Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 10:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
acc861445e790fc70af211a6a4667690_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
acc861445e790fc70af211a6a4667690_NeikiAnalytics.exe
-
Size
55KB
-
MD5
acc861445e790fc70af211a6a4667690
-
SHA1
4fdab77dc296262dc6a5b3e1a5dc2017a10a0532
-
SHA256
d43ee8db0c00cf4f6fd95be4090150de1ef4aeb6a29ed36e8aa5e590962e6719
-
SHA512
d869597dabd334ef95ed1a1204cec3b13b08f78b681954510e20ec25ad00524a70efc3cc51903d9383a40a70f8e90ef7e6e2d247b3da2ff56982e557093d511d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb6tZ9bm:ymb3NkkiQ3mdBjFIb6tZNm
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4236-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1728-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/844-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2600-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1264-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2656-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/904-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2196 vvvjd.exe 1728 lrlrrlf.exe 4444 5lxxffl.exe 844 ttbbth.exe 2344 rxlfxfx.exe 1504 5hnhbb.exe 4220 dppvd.exe 2664 djjdj.exe 3056 nbhhhb.exe 3640 lflfffl.exe 3492 jpvvj.exe 3252 3htbbn.exe 2600 jjpjj.exe 384 lflfxxx.exe 1768 hhtnnb.exe 1264 pvjdp.exe 4400 vvpjp.exe 2656 xfrxffr.exe 904 tnhbtb.exe 4536 pdjjv.exe 4092 lflfxfx.exe 3192 nhttnn.exe 1784 3jdjd.exe 1580 rrrxlrl.exe 2920 fffffff.exe 4248 nnttbb.exe 3652 ttnhbb.exe 3300 dvdvp.exe 2340 nhhhbb.exe 2792 bbthht.exe 1824 vpjpv.exe 4540 lxxrfrf.exe 756 bbhhnt.exe 784 1vdpv.exe 4768 5jpvv.exe 1876 lxxllrx.exe 1240 ttbbbn.exe 4384 bbbbnt.exe 2444 jjpjd.exe 116 rxflfrx.exe 4564 nbbbnn.exe 1172 pvppd.exe 4416 ppdvd.exe 4844 xlfxfrr.exe 1760 bnbtnt.exe 856 vjjvj.exe 4748 rrxlfxx.exe 3284 nnbbbh.exe 4824 dvvpj.exe 1404 xlxflfr.exe 4628 xxlrxlr.exe 2704 1nttbh.exe 692 jjvpp.exe 1928 xflfxxx.exe 1992 rfllrlx.exe 4100 5nnnhh.exe 1600 bbbbtt.exe 1092 dpppp.exe 3740 xrrlllf.exe 5008 rrrllfx.exe 2268 tnhttb.exe 4288 dvdvj.exe 4024 jvjjj.exe 5104 flrxrrr.exe -
resource yara_rule behavioral2/memory/4236-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2600-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/384-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1264-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/904-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4236 wrote to memory of 2196 4236 acc861445e790fc70af211a6a4667690_NeikiAnalytics.exe 83 PID 4236 wrote to memory of 2196 4236 acc861445e790fc70af211a6a4667690_NeikiAnalytics.exe 