Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 22:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3bba46ae74145985f6dbdd6f15dc4fc0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
3bba46ae74145985f6dbdd6f15dc4fc0_NeikiAnalytics.exe
-
Size
492KB
-
MD5
3bba46ae74145985f6dbdd6f15dc4fc0
-
SHA1
e90e93452cd80b2932eec666f30da5341354165f
-
SHA256
705588bb761a841f1c2759bcb821cccdd35fb32b5ac8a827cba6e7475eea54a6
-
SHA512
4103bb630a48555a974a3a88123bbde5e7bf80589fe59aa0ace5af6595c1312ec788ca433d465fee9935c9faf1b26c790919bfa212eadc40f238486e96e849f3
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq78yoyfx93svqTbWL5wEpOQ9DRRi:n3C9yMo+S0L9xRnoq7H9QYcmeN9D6
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3496-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1124-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/968-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/528-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3496 hhnntn.exe 3124 vpjjp.exe 4472 pjppp.exe 3368 7vdvv.exe 640 9dvpj.exe 1120 thhbbn.exe 400 ttnhnn.exe 4588 fxrlffx.exe 3936 hthbtt.exe 5020 lfxxrxx.exe 3672 tnhntb.exe 3544 1vpvp.exe 3636 flxrlfx.exe 2772 jvjvv.exe 5112 dpjdv.exe 2712 rfrlffx.exe 3144 pvdpv.exe 4400 fxrflxf.exe 1080 7bnnnn.exe 372 ffflxxl.exe 2216 pvjdj.exe 3300 fflfxxr.exe 1564 vppdv.exe 752 7ffxrll.exe 1124 rlrxrxr.exe 3532 tnhbhh.exe 4812 htbtbt.exe 4764 bbtbnt.exe 4848 5rlfxlr.exe 968 xfllfrl.exe 528 vpjvp.exe 3116 pvvdv.exe 4308 3hnhbb.exe 3216 vppjv.exe 4628 lrrlfrf.exe 4140 nnbbtb.exe 3188 vdjjj.exe 3484 frrlxrx.exe 1248 hbttnb.exe 1272 pjdvv.exe 976 thbnnt.exe 324 djvjj.exe 3912 rrrfxrr.exe 4020 hnhhbn.exe 2280 pjppp.exe 4784 rrfxllf.exe 2400 thbtbn.exe 1456 7vppj.exe 3936 lrfffxx.exe 2164 hntbtt.exe 5064 xxllflx.exe 3000 ttbhhn.exe 3544 dvdjd.exe 1756 tnntnb.exe 2768 jppvd.exe 440 fxxrllx.exe 4376 9hbnhh.exe 1172 dvppj.exe 3772 xflxrxf.exe 5108 thhhbt.exe 3280 bbthtt.exe 4172 1ddjp.exe 2264 9lxxffl.exe 1204 tbnnth.exe -
resource yara_rule behavioral2/memory/2808-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1124-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3532-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/968-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/528-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2808 wrote to memory of 3496 2808 3bba46ae74145985f6dbdd6f15dc4fc0_NeikiAnalytics.exe 82 PID 2808 wrote to memory of 3496 2808 3bba46ae74145985f6dbdd6f15dc4fc0_NeikiAnalytics.exe 82 PID 2808 wrote to memory of 3496 2808 3bba46ae74145985f6dbdd6f15dc4fc0_NeikiAnalytics.exe 82 PID 3496 wrote to memory of 3124 3496 hhnntn.exe 83 PID 3496 wrote to memory of 3124 3496 hhnntn.exe 83 PID 3496 wrote to memory of 3124 3496 hhnntn.exe 83 PID 3124 wrote to memory of 4472 3124 vpjjp.exe 84 PID 3124 wrote to memory of 4472 3124 vpjjp.exe 84 PID 3124 wrote to memory of 4472 3124 vpjjp.exe 84 PID 4472 wrote to memory of 3368 4472 pjppp.exe 85 PID 4472 wrote to memory of 3368 4472 pjppp.exe 85 PID 4472 wrote to memory of 3368 4472 pjppp.exe 85 PID 3368 wrote to memory of 640 3368 7vdvv.exe 86 PID 3368 wrote to memory of 640 3368 7vdvv.exe 86 PID 