Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 20:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
28dda816ee26542b738699f8fdeda1f0_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
28dda816ee26542b738699f8fdeda1f0_NeikiAnalytics.exe
-
Size
62KB
-
MD5
28dda816ee26542b738699f8fdeda1f0
-
SHA1
284f16d914964d195295d9261d0387115680678c
-
SHA256
2d9d3c45bbc5c50c88ca9d3d94b14eab5f73d7c4009b61ca5516f5203cadd92f
-
SHA512
87f5426e0464a3da5adf862ba3bbbdd8b2e18781d80e571297e272aa16cce0e32c346ea2b6ece5aeab021049cf2fc4a744a7c1b1a392a7f7d6dfaf86c8b6d9c9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8mbUhz:ymb3NkkiQ3mdBjF0yMjE
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/816-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/856-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-62-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3908-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4188-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/444-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/552-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1164-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1936 0466620.exe 3008 llfxrrl.exe 2388 hhnbbt.exe 1748 2048268.exe 4176 06228.exe 4512 hbnhnh.exe 856 40806.exe 3908 vjvjv.exe 4188 tbnhhb.exe 444 82426.exe 1940 s8468.exe 1900 llrrxlf.exe 2064 tnnbtn.exe 552 pvddv.exe 4876 bhnbbb.exe 716 48248.exe 1176 282088.exe 116 flxlxxl.exe 1604 nbtbtb.exe 1164 6048660.exe 228 xfrlrrx.exe 220 840000.exe 2224 dvdvp.exe 1784 djvpj.exe 1836 88484.exe 1160 s2826.exe 1720 4282266.exe 4760 hbtttn.exe 3620 dvdpd.exe 1624 nhthth.exe 680 06028.exe 1428 64088.exe 3856 btnnhb.exe 1476 lffxlff.exe 1528 bnnhhh.exe 1284 bnbbhn.exe 1552 886228.exe 1400 2002402.exe 4976 0482806.exe 4420 7bnnnt.exe 920 thttnn.exe 1560 86446.exe 3192 800488.exe 3008 08000.exe 4316 200228.exe 392 frrlfff.exe 2556 00048.exe 740 lxrlfxr.exe 3724 6026hb.exe 4440 202848.exe 1740 vjvdp.exe 3772 lxxxxrr.exe 4008 860600.exe 3976 vvdvp.exe 404 llrllff.exe 3060 84662.exe 3164 g2204.exe 4908 4084204.exe 3444 ttbnbn.exe 5116 htnhhh.exe 4572 bbbtth.exe 1436 020660.exe 3572 bthhth.exe 3840 bhhbtt.exe -
resource yara_rule behavioral2/memory/816-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/816-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/856-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3908-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4188-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/444-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1164-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 816 wrote to memory of 1936 816 28dda816ee26542b738699f8fdeda1f0_NeikiAnalytics.exe 82 PID 816 wrote to memory of 1936 816 28dda816ee26542b738699f8fdeda1f0_NeikiAnalytics.exe 82 PID 816 wrote to memory of 1936 816 28dda816ee26542b738699f8fdeda1f0_NeikiAnalytics.exe 82 PID 1936 wrote to memory of 3008 1936 0466620.exe 83 PID 1936 wrote to memory of 3008 1936 0466620.exe 83 PID 1936 wrote to memory of 3008 1936 0466620.exe 83 PID 3008 wrote to memory of 2388 3008 llfxrrl.exe 84 PID 3008 wrote to memory of 2388 3008 llfxrrl.exe 84 PID 3008 wrote to memory of 2388 3008 llfxrrl.exe 84 PID 2388 wrote to memory of 1748 2388 hhnbbt.exe 85 PID 2388 wrote to memory of 1748 2388 hhnbbt.exe 85 PID 2388 wrote