83 PID 4236 wrote to memory of 2196 4236 acc861445e790fc70af211a6a4667690_NeikiAnalytics.exe 83 PID 2196 wrote to memory of 1728 2196 vvvjd.exe 85 PID 2196 wrote to memory of 1728 2196 vvvjd.exe 85 PID 2196 wrote to memory of 1728 2196 vvvjd.exe 85 PID 1728 wrote to memory of 4444 1728 lrlrrlf.exe 86 PID 1728 wrote to memory of 4444 1728 lrlrrlf.exe 86 PID 1728 wrote to memory of 4444 1728 lrlrrlf.exe 86 PID 4444 wrote to memory of 844 4444 5lxxffl.exe 87 PID 4444 wrote to memory of 844 4444 5lxxffl.exe 87 PID 4444 wrote to memory of 844 4444 5lxxffl.exe 87 PID 844 wrote to memory of 2344 844 ttbbth.exe 88 PID 844 wrote to memory of 2344 844 ttbbth.exe 88 PID 844 wrote to memory of 2344 844 ttbbth.exe 88 PID 2344 wrote to memory of 1504 2344 rxlfxfx.exe 90 PID 2344 wrote to memory of 1504 2344 rxlfxfx.exe 90 PID 2344 wrote to memory of 1504 2344 rxlfxfx.exe 90 PID 1504 wrote to memory of 4220 1504 5hnhbb.exe 91 PID 1504 wrote to memory of 4220 1504 5hnhbb.exe 91 PID 1504 wrote to memory of 4220 1504 5hnhbb.exe 91 PID 4220 wrote to memory of 2664 4220 dppvd.exe 92 PID 4220 wrote to memory of 2664 4220 dppvd.exe 92 PID 4220 wrote to memory of 2664 4220 dppvd.exe 92 PID 2664 wrote to memory of 3056 2664 djjdj.exe 93 PID 2664 wrote to memory of 3056 2664 djjdj.exe 93 PID 2664 wrote to memory of 3056 2664 djjdj.exe 93 PID 3056 wrote to memory of 3640 3056 nbhhhb.exe 94 PID 3056 wrote to memory of 3640 3056 nbhhhb.exe 94 PID 3056 wrote to memory of 3640 3056 nbhhhb.exe 94 PID 3640 wrote to memory of 3492 3640 lflfffl.exe 95 PID 3640 wrote to memory of 3492 3640 lflfffl.exe 95 PID 3640 wrote to memory of 3492 3640 lflfffl.exe 95 PID 3492 wrote to memory of 3252 3492 jpvvj.exe 96 PID 3492 wrote to memory of 3252 3492 jpvvj.exe 96 PID 3492 wrote to memory of 3252 3492 jpvvj.exe 96 PID 3252 wrote to memory of 2600 3252 3htbbn.exe 97 PID 3252 wrote to memory of 2600 3252 3htbbn.exe 97 PID 3252 wrote to memory of 2600 3252 3htbbn.exe 97 PID 2600 wrote to memory of 384 2600 jjpjj.exe 98 PID 2600 wrote to memory of 384 2600 jjpjj.exe 98 PID 2600 wrote to memory of 384 2600 jjpjj.exe 98 PID 384 wrote to memory of 1768 384 lflfxxx.exe 99 PID 384 wrote to memory of 1768 384 lflfxxx.exe 99 PID 384 wrote to memory of 1768 384 lflfxxx.exe 99 PID 1768 wrote to memory of 1264 1768 hhtnnb.exe 100 PID 1768 wrote to memory of 1264 1768 hhtnnb.exe 100 PID 1768 wrote to memory of 1264 1768 hhtnnb.exe 100 PID 1264 wrote to memory of 4400 1264 pvjdp.exe 101 PID 1264 wrote to memory of 4400 1264 pvjdp.exe 101 PID 1264 wrote to memory of 4400 1264 pvjdp.exe 101 PID 4400 wrote to memory of 2656 4400 vvpjp.exe 