Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 04:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ca14135ae7a5d5e9ac9c3c7ecc89b980_NEIKI.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
ca14135ae7a5d5e9ac9c3c7ecc89b980_NEIKI.exe
-
Size
433KB
-
MD5
ca14135ae7a5d5e9ac9c3c7ecc89b980
-
SHA1
e92c7f7a656364c3c3b6363b386d47cdc34b6715
-
SHA256
9ffdffe225cc68e42d1ed4361e0f9b76244555a661d49868f3a99d743573c71a
-
SHA512
abb19969d64d291ade0a7b5a6006cc5eaf2e28b366f6eabd191bc88a1f93b5aa0cc5391baf9095358f855dc486d22904394dfaf86d2c31c37c47a5fb400389f4
-
SSDEEP
12288:n3C9uMPh2kkkkK4kXkkkkkkkkl888888888888888888nR:ShPh2kkkkK4kXkkkkkkkkD
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1652-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/300-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2076-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1064-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1988 864460.exe 2732 pdppd.exe 2588 046244.exe 2708 a4244.exe 2692 080060.exe 2828 vpdjd.exe 2500 m4624.exe 2524 s6822.exe 2616 xxllxrx.exe 2820 djdvp.exe 2932 6640004.exe 2064 42886.exe 300 jdvdj.exe 1484 pvvvd.exe 2016 420206.exe 1936 k20060.exe 288 3pvpj.exe 1304 08444.exe 2076 dvpvj.exe 324 frflllr.exe 632 0422402.exe 2176 202800.exe 1064 jdpvp.exe 2148 3bhntt.exe 1624 dpddp.exe 1964 46222.exe 780 5thhhb.exe 384 42402.exe 3048 u866228.exe 2040 7ntthn.exe 2352 08044.exe 876 dpjjv.exe 1688 648288.exe 1684 5pddd.exe 3068 fxffllr.exe 2096 bthhnn.exe 2292 7rflllr.exe 2552 u028668.exe 2600 1bhhhh.exe 1236 rlxflrf.exe 2712 tnhnnn.exe 2408 86880.exe 2440 ffflxfl.exe 1016 dvjjv.exe 2488 02040.exe 2496 5djjj.exe 2952 086688.exe 2968 nbnntt.exe 2932 8288442.exe 2972 5pdjj.exe 1588 42000.exe 2432 vjvpv.exe 1952 8626602.exe 2548 1thhhh.exe 2800 7vjpp.exe 1728 9bhhnn.exe 624 lfrfllr.exe 2264 fxxxxxx.exe 2100 5bbnhh.exe 612 q60622.exe 1324 2066662.exe 1864 s8062.exe 2132 7lxrrxx.exe 828 jvjpd.exe -
resource yara_rule behavioral1/memory/1652-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/300-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1064-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1652 wrote to memory of 1988 1652 ca14135ae7a5d5e9ac9c3c7ecc89b980_NEIKI.exe 28 PID 1652 wrote to memory of 1988 1652 ca14135ae7a5d5e9ac9c3c7ecc89b980_NEIKI.exe 28 PID 1652 wrote to memory of 1988 1652 ca14135ae7a5d5e9ac9c3c7ecc89b980_NEIKI.exe 28 PID 1652 wrote to memory of 1988 1652 ca14135ae7a5d5e9ac9c3c7ecc89b980_NEIKI.exe 28 PID 1988 wrote to memory of 2732 1988 864460.exe 29 PID 1988 wrote to memory of 2732 1988 864460.exe 29 PID 1988 wrote to memory of 2732 1988 864460.exe 29 PID 1988 wrote to memory of 2732 1988 864460.exe 29 PID 2732 wrote to memory of 2588 2732 pdppd.exe 30 PID 2732 wrote to memory of 2588 2732 pdppd.exe 30 PID 2732 wrote to memory of 2588 2732 pdppd.exe 30 PID 2732 wrote to memory of 2588 2732 pdppd.exe 30 PID 2588 wrote to memory of 2708 2588 046244.exe 31 PID 2588 wrote to memory of 2708 2588 046244.exe 31 PID 2588 wrote to memory of 2708 2588 046244.exe 31 PID 2588 wrote to memory of 2708 2588 046244.exe 31 PID 2708 wrote to memory of 2692 2708 a4244.exe 32 PID 2708 wrote to memory of 2692 2708 a4244.exe 