to memory of 1748 2388 hhnbbt.exe 85 PID 1748 wrote to memory of 4176 1748 2048268.exe 86 PID 1748 wrote to memory of 4176 1748 2048268.exe 86 PID 1748 wrote to memory of 4176 1748 2048268.exe 86 PID 4176 wrote to memory of 4512 4176 06228.exe 87 PID 4176 wrote to memory of 4512 4176 06228.exe 87 PID 4176 wrote to memory of 4512 4176 06228.exe 87 PID 4512 wrote to memory of 856 4512 hbnhnh.exe 88 PID 4512 wrote to memory of 856 4512 hbnhnh.exe 88 PID 4512 wrote to memory of 856 4512 hbnhnh.exe 88 PID 856 wrote to memory of 3908 856 40806.exe 89 PID 856 wrote to memory of 3908 856 40806.exe 89 PID 856 wrote to memory of 3908 856 40806.exe 89 PID 3908 wrote to memory of 4188 3908 vjvjv.exe 90 PID 3908 wrote to memory of 4188 3908 vjvjv.exe 90 PID 3908 wrote to memory of 4188 3908 vjvjv.exe 90 PID 4188 wrote to memory of 444 4188 tbnhhb.exe 91 PID 4188 wrote to memory of 444 4188 tbnhhb.exe 91 PID 4188 wrote to memory of 444 4188 tbnhhb.exe 91 PID 444 wrote to memory of 1940 444 82426.exe 92 PID 444 wrote to memory of 1940 444 82426.exe 92 PID 444 wrote to memory of 1940 444 82426.exe 92 PID 1940 wrote to memory of 1900 1940 s8468.exe 93 PID 1940 wrote to memory of 1900 1940 s8468.exe 93 PID 1940 wrote to memory of 1900 1940 s8468.exe 93 PID 1900 wrote to memory of 2064 1900 llrrxlf.exe 94 PID 1900 wrote to memory of 2064 1900 llrrxlf.exe 94 PID 1900 wrote to memory of 2064 1900 llrrxlf.exe 94 PID 2064 wrote to memory of 552 2064 tnnbtn.exe 95 PID 2064 wrote to memory of 552 2064 tnnbtn.exe 95 PID 2064 wrote to memory of 552 2064 tnnbtn.exe 95 PID 552 wrote to memory of 4876 552 pvddv.exe 96 PID 552 wrote to memory of 4876 552 pvddv.exe 96 PID 552 wrote to memory of 4876 552 pvddv.exe 96 PID 4876 wrote to memory of 716 4876 bhnbbb.exe 97 PID 4876 wrote to memory of 716 4876 bhnbbb.exe 97 PID 4876 wrote to memory of 716 4876 bhnbbb.exe 97 PID 716 wrote to memory of 1176 716 48248.exe 98 PID 716 wrote to memory of 1176 716 48248.exe 98 PID 716 wrote to memory of 1176 716 48248.exe 98 PID 1176 wrote to memory of 116 1176 282088.exe 99 PID 1176 wrote to memory of 116 1176 282088.exe 99 PID 1176 wrote to memory of 116 1176 282088.exe 99 PID 116 wrote to memory of 1604 116 flxlxxl.exe 100 PID 116 wrote to memory of 1604 116 flxlxxl.exe 100 PID 116 wrote to memory of 1604 116 flxlxxl.exe 100 PID 1604 wrote to memory of 1164 1604 nbtbtb.exe 101 PID 1604 wrote to memory of 1164 1604 nbtbtb.exe 101 PID 1604 wrote to memory of 1164 1604 nbtbtb.exe 101 PID 1164 wrote to memory of 228 1164 6048660.exe 102 PID 1164 wrote to memory of 228 1164 6048660.exe 102 PID 1164 wrote to memory of 228 1164 6048660.exe 102 PID 228 wrote to memory of 220 228 xfrlrrx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\28dda816ee26542b738699f8fdeda1f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\28dda816ee26542b738699f8fdeda1f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\0466620.exec:\0466620.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\llfxrrl.exec:\llfxrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\hhnbbt.exec:\hhnbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\2048268.exec:\2048268.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\06228.exec:\06228.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\hbnhnh.exec:\hbnhnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\40806.exec:\40806.