Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 14:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b71e2a0a6110584b9c634ea86e5b9d0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
0b71e2a0a6110584b9c634ea86e5b9d0_NeikiAnalytics.exe
-
Size
83KB
-
MD5
0b71e2a0a6110584b9c634ea86e5b9d0
-
SHA1
2d7efa1693c016d3799de886f6b6a6a2d56af258
-
SHA256
a3359f519c180bb0023c79db5a1543990ba80d5759b45ce70d40fec85351d0a9
-
SHA512
851968e66dc2c3fc524e562ecb6e3ac17c5b1bfa99df81ad98a51f634ba5b408c9be9367e1b1d6f21bc55f4715a545c23815c305c85b8aa8956f586daba2cb9b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJSLCBCO+HlMO7s0yOy:ymb3NkkiQ3mdBjFIwLMoHW8y7
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2756-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1084-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1884-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2364 0224024.exe 2052 rlffrlx.exe 2548 nhbhnt.exe 2636 0800668.exe 2560 48408.exe 2852 xrxfllr.exe 2484 2202442.exe 2480 nthhhh.exe 1720 5vddj.exe 3016 6260046.exe 1712 xrllxxr.exe 2028 40080.exe 1652 8822488.exe 2800 vjdvd.exe 2788 tbnbhn.exe 2832 vpjjd.exe 2856 o446624.exe 2000 00482.exe 1740 7hnbnt.exe 1084 824622.exe 1888 4244068.exe 2220 6422402.exe 1092 640440.exe 2136 4222228.exe 1884 pjddd.exe 1612 fxxxffl.exe 2288 4206828.exe 1820 i840006.exe 2180 06062.exe 2104 fxlflfr.exe 3044 42800.exe 2024 w46240.exe 3048 5dpdd.exe 2620 djjdp.exe 1568 jjvdp.exe 2132 jjppp.exe 2660 7pdjj.exe 2876 hthnhh.exe 2636 6424464.exe 2580 7jpjp.exe 2616 vpjjd.exe 2440 m8086.exe 2516 a2442.exe 2124 bbbnbt.exe 1856 llrrflr.exe 2996 dvjjp.exe 2476 5nthbb.exe 1120 20806.exe 2784 8262880.exe 2696 btbtbb.exe 1188 tnhtbt.exe 2528 400448.exe 2968 82402.exe 2944 28440.exe 2952 e00684.exe 1284 i428484.exe 2012 rrlrfrf.exe 2420 04628.exe 2008 hbtthn.exe 2212 vpddj.exe 336 3ddpd.exe 2220 1xxlfrf.exe 2128 ddvvv.exe 1624 44286.exe -
resource yara_rule behavioral1/memory/2756-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1084-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1884-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-279-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2364 2756 0b71e2a0a6110584b9c634ea86e5b9d0_NeikiAnalytics.exe 28 PID 2756 wrote to memory of 2364 2756 0b71e2a0a6110584b9c634ea86e5b9d0_NeikiAnalytics.exe 28 PID 2756 wrote to memory of 2364 2756 0b71e2a0a6110584b9c634ea86e5b9d0_NeikiAnalytics.exe 28 PID 2756 wrote to memory of 2364 2756 0b71e2a0a6110584b9c634ea86e5b9d0_NeikiAnalytics.exe 28 PID 2364 wrote to memory of 2052 2364 0224024.exe 29 PID 2364 wrote to memory of 2052 2364 0224024.exe 29 PID 2364 wrote to memory of 2052 2364 0224024.exe 29 PID 2364 wrote to memory of 2052 2364 0224024.exe 29 PID 2052 wrote to memory of 2548 2052 rlffrlx.exe 30 PID 2052 wrote to memory of 2548 2052 rlffrlx.exe 30 PID 2052 wrote to memory of 2548 2052 rlffrlx.exe 30 PID 2052 wrote to memory of 2548 2052 rlffrlx.exe 30 PID 2548 wrote to memory of 2636 2548 nhbhnt.exe 31 PID 2548 wrote to memory of 2636 2548 nhbhnt.exe 31 PID 2548 wrote to memory of 2636 2548 nhbhnt.exe 31 PID 2548 wrote to memory of 2636 2548 nhbhnt.exe 31 PID 2636 wrote to memory of 2560 2636 0800668.exe 32 PID 2636 wrote to