Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 21:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
460fd22e825972536bee86f8354477dd34e7e51ebac18b633a2d0f3b94b7d62e.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
460fd22e825972536bee86f8354477dd34e7e51ebac18b633a2d0f3b94b7d62e.exe
-
Size
69KB
-
MD5
831976b91c46b871ea7dc408ee8de1b8
-
SHA1
7821e3e01b720c4cf0b4d847abdb30cc75b709e8
-
SHA256
460fd22e825972536bee86f8354477dd34e7e51ebac18b633a2d0f3b94b7d62e
-
SHA512
fbe28a1a0549aef1119660d681c3dcc9e31ccf5d07a49163e4bb919ebb66f22b3a262b1454454ef2c4596ecbf5a541c27b2bcd7398522b7d4e62a34194166d03
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUPqrDZVTr7:ymb3NkkiQ3mdBjF0yUm7T
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2328-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/500-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1228-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1424-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1344-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1172-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2484 244244.exe 2600 bhhtht.exe 2536 04848.exe 2588 vpvpd.exe 2780 2022440.exe 2444 vpvpj.exe 2512 xlxxllx.exe 2708 4244466.exe 2744 882244.exe 2820 i644662.exe 2380 rlxfffr.exe 2284 llflrfl.exe 1852 400604.exe 2636 llllxfx.exe 2660 66688.exe 784 ttnbnt.exe 500 48286.exe 840 26068.exe 1228 llxxlfl.exe 2012 80888.exe 1920 nbbhnb.exe 2372 480262.exe 1424 04224.exe 1140 04628.exe 2264 lfllrxf.exe 1344 048040.exe 1740 hbhnnn.exe 1688 w02022.exe 3048 frrxxlr.exe 1172 flflrfr.exe 2168 jvjjp.exe 1948 irflfrr.exe 2072 nnttth.exe 2332 7rfxrlr.exe 2496 8684006.exe 2844 xrxflxf.exe 2508 48286.exe 1528 m0428.exe 2420 bbbtht.exe 2556 fxlxxfr.exe 2396 42462.exe 2464 c286048.exe 1956 nhtbnn.exe 1684 jpddp.exe 2792 bbnnbh.exe 2900 e26022.exe 2452 6028806.exe 376 06082.exe 1560 hhthhh.exe 2580 66068.exe 1452 ffxfxrl.exe 2688 frfflrf.exe 324 lxrxxxf.exe 1060 22228.exe 932 44680.exe 500 488666.exe 916 20628.exe 2080 608862.exe 2340 0828446.exe 1932 vvpvd.exe 760 jdvvj.exe 2372 pvpjd.exe 708 486888.exe 2724 0086088.exe -
resource yara_rule behavioral1/memory/2328-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/500-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1228-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1424-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1344-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1172-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-297-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2484 2328 460fd22e825972536bee86f8354477dd34e7e51ebac18b633a2d0f3b94b7d62e.exe 28 PID 2328 wrote to memory of 2484 2328 460fd22e825972536bee86f8354477dd34e7e51ebac18b633a2d0f3b94b7d62e.exe 28 PID 2328 wrote to memory of 2484 2328 460fd22e825972536bee86f8354477dd34e7e51ebac18b633a2d0f3b94b7d62e.exe 28 PID 2328 wrote to memory of 2484 2328 460fd22e825972536bee86f8354477dd34e7e51ebac18b633a2d0f3b94b7d62e.exe 28 PID 2484 wrote to memory of 2600 2484 244244.exe 29 PID 2484 wrote to memory of 2600 2484 244244.exe 29 PID 2484 wrote to memory of 2600 2484 244244.exe 29 PID 2484 wrote to memory of 2600 2484 244244.exe 29 PID 2600 wrote to memory of 2536 2600 bhhtht.exe 30 PID 2600 wrote to memory of 2536 2600 bhhtht.exe 30 PID 2600 wrote to memory of 2536 2600 bhhtht.exe 30 PID 2600 