Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 13:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a51478a253606bfc805b40f17fb5dc30_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
a51478a253606bfc805b40f17fb5dc30_NeikiAnalytics.exe
-
Size
116KB
-
MD5
a51478a253606bfc805b40f17fb5dc30
-
SHA1
cf77c9027979b4fc4ca34e5967d833212bdd1491
-
SHA256
a91a69f7a43cdb18d829a5a1d0559712052c93bde345bdffd5de8dacfdbd569e
-
SHA512
c6a89e0f828cd8b94e2c895ea69b6d9f8d9ae8a4cea188adf149e373ce29d3cb3233069cc874395845f9ac7839d27dc7aec1bf2884f5409e14d663d1eaba8097
-
SSDEEP
3072:ymb3NkkiQ3mdBjFosxXGPXbXQMFHLgDWSmjlkFn:n3C9BRosxW8MFHLMWvlO
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral2/memory/2136-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2020-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/928-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 100 18w66iv.exe 1120 v2e87u5.exe 2372 b192e.exe 4988 1v69k.exe 752 cgl9a7.exe 2020 gk7ucg3.exe 3872 v6i92.exe 3448 k99799p.exe 372 xrv637.exe 3620 li3s307.exe 928 71p7a.exe 2260 820u719.exe 2276 4agfn.exe 1796 m2a5qh.exe 1056 790r5gv.exe 4048 w3clm2.exe 2228 q0u4bi.exe 404 svg08m.exe 4016 2hhf45.exe 2436 v418r0f.exe 2296 fmmeisk.exe 1700 b9k926o.exe 4112 x9d6u5.exe 1976 gg694q8.exe 4584 2080x0u.exe 4416 no95p37.exe 4436 3c7r8m1.exe 4324 g77mk4.exe 2360 d0ses.exe 3768 781n4.exe 2152 fc46g7.exe 732 50vn8tc.exe 888 3f578.exe 3968 0wuvqi.exe 1768 ot8ehos.exe 2780 70957.exe 3724 r9q8oc.exe 5004 davp3q7.exe 4984 der79.exe 4400 tk1h3.exe 4232 r53pg3w.exe 3096 rsj0n.exe 1772 pu486.exe 620 0469ewc.exe 2920 cxurjq.exe 5024 o8hdr.exe 4852 q694c9.exe 764 gt8r7.exe 3952 bb67u.exe 3536 dciapri.exe 1056 9xisbu.exe 3696 54mg6.exe 4460 i38ff7.exe 5104 1r1p4.exe 3592 b7d0aj.exe 1888 s77ox1.exe 2472 87fhoov.exe 2332 v6j157.exe 2296 459nxp3.exe 4256 kspureu.exe 3648 a15q2.exe 2696 tm4l1.exe 1536 1589p.exe 1972 rvm95.exe -
resource yara_rule behavioral2/memory/2136-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2020-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2020-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/928-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2136 wrote to memory of 100 2136 a51478a253606bfc805b40f17fb5dc30_NeikiAnalytics.exe 91 PID 2136 wrote to memory of 100 2136 a51478a253606bfc805b40f17fb5dc30_NeikiAnalytics.exe 91 PID 2136 wrote to memory of 100 2136 a51478a253606bfc805b40f17fb5dc30_NeikiAnalytics.exe 91 PID 100 wrote to memory of 1120 100 18w66iv.exe 92 PID 100 wrote to memory of 1120 100 18w66iv.exe 92 PID 100 wrote to memory of 1120 100 18w66iv.exe 92 PID 1120 wrote to memory of 2372 1120 v2e87u5.exe 93 PID 1120 wrote to memory of 2372 1120 v2e87u5.exe 93 PID 1120 wrote to memory of 2372 1120 v2e87u5.exe 93 PID 2372 wrote to memory of 4988 2372 b192e.exe 94 PID 2372 wrote to memory of 4988 2372 b192e.exe 94 PID 2372 wrote to memory of 4988 2372 b192e.exe 94 PID 4988 wrote to memory of 752 4988 1v69k.exe 95 PID 4988 wrote to memory of 752 4988 1v69k.exe 95 PID 4988 wrote to memory of 752 4988 1v69k.exe 95 PID 752 wrote to memory of 2020 752 cgl9a7.exe 96 PID 752 wrote to memory of 2020 752 cgl9a7.exe 96 PID 752 wrote to memory of 2020 752 cgl9a7.exe 96 PID 2020 wrote