Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
52s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 23:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6f92a47978dba204bac824c671d20c80_NEIKI.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
6f92a47978dba204bac824c671d20c80_NEIKI.exe
-
Size
433KB
-
MD5
6f92a47978dba204bac824c671d20c80
-
SHA1
b653fa1b9a68a599d196a9c25063fe127fc57cad
-
SHA256
f89397809333c39f43fba2b2c6822c90a00bb12aa5f91319aaf34566a4a8c014
-
SHA512
23a84b8001f2f79fb3214747aa1dfd2415b6b9c5cf88379687e6bd0a3a1c6d72f23d03a8c5b5f235b36f038a130134e264927bbe8ab1420825295d6c5c2d345f
-
SSDEEP
12288:n3C9uMPh2kkkkK4kXkkkkkkkkl888888888888888888nF:ShPh2kkkkK4kXkkkkkkkkr
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2328-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/860-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1088-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/812-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1036-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1004-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1004 26640.exe 2328 ppjpp.exe 1700 c820068.exe 2580 rlxfxfl.exe 2588 60880.exe 2616 860688.exe 2456 5xllfll.exe 2664 nhbbtt.exe 2556 tthnbb.exe 2992 vpddv.exe 2820 42682.exe 2520 rrlfrxl.exe 860 04442.exe 1608 60668.exe 1036 hbbbnn.exe 2100 c606802.exe 2956 vpjvd.exe 2252 tnbhnn.exe 2004 2662008.exe 576 u266880.exe 1088 nnthhh.exe 2916 68066.exe 2416 44284.exe 1684 bthnnt.exe 1716 0822440.exe 1340 9frrllf.exe 812 jdvvd.exe 908 q02440.exe 2260 m6402.exe 560 e48466.exe 2280 hnhhnn.exe 2240 9rrrxrx.exe 2516 6868280.exe 2300 042844.exe 1828 nhnnbb.exe 2336 u640068.exe 2628 llxfrrl.exe 2632 5rfllrf.exe 2844 xxrrxxl.exe 2596 4800228.exe 2452 jjpjp.exe 2428 i424062.exe 2648 u244006.exe 2940 26062.exe 1656 tnttbb.exe 2476 5nthbb.exe 2436 0444446.exe 2460 082648.exe 1800 vjvdp.exe 1324 hhthbb.exe 1808 ddjdj.exe 1704 thttbb.exe 2000 g2008.exe 2264 1lfxffr.exe 1724 3hntbh.exe 1140 6428002.exe 384 frllrrl.exe 1380 468240.exe 572 u602440.exe 1740 dvjjp.exe 2916 7nbbtb.exe 2416 040460.exe 1684 pjvjp.exe 1864 jdpvv.exe -
resource yara_rule behavioral1/memory/2328-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/860-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1088-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/812-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1036-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1004-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-4-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2512 wrote to memory of 1004 2512 6f92a47978dba204bac824c671d20c80_NEIKI.exe 28 PID 2512 wrote to memory of 1004 2512 6f92a47978dba204bac824c671d20c80_NEIKI.exe 28 PID 2512 wrote to memory of 1004 2512 6f92a47978dba204bac824c671d20c80_NEIKI.exe 28 PID 2512 wrote to memory of 1004 2512 6f92a47978dba204bac824c671d20c80_NEIKI.exe 28 PID 1004 wrote to memory of 2328 1004 26640.exe 29 PID 1004 wrote to memory of 2328 1004 26640.exe 29 PID 1004 wrote to memory of 2328 1004 26640.exe 29 PID 1004 wrote to memory of 2328 1004 26640.exe 29 PID 2328 wrote to memory of 1700 2328 ppjpp.exe 30 PID 2328 wrote to memory of 1700 2328 ppjpp.exe 30 PID 2328 wrote to memory of 1700 2328 ppjpp.exe 30 PID 2328 wrote to memory of 1700 2328 ppjpp.exe 30 PID 1700 