Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 01:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
73c91b6ad96ba89d3cec053c74a3eb20_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
73c91b6ad96ba89d3cec053c74a3eb20_NeikiAnalytics.exe
-
Size
56KB
-
MD5
73c91b6ad96ba89d3cec053c74a3eb20
-
SHA1
61223e2901d8f06be29b5afa4aba3b46f2ce2e23
-
SHA256
f5b48a39b32c914af616b0e10bd4c1d8495577c096598257fdca316d157027cb
-
SHA512
8a1c0e43ef114058f9cf017172658ad6d475f402aa1ea7bd1362a211e05cbca7978e6c9afbce3c098b88765e896ffc0ea7f9e33ddab02d644c21312ce0df3db4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chVh:ymb3NkkiQ3mdBjF0crh
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2868-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-72-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1356-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/796-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/668-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1212-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-366-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1556 pvjpv.exe 3008 264200.exe 2604 5nbbnh.exe 2504 hbhbnn.exe 2676 4240668.exe 2536 jjvjv.exe 2368 5bnnbb.exe 2916 vpvvj.exe 2268 fllflxx.exe 2696 3tnbnt.exe 2740 tbbbbh.exe 1356 264644.exe 796 vjdjd.exe 2128 btthnn.exe 2628 64664.exe 668 2062468.exe 2292 fxxxfxl.exe 1344 ddvdv.exe 2324 4206602.exe 1416 602806.exe 2012 hbttbb.exe 1212 e46688.exe 836 lrrlrrf.exe 1468 nhnntb.exe 3000 7hbtnn.exe 2800 i206284.exe 2452 lrffllx.exe 1896 rlfflrx.exe 1716 3bhbth.exe 2692 nbbthh.exe 2872 04840.exe 2284 vpvdj.exe 2796 3jddp.exe 1652 xxrxrxl.exe 2576 nbnntt.exe 2476 fxflxrl.exe 1892 9nntbb.exe 2976 pdjdd.exe 2484 bbntbb.exe 2536 nhbhnn.exe 2508 fxllxff.exe 2384 6846628.exe 2472 5fxfrrf.exe 2748 bthhnt.exe 2724 7vpvd.exe 2440 fxllxfr.exe 760 pjvvd.exe 332 hthbbb.exe 1664 rflfrrx.exe 2360 vpddj.exe 2548 rlfxxxr.exe 2628 06262.exe 668 864064.exe 840 864488.exe 1692 ppvvp.exe 2936 rfrfrrl.exe 2956 bnbbbb.exe 2076 206682.exe 2244 9tbtnt.exe 1620 o844446.exe 584 8240282.exe 1156 nhbbnn.exe 1280 s0284.exe 2000 rlffrll.exe -
resource yara_rule behavioral1/memory/2868-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3008-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1356-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/796-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/668-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1212-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-366-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2868 wrote to memory of 1556 2868 73c91b6ad96ba89d3cec053c74a3eb20_NeikiAnalytics.exe 28 PID 2868 wrote to memory of 1556 2868 73c91b6ad96ba89d3cec053c74a3eb20_NeikiAnalytics.exe 28 PID 2868 wrote to memory of 1556 2868 73c91b6ad96ba89d3cec053c74a3eb20_NeikiAnalytics.exe 28 PID 2868 wrote to memory of 1556 2868 73c91b6ad96ba89d3cec053c74a3eb20_NeikiAnalytics.exe 28 PID 1556 wrote to memory of 3008 1556 pvjpv.exe 29 PID 1556 wrote to memory of 3008 1556 pvjpv.exe 29 PID 1556 wrote to memory of 3008 1556 pvjpv.exe 29 PID 1556 wrote to memory of 3008 1556 pvjpv.exe 29 PID 3008 wrote to memory of 2604 3008 264200.exe 30 PID 3008 wrote to memory of 2604 3008 264200.exe 30 PID 3008 wrote to memory of 2604 3008 264200.exe 30 PID 3008 wrote to memory of 