Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 04:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f78310d1c8cb2b1d77e9e8605a9122f85356ed11b6462231ea3f776c8fe7c40b.exe
Resource
win7-20240704-en
5 signatures
150 seconds
General
-
Target
f78310d1c8cb2b1d77e9e8605a9122f85356ed11b6462231ea3f776c8fe7c40b.exe
-
Size
93KB
-
MD5
caf203fcd15b9b441ff19f332a395fd5
-
SHA1
1541a8bfebd97b62351de9851b9f612f18fbd873
-
SHA256
f78310d1c8cb2b1d77e9e8605a9122f85356ed11b6462231ea3f776c8fe7c40b
-
SHA512
34716433c13d8cba4e56735501d9567f94a6a0a442ca596f9c07311c1c4e5b1cb583a347b80d1d823fca0a1fa0f9d00e8ca8df19a74cefe350d72ef9985e4702
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZaRBE:ymb3NkkiQ3mdBjFIVLd2hWZGreRCYBI
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2876-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1296-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1148-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1100-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1900-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2484 9rrlfxr.exe 2872 42604.exe 2768 8046460.exe 2612 xrffxlf.exe 3060 fxfxfrx.exe 320 408022.exe 940 dddvj.exe 2944 bhhhtb.exe 2228 a0464.exe 2792 0868222.exe 2064 8828640.exe 1296 thhtbb.exe 852 68820.exe 2828 hhhbnt.exe 1992 4846280.exe 1148 nhtntt.exe 2988 ttnbhn.exe 2488 60802.exe 2208 6040224.exe 1524 jvvdp.exe 1960 424246.exe 1856 hthbnb.exe 1100 ttbbtt.exe 1504 080400.exe 1980 lfflrlx.exe 644 644606.exe 2404 026820.exe 2356 464406.exe 2508 rrrflxx.exe 1652 84408.exe 1900 880884.exe 1592 808446.exe 2728 40844.exe 2896 u222080.exe 2940 tthhnt.exe 2764 664866.exe 2596 pjjjv.exe 2664 82808.exe 2612 fxrxlrf.exe 3060 5vjpp.exe 604 2682446.exe 1332 0468644.exe 984 nbtbhh.exe 2220 08822.exe 2084 4826266.exe 1276 xxfrfxf.exe 2868 q20240.exe 2436 fxrxlrf.exe 2344 2040228.exe 2804 bnttnn.exe 1720 1lflffl.exe 2828 486084.exe 1992 hbhnht.exe 2196 lxllrrx.exe 1944 608400.exe 2320 7jddv.exe 2452 3pjpv.exe 620 fxflxxl.exe 1940 btntbh.exe 1740 nhthnb.exe 2532 flxfllx.exe 1856 9dddp.exe 1252 bthnht.exe 1860 fxrlffx.exe -
resource yara_rule behavioral1/memory/2876-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1296-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1148-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1100-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1900-305-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2484 2876 f78310d1c8cb2b1d77e9e8605a9122f85356ed11b6462231ea3f776c8fe7c40b.exe 30 PID 2876 wrote to memory of 2484 2876 f78310d1c8cb2b1d77e9e8605a9122f85356ed11b6462231ea3f776c8fe7c40b.exe 30 PID 2876 wrote to memory of 2484 2876 f78310d1c8cb2b1d77e9e8605a9122f85356ed11b6462231ea3f776c8fe7c40b.exe 30 PID 2876 wrote to memory of 2484 2876 f78310d1c8cb2b1d77e9e8605a9122f85356ed11b6462231ea3f776c8fe7c40b.exe 30 PID 2484 wrote to memory of 2872 2484 9rrlfxr.exe 31 PID 2484 wrote to memory of 2872 2484 9rrlfxr.exe 31 PID 2484 wrote to memory of 2872 2484 9rrlfxr.exe 31 PID 2484 wrote to memory of 2872 2484 9rrlfxr.exe 31 PID 2872 wrote to memory of 2768 2872 42604.exe 32 PID 2872 wrote to memory of 2768 2872 42604.exe 32 PID 2872 wrote to memory of 2768 2872 42604.exe 32 PID 2872 wrote to memory of 2768 2872 42604.exe 32 PID 2768 wrote to memory of 2612 2768 8046460.exe 33 PID 2768 