wrote to memory of 2580 1700 c820068.exe 31 PID 1700 wrote to memory of 2580 1700 c820068.exe 31 PID 1700 wrote to memory of 2580 1700 c820068.exe 31 PID 1700 wrote to memory of 2580 1700 c820068.exe 31 PID 2580 wrote to memory of 2588 2580 rlxfxfl.exe 32 PID 2580 wrote to memory of 2588 2580 rlxfxfl.exe 32 PID 2580 wrote to memory of 2588 2580 rlxfxfl.exe 32 PID 2580 wrote to memory of 2588 2580 rlxfxfl.exe 32 PID 2588 wrote to memory of 2616 2588 60880.exe 33 PID 2588 wrote to memory of 2616 2588 60880.exe 33 PID 2588 wrote to memory of 2616 2588 60880.exe 33 PID 2588 wrote to memory of 2616 2588 60880.exe 33 PID 2616 wrote to memory of 2456 2616 860688.exe 34 PID 2616 wrote to memory of 2456 2616 860688.exe 34 PID 2616 wrote to memory of 2456 2616 860688.exe 34 PID 2616 wrote to memory of 2456 2616 860688.exe 34 PID 2456 wrote to memory of 2664 2456 5xllfll.exe 35 PID 2456 wrote to memory of 2664 2456 5xllfll.exe 35 PID 2456 wrote to memory of 2664 2456 5xllfll.exe 35 PID 2456 wrote to memory of 2664 2456 5xllfll.exe 35 PID 2664 wrote to memory of 2556 2664 nhbbtt.exe 36 PID 2664 wrote to memory of 2556 2664 nhbbtt.exe 36 PID 2664 wrote to memory of 2556 2664 nhbbtt.exe 36 PID 2664 wrote to memory of 2556 2664 nhbbtt.exe 36 PID 2556 wrote to memory of 2992 2556 tthnbb.exe 37 PID 2556 wrote to memory of 2992 2556 tthnbb.exe 37 PID 2556 wrote to memory of 2992 2556 tthnbb.exe 37 PID 2556 wrote to memory of 2992 2556 tthnbb.exe 37 PID 2992 wrote to memory of 2820 2992 vpddv.exe 38 PID 2992 wrote to memory of 2820 2992 vpddv.exe 38 PID 2992 wrote to memory of 2820 2992 vpddv.exe 38 PID 2992 wrote to memory of 2820 2992 vpddv.exe 38 PID 2820 wrote to memory of 2520 2820 42682.exe 39 PID 2820 wrote to memory of 2520 2820 42682.exe 39 PID 2820 wrote to memory of 2520 2820 42682.exe 39 PID 2820 wrote to memory of 2520 2820 42682.exe 39 PID 2520 wrote to memory of 860 2520 rrlfrxl.exe 40 PID 2520 wrote to memory of 860 2520 rrlfrxl.exe 40 PID 2520 wrote to memory of 860 2520 rrlfrxl.exe 40 PID 2520 wrote to memory of 860 2520 rrlfrxl.exe 40 PID 860 wrote to memory of 1608 860 04442.exe 41 PID 860 wrote to memory of 1608 860 04442.exe 41 PID 860 wrote to memory of 1608 860 04442.exe 41 PID 860 wrote to memory of 1608 860 04442.exe 41 PID 1608 wrote to memory of 1036 1608 60668.exe 42 PID 1608 wrote to memory of 1036 1608 60668.exe 42 PID 1608 wrote to memory of 1036 1608 60668.exe 42 PID 1608 wrote to memory of 1036 1608 60668.exe 42 PID 1036 wrote to memory of 2100 1036 hbbbnn.exe 43 PID 1036 wrote to memory of 2100 1036 hbbbnn.exe 43 PID 1036 wrote to memory of 2100 1036 hbbbnn.exe 43 PID 1036 wrote to memory of 2100 1036 hbbbnn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f92a47978dba204bac824c671d20c80_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\6f92a47978dba204bac824c671d20c80_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\26640.exec:\26640.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\ppjpp.exec:\ppjpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\c820068.exec:\c820068.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\rlxfxfl.exec:\rlxfxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\60880.exec:\60880.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\860688.exec:\860688.