Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 04:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8604b6a8c872a2cdae485b3d98d2bcc2_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
8604b6a8c872a2cdae485b3d98d2bcc2_JaffaCakes118.exe
-
Size
101KB
-
MD5
8604b6a8c872a2cdae485b3d98d2bcc2
-
SHA1
cedebb7fc814e219c9e27a45bec270b0d9534a13
-
SHA256
a6a54a331e4403156ec6893c5f4760e5d65d760a16a97e33b36098220535a003
-
SHA512
560e233d447ba2f0b664437f739d518a232a9d84c2147ee2f256b8a33a81d5e14c21ccd21f9f40a7b33880fbdcdc0f5ca95a2374d88ab49eaa5020f572449e2b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2lmf6g7xmIi6h7zp:ymb3NkkiQ3mdBjF+3TU20L46FV
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4472-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3204-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3756-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1552-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3796-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/760-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/808-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3204 0682444.exe 1236 00664.exe 2352 6004222.exe 3756 4860668.exe 3076 26604.exe 4312 m4642.exe 4328 840482.exe 4024 jpjvv.exe 5056 i282626.exe 4076 006660.exe 3396 pjdpj.exe 2136 w24260.exe 3580 bnnhtt.exe 5088 e28626.exe 4936 42820.exe 1552 htbnht.exe 3796 g0460.exe 2204 vpdvp.exe 3804 w06488.exe 2760 1bbbnn.exe 4672 86826.exe 3188 fllfxrf.exe 3584 bnbhhn.exe 2408 9xrlfxr.exe 760 20048.exe 808 4804804.exe 4284 028426.exe 4460 httnbh.exe 3464 86486.exe 3620 c080426.exe 4368 088482.exe 544 tthtnh.exe 4208 nbtnbt.exe 4316 028488.exe 3764 lxlfxrf.exe 1808 066426.exe 1136 pvdvj.exe 4360 xrrfrll.exe 4080 4466626.exe 2268 202226.exe 1032 9lfxrrl.exe 3332 pjvpp.exe 1976 6204220.exe 684 266668.exe 2996 c404444.exe 1740 xxrfxll.exe 4232 vpppj.exe 2716 064044.exe 4328 nbbtnn.exe 2100 2666660.exe 4988 8228444.exe 4048 3ddvv.exe 3856 tnbbnt.exe 2008 xfllflf.exe 3396 1bbbtt.exe 4184 3tbbbt.exe 4108 fxllrlr.exe 840 5lllffx.exe 1556 llllfxl.exe 3504 60666.exe 5064 0244888.exe 4644 k28882.exe 4288 llrxfxf.exe 3292 rlrlrrx.exe -
resource yara_rule behavioral2/memory/4472-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3756-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3796-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/760-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/808-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4472 wrote to memory of 3204 4472 8604b6a8c872a2cdae485b3d98d2bcc2_JaffaCakes118.exe 82 PID 4472 wrote to memory of 3204 4472 8604b6a8c872a2cdae485b3d98d2bcc2_JaffaCakes118.exe 82 PID 4472 wrote to memory of 3204 4472 8604b6a8c872a2cdae485b3d98d2bcc2_JaffaCakes118.exe 82 PID 3204 wrote to memory of 1236 3204 0682444.exe 83 PID 3204 wrote to memory of 1236 3204 0682444.exe 83 PID 3204 wrote to memory of 1236 3204 0682444.exe 83 PID 1236 wrote to memory of 2352 1236 00664.exe 84 PID 1236 wrote to memory of 2352 1236 00664.exe 84 PID 1236 wrote to memory of 2352 1236 00664.exe 84 PID 2352 wrote to memory of 3756 2352 6004222.exe 85 PID 2352 wrote to memory of 3756 2352 6004222.exe 85 PID 2352 wrote to memory of 3756 2352 6004222.exe 85 PID 3756 wrote to memory of 3076 3756 4860668.exe 86 PID 3756 wrote to memory of 3076 3756 