Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 13:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a507f89791b8abffaded4a48717c9f60_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
a507f89791b8abffaded4a48717c9f60_NeikiAnalytics.exe
-
Size
95KB
-
MD5
a507f89791b8abffaded4a48717c9f60
-
SHA1
17cb54deab18d8d8fea5826ebdcf00c1faa78910
-
SHA256
b5be4639db0733d12076a36e0ffb68f0469bd13c328bde89f832d40ab2c32b55
-
SHA512
1e194f7e28d9e949c336ce330b15d827d1e836f256e304d61dfca791548551ad7c37ed06c45f6d3d1e193babc4730f7ad46c28afba8a3cb9a954614283e0cbd3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxEPOfPrAB:ymb3NkkiQ3mdBjFo73PYP1lri3KuOnrE
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/3136-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1832-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1088-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1124-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4512 bnnhbh.exe 4384 00048.exe 1124 jpvpj.exe 4432 vpjdd.exe 4424 xrfxxxr.exe 2752 xlxrrrx.exe 1832 8404826.exe 2468 e62266.exe 2852 1bnhhh.exe 3036 42260.exe 2488 2020404.exe 4748 rxxrfxf.exe 2724 0482660.exe 2892 bhbtnh.exe 4108 jvdpj.exe 2336 jvdvp.exe 3652 1fxrllx.exe 4684 xrffxrr.exe 888 pjjvp.exe 2116 400600.exe 3104 048048.exe 3872 u408602.exe 3064 848642.exe 2096 68048.exe 1088 2686822.exe 4316 208844.exe 1208 lffxxxf.exe 3664 06660.exe 4968 lrlrlxx.exe 4776 08482.exe 4380 04660.exe 3948 48488.exe 3396 nhhbnt.exe 2800 4804628.exe 4436 m2006.exe 924 6040228.exe 3308 k22648.exe 4084 i020042.exe 2572 06604.exe 1488 xrflfll.exe 1696 2240666.exe 1448 6044882.exe 3608 1nnhbb.exe 3272 04608.exe 1284 6282626.exe 1948 bttnbb.exe 4432 lflxrlf.exe 2176 0820800.exe 648 8224488.exe 4520 vjvdv.exe 2912 6800440.exe 2468 3dvpv.exe 2852 frxlxrx.exe 4956 tnbbth.exe 3364 9pvpd.exe 3360 ntnhbt.exe 1092 xrrlxxr.exe 3184 444860.exe 4176 82688.exe 4676 w48826.exe 1680 2226448.exe 1272 frffxrr.exe 1996 jdvpj.exe 2252 vjvpd.exe -
resource yara_rule behavioral2/memory/3136-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1124-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1088-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1124-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1124-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1124-24-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3136 wrote to memory of 4512 3136 a507f89791b8abffaded4a48717c9f60_NeikiAnalytics.exe 82 PID 3136 wrote to memory of 4512 3136 a507f89791b8abffaded4a48717c9f60_NeikiAnalytics.exe 82 PID 3136 wrote to memory of 4512 3136 a507f89791b8abffaded4a48717c9f60_NeikiAnalytics.exe 82 PID 4512 wrote to memory of 4384 4512 bnnhbh.exe 83 PID 4512 wrote to memory of 4384 4512 bnnhbh.exe 83 PID 4512 wrote to memory of 4384 4512 bnnhbh.exe 83 PID 4384 wrote to memory of 1124 4384 00048.exe 84 PID 4384 wrote to memory of 1124 4384 00048.exe 84 PID 4384 wrote to memory of 1124 4384 00048.exe 84 PID 1124 wrote to memory of 4432 1124 jpvpj.exe 131 PID 1124 wrote to memory of 4432 1124 jpvpj.exe 131 PID 1124 wrote to memory of 4432 1124 jpvpj.exe 131 PID 4432 wrote to memory of 4424 4432 vpjdd.exe 86 PID 4432 wrote to memory of 4424 4432 vpjdd.exe 86 PID 4432 wrote to memory of 4424 4432 vpjdd.exe 86 PID 4424 wrote to memory