Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 04:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8604b6a8c872a2cdae485b3d98d2bcc2_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
8604b6a8c872a2cdae485b3d98d2bcc2_JaffaCakes118.exe
-
Size
101KB
-
MD5
8604b6a8c872a2cdae485b3d98d2bcc2
-
SHA1
cedebb7fc814e219c9e27a45bec270b0d9534a13
-
SHA256
a6a54a331e4403156ec6893c5f4760e5d65d760a16a97e33b36098220535a003
-
SHA512
560e233d447ba2f0b664437f739d518a232a9d84c2147ee2f256b8a33a81d5e14c21ccd21f9f40a7b33880fbdcdc0f5ca95a2374d88ab49eaa5020f572449e2b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2lmf6g7xmIi6h7zp:ymb3NkkiQ3mdBjF+3TU20L46FV
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/1400-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/112-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1328-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1468-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1144-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/576-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/708-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2412 hvffxxt.exe 2424 plhft.exe 2532 jxfrp.exe 2440 bntlt.exe 2612 xphnxjh.exe 2500 thnbtp.exe 2352 bnfhj.exe 2608 rrhtpfj.exe 112 rnjrdd.exe 2312 tpnlb.exe 1328 vlrxtvr.exe 2792 hhjpr.exe 2016 pdlhh.exe 1468 tjnddv.exe 2400 xtbrdnv.exe 2588 brpvvfn.exe 1144 jnvbjrx.exe 2272 vndfrpf.exe 2268 lprnx.exe 576 fxxvnpf.exe 1568 bdvjf.exe 2052 jrrlxh.exe 3060 lxlpvd.exe 2192 tbrvp.exe 1156 hdxhltd.exe 1444 vtftjf.exe 2020 lxltbdx.exe 2984 xtfdhhp.exe 2708 vxfvnxv.exe 704 phvdf.exe 708 brtdptl.exe 1972 bpxppj.exe 2300 hfrnl.exe 1588 hxjvtpx.exe 2872 rjttd.exe 2620 jxtvltd.exe 2728 ftxjhnv.exe 2488 lnndxh.exe 884 nvbtb.exe 2448 rhphrjh.exe 2356 nxbxx.exe 2444 nrvlbb.exe 2404 xljppx.exe 2796 nbjtfx.exe 1916 xrpfpdp.exe 1364 prxrr.exe 1300 bbpjxtl.exe 652 pnrfdd.exe 2692 pvnlpxf.exe 2832 nthvr.exe 2000 ttxxlrn.exe 1648 rxhfftf.exe 2320 ttjnhb.exe 2628 bpxvlpt.exe 1460 fxphxpv.exe 1772 ppfdjpn.exe 2264 xldxhdh.exe 2272 vxjlj.exe 584 tjvtblf.exe 2084 bdhxbt.exe 1472 pbjppdn.exe 2940 njrjnfh.exe 2204 nxffbtb.exe 3060 jbdfhlj.exe -
resource yara_rule behavioral1/memory/1400-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/112-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1328-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1468-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1144-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/576-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/708-305-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1400 wrote to memory of 2412 1400 8604b6a8c872a2cdae485b3d98d2bcc2_JaffaCakes118.exe 