32 PID 2708 wrote to memory of 2692 2708 a4244.exe 32 PID 2708 wrote to memory of 2692 2708 a4244.exe 32 PID 2692 wrote to memory of 2828 2692 080060.exe 33 PID 2692 wrote to memory of 2828 2692 080060.exe 33 PID 2692 wrote to memory of 2828 2692 080060.exe 33 PID 2692 wrote to memory of 2828 2692 080060.exe 33 PID 2828 wrote to memory of 2500 2828 vpdjd.exe 34 PID 2828 wrote to memory of 2500 2828 vpdjd.exe 34 PID 2828 wrote to memory of 2500 2828 vpdjd.exe 34 PID 2828 wrote to memory of 2500 2828 vpdjd.exe 34 PID 2500 wrote to memory of 2524 2500 m4624.exe 35 PID 2500 wrote to memory of 2524 2500 m4624.exe 35 PID 2500 wrote to memory of 2524 2500 m4624.exe 35 PID 2500 wrote to memory of 2524 2500 m4624.exe 35 PID 2524 wrote to memory of 2616 2524 s6822.exe 36 PID 2524 wrote to memory of 2616 2524 s6822.exe 36 PID 2524 wrote to memory of 2616 2524 s6822.exe 36 PID 2524 wrote to memory of 2616 2524 s6822.exe 36 PID 2616 wrote to memory of 2820 2616 xxllxrx.exe 37 PID 2616 wrote to memory of 2820 2616 xxllxrx.exe 37 PID 2616 wrote to memory of 2820 2616 xxllxrx.exe 37 PID 2616 wrote to memory of 2820 2616 xxllxrx.exe 37 PID 2820 wrote to memory of 2932 2820 djdvp.exe 38 PID 2820 wrote to memory of 2932 2820 djdvp.exe 38 PID 2820 wrote to memory of 2932 2820 djdvp.exe 38 PID 2820 wrote to memory of 2932 2820 djdvp.exe 38 PID 2932 wrote to memory of 2064 2932 6640004.exe 39 PID 2932 wrote to memory of 2064 2932 6640004.exe 39 PID 2932 wrote to memory of 2064 2932 6640004.exe 39 PID 2932 wrote to memory of 2064 2932 6640004.exe 39 PID 2064 wrote to memory of 300 2064 42886.exe 40 PID 2064 wrote to memory of 300 2064 42886.exe 40 PID 2064 wrote to memory of 300 2064 42886.exe 40 PID 2064 wrote to memory of 300 2064 42886.exe 40 PID 300 wrote to memory of 1484 300 jdvdj.exe 41 PID 300 wrote to memory of 1484 300 jdvdj.exe 41 PID 300 wrote to memory of 1484 300 jdvdj.exe 41 PID 300 wrote to memory of 1484 300 jdvdj.exe 41 PID 1484 wrote to memory of 2016 1484 pvvvd.exe 42 PID 1484 wrote to memory of 2016 1484 pvvvd.exe 42 PID 1484 wrote to memory of 2016 1484 pvvvd.exe 42 PID 1484 wrote to memory of 2016 1484 pvvvd.exe 42 PID 2016 wrote to memory of 1936 2016 420206.exe 43 PID 2016 wrote to memory of 1936 2016 420206.exe 43 PID 2016 wrote to memory of 1936 2016 420206.exe 43 PID 2016 wrote to memory of 1936 2016 420206.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca14135ae7a5d5e9ac9c3c7ecc89b980_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\ca14135ae7a5d5e9ac9c3c7ecc89b980_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\864460.exec:\864460.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\pdppd.exec:\pdppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\046244.exec:\046244.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\a4244.exec:\a4244.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\080060.exec:\080060.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\vpdjd.exec:\vpdjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\m4624.exec:\m4624.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\s6822.exec:\s6822.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\xxllxrx.exec:\xxllxrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\djdvp.exec:\djdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\6640004.exec:\6640004.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\42886.exec:\42886.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\jdvdj.exec:\jdvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
