Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 02:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
54f18b358597d7aba47a9fd12936beb0_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
54f18b358597d7aba47a9fd12936beb0_NeikiAnalytics.exe
-
Size
144KB
-
MD5
54f18b358597d7aba47a9fd12936beb0
-
SHA1
d443626351daba488dcc926b0ed9232fb36e2aea
-
SHA256
1b4223fee33608d89a961fedfef2338aa9dd32da8acefce437774d3991667ed2
-
SHA512
52515cd4e53c93d2d416102ca55b91b54c20a71a1676fc81e7b4f70b99e588cda82c1438568ba6a8c953887d3c2366ed91ff88f63f51981ebc41c0c5e0a4302f
-
SSDEEP
3072:ymb3NkkiQ3mdBjFosxXGPXbXQMFHLgDWSmklgQh:n3C9BRosxW8MFHLMW7Qh
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
resource yara_rule behavioral2/memory/2988-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3756-41-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3756-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1596-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1716-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1808-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2552-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3700 jjpdv.exe 1596 pjpvd.exe 4212 fxlfxrr.exe 1764 nnnnhn.exe 3756 bntnnh.exe 4780 vddvj.exe 3660 pjpjd.exe 4020 tnnhbb.exe 3752 fffrrfl.exe 2276 hntnbt.exe 516 hbnhbb.exe 1716 vpppv.exe 1808 xrrlrll.exe 3216 nhhhbb.exe 3100 vpvvv.exe 2552 rllfxrr.exe 4552 llxrfff.exe 4932 hbhbtt.exe 2820 jjppv.exe 3416 fxxfrxl.exe 1148 1nhbbt.exe 640 1vjvp.exe 1444 vjpjp.exe 400 lflxrlf.exe 2476 jpdjj.exe 3568 vpjdv.exe 1092 7flfrrx.exe 4256 hbttbt.exe 3616 tthbnh.exe 2392 vpjjd.exe 3612 7flxllf.exe 4556 htnnhh.exe 2940 tntnnh.exe 2096 dpjjv.exe 1424 ffflfrf.exe 1756 xrffxll.exe 4492 bthnht.exe 4508 5ppjv.exe 2988 dpjvp.exe 3124 xrlfrrl.exe 3912 hbbnhb.exe 1656 nhhbtb.exe 2600 hnthbt.exe 4204 pjjjj.exe 3664 rflfxfx.exe 884 nthbtt.exe 1560 7ttnbt.exe 5064 pjvpj.exe 4372 7jjdp.exe 3316 lxffxxx.exe 1916 tbbnbb.exe 692 9bbttt.exe 464 3vvpj.exe 516 fxrlxfx.exe 1716 thntnb.exe 4956 bnnhtt.exe 2844 pvdjd.exe 4412 llxrrll.exe 1808 nnhhnn.exe 2552 bttnbb.exe 2544 vpdpp.exe 2296 9llffff.exe 1688 lfxrffx.exe 3848 tttnhh.exe -
resource yara_rule behavioral2/memory/2988-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3756-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1596-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1808-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2552-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2988 wrote to memory of 3700 2988 54f18b358597d7aba47a9fd12936beb0_NeikiAnalytics.exe 82 PID 2988 wrote to memory of 3700 2988 