to memory of 3872 2020 gk7ucg3.exe 97 PID 2020 wrote to memory of 3872 2020 gk7ucg3.exe 97 PID 2020 wrote to memory of 3872 2020 gk7ucg3.exe 97 PID 3872 wrote to memory of 3448 3872 v6i92.exe 98 PID 3872 wrote to memory of 3448 3872 v6i92.exe 98 PID 3872 wrote to memory of 3448 3872 v6i92.exe 98 PID 3448 wrote to memory of 372 3448 k99799p.exe 99 PID 3448 wrote to memory of 372 3448 k99799p.exe 99 PID 3448 wrote to memory of 372 3448 k99799p.exe 99 PID 372 wrote to memory of 3620 372 xrv637.exe 100 PID 372 wrote to memory of 3620 372 xrv637.exe 100 PID 372 wrote to memory of 3620 372 xrv637.exe 100 PID 3620 wrote to memory of 928 3620 li3s307.exe 101 PID 3620 wrote to memory of 928 3620 li3s307.exe 101 PID 3620 wrote to memory of 928 3620 li3s307.exe 101 PID 928 wrote to memory of 2260 928 71p7a.exe 102 PID 928 wrote to memory of 2260 928 71p7a.exe 102 PID 928 wrote to memory of 2260 928 71p7a.exe 102 PID 2260 wrote to memory of 2276 2260 820u719.exe 103 PID 2260 wrote to memory of 2276 2260 820u719.exe 103 PID 2260 wrote to memory of 2276 2260 820u719.exe 103 PID 2276 wrote to memory of 1796 2276 4agfn.exe 104 PID 2276 wrote to memory of 1796 2276 4agfn.exe 104 PID 2276 wrote to memory of 1796 2276 4agfn.exe 104 PID 1796 wrote to memory of 1056 1796 m2a5qh.exe 105 PID 1796 wrote to memory of 1056 1796 m2a5qh.exe 105 PID 1796 wrote to memory of 1056 1796 m2a5qh.exe 105 PID 1056 wrote to memory of 4048 1056 790r5gv.exe 106 PID 1056 wrote to memory of 4048 1056 790r5gv.exe 106 PID 1056 wrote to memory of 4048 1056 790r5gv.exe 106 PID 4048 wrote to memory of 2228 4048 w3clm2.exe 107 PID 4048 wrote to memory of 2228 4048 w3clm2.exe 107 PID 4048 wrote to memory of 2228 4048 w3clm2.exe 107 PID 2228 wrote to memory of 404 2228 q0u4bi.exe 108 PID 2228 wrote to memory of 404 2228 q0u4bi.exe 108 PID 2228 wrote to memory of 404 2228 q0u4bi.exe 108 PID 404 wrote to memory of 4016 404 svg08m.exe 109 PID 404 wrote to memory of 4016 404 svg08m.exe 109 PID 404 wrote to memory of 4016 404 svg08m.exe 109 PID 4016 wrote to memory of 2436 4016 2hhf45.exe 110 PID 4016 wrote to memory of 2436 4016 2hhf45.exe 110 PID 4016 wrote to memory of 2436 4016 2hhf45.exe 110 PID 2436 wrote to memory of 2296 2436 v418r0f.exe 111 PID 2436 wrote to memory of 2296 2436 v418r0f.exe 111 PID 2436 wrote to memory of 2296 2436 v418r0f.exe 111 PID 2296 wrote to memory of 1700 2296 fmmeisk.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\a51478a253606bfc805b40f17fb5dc30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a51478a253606bfc805b40f17fb5dc30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\18w66iv.exec:\18w66iv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\v2e87u5.exec:\v2e87u5.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\b192e.exec:\b192e.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\1v69k.exec:\1v69k.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\cgl9a7.exec:\cgl9a7.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\gk7ucg3.exec:\gk7ucg3.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\v6i92.exec:\v6i92.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\k99799p.exec:\k99799p.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\xrv637.exec:\xrv637.