Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 18:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3603e55f61dbab09496a2500337d24d2_JaffaCakes118.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
3603e55f61dbab09496a2500337d24d2_JaffaCakes118.exe
-
Size
92KB
-
MD5
3603e55f61dbab09496a2500337d24d2
-
SHA1
3503e371d4c0ba4d3be57ec2beba973c063ae2cd
-
SHA256
41ed94df272672323b3dcaba6860c90eb33999f8cd698f755993cd6f4e713bc5
-
SHA512
ece454da89409fa57578b10e4a6c3443bd159921bdd952ae8e2adbcabfc62562bdaf375a139c28175bfbabd6bb8b5d6c86f9dd9e06b5646940eb4f2bf37cf9e8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDWiekja1br3GGBxfot5lmKaZNkQL:ymb3NkkiQ3mdBjFWXkj7afo4ZERy
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral1/memory/2728-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1044-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-60-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1532-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1452-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/772-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/904-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/896-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1044 tnttnb.exe 2604 3jjdv.exe 2524 xrffllr.exe 2988 fxflxlr.exe 2424 hbtbtb.exe 2456 jjppp.exe 2152 fxfxllr.exe 2916 9fffrrx.exe 2648 9ntbbt.exe 2776 vpdjv.exe 1508 5lfxrll.exe 1644 nbhhtt.exe 1532 hthhnh.exe 1452 vvvdj.exe 1436 xfxlflx.exe 492 7lrrffl.exe 2228 btnhhn.exe 2220 jdvdd.exe 2256 vpppv.exe 1968 rlxxlfl.exe 772 nbtbbh.exe 1432 5thnbb.exe 1576 vpvvv.exe 2368 xxxffff.exe 2020 rlrfxxl.exe 776 thtntt.exe 904 hhbttn.exe 2948 jdvvd.exe 1332 ffxflfl.exe 1988 5bnntt.exe 896 hbnnbb.exe 1668 jdpdj.exe 1652 rlxlxfl.exe 1044 hhbhbn.exe 2620 btntnn.exe 2508 jpvdv.exe 2712 jjjvv.exe 2532 7fllrfx.exe 2988 3tthbt.exe 2760 pjvjp.exe 2520 vpvvv.exe 2700 llffrxl.exe 1620 hbhhnh.exe 2664 nnnthn.exe 2652 9vppv.exe 2636 pjvjj.exe 2792 9xrfxfr.exe 1900 xxrxffl.exe 1496 hbbnht.exe 332 vvjpj.exe 2132 vpjdd.exe 1584 pjdjd.exe 3032 7fxlxlx.exe 1212 5tnntn.exe 2496 hbtbtb.exe 2028 tnnthn.exe 2836 7vpdv.exe 2200 pjdjp.exe 2204 3fxxflx.exe 588 9rllfrl.exe 560 nhtnbt.exe 1756 hbtbhh.exe 788 tnbbnn.exe 632 pjvjp.exe -
resource yara_rule behavioral1/memory/2728-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1044-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1044-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1532-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1452-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/772-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/904-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/896-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2728 