memory of 2560 2636 0800668.exe 32 PID 2636 wrote to memory of 2560 2636 0800668.exe 32 PID 2636 wrote to memory of 2560 2636 0800668.exe 32 PID 2560 wrote to memory of 2852 2560 48408.exe 33 PID 2560 wrote to memory of 2852 2560 48408.exe 33 PID 2560 wrote to memory of 2852 2560 48408.exe 33 PID 2560 wrote to memory of 2852 2560 48408.exe 33 PID 2852 wrote to memory of 2484 2852 xrxfllr.exe 34 PID 2852 wrote to memory of 2484 2852 xrxfllr.exe 34 PID 2852 wrote to memory of 2484 2852 xrxfllr.exe 34 PID 2852 wrote to memory of 2484 2852 xrxfllr.exe 34 PID 2484 wrote to memory of 2480 2484 2202442.exe 35 PID 2484 wrote to memory of 2480 2484 2202442.exe 35 PID 2484 wrote to memory of 2480 2484 2202442.exe 35 PID 2484 wrote to memory of 2480 2484 2202442.exe 35 PID 2480 wrote to memory of 1720 2480 nthhhh.exe 36 PID 2480 wrote to memory of 1720 2480 nthhhh.exe 36 PID 2480 wrote to memory of 1720 2480 nthhhh.exe 36 PID 2480 wrote to memory of 1720 2480 nthhhh.exe 36 PID 1720 wrote to memory of 3016 1720 5vddj.exe 37 PID 1720 wrote to memory of 3016 1720 5vddj.exe 37 PID 1720 wrote to memory of 3016 1720 5vddj.exe 37 PID 1720 wrote to memory of 3016 1720 5vddj.exe 37 PID 3016 wrote to memory of 1712 3016 6260046.exe 38 PID 3016 wrote to memory of 1712 3016 6260046.exe 38 PID 3016 wrote to memory of 1712 3016 6260046.exe 38 PID 3016 wrote to memory of 1712 3016 6260046.exe 38 PID 1712 wrote to memory of 2028 1712 xrllxxr.exe 39 PID 1712 wrote to memory of 2028 1712 xrllxxr.exe 39 PID 1712 wrote to memory of 2028 1712 xrllxxr.exe 39 PID 1712 wrote to memory of 2028 1712 xrllxxr.exe 39 PID 2028 wrote to memory of 1652 2028 40080.exe 40 PID 2028 wrote to memory of 1652 2028 40080.exe 40 PID 2028 wrote to memory of 1652 2028 40080.exe 40 PID 2028 wrote to memory of 1652 2028 40080.exe 40 PID 1652 wrote to memory of 2800 1652 8822488.exe 41 PID 1652 wrote to memory of 2800 1652 8822488.exe 41 PID 1652 wrote to memory of 2800 1652 8822488.exe 41 PID 1652 wrote to memory of 2800 1652 8822488.exe 41 PID 2800 wrote to memory of 2788 2800 vjdvd.exe 42 PID 2800 wrote to memory of 2788 2800 vjdvd.exe 42 PID 2800 wrote to memory of 2788 2800 vjdvd.exe 42 PID 2800 wrote to memory of 2788 2800 vjdvd.exe 42 PID 2788 wrote to memory of 2832 2788 tbnbhn.exe 43 PID 2788 wrote to memory of 2832 2788 tbnbhn.exe 43 PID 2788 wrote to memory of 2832 2788 tbnbhn.exe 43 PID 2788 wrote to memory of 2832 2788 tbnbhn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b71e2a0a6110584b9c634ea86e5b9d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0b71e2a0a6110584b9c634ea86e5b9d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\0224024.exec:\0224024.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\rlffrlx.exec:\rlffrlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\nhbhnt.exec:\nhbhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\0800668.exec:\0800668.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\48408.exec:\48408.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\xrxfllr.exec:\xrxfllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\2202442.exec:\2202442.