wrote to memory of 2612 2768 8046460.exe 33 PID 2768 wrote to memory of 2612 2768 8046460.exe 33 PID 2768 wrote to memory of 2612 2768 8046460.exe 33 PID 2612 wrote to memory of 3060 2612 xrffxlf.exe 34 PID 2612 wrote to memory of 3060 2612 xrffxlf.exe 34 PID 2612 wrote to memory of 3060 2612 xrffxlf.exe 34 PID 2612 wrote to memory of 3060 2612 xrffxlf.exe 34 PID 3060 wrote to memory of 320 3060 fxfxfrx.exe 35 PID 3060 wrote to memory of 320 3060 fxfxfrx.exe 35 PID 3060 wrote to memory of 320 3060 fxfxfrx.exe 35 PID 3060 wrote to memory of 320 3060 fxfxfrx.exe 35 PID 320 wrote to memory of 940 320 408022.exe 36 PID 320 wrote to memory of 940 320 408022.exe 36 PID 320 wrote to memory of 940 320 408022.exe 36 PID 320 wrote to memory of 940 320 408022.exe 36 PID 940 wrote to memory of 2944 940 dddvj.exe 37 PID 940 wrote to memory of 2944 940 dddvj.exe 37 PID 940 wrote to memory of 2944 940 dddvj.exe 37 PID 940 wrote to memory of 2944 940 dddvj.exe 37 PID 2944 wrote to memory of 2228 2944 bhhhtb.exe 38 PID 2944 wrote to memory of 2228 2944 bhhhtb.exe 38 PID 2944 wrote to memory of 2228 2944 bhhhtb.exe 38 PID 2944 wrote to memory of 2228 2944 bhhhtb.exe 38 PID 2228 wrote to memory of 2792 2228 a0464.exe 39 PID 2228 wrote to memory of 2792 2228 a0464.exe 39 PID 2228 wrote to memory of 2792 2228 a0464.exe 39 PID 2228 wrote to memory of 2792 2228 a0464.exe 39 PID 2792 wrote to memory of 2064 2792 0868222.exe 40 PID 2792 wrote to memory of 2064 2792 0868222.exe 40 PID 2792 wrote to memory of 2064 2792 0868222.exe 40 PID 2792 wrote to memory of 2064 2792 0868222.exe 40 PID 2064 wrote to memory of 1296 2064 8828640.exe 41 PID 2064 wrote to memory of 1296 2064 8828640.exe 41 PID 2064 wrote to memory of 1296 2064 8828640.exe 41 PID 2064 wrote to memory of 1296 2064 8828640.exe 41 PID 1296 wrote to memory of 852 1296 thhtbb.exe 42 PID 1296 wrote to memory of 852 1296 thhtbb.exe 42 PID 1296 wrote to memory of 852 1296 thhtbb.exe 42 PID 1296 wrote to memory of 852 1296 thhtbb.exe 42 PID 852 wrote to memory of 2828 852 68820.exe 43 PID 852 wrote to memory of 2828 852 68820.exe 43 PID 852 wrote to memory of 2828 852 68820.exe 43 PID 852 wrote to memory of 2828 852 68820.exe 43 PID 2828 wrote to memory of 1992 2828 hhhbnt.exe 44 PID 2828 wrote to memory of 1992 2828 hhhbnt.exe 44 PID 2828 wrote to memory of 1992 2828 hhhbnt.exe 44 PID 2828 wrote to memory of 1992 2828 hhhbnt.exe 44 PID 1992 wrote to memory of 1148 1992 4846280.exe 45 PID 1992 wrote to memory of 1148 1992 4846280.exe 45 PID 1992 wrote to memory of 1148 1992 4846280.exe 45 PID 1992 wrote to memory of 1148 1992 4846280.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f78310d1c8cb2b1d77e9e8605a9122f85356ed11b6462231ea3f776c8fe7c40b.exe"C:\Users\Admin\AppData\Local\Temp\f78310d1c8cb2b1d77e9e8605a9122f85356ed11b6462231ea3f776c8fe7c40b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\9rrlfxr.exec:\9rrlfxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\42604.exec:\42604.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\8046460.exec:\8046460.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\xrffxlf.exec:\xrffxlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\fxfxfrx.exec:\fxfxfrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\408022.exec:\408022.