Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 23:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9c5d9802b7519827e6b8e2e4615ea30d_JaffaCakes118.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
9c5d9802b7519827e6b8e2e4615ea30d_JaffaCakes118.exe
-
Size
101KB
-
MD5
9c5d9802b7519827e6b8e2e4615ea30d
-
SHA1
cea195526872ae777979cb07e1abcc9add371d85
-
SHA256
d6ce6477e74efb0811c638a609fc11ad1cf0fd13963912df06dc65a20ab4f9d9
-
SHA512
2090dd26b44af877609d72b83db4cec5c1226dbeaf6edf5be3e56365d99bd99aba01003bcdb3c309449e15fe2ed3a83b1fcba90f92d428b887e9608133a6d125
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2lmf6g7xmIi6h7zZ:ymb3NkkiQ3mdBjF+3TU20L46Fd
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4008-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/712-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1484-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1788-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4376-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3344-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4008 1ddvj.exe 4616 fxrfrrf.exe 4444 tttnbn.exe 1640 pvvvd.exe 712 9jjdv.exe 1484 hhttnt.exe 3068 djjvj.exe 4068 pppdv.exe 2084 tbbbtn.exe 1020 vpvpj.exe 864 1rxrlfr.exe 1696 htnbtn.exe 1788 hnbtnh.exe 4532 pdjdp.exe 4468 rxfrxlf.exe 3448 bnbnhb.exe 4248 fxlfrlf.exe 2812 xrxrfxl.exe 2772 btnnbh.exe 4452 1lfrfxr.exe 4240 httnbn.exe 3852 5thbhb.exe 4376 jvvjv.exe 3344 frfrxrr.exe 4460 fxfxxxr.exe 2072 9tnhbt.exe 1692 1pjvj.exe 5060 lfrlfxr.exe 2560 hhhbtn.exe 2520 hbtnhb.exe 4700 9vvjv.exe 1660 rxrlxrr.exe 2436 lxrlxlx.exe 2076 nbhbnh.exe 3228 9jdvj.exe 3016 jvpvj.exe 1504 lrxlfxr.exe 4184 tnnnhh.exe 4336 nhhtnh.exe 3176 jppjd.exe 4476 3xxrfff.exe 4812 hhbthb.exe 1068 hbtnhh.exe 1656 jpvjj.exe 220 jjpdj.exe 4436 xxxrfxr.exe 4016 lxlflfx.exe 1336 nhhtnh.exe 3000 bbtntn.exe 1356 pdvpj.exe 4444 jjvjp.exe 2712 7flxrrr.exe 4060 hbbbtt.exe 1132 hbbthh.exe 2788 vjjdp.exe 1484 vjpjj.exe 3984 xrfxlfr.exe 1028 bhhthb.exe 3812 vpvjd.exe 1896 pvvjd.exe 4512 xxllrlf.exe 3044 ffrfrfr.exe 4276 7nhnbb.exe 864 1vjpp.exe -
resource yara_rule behavioral2/memory/4008-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/712-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/712-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1484-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1696-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4376-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3344-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4996 wrote to memory of 4008 4996 9c5d9802b7519827e6b8e2e4615ea30d_JaffaCakes118.exe 80 PID 4996 wrote