of 2752 4424 xrfxxxr.exe 87 PID 4424 wrote to memory of 2752 4424 xrfxxxr.exe 87 PID 4424 wrote to memory of 2752 4424 xrfxxxr.exe 87 PID 2752 wrote to memory of 1832 2752 xlxrrrx.exe 88 PID 2752 wrote to memory of 1832 2752 xlxrrrx.exe 88 PID 2752 wrote to memory of 1832 2752 xlxrrrx.exe 88 PID 1832 wrote to memory of 2468 1832 8404826.exe 136 PID 1832 wrote to memory of 2468 1832 8404826.exe 136 PID 1832 wrote to memory of 2468 1832 8404826.exe 136 PID 2468 wrote to memory of 2852 2468 e62266.exe 137 PID 2468 wrote to memory of 2852 2468 e62266.exe 137 PID 2468 wrote to memory of 2852 2468 e62266.exe 137 PID 2852 wrote to memory of 3036 2852 1bnhhh.exe 92 PID 2852 wrote to memory of 3036 2852 1bnhhh.exe 92 PID 2852 wrote to memory of 3036 2852 1bnhhh.exe 92 PID 3036 wrote to memory of 2488 3036 42260.exe 93 PID 3036 wrote to memory of 2488 3036 42260.exe 93 PID 3036 wrote to memory of 2488 3036 42260.exe 93 PID 2488 wrote to memory of 4748 2488 2020404.exe 95 PID 2488 wrote to memory of 4748 2488 2020404.exe 95 PID 2488 wrote to memory of 4748 2488 2020404.exe 95 PID 4748 wrote to memory of 2724 4748 rxxrfxf.exe 96 PID 4748 wrote to memory of 2724 4748 rxxrfxf.exe 96 PID 4748 wrote to memory of 2724 4748 rxxrfxf.exe 96 PID 2724 wrote to memory of 2892 2724 0482660.exe 97 PID 2724 wrote to memory of 2892 2724 0482660.exe 97 PID 2724 wrote to memory of 2892 2724 0482660.exe 97 PID 2892 wrote to memory of 4108 2892 bhbtnh.exe 98 PID 2892 wrote to memory of 4108 2892 bhbtnh.exe 98 PID 2892 wrote to memory of 4108 2892 bhbtnh.exe 98 PID 4108 wrote to memory of 2336 4108 jvdpj.exe 99 PID 4108 wrote to memory of 2336 4108 jvdpj.exe 99 PID 4108 wrote to memory of 2336 4108 jvdpj.exe 99 PID 2336 wrote to memory of 3652 2336 jvdvp.exe 100 PID 2336 wrote to memory of 3652 2336 jvdvp.exe 100 PID 2336 wrote to memory of 3652 2336 jvdvp.exe 100 PID 3652 wrote to memory of 4684 3652 1fxrllx.exe 152 PID 3652 wrote to memory of 4684 3652 1fxrllx.exe 152 PID 3652 wrote to memory of 4684 3652 1fxrllx.exe 152 PID 4684 wrote to memory of 888 4684 xrffxrr.exe 103 PID 4684 wrote to memory of 888 4684 xrffxrr.exe 103 PID 4684 wrote to memory of 888 4684 xrffxrr.exe 103 PID 888 wrote to memory of 2116 888 pjjvp.exe 104 PID 888 wrote to memory of 2116 888 pjjvp.exe 104 PID 888 wrote to memory of 2116 888 pjjvp.exe 104 PID 2116 wrote to memory of 3104 2116 400600.exe 105 PID 2116 wrote to memory of 3104 2116 400600.exe 105 PID 2116 wrote to memory of 3104 2116 400600.exe 105 PID 3104 wrote to memory of 3872 3104 048048.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\a507f89791b8abffaded4a48717c9f60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a507f89791b8abffaded4a48717c9f60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\bnnhbh.exec:\bnnhbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\00048.exec:\00048.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\jpvpj.exec:\jpvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\vpjdd.exec:\vpjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\xrfxxxr.exec:\xrfxxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\xlxrrrx.exec:\xlxrrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\8404826.exec:\8404826.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\e62266.exec:\e62266.