Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 21:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04126c7ea86c6e4bd4eeb1c1bb76ab20_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
04126c7ea86c6e4bd4eeb1c1bb76ab20_NeikiAnalytics.exe
-
Size
386KB
-
MD5
04126c7ea86c6e4bd4eeb1c1bb76ab20
-
SHA1
32a03d9db20f3f9882e3ebff7eb312eef0cba6ca
-
SHA256
787be39de0f4656ebb9786c640468107462e1bae0e7c5e2765d6fa11d0ab0991
-
SHA512
9401fb71cf37e28e37083bb579f9024171899f8ea729406ea38564571f2057a5c1080d53c3cc8d60102c904de9fbdd1cc15f947dd3c899b2dc8d91838093d519
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwthl:n3C9uYA7okVqdKwaO5CVMhl
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4012-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1484-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2160-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2600-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4856 vppjv.exe 4424 tntttt.exe 2044 9pdjj.exe 3032 3lfxrxf.exe 4284 nntbtn.exe 3448 jddjd.exe 1484 lrlrflx.exe 1756 nhnnhh.exe 448 djjdv.exe 1944 lxflllf.exe 4752 pvpdd.exe 4812 7fffllf.exe 2160 9llfxxr.exe 3696 7nnhbt.exe 3648 jjpdv.exe 2524 lxfffff.exe 1688 rxfxxxx.exe 2216 tttbtn.exe 3652 jvddv.exe 1368 lxrxlxf.exe 2600 btntnn.exe 1968 bthbbh.exe 4384 jjjdj.exe 640 jjdvp.exe 788 5lrffll.exe 4576 3ddvv.exe 2856 flrllll.exe 912 dpdvp.exe 3524 fffxrrl.exe 3508 bbbtnh.exe 728 ddddv.exe 5100 rlxrrrl.exe 4328 nnnnnn.exe 8 jjjjd.exe 1280 frffllf.exe 4484 7bnhtt.exe 4380 pvjpp.exe 3380 3xxrfxr.exe 2424 rllxfrr.exe 956 1thtth.exe 2084 jppjd.exe 4180 7ffxffl.exe 2880 fxxxrrf.exe 1668 nhnnhh.exe 560 5vvpj.exe 1640 lffxrll.exe 1484 nnhtbn.exe 3076 vjjjd.exe 1756 rlfxrlf.exe 4512 hbnhbb.exe 3140 vvdpj.exe 3016 lrxlllf.exe 1804 5rxrlfl.exe 4348 1bttnn.exe 4812 dvdvd.exe 2980 xxrllfr.exe 2960 lrflrrx.exe 4824 ttbbbb.exe 732 vvjdd.exe 4960 dddvp.exe 2604 fffxlrl.exe 4128 9nhnnt.exe 808 hbnhbb.exe 4868 9jjdv.exe -
resource yara_rule behavioral2/memory/4012-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1484-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2600-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4012 wrote to memory of 4856 4012 04126c7ea86c6e4bd4eeb1c1bb76ab20_NeikiAnalytics.exe 81 PID 4012 wrote to memory of 4856 4012 04126c7ea86c6e4bd4eeb1c1bb76ab20_NeikiAnalytics.exe 81 PID 4012 wrote to memory of 4856 4012 04126c7ea86c6e4bd4eeb1c1bb76ab20_NeikiAnalytics.exe 81 PID 4856 wrote to memory of 4424 4856 vppjv.exe 82 PID 4856 wrote to memory of 4424 4856 vppjv.exe 82 PID 4856 wrote to memory of 4424 4856 vppjv.exe 