Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 23:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
92fe2bf7f2a1bd098b079c2a114df80c_JaffaCakes118.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
92fe2bf7f2a1bd098b079c2a114df80c_JaffaCakes118.exe
-
Size
231KB
-
MD5
92fe2bf7f2a1bd098b079c2a114df80c
-
SHA1
2eda70ab29df06f531e799ba1109611f476353a6
-
SHA256
b3ea0c725e683b913c2840901aa26f25491cf2d5a94468e9523707e8adb9463f
-
SHA512
f42935a669bebb2651de329b976b4aa7bcfddb440fc2397e6dfa273c4e81332e8b5562c734ca47af4a744a6122d53470b1a505019d8c3a3b751ca915de8824ab
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xL8eBWOgP:n3C9BRo7MlrWKo+lxK8eBWVP
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4188-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1988-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1988-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/616-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4048 fu350f.exe 3968 g2fu70.exe 3724 o3v10v.exe 1988 r7avkoe.exe 1756 efus6l.exe 4968 iwwno4.exe 2760 r1x5u47.exe 1860 3i5hw.exe 616 p53dq.exe 4560 6a6e3.exe 1492 83s8hq.exe 2832 38l5tc.exe 3524 r3599gm.exe 1964 fsqkec6.exe 1548 779r85.exe 4480 54155n9.exe 4520 kj94j.exe 4576 m1gre3.exe 4712 n1uoamt.exe 1208 75j329.exe 2236 513wa39.exe 4428 2pmmq.exe 4904 i5587.exe 440 7g2wfb.exe 2248 u3oi75s.exe 548 8t147u.exe 2024 3mpwc.exe 2416 mnw40u.exe 60 jcw3ec.exe 4456 48e6c8.exe 1236 2ee36f.exe 4184 7xugpt3.exe 1948 4e8n6qi.exe 3252 64tn01.exe 5112 10t40.exe 4988 m2g0h.exe 4912 4xkro.exe 4036 n4as3ee.exe 2412 8ov381.exe 3192 u97e0.exe 436 7ccjk.exe 5072 44w54o1.exe 4004 1jmko8g.exe 2204 89k2237.exe 5068 791ua51.exe 1692 w0n90uu.exe 4940 x57pa39.exe 3536 ah4rpp5.exe 2128 6711irf.exe 1312 84t54.exe 4920 1s589k.exe 4812 59b382.exe 2368 9u7434k.exe 4168 o9007.exe 3700 17gr7.exe 1012 i3ullg.exe 5052 37w5u.exe 3092 q18075.exe 3044 vmaw4.exe 892 56aa00.exe 4108 f3gl17.exe 3328 e8u1g.exe 2648 4x1v7.exe 1288 7cxr812.exe -
resource yara_rule behavioral2/memory/4188-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/616-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/616-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/616-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4188 wrote to memory of 4048 4188 92fe2bf7f2a1bd098b079c2a114df80c_JaffaCakes118.exe 91 PID 4188 wrote to memory of 4048 4188 92fe2bf7f2a1bd098b079c2a114df80c_JaffaCakes118.exe 91 PID 4188 wrote to memory of 4048 4188 92fe2bf7f2a1bd098b079c2a114df80c_JaffaCakes118.exe 91 PID 4048 wrote to memory of 3968 4048 fu350f.exe 92 PID 4048 wrote to memory of 3968 4048 fu350f.exe 92 PID 4048 wrote to memory of 3968 4048 fu350f.exe 92 PID 3968 wrote to memory of 3724 3968 g2fu70.exe 93 PID 3968 wrote to memory of 3724 3968 g2fu70.exe 93 PID 3968 wrote to memory of 3724 3968 g2fu70.exe 93 PID 3724 wrote to memory of 1988 3724 o3v10v.exe 94 PID 3724 wrote to memory of 1988 3724 o3v10v.exe 94 PID 3724 wrote to memory of 1988 3724 o3v10v.exe 94 PID 1988 wrote to memory of 1756 1988 r7avkoe.exe 95 PID 1988 wrote to memory of 1756 1988 r7avkoe.exe 95 PID 1988 wrote to memory of 1756 1988 r7avkoe.exe 95 PID 1756 wrote to memory of 4968 1756 efus6l.exe 96 PID 1756 wrote to memory of 4968 1756 efus6l.exe 96 PID 1756 