\??\c:\pvvvd.exec:\pvvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\420206.exec:\420206.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\k20060.exec:\k20060.exe17⤵
- Executes dropped EXE
PID:1936 -
\??\c:\3pvpj.exec:\3pvpj.exe18⤵
- Executes dropped EXE
PID:288 -
\??\c:\08444.exec:\08444.exe19⤵
- Executes dropped EXE
PID:1304 -
\??\c:\dvpvj.exec:\dvpvj.exe20⤵
- Executes dropped EXE
PID:2076 -
\??\c:\frflllr.exec:\frflllr.exe21⤵
- Executes dropped EXE
PID:324 -
\??\c:\0422402.exec:\0422402.exe22⤵
- Executes dropped EXE
PID:632 -
\??\c:\202800.exec:\202800.exe23⤵
- Executes dropped EXE
PID:2176 -
\??\c:\jdpvp.exec:\jdpvp.exe24⤵
- Executes dropped EXE
PID:1064 -
\??\c:\3bhntt.exec:\3bhntt.exe25⤵
- Executes dropped EXE
PID:2148 -
\??\c:\dpddp.exec:\dpddp.exe26⤵
- Executes dropped EXE
PID:1624 -
\??\c:\46222.exec:\46222.exe27⤵
- Executes dropped EXE
PID:1964 -
\??\c:\5thhhb.exec:\5thhhb.exe28⤵
- Executes dropped EXE
PID:780 -
\??\c:\42402.exec:\42402.exe29⤵
- Executes dropped EXE
PID:384 -
\??\c:\u866228.exec:\u866228.exe30⤵
- Executes dropped EXE
PID:3048 -
\??\c:\7ntthn.exec:\7ntthn.exe31⤵
- Executes dropped EXE
PID:2040 -
\??\c:\08044.exec:\08044.exe32⤵
- Executes dropped EXE
PID:2352 -
\??\c:\dpjjv.exec:\dpjjv.exe33⤵
- Executes dropped EXE
PID:876 -
\??\c:\648288.exec:\648288.exe34⤵
- Executes dropped EXE
PID:1688 -
\??\c:\5pddd.exec:\5pddd.exe35⤵
- Executes dropped EXE
PID:1684 -
\??\c:\fxffllr.exec:\fxffllr.exe36⤵
- Executes dropped EXE
PID:3068 -
\??\c:\bthhnn.exec:\bthhnn.exe37⤵
- Executes dropped EXE
PID:2096 -
\??\c:\7rflllr.exec:\7rflllr.exe38⤵
- Executes dropped EXE
PID:2292 -
\??\c:\u028668.exec:\u028668.exe39⤵
- Executes dropped EXE
PID:2552 -
\??\c:\1bhhhh.exec:\1bhhhh.exe40⤵
- Executes dropped EXE
PID:2600 -
\??\c:\rlxflrf.exec:\rlxflrf.exe41⤵
- Executes dropped EXE
PID:1236 -
\??\c:\tnhnnn.exec:\tnhnnn.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\86880.exec:\86880.exe43⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ffflxfl.exec:\ffflxfl.exe44⤵
- Executes dropped EXE
PID:2440 -
\??\c:\dvjjv.exec:\dvjjv.exe45⤵
- Executes dropped EXE
PID:1016 -
\??\c:\02040.exec:\02040.exe46⤵
- Executes dropped EXE
PID:2488 -
\??\c:\5djjj.exec:\5djjj.exe47⤵
- Executes dropped EXE
PID:2496 -
\??\c:\086688.exec:\086688.exe48⤵
- Executes dropped EXE
PID:2952 -
\??\c:\nbnntt.exec:\nbnntt.exe49⤵
- Executes dropped EXE
PID:2968 -
\??\c:\8288442.exec:\8288442.exe50⤵
- Executes dropped EXE
PID:2932 -
\??\c:\5pdjj.exec:\5pdjj.exe51⤵
- Executes dropped EXE
PID:2972 -
\??\c:\42000.exec:\42000.exe52⤵
- Executes dropped EXE
PID:1588 -
\??\c:\vjvpv.exec:\vjvpv.exe53⤵
- Executes dropped EXE
PID:2432 -
\??\c:\8626602.exec:\8626602.exe54⤵
- Executes dropped EXE
PID:1952 -
\??\c:\1thhhh.exec:\1thhhh.exe55⤵
- Executes dropped EXE
PID:2548 -
\??\c:\7vjpp.exec:\7vjpp.exe56⤵
- Executes dropped EXE
PID:2800 -