102 PID 4400 wrote to memory of 2656 4400 vvpjp.exe 102 PID 4400 wrote to memory of 2656 4400 vvpjp.exe 102 PID 2656 wrote to memory of 904 2656 xfrxffr.exe 103 PID 2656 wrote to memory of 904 2656 xfrxffr.exe 103 PID 2656 wrote to memory of 904 2656 xfrxffr.exe 103 PID 904 wrote to memory of 4536 904 tnhbtb.exe 104 PID 904 wrote to memory of 4536 904 tnhbtb.exe 104 PID 904 wrote to memory of 4536 904 tnhbtb.exe 104 PID 4536 wrote to memory of 4092 4536 pdjjv.exe 105 PID 4536 wrote to memory of 4092 4536 pdjjv.exe 105 PID 4536 wrote to memory of 4092 4536 pdjjv.exe 105 PID 4092 wrote to memory of 3192 4092 lflfxfx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\acc861445e790fc70af211a6a4667690_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\acc861445e790fc70af211a6a4667690_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\vvvjd.exec:\vvvjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\lrlrrlf.exec:\lrlrrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\5lxxffl.exec:\5lxxffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\ttbbth.exec:\ttbbth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\rxlfxfx.exec:\rxlfxfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\5hnhbb.exec:\5hnhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\dppvd.exec:\dppvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\djjdj.exec:\djjdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\nbhhhb.exec:\nbhhhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\lflfffl.exec:\lflfffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\jpvvj.exec:\jpvvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\3htbbn.exec:\3htbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\jjpjj.exec:\jjpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\lflfxxx.exec:\lflfxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\hhtnnb.exec:\hhtnnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\pvjdp.exec:\pvjdp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\vvpjp.exec:\vvpjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\xfrxffr.exec:\xfrxffr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\tnhbtb.exec:\tnhbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
\??\c:\pdjjv.exec:\pdjjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\lflfxfx.exec:\lflfxfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\nhttnn.exec:\nhttnn.exe23⤵
- Executes dropped EXE
PID:3192 -
\??\c:\3jdjd.exec:\3jdjd.exe24⤵
- Executes dropped EXE
PID:1784 -
\??\c:\rrrxlrl.exec:\rrrxlrl.exe25⤵
- Executes dropped EXE
PID:1580 -
\??\c:\fffffff.exec:\fffffff.exe26⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nnttbb.exec:\nnttbb.exe27⤵