2604 3008 264200.exe 30 PID 2604 wrote to memory of 2504 2604 5nbbnh.exe 31 PID 2604 wrote to memory of 2504 2604 5nbbnh.exe 31 PID 2604 wrote to memory of 2504 2604 5nbbnh.exe 31 PID 2604 wrote to memory of 2504 2604 5nbbnh.exe 31 PID 2504 wrote to memory of 2676 2504 hbhbnn.exe 32 PID 2504 wrote to memory of 2676 2504 hbhbnn.exe 32 PID 2504 wrote to memory of 2676 2504 hbhbnn.exe 32 PID 2504 wrote to memory of 2676 2504 hbhbnn.exe 32 PID 2676 wrote to memory of 2536 2676 4240668.exe 33 PID 2676 wrote to memory of 2536 2676 4240668.exe 33 PID 2676 wrote to memory of 2536 2676 4240668.exe 33 PID 2676 wrote to memory of 2536 2676 4240668.exe 33 PID 2536 wrote to memory of 2368 2536 jjvjv.exe 34 PID 2536 wrote to memory of 2368 2536 jjvjv.exe 34 PID 2536 wrote to memory of 2368 2536 jjvjv.exe 34 PID 2536 wrote to memory of 2368 2536 jjvjv.exe 34 PID 2368 wrote to memory of 2916 2368 5bnnbb.exe 35 PID 2368 wrote to memory of 2916 2368 5bnnbb.exe 35 PID 2368 wrote to memory of 2916 2368 5bnnbb.exe 35 PID 2368 wrote to memory of 2916 2368 5bnnbb.exe 35 PID 2916 wrote to memory of 2268 2916 vpvvj.exe 36 PID 2916 wrote to memory of 2268 2916 vpvvj.exe 36 PID 2916 wrote to memory of 2268 2916 vpvvj.exe 36 PID 2916 wrote to memory of 2268 2916 vpvvj.exe 36 PID 2268 wrote to memory of 2696 2268 fllflxx.exe 37 PID 2268 wrote to memory of 2696 2268 fllflxx.exe 37 PID 2268 wrote to memory of 2696 2268 fllflxx.exe 37 PID 2268 wrote to memory of 2696 2268 fllflxx.exe 37 PID 2696 wrote to memory of 2740 2696 3tnbnt.exe 38 PID 2696 wrote to memory of 2740 2696 3tnbnt.exe 38 PID 2696 wrote to memory of 2740 2696 3tnbnt.exe 38 PID 2696 wrote to memory of 2740 2696 3tnbnt.exe 38 PID 2740 wrote to memory of 1356 2740 tbbbbh.exe 39 PID 2740 wrote to memory of 1356 2740 tbbbbh.exe 39 PID 2740 wrote to memory of 1356 2740 tbbbbh.exe 39 PID 2740 wrote to memory of 1356 2740 tbbbbh.exe 39 PID 1356 wrote to memory of 796 1356 264644.exe 40 PID 1356 wrote to memory of 796 1356 264644.exe 40 PID 1356 wrote to memory of 796 1356 264644.exe 40 PID 1356 wrote to memory of 796 1356 264644.exe 40 PID 796 wrote to memory of 2128 796 vjdjd.exe 41 PID 796 wrote to memory of 2128 796 vjdjd.exe 41 PID 796 wrote to memory of 2128 796 vjdjd.exe 41 PID 796 wrote to memory of 2128 796 vjdjd.exe 41 PID 2128 wrote to memory of 2628 2128 btthnn.exe 42 PID 2128 wrote to memory of 2628 2128 btthnn.exe 42 PID 2128 wrote to memory of 2628 2128 btthnn.exe 42 PID 2128 wrote to memory of 2628 2128 btthnn.exe 42 PID 2628 wrote to memory of 668 2628 64664.exe 43 PID 2628 wrote to memory of 668 2628 64664.exe 43 PID 2628 wrote to memory of 668 2628 64664.exe 43 PID 2628 wrote to memory of 668 2628 64664.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\73c91b6ad96ba89d3cec053c74a3eb20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\73c91b6ad96ba89d3cec053c74a3eb20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\pvjpv.exec:\pvjpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\264200.exec:\264200.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\5nbbnh.exec:\5nbbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\hbhbnn.exec:\hbhbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\4240668.exec:\4240668.