54f18b358597d7aba47a9fd12936beb0_NeikiAnalytics.exe 82 PID 2988 wrote to memory of 3700 2988 54f18b358597d7aba47a9fd12936beb0_NeikiAnalytics.exe 82 PID 3700 wrote to memory of 1596 3700 jjpdv.exe 83 PID 3700 wrote to memory of 1596 3700 jjpdv.exe 83 PID 3700 wrote to memory of 1596 3700 jjpdv.exe 83 PID 1596 wrote to memory of 4212 1596 pjpvd.exe 84 PID 1596 wrote to memory of 4212 1596 pjpvd.exe 84 PID 1596 wrote to memory of 4212 1596 pjpvd.exe 84 PID 4212 wrote to memory of 1764 4212 fxlfxrr.exe 85 PID 4212 wrote to memory of 1764 4212 fxlfxrr.exe 85 PID 4212 wrote to memory of 1764 4212 fxlfxrr.exe 85 PID 1764 wrote to memory of 3756 1764 nnnnhn.exe 86 PID 1764 wrote to memory of 3756 1764 nnnnhn.exe 86 PID 1764 wrote to memory of 3756 1764 nnnnhn.exe 86 PID 3756 wrote to memory of 4780 3756 bntnnh.exe 87 PID 3756 wrote to memory of 4780 3756 bntnnh.exe 87 PID 3756 wrote to memory of 4780 3756 bntnnh.exe 87 PID 4780 wrote to memory of 3660 4780 vddvj.exe 88 PID 4780 wrote to memory of 3660 4780 vddvj.exe 88 PID 4780 wrote to memory of 3660 4780 vddvj.exe 88 PID 3660 wrote to memory of 4020 3660 pjpjd.exe 89 PID 3660 wrote to memory of 4020 3660 pjpjd.exe 89 PID 3660 wrote to memory of 4020 3660 pjpjd.exe 89 PID 4020 wrote to memory of 3752 4020 tnnhbb.exe 90 PID 4020 wrote to memory of 3752 4020 tnnhbb.exe 90 PID 4020 wrote to memory of 3752 4020 tnnhbb.exe 90 PID 3752 wrote to memory of 2276 3752 fffrrfl.exe 91 PID 3752 wrote to memory of 2276 3752 fffrrfl.exe 91 PID 3752 wrote to memory of 2276 3752 fffrrfl.exe 91 PID 2276 wrote to memory of 516 2276 hntnbt.exe 92 PID 2276 wrote to memory of 516 2276 hntnbt.exe 92 PID 2276 wrote to memory of 516 2276 hntnbt.exe 92 PID 516 wrote to memory of 1716 516 hbnhbb.exe 93 PID 516 wrote to memory of 1716 516 hbnhbb.exe 93 PID 516 wrote to memory of 1716 516 hbnhbb.exe 93 PID 1716 wrote to memory of 1808 1716 vpppv.exe 94 PID 1716 wrote to memory of 1808 1716 vpppv.exe 94 PID 1716 wrote to memory of 1808 1716 vpppv.exe 94 PID 1808 wrote to memory of 3216 1808 xrrlrll.exe 95 PID 1808 wrote to memory of 3216 1808 xrrlrll.exe 95 PID 1808 wrote to memory of 3216 1808 xrrlrll.exe 95 PID 3216 wrote to memory of 3100 3216 nhhhbb.exe 96 PID 3216 wrote to memory of 3100 3216 nhhhbb.exe 96 PID 3216 wrote to memory of 3100 3216 nhhhbb.exe 96 PID 3100 wrote to memory of 2552 3100 vpvvv.exe 97 PID 3100 wrote to memory of 2552 3100 vpvvv.exe 97 PID 3100 wrote to memory of 2552 3100 vpvvv.exe 97 PID 2552 wrote to memory of 4552 2552 rllfxrr.exe 98 PID 2552 wrote to memory of 4552 2552 rllfxrr.exe 98 PID 2552 wrote to memory of 4552 2552 rllfxrr.exe 98 PID 4552 