to memory of 4008 4996 9c5d9802b7519827e6b8e2e4615ea30d_JaffaCakes118.exe 80 PID 4996 wrote to memory of 4008 4996 9c5d9802b7519827e6b8e2e4615ea30d_JaffaCakes118.exe 80 PID 4008 wrote to memory of 4616 4008 1ddvj.exe 81 PID 4008 wrote to memory of 4616 4008 1ddvj.exe 81 PID 4008 wrote to memory of 4616 4008 1ddvj.exe 81 PID 4616 wrote to memory of 4444 4616 fxrfrrf.exe 82 PID 4616 wrote to memory of 4444 4616 fxrfrrf.exe 82 PID 4616 wrote to memory of 4444 4616 fxrfrrf.exe 82 PID 4444 wrote to memory of 1640 4444 tttnbn.exe 83 PID 4444 wrote to memory of 1640 4444 tttnbn.exe 83 PID 4444 wrote to memory of 1640 4444 tttnbn.exe 83 PID 1640 wrote to memory of 712 1640 pvvvd.exe 84 PID 1640 wrote to memory of 712 1640 pvvvd.exe 84 PID 1640 wrote to memory of 712 1640 pvvvd.exe 84 PID 712 wrote to memory of 1484 712 9jjdv.exe 85 PID 712 wrote to memory of 1484 712 9jjdv.exe 85 PID 712 wrote to memory of 1484 712 9jjdv.exe 85 PID 1484 wrote to memory of 3068 1484 hhttnt.exe 86 PID 1484 wrote to memory of 3068 1484 hhttnt.exe 86 PID 1484 wrote to memory of 3068 1484 hhttnt.exe 86 PID 3068 wrote to memory of 4068 3068 djjvj.exe 87 PID 3068 wrote to memory of 4068 3068 djjvj.exe 87 PID 3068 wrote to memory of 4068 3068 djjvj.exe 87 PID 4068 wrote to memory of 2084 4068 pppdv.exe 88 PID 4068 wrote to memory of 2084 4068 pppdv.exe 88 PID 4068 wrote to memory of 2084 4068 pppdv.exe 88 PID 2084 wrote to memory of 1020 2084 tbbbtn.exe 89 PID 2084 wrote to memory of 1020 2084 tbbbtn.exe 89 PID 2084 wrote to memory of 1020 2084 tbbbtn.exe 89 PID 1020 wrote to memory of 864 1020 vpvpj.exe 90 PID 1020 wrote to memory of 864 1020 vpvpj.exe 90 PID 1020 wrote to memory of 864 1020 vpvpj.exe 90 PID 864 wrote to memory of 1696 864 1rxrlfr.exe 91 PID 864 wrote to memory of 1696 864 1rxrlfr.exe 91 PID 864 wrote to memory of 1696 864 1rxrlfr.exe 91 PID 1696 wrote to memory of 1788 1696 htnbtn.exe 92 PID 1696 wrote to memory of 1788 1696 htnbtn.exe 92 PID 1696 wrote to memory of 1788 1696 htnbtn.exe 92 PID 1788 wrote to memory of 4532 1788 hnbtnh.exe 93 PID 1788 wrote to memory of 4532 1788 hnbtnh.exe 93 PID 1788 wrote to memory of 4532 1788 hnbtnh.exe 93 PID 4532 wrote to memory of 4468 4532 pdjdp.exe 94 PID 4532 wrote to memory of 4468 4532 pdjdp.exe 94 PID 4532 wrote to memory of 4468 4532 pdjdp.exe 94 PID 4468 wrote to memory of 3448 4468 rxfrxlf.exe 95 PID 4468 wrote to memory of 3448 4468 rxfrxlf.exe 95 PID 4468 wrote to memory of 3448 4468 rxfrxlf.exe 95 PID 3448 wrote to memory of 4248 3448 bnbnhb.exe 96 PID 3448 wrote to memory of 4248 3448 bnbnhb.exe 96 PID 3448 wrote to memory of 4248 3448 bnbnhb.exe 96 PID 