wrote to memory of 4968 1756 efus6l.exe 96 PID 4968 wrote to memory of 2760 4968 iwwno4.exe 97 PID 4968 wrote to memory of 2760 4968 iwwno4.exe 97 PID 4968 wrote to memory of 2760 4968 iwwno4.exe 97 PID 2760 wrote to memory of 1860 2760 r1x5u47.exe 98 PID 2760 wrote to memory of 1860 2760 r1x5u47.exe 98 PID 2760 wrote to memory of 1860 2760 r1x5u47.exe 98 PID 1860 wrote to memory of 616 1860 3i5hw.exe 99 PID 1860 wrote to memory of 616 1860 3i5hw.exe 99 PID 1860 wrote to memory of 616 1860 3i5hw.exe 99 PID 616 wrote to memory of 4560 616 p53dq.exe 100 PID 616 wrote to memory of 4560 616 p53dq.exe 100 PID 616 wrote to memory of 4560 616 p53dq.exe 100 PID 4560 wrote to memory of 1492 4560 6a6e3.exe 101 PID 4560 wrote to memory of 1492 4560 6a6e3.exe 101 PID 4560 wrote to memory of 1492 4560 6a6e3.exe 101 PID 1492 wrote to memory of 2832 1492 83s8hq.exe 102 PID 1492 wrote to memory of 2832 1492 83s8hq.exe 102 PID 1492 wrote to memory of 2832 1492 83s8hq.exe 102 PID 2832 wrote to memory of 3524 2832 38l5tc.exe 103 PID 2832 wrote to memory of 3524 2832 38l5tc.exe 103 PID 2832 wrote to memory of 3524 2832 38l5tc.exe 103 PID 3524 wrote to memory of 1964 3524 r3599gm.exe 104 PID 3524 wrote to memory of 1964 3524 r3599gm.exe 104 PID 3524 wrote to memory of 1964 3524 r3599gm.exe 104 PID 1964 wrote to memory of 1548 1964 fsqkec6.exe 105 PID 1964 wrote to memory of 1548 1964 fsqkec6.exe 105 PID 1964 wrote to memory of 1548 1964 fsqkec6.exe 105 PID 1548 wrote to memory of 4480 1548 779r85.exe 106 PID 1548 wrote to memory of 4480 1548 779r85.exe 106 PID 1548 wrote to memory of 4480 1548 779r85.exe 106 PID 4480 wrote to memory of 4520 4480 54155n9.exe 107 PID 4480 wrote to memory of 4520 4480 54155n9.exe 107 PID 4480 wrote to memory of 4520 4480 54155n9.exe 107 PID 4520 wrote to memory of 4576 4520 kj94j.exe 108 PID 4520 wrote to memory of 4576 4520 kj94j.exe 108 PID 4520 wrote to memory of 4576 4520 kj94j.exe 108 PID 4576 wrote to memory of 4712 4576 m1gre3.exe 109 PID 4576 wrote to memory of 4712 4576 m1gre3.exe 109 PID 4576 wrote to memory of 4712 4576 m1gre3.exe 109 PID 4712 wrote to memory of 1208 4712 n1uoamt.exe 110 PID 4712 wrote to memory of 1208 4712 n1uoamt.exe 110 PID 4712 wrote to memory of 1208 4712 n1uoamt.exe 110 PID 1208 wrote to memory of 2236 1208 75j329.exe 111 PID 1208 wrote to memory of 2236 1208 75j329.exe 111 PID 1208 wrote to memory of 2236 1208 75j329.exe 111 PID 2236 wrote to memory of 4428 2236 513wa39.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\92fe2bf7f2a1bd098b079c2a114df80c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\92fe2bf7f2a1bd098b079c2a114df80c_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\fu350f.exec:\fu350f.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\g2fu70.exec:\g2fu70.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\o3v10v.exec:\o3v10v.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\r7avkoe.exec:\r7avkoe.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\efus6l.exec:\efus6l.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\iwwno4.exec:\iwwno4.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\r1x5u47.exec:\r1x5u47.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\3i5hw.exec:\3i5hw.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\p53dq.exec:\p53dq.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