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\5xllfll.exec:\5xllfll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\nhbbtt.exec:\nhbbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\tthnbb.exec:\tthnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\vpddv.exec:\vpddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\42682.exec:\42682.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\rrlfrxl.exec:\rrlfrxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\04442.exec:\04442.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\60668.exec:\60668.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\hbbbnn.exec:\hbbbnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\c606802.exec:\c606802.exe17⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vpjvd.exec:\vpjvd.exe18⤵
- Executes dropped EXE
PID:2956 -
\??\c:\tnbhnn.exec:\tnbhnn.exe19⤵
- Executes dropped EXE
PID:2252 -
\??\c:\2662008.exec:\2662008.exe20⤵
- Executes dropped EXE
PID:2004 -
\??\c:\u266880.exec:\u266880.exe21⤵
- Executes dropped EXE
PID:576 -
\??\c:\nnthhh.exec:\nnthhh.exe22⤵
- Executes dropped EXE
PID:1088 -
\??\c:\68066.exec:\68066.exe23⤵
- Executes dropped EXE
PID:2916 -
\??\c:\44284.exec:\44284.exe24⤵
- Executes dropped EXE
PID:2416 -
\??\c:\bthnnt.exec:\bthnnt.exe25⤵
- Executes dropped EXE
PID:1684 -
\??\c:\0822440.exec:\0822440.exe26⤵
- Executes dropped EXE
PID:1716 -
\??\c:\9frrllf.exec:\9frrllf.exe27⤵
- Executes dropped EXE
PID:1340 -
\??\c:\jdvvd.exec:\jdvvd.exe28⤵
- Executes dropped EXE
PID:812 -
\??\c:\q02440.exec:\q02440.exe29⤵
- Executes dropped EXE
PID:908 -
\??\c:\m6402.exec:\m6402.exe30⤵
- Executes dropped EXE
PID:2260 -
\??\c:\e48466.exec:\e48466.exe31⤵
- Executes dropped EXE
PID:560 -
\??\c:\hnhhnn.exec:\hnhhnn.exe32⤵
- Executes dropped EXE
PID:2280 -
\??\c:\9rrrxrx.exec:\9rrrxrx.exe33⤵
- Executes dropped EXE
PID:2240 -
\??\c:\6868280.exec:\6868280.exe34⤵
- Executes dropped EXE
PID:2516 -
\??\c:\042844.exec:\042844.exe35⤵
- Executes dropped EXE
PID:2300 -
\??\c:\nhnnbb.exec:\nhnnbb.exe36⤵
- Executes dropped EXE
PID:1828 -
\??\c:\u640068.exec:\u640068.exe37⤵
- Executes dropped EXE
PID:2336 -
\??\c:\llxfrrl.exec:\llxfrrl.exe38⤵
- Executes dropped EXE
PID:2628 -
\??\c:\5rfllrf.exec:\5rfllrf.exe39⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xxrrxxl.exec:\xxrrxxl.exe40⤵
- Executes dropped EXE
PID:2844 -
\??\c:\4800228.exec:\4800228.exe41⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jjpjp.exec:\jjpjp.exe42⤵
- Executes dropped EXE
PID:2452 -
\??\c:\i424062.exec:\i424062.exe43⤵
- Executes dropped EXE
PID:2428 -
\??\c:\u244006.exec:\u244006.exe44⤵
- Executes dropped EXE
PID:2648 -
\??\c:\26062.exec:\26062.exe45⤵
- Executes dropped EXE
PID:2940 -
\??\c:\tnttbb.exec:\tnttbb.exe46⤵
- Executes dropped EXE
PID:1656 -
\??\c:\5nthbb.exec:\5nthbb.exe47⤵
- Executes dropped EXE
PID:2476 -
\??\c:\0444446.exec:\0444446.exe48⤵
- Executes dropped EXE
PID:2436 -
\??\c:\082648.exec:\082648.exe49⤵
- Executes dropped EXE
PID:2460 -
\??\c:\vjvdp.exec:\vjvdp.exe50⤵
- Executes dropped EXE
PID:1800 -
\??\c:\hhthbb.exec:\hhthbb.exe51⤵
- Executes dropped EXE
PID:1324 -
\??\c:\ddjdj.exec:\ddjdj.exe52⤵
- Executes dropped EXE
PID:1808 -
\??\c:\thttbb.exec:\thttbb.exe53⤵
- Executes dropped EXE
PID:1704 -
\??\c:\g2008.exec:\g2008.exe54⤵
- Executes dropped EXE
PID:2000 -
\??\c:\1lfxffr.exec:\1lfxffr.exe55⤵
