
PID:996 -
\??\c:\5xlxflx.exec:\5xlxflx.exe27⤵
- Executes dropped EXE
PID:2980 -
\??\c:\jjppv.exec:\jjppv.exe28⤵
- Executes dropped EXE
PID:876 -
\??\c:\5dpdj.exec:\5dpdj.exe29⤵
- Executes dropped EXE
PID:2192 -
\??\c:\7tthnn.exec:\7tthnn.exe30⤵
- Executes dropped EXE
PID:3004 -
\??\c:\flxrffr.exec:\flxrffr.exe31⤵
- Executes dropped EXE
PID:2668 -
\??\c:\fxxfrxl.exec:\fxxfrxl.exe32⤵
- Executes dropped EXE
PID:892 -
\??\c:\bbbnbh.exec:\bbbnbh.exe33⤵
- Executes dropped EXE
PID:2252 -
\??\c:\1xxrxrx.exec:\1xxrxrx.exe34⤵
- Executes dropped EXE
PID:2908 -
\??\c:\tbthbt.exec:\tbthbt.exe35⤵
- Executes dropped EXE
PID:2496 -
\??\c:\ddddp.exec:\ddddp.exe36⤵
- Executes dropped EXE
PID:2712 -
\??\c:\btnbnn.exec:\btnbnn.exe37⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rrrxlxf.exec:\rrrxlxf.exe38⤵
- Executes dropped EXE
PID:2432 -
\??\c:\3djdd.exec:\3djdd.exe39⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xflfffx.exec:\xflfffx.exe40⤵
- Executes dropped EXE
PID:2772 -
\??\c:\nhnhnh.exec:\nhnhnh.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xlflrrl.exec:\xlflrrl.exe42⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pjppp.exec:\pjppp.exe43⤵
- Executes dropped EXE
PID:108 -
\??\c:\flxxlrl.exec:\flxxlrl.exe44⤵
- Executes dropped EXE
PID:1516 -
\??\c:\vvpdv.exec:\vvpdv.exe45⤵
- Executes dropped EXE
PID:1548 -
\??\c:\ffrflrx.exec:\ffrflrx.exe46⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vpdjp.exec:\vpdjp.exe47⤵
- Executes dropped EXE
PID:400 -
\??\c:\rxrlxff.exec:\rxrlxff.exe48⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jvpdj.exec:\jvpdj.exe49⤵
- Executes dropped EXE
PID:1880 -
\??\c:\tttttt.exec:\tttttt.exe50⤵
- Executes dropped EXE
PID:640 -
\??\c:\vpjjj.exec:\vpjjj.exe51⤵
- Executes dropped EXE
PID:1096 -
\??\c:\thttnh.exec:\thttnh.exe52⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vdddp.exec:\vdddp.exe53⤵
- Executes dropped EXE
PID:848 -
\??\c:\llxlflx.exec:\llxlflx.exe54⤵
- Executes dropped EXE
PID:1260 -
\??\c:\vvpjp.exec:\vvpjp.exe55⤵
- Executes dropped EXE
PID:600 -
\??\c:\xxrxlxr.exec:\xxrxlxr.exe56⤵
- Executes dropped EXE
PID:576 -
\??\c:\ddppv.exec:\ddppv.exe57⤵
- Executes dropped EXE
PID:1780 -
\??\c:\rrllxlx.exec:\rrllxlx.exe58⤵
- Executes dropped EXE
PID:1140 -
\??\c:\5htbnt.exec:\5htbnt.exe59⤵
- Executes dropped EXE
PID:3032 -
\??\c:\1jvvv.exec:\1jvvv.exe60⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lfxflrf.exec:\lfxflrf.exe61⤵
- Executes dropped EXE
PID:448 -
\??\c:\jpddp.exec:\jpddp.exe62⤵
- Executes dropped EXE
PID:1792 -
\??\c:\lxrfllf.exec:\lxrfllf.exe63⤵
- Executes dropped EXE
PID:1928 -
\??\c:\pvvvj.exec:\pvvvj.exe64⤵
- Executes dropped EXE