wrote to memory of 1044 2728 3603e55f61dbab09496a2500337d24d2_JaffaCakes118.exe 28 PID 2728 wrote to memory of 1044 2728 3603e55f61dbab09496a2500337d24d2_JaffaCakes118.exe 28 PID 2728 wrote to memory of 1044 2728 3603e55f61dbab09496a2500337d24d2_JaffaCakes118.exe 28 PID 2728 wrote to memory of 1044 2728 3603e55f61dbab09496a2500337d24d2_JaffaCakes118.exe 28 PID 1044 wrote to memory of 2604 1044 tnttnb.exe 29 PID 1044 wrote to memory of 2604 1044 tnttnb.exe 29 PID 1044 wrote to memory of 2604 1044 tnttnb.exe 29 PID 1044 wrote to memory of 2604 1044 tnttnb.exe 29 PID 2604 wrote to memory of 2524 2604 3jjdv.exe 30 PID 2604 wrote to memory of 2524 2604 3jjdv.exe 30 PID 2604 wrote to memory of 2524 2604 3jjdv.exe 30 PID 2604 wrote to memory of 2524 2604 3jjdv.exe 30 PID 2524 wrote to memory of 2988 2524 xrffllr.exe 31 PID 2524 wrote to memory of 2988 2524 xrffllr.exe 31 PID 2524 wrote to memory of 2988 2524 xrffllr.exe 31 PID 2524 wrote to memory of 2988 2524 xrffllr.exe 31 PID 2988 wrote to memory of 2424 2988 fxflxlr.exe 32 PID 2988 wrote to memory of 2424 2988 fxflxlr.exe 32 PID 2988 wrote to memory of 2424 2988 fxflxlr.exe 32 PID 2988 wrote to memory of 2424 2988 fxflxlr.exe 32 PID 2424 wrote to memory of 2456 2424 hbtbtb.exe 33 PID 2424 wrote to memory of 2456 2424 hbtbtb.exe 33 PID 2424 wrote to memory of 2456 2424 hbtbtb.exe 33 PID 2424 wrote to memory of 2456 2424 hbtbtb.exe 33 PID 2456 wrote to memory of 2152 2456 jjppp.exe 34 PID 2456 wrote to memory of 2152 2456 jjppp.exe 34 PID 2456 wrote to memory of 2152 2456 jjppp.exe 34 PID 2456 wrote to memory of 2152 2456 jjppp.exe 34 PID 2152 wrote to memory of 2916 2152 fxfxllr.exe 35 PID 2152 wrote to memory of 2916 2152 fxfxllr.exe 35 PID 2152 wrote to memory of 2916 2152 fxfxllr.exe 35 PID 2152 wrote to memory of 2916 2152 fxfxllr.exe 35 PID 2916 wrote to memory of 2648 2916 9fffrrx.exe 36 PID 2916 wrote to memory of 2648 2916 9fffrrx.exe 36 PID 2916 wrote to memory of 2648 2916 9fffrrx.exe 36 PID 2916 wrote to memory of 2648 2916 9fffrrx.exe 36 PID 2648 wrote to memory of 2776 2648 9ntbbt.exe 37 PID 2648 wrote to memory of 2776 2648 9ntbbt.exe 37 PID 2648 wrote to memory of 2776 2648 9ntbbt.exe 37 PID 2648 wrote to memory of 2776 2648 9ntbbt.exe 37 PID 2776 wrote to memory of 1508 2776 vpdjv.exe 38 PID 2776 wrote to memory of 1508 2776 vpdjv.exe 38 PID 2776 wrote to memory of 1508 2776 vpdjv.exe 38 PID 2776 wrote to memory of 1508 2776 vpdjv.exe 38 PID 1508 wrote to memory of 1644 1508 5lfxrll.exe 39 PID 1508 wrote to memory of 1644 1508 5lfxrll.exe 39 PID 1508 wrote to memory of 1644 1508 5lfxrll.exe 39 PID 1508 wrote to memory of 1644 1508 5lfxrll.exe 39 PID 1644 