28 PID 1400 wrote to memory of 2412 1400 8604b6a8c872a2cdae485b3d98d2bcc2_JaffaCakes118.exe 28 PID 1400 wrote to memory of 2412 1400 8604b6a8c872a2cdae485b3d98d2bcc2_JaffaCakes118.exe 28 PID 1400 wrote to memory of 2412 1400 8604b6a8c872a2cdae485b3d98d2bcc2_JaffaCakes118.exe 28 PID 2412 wrote to memory of 2424 2412 hvffxxt.exe 29 PID 2412 wrote to memory of 2424 2412 hvffxxt.exe 29 PID 2412 wrote to memory of 2424 2412 hvffxxt.exe 29 PID 2412 wrote to memory of 2424 2412 hvffxxt.exe 29 PID 2424 wrote to memory of 2532 2424 plhft.exe 30 PID 2424 wrote to memory of 2532 2424 plhft.exe 30 PID 2424 wrote to memory of 2532 2424 plhft.exe 30 PID 2424 wrote to memory of 2532 2424 plhft.exe 30 PID 2532 wrote to memory of 2440 2532 jxfrp.exe 31 PID 2532 wrote to memory of 2440 2532 jxfrp.exe 31 PID 2532 wrote to memory of 2440 2532 jxfrp.exe 31 PID 2532 wrote to memory of 2440 2532 jxfrp.exe 31 PID 2440 wrote to memory of 2612 2440 bntlt.exe 32 PID 2440 wrote to memory of 2612 2440 bntlt.exe 32 PID 2440 wrote to memory of 2612 2440 bntlt.exe 32 PID 2440 wrote to memory of 2612 2440 bntlt.exe 32 PID 2612 wrote to memory of 2500 2612 xphnxjh.exe 33 PID 2612 wrote to memory of 2500 2612 xphnxjh.exe 33 PID 2612 wrote to memory of 2500 2612 xphnxjh.exe 33 PID 2612 wrote to memory of 2500 2612 xphnxjh.exe 33 PID 2500 wrote to memory of 2352 2500 thnbtp.exe 34 PID 2500 wrote to memory of 2352 2500 thnbtp.exe 34 PID 2500 wrote to memory of 2352 2500 thnbtp.exe 34 PID 2500 wrote to memory of 2352 2500 thnbtp.exe 34 PID 2352 wrote to memory of 2608 2352 bnfhj.exe 35 PID 2352 wrote to memory of 2608 2352 bnfhj.exe 35 PID 2352 wrote to memory of 2608 2352 bnfhj.exe 35 PID 2352 wrote to memory of 2608 2352 bnfhj.exe 35 PID 2608 wrote to memory of 112 2608 rrhtpfj.exe 36 PID 2608 wrote to memory of 112 2608 rrhtpfj.exe 36 PID 2608 wrote to memory of 112 2608 rrhtpfj.exe 36 PID 2608 wrote to memory of 112 2608 rrhtpfj.exe 36 PID 112 wrote to memory of 2312 112 rnjrdd.exe 37 PID 112 wrote to memory of 2312 112 rnjrdd.exe 37 PID 112 wrote to memory of 2312 112 rnjrdd.exe 37 PID 112 wrote to memory of 2312 112 rnjrdd.exe 37 PID 2312 wrote to memory of 1328 2312 tpnlb.exe 38 PID 2312 wrote to memory of 1328 2312 tpnlb.exe 38 PID 2312 wrote to memory of 1328 2312 tpnlb.exe 38 PID 2312 wrote to memory of 1328 2312 tpnlb.exe 38 PID 1328 wrote to memory of 2792 1328 vlrxtvr.exe 39 PID 1328 wrote to memory of 2792 1328 vlrxtvr.exe 39 PID 1328 wrote to memory of 2792 1328 vlrxtvr.exe 39 PID 1328 wrote to memory of 2792 1328 vlrxtvr.exe 39 PID 2792 wrote to memory of 2016 2792 hhjpr.exe 40 PID 2792 wrote to memory of 2016 2792 hhjpr.exe 40 PID 2792 wrote to memory