wrote to memory of 4932 4552 llxrfff.exe 99 PID 4552 wrote to memory of 4932 4552 llxrfff.exe 99 PID 4552 wrote to memory of 4932 4552 llxrfff.exe 99 PID 4932 wrote to memory of 2820 4932 hbhbtt.exe 100 PID 4932 wrote to memory of 2820 4932 hbhbtt.exe 100 PID 4932 wrote to memory of 2820 4932 hbhbtt.exe 100 PID 2820 wrote to memory of 3416 2820 jjppv.exe 101 PID 2820 wrote to memory of 3416 2820 jjppv.exe 101 PID 2820 wrote to memory of 3416 2820 jjppv.exe 101 PID 3416 wrote to memory of 1148 3416 fxxfrxl.exe 102 PID 3416 wrote to memory of 1148 3416 fxxfrxl.exe 102 PID 3416 wrote to memory of 1148 3416 fxxfrxl.exe 102 PID 1148 wrote to memory of 640 1148 1nhbbt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\54f18b358597d7aba47a9fd12936beb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\54f18b358597d7aba47a9fd12936beb0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\jjpdv.exec:\jjpdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\pjpvd.exec:\pjpvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\fxlfxrr.exec:\fxlfxrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\nnnnhn.exec:\nnnnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\bntnnh.exec:\bntnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\vddvj.exec:\vddvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\pjpjd.exec:\pjpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\tnnhbb.exec:\tnnhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\fffrrfl.exec:\fffrrfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\hntnbt.exec:\hntnbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\hbnhbb.exec:\hbnhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\vpppv.exec:\vpppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\xrrlrll.exec:\xrrlrll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\nhhhbb.exec:\nhhhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\vpvvv.exec:\vpvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\rllfxrr.exec:\rllfxrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\llxrfff.exec:\llxrfff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\hbhbtt.exec:\hbhbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\jjppv.exec:\jjppv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\fxxfrxl.exec:\fxxfrxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\1nhbbt.exec:\1nhbbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\1vjvp.exec:\1vjvp.exe23⤵
- Executes dropped EXE
PID:640 -
\??\c:\vjpjp.exec:\vjpjp.exe24⤵
- Executes dropped EXE
PID:1444 -
\??\c:\lflxrlf.exec:\lflxrlf.exe25⤵
- Executes dropped EXE
PID:400 -
\??\c:\jpdjj.exec:\jpdjj.exe26⤵