\??\c:\9bhhnn.exec:\9bhhnn.exe57⤵
- Executes dropped EXE
PID:1728 -
\??\c:\lfrfllr.exec:\lfrfllr.exe58⤵
- Executes dropped EXE
PID:624 -
\??\c:\fxxxxxx.exec:\fxxxxxx.exe59⤵
- Executes dropped EXE
PID:2264 -
\??\c:\5bbnhh.exec:\5bbnhh.exe60⤵
- Executes dropped EXE
PID:2100 -
\??\c:\q60622.exec:\q60622.exe61⤵
- Executes dropped EXE
PID:612 -
\??\c:\2066662.exec:\2066662.exe62⤵
- Executes dropped EXE
PID:1324 -
\??\c:\s8062.exec:\s8062.exe63⤵
- Executes dropped EXE
PID:1864 -
\??\c:\7lxrrxx.exec:\7lxrrxx.exe64⤵
- Executes dropped EXE
PID:2132 -
\??\c:\jvjpd.exec:\jvjpd.exe65⤵
- Executes dropped EXE
PID:828 -
\??\c:\pdjpv.exec:\pdjpv.exe66⤵PID:2288
-
\??\c:\6022484.exec:\6022484.exe67⤵PID:2276
-
\??\c:\bnbbbt.exec:\bnbbbt.exe68⤵PID:1344
-
\??\c:\424800.exec:\424800.exe69⤵PID:1964
-
\??\c:\vpdjd.exec:\vpdjd.exe70⤵PID:604
-
\??\c:\vpjjv.exec:\vpjjv.exe71⤵PID:896
-
\??\c:\20260.exec:\20260.exe72⤵PID:1072
-
\??\c:\fxrrlrl.exec:\fxrrlrl.exe73⤵PID:564
-
\??\c:\080006.exec:\080006.exe74⤵PID:1148
-
\??\c:\btbbhb.exec:\btbbhb.exe75⤵PID:2084
-
\??\c:\3nnhbb.exec:\3nnhbb.exe76⤵PID:3016
-
\??\c:\bthnhh.exec:\bthnhh.exe77⤵PID:1704
-
\??\c:\8264068.exec:\8264068.exe78⤵PID:2136
-
\??\c:\q86686.exec:\q86686.exe79⤵PID:2172
-
\??\c:\ffllrrx.exec:\ffllrrx.exe80⤵PID:1596
-
\??\c:\9vdjp.exec:\9vdjp.exe81⤵PID:2732
-
\??\c:\864062.exec:\864062.exe82⤵PID:2860
-
\??\c:\hbntbh.exec:\hbntbh.exe83⤵PID:2580
-
\??\c:\vjvvj.exec:\vjvvj.exe84⤵PID:2708
-
\??\c:\64802.exec:\64802.exe85⤵PID:3028
-
\??\c:\0286000.exec:\0286000.exe86⤵PID:2444
-
\??\c:\0462480.exec:\0462480.exe87⤵PID:2512
-
\??\c:\5nhbbb.exec:\5nhbbb.exe88⤵PID:2520
-
\??\c:\vvjjp.exec:\vvjjp.exe89⤵PID:2964
-
\??\c:\20222.exec:\20222.exe90⤵PID:2536
-
\??\c:\864406.exec:\864406.exe91⤵PID:2928
-
\??\c:\7nhtbh.exec:\7nhtbh.exe92⤵PID:2916
-
\??\c:\llflrxf.exec:\llflrxf.exe93⤵PID:2756
-
\??\c:\jddjj.exec:\jddjj.exe94⤵PID:2388
-
\??\c:\6840000.exec:\6840000.exe95⤵PID:1640
-
\??\c:\w24004.exec:\w24004.exe96⤵PID:2772
-
\??\c:\9xlrrlr.exec:\9xlrrlr.exe97⤵PID:2764
-
\??\c:\thtttt.exec:\thtttt.exe98⤵PID:2804
-
\??\c:\i626266.exec:\i626266.exe99⤵PID:1936
-
\??\c:\nhbtbb.exec:\nhbtbb.exe100⤵PID:288
-
\??\c:\w24062.exec:\w24062.exe101⤵PID:2272
-
\??\c:\1nbhhn.exec:\1nbhhn.exe102⤵PID:2052
-
\??\c:\llflxxf.exec:\llflxxf.exe103⤵PID:904
-
\??\c:\48624.exec:\48624.exe104⤵PID:1612
-
\??\c:\20666.exec:\20666.exe105⤵PID:1464
-
\??\c:\48624.exec:\48624.exe106⤵PID:1532
-
\??\c:\4866846.exec:\4866846.exe107⤵PID:2840
-
\??\c:\086288.exec:\086288.exe108⤵PID:2284
-
\??\c:\rfrlllr.exec:\rfrlllr.exe109⤵PID:2308
-
\??\c:\a0666.exec:\a0666.exe110⤵PID:1940
-
\??\c:\lfxrxlr.exec:\lfxrxlr.exe111⤵PID:1516
-
\??\c:\thnnhn.exec:\thnnhn.exe112⤵PID:2872
-
\??\c:\68068.exec:\68068.exe113⤵PID:656
-
\??\c:\20228.exec:\20228.exe114⤵PID:1272
-
\??\c:\rlfxlll.exec:\rlfxlll.exe115⤵PID:3048
-
\??\c:\024460.exec:\024460.exe116⤵PID:2040
-
\??\c:\jdppv.exec:\jdppv.exe117⤵PID:1752
-
\??\c:\0288828.exec:\0288828.exe118⤵PID:2236
-
\??\c:\rrxxfxf.exec:\rrxxfxf.exe119⤵PID:1576
-
\??\c:\hhtttn.exec:\hhtttn.exe120⤵PID:2168
-
\??\c:\5xffllx.exec:\5xffllx.exe121⤵PID:2636
-
\??\c:\1frrrrr.exec:\1frrrrr.exe122⤵PID:2540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-