82 PID 4424 wrote to memory of 2044 4424 tntttt.exe 84 PID 4424 wrote to memory of 2044 4424 tntttt.exe 84 PID 4424 wrote to memory of 2044 4424 tntttt.exe 84 PID 2044 wrote to memory of 3032 2044 9pdjj.exe 85 PID 2044 wrote to memory of 3032 2044 9pdjj.exe 85 PID 2044 wrote to memory of 3032 2044 9pdjj.exe 85 PID 3032 wrote to memory of 4284 3032 3lfxrxf.exe 88 PID 3032 wrote to memory of 4284 3032 3lfxrxf.exe 88 PID 3032 wrote to memory of 4284 3032 3lfxrxf.exe 88 PID 4284 wrote to memory of 3448 4284 nntbtn.exe 89 PID 4284 wrote to memory of 3448 4284 nntbtn.exe 89 PID 4284 wrote to memory of 3448 4284 nntbtn.exe 89 PID 3448 wrote to memory of 1484 3448 jddjd.exe 90 PID 3448 wrote to memory of 1484 3448 jddjd.exe 90 PID 3448 wrote to memory of 1484 3448 jddjd.exe 90 PID 1484 wrote to memory of 1756 1484 lrlrflx.exe 91 PID 1484 wrote to memory of 1756 1484 lrlrflx.exe 91 PID 1484 wrote to memory of 1756 1484 lrlrflx.exe 91 PID 1756 wrote to memory of 448 1756 nhnnhh.exe 92 PID 1756 wrote to memory of 448 1756 nhnnhh.exe 92 PID 1756 wrote to memory of 448 1756 nhnnhh.exe 92 PID 448 wrote to memory of 1944 448 djjdv.exe 93 PID 448 wrote to memory of 1944 448 djjdv.exe 93 PID 448 wrote to memory of 1944 448 djjdv.exe 93 PID 1944 wrote to memory of 4752 1944 lxflllf.exe 94 PID 1944 wrote to memory of 4752 1944 lxflllf.exe 94 PID 1944 wrote to memory of 4752 1944 lxflllf.exe 94 PID 4752 wrote to memory of 4812 4752 pvpdd.exe 95 PID 4752 wrote to memory of 4812 4752 pvpdd.exe 95 PID 4752 wrote to memory of 4812 4752 pvpdd.exe 95 PID 4812 wrote to memory of 2160 4812 7fffllf.exe 96 PID 4812 wrote to memory of 2160 4812 7fffllf.exe 96 PID 4812 wrote to memory of 2160 4812 7fffllf.exe 96 PID 2160 wrote to memory of 3696 2160 9llfxxr.exe 97 PID 2160 wrote to memory of 3696 2160 9llfxxr.exe 97 PID 2160 wrote to memory of 3696 2160 9llfxxr.exe 97 PID 3696 wrote to memory of 3648 3696 7nnhbt.exe 98 PID 3696 wrote to memory of 3648 3696 7nnhbt.exe 98 PID 3696 wrote to memory of 3648 3696 7nnhbt.exe 98 PID 3648 wrote to memory of 2524 3648 jjpdv.exe 99 PID 3648 wrote to memory of 2524 3648 jjpdv.exe 99 PID 3648 wrote to memory of 2524 3648 jjpdv.exe 99 PID 2524 wrote to memory of 1688 2524 lxfffff.exe 100 PID 2524 wrote to memory of 1688 2524 lxfffff.exe 100 PID 2524 wrote to memory of 1688 2524 lxfffff.exe 100 PID 1688 wrote to memory of 2216 1688 rxfxxxx.exe 102 PID 1688 wrote to memory of 2216 1688 rxfxxxx.exe 102 PID 1688 wrote to memory of 2216 1688 rxfxxxx.exe 102 PID 2216 wrote to memory of 3652 2216 tttbtn.exe 103 PID 2216 wrote to