- Executes dropped EXE
PID:2476 -
\??\c:\vpjdv.exec:\vpjdv.exe27⤵
- Executes dropped EXE
PID:3568 -
\??\c:\7flfrrx.exec:\7flfrrx.exe28⤵
- Executes dropped EXE
PID:1092 -
\??\c:\hbttbt.exec:\hbttbt.exe29⤵
- Executes dropped EXE
PID:4256 -
\??\c:\tthbnh.exec:\tthbnh.exe30⤵
- Executes dropped EXE
PID:3616 -
\??\c:\vpjjd.exec:\vpjjd.exe31⤵
- Executes dropped EXE
PID:2392 -
\??\c:\7flxllf.exec:\7flxllf.exe32⤵
- Executes dropped EXE
PID:3612 -
\??\c:\htnnhh.exec:\htnnhh.exe33⤵
- Executes dropped EXE
PID:4556 -
\??\c:\tntnnh.exec:\tntnnh.exe34⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dpjjv.exec:\dpjjv.exe35⤵
- Executes dropped EXE
PID:2096 -
\??\c:\ffflfrf.exec:\ffflfrf.exe36⤵
- Executes dropped EXE
PID:1424 -
\??\c:\xrffxll.exec:\xrffxll.exe37⤵
- Executes dropped EXE
PID:1756 -
\??\c:\bthnht.exec:\bthnht.exe38⤵
- Executes dropped EXE
PID:4492 -
\??\c:\5ppjv.exec:\5ppjv.exe39⤵
- Executes dropped EXE
PID:4508 -
\??\c:\dpjvp.exec:\dpjvp.exe40⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe41⤵
- Executes dropped EXE
PID:3124 -
\??\c:\hbbnhb.exec:\hbbnhb.exe42⤵
- Executes dropped EXE
PID:3912 -
\??\c:\nhhbtb.exec:\nhhbtb.exe43⤵
- Executes dropped EXE
PID:1656 -
\??\c:\hnthbt.exec:\hnthbt.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\pjjjj.exec:\pjjjj.exe45⤵
- Executes dropped EXE
PID:4204 -
\??\c:\rflfxfx.exec:\rflfxfx.exe46⤵
- Executes dropped EXE
PID:3664 -
\??\c:\nthbtt.exec:\nthbtt.exe47⤵
- Executes dropped EXE
PID:884 -
\??\c:\7ttnbt.exec:\7ttnbt.exe48⤵
- Executes dropped EXE
PID:1560 -
\??\c:\pjvpj.exec:\pjvpj.exe49⤵
- Executes dropped EXE
PID:5064 -
\??\c:\7jjdp.exec:\7jjdp.exe50⤵
- Executes dropped EXE
PID:4372 -
\??\c:\lxffxxx.exec:\lxffxxx.exe51⤵
- Executes dropped EXE
PID:3316 -
\??\c:\tbbnbb.exec:\tbbnbb.exe52⤵
- Executes dropped EXE
PID:1916 -
\??\c:\9bbttt.exec:\9bbttt.exe53⤵
- Executes dropped EXE
PID:692 -
\??\c:\3vvpj.exec:\3vvpj.exe54⤵
- Executes dropped EXE
PID:464 -
\??\c:\fxrlxfx.exec:\fxrlxfx.exe55⤵
- Executes dropped EXE
PID:516 -
\??\c:\thntnb.exec:\thntnb.exe56⤵
- Executes dropped EXE
PID:1716 -
\??\c:\bnnhtt.exec:\bnnhtt.exe57⤵
- Executes dropped EXE
PID:4956 -
\??\c:\pvdjd.exec:\pvdjd.exe58⤵
- Executes dropped EXE
PID:2844 -
\??\c:\llxrrll.exec:\llxrrll.exe59⤵
- Executes dropped EXE
PID:4412 -
\??\c:\nnhhnn.exec:\nnhhnn.exe60⤵
- Executes dropped EXE
PID:1808 -
\??\c:\bttnbb.exec:\bttnbb.exe61⤵
- Executes dropped EXE
PID:2552 -
\??\c:\vpdpp.exec:\vpdpp.exe62⤵
- Executes dropped EXE
PID:2544 -
\??\c:\9llffff.exec:\9llffff.exe63⤵
- Executes dropped EXE
PID:2296 -
\??\c:\lfxrffx.exec:\lfxrffx.exe64⤵
- Executes dropped EXE
PID:1688 -