PID:1648 -
\??\c:\hbtthb.exec:\hbtthb.exe65⤵
- Executes dropped EXE
PID:2236 -
\??\c:\7jjvj.exec:\7jjvj.exe66⤵PID:876
-
\??\c:\ttbnnh.exec:\ttbnnh.exe67⤵PID:2192
-
\??\c:\9vvjp.exec:\9vvjp.exe68⤵PID:3056
-
\??\c:\lrrfrfl.exec:\lrrfrfl.exe69⤵PID:540
-
\??\c:\7hhbnt.exec:\7hhbnt.exe70⤵PID:1560
-
\??\c:\ffrfrff.exec:\ffrfrff.exe71⤵PID:1500
-
\??\c:\djjdd.exec:\djjdd.exe72⤵PID:3024
-
\??\c:\rrrrlrf.exec:\rrrrlrf.exe73⤵PID:2908
-
\??\c:\hnnbtb.exec:\hnnbtb.exe74⤵PID:2496
-
\??\c:\9xxfrfr.exec:\9xxfrfr.exe75⤵PID:2792
-
\??\c:\jppvv.exec:\jppvv.exe76⤵PID:568
-
\??\c:\rfrrrxf.exec:\rfrrrxf.exe77⤵PID:2504
-
\??\c:\1btnhb.exec:\1btnhb.exe78⤵PID:2412
-
\??\c:\fxffrrf.exec:\fxffrrf.exe79⤵PID:2796
-
\??\c:\1ntbbb.exec:\1ntbbb.exe80⤵PID:2772
-
\??\c:\vddjp.exec:\vddjp.exe81⤵PID:1536
-
\??\c:\fllxrlf.exec:\fllxrlf.exe82⤵PID:1356
-
\??\c:\ddpjv.exec:\ddpjv.exe83⤵PID:2624
-
\??\c:\bbhnnh.exec:\bbhnnh.exe84⤵PID:2708
-
\??\c:\ppjpp.exec:\ppjpp.exe85⤵PID:2636
-
\??\c:\btbhth.exec:\btbhth.exe86⤵PID:1668
-
\??\c:\jvdvj.exec:\jvdvj.exe87⤵PID:1580
-
\??\c:\tnhhnn.exec:\tnhhnn.exe88⤵PID:2600
-
\??\c:\jppdp.exec:\jppdp.exe89⤵PID:2936
-
\??\c:\bbbtnb.exec:\bbbtnb.exe90⤵PID:1744
-
\??\c:\vpjpj.exec:\vpjpj.exe91⤵PID:1972
-
\??\c:\rrfrfrf.exec:\rrfrfrf.exe92⤵PID:1608
-
\??\c:\vjdpd.exec:\vjdpd.exe93⤵PID:2092
-
\??\c:\rlflflf.exec:\rlflflf.exe94⤵PID:1904
-
\??\c:\pjvpp.exec:\pjvpp.exe95⤵PID:2568
-
\??\c:\3rlrfll.exec:\3rlrfll.exe96⤵PID:688
-
\??\c:\tnthbt.exec:\tnthbt.exe97⤵PID:784
-
\??\c:\lfrfxxl.exec:\lfrfxxl.exe98⤵PID:1780
-
\??\c:\tntnnh.exec:\tntnnh.exe99⤵PID:2276
-
\??\c:\lffrflx.exec:\lffrflx.exe100⤵PID:1920
-
\??\c:\bttntn.exec:\bttntn.exe101⤵PID:708
-
\??\c:\djpdd.exec:\djpdd.exe102⤵PID:2292
-
\??\c:\nnntnb.exec:\nnntnb.exe103⤵PID:340
-
\??\c:\jdvvv.exec:\jdvvv.exe104⤵PID:1928
-
\??\c:\thttnn.exec:\thttnn.exe105⤵PID:2816
-
\??\c:\flrrxrx.exec:\flrrxrx.exe106⤵PID:1616
-
\??\c:\nnhthn.exec:\nnhthn.exe107⤵PID:1628
-
\??\c:\vjppj.exec:\vjppj.exe108⤵PID:1220
-
\??\c:\ttnbtt.exec:\ttnbtt.exe109⤵PID:2192
-
\??\c:\rxxrfrr.exec:\rxxrfrr.exe110⤵PID:1640
-
\??\c:\vpvjv.exec:\vpvjv.exe111⤵PID:2188
-
\??\c:\7nhhnt.exec:\7nhhnt.exe112⤵PID:1012
-
\??\c:\rrfrxrf.exec:\rrfrxrf.exe113⤵PID:2976
-
\??\c:\hhbtbh.exec:\hhbtbh.exe114⤵PID:2676
-
\??\c:\lllxxrr.exec:\lllxxrr.exe115⤵PID:2220
-
\??\c:\vjppv.exec:\vjppv.exe116⤵PID:1092
-
\??\c:\fflxflr.exec:\fflxflr.exe117⤵PID:2564
-
\??\c:\pjjdv.exec:\pjjdv.exe118⤵PID:2464
-
\??\c:\htnhnn.exec:\htnhnn.exe119⤵PID:2560
-
\??\c:\xrrlrlr.exec:\xrrlrlr.exe120⤵PID:2764
-
\??\c:\fxlxxlf.exec:\fxlxxlf.exe121⤵PID:1656
-
\??\c:\jjjdp.exec:\jjjdp.exe122⤵PID:896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-