memory of 3652 2216 tttbtn.exe 103 PID 2216 wrote to memory of 3652 2216 tttbtn.exe 103 PID 3652 wrote to memory of 1368 3652 jvddv.exe 104 PID 3652 wrote to memory of 1368 3652 jvddv.exe 104 PID 3652 wrote to memory of 1368 3652 jvddv.exe 104 PID 1368 wrote to memory of 2600 1368 lxrxlxf.exe 105 PID 1368 wrote to memory of 2600 1368 lxrxlxf.exe 105 PID 1368 wrote to memory of 2600 1368 lxrxlxf.exe 105 PID 2600 wrote to memory of 1968 2600 btntnn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\04126c7ea86c6e4bd4eeb1c1bb76ab20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\04126c7ea86c6e4bd4eeb1c1bb76ab20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\vppjv.exec:\vppjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\tntttt.exec:\tntttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\9pdjj.exec:\9pdjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\3lfxrxf.exec:\3lfxrxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\nntbtn.exec:\nntbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\jddjd.exec:\jddjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\lrlrflx.exec:\lrlrflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\nhnnhh.exec:\nhnnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\djjdv.exec:\djjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\lxflllf.exec:\lxflllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\pvpdd.exec:\pvpdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\7fffllf.exec:\7fffllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\9llfxxr.exec:\9llfxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\7nnhbt.exec:\7nnhbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\jjpdv.exec:\jjpdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\lxfffff.exec:\lxfffff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\rxfxxxx.exec:\rxfxxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\tttbtn.exec:\tttbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\jvddv.exec:\jvddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\lxrxlxf.exec:\lxrxlxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\btntnn.exec:\btntnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\bthbbh.exec:\bthbbh.exe23⤵
- Executes dropped EXE
PID:1968 -
\??\c:\jjjdj.exec:\jjjdj.exe24⤵
- Executes dropped EXE
PID:4384 -
\??\c:\jjdvp.exec:\jjdvp.exe25⤵
- Executes dropped EXE
PID:640 -
\??\c:\5lrffll.exec:\5lrffll.exe26⤵
- Executes dropped EXE
PID:788 -
\??\c:\3ddvv.exec:\3ddvv.exe27⤵
- Executes dropped EXE
PID:4576 -
\??\c:\flrllll.exec:\flrllll.exe28⤵
- Executes dropped EXE
PID:2856 -