4248 wrote to memory of 2812 4248 fxlfrlf.exe 97 PID 4248 wrote to memory of 2812 4248 fxlfrlf.exe 97 PID 4248 wrote to memory of 2812 4248 fxlfrlf.exe 97 PID 2812 wrote to memory of 2772 2812 xrxrfxl.exe 98 PID 2812 wrote to memory of 2772 2812 xrxrfxl.exe 98 PID 2812 wrote to memory of 2772 2812 xrxrfxl.exe 98 PID 2772 wrote to memory of 4452 2772 btnnbh.exe 99 PID 2772 wrote to memory of 4452 2772 btnnbh.exe 99 PID 2772 wrote to memory of 4452 2772 btnnbh.exe 99 PID 4452 wrote to memory of 4240 4452 1lfrfxr.exe 100 PID 4452 wrote to memory of 4240 4452 1lfrfxr.exe 100 PID 4452 wrote to memory of 4240 4452 1lfrfxr.exe 100 PID 4240 wrote to memory of 3852 4240 httnbn.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c5d9802b7519827e6b8e2e4615ea30d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9c5d9802b7519827e6b8e2e4615ea30d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\1ddvj.exec:\1ddvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\fxrfrrf.exec:\fxrfrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\tttnbn.exec:\tttnbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\pvvvd.exec:\pvvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\9jjdv.exec:\9jjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
\??\c:\hhttnt.exec:\hhttnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\djjvj.exec:\djjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\pppdv.exec:\pppdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\tbbbtn.exec:\tbbbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\vpvpj.exec:\vpvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\1rxrlfr.exec:\1rxrlfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\htnbtn.exec:\htnbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\hnbtnh.exec:\hnbtnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\pdjdp.exec:\pdjdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\rxfrxlf.exec:\rxfrxlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\bnbnhb.exec:\bnbnhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\fxlfrlf.exec:\fxlfrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\xrxrfxl.exec:\xrxrfxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\btnnbh.exec:\btnnbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\1lfrfxr.exec:\1lfrfxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\httnbn.exec:\httnbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\5thbhb.exec:\5thbhb.exe23⤵
- Executes dropped EXE
PID:3852 -
\??\c:\jvvjv.exec:\jvvjv.exe24⤵
- Executes dropped EXE
PID:4376 -
\??\c:\frfrxrr.exec:\frfrxrr.exe25⤵
- Executes dropped EXE
PID:3344 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe26⤵