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\jjvjv.exec:\jjvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\5bnnbb.exec:\5bnnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\vpvvj.exec:\vpvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\fllflxx.exec:\fllflxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\3tnbnt.exec:\3tnbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\tbbbbh.exec:\tbbbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\264644.exec:\264644.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\vjdjd.exec:\vjdjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\btthnn.exec:\btthnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\64664.exec:\64664.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\2062468.exec:\2062468.exe17⤵
- Executes dropped EXE
PID:668 -
\??\c:\fxxxfxl.exec:\fxxxfxl.exe18⤵
- Executes dropped EXE
PID:2292 -
\??\c:\ddvdv.exec:\ddvdv.exe19⤵
- Executes dropped EXE
PID:1344 -
\??\c:\4206602.exec:\4206602.exe20⤵
- Executes dropped EXE
PID:2324 -
\??\c:\602806.exec:\602806.exe21⤵
- Executes dropped EXE
PID:1416 -
\??\c:\hbttbb.exec:\hbttbb.exe22⤵
- Executes dropped EXE
PID:2012 -
\??\c:\e46688.exec:\e46688.exe23⤵
- Executes dropped EXE
PID:1212 -
\??\c:\lrrlrrf.exec:\lrrlrrf.exe24⤵
- Executes dropped EXE
PID:836 -
\??\c:\nhnntb.exec:\nhnntb.exe25⤵
- Executes dropped EXE
PID:1468 -
\??\c:\7hbtnn.exec:\7hbtnn.exe26⤵
- Executes dropped EXE
PID:3000 -
\??\c:\i206284.exec:\i206284.exe27⤵
- Executes dropped EXE
PID:2800 -
\??\c:\lrffllx.exec:\lrffllx.exe28⤵
- Executes dropped EXE
PID:2452 -
\??\c:\rlfflrx.exec:\rlfflrx.exe29⤵
- Executes dropped EXE
PID:1896 -
\??\c:\3bhbth.exec:\3bhbth.exe30⤵
- Executes dropped EXE
PID:1716 -
\??\c:\nbbthh.exec:\nbbthh.exe31⤵
- Executes dropped EXE
PID:2692 -
\??\c:\04840.exec:\04840.exe32⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vpvdj.exec:\vpvdj.exe33⤵
- Executes dropped EXE
PID:2284 -
\??\c:\3jddp.exec:\3jddp.exe34⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xxrxrxl.exec:\xxrxrxl.exe35⤵
- Executes dropped EXE
PID:1652 -
\??\c:\nbnntt.exec:\nbnntt.exe36⤵
- Executes dropped EXE
PID:2576 -
\??\c:\fxflxrl.exec:\fxflxrl.exe37⤵
- Executes dropped EXE
PID:2476 -
\??\c:\9nntbb.exec:\9nntbb.exe38⤵
- Executes dropped EXE
PID:1892 -
\??\c:\pdjdd.exec:\pdjdd.exe39⤵
- Executes dropped EXE
PID:2976 -
\??\c:\bbntbb.exec:\bbntbb.exe40⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nhbhnn.exec:\nhbhnn.exe41⤵
- Executes dropped EXE
PID:2536 -
\??\c:\fxllxff.exec:\fxllxff.exe42⤵
- Executes dropped EXE
PID:2508 -
\??\c:\6846628.exec:\6846628.exe43⤵
- Executes dropped EXE
PID:2384 -
\??\c:\5fxfrrf.exec:\5fxfrrf.exe44⤵
- Executes dropped EXE
PID:2472 -
\??\c:\bthhnt.exec:\bthhnt.exe45⤵
- Executes dropped EXE
PID:2748 -
\??\c:\7vpvd.exec:\7vpvd.exe46⤵
- Executes dropped EXE
PID:2724 -
\??\c:\fxllxfr.exec:\fxllxfr.exe47⤵
- Executes dropped EXE
PID:2440 -
\??\c:\pjvvd.exec:\pjvvd.exe48⤵
- Executes dropped EXE
PID:760 -
\??\c:\hthbbb.exec:\hthbbb.exe49⤵
- Executes dropped EXE
PID:332 -
\??\c:\rflfrrx.exec:\rflfrrx.exe50⤵
- Executes dropped EXE
PID:1664 -
\??\c:\vpddj.exec:\vpddj.exe51⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rlfxxxr.exec:\rlfxxxr.exe52⤵
- Executes dropped EXE
PID:2548 -
\??\c:\06262.exec:\06262.exe53⤵
- Executes dropped EXE
PID:2628 -
\??\c:\864064.exec:\864064.exe54⤵
- Executes dropped EXE
PID:668 -