\??\c:\dpdvp.exec:\dpdvp.exe29⤵
- Executes dropped EXE
PID:912 -
\??\c:\fffxrrl.exec:\fffxrrl.exe30⤵
- Executes dropped EXE
PID:3524 -
\??\c:\bbbtnh.exec:\bbbtnh.exe31⤵
- Executes dropped EXE
PID:3508 -
\??\c:\ddddv.exec:\ddddv.exe32⤵
- Executes dropped EXE
PID:728 -
\??\c:\rlxrrrl.exec:\rlxrrrl.exe33⤵
- Executes dropped EXE
PID:5100 -
\??\c:\nnnnnn.exec:\nnnnnn.exe34⤵
- Executes dropped EXE
PID:4328 -
\??\c:\jjjjd.exec:\jjjjd.exe35⤵
- Executes dropped EXE
PID:8 -
\??\c:\frffllf.exec:\frffllf.exe36⤵
- Executes dropped EXE
PID:1280 -
\??\c:\7bnhtt.exec:\7bnhtt.exe37⤵
- Executes dropped EXE
PID:4484 -
\??\c:\pvjpp.exec:\pvjpp.exe38⤵
- Executes dropped EXE
PID:4380 -
\??\c:\3xxrfxr.exec:\3xxrfxr.exe39⤵
- Executes dropped EXE
PID:3380 -
\??\c:\rllxfrr.exec:\rllxfrr.exe40⤵
- Executes dropped EXE
PID:2424 -
\??\c:\1thtth.exec:\1thtth.exe41⤵
- Executes dropped EXE
PID:956 -
\??\c:\jppjd.exec:\jppjd.exe42⤵
- Executes dropped EXE
PID:2084 -
\??\c:\7ffxffl.exec:\7ffxffl.exe43⤵
- Executes dropped EXE
PID:4180 -
\??\c:\fxxxrrf.exec:\fxxxrrf.exe44⤵
- Executes dropped EXE
PID:2880 -
\??\c:\nhnnhh.exec:\nhnnhh.exe45⤵
- Executes dropped EXE
PID:1668 -
\??\c:\5vvpj.exec:\5vvpj.exe46⤵
- Executes dropped EXE
PID:560 -
\??\c:\lffxrll.exec:\lffxrll.exe47⤵
- Executes dropped EXE
PID:1640 -
\??\c:\nnhtbn.exec:\nnhtbn.exe48⤵
- Executes dropped EXE
PID:1484 -
\??\c:\vjjjd.exec:\vjjjd.exe49⤵
- Executes dropped EXE
PID:3076 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe50⤵
- Executes dropped EXE
PID:1756 -
\??\c:\hbnhbb.exec:\hbnhbb.exe51⤵
- Executes dropped EXE
PID:4512 -
\??\c:\vvdpj.exec:\vvdpj.exe52⤵
- Executes dropped EXE
PID:3140 -
\??\c:\lrxlllf.exec:\lrxlllf.exe53⤵
- Executes dropped EXE
PID:3016 -
\??\c:\5rxrlfl.exec:\5rxrlfl.exe54⤵
- Executes dropped EXE
PID:1804 -
\??\c:\1bttnn.exec:\1bttnn.exe55⤵
- Executes dropped EXE
PID:4348 -
\??\c:\dvdvd.exec:\dvdvd.exe56⤵
- Executes dropped EXE
PID:4812 -
\??\c:\xxrllfr.exec:\xxrllfr.exe57⤵
- Executes dropped EXE
PID:2980 -
\??\c:\lrflrrx.exec:\lrflrrx.exe58⤵
- Executes dropped EXE
PID:2960 -
\??\c:\ttbbbb.exec:\ttbbbb.exe59⤵
- Executes dropped EXE
PID:4824 -
\??\c:\vvjdd.exec:\vvjdd.exe60⤵
- Executes dropped EXE
PID:732 -
\??\c:\dddvp.exec:\dddvp.exe61⤵
- Executes dropped EXE
PID:4960 -
\??\c:\fffxlrl.exec:\fffxlrl.exe62⤵
- Executes dropped EXE
PID:2604 -
\??\c:\9nhnnt.exec:\9nhnnt.exe63⤵
- Executes dropped EXE
PID:4128 -
\??\c:\hbnhbb.exec:\hbnhbb.exe64⤵
- Executes dropped EXE
PID:808 -
\??\c:\9jjdv.exec:\9jjdv.exe65⤵
- Executes dropped EXE
PID:4868 -
\??\c:\rxlllll.exec:\rxlllll.exe66⤵PID:4420