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\li3s307.exec:\li3s307.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\71p7a.exec:\71p7a.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\820u719.exec:\820u719.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\4agfn.exec:\4agfn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\m2a5qh.exec:\m2a5qh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\790r5gv.exec:\790r5gv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\w3clm2.exec:\w3clm2.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\q0u4bi.exec:\q0u4bi.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\svg08m.exec:\svg08m.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\2hhf45.exec:\2hhf45.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\v418r0f.exec:\v418r0f.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\fmmeisk.exec:\fmmeisk.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\b9k926o.exec:\b9k926o.exe23⤵
- Executes dropped EXE
PID:1700 -
\??\c:\x9d6u5.exec:\x9d6u5.exe24⤵
- Executes dropped EXE
PID:4112 -
\??\c:\gg694q8.exec:\gg694q8.exe25⤵
- Executes dropped EXE
PID:1976 -
\??\c:\2080x0u.exec:\2080x0u.exe26⤵
- Executes dropped EXE
PID:4584 -
\??\c:\no95p37.exec:\no95p37.exe27⤵
- Executes dropped EXE
PID:4416 -
\??\c:\3c7r8m1.exec:\3c7r8m1.exe28⤵
- Executes dropped EXE
PID:4436 -
\??\c:\g77mk4.exec:\g77mk4.exe29⤵
- Executes dropped EXE
PID:4324 -
\??\c:\d0ses.exec:\d0ses.exe30⤵
- Executes dropped EXE
PID:2360 -
\??\c:\781n4.exec:\781n4.exe31⤵
- Executes dropped EXE
PID:3768 -
\??\c:\fc46g7.exec:\fc46g7.exe32⤵
- Executes dropped EXE
PID:2152 -
\??\c:\50vn8tc.exec:\50vn8tc.exe33⤵
- Executes dropped EXE
PID:732 -
\??\c:\3f578.exec:\3f578.exe34⤵
- Executes dropped EXE
PID:888 -
\??\c:\0wuvqi.exec:\0wuvqi.exe35⤵
- Executes dropped EXE
PID:3968 -
\??\c:\ot8ehos.exec:\ot8ehos.exe36⤵
- Executes dropped EXE
PID:1768 -
\??\c:\70957.exec:\70957.exe37⤵
- Executes dropped EXE
PID:2780 -
\??\c:\r9q8oc.exec:\r9q8oc.exe38⤵
- Executes dropped EXE
PID:3724 -
\??\c:\davp3q7.exec:\davp3q7.exe39⤵
- Executes dropped EXE
PID:5004 -
\??\c:\der79.exec:\der79.exe40⤵
- Executes dropped EXE
PID:4984 -
\??\c:\tk1h3.exec:\tk1h3.exe41⤵
- Executes dropped EXE
PID:4400 -
\??\c:\r53pg3w.exec:\r53pg3w.exe42⤵
- Executes dropped EXE
PID:4232 -
\??\c:\rsj0n.exec:\rsj0n.exe43⤵
- Executes dropped EXE
PID:3096 -
\??\c:\pu486.exec:\pu486.exe44⤵
- Executes dropped EXE
PID:1772 -
\??\c:\0469ewc.exec:\0469ewc.exe45⤵
- Executes dropped EXE
PID:620 -
\??\c:\cxurjq.exec:\cxurjq.exe46⤵
- Executes dropped EXE
PID:2920 -
\??\c:\o8hdr.exec:\o8hdr.exe47⤵
- Executes dropped EXE
PID:5024 -
\??\c:\q694c9.exec:\q694c9.exe48⤵
- Executes dropped EXE
PID:4852 -
\??\c:\gt8r7.exec:\gt8r7.exe49⤵
- Executes dropped EXE
PID:764 -
\??\c:\bb67u.exec:\bb67u.exe50⤵
- Executes dropped EXE
PID:3952 -
\??\c:\dciapri.exec:\dciapri.exe51⤵
- Executes dropped EXE
PID:3536 -
\??\c:\9xisbu.exec:\9xisbu.exe52⤵
- Executes dropped EXE
PID:1056 -
\??\c:\54mg6.exec:\54mg6.exe53⤵
- Executes dropped EXE
PID:3696 -
\??\c:\i38ff7.exec:\i38ff7.exe54⤵
- Executes dropped EXE
PID:4460 -
\??\c:\1r1p4.exec:\1r1p4.exe55⤵
- Executes dropped EXE
PID:5104 -
\??\c:\b7d0aj.exec:\b7d0aj.exe56⤵