\??\c:\864488.exec:\864488.exe55⤵
- Executes dropped EXE
PID:840 -
\??\c:\ppvvp.exec:\ppvvp.exe56⤵
- Executes dropped EXE
PID:1692 -
\??\c:\rfrfrrl.exec:\rfrfrrl.exe57⤵
- Executes dropped EXE
PID:2936 -
\??\c:\bnbbbb.exec:\bnbbbb.exe58⤵
- Executes dropped EXE
PID:2956 -
\??\c:\206682.exec:\206682.exe59⤵
- Executes dropped EXE
PID:2076 -
\??\c:\9tbtnt.exec:\9tbtnt.exe60⤵
- Executes dropped EXE
PID:2244 -
\??\c:\o844446.exec:\o844446.exe61⤵
- Executes dropped EXE
PID:1620 -
\??\c:\8240282.exec:\8240282.exe62⤵
- Executes dropped EXE
PID:584 -
\??\c:\nhbbnn.exec:\nhbbnn.exe63⤵
- Executes dropped EXE
PID:1156 -
\??\c:\s0284.exec:\s0284.exe64⤵
- Executes dropped EXE
PID:1280 -
\??\c:\rlffrll.exec:\rlffrll.exe65⤵
- Executes dropped EXE
PID:2000 -
\??\c:\24228.exec:\24228.exe66⤵PID:672
-
\??\c:\vjdjp.exec:\vjdjp.exe67⤵PID:1632
-
\??\c:\200026.exec:\200026.exe68⤵PID:1992
-
\??\c:\886060.exec:\886060.exe69⤵PID:2132
-
\??\c:\4806440.exec:\4806440.exe70⤵PID:1716
-
\??\c:\vjpvd.exec:\vjpvd.exe71⤵PID:2456
-
\??\c:\i640224.exec:\i640224.exe72⤵PID:1736
-
\??\c:\4846440.exec:\4846440.exe73⤵PID:2480
-
\??\c:\lflxlfr.exec:\lflxlfr.exe74⤵PID:1980
-
\??\c:\5fxxffl.exec:\5fxxffl.exe75⤵PID:2564
-
\??\c:\8206840.exec:\8206840.exe76⤵PID:1652
-
\??\c:\xlrffff.exec:\xlrffff.exe77⤵PID:2524
-
\??\c:\bthnhb.exec:\bthnhb.exe78⤵PID:2588
-
\??\c:\w48028.exec:\w48028.exe79⤵PID:1628
-
\??\c:\6022406.exec:\6022406.exe80⤵PID:2288
-
\??\c:\86446.exec:\86446.exe81⤵PID:2428
-
\??\c:\c484622.exec:\c484622.exe82⤵PID:2396
-
\??\c:\q08866.exec:\q08866.exe83⤵PID:2092
-
\??\c:\vpjpp.exec:\vpjpp.exe84⤵PID:2704
-
\??\c:\pjvdp.exec:\pjvdp.exe85⤵PID:2908
-
\??\c:\880088.exec:\880088.exe86⤵PID:2748
-
\??\c:\o244006.exec:\o244006.exe87⤵PID:2752
-
\??\c:\c462468.exec:\c462468.exe88⤵PID:296
-
\??\c:\rlflllr.exec:\rlflllr.exe89⤵PID:2120
-
\??\c:\jvpvj.exec:\jvpvj.exe90⤵PID:1876
-
\??\c:\1nnnhh.exec:\1nnnhh.exe91⤵PID:1492
-
\??\c:\0800606.exec:\0800606.exe92⤵PID:2552
-
\??\c:\48020.exec:\48020.exe93⤵PID:532
-
\??\c:\bthtnh.exec:\bthtnh.exe94⤵PID:1256
-
\??\c:\22008.exec:\22008.exe95⤵PID:1232
-
\??\c:\dvjpd.exec:\dvjpd.exe96⤵PID:852
-
\??\c:\xrxxrrx.exec:\xrxxrrx.exe97⤵PID:2952
-
\??\c:\86406.exec:\86406.exe98⤵PID:2936
-
\??\c:\62006.exec:\62006.exe99⤵PID:1888
-
\??\c:\hnnthh.exec:\hnnthh.exe100⤵PID:928
-
\??\c:\0804006.exec:\0804006.exe101⤵PID:1040
-
\??\c:\5pddd.exec:\5pddd.exe102⤵PID:1264
-
\??\c:\3frllrx.exec:\3frllrx.exe103⤵PID:1964
-
\??\c:\86846.exec:\86846.exe104⤵PID:2328
-
\??\c:\420628.exec:\420628.exe105⤵PID:3000
-
\??\c:\408288.exec:\408288.exe106⤵PID:1412
-
\??\c:\9bnnhh.exec:\9bnnhh.exe107⤵PID:772
-
\??\c:\48644.exec:\48644.exe108⤵PID:3056
-
\??\c:\a8062.exec:\a8062.exe109⤵PID:1960
-
\??\c:\5fllxxf.exec:\5fllxxf.exe110⤵PID:2340
-
\??\c:\60286.exec:\60286.exe111⤵PID:1668
-
\??\c:\4862062.exec:\4862062.exe112⤵PID:2988
-
\??\c:\42842.exec:\42842.exe113⤵PID:2028
-
\??\c:\nhnbnb.exec:\nhnbnb.exe114⤵PID:1556
-
\??\c:\246644.exec:\246644.exe115⤵PID:2580
-
\??\c:\hbbhbh.exec:\hbbhbh.exe116⤵PID:2796
-
\??\c:\3bhbnn.exec:\3bhbnn.exe117⤵PID:2464
-
\??\c:\o644228.exec:\o644228.exe118⤵PID:2524
-
\??\c:\g4068.exec:\g4068.exe119⤵PID:2476
-
\??\c:\nhbbhh.exec:\nhbbhh.exe120⤵PID:1892
-
\??\c:\4046202.exec:\4046202.exe121⤵PID:2052
-
\??\c:\5xxfrxf.exec:\5xxfrxf.exe122⤵PID:2376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-