4860668.exe 86 PID 3756 wrote to memory of 3076 3756 4860668.exe 86 PID 3076 wrote to memory of 4312 3076 26604.exe 87 PID 3076 wrote to memory of 4312 3076 26604.exe 87 PID 3076 wrote to memory of 4312 3076 26604.exe 87 PID 4312 wrote to memory of 4328 4312 m4642.exe 88 PID 4312 wrote to memory of 4328 4312 m4642.exe 88 PID 4312 wrote to memory of 4328 4312 m4642.exe 88 PID 4328 wrote to memory of 4024 4328 840482.exe 89 PID 4328 wrote to memory of 4024 4328 840482.exe 89 PID 4328 wrote to memory of 4024 4328 840482.exe 89 PID 4024 wrote to memory of 5056 4024 jpjvv.exe 91 PID 4024 wrote to memory of 5056 4024 jpjvv.exe 91 PID 4024 wrote to memory of 5056 4024 jpjvv.exe 91 PID 5056 wrote to memory of 4076 5056 i282626.exe 92 PID 5056 wrote to memory of 4076 5056 i282626.exe 92 PID 5056 wrote to memory of 4076 5056 i282626.exe 92 PID 4076 wrote to memory of 3396 4076 006660.exe 93 PID 4076 wrote to memory of 3396 4076 006660.exe 93 PID 4076 wrote to memory of 3396 4076 006660.exe 93 PID 3396 wrote to memory of 2136 3396 pjdpj.exe 94 PID 3396 wrote to memory of 2136 3396 pjdpj.exe 94 PID 3396 wrote to memory of 2136 3396 pjdpj.exe 94 PID 2136 wrote to memory of 3580 2136 w24260.exe 95 PID 2136 wrote to memory of 3580 2136 w24260.exe 95 PID 2136 wrote to memory of 3580 2136 w24260.exe 95 PID 3580 wrote to memory of 5088 3580 bnnhtt.exe 96 PID 3580 wrote to memory of 5088 3580 bnnhtt.exe 96 PID 3580 wrote to memory of 5088 3580 bnnhtt.exe 96 PID 5088 wrote to memory of 4936 5088 e28626.exe 97 PID 5088 wrote to memory of 4936 5088 e28626.exe 97 PID 5088 wrote to memory of 4936 5088 e28626.exe 97 PID 4936 wrote to memory of 1552 4936 42820.exe 98 PID 4936 wrote to memory of 1552 4936 42820.exe 98 PID 4936 wrote to memory of 1552 4936 42820.exe 98 PID 1552 wrote to memory of 3796 1552 htbnht.exe 99 PID 1552 wrote to memory of 3796 1552 htbnht.exe 99 PID 1552 wrote to memory of 3796 1552 htbnht.exe 99 PID 3796 wrote to memory of 2204 3796 g0460.exe 100 PID 3796 wrote to memory of 2204 3796 g0460.exe 100 PID 3796 wrote to memory of 2204 3796 g0460.exe 100 PID 2204 wrote to memory of 3804 2204 vpdvp.exe 101 PID 2204 wrote to memory of 3804 2204 vpdvp.exe 101 PID 2204 wrote to memory of 3804 2204 vpdvp.exe 101 PID 3804 wrote to memory of 2760 3804 w06488.exe 102 PID 3804 wrote to memory of 2760 3804 w06488.exe 102 PID 3804 wrote to memory of 2760 3804 w06488.exe 102 PID 2760 wrote to memory of 4672 2760 1bbbnn.exe 103 PID 2760 wrote to memory of 4672 2760 1bbbnn.exe 103 PID 2760 wrote to memory of 4672 2760 1bbbnn.exe 103 PID 4672 wrote to memory of 3188 4672 86826.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\8604b6a8c872a2cdae485b3d98d2bcc2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8604b6a8c872a2cdae485b3d98d2bcc2_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\0682444.exec:\0682444.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\00664.exec:\00664.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\6004222.exec:\6004222.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\4860668.exec:\4860668.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\26604.exec:\26604.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\m4642.exec:\m4642.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\840482.exec:\840482.