Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 23:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
92fe2bf7f2a1bd098b079c2a114df80c_JaffaCakes118.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
92fe2bf7f2a1bd098b079c2a114df80c_JaffaCakes118.exe
-
Size
231KB
-
MD5
92fe2bf7f2a1bd098b079c2a114df80c
-
SHA1
2eda70ab29df06f531e799ba1109611f476353a6
-
SHA256
b3ea0c725e683b913c2840901aa26f25491cf2d5a94468e9523707e8adb9463f
-
SHA512
f42935a669bebb2651de329b976b4aa7bcfddb440fc2397e6dfa273c4e81332e8b5562c734ca47af4a744a6122d53470b1a505019d8c3a3b751ca915de8824ab
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xL8eBWOgP:n3C9BRo7MlrWKo+lxK8eBWVP
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2036-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/920-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/812-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1464-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/956-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2188 xrflrrr.exe 2224 1bnnnt.exe 2328 vpjjp.exe 2680 9fxlxfl.exe 2948 nhbbhh.exe 2500 bbnnbt.exe 2600 1vjvj.exe 2480 7djpv.exe 3024 5vvpd.exe 920 hbhntb.exe 2848 hbntbt.exe 2884 lllxflr.exe 2720 3fllxxl.exe 1664 vpdjv.exe 1792 pjvpj.exe 2640 tthnbb.exe 2836 vvjpv.exe 864 5jjpp.exe 3068 9rxfllf.exe 812 nnttnn.exe 1584 jdpvj.exe 2008 9xxlrxl.exe 1464 xxlrrfx.exe 2052 jdpjp.exe 1728 ppjvj.exe 956 7nnnbb.exe 2984 9vjpv.exe 936 llfrxfl.exe 1936 9bnbnh.exe 2060 hbhhtt.exe 1636 ddjjv.exe 2284 lfllrlr.exe 2176 hbbnbb.exe 2936 jdppv.exe 2760 vpdjv.exe 1884 fxrflrf.exe 1628 1llxxxl.exe 2688 1thntn.exe 2948 ttnnbh.exe 2488 vvjvp.exe 1588 lxxxffl.exe 2512 xrlrxrf.exe 2520 bthntb.exe 2628 9thhnn.exe 1192 ppjvd.exe 3040 ddvjv.exe 2832 5fxflfr.exe 2896 7thhtb.exe 2848 nhthhn.exe 1120 vpjpd.exe 1824 7jvdp.exe 1808 fflrfrf.exe 1704 fllllxx.exe 2808 tnbnnn.exe 2640 7dvjj.exe 1740 dvvdd.exe 2140 rlxlxxr.exe 608 xlrlllx.exe 1780 3nbbbb.exe 2124 ppjpv.exe 1428 9dvpv.exe 2008 fxllrrf.exe 2964 5fxflxl.exe 1928 nhtthh.exe -
resource yara_rule behavioral1/memory/2036-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/920-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/812-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1464-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/956-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-281-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2188 2036 92fe2bf7f2a1bd098b079c2a114df80c_JaffaCakes118.exe 28 PID 2036 wrote to memory of 2188 2036 92fe2bf7f2a1bd098b079c2a114df80c_JaffaCakes118.exe 28 PID 2036 wrote to memory of 2188 2036 