\??\c:\tttnhh.exec:\tttnhh.exe65⤵
- Executes dropped EXE
PID:3848 -
\??\c:\ttbbhn.exec:\ttbbhn.exe66⤵PID:4428
-
\??\c:\vpvpd.exec:\vpvpd.exe67⤵PID:4276
-
\??\c:\3xfxllf.exec:\3xfxllf.exe68⤵PID:2972
-
\??\c:\nbbhtb.exec:\nbbhtb.exe69⤵PID:4616
-
\??\c:\7pvvd.exec:\7pvvd.exe70⤵PID:1812
-
\??\c:\lxxrffx.exec:\lxxrffx.exe71⤵PID:368
-
\??\c:\xfffxxf.exec:\xfffxxf.exe72⤵PID:2476
-
\??\c:\hbhnnn.exec:\hbhnnn.exe73⤵PID:4736
-
\??\c:\pjjjd.exec:\pjjjd.exe74⤵PID:4732
-
\??\c:\vjvpv.exec:\vjvpv.exe75⤵PID:1116
-
\??\c:\lrrlxxr.exec:\lrrlxxr.exe76⤵PID:4224
-
\??\c:\tnbnnh.exec:\tnbnnh.exe77⤵PID:2180
-
\??\c:\bhhntt.exec:\bhhntt.exe78⤵PID:3376
-
\??\c:\5pdpv.exec:\5pdpv.exe79⤵PID:436
-
\??\c:\rxrfrlf.exec:\rxrfrlf.exe80⤵PID:3616
-
\??\c:\hntnnn.exec:\hntnnn.exe81⤵PID:264
-
\??\c:\7nnnbb.exec:\7nnnbb.exe82⤵PID:3612
-
\??\c:\ddpjd.exec:\ddpjd.exe83⤵PID:2880
-
\??\c:\vpvdv.exec:\vpvdv.exe84⤵PID:2824
-
\??\c:\rlfxxxf.exec:\rlfxxxf.exe85⤵PID:4852
-
\??\c:\bttnnh.exec:\bttnnh.exe86⤵PID:428
-
\??\c:\ppdvd.exec:\ppdvd.exe87⤵PID:4464
-
\??\c:\5vjjj.exec:\5vjjj.exe88⤵PID:664
-
\??\c:\xlffxxr.exec:\xlffxxr.exe89⤵PID:1632
-
\??\c:\flfxxfx.exec:\flfxxfx.exe90⤵PID:2952
-
\??\c:\bnnntt.exec:\bnnntt.exe91⤵PID:3436
-
\??\c:\9bbntn.exec:\9bbntn.exe92⤵PID:3552
-
\??\c:\3jddj.exec:\3jddj.exe93⤵PID:2512
-
\??\c:\pdvjv.exec:\pdvjv.exe94⤵PID:940
-
\??\c:\9lrrllr.exec:\9lrrllr.exe95⤵PID:3948
-
\??\c:\9hnthh.exec:\9hnthh.exe96⤵PID:4640
-
\??\c:\hbbtnh.exec:\hbbtnh.exe97⤵PID:1144
-
\??\c:\7jvpp.exec:\7jvpp.exe98⤵PID:3820
-
\??\c:\btbthh.exec:\btbthh.exe99⤵PID:4400
-
\??\c:\1btnhb.exec:\1btnhb.exe100⤵PID:4020
-
\??\c:\vpdvp.exec:\vpdvp.exe101⤵PID:1568
-
\??\c:\dpvvd.exec:\dpvvd.exe102⤵PID:2160
-
\??\c:\9lfrrlf.exec:\9lfrrlf.exe103⤵PID:2176
-
\??\c:\3bbnhh.exec:\3bbnhh.exe104⤵PID:3992
-
\??\c:\1bhhnh.exec:\1bhhnh.exe105⤵PID:636
-
\??\c:\jjjdp.exec:\jjjdp.exe106⤵PID:4948
-
\??\c:\jpvvv.exec:\jpvvv.exe107⤵PID:5044
-
\??\c:\lxrlxrf.exec:\lxrlxrf.exe108⤵PID:2648
-
\??\c:\fxlfrlf.exec:\fxlfrlf.exe109⤵PID:2804
-
\??\c:\nbthtn.exec:\nbthtn.exe110⤵PID:1880
-
\??\c:\vvpdj.exec:\vvpdj.exe111⤵PID:2404
-
\??\c:\jpjdd.exec:\jpjdd.exe112⤵PID:2976
-
\??\c:\fxxlxrl.exec:\fxxlxrl.exe113⤵PID:4792
-
\??\c:\9llfrxr.exec:\9llfrxr.exe114⤵PID:2420
-
\??\c:\ntnhtn.exec:\ntnhtn.exe115⤵PID:772
-
\??\c:\bttnbb.exec:\bttnbb.exe116⤵PID:3964
-
\??\c:\jvvvp.exec:\jvvvp.exe117⤵PID:4844
-
\??\c:\flrxfxf.exec:\flrxfxf.exe118⤵PID:4568
-
\??\c:\7thbtn.exec:\7thbtn.exe119⤵PID:4908
-
\??\c:\tnhbhb.exec:\tnhbhb.exe120⤵PID:2948
-
\??\c:\7jjvv.exec:\7jjvv.exe121⤵PID:2124
-
\??\c:\vjpjv.exec:\vjpjv.exe122⤵PID:3568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-