- Executes dropped EXE
PID:2264 -
\??\c:\3hntbh.exec:\3hntbh.exe56⤵
- Executes dropped EXE
PID:1724 -
\??\c:\6428002.exec:\6428002.exe57⤵
- Executes dropped EXE
PID:1140 -
\??\c:\frllrrl.exec:\frllrrl.exe58⤵
- Executes dropped EXE
PID:384 -
\??\c:\468240.exec:\468240.exe59⤵
- Executes dropped EXE
PID:1380 -
\??\c:\u602440.exec:\u602440.exe60⤵
- Executes dropped EXE
PID:572 -
\??\c:\dvjjp.exec:\dvjjp.exe61⤵
- Executes dropped EXE
PID:1740 -
\??\c:\7nbbtb.exec:\7nbbtb.exe62⤵
- Executes dropped EXE
PID:2916 -
\??\c:\040460.exec:\040460.exe63⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pjvjp.exec:\pjvjp.exe64⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jdpvv.exec:\jdpvv.exe65⤵
- Executes dropped EXE
PID:1864 -
\??\c:\a6486.exec:\a6486.exe66⤵PID:800
-
\??\c:\600022.exec:\600022.exe67⤵PID:568
-
\??\c:\1tntbb.exec:\1tntbb.exe68⤵PID:1948
-
\??\c:\k64400.exec:\k64400.exe69⤵PID:912
-
\??\c:\6422446.exec:\6422446.exe70⤵PID:2260
-
\??\c:\tnhthn.exec:\tnhthn.exe71⤵PID:1056
-
\??\c:\w42464.exec:\w42464.exe72⤵PID:1752
-
\??\c:\jdjdj.exec:\jdjdj.exe73⤵PID:2280
-
\??\c:\ttnbnt.exec:\ttnbnt.exe74⤵PID:3032
-
\??\c:\604466.exec:\604466.exe75⤵PID:1944
-
\??\c:\i266228.exec:\i266228.exe76⤵PID:1504
-
\??\c:\626022.exec:\626022.exe77⤵PID:2984
-
\??\c:\k80028.exec:\k80028.exe78⤵PID:672
-
\??\c:\20220.exec:\20220.exe79⤵PID:2656
-
\??\c:\604068.exec:\604068.exe80⤵PID:2628
-
\??\c:\2088002.exec:\2088002.exe81⤵PID:1960
-
\??\c:\pjddj.exec:\pjddj.exe82⤵PID:1028
-
\??\c:\1tnnbn.exec:\1tnnbn.exe83⤵PID:2724
-
\??\c:\dvpvp.exec:\dvpvp.exe84⤵PID:2812
-
\??\c:\hhbhnb.exec:\hhbhnb.exe85⤵PID:2524
-
\??\c:\60880.exec:\60880.exe86⤵PID:2312
-
\??\c:\680620.exec:\680620.exe87⤵PID:1316
-
\??\c:\jjdjv.exec:\jjdjv.exe88⤵PID:2824
-
\??\c:\jjdjp.exec:\jjdjp.exe89⤵PID:2952
-
\??\c:\5jddj.exec:\5jddj.exe90⤵PID:2480
-
\??\c:\nbbhbh.exec:\nbbhbh.exe91⤵PID:1728
-
\??\c:\884068.exec:\884068.exe92⤵PID:2756
-
\??\c:\642800.exec:\642800.exe93⤵PID:1964
-
\??\c:\lfxxllx.exec:\lfxxllx.exe94⤵PID:296
-
\??\c:\0804002.exec:\0804002.exe95⤵PID:1036
-
\??\c:\204040.exec:\204040.exe96⤵PID:2132
-
\??\c:\480006.exec:\480006.exe97⤵PID:1032
-
\??\c:\0068280.exec:\0068280.exe98⤵PID:1820
-
\??\c:\ddppv.exec:\ddppv.exe99⤵PID:1724
-
\??\c:\jdvdv.exec:\jdvdv.exe100⤵PID:1140
-
\??\c:\802888.exec:\802888.exe101⤵PID:2308
-
\??\c:\rxfrlfx.exec:\rxfrlfx.exe102⤵PID:2620
-
\??\c:\k86022.exec:\k86022.exe103⤵PID:1116
-
\??\c:\pjddp.exec:\pjddp.exe104⤵PID:452
-
\??\c:\0804666.exec:\0804666.exe105⤵PID:2748
-
\??\c:\ffrrxxl.exec:\ffrrxxl.exe106⤵PID:1768
-
\??\c:\xrrrflx.exec:\xrrrflx.exe107⤵PID:2868
-
\??\c:\k26806.exec:\k26806.exe108⤵PID:1592
-
\??\c:\s6668.exec:\s6668.exe109⤵PID:900
-
\??\c:\6064240.exec:\6064240.exe110⤵PID:708
-
\??\c:\2668846.exec:\2668846.exe111⤵PID:348
-
\??\c:\48280.exec:\48280.exe112⤵PID:2996
-
\??\c:\ntnthh.exec:\ntnthh.exe113⤵PID:2836
-
\??\c:\fffrflr.exec:\fffrflr.exe114⤵PID:560
-
\??\c:\5lxrxxf.exec:\5lxrxxf.exe115⤵PID:3048
-
\??\c:\088022.exec:\088022.exe116⤵PID:1552
-
\??\c:\bbnbnb.exec:\bbnbnb.exe117⤵PID:2516
-
\??\c:\860684.exec:\860684.exe118⤵PID:2224
-
\??\c:\dpdvd.exec:\dpdvd.exe119⤵PID:2148
-
\??\c:\nthtnn.exec:\nthtnn.exe120⤵PID:3040
-
\??\c:\lxffrfx.exec:\lxffrfx.exe121⤵PID:2644
-
\??\c:\djvvd.exec:\djvvd.exe122⤵PID:2584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-