wrote to memory of 2536 2600 bhhtht.exe 30 PID 2536 wrote to memory of 2588 2536 04848.exe 31 PID 2536 wrote to memory of 2588 2536 04848.exe 31 PID 2536 wrote to memory of 2588 2536 04848.exe 31 PID 2536 wrote to memory of 2588 2536 04848.exe 31 PID 2588 wrote to memory of 2780 2588 vpvpd.exe 32 PID 2588 wrote to memory of 2780 2588 vpvpd.exe 32 PID 2588 wrote to memory of 2780 2588 vpvpd.exe 32 PID 2588 wrote to memory of 2780 2588 vpvpd.exe 32 PID 2780 wrote to memory of 2444 2780 2022440.exe 33 PID 2780 wrote to memory of 2444 2780 2022440.exe 33 PID 2780 wrote to memory of 2444 2780 2022440.exe 33 PID 2780 wrote to memory of 2444 2780 2022440.exe 33 PID 2444 wrote to memory of 2512 2444 vpvpj.exe 34 PID 2444 wrote to memory of 2512 2444 vpvpj.exe 34 PID 2444 wrote to memory of 2512 2444 vpvpj.exe 34 PID 2444 wrote to memory of 2512 2444 vpvpj.exe 34 PID 2512 wrote to memory of 2708 2512 xlxxllx.exe 35 PID 2512 wrote to memory of 2708 2512 xlxxllx.exe 35 PID 2512 wrote to memory of 2708 2512 xlxxllx.exe 35 PID 2512 wrote to memory of 2708 2512 xlxxllx.exe 35 PID 2708 wrote to memory of 2744 2708 4244466.exe 36 PID 2708 wrote to memory of 2744 2708 4244466.exe 36 PID 2708 wrote to memory of 2744 2708 4244466.exe 36 PID 2708 wrote to memory of 2744 2708 4244466.exe 36 PID 2744 wrote to memory of 2820 2744 882244.exe 37 PID 2744 wrote to memory of 2820 2744 882244.exe 37 PID 2744 wrote to memory of 2820 2744 882244.exe 37 PID 2744 wrote to memory of 2820 2744 882244.exe 37 PID 2820 wrote to memory of 2380 2820 i644662.exe 38 PID 2820 wrote to memory of 2380 2820 i644662.exe 38 PID 2820 wrote to memory of 2380 2820 i644662.exe 38 PID 2820 wrote to memory of 2380 2820 i644662.exe 38 PID 2380 wrote to memory of 2284 2380 rlxfffr.exe 39 PID 2380 wrote to memory of 2284 2380 rlxfffr.exe 39 PID 2380 wrote to memory of 2284 2380 rlxfffr.exe 39 PID 2380 wrote to memory of 2284 2380 rlxfffr.exe 39 PID 2284 wrote to memory of 1852 2284 llflrfl.exe 40 PID 2284 wrote to memory of 1852 2284 llflrfl.exe 40 PID 2284 wrote to memory of 1852 2284 llflrfl.exe 40 PID 2284 wrote to memory of 1852 2284 llflrfl.exe 40 PID 1852 wrote to memory of 2636 1852 400604.exe 41 PID 1852 wrote to memory of 2636 1852 400604.exe 41 PID 1852 wrote to memory of 2636 1852 400604.exe 41 PID 1852 wrote to memory of 2636 1852 400604.exe 41 PID 2636 wrote to memory of 2660 2636 llllxfx.exe 42 PID 2636 wrote to memory of 2660 2636 llllxfx.exe 42 PID 2636 wrote to memory of 2660 2636 llllxfx.exe 42 PID 2636 wrote to memory of 2660 2636 llllxfx.exe 42 PID 2660 wrote to memory of 784 2660 66688.exe 43 PID 2660 wrote to memory of 784 2660 66688.exe 43 PID 2660 wrote to memory of 784 2660 66688.exe 43 PID 2660 wrote to memory of 784 2660 66688.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\460fd22e825972536bee86f8354477dd34e7e51ebac18b633a2d0f3b94b7d62e.exe"C:\Users\Admin\AppData\Local\Temp\460fd22e825972536bee86f8354477dd34e7e51ebac18b633a2d0f3b94b7d62e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\244244.exec:\244244.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\bhhtht.exec:\bhhtht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\04848.exec:\04848.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\vpvpd.exec:\vpvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\2022440.exec:\2022440.