- Executes dropped EXE
PID:3592 -
\??\c:\s77ox1.exec:\s77ox1.exe57⤵
- Executes dropped EXE
PID:1888 -
\??\c:\87fhoov.exec:\87fhoov.exe58⤵
- Executes dropped EXE
PID:2472 -
\??\c:\v6j157.exec:\v6j157.exe59⤵
- Executes dropped EXE
PID:2332 -
\??\c:\459nxp3.exec:\459nxp3.exe60⤵
- Executes dropped EXE
PID:2296 -
\??\c:\kspureu.exec:\kspureu.exe61⤵
- Executes dropped EXE
PID:4256 -
\??\c:\a15q2.exec:\a15q2.exe62⤵
- Executes dropped EXE
PID:3648 -
\??\c:\tm4l1.exec:\tm4l1.exe63⤵
- Executes dropped EXE
PID:2696 -
\??\c:\1589p.exec:\1589p.exe64⤵
- Executes dropped EXE
PID:1536 -
\??\c:\rvm95.exec:\rvm95.exe65⤵
- Executes dropped EXE
PID:1972 -
\??\c:\wt7r53g.exec:\wt7r53g.exe66⤵PID:456
-
\??\c:\qi9ug.exec:\qi9ug.exe67⤵PID:4320
-
\??\c:\2du974.exec:\2du974.exe68⤵PID:4536
-
\??\c:\sa935vd.exec:\sa935vd.exe69⤵PID:3272
-
\??\c:\6533rro.exec:\6533rro.exe70⤵PID:4904
-
\??\c:\4r5mtt7.exec:\4r5mtt7.exe71⤵PID:2728
-
\??\c:\da8q1m.exec:\da8q1m.exe72⤵PID:4300
-
\??\c:\ja97k.exec:\ja97k.exe73⤵PID:4784
-
\??\c:\36ew3.exec:\36ew3.exe74⤵PID:1120
-
\??\c:\92g7o9.exec:\92g7o9.exe75⤵PID:888
-
\??\c:\1kw21x.exec:\1kw21x.exe76⤵PID:4152
-
\??\c:\wwe99.exec:\wwe99.exe77⤵PID:1768
-
\??\c:\43j6b.exec:\43j6b.exe78⤵PID:4364
-
\??\c:\29626.exec:\29626.exe79⤵PID:3724
-
\??\c:\eg03i49.exec:\eg03i49.exe80⤵PID:1564
-
\??\c:\6e5q2o.exec:\6e5q2o.exe81⤵PID:3692
-
\??\c:\la089c.exec:\la089c.exe82⤵PID:3684
-
\??\c:\019n9js.exec:\019n9js.exe83⤵PID:1948
-
\??\c:\k96hu.exec:\k96hu.exe84⤵PID:2928
-
\??\c:\53en66.exec:\53en66.exe85⤵PID:2776
-
\??\c:\j285m.exec:\j285m.exe86⤵PID:4468
-
\??\c:\17a4s5h.exec:\17a4s5h.exe87⤵PID:4908
-
\??\c:\lmqm4fh.exec:\lmqm4fh.exe88⤵PID:1696
-
\??\c:\it63c3g.exec:\it63c3g.exe89⤵PID:2004
-
\??\c:\77m6n.exec:\77m6n.exe90⤵PID:4484
-
\??\c:\lggq2.exec:\lggq2.exe91⤵PID:764
-
\??\c:\m9q9v.exec:\m9q9v.exe92⤵PID:3216
-
\??\c:\cfgkcp.exec:\cfgkcp.exe93⤵PID:1952
-
\??\c:\417v83.exec:\417v83.exe94⤵PID:1056
-
\??\c:\3w3q3g.exec:\3w3q3g.exe95⤵PID:664
-
\??\c:\0fmv758.exec:\0fmv758.exe96⤵PID:2252
-
\??\c:\gc398li.exec:\gc398li.exe97⤵PID:4372
-
\??\c:\12lf3x.exec:\12lf3x.exe98⤵PID:1888
-
\??\c:\3l5ci.exec:\3l5ci.exe99⤵PID:3964
-
\??\c:\9v1wu.exec:\9v1wu.exe100⤵PID:3132
-
\??\c:\8iaq7e.exec:\8iaq7e.exe101⤵PID:2572
-
\??\c:\jjvwil0.exec:\jjvwil0.exe102⤵PID:3068
-
\??\c:\n9491.exec:\n9491.exe103⤵PID:3912
-
\??\c:\i91ru.exec:\i91ru.exe104⤵PID:1536
-
\??\c:\4op294s.exec:\4op294s.exe105⤵PID:4524
-
\??\c:\i76281h.exec:\i76281h.exe106⤵PID:3604
-
\??\c:\abh515o.exec:\abh515o.exe107⤵PID:3768
-
\??\c:\4j1c71.exec:\4j1c71.exe108⤵PID:2848
-
\??\c:\76w295a.exec:\76w295a.exe109⤵PID:1956
-
\??\c:\rc2p71q.exec:\rc2p71q.exe110⤵PID:2496
-
\??\c:\2h5lrr.exec:\2h5lrr.exe111⤵PID:844
-
\??\c:\wphmv.exec:\wphmv.exe112⤵PID:3968
-
\??\c:\04775.exec:\04775.exe113⤵PID:4008
-
\??\c:\3a529b.exec:\3a529b.exe114⤵PID:3760
-
\??\c:\br56u.exec:\br56u.exe115⤵PID:4684
-
\??\c:\sj9jg7.exec:\sj9jg7.exe116⤵PID:2460
-
\??\c:\mpwi172.exec:\mpwi172.exe117⤵PID:3692
-
\??\c:\9s47338.exec:\9s47338.exe118⤵PID:3176
-
\??\c:\rq515.exec:\rq515.exe119⤵PID:3448
-
\??\c:\2k82r.exec:\2k82r.exe120⤵PID:2928
-
\??\c:\5gpb9ig.exec:\5gpb9ig.exe121⤵PID:2776
-
\??\c:\d1w3r.exec:\d1w3r.exe122⤵PID:1020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-