of 2016 2792 hhjpr.exe 40 PID 2792 wrote to memory of 2016 2792 hhjpr.exe 40 PID 2016 wrote to memory of 1468 2016 pdlhh.exe 41 PID 2016 wrote to memory of 1468 2016 pdlhh.exe 41 PID 2016 wrote to memory of 1468 2016 pdlhh.exe 41 PID 2016 wrote to memory of 1468 2016 pdlhh.exe 41 PID 1468 wrote to memory of 2400 1468 tjnddv.exe 42 PID 1468 wrote to memory of 2400 1468 tjnddv.exe 42 PID 1468 wrote to memory of 2400 1468 tjnddv.exe 42 PID 1468 wrote to memory of 2400 1468 tjnddv.exe 42 PID 2400 wrote to memory of 2588 2400 xtbrdnv.exe 43 PID 2400 wrote to memory of 2588 2400 xtbrdnv.exe 43 PID 2400 wrote to memory of 2588 2400 xtbrdnv.exe 43 PID 2400 wrote to memory of 2588 2400 xtbrdnv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\8604b6a8c872a2cdae485b3d98d2bcc2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8604b6a8c872a2cdae485b3d98d2bcc2_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\hvffxxt.exec:\hvffxxt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\plhft.exec:\plhft.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\jxfrp.exec:\jxfrp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\bntlt.exec:\bntlt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\xphnxjh.exec:\xphnxjh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\thnbtp.exec:\thnbtp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\bnfhj.exec:\bnfhj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\rrhtpfj.exec:\rrhtpfj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\rnjrdd.exec:\rnjrdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\tpnlb.exec:\tpnlb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\vlrxtvr.exec:\vlrxtvr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\hhjpr.exec:\hhjpr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\pdlhh.exec:\pdlhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\tjnddv.exec:\tjnddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\xtbrdnv.exec:\xtbrdnv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\brpvvfn.exec:\brpvvfn.exe17⤵
- Executes dropped EXE
PID:2588 -
\??\c:\jnvbjrx.exec:\jnvbjrx.exe18⤵
- Executes dropped EXE
PID:1144 -
\??\c:\vndfrpf.exec:\vndfrpf.exe19⤵
- Executes dropped EXE
PID:2272 -
\??\c:\lprnx.exec:\lprnx.exe20⤵
- Executes dropped EXE
PID:2268 -
\??\c:\fxxvnpf.exec:\fxxvnpf.exe21⤵
- Executes dropped EXE
PID:576 -
\??\c:\bdvjf.exec:\bdvjf.exe22⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jrrlxh.exec:\jrrlxh.exe23⤵
- Executes dropped EXE
PID:2052 -
\??\c:\lxlpvd.exec:\lxlpvd.exe24⤵
- Executes dropped EXE
PID:3060 -
\??\c:\tbrvp.exec:\tbrvp.exe25⤵
- Executes dropped EXE
PID:2192 -
\??\c:\hdxhltd.exec:\hdxhltd.exe26⤵
- Executes dropped EXE