3368 wrote to memory of 640 3368 7vdvv.exe 86 PID 640 wrote to memory of 1120 640 9dvpj.exe 87 PID 640 wrote to memory of 1120 640 9dvpj.exe 87 PID 640 wrote to memory of 1120 640 9dvpj.exe 87 PID 1120 wrote to memory of 400 1120 thhbbn.exe 88 PID 1120 wrote to memory of 400 1120 thhbbn.exe 88 PID 1120 wrote to memory of 400 1120 thhbbn.exe 88 PID 400 wrote to memory of 4588 400 ttnhnn.exe 89 PID 400 wrote to memory of 4588 400 ttnhnn.exe 89 PID 400 wrote to memory of 4588 400 ttnhnn.exe 89 PID 4588 wrote to memory of 3936 4588 fxrlffx.exe 90 PID 4588 wrote to memory of 3936 4588 fxrlffx.exe 90 PID 4588 wrote to memory of 3936 4588 fxrlffx.exe 90 PID 3936 wrote to memory of 5020 3936 hthbtt.exe 91 PID 3936 wrote to memory of 5020 3936 hthbtt.exe 91 PID 3936 wrote to memory of 5020 3936 hthbtt.exe 91 PID 5020 wrote to memory of 3672 5020 lfxxrxx.exe 92 PID 5020 wrote to memory of 3672 5020 lfxxrxx.exe 92 PID 5020 wrote to memory of 3672 5020 lfxxrxx.exe 92 PID 3672 wrote to memory of 3544 3672 tnhntb.exe 93 PID 3672 wrote to memory of 3544 3672 tnhntb.exe 93 PID 3672 wrote to memory of 3544 3672 tnhntb.exe 93 PID 3544 wrote to memory of 3636 3544 1vpvp.exe 95 PID 3544 wrote to memory of 3636 3544 1vpvp.exe 95 PID 3544 wrote to memory of 3636 3544 1vpvp.exe 95 PID 3636 wrote to memory of 2772 3636 flxrlfx.exe 96 PID 3636 wrote to memory of 2772 3636 flxrlfx.exe 96 PID 3636 wrote to memory of 2772 3636 flxrlfx.exe 96 PID 2772 wrote to memory of 5112 2772 jvjvv.exe 97 PID 2772 wrote to memory of 5112 2772 jvjvv.exe 97 PID 2772 wrote to memory of 5112 2772 jvjvv.exe 97 PID 5112 wrote to memory of 2712 5112 dpjdv.exe 98 PID 5112 wrote to memory of 2712 5112 dpjdv.exe 98 PID 5112 wrote to memory of 2712 5112 dpjdv.exe 98 PID 2712 wrote to memory of 3144 2712 rfrlffx.exe 99 PID 2712 wrote to memory of 3144 2712 rfrlffx.exe 99 PID 2712 wrote to memory of 3144 2712 rfrlffx.exe 99 PID 3144 wrote to memory of 4400 3144 pvdpv.exe 100 PID 3144 wrote to memory of 4400 3144 pvdpv.exe 100 PID 3144 wrote to memory of 4400 3144 pvdpv.exe 100 PID 4400 wrote to memory of 1080 4400 fxrflxf.exe 101 PID 4400 wrote to memory of 1080 4400 fxrflxf.exe 101 PID 4400 wrote to memory of 1080 4400 fxrflxf.exe 101 PID 1080 wrote to memory of 372 1080 7bnnnn.exe 102 PID 1080 wrote to memory of 372 1080 7bnnnn.exe 102 PID 1080 wrote to memory of 372 1080 7bnnnn.exe 102 PID 372 wrote to memory of 2216 372 ffflxxl.exe 104 PID 372 wrote to memory of 2216 372 ffflxxl.exe 104 PID 372 wrote to memory of 2216 372 ffflxxl.exe 104 PID 2216 wrote to memory of 3300 2216 pvjdj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bba46ae74145985f6dbdd6f15dc4fc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bba46ae74145985f6dbdd6f15dc4fc0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\hhnntn.exec:\hhnntn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\vpjjp.exec:\vpjjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\pjppp.exec:\pjppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\7vdvv.exec:\7vdvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\9dvpj.exec:\9dvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