wrote to memory of 1532 1644 nbhhtt.exe 40 PID 1644 wrote to memory of 1532 1644 nbhhtt.exe 40 PID 1644 wrote to memory of 1532 1644 nbhhtt.exe 40 PID 1644 wrote to memory of 1532 1644 nbhhtt.exe 40 PID 1532 wrote to memory of 1452 1532 hthhnh.exe 41 PID 1532 wrote to memory of 1452 1532 hthhnh.exe 41 PID 1532 wrote to memory of 1452 1532 hthhnh.exe 41 PID 1532 wrote to memory of 1452 1532 hthhnh.exe 41 PID 1452 wrote to memory of 1436 1452 vvvdj.exe 42 PID 1452 wrote to memory of 1436 1452 vvvdj.exe 42 PID 1452 wrote to memory of 1436 1452 vvvdj.exe 42 PID 1452 wrote to memory of 1436 1452 vvvdj.exe 42 PID 1436 wrote to memory of 492 1436 xfxlflx.exe 43 PID 1436 wrote to memory of 492 1436 xfxlflx.exe 43 PID 1436 wrote to memory of 492 1436 xfxlflx.exe 43 PID 1436 wrote to memory of 492 1436 xfxlflx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\3603e55f61dbab09496a2500337d24d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3603e55f61dbab09496a2500337d24d2_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\tnttnb.exec:\tnttnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\3jjdv.exec:\3jjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\xrffllr.exec:\xrffllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\fxflxlr.exec:\fxflxlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\hbtbtb.exec:\hbtbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\jjppp.exec:\jjppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\fxfxllr.exec:\fxfxllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\9fffrrx.exec:\9fffrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\9ntbbt.exec:\9ntbbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\vpdjv.exec:\vpdjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\5lfxrll.exec:\5lfxrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\nbhhtt.exec:\nbhhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\hthhnh.exec:\hthhnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\vvvdj.exec:\vvvdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\xfxlflx.exec:\xfxlflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\7lrrffl.exec:\7lrrffl.exe17⤵
- Executes dropped EXE
PID:492 -
\??\c:\btnhhn.exec:\btnhhn.exe18⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jdvdd.exec:\jdvdd.exe19⤵
- Executes dropped EXE
PID:2220 -
\??\c:\vpppv.exec:\vpppv.exe20⤵
- Executes dropped EXE
PID:2256 -
\??\c:\rlxxlfl.exec:\rlxxlfl.exe21⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nbtbbh.exec:\nbtbbh.exe22⤵
- Executes dropped EXE
PID:772 -
\??\c:\5thnbb.exec:\5thnbb.exe23⤵
- Executes dropped EXE
PID:1432 -
\??\c:\vpvvv.exec:\vpvvv.exe24⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xxxffff.exec:\xxxffff.exe25⤵