92fe2bf7f2a1bd098b079c2a114df80c_JaffaCakes118.exe 28 PID 2036 wrote to memory of 2188 2036 92fe2bf7f2a1bd098b079c2a114df80c_JaffaCakes118.exe 28 PID 2188 wrote to memory of 2224 2188 xrflrrr.exe 29 PID 2188 wrote to memory of 2224 2188 xrflrrr.exe 29 PID 2188 wrote to memory of 2224 2188 xrflrrr.exe 29 PID 2188 wrote to memory of 2224 2188 xrflrrr.exe 29 PID 2224 wrote to memory of 2328 2224 1bnnnt.exe 30 PID 2224 wrote to memory of 2328 2224 1bnnnt.exe 30 PID 2224 wrote to memory of 2328 2224 1bnnnt.exe 30 PID 2224 wrote to memory of 2328 2224 1bnnnt.exe 30 PID 2328 wrote to memory of 2680 2328 vpjjp.exe 31 PID 2328 wrote to memory of 2680 2328 vpjjp.exe 31 PID 2328 wrote to memory of 2680 2328 vpjjp.exe 31 PID 2328 wrote to memory of 2680 2328 vpjjp.exe 31 PID 2680 wrote to memory of 2948 2680 9fxlxfl.exe 32 PID 2680 wrote to memory of 2948 2680 9fxlxfl.exe 32 PID 2680 wrote to memory of 2948 2680 9fxlxfl.exe 32 PID 2680 wrote to memory of 2948 2680 9fxlxfl.exe 32 PID 2948 wrote to memory of 2500 2948 nhbbhh.exe 33 PID 2948 wrote to memory of 2500 2948 nhbbhh.exe 33 PID 2948 wrote to memory of 2500 2948 nhbbhh.exe 33 PID 2948 wrote to memory of 2500 2948 nhbbhh.exe 33 PID 2500 wrote to memory of 2600 2500 bbnnbt.exe 34 PID 2500 wrote to memory of 2600 2500 bbnnbt.exe 34 PID 2500 wrote to memory of 2600 2500 bbnnbt.exe 34 PID 2500 wrote to memory of 2600 2500 bbnnbt.exe 34 PID 2600 wrote to memory of 2480 2600 1vjvj.exe 35 PID 2600 wrote to memory of 2480 2600 1vjvj.exe 35 PID 2600 wrote to memory of 2480 2600 1vjvj.exe 35 PID 2600 wrote to memory of 2480 2600 1vjvj.exe 35 PID 2480 wrote to memory of 3024 2480 7djpv.exe 36 PID 2480 wrote to memory of 3024 2480 7djpv.exe 36 PID 2480 wrote to memory of 3024 2480 7djpv.exe 36 PID 2480 wrote to memory of 3024 2480 7djpv.exe 36 PID 3024 wrote to memory of 920 3024 5vvpd.exe 37 PID 3024 wrote to memory of 920 3024 5vvpd.exe 37 PID 3024 wrote to memory of 920 3024 5vvpd.exe 37 PID 3024 wrote to memory of 920 3024 5vvpd.exe 37 PID 920 wrote to memory of 2848 920 hbhntb.exe 38 PID 920 wrote to memory of 2848 920 hbhntb.exe 38 PID 920 wrote to memory of 2848 920 hbhntb.exe 38 PID 920 wrote to memory of 2848 920 hbhntb.exe 38 PID 2848 wrote to memory of 2884 2848 hbntbt.exe 39 PID 2848 wrote to memory of 2884 2848 hbntbt.exe 39 PID 2848 wrote to memory of 2884 2848 hbntbt.exe 39 PID 2848 wrote to memory of 2884 2848 hbntbt.exe 39 PID 2884 wrote to memory of 2720 2884 lllxflr.exe 40 PID 2884 wrote to memory of 2720 2884 lllxflr.exe 40 PID 2884 wrote to memory of 2720 2884 lllxflr.exe 40 PID 2884 wrote to memory of 2720 2884 lllxflr.exe 40 PID 2720 wrote to memory