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\vjvjv.exec:\vjvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\tbnhhb.exec:\tbnhhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\82426.exec:\82426.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\s8468.exec:\s8468.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\llrrxlf.exec:\llrrxlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\tnnbtn.exec:\tnnbtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\pvddv.exec:\pvddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\bhnbbb.exec:\bhnbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\48248.exec:\48248.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\282088.exec:\282088.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\flxlxxl.exec:\flxlxxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\nbtbtb.exec:\nbtbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\6048660.exec:\6048660.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\xfrlrrx.exec:\xfrlrrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\840000.exec:\840000.exe23⤵
- Executes dropped EXE
PID:220 -
\??\c:\dvdvp.exec:\dvdvp.exe24⤵
- Executes dropped EXE
PID:2224 -
\??\c:\djvpj.exec:\djvpj.exe25⤵
- Executes dropped EXE
PID:1784 -
\??\c:\88484.exec:\88484.exe26⤵
- Executes dropped EXE
PID:1836 -
\??\c:\s2826.exec:\s2826.exe27⤵
- Executes dropped EXE
PID:1160 -
\??\c:\4282266.exec:\4282266.exe28⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hbtttn.exec:\hbtttn.exe29⤵
- Executes dropped EXE
PID:4760 -
\??\c:\dvdpd.exec:\dvdpd.exe30⤵
- Executes dropped EXE
PID:3620 -
\??\c:\nhthth.exec:\nhthth.exe31⤵
- Executes dropped EXE
PID:1624 -
\??\c:\06028.exec:\06028.exe32⤵
- Executes dropped EXE
PID:680 -
\??\c:\64088.exec:\64088.exe33⤵
- Executes dropped EXE
PID:1428 -
\??\c:\btnnhb.exec:\btnnhb.exe34⤵
- Executes dropped EXE
PID:3856 -
\??\c:\lffxlff.exec:\lffxlff.exe35⤵
- Executes dropped EXE
PID:1476 -
\??\c:\bnnhhh.exec:\bnnhhh.exe36⤵
- Executes dropped EXE
PID:1528 -
\??\c:\bnbbhn.exec:\bnbbhn.exe37⤵
- Executes dropped EXE
PID:1284 -
\??\c:\886228.exec:\886228.exe38⤵
- Executes dropped EXE
PID:1552 -
\??\c:\2002402.exec:\2002402.exe39⤵
- Executes dropped EXE
PID:1400 -
\??\c:\0482806.exec:\0482806.exe40⤵
- Executes dropped EXE
PID:4976 -
\??\c:\7bnnnt.exec:\7bnnnt.exe41⤵
- Executes dropped EXE
PID:4420 -
\??\c:\thttnn.exec:\thttnn.exe42⤵
- Executes dropped EXE
PID:920 -
\??\c:\86446.exec:\86446.exe43⤵
- Executes dropped EXE
PID:1560 -
\??\c:\800488.exec:\800488.exe44⤵
- Executes dropped EXE
PID:3192 -
\??\c:\08000.exec:\08000.exe45⤵
- Executes dropped EXE
PID:3008 -
\??\c:\200228.exec:\200228.exe46⤵
- Executes dropped EXE
PID:4316 -
\??\c:\frrlfff.exec:\frrlfff.exe47⤵
- Executes dropped EXE
PID:392 -
\??\c:\00048.exec:\00048.exe48⤵
- Executes dropped EXE
PID:2556 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe49⤵
- Executes dropped EXE
PID:740 -
\??\c:\6026hb.exec:\6026hb.exe50⤵
- Executes dropped EXE
PID:3724 -
\??\c:\202848.exec:\202848.exe51⤵
- Executes dropped EXE
PID:4440 -
\??\c:\vjvdp.exec:\vjvdp.exe52⤵
- Executes dropped EXE
PID:1740 -
\??\c:\lxxxxrr.exec:\lxxxxrr.exe53⤵
- Executes dropped EXE
PID:3772 -
\??\c:\860600.exec:\860600.exe54⤵
- Executes dropped EXE
PID:4008 -