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\nthhhh.exec:\nthhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\5vddj.exec:\5vddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\6260046.exec:\6260046.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\xrllxxr.exec:\xrllxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\40080.exec:\40080.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\8822488.exec:\8822488.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\vjdvd.exec:\vjdvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\tbnbhn.exec:\tbnbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\vpjjd.exec:\vpjjd.exe17⤵
- Executes dropped EXE
PID:2832 -
\??\c:\o446624.exec:\o446624.exe18⤵
- Executes dropped EXE
PID:2856 -
\??\c:\00482.exec:\00482.exe19⤵
- Executes dropped EXE
PID:2000 -
\??\c:\7hnbnt.exec:\7hnbnt.exe20⤵
- Executes dropped EXE
PID:1740 -
\??\c:\824622.exec:\824622.exe21⤵
- Executes dropped EXE
PID:1084 -
\??\c:\4244068.exec:\4244068.exe22⤵
- Executes dropped EXE
PID:1888 -
\??\c:\6422402.exec:\6422402.exe23⤵
- Executes dropped EXE
PID:2220 -
\??\c:\640440.exec:\640440.exe24⤵
- Executes dropped EXE
PID:1092 -
\??\c:\4222228.exec:\4222228.exe25⤵
- Executes dropped EXE
PID:2136 -
\??\c:\pjddd.exec:\pjddd.exe26⤵
- Executes dropped EXE
PID:1884 -
\??\c:\fxxxffl.exec:\fxxxffl.exe27⤵
- Executes dropped EXE
PID:1612 -
\??\c:\4206828.exec:\4206828.exe28⤵
- Executes dropped EXE
PID:2288 -
\??\c:\i840006.exec:\i840006.exe29⤵
- Executes dropped EXE
PID:1820 -
\??\c:\06062.exec:\06062.exe30⤵
- Executes dropped EXE
PID:2180 -
\??\c:\fxlflfr.exec:\fxlflfr.exe31⤵
- Executes dropped EXE
PID:2104 -
\??\c:\42800.exec:\42800.exe32⤵
- Executes dropped EXE
PID:3044 -
\??\c:\w46240.exec:\w46240.exe33⤵
- Executes dropped EXE
PID:2024 -
\??\c:\5dpdd.exec:\5dpdd.exe34⤵
- Executes dropped EXE
PID:3048 -
\??\c:\djjdp.exec:\djjdp.exe35⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jjvdp.exec:\jjvdp.exe36⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jjppp.exec:\jjppp.exe37⤵
- Executes dropped EXE
PID:2132 -
\??\c:\7pdjj.exec:\7pdjj.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hthnhh.exec:\hthnhh.exe39⤵
- Executes dropped EXE
PID:2876 -
\??\c:\6424464.exec:\6424464.exe40⤵
- Executes dropped EXE
PID:2636 -
\??\c:\7jpjp.exec:\7jpjp.exe41⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vpjjd.exec:\vpjjd.exe42⤵
- Executes dropped EXE
PID:2616 -
\??\c:\m8086.exec:\m8086.exe43⤵
- Executes dropped EXE
PID:2440 -
\??\c:\a2442.exec:\a2442.exe44⤵
- Executes dropped EXE
PID:2516 -
\??\c:\bbbnbt.exec:\bbbnbt.exe45⤵
- Executes dropped EXE
PID:2124 -
\??\c:\llrrflr.exec:\llrrflr.exe46⤵
- Executes dropped EXE
PID:1856 -
\??\c:\dvjjp.exec:\dvjjp.exe47⤵
- Executes dropped EXE
PID:2996 -
\??\c:\5nthbb.exec:\5nthbb.exe48⤵
- Executes dropped EXE
PID:2476 -
\??\c:\20806.exec:\20806.exe49⤵
- Executes dropped EXE
PID:1120 -
\??\c:\8262880.exec:\8262880.exe50⤵
- Executes dropped EXE
PID:2784 -
\??\c:\btbtbb.exec:\btbtbb.exe51⤵
- Executes dropped EXE
PID:2696 -
\??\c:\tnhtbt.exec:\tnhtbt.exe52⤵
- Executes dropped EXE
PID:1188 -
\??\c:\400448.exec:\400448.exe53⤵
- Executes dropped EXE
PID:2528 -
\??\c:\82402.exec:\82402.exe54⤵
- Executes dropped EXE
PID:2968 -
\??\c:\28440.exec:\28440.exe55⤵
- Executes dropped EXE
PID:2944 -
\??\c:\e00684.exec:\e00684.exe56⤵