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\jpjvv.exec:\jpjvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\i282626.exec:\i282626.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\006660.exec:\006660.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\pjdpj.exec:\pjdpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\w24260.exec:\w24260.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\bnnhtt.exec:\bnnhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\e28626.exec:\e28626.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\42820.exec:\42820.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\htbnht.exec:\htbnht.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\g0460.exec:\g0460.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\vpdvp.exec:\vpdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\w06488.exec:\w06488.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\1bbbnn.exec:\1bbbnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\86826.exec:\86826.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\fllfxrf.exec:\fllfxrf.exe23⤵
- Executes dropped EXE
PID:3188 -
\??\c:\bnbhhn.exec:\bnbhhn.exe24⤵
- Executes dropped EXE
PID:3584 -
\??\c:\9xrlfxr.exec:\9xrlfxr.exe25⤵
- Executes dropped EXE
PID:2408 -
\??\c:\20048.exec:\20048.exe26⤵
- Executes dropped EXE
PID:760 -
\??\c:\4804804.exec:\4804804.exe27⤵
- Executes dropped EXE
PID:808 -
\??\c:\028426.exec:\028426.exe28⤵
- Executes dropped EXE
PID:4284 -
\??\c:\httnbh.exec:\httnbh.exe29⤵
- Executes dropped EXE
PID:4460 -
\??\c:\86486.exec:\86486.exe30⤵
- Executes dropped EXE
PID:3464 -
\??\c:\c080426.exec:\c080426.exe31⤵
- Executes dropped EXE
PID:3620 -
\??\c:\088482.exec:\088482.exe32⤵
- Executes dropped EXE
PID:4368 -
\??\c:\tthtnh.exec:\tthtnh.exe33⤵
- Executes dropped EXE
PID:544 -
\??\c:\nbtnbt.exec:\nbtnbt.exe34⤵
- Executes dropped EXE
PID:4208 -
\??\c:\028488.exec:\028488.exe35⤵
- Executes dropped EXE
PID:4316 -
\??\c:\lxlfxrf.exec:\lxlfxrf.exe36⤵
- Executes dropped EXE
PID:3764 -
\??\c:\066426.exec:\066426.exe37⤵
- Executes dropped EXE
PID:1808 -
\??\c:\pvdvj.exec:\pvdvj.exe38⤵
- Executes dropped EXE
PID:1136 -
\??\c:\xrrfrll.exec:\xrrfrll.exe39⤵
- Executes dropped EXE
PID:4360 -
\??\c:\4466626.exec:\4466626.exe40⤵
- Executes dropped EXE
PID:4080 -
\??\c:\202226.exec:\202226.exe41⤵
- Executes dropped EXE
PID:2268 -
\??\c:\9lfxrrl.exec:\9lfxrrl.exe42⤵
- Executes dropped EXE
PID:1032 -
\??\c:\pjvpp.exec:\pjvpp.exe43⤵
- Executes dropped EXE
PID:3332 -
\??\c:\6204220.exec:\6204220.exe44⤵
- Executes dropped EXE
PID:1976 -
\??\c:\266668.exec:\266668.exe45⤵
- Executes dropped EXE
PID:684 -
\??\c:\c404444.exec:\c404444.exe46⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xxrfxll.exec:\xxrfxll.exe47⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vpppj.exec:\vpppj.exe48⤵
- Executes dropped EXE
PID:4232 -
\??\c:\064044.exec:\064044.exe49⤵
- Executes dropped EXE
PID:2716 -
\??\c:\nbbtnn.exec:\nbbtnn.exe50⤵
- Executes dropped EXE
PID:4328 -
\??\c:\2666660.exec:\2666660.exe51⤵
- Executes dropped EXE
PID:2100 -
\??\c:\8228444.exec:\8228444.exe52⤵
- Executes dropped EXE
PID:4988 -
\??\c:\3ddvv.exec:\3ddvv.exe53⤵
- Executes dropped EXE
PID:4048 -
\??\c:\tnbbnt.exec:\tnbbnt.exe54⤵
- Executes dropped EXE
PID:3856 -
\??\c:\xfllflf.exec:\xfllflf.exe55⤵
- Executes dropped EXE