\??\c:\vvdvp.exec:\vvdvp.exe55⤵
- Executes dropped EXE
PID:3976 -
\??\c:\llrllff.exec:\llrllff.exe56⤵
- Executes dropped EXE
PID:404 -
\??\c:\84662.exec:\84662.exe57⤵
- Executes dropped EXE
PID:3060 -
\??\c:\g2204.exec:\g2204.exe58⤵
- Executes dropped EXE
PID:3164 -
\??\c:\4084204.exec:\4084204.exe59⤵
- Executes dropped EXE
PID:4908 -
\??\c:\ttbnbn.exec:\ttbnbn.exe60⤵
- Executes dropped EXE
PID:3444 -
\??\c:\htnhhh.exec:\htnhhh.exe61⤵
- Executes dropped EXE
PID:5116 -
\??\c:\bbbtth.exec:\bbbtth.exe62⤵
- Executes dropped EXE
PID:4572 -
\??\c:\020660.exec:\020660.exe63⤵
- Executes dropped EXE
PID:1436 -
\??\c:\bthhth.exec:\bthhth.exe64⤵
- Executes dropped EXE
PID:3572 -
\??\c:\bhhbtt.exec:\bhhbtt.exe65⤵
- Executes dropped EXE
PID:3840 -
\??\c:\0826048.exec:\0826048.exe66⤵PID:5088
-
\??\c:\e82468.exec:\e82468.exe67⤵PID:1164
-
\??\c:\840428.exec:\840428.exe68⤵PID:228
-
\??\c:\djjjp.exec:\djjjp.exe69⤵PID:112
-
\??\c:\dvdpj.exec:\dvdpj.exe70⤵PID:2224
-
\??\c:\jpdpj.exec:\jpdpj.exe71⤵PID:4924
-
\??\c:\flxlxrl.exec:\flxlxrl.exe72⤵PID:812
-
\??\c:\vpvpp.exec:\vpvpp.exe73⤵PID:5044
-
\??\c:\8804882.exec:\8804882.exe74⤵PID:3448
-
\??\c:\8460044.exec:\8460044.exe75⤵PID:4672
-
\??\c:\frffffx.exec:\frffffx.exe76⤵PID:4760
-
\??\c:\pdvvp.exec:\pdvvp.exe77⤵PID:4700
-
\??\c:\022648.exec:\022648.exe78⤵PID:4128
-
\??\c:\48600.exec:\48600.exe79⤵PID:4036
-
\??\c:\48882.exec:\48882.exe80⤵PID:3744
-
\??\c:\220422.exec:\220422.exe81⤵PID:3368
-
\??\c:\hbbbbb.exec:\hbbbbb.exe82⤵PID:4884
-
\??\c:\hhnhbh.exec:\hhnhbh.exe83⤵PID:1832
-
\??\c:\044462.exec:\044462.exe84⤵PID:3928
-
\??\c:\xxlfxrx.exec:\xxlfxrx.exe85⤵PID:3300
-
\??\c:\bnhhbb.exec:\bnhhbb.exe86⤵PID:2136
-
\??\c:\6404044.exec:\6404044.exe87⤵PID:1416
-
\??\c:\3jjjv.exec:\3jjjv.exe88⤵PID:816
-
\??\c:\jpdjv.exec:\jpdjv.exe89⤵PID:2856
-
\??\c:\9xrlffr.exec:\9xrlffr.exe90⤵PID:4496
-
\??\c:\xllrlfx.exec:\xllrlfx.exe91⤵PID:3360
-
\??\c:\9rllrrr.exec:\9rllrrr.exe92⤵PID:2612
-
\??\c:\0200488.exec:\0200488.exe93⤵PID:4024
-
\??\c:\640486.exec:\640486.exe94⤵PID:4316
-
\??\c:\82820.exec:\82820.exe95⤵PID:4872
-
\??\c:\484826.exec:\484826.exe96⤵PID:3196
-
\??\c:\xlxllfx.exec:\xlxllfx.exe97⤵PID:368
-
\??\c:\0806002.exec:\0806002.exe98⤵PID:740
-
\??\c:\flxrllf.exec:\flxrllf.exe99⤵PID:1148
-
\??\c:\xrlllrr.exec:\xrlllrr.exe100⤵PID:2060
-
\??\c:\frrlfxr.exec:\frrlfxr.exe101⤵PID:4504
-
\??\c:\08006.exec:\08006.exe102⤵PID:3664
-
\??\c:\jppjj.exec:\jppjj.exe103⤵PID:3016
-
\??\c:\42462.exec:\42462.exe104⤵PID:4012
-
\??\c:\xrrllll.exec:\xrrllll.exe105⤵PID:1892
-
\??\c:\20228.exec:\20228.exe106⤵PID:2816
-
\??\c:\jdddp.exec:\jdddp.exe107⤵PID:3984
-
\??\c:\g2482.exec:\g2482.exe108⤵PID:2112
-
\??\c:\0848406.exec:\0848406.exe109⤵PID:5116
-
\??\c:\fxllllr.exec:\fxllllr.exe110⤵PID:4572
-
\??\c:\htnnnn.exec:\htnnnn.exe111⤵PID:1556
-
\??\c:\llfxlrl.exec:\llfxlrl.exe112⤵PID:3572
-
\??\c:\hhhhbb.exec:\hhhhbb.exe113⤵PID:5064
-
\??\c:\bnnhhb.exec:\bnnhhb.exe114⤵PID:5060
-
\??\c:\hbtnhh.exec:\hbtnhh.exe115⤵PID:1576
-
\??\c:\64606.exec:\64606.exe116⤵PID:1140
-
\??\c:\4448882.exec:\4448882.exe117⤵PID:4336
-
\??\c:\4246260.exec:\4246260.exe118⤵PID:1020
-
\??\c:\djjdd.exec:\djjdd.exe119⤵PID:1652
-
\??\c:\262606.exec:\262606.exe120⤵PID:2292
-
\??\c:\08026.exec:\08026.exe121⤵PID:4052
-
\??\c:\pvvpp.exec:\pvvpp.exe122⤵PID:384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-