\??\c:\6a6e3.exec:\6a6e3.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\83s8hq.exec:\83s8hq.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\38l5tc.exec:\38l5tc.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\r3599gm.exec:\r3599gm.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\fsqkec6.exec:\fsqkec6.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\779r85.exec:\779r85.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\54155n9.exec:\54155n9.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\kj94j.exec:\kj94j.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\m1gre3.exec:\m1gre3.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\n1uoamt.exec:\n1uoamt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\75j329.exec:\75j329.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\513wa39.exec:\513wa39.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\2pmmq.exec:\2pmmq.exe23⤵
- Executes dropped EXE
PID:4428 -
\??\c:\i5587.exec:\i5587.exe24⤵
- Executes dropped EXE
PID:4904 -
\??\c:\7g2wfb.exec:\7g2wfb.exe25⤵
- Executes dropped EXE
PID:440 -
\??\c:\u3oi75s.exec:\u3oi75s.exe26⤵
- Executes dropped EXE
PID:2248 -
\??\c:\8t147u.exec:\8t147u.exe27⤵
- Executes dropped EXE
PID:548 -
\??\c:\3mpwc.exec:\3mpwc.exe28⤵
- Executes dropped EXE
PID:2024 -
\??\c:\mnw40u.exec:\mnw40u.exe29⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jcw3ec.exec:\jcw3ec.exe30⤵
- Executes dropped EXE
PID:60 -
\??\c:\48e6c8.exec:\48e6c8.exe31⤵
- Executes dropped EXE
PID:4456 -
\??\c:\2ee36f.exec:\2ee36f.exe32⤵
- Executes dropped EXE
PID:1236 -
\??\c:\7xugpt3.exec:\7xugpt3.exe33⤵
- Executes dropped EXE
PID:4184 -
\??\c:\4e8n6qi.exec:\4e8n6qi.exe34⤵
- Executes dropped EXE
PID:1948 -
\??\c:\64tn01.exec:\64tn01.exe35⤵
- Executes dropped EXE
PID:3252 -
\??\c:\10t40.exec:\10t40.exe36⤵
- Executes dropped EXE
PID:5112 -
\??\c:\m2g0h.exec:\m2g0h.exe37⤵
- Executes dropped EXE
PID:4988 -
\??\c:\4xkro.exec:\4xkro.exe38⤵
- Executes dropped EXE
PID:4912 -
\??\c:\n4as3ee.exec:\n4as3ee.exe39⤵
- Executes dropped EXE
PID:4036 -
\??\c:\8ov381.exec:\8ov381.exe40⤵
- Executes dropped EXE
PID:2412 -
\??\c:\u97e0.exec:\u97e0.exe41⤵
- Executes dropped EXE
PID:3192 -
\??\c:\7ccjk.exec:\7ccjk.exe42⤵
- Executes dropped EXE
PID:436 -
\??\c:\44w54o1.exec:\44w54o1.exe43⤵
- Executes dropped EXE
PID:5072 -
\??\c:\1jmko8g.exec:\1jmko8g.exe44⤵
- Executes dropped EXE
PID:4004 -
\??\c:\89k2237.exec:\89k2237.exe45⤵
- Executes dropped EXE
PID:2204 -
\??\c:\791ua51.exec:\791ua51.exe46⤵
- Executes dropped EXE
PID:5068 -
\??\c:\w0n90uu.exec:\w0n90uu.exe47⤵
- Executes dropped EXE
PID:1692 -
\??\c:\x57pa39.exec:\x57pa39.exe48⤵
- Executes dropped EXE
PID:4940 -
\??\c:\ah4rpp5.exec:\ah4rpp5.exe49⤵
- Executes dropped EXE
PID:3536 -
\??\c:\6711irf.exec:\6711irf.exe50⤵
- Executes dropped EXE
PID:2128 -
\??\c:\84t54.exec:\84t54.exe51⤵
- Executes dropped EXE
PID:1312 -
\??\c:\1s589k.exec:\1s589k.exe52⤵
- Executes dropped EXE
PID:4920 -
\??\c:\59b382.exec:\59b382.exe53⤵
- Executes dropped EXE
PID:4812 -
\??\c:\9u7434k.exec:\9u7434k.exe54⤵
- Executes dropped EXE
PID:2368 -
\??\c:\o9007.exec:\o9007.exe55⤵
- Executes dropped EXE
PID:4168 -