PID:2008 -
\??\c:\1bbbtt.exec:\1bbbtt.exe56⤵
- Executes dropped EXE
PID:3396 -
\??\c:\3tbbbt.exec:\3tbbbt.exe57⤵
- Executes dropped EXE
PID:4184 -
\??\c:\fxllrlr.exec:\fxllrlr.exe58⤵
- Executes dropped EXE
PID:4108 -
\??\c:\5lllffx.exec:\5lllffx.exe59⤵
- Executes dropped EXE
PID:840 -
\??\c:\llllfxl.exec:\llllfxl.exe60⤵
- Executes dropped EXE
PID:1556 -
\??\c:\60666.exec:\60666.exe61⤵
- Executes dropped EXE
PID:3504 -
\??\c:\0244888.exec:\0244888.exe62⤵
- Executes dropped EXE
PID:5064 -
\??\c:\k28882.exec:\k28882.exe63⤵
- Executes dropped EXE
PID:4644 -
\??\c:\llrxfxf.exec:\llrxfxf.exe64⤵
- Executes dropped EXE
PID:4288 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe65⤵
- Executes dropped EXE
PID:3292 -
\??\c:\i660448.exec:\i660448.exe66⤵PID:264
-
\??\c:\040444.exec:\040444.exe67⤵PID:3536
-
\??\c:\jvjvd.exec:\jvjvd.exe68⤵PID:2720
-
\??\c:\nnnhhb.exec:\nnnhhb.exe69⤵PID:3308
-
\??\c:\02820.exec:\02820.exe70⤵PID:1460
-
\??\c:\lfxrffx.exec:\lfxrffx.exe71⤵PID:224
-
\??\c:\bhtnhh.exec:\bhtnhh.exe72⤵PID:2604
-
\??\c:\vppdd.exec:\vppdd.exe73⤵PID:5040
-
\??\c:\vvvpj.exec:\vvvpj.exe74⤵PID:4648
-
\??\c:\c404822.exec:\c404822.exe75⤵PID:4564
-
\??\c:\ffxxrlf.exec:\ffxxrlf.exe76⤵PID:2208
-
\??\c:\vdpdp.exec:\vdpdp.exe77⤵PID:4688
-
\??\c:\22048.exec:\22048.exe78⤵PID:2112
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe79⤵PID:2740
-
\??\c:\hhbbtt.exec:\hhbbtt.exe80⤵PID:4400
-
\??\c:\pdddv.exec:\pdddv.exe81⤵PID:544
-
\??\c:\084482.exec:\084482.exe82⤵PID:1428
-
\??\c:\8260006.exec:\8260006.exe83⤵PID:3892
-
\??\c:\7dpjj.exec:\7dpjj.exe84⤵PID:1544
-
\??\c:\c426000.exec:\c426000.exe85⤵PID:436
-
\??\c:\88044.exec:\88044.exe86⤵PID:1704
-
\??\c:\4204440.exec:\4204440.exe87⤵PID:4336
-
\??\c:\o066660.exec:\o066660.exe88⤵PID:4836
-
\??\c:\bhhhbb.exec:\bhhhbb.exe89⤵PID:2040
-
\??\c:\2442026.exec:\2442026.exe90⤵PID:1004
-
\??\c:\q66000.exec:\q66000.exe91⤵PID:1588
-
\??\c:\8066066.exec:\8066066.exe92⤵PID:1596
-
\??\c:\thntnn.exec:\thntnn.exe93⤵PID:1340
-
\??\c:\tbhnhb.exec:\tbhnhb.exe94⤵PID:832
-
\??\c:\jddvp.exec:\jddvp.exe95⤵PID:4964
-
\??\c:\000822.exec:\000822.exe96⤵PID:3348
-
\??\c:\4844046.exec:\4844046.exe97⤵PID:2424
-
\??\c:\xxxffff.exec:\xxxffff.exe98⤵PID:316
-
\??\c:\fxllllx.exec:\fxllllx.exe99⤵PID:1392
-
\??\c:\dpddv.exec:\dpddv.exe100⤵PID:2328
-
\??\c:\xlfrrxx.exec:\xlfrrxx.exe101⤵PID:3776
-
\??\c:\26802.exec:\26802.exe102⤵PID:2956
-
\??\c:\280088.exec:\280088.exe103⤵PID:780
-
\??\c:\pjpvv.exec:\pjpvv.exe104⤵PID:2456
-
\??\c:\066666.exec:\066666.exe105⤵PID:2224
-
\??\c:\u066444.exec:\u066444.exe106⤵PID:3360
-
\??\c:\824844.exec:\824844.exe107⤵PID:4412
-
\??\c:\thnhbb.exec:\thnhbb.exe108⤵PID:1664
-
\??\c:\dpppd.exec:\dpppd.exe109⤵PID:4632
-
\??\c:\2066444.exec:\2066444.exe110⤵PID:4452
-
\??\c:\pdddd.exec:\pdddd.exe111⤵PID:464
-
\??\c:\48886.exec:\48886.exe112⤵PID:1436
-
\??\c:\20660.exec:\20660.exe113⤵PID:2080
-
\??\c:\26608.exec:\26608.exe114⤵PID:3508
-
\??\c:\w06644.exec:\w06644.exe115⤵PID:432
-
\??\c:\dvddv.exec:\dvddv.exe116⤵PID:3536
-
\??\c:\dvppp.exec:\dvppp.exe117⤵PID:2720
-
\??\c:\284822.exec:\284822.exe118⤵PID:1460
-
\??\c:\rxllfrl.exec:\rxllfrl.exe119⤵PID:224
-
\??\c:\8444882.exec:\8444882.exe120⤵PID:760
-
\??\c:\llrrxxf.exec:\llrrxxf.exe121⤵PID:808
-
\??\c:\rllfffx.exec:\rllfffx.exe122⤵PID:4204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-