- Executes dropped EXE
PID:2368 -
\??\c:\rlrfxxl.exec:\rlrfxxl.exe26⤵
- Executes dropped EXE
PID:2020 -
\??\c:\thtntt.exec:\thtntt.exe27⤵
- Executes dropped EXE
PID:776 -
\??\c:\hhbttn.exec:\hhbttn.exe28⤵
- Executes dropped EXE
PID:904 -
\??\c:\jdvvd.exec:\jdvvd.exe29⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ffxflfl.exec:\ffxflfl.exe30⤵
- Executes dropped EXE
PID:1332 -
\??\c:\5bnntt.exec:\5bnntt.exe31⤵
- Executes dropped EXE
PID:1988 -
\??\c:\hbnnbb.exec:\hbnnbb.exe32⤵
- Executes dropped EXE
PID:896 -
\??\c:\jdpdj.exec:\jdpdj.exe33⤵
- Executes dropped EXE
PID:1668 -
\??\c:\rlxlxfl.exec:\rlxlxfl.exe34⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hhbhbn.exec:\hhbhbn.exe35⤵
- Executes dropped EXE
PID:1044 -
\??\c:\btntnn.exec:\btntnn.exe36⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jpvdv.exec:\jpvdv.exe37⤵
- Executes dropped EXE
PID:2508 -
\??\c:\jjjvv.exec:\jjjvv.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\7fllrfx.exec:\7fllrfx.exe39⤵
- Executes dropped EXE
PID:2532 -
\??\c:\3tthbt.exec:\3tthbt.exe40⤵
- Executes dropped EXE
PID:2988 -
\??\c:\pjvjp.exec:\pjvjp.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vpvvv.exec:\vpvvv.exe42⤵
- Executes dropped EXE
PID:2520 -
\??\c:\llffrxl.exec:\llffrxl.exe43⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hbhhnh.exec:\hbhhnh.exe44⤵
- Executes dropped EXE
PID:1620 -
\??\c:\nnnthn.exec:\nnnthn.exe45⤵
- Executes dropped EXE
PID:2664 -
\??\c:\9vppv.exec:\9vppv.exe46⤵
- Executes dropped EXE
PID:2652 -
\??\c:\pjvjj.exec:\pjvjj.exe47⤵
- Executes dropped EXE
PID:2636 -
\??\c:\9xrfxfr.exec:\9xrfxfr.exe48⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xxrxffl.exec:\xxrxffl.exe49⤵
- Executes dropped EXE
PID:1900 -
\??\c:\hbbnht.exec:\hbbnht.exe50⤵
- Executes dropped EXE
PID:1496 -
\??\c:\vvjpj.exec:\vvjpj.exe51⤵
- Executes dropped EXE
PID:332 -
\??\c:\vpjdd.exec:\vpjdd.exe52⤵
- Executes dropped EXE
PID:2132 -
\??\c:\pjdjd.exec:\pjdjd.exe53⤵
- Executes dropped EXE
PID:1584 -
\??\c:\7fxlxlx.exec:\7fxlxlx.exe54⤵
- Executes dropped EXE
PID:3032 -
\??\c:\5tnntn.exec:\5tnntn.exe55⤵
- Executes dropped EXE
PID:1212 -
\??\c:\hbtbtb.exec:\hbtbtb.exe56⤵
- Executes dropped EXE
PID:2496 -
\??\c:\tnnthn.exec:\tnnthn.exe57⤵
- Executes dropped EXE
PID:2028 -
\??\c:\7vpdv.exec:\7vpdv.exe58⤵
- Executes dropped EXE
PID:2836 -
\??\c:\pjdjp.exec:\pjdjp.exe59⤵
- Executes dropped EXE
PID:2200 -
\??\c:\3fxxflx.exec:\3fxxflx.exe60⤵
- Executes dropped EXE
PID:2204 -
\??\c:\9rllfrl.exec:\9rllfrl.exe61⤵
- Executes dropped EXE
PID:588 -
\??\c:\nhtnbt.exec:\nhtnbt.exe62⤵
- Executes dropped EXE
PID:560 -
\??\c:\hbtbhh.exec:\hbtbhh.exe63⤵
- Executes dropped EXE
PID:1756 -