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\dddvj.exec:\dddvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\bhhhtb.exec:\bhhhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\a0464.exec:\a0464.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\0868222.exec:\0868222.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\8828640.exec:\8828640.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\thhtbb.exec:\thhtbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\68820.exec:\68820.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\hhhbnt.exec:\hhhbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\4846280.exec:\4846280.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\nhtntt.exec:\nhtntt.exe17⤵
- Executes dropped EXE
PID:1148 -
\??\c:\ttnbhn.exec:\ttnbhn.exe18⤵
- Executes dropped EXE
PID:2988 -
\??\c:\60802.exec:\60802.exe19⤵
- Executes dropped EXE
PID:2488 -
\??\c:\6040224.exec:\6040224.exe20⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jvvdp.exec:\jvvdp.exe21⤵
- Executes dropped EXE
PID:1524 -
\??\c:\424246.exec:\424246.exe22⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hthbnb.exec:\hthbnb.exe23⤵
- Executes dropped EXE
PID:1856 -
\??\c:\ttbbtt.exec:\ttbbtt.exe24⤵
- Executes dropped EXE
PID:1100 -
\??\c:\080400.exec:\080400.exe25⤵
- Executes dropped EXE
PID:1504 -
\??\c:\lfflrlx.exec:\lfflrlx.exe26⤵
- Executes dropped EXE
PID:1980 -
\??\c:\644606.exec:\644606.exe27⤵
- Executes dropped EXE
PID:644 -
\??\c:\026820.exec:\026820.exe28⤵
- Executes dropped EXE
PID:2404 -
\??\c:\464406.exec:\464406.exe29⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rrrflxx.exec:\rrrflxx.exe30⤵
- Executes dropped EXE
PID:2508 -
\??\c:\84408.exec:\84408.exe31⤵
- Executes dropped EXE
PID:1652 -
\??\c:\880884.exec:\880884.exe32⤵
- Executes dropped EXE
PID:1900 -
\??\c:\808446.exec:\808446.exe33⤵
- Executes dropped EXE
PID:1592 -
\??\c:\40844.exec:\40844.exe34⤵
- Executes dropped EXE
PID:2728 -
\??\c:\u222080.exec:\u222080.exe35⤵
- Executes dropped EXE
PID:2896 -
\??\c:\tthhnt.exec:\tthhnt.exe36⤵
- Executes dropped EXE
PID:2940 -
\??\c:\664866.exec:\664866.exe37⤵
- Executes dropped EXE
PID:2764 -
\??\c:\pjjjv.exec:\pjjjv.exe38⤵
- Executes dropped EXE
PID:2596 -
\??\c:\82808.exec:\82808.exe39⤵
- Executes dropped EXE
PID:2664 -
\??\c:\fxrxlrf.exec:\fxrxlrf.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\5vjpp.exec:\5vjpp.exe41⤵
- Executes dropped EXE
PID:3060 -
\??\c:\2682446.exec:\2682446.exe42⤵
- Executes dropped EXE
PID:604 -
\??\c:\0468644.exec:\0468644.exe43⤵
- Executes dropped EXE
PID:1332 -
\??\c:\nbtbhh.exec:\nbtbhh.exe44⤵
- Executes dropped EXE
PID:984 -
\??\c:\08822.exec:\08822.exe45⤵
- Executes dropped EXE
PID:2220 -
\??\c:\4826266.exec:\4826266.exe46⤵
- Executes dropped EXE
PID:2084 -
\??\c:\xxfrfxf.exec:\xxfrfxf.exe47⤵
- Executes dropped EXE
PID:1276 -
\??\c:\q20240.exec:\q20240.exe48⤵
- Executes dropped EXE
PID:2868 -
\??\c:\fxrxlrf.exec:\fxrxlrf.exe49⤵
- Executes dropped EXE
PID:2436 -
\??\c:\2040228.exec:\2040228.exe50⤵
- Executes dropped EXE
PID:2344 -
\??\c:\bnttnn.exec:\bnttnn.exe51⤵
- Executes dropped EXE
PID:2804 -
\??\c:\1lflffl.exec:\1lflffl.exe52⤵
- Executes dropped EXE
PID:1720 -
\??\c:\486084.exec:\486084.exe53⤵
- Executes dropped EXE
PID:2828 -
\??\c:\hbhnht.exec:\hbhnht.exe54⤵
- Executes dropped EXE
PID:1992 -