- Executes dropped EXE
PID:4248 -
\??\c:\ttnhbb.exec:\ttnhbb.exe28⤵
- Executes dropped EXE
PID:3652 -
\??\c:\dvdvp.exec:\dvdvp.exe29⤵
- Executes dropped EXE
PID:3300 -
\??\c:\nhhhbb.exec:\nhhhbb.exe30⤵
- Executes dropped EXE
PID:2340 -
\??\c:\bbthht.exec:\bbthht.exe31⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vpjpv.exec:\vpjpv.exe32⤵
- Executes dropped EXE
PID:1824 -
\??\c:\lxxrfrf.exec:\lxxrfrf.exe33⤵
- Executes dropped EXE
PID:4540 -
\??\c:\bbhhnt.exec:\bbhhnt.exe34⤵
- Executes dropped EXE
PID:756 -
\??\c:\1vdpv.exec:\1vdpv.exe35⤵
- Executes dropped EXE
PID:784 -
\??\c:\5jpvv.exec:\5jpvv.exe36⤵
- Executes dropped EXE
PID:4768 -
\??\c:\lxxllrx.exec:\lxxllrx.exe37⤵
- Executes dropped EXE
PID:1876 -
\??\c:\ttbbbn.exec:\ttbbbn.exe38⤵
- Executes dropped EXE
PID:1240 -
\??\c:\bbbbnt.exec:\bbbbnt.exe39⤵
- Executes dropped EXE
PID:4384 -
\??\c:\jjpjd.exec:\jjpjd.exe40⤵
- Executes dropped EXE
PID:2444 -
\??\c:\rxflfrx.exec:\rxflfrx.exe41⤵
- Executes dropped EXE
PID:116 -
\??\c:\nbbbnn.exec:\nbbbnn.exe42⤵
- Executes dropped EXE
PID:4564 -
\??\c:\pvppd.exec:\pvppd.exe43⤵
- Executes dropped EXE
PID:1172 -
\??\c:\ppdvd.exec:\ppdvd.exe44⤵
- Executes dropped EXE
PID:4416 -
\??\c:\xlfxfrr.exec:\xlfxfrr.exe45⤵
- Executes dropped EXE
PID:4844 -
\??\c:\bnbtnt.exec:\bnbtnt.exe46⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vjjvj.exec:\vjjvj.exe47⤵
- Executes dropped EXE
PID:856 -
\??\c:\rrxlfxx.exec:\rrxlfxx.exe48⤵
- Executes dropped EXE
PID:4748 -
\??\c:\nnbbbh.exec:\nnbbbh.exe49⤵
- Executes dropped EXE
PID:3284 -
\??\c:\dvvpj.exec:\dvvpj.exe50⤵
- Executes dropped EXE
PID:4824 -
\??\c:\xlxflfr.exec:\xlxflfr.exe51⤵
- Executes dropped EXE
PID:1404 -
\??\c:\xxlrxlr.exec:\xxlrxlr.exe52⤵
- Executes dropped EXE
PID:4628 -
\??\c:\1nttbh.exec:\1nttbh.exe53⤵
- Executes dropped EXE
PID:2704 -
\??\c:\jjvpp.exec:\jjvpp.exe54⤵
- Executes dropped EXE
PID:692 -
\??\c:\xflfxxx.exec:\xflfxxx.exe55⤵
- Executes dropped EXE
PID:1928 -
\??\c:\rfllrlx.exec:\rfllrlx.exe56⤵
- Executes dropped EXE
PID:1992 -
\??\c:\5nnnhh.exec:\5nnnhh.exe57⤵
- Executes dropped EXE
PID:4100 -
\??\c:\bbbbtt.exec:\bbbbtt.exe58⤵
- Executes dropped EXE
PID:1600 -
\??\c:\dpppp.exec:\dpppp.exe59⤵
- Executes dropped EXE
PID:1092 -
\??\c:\xrrlllf.exec:\xrrlllf.exe60⤵
- Executes dropped EXE
PID:3740 -
\??\c:\rrrllfx.exec:\rrrllfx.exe61⤵
- Executes dropped EXE
PID:5008 -
\??\c:\tnhttb.exec:\tnhttb.exe62⤵
- Executes dropped EXE
PID:2268 -
\??\c:\dvdvj.exec:\dvdvj.exe63⤵
- Executes dropped EXE
PID:4288 -
\??\c:\jvjjj.exec:\jvjjj.exe64⤵
- Executes dropped EXE
PID:4024 -