- Executes dropped EXE
PID:4460 -
\??\c:\9tnhbt.exec:\9tnhbt.exe27⤵
- Executes dropped EXE
PID:2072 -
\??\c:\1pjvj.exec:\1pjvj.exe28⤵
- Executes dropped EXE
PID:1692 -
\??\c:\lfrlfxr.exec:\lfrlfxr.exe29⤵
- Executes dropped EXE
PID:5060 -
\??\c:\hhhbtn.exec:\hhhbtn.exe30⤵
- Executes dropped EXE
PID:2560 -
\??\c:\hbtnhb.exec:\hbtnhb.exe31⤵
- Executes dropped EXE
PID:2520 -
\??\c:\9vvjv.exec:\9vvjv.exe32⤵
- Executes dropped EXE
PID:4700 -
\??\c:\rxrlxrr.exec:\rxrlxrr.exe33⤵
- Executes dropped EXE
PID:1660 -
\??\c:\lxrlxlx.exec:\lxrlxlx.exe34⤵
- Executes dropped EXE
PID:2436 -
\??\c:\nbhbnh.exec:\nbhbnh.exe35⤵
- Executes dropped EXE
PID:2076 -
\??\c:\9jdvj.exec:\9jdvj.exe36⤵
- Executes dropped EXE
PID:3228 -
\??\c:\jvpvj.exec:\jvpvj.exe37⤵
- Executes dropped EXE
PID:3016 -
\??\c:\lrxlfxr.exec:\lrxlfxr.exe38⤵
- Executes dropped EXE
PID:1504 -
\??\c:\tnnnhh.exec:\tnnnhh.exe39⤵
- Executes dropped EXE
PID:4184 -
\??\c:\nhhtnh.exec:\nhhtnh.exe40⤵
- Executes dropped EXE
PID:4336 -
\??\c:\jppjd.exec:\jppjd.exe41⤵
- Executes dropped EXE
PID:3176 -
\??\c:\3xxrfff.exec:\3xxrfff.exe42⤵
- Executes dropped EXE
PID:4476 -
\??\c:\hhbthb.exec:\hhbthb.exe43⤵
- Executes dropped EXE
PID:4812 -
\??\c:\hbtnhh.exec:\hbtnhh.exe44⤵
- Executes dropped EXE
PID:1068 -
\??\c:\jpvjj.exec:\jpvjj.exe45⤵
- Executes dropped EXE
PID:1656 -
\??\c:\jjpdj.exec:\jjpdj.exe46⤵
- Executes dropped EXE
PID:220 -
\??\c:\xxxrfxr.exec:\xxxrfxr.exe47⤵
- Executes dropped EXE
PID:4436 -
\??\c:\lxlflfx.exec:\lxlflfx.exe48⤵
- Executes dropped EXE
PID:4016 -
\??\c:\nhhtnh.exec:\nhhtnh.exe49⤵
- Executes dropped EXE
PID:1336 -
\??\c:\bbtntn.exec:\bbtntn.exe50⤵
- Executes dropped EXE
PID:3000 -
\??\c:\pdvpj.exec:\pdvpj.exe51⤵
- Executes dropped EXE
PID:1356 -
\??\c:\jjvjp.exec:\jjvjp.exe52⤵
- Executes dropped EXE
PID:4444 -
\??\c:\7flxrrr.exec:\7flxrrr.exe53⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hbbbtt.exec:\hbbbtt.exe54⤵
- Executes dropped EXE
PID:4060 -
\??\c:\hbbthh.exec:\hbbthh.exe55⤵
- Executes dropped EXE
PID:1132 -
\??\c:\vjjdp.exec:\vjjdp.exe56⤵
- Executes dropped EXE
PID:2788 -
\??\c:\vjpjj.exec:\vjpjj.exe57⤵
- Executes dropped EXE
PID:1484 -
\??\c:\xrfxlfr.exec:\xrfxlfr.exe58⤵
- Executes dropped EXE
PID:3984 -
\??\c:\bhhthb.exec:\bhhthb.exe59⤵
- Executes dropped EXE
PID:1028 -
\??\c:\vpvjd.exec:\vpvjd.exe60⤵
- Executes dropped EXE
PID:3812 -
\??\c:\pvvjd.exec:\pvvjd.exe61⤵
- Executes dropped EXE
PID:1896 -
\??\c:\xxllrlf.exec:\xxllrlf.exe62⤵
- Executes dropped EXE
PID:4512 -
\??\c:\ffrfrfr.exec:\ffrfrfr.exe63⤵
- Executes dropped EXE
PID:3044 -
\??\c:\7nhnbb.exec:\7nhnbb.exe64⤵
- Executes dropped EXE