PID:1156 -
\??\c:\vtftjf.exec:\vtftjf.exe27⤵
- Executes dropped EXE
PID:1444 -
\??\c:\lxltbdx.exec:\lxltbdx.exe28⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xtfdhhp.exec:\xtfdhhp.exe29⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vxfvnxv.exec:\vxfvnxv.exe30⤵
- Executes dropped EXE
PID:2708 -
\??\c:\phvdf.exec:\phvdf.exe31⤵
- Executes dropped EXE
PID:704 -
\??\c:\brtdptl.exec:\brtdptl.exe32⤵
- Executes dropped EXE
PID:708 -
\??\c:\bpxppj.exec:\bpxppj.exe33⤵
- Executes dropped EXE
PID:1972 -
\??\c:\hfrnl.exec:\hfrnl.exe34⤵
- Executes dropped EXE
PID:2300 -
\??\c:\hxjvtpx.exec:\hxjvtpx.exe35⤵
- Executes dropped EXE
PID:1588 -
\??\c:\rjttd.exec:\rjttd.exe36⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jxtvltd.exec:\jxtvltd.exe37⤵
- Executes dropped EXE
PID:2620 -
\??\c:\ftxjhnv.exec:\ftxjhnv.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\lnndxh.exec:\lnndxh.exe39⤵
- Executes dropped EXE
PID:2488 -
\??\c:\nvbtb.exec:\nvbtb.exe40⤵
- Executes dropped EXE
PID:884 -
\??\c:\rhphrjh.exec:\rhphrjh.exe41⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nxbxx.exec:\nxbxx.exe42⤵
- Executes dropped EXE
PID:2356 -
\??\c:\nrvlbb.exec:\nrvlbb.exe43⤵
- Executes dropped EXE
PID:2444 -
\??\c:\xljppx.exec:\xljppx.exe44⤵
- Executes dropped EXE
PID:2404 -
\??\c:\nbjtfx.exec:\nbjtfx.exe45⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xrpfpdp.exec:\xrpfpdp.exe46⤵
- Executes dropped EXE
PID:1916 -
\??\c:\prxrr.exec:\prxrr.exe47⤵
- Executes dropped EXE
PID:1364 -
\??\c:\bbpjxtl.exec:\bbpjxtl.exe48⤵
- Executes dropped EXE
PID:1300 -
\??\c:\pnrfdd.exec:\pnrfdd.exe49⤵
- Executes dropped EXE
PID:652 -
\??\c:\pvnlpxf.exec:\pvnlpxf.exe50⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nthvr.exec:\nthvr.exe51⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ttxxlrn.exec:\ttxxlrn.exe52⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rxhfftf.exec:\rxhfftf.exe53⤵
- Executes dropped EXE
PID:1648 -
\??\c:\ttjnhb.exec:\ttjnhb.exe54⤵
- Executes dropped EXE
PID:2320 -
\??\c:\bpxvlpt.exec:\bpxvlpt.exe55⤵
- Executes dropped EXE
PID:2628 -
\??\c:\fxphxpv.exec:\fxphxpv.exe56⤵
- Executes dropped EXE
PID:1460 -
\??\c:\ppfdjpn.exec:\ppfdjpn.exe57⤵
- Executes dropped EXE
PID:1772 -
\??\c:\xldxhdh.exec:\xldxhdh.exe58⤵
- Executes dropped EXE
PID:2264 -
\??\c:\vxjlj.exec:\vxjlj.exe59⤵
- Executes dropped EXE
PID:2272 -
\??\c:\tjvtblf.exec:\tjvtblf.exe60⤵
- Executes dropped EXE
PID:584 -
\??\c:\bdhxbt.exec:\bdhxbt.exe61⤵
- Executes dropped EXE
PID:2084 -
\??\c:\pbjppdn.exec:\pbjppdn.exe62⤵
- Executes dropped EXE
PID:1472 -
\??\c:\njrjnfh.exec:\njrjnfh.exe63⤵
- Executes dropped EXE
PID:2940 -
\??\c:\nxffbtb.exec:\nxffbtb.exe64⤵