\??\c:\lxllrrx.exec:\lxllrrx.exe55⤵
- Executes dropped EXE
PID:2196 -
\??\c:\608400.exec:\608400.exe56⤵
- Executes dropped EXE
PID:1944 -
\??\c:\7jddv.exec:\7jddv.exe57⤵
- Executes dropped EXE
PID:2320 -
\??\c:\3pjpv.exec:\3pjpv.exe58⤵
- Executes dropped EXE
PID:2452 -
\??\c:\fxflxxl.exec:\fxflxxl.exe59⤵
- Executes dropped EXE
PID:620 -
\??\c:\btntbh.exec:\btntbh.exe60⤵
- Executes dropped EXE
PID:1940 -
\??\c:\nhthnb.exec:\nhthnb.exe61⤵
- Executes dropped EXE
PID:1740 -
\??\c:\flxfllx.exec:\flxfllx.exe62⤵
- Executes dropped EXE
PID:2532 -
\??\c:\9dddp.exec:\9dddp.exe63⤵
- Executes dropped EXE
PID:1856 -
\??\c:\bthnht.exec:\bthnht.exe64⤵
- Executes dropped EXE
PID:1252 -
\??\c:\fxrlffx.exec:\fxrlffx.exe65⤵
- Executes dropped EXE
PID:1860 -
\??\c:\vjpjv.exec:\vjpjv.exe66⤵PID:1852
-
\??\c:\hnbbbh.exec:\hnbbbh.exe67⤵PID:752
-
\??\c:\886262.exec:\886262.exe68⤵PID:2080
-
\??\c:\6664860.exec:\6664860.exe69⤵PID:3068
-
\??\c:\rrlffff.exec:\rrlffff.exe70⤵PID:1908
-
\??\c:\a0648.exec:\a0648.exe71⤵PID:1392
-
\??\c:\2048626.exec:\2048626.exe72⤵PID:1032
-
\??\c:\bhnhht.exec:\bhnhht.exe73⤵PID:2412
-
\??\c:\bhtnnn.exec:\bhtnnn.exe74⤵PID:1596
-
\??\c:\3nbhtn.exec:\3nbhtn.exe75⤵PID:2740
-
\??\c:\lllxxxx.exec:\lllxxxx.exe76⤵PID:2728
-
\??\c:\jvdpj.exec:\jvdpj.exe77⤵PID:2756
-
\??\c:\i488662.exec:\i488662.exe78⤵PID:2616
-
\??\c:\48006.exec:\48006.exe79⤵PID:2640
-
\??\c:\864402.exec:\864402.exe80⤵PID:3032
-
\??\c:\1ntttt.exec:\1ntttt.exe81⤵PID:3048
-
\??\c:\lxxxlrr.exec:\lxxxlrr.exe82⤵PID:572
-
\??\c:\486204.exec:\486204.exe83⤵PID:300
-
\??\c:\2008406.exec:\2008406.exe84⤵PID:1268
-
\??\c:\tnntbn.exec:\tnntbn.exe85⤵PID:824
-
\??\c:\q46248.exec:\q46248.exe86⤵PID:984
-
\??\c:\0480600.exec:\0480600.exe87⤵PID:2216
-
\??\c:\5btntn.exec:\5btntn.exe88⤵PID:2108
-
\??\c:\7htnbh.exec:\7htnbh.exe89⤵PID:2660
-
\??\c:\7bhtnt.exec:\7bhtnt.exe90⤵PID:2332
-
\??\c:\xrxxfxx.exec:\xrxxfxx.exe91⤵PID:1540
-
\??\c:\062482.exec:\062482.exe92⤵PID:2796
-
\??\c:\nhthht.exec:\nhthht.exe93⤵PID:2928
-
\??\c:\2666420.exec:\2666420.exe94⤵PID:1720
-
\??\c:\86066.exec:\86066.exe95⤵PID:1284
-
\??\c:\266224.exec:\266224.exe96⤵PID:1992
-
\??\c:\lflrlll.exec:\lflrlll.exe97⤵PID:2172
-
\??\c:\04062.exec:\04062.exe98⤵PID:2044
-
\??\c:\22086.exec:\22086.exe99⤵PID:2312
-
\??\c:\3xffrrl.exec:\3xffrrl.exe100⤵PID:2004
-
\??\c:\840862.exec:\840862.exe101⤵PID:1480
-
\??\c:\ddvdj.exec:\ddvdj.exe102⤵PID:864
-
\??\c:\vjvdd.exec:\vjvdd.exe103⤵PID:1960
-
\??\c:\dpdjp.exec:\dpdjp.exe104⤵PID:2252
-
\??\c:\68204.exec:\68204.exe105⤵PID:1520
-
\??\c:\68880.exec:\68880.exe106⤵PID:2460
-
\??\c:\066420.exec:\066420.exe107⤵PID:1608
-
\??\c:\2268684.exec:\2268684.exe108⤵PID:832
-
\??\c:\w02080.exec:\w02080.exe109⤵PID:952
-
\??\c:\88026.exec:\88026.exe110⤵PID:2080
-
\??\c:\g2620.exec:\g2620.exe111⤵PID:2396
-
\??\c:\3bbhtn.exec:\3bbhtn.exe112⤵PID:2908
-
\??\c:\q44404.exec:\q44404.exe113⤵PID:2304
-
\??\c:\fxxxfll.exec:\fxxxfll.exe114⤵PID:1032
-
\??\c:\602466.exec:\602466.exe115⤵PID:1588
-
\??\c:\5ddjj.exec:\5ddjj.exe116⤵PID:1596
-
\??\c:\vpvdd.exec:\vpvdd.exe117⤵PID:1592
-
\??\c:\lfflfxl.exec:\lfflfxl.exe118⤵PID:2884
-
\??\c:\tnnthn.exec:\tnnthn.exe119⤵PID:2896
-
\??\c:\ddjpp.exec:\ddjpp.exe120⤵PID:2604
-
\??\c:\s0242.exec:\s0242.exe121⤵PID:2764
-
\??\c:\24066.exec:\24066.exe122⤵PID:3032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-