of 1664 2720 3fllxxl.exe 41 PID 2720 wrote to memory of 1664 2720 3fllxxl.exe 41 PID 2720 wrote to memory of 1664 2720 3fllxxl.exe 41 PID 2720 wrote to memory of 1664 2720 3fllxxl.exe 41 PID 1664 wrote to memory of 1792 1664 vpdjv.exe 42 PID 1664 wrote to memory of 1792 1664 vpdjv.exe 42 PID 1664 wrote to memory of 1792 1664 vpdjv.exe 42 PID 1664 wrote to memory of 1792 1664 vpdjv.exe 42 PID 1792 wrote to memory of 2640 1792 pjvpj.exe 43 PID 1792 wrote to memory of 2640 1792 pjvpj.exe 43 PID 1792 wrote to memory of 2640 1792 pjvpj.exe 43 PID 1792 wrote to memory of 2640 1792 pjvpj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\92fe2bf7f2a1bd098b079c2a114df80c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\92fe2bf7f2a1bd098b079c2a114df80c_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\xrflrrr.exec:\xrflrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\1bnnnt.exec:\1bnnnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\vpjjp.exec:\vpjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\9fxlxfl.exec:\9fxlxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\nhbbhh.exec:\nhbbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\bbnnbt.exec:\bbnnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\1vjvj.exec:\1vjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\7djpv.exec:\7djpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\5vvpd.exec:\5vvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\hbhntb.exec:\hbhntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\hbntbt.exec:\hbntbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\lllxflr.exec:\lllxflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\3fllxxl.exec:\3fllxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\vpdjv.exec:\vpdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\pjvpj.exec:\pjvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\tthnbb.exec:\tthnbb.exe17⤵
- Executes dropped EXE
PID:2640 -
\??\c:\vvjpv.exec:\vvjpv.exe18⤵
- Executes dropped EXE
PID:2836 -
\??\c:\5jjpp.exec:\5jjpp.exe19⤵
- Executes dropped EXE
PID:864 -
\??\c:\9rxfllf.exec:\9rxfllf.exe20⤵
- Executes dropped EXE
PID:3068 -
\??\c:\nnttnn.exec:\nnttnn.exe21⤵
- Executes dropped EXE
PID:812 -
\??\c:\jdpvj.exec:\jdpvj.exe22⤵
- Executes dropped EXE
PID:1584 -
\??\c:\9xxlrxl.exec:\9xxlrxl.exe23⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xxlrrfx.exec:\xxlrrfx.exe24⤵
- Executes dropped EXE
PID:1464 -
\??\c:\jdpjp.exec:\jdpjp.exe25⤵
- Executes dropped EXE
PID:2052 -
\??\c:\ppjvj.exec:\ppjvj.exe26⤵
- Executes dropped EXE
PID:1728 -
\??\c:\7nnnbb.exec:\7nnnbb.exe27⤵
- Executes dropped EXE
PID:956 -