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\1bnhhh.exec:\1bnhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\42260.exec:\42260.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\2020404.exec:\2020404.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\rxxrfxf.exec:\rxxrfxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\0482660.exec:\0482660.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\bhbtnh.exec:\bhbtnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\jvdpj.exec:\jvdpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\jvdvp.exec:\jvdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\1fxrllx.exec:\1fxrllx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\xrffxrr.exec:\xrffxrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\pjjvp.exec:\pjjvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\400600.exec:\400600.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\048048.exec:\048048.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\u408602.exec:\u408602.exe23⤵
- Executes dropped EXE
PID:3872 -
\??\c:\848642.exec:\848642.exe24⤵
- Executes dropped EXE
PID:3064 -
\??\c:\68048.exec:\68048.exe25⤵
- Executes dropped EXE
PID:2096 -
\??\c:\2686822.exec:\2686822.exe26⤵
- Executes dropped EXE
PID:1088 -
\??\c:\208844.exec:\208844.exe27⤵
- Executes dropped EXE
PID:4316 -
\??\c:\lffxxxf.exec:\lffxxxf.exe28⤵
- Executes dropped EXE
PID:1208 -
\??\c:\06660.exec:\06660.exe29⤵
- Executes dropped EXE
PID:3664 -
\??\c:\lrlrlxx.exec:\lrlrlxx.exe30⤵
- Executes dropped EXE
PID:4968 -
\??\c:\08482.exec:\08482.exe31⤵
- Executes dropped EXE
PID:4776 -
\??\c:\04660.exec:\04660.exe32⤵
- Executes dropped EXE
PID:4380 -
\??\c:\48488.exec:\48488.exe33⤵
- Executes dropped EXE
PID:3948 -
\??\c:\nhhbnt.exec:\nhhbnt.exe34⤵
- Executes dropped EXE
PID:3396 -
\??\c:\4804628.exec:\4804628.exe35⤵
- Executes dropped EXE
PID:2800 -
\??\c:\m2006.exec:\m2006.exe36⤵
- Executes dropped EXE
PID:4436 -
\??\c:\6040228.exec:\6040228.exe37⤵
- Executes dropped EXE
PID:924 -
\??\c:\k22648.exec:\k22648.exe38⤵
- Executes dropped EXE
PID:3308 -
\??\c:\i020042.exec:\i020042.exe39⤵
- Executes dropped EXE
PID:4084 -
\??\c:\06604.exec:\06604.exe40⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xrflfll.exec:\xrflfll.exe41⤵
- Executes dropped EXE
PID:1488 -
\??\c:\2240666.exec:\2240666.exe42⤵
- Executes dropped EXE
PID:1696 -
\??\c:\6044882.exec:\6044882.exe43⤵
- Executes dropped EXE
PID:1448 -
\??\c:\1nnhbb.exec:\1nnhbb.exe44⤵
- Executes dropped EXE
PID:3608 -
\??\c:\04608.exec:\04608.exe45⤵
- Executes dropped EXE
PID:3272 -
\??\c:\6282626.exec:\6282626.exe46⤵
- Executes dropped EXE
PID:1284 -
\??\c:\bttnbb.exec:\bttnbb.exe47⤵
- Executes dropped EXE
PID:1948 -
\??\c:\lflxrlf.exec:\lflxrlf.exe48⤵
- Executes dropped EXE
PID:4432 -
\??\c:\0820800.exec:\0820800.exe49⤵
- Executes dropped EXE
PID:2176 -
\??\c:\8224488.exec:\8224488.exe50⤵
- Executes dropped EXE
PID:648 -
\??\c:\vjvdv.exec:\vjvdv.exe51⤵
- Executes dropped EXE
PID:4520 -
\??\c:\6800440.exec:\6800440.exe52⤵
- Executes dropped EXE
PID:2912 -
\??\c:\3dvpv.exec:\3dvpv.exe53⤵
- Executes dropped EXE
PID:2468 -
\??\c:\frxlxrx.exec:\frxlxrx.exe54⤵
- Executes dropped EXE
PID:2852 -
\??\c:\tnbbth.exec:\tnbbth.exe55⤵
- Executes dropped EXE
PID:4956 -
