Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 06:45
Behavioral task
behavioral1
Sample
c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe
Resource
win10v2004-20220812-en
General
-
Target
c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe
-
Size
176KB
-
MD5
67bb67039260940af0e4dad4bca535dd
-
SHA1
4f000c37fdcc24f63b5c3c1412c5e4e308b07206
-
SHA256
c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4
-
SHA512
4c823d75ff77fa3fcc52086364c41b4b0002a67b40342827f9381a76e6bd34a792ec4a849441edfda119553e31834950b7fd3f61f0f42d80cf7af455e6fc4755
-
SSDEEP
3072:bB829B5TpDnq2gKkbb+NjI0s8cCecLG2VPjNXx+ak2rFRosLTYIxOU:bN9le2gKGitb3XUvULT
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/364-55-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/memory/364-91-0x0000000000400000-0x0000000000479000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\marshaalina = "C:\\Windows\\marshaalina.bat" c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\marshaalina.exe c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe File opened for modification C:\Windows\marshaalina.exe c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe File created C:\Windows\marshaalina.bat c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1708 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe 1708 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 364 wrote to memory of 1708 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 26 PID 364 wrote to memory of 1708 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 26 PID 364 wrote to memory of 1708 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 26 PID 364 wrote to memory of 1708 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 26 PID 364 wrote to memory of 1868 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 27 PID 364 wrote to memory of 1868 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 27 PID 364 wrote to memory of 1868 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 27 PID 364 wrote to memory of 1868 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 27 PID 364 wrote to memory of 908 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 28 PID 364 wrote to memory of 908 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 28 PID 364 wrote to memory of 908 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 28 PID 364 wrote to memory of 908 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 28 PID 364 wrote to memory of 984 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 29 PID 364 wrote to memory of 984 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 29 PID 364 wrote to memory of 984 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 29 PID 364 wrote to memory of 984 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 29 PID 364 wrote to memory of 1376 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 30 PID 364 wrote to memory of 1376 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 30 PID 364 wrote to memory of 1376 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 30 PID 364 wrote to memory of 1376 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 30 PID 364 wrote to memory of 1928 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 31 PID 364 wrote to memory of 1928 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 31 PID 364 wrote to memory of 1928 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 31 PID 364 wrote to memory of 1928 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 31 PID 364 wrote to memory of 1092 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 32 PID 364 wrote to memory of 1092 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 32 PID 364 wrote to memory of 1092 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 32 PID 364 wrote to memory of 1092 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 32 PID 364 wrote to memory of 1932 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 33 PID 364 wrote to memory of 1932 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 33 PID 364 wrote to memory of 1932 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 33 PID 364 wrote to memory of 1932 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 33 PID 364 wrote to memory of 1780 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 34 PID 364 wrote to memory of 1780 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 34 PID 364 wrote to memory of 1780 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 34 PID 364 wrote to memory of 1780 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 34 PID 364 wrote to memory of 1400 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 35 PID 364 wrote to memory of 1400 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 35 PID 364 wrote to memory of 1400 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 35 PID 364 wrote to memory of 1400 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 35 PID 364 wrote to memory of 1724 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 36 PID 364 wrote to memory of 1724 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 36 PID 364 wrote to memory of 1724 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 36 PID 364 wrote to memory of 1724 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 36 PID 364 wrote to memory of 568 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 37 PID 364 wrote to memory of 568 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 37 PID 364 wrote to memory of 568 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 37 PID 364 wrote to memory of 568 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 37 PID 364 wrote to memory of 1280 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 38 PID 364 wrote to memory of 1280 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 38 PID 364 wrote to memory of 1280 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 38 PID 364 wrote to memory of 1280 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 38 PID 364 wrote to memory of 1640 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 39 PID 364 wrote to memory of 1640 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 39 PID 364 wrote to memory of 1640 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 39 PID 364 wrote to memory of 1640 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 39 PID 364 wrote to memory of 1412 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 40 PID 364 wrote to memory of 1412 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 40 PID 364 wrote to memory of 1412 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 40 PID 364 wrote to memory of 1412 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 40 PID 364 wrote to memory of 2032 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 41 PID 364 wrote to memory of 2032 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 41 PID 364 wrote to memory of 2032 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 41 PID 364 wrote to memory of 2032 364 c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe"C:\Users\Admin\AppData\Local\Temp\c9747aaf3bc0235b6f95609f8c90ed1ef9327a7ddb7cacaedbd93a5dc0fbe1a4.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1708
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1868
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:908
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:984
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1376
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1928
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1092
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1932
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1780
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1400
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1724
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:568
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1280
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1640
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1412
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:2032
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1736
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1976
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1380
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:2016
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1088
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1436
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:820
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1504
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1468
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:560
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:268
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:656
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1292
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:548
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1068
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1844
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1812
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1744
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:788
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1692
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:940
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1944
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1448
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:836
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1112
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1920
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:2044
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1464
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1856
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:2028
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1048
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1408
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1616
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1520
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1980
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1984
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1976
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1380
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:2016
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1088
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:864
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:956
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1480
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1192
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1536
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:580
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1456
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:736
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1176
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:548
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:920
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1648
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1844
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1556
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1740
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:2020
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:788
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:912
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:944
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:908
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1944
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1256
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1364
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1928
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1112
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1092
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:2040
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1184
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1464
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:632
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:568
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1604
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1048
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1408
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:928
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:2032
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1992
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1996
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1984
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1972
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1472
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1908
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:2016
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1712
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:396
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:864
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1076
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1504
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1480
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:972
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:764
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1600
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:580
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:524
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1292
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1680
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1116
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:304
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1620
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1580
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1812
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1744
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:996
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1288
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1668
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:912
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:944
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:908
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1944
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1256
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1364
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1928
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1780
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:2044
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1952
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1400
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:816
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1856
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:288
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1280
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1640
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1756
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:860
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1748
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1784
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1080
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1056
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1412
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:2024
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:928
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:2032
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1992
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1996
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1984
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1972
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1472
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1908
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:2016
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1712
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:976
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:864
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1076
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1504
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1480
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:972
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:764
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1600
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:580
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1456
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1292
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1176
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:548
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:920
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1584
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1844
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1556
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1588
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:1704
-
-
C:\Windows\SysWOW64\taskmgr.exe"C:\Windows\System32\taskmgr.exe"2⤵PID:788
-