\??\c:\17gr7.exec:\17gr7.exe56⤵
- Executes dropped EXE
PID:3700 -
\??\c:\i3ullg.exec:\i3ullg.exe57⤵
- Executes dropped EXE
PID:1012 -
\??\c:\37w5u.exec:\37w5u.exe58⤵
- Executes dropped EXE
PID:5052 -
\??\c:\q18075.exec:\q18075.exe59⤵
- Executes dropped EXE
PID:3092 -
\??\c:\vmaw4.exec:\vmaw4.exe60⤵
- Executes dropped EXE
PID:3044 -
\??\c:\56aa00.exec:\56aa00.exe61⤵
- Executes dropped EXE
PID:892 -
\??\c:\f3gl17.exec:\f3gl17.exe62⤵
- Executes dropped EXE
PID:4108 -
\??\c:\e8u1g.exec:\e8u1g.exe63⤵
- Executes dropped EXE
PID:3328 -
\??\c:\4x1v7.exec:\4x1v7.exe64⤵
- Executes dropped EXE
PID:2648 -
\??\c:\7cxr812.exec:\7cxr812.exe65⤵
- Executes dropped EXE
PID:1288 -
\??\c:\7buo03.exec:\7buo03.exe66⤵PID:1564
-
\??\c:\6ht812.exec:\6ht812.exe67⤵PID:4256
-
\??\c:\53ul213.exec:\53ul213.exe68⤵PID:3476
-
\??\c:\ssp8mw.exec:\ssp8mw.exe69⤵PID:5084
-
\??\c:\p13ei5.exec:\p13ei5.exe70⤵PID:2216
-
\??\c:\r3ee0l.exec:\r3ee0l.exe71⤵PID:3148
-
\??\c:\u970a4.exec:\u970a4.exe72⤵PID:3848
-
\??\c:\7imt9c.exec:\7imt9c.exe73⤵PID:944
-
\??\c:\l1992kk.exec:\l1992kk.exe74⤵PID:3232
-
\??\c:\765vd33.exec:\765vd33.exe75⤵PID:3540
-
\??\c:\97pj06.exec:\97pj06.exe76⤵PID:1948
-
\??\c:\090ro16.exec:\090ro16.exe77⤵PID:3824
-
\??\c:\4p0w1.exec:\4p0w1.exe78⤵PID:2756
-
\??\c:\t9d1jt.exec:\t9d1jt.exe79⤵PID:2148
-
\??\c:\ecxg3q2.exec:\ecxg3q2.exe80⤵PID:3248
-
\??\c:\221u3r1.exec:\221u3r1.exe81⤵PID:4036
-
\??\c:\u8op1.exec:\u8op1.exe82⤵PID:4968
-
\??\c:\5371p.exec:\5371p.exe83⤵PID:3192
-
\??\c:\a3s31.exec:\a3s31.exe84⤵PID:1496
-
\??\c:\p8il5.exec:\p8il5.exe85⤵PID:1804
-
\??\c:\ls95q.exec:\ls95q.exe86⤵PID:2436
-
\??\c:\j5vj4e.exec:\j5vj4e.exe87⤵PID:228
-
\??\c:\lgqfm.exec:\lgqfm.exe88⤵PID:3992
-
\??\c:\98521t.exec:\98521t.exe89⤵PID:2784
-
\??\c:\t6611.exec:\t6611.exe90⤵PID:1492
-
\??\c:\2i8m1.exec:\2i8m1.exe91⤵PID:3756
-
\??\c:\6u41r3i.exec:\6u41r3i.exe92⤵PID:4684
-
\??\c:\893hx.exec:\893hx.exe93⤵PID:1876
-
\??\c:\vvupjra.exec:\vvupjra.exe94⤵PID:4052
-
\??\c:\3h8l1li.exec:\3h8l1li.exe95⤵PID:2944
-
\??\c:\0lu3g1l.exec:\0lu3g1l.exe96⤵PID:3704
-
\??\c:\7ux070f.exec:\7ux070f.exe97⤵PID:4080
-
\??\c:\8p1mb.exec:\8p1mb.exe98⤵PID:1012
-
\??\c:\u3is3.exec:\u3is3.exe99⤵PID:5052
-
\??\c:\smsm86f.exec:\smsm86f.exe100⤵PID:3092
-
\??\c:\va3h5g6.exec:\va3h5g6.exe101⤵PID:3896
-
\??\c:\qwww8ow.exec:\qwww8ow.exe102⤵PID:892
-
\??\c:\13jppt6.exec:\13jppt6.exe103⤵PID:2336
-
\??\c:\apwu0.exec:\apwu0.exe104⤵PID:2108
-
\??\c:\b5s27.exec:\b5s27.exe105⤵PID:4400
-
\??\c:\qxai48t.exec:\qxai48t.exe106⤵PID:3776
-
\??\c:\4b8oq.exec:\4b8oq.exe107⤵PID:2164
-
\??\c:\8c4u22.exec:\8c4u22.exe108⤵PID:4604
-
\??\c:\tw08f.exec:\tw08f.exe109⤵PID:3476
-
\??\c:\w5um9qu.exec:\w5um9qu.exe110⤵PID:4420
-
\??\c:\4936g0.exec:\4936g0.exe111⤵PID:4472
-
\??\c:\4adq2r0.exec:\4adq2r0.exe112⤵PID:4104
-
\??\c:\ja23n3.exec:\ja23n3.exe113⤵PID:1532
-
\??\c:\1apn1e.exec:\1apn1e.exe114⤵PID:3644
-
\??\c:\k7x7ci.exec:\k7x7ci.exe115⤵PID:1704
-
\??\c:\t29n114.exec:\t29n114.exe116⤵PID:2480
-
\??\c:\2kfpf68.exec:\2kfpf68.exe117⤵PID:4748
-
\??\c:\t90831.exec:\t90831.exe118⤵PID:2060
-
\??\c:\984m6q.exec:\984m6q.exe119⤵PID:2612
-
\??\c:\hiis0.exec:\hiis0.exe120⤵PID:2760
-
\??\c:\d653ve6.exec:\d653ve6.exe121⤵PID:1496
-
\??\c:\l38842.exec:\l38842.exe122⤵PID:416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-