\??\c:\9vjpv.exec:\9vjpv.exe28⤵
- Executes dropped EXE
PID:2984 -
\??\c:\llfrxfl.exec:\llfrxfl.exe29⤵
- Executes dropped EXE
PID:936 -
\??\c:\9bnbnh.exec:\9bnbnh.exe30⤵
- Executes dropped EXE
PID:1936 -
\??\c:\hbhhtt.exec:\hbhhtt.exe31⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ddjjv.exec:\ddjjv.exe32⤵
- Executes dropped EXE
PID:1636 -
\??\c:\lfllrlr.exec:\lfllrlr.exe33⤵
- Executes dropped EXE
PID:2284 -
\??\c:\hbbnbb.exec:\hbbnbb.exe34⤵
- Executes dropped EXE
PID:2176 -
\??\c:\jdppv.exec:\jdppv.exe35⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vpdjv.exec:\vpdjv.exe36⤵
- Executes dropped EXE
PID:2760 -
\??\c:\fxrflrf.exec:\fxrflrf.exe37⤵
- Executes dropped EXE
PID:1884 -
\??\c:\1llxxxl.exec:\1llxxxl.exe38⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1thntn.exec:\1thntn.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\ttnnbh.exec:\ttnnbh.exe40⤵
- Executes dropped EXE
PID:2948 -
\??\c:\vvjvp.exec:\vvjvp.exe41⤵
- Executes dropped EXE
PID:2488 -
\??\c:\lxxxffl.exec:\lxxxffl.exe42⤵
- Executes dropped EXE
PID:1588 -
\??\c:\xrlrxrf.exec:\xrlrxrf.exe43⤵
- Executes dropped EXE
PID:2512 -
\??\c:\bthntb.exec:\bthntb.exe44⤵
- Executes dropped EXE
PID:2520 -
\??\c:\9thhnn.exec:\9thhnn.exe45⤵
- Executes dropped EXE
PID:2628 -
\??\c:\ppjvd.exec:\ppjvd.exe46⤵
- Executes dropped EXE
PID:1192 -
\??\c:\ddvjv.exec:\ddvjv.exe47⤵
- Executes dropped EXE
PID:3040 -
\??\c:\5fxflfr.exec:\5fxflfr.exe48⤵
- Executes dropped EXE
PID:2832 -
\??\c:\7thhtb.exec:\7thhtb.exe49⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nhthhn.exec:\nhthhn.exe50⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vpjpd.exec:\vpjpd.exe51⤵
- Executes dropped EXE
PID:1120 -
\??\c:\7jvdp.exec:\7jvdp.exe52⤵
- Executes dropped EXE
PID:1824 -
\??\c:\fflrfrf.exec:\fflrfrf.exe53⤵
- Executes dropped EXE
PID:1808 -
\??\c:\fllllxx.exec:\fllllxx.exe54⤵
- Executes dropped EXE
PID:1704 -
\??\c:\tnbnnn.exec:\tnbnnn.exe55⤵
- Executes dropped EXE
PID:2808 -
\??\c:\7dvjj.exec:\7dvjj.exe56⤵
- Executes dropped EXE
PID:2640 -
\??\c:\dvvdd.exec:\dvvdd.exe57⤵
- Executes dropped EXE
PID:1740 -
\??\c:\rlxlxxr.exec:\rlxlxxr.exe58⤵
- Executes dropped EXE
PID:2140 -
\??\c:\xlrlllx.exec:\xlrlllx.exe59⤵
- Executes dropped EXE
PID:608 -
\??\c:\3nbbbb.exec:\3nbbbb.exe60⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ppjpv.exec:\ppjpv.exe61⤵
- Executes dropped EXE
PID:2124 -
\??\c:\9dvpv.exec:\9dvpv.exe62⤵
- Executes dropped EXE
PID:1428 -
\??\c:\fxllrrf.exec:\fxllrrf.exe63⤵
- Executes dropped EXE
PID:2008 -
\??\c:\5fxflxl.exec:\5fxflxl.exe64⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nhtthh.exec:\nhtthh.exe65⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bbhnnt.exec:\bbhnnt.exe66⤵PID:916