- Executes dropped EXE
PID:2952 -
\??\c:\i428484.exec:\i428484.exe57⤵
- Executes dropped EXE
PID:1284 -
\??\c:\rrlrfrf.exec:\rrlrfrf.exe58⤵
- Executes dropped EXE
PID:2012 -
\??\c:\04628.exec:\04628.exe59⤵
- Executes dropped EXE
PID:2420 -
\??\c:\hbtthn.exec:\hbtthn.exe60⤵
- Executes dropped EXE
PID:2008 -
\??\c:\vpddj.exec:\vpddj.exe61⤵
- Executes dropped EXE
PID:2212 -
\??\c:\3ddpd.exec:\3ddpd.exe62⤵
- Executes dropped EXE
PID:336 -
\??\c:\1xxlfrf.exec:\1xxlfrf.exe63⤵
- Executes dropped EXE
PID:2220 -
\??\c:\ddvvv.exec:\ddvvv.exe64⤵
- Executes dropped EXE
PID:2128 -
\??\c:\44286.exec:\44286.exe65⤵
- Executes dropped EXE
PID:1624 -
\??\c:\i646268.exec:\i646268.exe66⤵PID:1532
-
\??\c:\424404.exec:\424404.exe67⤵PID:1892
-
\??\c:\tttbth.exec:\tttbth.exe68⤵PID:1336
-
\??\c:\rlllrrl.exec:\rlllrrl.exe69⤵PID:1376
-
\??\c:\7dpvp.exec:\7dpvp.exe70⤵PID:2340
-
\??\c:\86440.exec:\86440.exe71⤵PID:2224
-
\??\c:\820622.exec:\820622.exe72⤵PID:564
-
\??\c:\vpdvd.exec:\vpdvd.exe73⤵PID:872
-
\??\c:\0488008.exec:\0488008.exe74⤵PID:2336
-
\??\c:\s8668.exec:\s8668.exe75⤵PID:2020
-
\??\c:\8202846.exec:\8202846.exe76⤵PID:792
-
\??\c:\0668240.exec:\0668240.exe77⤵PID:2584
-
\??\c:\6084668.exec:\6084668.exe78⤵PID:3024
-
\??\c:\fxxxffr.exec:\fxxxffr.exe79⤵PID:2652
-
\??\c:\0466880.exec:\0466880.exe80⤵PID:2668
-
\??\c:\e42244.exec:\e42244.exe81⤵PID:2596
-
\??\c:\rxrxfrl.exec:\rxrxfrl.exe82⤵PID:3056
-
\??\c:\vpjpj.exec:\vpjpj.exe83⤵PID:2612
-
\??\c:\tnhhnt.exec:\tnhhnt.exe84⤵PID:2436
-
\??\c:\xxrfflf.exec:\xxrfflf.exe85⤵PID:1948
-
\??\c:\60280.exec:\60280.exe86⤵PID:2324
-
\??\c:\262888.exec:\262888.exe87⤵PID:1520
-
\??\c:\042844.exec:\042844.exe88⤵PID:2988
-
\??\c:\dpddj.exec:\dpddj.exe89⤵PID:2004
-
\??\c:\q86626.exec:\q86626.exe90⤵PID:2948
-
\??\c:\jjddv.exec:\jjddv.exe91⤵PID:2812
-
\??\c:\1bnhhh.exec:\1bnhhh.exe92⤵PID:1620
-
\??\c:\hbnnbb.exec:\hbnnbb.exe93⤵PID:2684
-
\??\c:\m4622.exec:\m4622.exe94⤵PID:2804
-
\??\c:\rlxxlrf.exec:\rlxxlrf.exe95⤵PID:2992
-
\??\c:\428066.exec:\428066.exe96⤵PID:2960
-
\??\c:\vvdvj.exec:\vvdvj.exe97⤵PID:856
-
\??\c:\82002.exec:\82002.exe98⤵PID:1288
-
\??\c:\20662.exec:\20662.exe99⤵PID:2000
-
\??\c:\1llfxfl.exec:\1llfxfl.exe100⤵PID:1804
-
\??\c:\hbhhnt.exec:\hbhhnt.exe101⤵PID:1936
-
\??\c:\rllxfxl.exec:\rllxfxl.exe102⤵PID:308
-
\??\c:\vjppj.exec:\vjppj.exe103⤵PID:672
-
\??\c:\thnnnn.exec:\thnnnn.exe104⤵PID:2536
-
\??\c:\jvjvj.exec:\jvjvj.exe105⤵PID:1684
-
\??\c:\2080668.exec:\2080668.exe106⤵PID:1736
-
\??\c:\a2440.exec:\a2440.exe107⤵PID:1860
-
\??\c:\42840.exec:\42840.exe108⤵PID:1612
-
\??\c:\6262620.exec:\6262620.exe109⤵PID:764
-
\??\c:\q86622.exec:\q86622.exe110⤵PID:2372
-
\??\c:\pdjpp.exec:\pdjpp.exe111⤵PID:1404
-
\??\c:\vjppp.exec:\vjppp.exe112⤵PID:828
-
\??\c:\thtnnh.exec:\thtnnh.exe113⤵PID:1492
-
\??\c:\g2282.exec:\g2282.exe114⤵PID:1632
-
\??\c:\a0406.exec:\a0406.exe115⤵PID:1764
-
\??\c:\60804.exec:\60804.exe116⤵PID:1636
-
\??\c:\42440.exec:\42440.exe117⤵PID:2360
-
\??\c:\4200688.exec:\4200688.exe118⤵PID:2860
-
\??\c:\600842.exec:\600842.exe119⤵PID:1592
-
\??\c:\6848488.exec:\6848488.exe120⤵PID:2640
-
\??\c:\60840.exec:\60840.exe121⤵PID:2592
-
\??\c:\2044608.exec:\2044608.exe122⤵PID:2604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-