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vpvpj.exec:\vpvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\xlxxllx.exec:\xlxxllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\4244466.exec:\4244466.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\882244.exec:\882244.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\i644662.exec:\i644662.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\rlxfffr.exec:\rlxfffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\llflrfl.exec:\llflrfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\400604.exec:\400604.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\llllxfx.exec:\llllxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\66688.exec:\66688.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\ttnbnt.exec:\ttnbnt.exe17⤵
- Executes dropped EXE
PID:784 -
\??\c:\48286.exec:\48286.exe18⤵
- Executes dropped EXE
PID:500 -
\??\c:\26068.exec:\26068.exe19⤵
- Executes dropped EXE
PID:840 -
\??\c:\llxxlfl.exec:\llxxlfl.exe20⤵
- Executes dropped EXE
PID:1228 -
\??\c:\80888.exec:\80888.exe21⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nbbhnb.exec:\nbbhnb.exe22⤵
- Executes dropped EXE
PID:1920 -
\??\c:\480262.exec:\480262.exe23⤵
- Executes dropped EXE
PID:2372 -
\??\c:\04224.exec:\04224.exe24⤵
- Executes dropped EXE
PID:1424 -
\??\c:\04628.exec:\04628.exe25⤵
- Executes dropped EXE
PID:1140 -
\??\c:\lfllrxf.exec:\lfllrxf.exe26⤵
- Executes dropped EXE
PID:2264 -
\??\c:\048040.exec:\048040.exe27⤵
- Executes dropped EXE
PID:1344 -
\??\c:\hbhnnn.exec:\hbhnnn.exe28⤵
- Executes dropped EXE
PID:1740 -
\??\c:\w02022.exec:\w02022.exe29⤵
- Executes dropped EXE
PID:1688 -
\??\c:\frrxxlr.exec:\frrxxlr.exe30⤵
- Executes dropped EXE
PID:3048 -
\??\c:\flflrfr.exec:\flflrfr.exe31⤵
- Executes dropped EXE
PID:1172 -
\??\c:\jvjjp.exec:\jvjjp.exe32⤵
- Executes dropped EXE
PID:2168 -
\??\c:\irflfrr.exec:\irflfrr.exe33⤵
- Executes dropped EXE
PID:1948 -
\??\c:\nnttth.exec:\nnttth.exe34⤵
- Executes dropped EXE
PID:2072 -
\??\c:\7rfxrlr.exec:\7rfxrlr.exe35⤵
- Executes dropped EXE
PID:2332 -
\??\c:\8684006.exec:\8684006.exe36⤵
- Executes dropped EXE
PID:2496 -
\??\c:\xrxflxf.exec:\xrxflxf.exe37⤵
- Executes dropped EXE
PID:2844 -
\??\c:\48286.exec:\48286.exe38⤵
- Executes dropped EXE
PID:2508 -
\??\c:\m0428.exec:\m0428.exe39⤵
- Executes dropped EXE
PID:1528 -
\??\c:\bbbtht.exec:\bbbtht.exe40⤵
- Executes dropped EXE
PID:2420 -
\??\c:\fxlxxfr.exec:\fxlxxfr.exe41⤵
- Executes dropped EXE
PID:2556 -
\??\c:\42462.exec:\42462.exe42⤵
- Executes dropped EXE
PID:2396 -
\??\c:\c286048.exec:\c286048.exe43⤵
- Executes dropped EXE
PID:2464 -
\??\c:\nhtbnn.exec:\nhtbnn.exe44⤵
- Executes dropped EXE
PID:1956 -
\??\c:\jpddp.exec:\jpddp.exe45⤵
- Executes dropped EXE
PID:1684 -
\??\c:\bbnnbh.exec:\bbnnbh.exe46⤵
- Executes dropped EXE
PID:2792 -
\??\c:\e26022.exec:\e26022.exe47⤵
- Executes dropped EXE
PID:2900 -
\??\c:\6028806.exec:\6028806.exe48⤵
- Executes dropped EXE
PID:2452 -
\??\c:\06082.exec:\06082.exe49⤵
- Executes dropped EXE
PID:376 -
\??\c:\hhthhh.exec:\hhthhh.exe50⤵
- Executes dropped EXE
PID:1560 -
\??\c:\66068.exec:\66068.exe51⤵
- Executes dropped EXE
PID:2580 -
\??\c:\ffxfxrl.exec:\ffxfxrl.exe52⤵
- Executes dropped EXE
PID:1452 -
\??\c:\frfflrf.exec:\frfflrf.exe53⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lxrxxxf.exec:\lxrxxxf.exe54⤵