-
\??\c:\7jdjp.exec:\7jdjp.exe67⤵PID:1516
-
\??\c:\9rxxffr.exec:\9rxxffr.exe68⤵PID:956
-
\??\c:\tttbhn.exec:\tttbhn.exe69⤵PID:1712
-
\??\c:\hbnbhh.exec:\hbnbhh.exe70⤵PID:600
-
\??\c:\pjvdj.exec:\pjvdj.exe71⤵PID:2144
-
\??\c:\9dvvd.exec:\9dvvd.exe72⤵PID:988
-
\??\c:\rlxlrlx.exec:\rlxlrlx.exe73⤵PID:2060
-
\??\c:\xxxfffr.exec:\xxxfffr.exe74⤵PID:880
-
\??\c:\htbhhn.exec:\htbhhn.exe75⤵PID:1540
-
\??\c:\btbbnn.exec:\btbbnn.exe76⤵PID:2036
-
\??\c:\ddpdp.exec:\ddpdp.exe77⤵PID:1536
-
\??\c:\fxlfrxl.exec:\fxlfrxl.exe78⤵PID:1324
-
\??\c:\1flrrxl.exec:\1flrrxl.exe79⤵PID:2288
-
\??\c:\nhttbh.exec:\nhttbh.exe80⤵PID:2556
-
\??\c:\7hbntt.exec:\7hbntt.exe81⤵PID:2592
-
\??\c:\ppddj.exec:\ppddj.exe82⤵PID:2672
-
\??\c:\9rfxxxl.exec:\9rfxxxl.exe83⤵PID:2668
-
\??\c:\7xfflrx.exec:\7xfflrx.exe84⤵PID:2620
-
\??\c:\nhtnnn.exec:\nhtnnn.exe85⤵PID:1600
-
\??\c:\thhbnt.exec:\thhbnt.exe86⤵PID:2460
-
\??\c:\5jvvd.exec:\5jvvd.exe87⤵PID:1164
-
\??\c:\rfrrffl.exec:\rfrrffl.exe88⤵PID:1836
-
\??\c:\rfllrrf.exec:\rfllrrf.exe89⤵PID:3024
-
\??\c:\nhbnbh.exec:\nhbnbh.exe90⤵PID:3040
-
\??\c:\tnttbb.exec:\tnttbb.exe91⤵PID:2904
-
\??\c:\1vvvj.exec:\1vvvj.exe92⤵PID:2656
-
\??\c:\jvvvj.exec:\jvvvj.exe93⤵PID:744
-
\??\c:\rflrrrx.exec:\rflrrrx.exe94⤵PID:2712
-
\??\c:\hbtbtt.exec:\hbtbtt.exe95⤵PID:2352
-
\??\c:\5bbnht.exec:\5bbnht.exe96⤵PID:1808
-
\??\c:\vpvdj.exec:\vpvdj.exe97⤵PID:2784
-
\??\c:\vvjvd.exec:\vvjvd.exe98⤵PID:664
-
\??\c:\flxrxlf.exec:\flxrxlf.exe99⤵PID:2836
-
\??\c:\9rflxrf.exec:\9rflxrf.exe100⤵PID:732
-
\??\c:\btnthh.exec:\btnthh.exe101⤵PID:340
-
\??\c:\9dpjp.exec:\9dpjp.exe102⤵PID:2316
-
\??\c:\1pvpd.exec:\1pvpd.exe103⤵PID:1156
-
\??\c:\frllrrl.exec:\frllrrl.exe104⤵PID:2096
-
\??\c:\lxffrrx.exec:\lxffrrx.exe105⤵PID:1468
-
\??\c:\tnhhnn.exec:\tnhhnn.exe106⤵PID:1196
-
\??\c:\bbnntb.exec:\bbnntb.exe107⤵PID:2248
-
\??\c:\jvjdp.exec:\jvjdp.exe108⤵PID:1136
-
\??\c:\1lxrxxf.exec:\1lxrxxf.exe109⤵PID:916
-
\??\c:\fxrrffr.exec:\fxrrffr.exe110⤵PID:1724
-
\??\c:\hbnhnn.exec:\hbnhnn.exe111⤵PID:2080
-
\??\c:\3nhhhn.exec:\3nhhhn.exe112⤵PID:1712
-
\??\c:\dvpvp.exec:\dvpvp.exe113⤵PID:860
-
\??\c:\pdvvd.exec:\pdvvd.exe114⤵PID:1860
-
\??\c:\lxfflll.exec:\lxfflll.exe115⤵PID:2184
-
\??\c:\fxlfllx.exec:\fxlfllx.exe116⤵PID:2104
-
\??\c:\tntbhn.exec:\tntbhn.exe117⤵PID:2284
-
\??\c:\7jjdj.exec:\7jjdj.exe118⤵PID:1816
-
\??\c:\vpjdj.exec:\vpjdj.exe119⤵PID:1552
-
\??\c:\fxrrxlx.exec:\fxrrxlx.exe120⤵PID:2180
-
\??\c:\xrrfrxl.exec:\xrrfrxl.exe121⤵PID:2932
-
\??\c:\hthbbb.exec:\hthbbb.exe122⤵PID:2572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-