\??\c:\flrxrrr.exec:\flrxrrr.exe65⤵
- Executes dropped EXE
PID:5104 -
\??\c:\3bnnhn.exec:\3bnnhn.exe66⤵PID:1484
-
\??\c:\bnnhnt.exec:\bnnhnt.exe67⤵PID:4536
-
\??\c:\vdvpp.exec:\vdvpp.exe68⤵PID:912
-
\??\c:\rlxffrr.exec:\rlxffrr.exe69⤵PID:3012
-
\??\c:\frxrxfr.exec:\frxrxfr.exe70⤵PID:3800
-
\??\c:\9bnthh.exec:\9bnthh.exe71⤵PID:2760
-
\??\c:\pvdpv.exec:\pvdpv.exe72⤵PID:2100
-
\??\c:\ddjjd.exec:\ddjjd.exe73⤵PID:4776
-
\??\c:\flxfffx.exec:\flxfffx.exe74⤵PID:4528
-
\??\c:\frlfrfl.exec:\frlfrfl.exe75⤵PID:4252
-
\??\c:\tbtthh.exec:\tbtthh.exe76⤵PID:1348
-
\??\c:\jdvpd.exec:\jdvpd.exe77⤵PID:2700
-
\??\c:\pdppp.exec:\pdppp.exe78⤵PID:4956
-
\??\c:\frfrrrr.exec:\frfrrrr.exe79⤵PID:2528
-
\??\c:\nhttnb.exec:\nhttnb.exe80⤵PID:60
-
\??\c:\tbnhhn.exec:\tbnhhn.exe81⤵PID:612
-
\??\c:\vpvvd.exec:\vpvvd.exe82⤵PID:4144
-
\??\c:\vpvvp.exec:\vpvvp.exe83⤵PID:3908
-
\??\c:\3frxfxx.exec:\3frxfxx.exe84⤵PID:2548
-
\??\c:\bnbhtt.exec:\bnbhtt.exe85⤵PID:2500
-
\??\c:\hnthnh.exec:\hnthnh.exe86⤵PID:4044
-
\??\c:\dpppp.exec:\dpppp.exe87⤵PID:212
-
\??\c:\frfxxxx.exec:\frfxxxx.exe88⤵PID:4384
-
\??\c:\lrxrrfl.exec:\lrxrrfl.exe89⤵PID:3108
-
\??\c:\bhhhnt.exec:\bhhhnt.exe90⤵PID:1124
-
\??\c:\jpddj.exec:\jpddj.exe91⤵PID:740
-
\??\c:\rrllffl.exec:\rrllffl.exe92⤵PID:448
-
\??\c:\btnbth.exec:\btnbth.exe93⤵PID:3976
-
\??\c:\nhbtnh.exec:\nhbtnh.exe94⤵PID:5012
-
\??\c:\rrlrfrx.exec:\rrlrfrx.exe95⤵PID:1908
-
\??\c:\nhttbh.exec:\nhttbh.exe96⤵PID:2264
-
\??\c:\tnbtnh.exec:\tnbtnh.exe97⤵PID:2344
-
\??\c:\vvvjj.exec:\vvvjj.exe98⤵PID:4872
-
\??\c:\rxxxrll.exec:\rxxxrll.exe99⤵PID:1344
-
\??\c:\bnthtn.exec:\bnthtn.exe100⤵PID:3668
-
\??\c:\ppvdv.exec:\ppvdv.exe101⤵PID:2108
-
\??\c:\djdpd.exec:\djdpd.exe102⤵PID:5044
-
\??\c:\7xrrrrr.exec:\7xrrrrr.exe103⤵PID:3104
-
\??\c:\lllllrf.exec:\lllllrf.exe104⤵PID:1928
-
\??\c:\hhntbh.exec:\hhntbh.exe105⤵PID:3592
-
\??\c:\bnhbtt.exec:\bnhbtt.exe106⤵PID:1708
-
\??\c:\pdvpp.exec:\pdvpp.exe107⤵PID:412
-
\??\c:\flrlffx.exec:\flrlffx.exe108⤵PID:1592
-
\??\c:\nbnbnh.exec:\nbnbnh.exe109⤵PID:1892
-
\??\c:\1jjpj.exec:\1jjpj.exe110⤵PID:1352
-
\??\c:\vvdvp.exec:\vvdvp.exe111⤵PID:468
-
\??\c:\xxfrrlx.exec:\xxfrrlx.exe112⤵PID:4468
-
\??\c:\xrxfffx.exec:\xrxfffx.exe113⤵PID:2308
-
\??\c:\hhhhhh.exec:\hhhhhh.exe114⤵PID:1484
-
\??\c:\djdvp.exec:\djdvp.exe115⤵PID:392
-
\??\c:\jjppj.exec:\jjppj.exe116⤵PID:5000
-
\??\c:\xrlfflr.exec:\xrlfflr.exe117⤵PID:3012
-
\??\c:\nbnhhh.exec:\nbnhhh.exe118⤵PID:5064
-
\??\c:\nhhhbn.exec:\nhhhbn.exe119⤵PID:3944
-
\??\c:\dvjjp.exec:\dvjjp.exe120⤵PID:3900
-
\??\c:\9lxffxr.exec:\9lxffxr.exe121⤵PID:4248
-
\??\c:\lfllflf.exec:\lfllflf.exe122⤵PID:4528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-