-
\??\c:\tnhhbh.exec:\tnhhbh.exe67⤵PID:1932
-
\??\c:\nhhhbh.exec:\nhhhbh.exe68⤵PID:4368
-
\??\c:\9djdj.exec:\9djdj.exe69⤵PID:404
-
\??\c:\rlxxlll.exec:\rlxxlll.exe70⤵PID:2040
-
\??\c:\lxfxllf.exec:\lxfxllf.exe71⤵PID:632
-
\??\c:\7hnntb.exec:\7hnntb.exe72⤵PID:1664
-
\??\c:\nnbtbb.exec:\nnbtbb.exe73⤵PID:2664
-
\??\c:\3bnhhh.exec:\3bnhhh.exe74⤵PID:1892
-
\??\c:\vvvvv.exec:\vvvvv.exe75⤵PID:4532
-
\??\c:\rrrlrff.exec:\rrrlrff.exe76⤵PID:3248
-
\??\c:\bnnbbb.exec:\bnnbbb.exe77⤵PID:2200
-
\??\c:\jvpjd.exec:\jvpjd.exe78⤵PID:3656
-
\??\c:\fxlfllf.exec:\fxlfllf.exe79⤵PID:744
-
\??\c:\xrlxlrl.exec:\xrlxlrl.exe80⤵PID:3112
-
\??\c:\tnhbbb.exec:\tnhbbb.exe81⤵PID:5100
-
\??\c:\5vdvv.exec:\5vdvv.exe82⤵PID:2392
-
\??\c:\fxxrxrr.exec:\fxxrxrr.exe83⤵PID:416
-
\??\c:\bnnhbt.exec:\bnnhbt.exe84⤵PID:3676
-
\??\c:\bnbbhn.exec:\bnbbhn.exe85⤵PID:4484
-
\??\c:\vpvpp.exec:\vpvpp.exe86⤵PID:4396
-
\??\c:\frffffl.exec:\frffffl.exe87⤵PID:4488
-
\??\c:\btbbtt.exec:\btbbtt.exe88⤵PID:1016
-
\??\c:\vdppj.exec:\vdppj.exe89⤵PID:956
-
\??\c:\pvjvd.exec:\pvjvd.exe90⤵PID:3232
-
\??\c:\rrlfllx.exec:\rrlfllx.exe91⤵PID:3032
-
\??\c:\btbbbt.exec:\btbbbt.exe92⤵PID:2880
-
\??\c:\bbhbtt.exec:\bbhbtt.exe93⤵PID:1668
-
\??\c:\7pppj.exec:\7pppj.exe94⤵PID:3828
-
\??\c:\5flxrrl.exec:\5flxrrl.exe95⤵PID:1800
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe96⤵PID:1484
-
\??\c:\9nbtnt.exec:\9nbtnt.exe97⤵PID:2000
-
\??\c:\djvpp.exec:\djvpp.exe98⤵PID:3352
-
\??\c:\pdjpp.exec:\pdjpp.exe99⤵PID:1944
-
\??\c:\rllflfr.exec:\rllflfr.exe100⤵PID:4752
-
\??\c:\hhbbbt.exec:\hhbbbt.exe101⤵PID:3016
-
\??\c:\vdpjd.exec:\vdpjd.exe102⤵PID:2940
-
\??\c:\5jpjd.exec:\5jpjd.exe103⤵PID:852
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe104⤵PID:2980
-
\??\c:\bbtttt.exec:\bbtttt.exe105⤵PID:2960
-
\??\c:\vvvjd.exec:\vvvjd.exe106⤵PID:3328
-
\??\c:\xxfxrlx.exec:\xxfxrlx.exe107⤵PID:4760
-
\??\c:\3hthbt.exec:\3hthbt.exe108⤵PID:2292
-
\??\c:\bnttnt.exec:\bnttnt.exe109⤵PID:2604
-
\??\c:\vjppp.exec:\vjppp.exe110⤵PID:4128
-
\??\c:\lfrlllf.exec:\lfrlllf.exe111⤵PID:3292
-
\??\c:\tntnnh.exec:\tntnnh.exe112⤵PID:3280
-
\??\c:\tbhhbn.exec:\tbhhbn.exe113⤵PID:4420
-
\??\c:\djddd.exec:\djddd.exe114⤵PID:4092
-
\??\c:\lrrxlxr.exec:\lrrxlxr.exe115⤵PID:4368
-
\??\c:\bhhhbb.exec:\bhhhbb.exe116⤵PID:404
-
\??\c:\hbnbtb.exec:\hbnbtb.exe117⤵PID:1044
-
\??\c:\vvvpj.exec:\vvvpj.exe118⤵PID:4168
-
\??\c:\rffxrlf.exec:\rffxrlf.exe119⤵PID:1664
-
\??\c:\rfllffx.exec:\rfllffx.exe120⤵PID:2856
-
\??\c:\tnbtnh.exec:\tnbtnh.exe121⤵PID:1892
-
\??\c:\btbtnn.exec:\btbtnn.exe122⤵PID:4532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-