- Executes dropped EXE
PID:2204 -
\??\c:\jbdfhlj.exec:\jbdfhlj.exe65⤵
- Executes dropped EXE
PID:3060 -
\??\c:\brjnpxx.exec:\brjnpxx.exe66⤵PID:2192
-
\??\c:\pbxdxf.exec:\pbxdxf.exe67⤵PID:2732
-
\??\c:\nrjpd.exec:\nrjpd.exe68⤵PID:2160
-
\??\c:\hrrfrvf.exec:\hrrfrvf.exe69⤵PID:1072
-
\??\c:\vhjxjpp.exec:\vhjxjpp.exe70⤵PID:2024
-
\??\c:\xdtjrxr.exec:\xdtjrxr.exe71⤵PID:2984
-
\??\c:\hndrl.exec:\hndrl.exe72⤵PID:2896
-
\??\c:\lplphh.exec:\lplphh.exe73⤵PID:1660
-
\??\c:\jvhbj.exec:\jvhbj.exe74⤵PID:948
-
\??\c:\nxrrbj.exec:\nxrrbj.exe75⤵PID:708
-
\??\c:\prntx.exec:\prntx.exe76⤵PID:2180
-
\??\c:\lxjvxtn.exec:\lxjvxtn.exe77⤵PID:1400
-
\??\c:\vtrxd.exec:\vtrxd.exe78⤵PID:1588
-
\??\c:\fvvnv.exec:\fvvnv.exe79⤵PID:2872
-
\??\c:\xlrbp.exec:\xlrbp.exe80⤵PID:2564
-
\??\c:\tpnxr.exec:\tpnxr.exe81⤵PID:2516
-
\??\c:\hlrrvpf.exec:\hlrrvpf.exe82⤵PID:2488
-
\??\c:\vbjfrp.exec:\vbjfrp.exe83⤵PID:884
-
\??\c:\lllnpb.exec:\lllnpb.exe84⤵PID:2664
-
\??\c:\dnvpphx.exec:\dnvpphx.exe85⤵PID:2356
-
\??\c:\xddtl.exec:\xddtl.exe86⤵PID:2444
-
\??\c:\xpldf.exec:\xpldf.exe87⤵PID:2452
-
\??\c:\jdfdpfd.exec:\jdfdpfd.exe88⤵PID:2996
-
\??\c:\flbxrlh.exec:\flbxrlh.exe89⤵PID:1916
-
\??\c:\jxddhx.exec:\jxddhx.exe90⤵PID:1816
-
\??\c:\pthxtpj.exec:\pthxtpj.exe91⤵PID:1300
-
\??\c:\jxfdrd.exec:\jxfdrd.exe92⤵PID:652
-
\??\c:\tthjhfp.exec:\tthjhfp.exe93⤵PID:1988
-
\??\c:\xxjxnpj.exec:\xxjxnpj.exe94⤵PID:2148
-
\??\c:\ltnbnnh.exec:\ltnbnnh.exe95⤵PID:2000
-
\??\c:\rbrnfj.exec:\rbrnfj.exe96⤵PID:864
-
\??\c:\bddtndd.exec:\bddtndd.exe97⤵PID:1976
-
\??\c:\dvthd.exec:\dvthd.exe98⤵PID:2288
-
\??\c:\dhfbxv.exec:\dhfbxv.exe99⤵PID:1188
-
\??\c:\pblxr.exec:\pblxr.exe100⤵PID:1196
-
\??\c:\ddhdnrn.exec:\ddhdnrn.exe101⤵PID:1772
-
\??\c:\xbnrl.exec:\xbnrl.exe102⤵PID:2264
-
\??\c:\rxvjj.exec:\rxvjj.exe103⤵PID:2272
-
\??\c:\tpjvf.exec:\tpjvf.exe104⤵PID:584
-
\??\c:\xjjfh.exec:\xjjfh.exe105⤵PID:2988
-
\??\c:\llbfx.exec:\llbfx.exe106⤵PID:1472
-
\??\c:\xfrdlfr.exec:\xfrdlfr.exe107⤵PID:416
-
\??\c:\dlhnd.exec:\dlhnd.exe108⤵PID:1316
-
\??\c:\hbvxh.exec:\hbvxh.exe109⤵PID:1152
-
\??\c:\phlfnll.exec:\phlfnll.exe110⤵PID:1828
-
\??\c:\vfbdbxr.exec:\vfbdbxr.exe111⤵PID:1548
-
\??\c:\xbtjxnl.exec:\xbtjxnl.exe112⤵PID:2892
-
\??\c:\ndxxxhp.exec:\ndxxxhp.exe113⤵PID:916
-
\??\c:\jpnrxth.exec:\jpnrxth.exe114⤵PID:2020
-
\??\c:\drvlfb.exec:\drvlfb.exe115⤵PID:2976
-
\??\c:\lxtddp.exec:\lxtddp.exe116⤵PID:2108
-
\??\c:\nfhrhdv.exec:\nfhrhdv.exe117⤵PID:2964
-
\??\c:\fvtnnjf.exec:\fvtnnjf.exe118⤵PID:2164
-
\??\c:\bdjvh.exec:\bdjvh.exe119⤵PID:708
-
\??\c:\dtnjjb.exec:\dtnjjb.exe120⤵PID:2180
-
\??\c:\xlvntpj.exec:\xlvntpj.exe121⤵PID:2904
-
\??\c:\nlrnp.exec:\nlrnp.exe122⤵PID:2916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-