- Executes dropped EXE
PID:324 -
\??\c:\22228.exec:\22228.exe55⤵
- Executes dropped EXE
PID:1060 -
\??\c:\44680.exec:\44680.exe56⤵
- Executes dropped EXE
PID:932 -
\??\c:\488666.exec:\488666.exe57⤵
- Executes dropped EXE
PID:500 -
\??\c:\20628.exec:\20628.exe58⤵
- Executes dropped EXE
PID:916 -
\??\c:\608862.exec:\608862.exe59⤵
- Executes dropped EXE
PID:2080 -
\??\c:\0828446.exec:\0828446.exe60⤵
- Executes dropped EXE
PID:2340 -
\??\c:\vvpvd.exec:\vvpvd.exe61⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jdvvj.exec:\jdvvj.exe62⤵
- Executes dropped EXE
PID:760 -
\??\c:\pvpjd.exec:\pvpjd.exe63⤵
- Executes dropped EXE
PID:2372 -
\??\c:\486888.exec:\486888.exe64⤵
- Executes dropped EXE
PID:708 -
\??\c:\0086088.exec:\0086088.exe65⤵
- Executes dropped EXE
PID:2724 -
\??\c:\7nnbhh.exec:\7nnbhh.exe66⤵PID:1664
-
\??\c:\444204.exec:\444204.exe67⤵PID:948
-
\??\c:\flxlrrr.exec:\flxlrrr.exe68⤵PID:1288
-
\??\c:\c022884.exec:\c022884.exe69⤵PID:1088
-
\??\c:\228024.exec:\228024.exe70⤵PID:1688
-
\??\c:\2460640.exec:\2460640.exe71⤵PID:2164
-
\??\c:\5xlrrfr.exec:\5xlrrfr.exe72⤵PID:2136
-
\??\c:\e08888.exec:\e08888.exe73⤵PID:2368
-
\??\c:\446826.exec:\446826.exe74⤵PID:1884
-
\??\c:\400424.exec:\400424.exe75⤵PID:1948
-
\??\c:\222408.exec:\222408.exe76⤵PID:2584
-
\??\c:\3jdjd.exec:\3jdjd.exe77⤵PID:2616
-
\??\c:\dvvjv.exec:\dvvjv.exe78⤵PID:2692
-
\??\c:\hbbttt.exec:\hbbttt.exe79⤵PID:2400
-
\??\c:\jjdjj.exec:\jjdjj.exe80⤵PID:2416
-
\??\c:\9btbbb.exec:\9btbbb.exe81⤵PID:2628
-
\??\c:\xxxrrfx.exec:\xxxrrfx.exe82⤵PID:2560
-
\??\c:\rlxxfxf.exec:\rlxxfxf.exe83⤵PID:2780
-
\??\c:\k42840.exec:\k42840.exe84⤵PID:304
-
\??\c:\82028.exec:\82028.exe85⤵PID:2468
-
\??\c:\260240.exec:\260240.exe86⤵PID:1680
-
\??\c:\4240224.exec:\4240224.exe87⤵PID:2768
-
\??\c:\2002026.exec:\2002026.exe88⤵PID:2808
-
\??\c:\lfxxfxx.exec:\lfxxfxx.exe89⤵PID:2744
-
\??\c:\8882686.exec:\8882686.exe90⤵PID:2976
-
\??\c:\hbbnbn.exec:\hbbnbn.exe91⤵PID:2968
-
\??\c:\hbhbhb.exec:\hbhbhb.exe92⤵PID:2284
-
\??\c:\22682.exec:\22682.exe93⤵PID:816
-
\??\c:\pjppd.exec:\pjppd.exe94⤵PID:2728
-
\??\c:\ppjpj.exec:\ppjpj.exe95⤵PID:384
-
\??\c:\hnbbbb.exec:\hnbbbb.exe96⤵PID:328
-
\??\c:\5nhthn.exec:\5nhthn.exe97⤵PID:1428
-
\??\c:\20222.exec:\20222.exe98⤵PID:696
-
\??\c:\jvjdp.exec:\jvjdp.exe99⤵PID:628
-
\??\c:\nnnttb.exec:\nnnttb.exe100⤵PID:852
-
\??\c:\6466228.exec:\6466228.exe101⤵PID:2488
-
\??\c:\2246840.exec:\2246840.exe102⤵PID:1976
-
\??\c:\hnbtbh.exec:\hnbtbh.exe103⤵PID:2376
-
\??\c:\vpdjp.exec:\vpdjp.exe104⤵PID:1072
-
\??\c:\6022828.exec:\6022828.exe105⤵PID:2220
-
\??\c:\1ppvj.exec:\1ppvj.exe106⤵PID:2040
-
\??\c:\jjvdp.exec:\jjvdp.exe107⤵PID:1644
-
\??\c:\jdpvd.exec:\jdpvd.exe108⤵PID:1292
-
\??\c:\s0462.exec:\s0462.exe109⤵PID:1344
-
\??\c:\5htbnn.exec:\5htbnn.exe110⤵PID:1056
-
\??\c:\4862240.exec:\4862240.exe111⤵PID:2052
-
\??\c:\3dppd.exec:\3dppd.exe112⤵PID:2364
-
\??\c:\hhtthh.exec:\hhtthh.exe113⤵PID:1000
-
\??\c:\82666.exec:\82666.exe114⤵PID:1700
-
\??\c:\vjvvv.exec:\vjvvv.exe115⤵PID:636
-
\??\c:\6284024.exec:\6284024.exe116⤵PID:1564
-
\??\c:\fxrxffx.exec:\fxrxffx.exe117⤵PID:2520
-
\??\c:\xxlxllr.exec:\xxlxllr.exe118⤵PID:2620
-
\??\c:\1pjpd.exec:\1pjpd.exe119⤵PID:2608
-
\??\c:\08044.exec:\08044.exe120⤵PID:2496
-
\??\c:\ddjjj.exec:\ddjjj.exe121⤵PID:2720
-
\??\c:\2684668.exec:\2684668.exe122⤵PID:1640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-