PID:4276 -
\??\c:\1vjpp.exec:\1vjpp.exe65⤵
- Executes dropped EXE
PID:864 -
\??\c:\3jvjv.exec:\3jvjv.exe66⤵PID:924
-
\??\c:\rrfrlxx.exec:\rrfrlxx.exe67⤵PID:1972
-
\??\c:\frllxfr.exec:\frllxfr.exe68⤵PID:1732
-
\??\c:\tnbnht.exec:\tnbnht.exe69⤵PID:2332
-
\??\c:\1ddjd.exec:\1ddjd.exe70⤵PID:3280
-
\??\c:\vjdpd.exec:\vjdpd.exe71⤵PID:1712
-
\??\c:\djjvd.exec:\djjvd.exe72⤵PID:740
-
\??\c:\xlxrxxr.exec:\xlxrxxr.exe73⤵PID:3960
-
\??\c:\fllfxrr.exec:\fllfxrr.exe74⤵PID:4980
-
\??\c:\nbbnbt.exec:\nbbnbt.exe75⤵PID:2812
-
\??\c:\vjvpj.exec:\vjvpj.exe76⤵PID:2028
-
\??\c:\jdpdp.exec:\jdpdp.exe77⤵PID:432
-
\??\c:\xlxfrfx.exec:\xlxfrfx.exe78⤵PID:1776
-
\??\c:\fxxrfff.exec:\fxxrfff.exe79⤵PID:3240
-
\??\c:\hbhbtn.exec:\hbhbtn.exe80⤵PID:2368
-
\??\c:\nbthhb.exec:\nbthhb.exe81⤵PID:1548
-
\??\c:\pdjjv.exec:\pdjjv.exe82⤵PID:3180
-
\??\c:\3vvpd.exec:\3vvpd.exe83⤵PID:2080
-
\??\c:\rlrlfff.exec:\rlrlfff.exe84⤵PID:4832
-
\??\c:\ffllxrf.exec:\ffllxrf.exe85⤵PID:4740
-
\??\c:\nbhttt.exec:\nbhttt.exe86⤵PID:5052
-
\??\c:\hbbnhb.exec:\hbbnhb.exe87⤵PID:3224
-
\??\c:\jvdpd.exec:\jvdpd.exe88⤵PID:4620
-
\??\c:\vdvpv.exec:\vdvpv.exe89⤵PID:4556
-
\??\c:\7ffxlfx.exec:\7ffxlfx.exe90⤵PID:1860
-
\??\c:\xfxrlfr.exec:\xfxrlfr.exe91⤵PID:3312
-
\??\c:\htthbb.exec:\htthbb.exe92⤵PID:4676
-
\??\c:\nhnhnb.exec:\nhnhnb.exe93⤵PID:1156
-
\??\c:\jddjp.exec:\jddjp.exe94⤵PID:748
-
\??\c:\9pjdp.exec:\9pjdp.exe95⤵PID:3396
-
\??\c:\rlfrfrl.exec:\rlfrfrl.exe96⤵PID:3548
-
\??\c:\nntnhb.exec:\nntnhb.exe97⤵PID:544
-
\??\c:\vpdvj.exec:\vpdvj.exe98⤵PID:852
-
\??\c:\jdpdp.exec:\jdpdp.exe99⤵PID:3836
-
\??\c:\3rfxlxl.exec:\3rfxlxl.exe100⤵PID:2136
-
\??\c:\fxxrrlf.exec:\fxxrrlf.exe101⤵PID:1368
-
\??\c:\9ntnbb.exec:\9ntnbb.exe102⤵PID:3524
-
\??\c:\thbtbb.exec:\thbtbb.exe103⤵PID:3024
-
\??\c:\3vpdp.exec:\3vpdp.exe104⤵PID:4440
-
\??\c:\pjjdv.exec:\pjjdv.exe105⤵PID:4996
-
\??\c:\fllfrrl.exec:\fllfrrl.exe106⤵PID:4016
-
\??\c:\1llflfl.exec:\1llflfl.exe107⤵PID:756
-
\??\c:\tbtnbt.exec:\tbtnbt.exe108⤵PID:3752
-
\??\c:\7pjdp.exec:\7pjdp.exe109⤵PID:2564
-
\??\c:\dpdvp.exec:\dpdvp.exe110⤵PID:1688
-
\??\c:\lxxrxfr.exec:\lxxrxfr.exe111⤵PID:1108
-
\??\c:\vdvjd.exec:\vdvjd.exe112⤵PID:3260
-
\??\c:\vppjd.exec:\vppjd.exe113⤵PID:1072
-
\??\c:\fxrfrfx.exec:\fxrfrfx.exe114⤵PID:1588
-
\??\c:\lflffff.exec:\lflffff.exe115⤵PID:3556
-
\??\c:\hbnhnn.exec:\hbnhnn.exe116⤵PID:1556
-
\??\c:\3bbtnn.exec:\3bbtnn.exe117⤵PID:1216
-
\??\c:\pjjjv.exec:\pjjjv.exe118⤵PID:3768
-
\??\c:\vdvjv.exec:\vdvjv.exe119⤵PID:1708
-
\??\c:\lxlfrrr.exec:\lxlfrrr.exe120⤵PID:3440
-
\??\c:\1bntnt.exec:\1bntnt.exe121⤵PID:2260
-
\??\c:\1vddd.exec:\1vddd.exe122⤵PID:4276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-