\??\c:\tnbbnn.exec:\tnbbnn.exe64⤵
- Executes dropped EXE
PID:788 -
\??\c:\pjvjp.exec:\pjvjp.exe65⤵
- Executes dropped EXE
PID:632 -
\??\c:\vvpjj.exec:\vvpjj.exe66⤵PID:1316
-
\??\c:\7lxxfrl.exec:\7lxxfrl.exe67⤵PID:2100
-
\??\c:\5llxfrx.exec:\5llxfrx.exe68⤵PID:2984
-
\??\c:\bbtbtb.exec:\bbtbtb.exe69⤵PID:2164
-
\??\c:\hhbhbh.exec:\hhbhbh.exe70⤵PID:2948
-
\??\c:\5hhbhn.exec:\5hhbhn.exe71⤵PID:2172
-
\??\c:\7dppj.exec:\7dppj.exe72⤵PID:3004
-
\??\c:\1rflxxf.exec:\1rflxxf.exe73⤵PID:2104
-
\??\c:\llxxllx.exec:\llxxllx.exe74⤵PID:2804
-
\??\c:\xxrxrff.exec:\xxrxrff.exe75⤵PID:1536
-
\??\c:\hnbttn.exec:\hnbttn.exe76⤵PID:2492
-
\??\c:\hbnnhn.exec:\hbnnhn.exe77⤵PID:2672
-
\??\c:\7pjvj.exec:\7pjvj.exe78⤵PID:2828
-
\??\c:\dpppj.exec:\dpppj.exe79⤵PID:2740
-
\??\c:\lrlrxrr.exec:\lrlrxrr.exe80⤵PID:2004
-
\??\c:\1bthtt.exec:\1bthtt.exe81⤵PID:2816
-
\??\c:\9tnthn.exec:\9tnthn.exe82⤵PID:2424
-
\??\c:\tthnhn.exec:\tthnhn.exe83⤵PID:2464
-
\??\c:\dvdjp.exec:\dvdjp.exe84⤵PID:2944
-
\??\c:\ddjvp.exec:\ddjvp.exe85⤵PID:284
-
\??\c:\5rlxxxl.exec:\5rlxxxl.exe86⤵PID:2912
-
\??\c:\1rlxlrf.exec:\1rlxlrf.exe87⤵PID:2624
-
\??\c:\btbhbh.exec:\btbhbh.exe88⤵PID:2500
-
\??\c:\3bnthn.exec:\3bnthn.exe89⤵PID:1560
-
\??\c:\ddvjp.exec:\ddvjp.exe90⤵PID:2296
-
\??\c:\dvdjv.exec:\dvdjv.exe91⤵PID:1484
-
\??\c:\7jvdj.exec:\7jvdj.exe92⤵PID:376
-
\??\c:\lfrlrrf.exec:\lfrlrrf.exe93⤵PID:2388
-
\??\c:\7fflxxl.exec:\7fflxxl.exe94⤵PID:1380
-
\??\c:\tnhbhn.exec:\tnhbhn.exe95⤵PID:1436
-
\??\c:\5nnhnt.exec:\5nnhnt.exe96⤵PID:2300
-
\??\c:\ppjvj.exec:\ppjvj.exe97⤵PID:2248
-
\??\c:\3vjjp.exec:\3vjjp.exe98⤵PID:1628
-
\??\c:\dvdjj.exec:\dvdjj.exe99⤵PID:2220
-
\??\c:\xffrxfr.exec:\xffrxfr.exe100⤵PID:2256
-
\??\c:\ffrrffr.exec:\ffrrffr.exe101⤵PID:448
-
\??\c:\bbnbnb.exec:\bbnbnb.exe102⤵PID:324
-
\??\c:\hbnnbb.exec:\hbnnbb.exe103⤵PID:988
-
\??\c:\tnhhtb.exec:\tnhhtb.exe104⤵PID:2768
-
\??\c:\ppvpv.exec:\ppvpv.exe105⤵PID:1944
-
\??\c:\3jddj.exec:\3jddj.exe106⤵PID:452
-
\??\c:\ffffllr.exec:\ffffllr.exe107⤵PID:1840
-
\??\c:\5rfffxx.exec:\5rfffxx.exe108⤵PID:1208
-
\??\c:\ttbbbn.exec:\ttbbbn.exe109⤵PID:1948
-
\??\c:\hhhhhb.exec:\hhhhhb.exe110⤵PID:352
-
\??\c:\dppjv.exec:\dppjv.exe111⤵PID:1816
-
\??\c:\jdvvj.exec:\jdvvj.exe112⤵PID:1332
-
\??\c:\7fxxfrf.exec:\7fxxfrf.exe113⤵PID:1728
-
\??\c:\tnhhtt.exec:\tnhhtt.exe114⤵PID:1444
-
\??\c:\tbnhnt.exec:\tbnhnt.exe115⤵PID:2728
-
\??\c:\5jdjv.exec:\5jdjv.exe116⤵PID:2980
-
\??\c:\ppddd.exec:\ppddd.exe117⤵PID:2732
-
\??\c:\7rlrlrf.exec:\7rlrlrf.exe118⤵PID:2616
-
\??\c:\9bnhbt.exec:\9bnhbt.exe119⤵PID:2548
-
\??\c:\3hbnth.exec:\3hbnth.exe120⤵PID:2556
-
\??\c:\jjvdp.exec:\jjvdp.exe121⤵PID:2560
-
\??\c:\5ppdp.exec:\5ppdp.exe122⤵PID:2332
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-