\??\c:\9pvpd.exec:\9pvpd.exe56⤵
- Executes dropped EXE
PID:3364 -
\??\c:\ntnhbt.exec:\ntnhbt.exe57⤵
- Executes dropped EXE
PID:3360 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe58⤵
- Executes dropped EXE
PID:1092 -
\??\c:\444860.exec:\444860.exe59⤵
- Executes dropped EXE
PID:3184 -
\??\c:\82688.exec:\82688.exe60⤵
- Executes dropped EXE
PID:4176 -
\??\c:\w48826.exec:\w48826.exe61⤵
- Executes dropped EXE
PID:4676 -
\??\c:\2226448.exec:\2226448.exe62⤵
- Executes dropped EXE
PID:1680 -
\??\c:\frffxrr.exec:\frffxrr.exe63⤵
- Executes dropped EXE
PID:1272 -
\??\c:\jdvpj.exec:\jdvpj.exe64⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vjvpd.exec:\vjvpd.exe65⤵
- Executes dropped EXE
PID:2252 -
\??\c:\2004464.exec:\2004464.exe66⤵PID:4860
-
\??\c:\8068080.exec:\8068080.exe67⤵PID:4692
-
\??\c:\600488.exec:\600488.exe68⤵PID:4916
-
\??\c:\88624.exec:\88624.exe69⤵PID:4684
-
\??\c:\thnbnh.exec:\thnbnh.exe70⤵PID:4828
-
\??\c:\hbtnhh.exec:\hbtnhh.exe71⤵PID:4744
-
\??\c:\3ddvp.exec:\3ddvp.exe72⤵PID:4172
-
\??\c:\lxrrffx.exec:\lxrrffx.exe73⤵PID:436
-
\??\c:\lrrlflf.exec:\lrrlflf.exe74⤵PID:5024
-
\??\c:\0686004.exec:\0686004.exe75⤵PID:4344
-
\??\c:\9ddvv.exec:\9ddvv.exe76⤵PID:4972
-
\??\c:\446406.exec:\446406.exe77⤵PID:4044
-
\??\c:\hnnbbt.exec:\hnnbbt.exe78⤵PID:2716
-
\??\c:\lflffxf.exec:\lflffxf.exe79⤵PID:2600
-
\??\c:\vdjvp.exec:\vdjvp.exe80⤵PID:3304
-
\??\c:\nnttnn.exec:\nnttnn.exe81⤵PID:1392
-
\??\c:\nhbtnn.exec:\nhbtnn.exe82⤵PID:4416
-
\??\c:\0682008.exec:\0682008.exe83⤵PID:3280
-
\??\c:\lflffff.exec:\lflffff.exe84⤵PID:212
-
\??\c:\bbthbn.exec:\bbthbn.exe85⤵PID:456
-
\??\c:\dddvp.exec:\dddvp.exe86⤵PID:3680
-
\??\c:\k80480.exec:\k80480.exe87⤵PID:2748
-
\??\c:\hbhbnn.exec:\hbhbnn.exe88⤵PID:4572
-
\??\c:\m2004.exec:\m2004.exe89⤵PID:4876
-
\??\c:\nhnnhh.exec:\nhnnhh.exe90⤵PID:1548
-
\??\c:\ntbntn.exec:\ntbntn.exe91⤵PID:924
-
\??\c:\446068.exec:\446068.exe92⤵PID:1100
-
\??\c:\o444848.exec:\o444848.exe93⤵PID:4084
-
\??\c:\624868.exec:\624868.exe94⤵PID:2572
-
\??\c:\86666.exec:\86666.exe95⤵PID:5000
-
\??\c:\vddvv.exec:\vddvv.exe96⤵PID:1696
-
\??\c:\nbttnn.exec:\nbttnn.exe97⤵PID:4512
-
\??\c:\dvvpp.exec:\dvvpp.exe98⤵PID:2944
-
\??\c:\flrfrlf.exec:\flrfrlf.exe99⤵PID:5092
-
\??\c:\djpjv.exec:\djpjv.exe100⤵PID:5088
-
\??\c:\046266.exec:\046266.exe101⤵PID:1948
-
\??\c:\4886660.exec:\4886660.exe102⤵PID:3500
-
\??\c:\862682.exec:\862682.exe103⤵PID:3800
-
\??\c:\lffxrrl.exec:\lffxrrl.exe104⤵PID:2092
-
\??\c:\pjdpd.exec:\pjdpd.exe105⤵PID:1832
-
\??\c:\86422.exec:\86422.exe106⤵PID:1732
-
\??\c:\bhtnbb.exec:\bhtnbb.exe107⤵PID:3372
-
\??\c:\m8044.exec:\m8044.exe108⤵PID:2668
-
\??\c:\7lrllrr.exec:\7lrllrr.exe109⤵PID:3036
-
\??\c:\lfrllfx.exec:\lfrllfx.exe110⤵PID:2772
-
\??\c:\4022660.exec:\4022660.exe111⤵PID:4964
-
\??\c:\ppjdd.exec:\ppjdd.exe112⤵PID:2768
-
\??\c:\08006.exec:\08006.exe113⤵PID:4188
-
\??\c:\rrfxrrl.exec:\rrfxrrl.exe114⤵PID:1276
-
\??\c:\484882.exec:\484882.exe115⤵PID:3580
-
\??\c:\pdppv.exec:\pdppv.exe116⤵PID:4352
-
\??\c:\jdjdd.exec:\jdjdd.exe117⤵PID:3488
-
\??\c:\hntbhh.exec:\hntbhh.exe118⤵PID:3080
-
\??\c:\840444.exec:\840444.exe119⤵PID:2612
-
\??\c:\06260.exec:\06260.exe120⤵PID:4908
-
\??\c:\04266.exec:\04266.exe121⤵PID:4720
-
\??\c:\lfffxxl.exec:\lfffxxl.exe122⤵PID:4592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-