\thhbbn.exec:\thhbbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\ttnhnn.exec:\ttnhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\fxrlffx.exec:\fxrlffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\hthbtt.exec:\hthbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\lfxxrxx.exec:\lfxxrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\tnhntb.exec:\tnhntb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\1vpvp.exec:\1vpvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\flxrlfx.exec:\flxrlfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\jvjvv.exec:\jvjvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\dpjdv.exec:\dpjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\rfrlffx.exec:\rfrlffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\pvdpv.exec:\pvdpv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\fxrflxf.exec:\fxrflxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\7bnnnn.exec:\7bnnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\ffflxxl.exec:\ffflxxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\pvjdj.exec:\pvjdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\fflfxxr.exec:\fflfxxr.exe23⤵
- Executes dropped EXE
PID:3300 -
\??\c:\vppdv.exec:\vppdv.exe24⤵
- Executes dropped EXE
PID:1564 -
\??\c:\7ffxrll.exec:\7ffxrll.exe25⤵
- Executes dropped EXE
PID:752 -
\??\c:\rlrxrxr.exec:\rlrxrxr.exe26⤵
- Executes dropped EXE
PID:1124 -
\??\c:\tnhbhh.exec:\tnhbhh.exe27⤵
- Executes dropped EXE
PID:3532 -
\??\c:\htbtbt.exec:\htbtbt.exe28⤵
- Executes dropped EXE
PID:4812 -
\??\c:\bbtbnt.exec:\bbtbnt.exe29⤵
- Executes dropped EXE
PID:4764 -
\??\c:\5rlfxlr.exec:\5rlfxlr.exe30⤵
- Executes dropped EXE
PID:4848 -
\??\c:\xfllfrl.exec:\xfllfrl.exe31⤵
- Executes dropped EXE
PID:968 -
\??\c:\vpjvp.exec:\vpjvp.exe32⤵
- Executes dropped EXE
PID:528 -
\??\c:\pvvdv.exec:\pvvdv.exe33⤵
- Executes dropped EXE
PID:3116 -
\??\c:\3hnhbb.exec:\3hnhbb.exe34⤵
- Executes dropped EXE
PID:4308 -
\??\c:\vppjv.exec:\vppjv.exe35⤵
- Executes dropped EXE
PID:3216 -
\??\c:\lrrlfrf.exec:\lrrlfrf.exe36⤵
- Executes dropped EXE
PID:4628 -
\??\c:\nnbbtb.exec:\nnbbtb.exe37⤵
- Executes dropped EXE
PID:4140 -
\??\c:\vdjjj.exec:\vdjjj.exe38⤵
- Executes dropped EXE
PID:3188 -
\??\c:\frrlxrx.exec:\frrlxrx.exe39⤵
- Executes dropped EXE
PID:3484 -
\??\c:\hbttnb.exec:\hbttnb.exe40⤵
- Executes dropped EXE
PID:1248 -
\??\c:\pjdvv.exec:\pjdvv.exe41⤵
- Executes dropped EXE
PID:1272 -
\??\c:\thbnnt.exec:\thbnnt.exe42⤵
- Executes dropped EXE
PID:976 -
\??\c:\djvjj.exec:\djvjj.exe43⤵
- Executes dropped EXE
PID:324 -
\??\c:\rrrfxrr.exec:\rrrfxrr.exe44⤵
- Executes dropped EXE
PID:3912 -
\??\c:\hnhhbn.exec:\hnhhbn.exe45⤵
- Executes dropped EXE
PID:4020 -
\??\c:\pjppp.exec:\pjppp.exe46⤵
- Executes dropped EXE
PID:2280 -
\??\c:\rrfxllf.exec:\rrfxllf.exe47⤵
- Executes dropped EXE
PID:4784 -
\??\c:\thbtbn.exec:\thbtbn.exe48⤵
- Executes dropped EXE
PID:2400 -
\??\c:\7vppj.exec:\7vppj.exe49⤵
- Executes dropped EXE
PID:1456 -
\??\c:\lrfffxx.exec:\lrfffxx.exe50⤵
- Executes dropped EXE
PID:3936 -
\??\c:\hntbtt.exec:\hntbtt.exe51⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xxllflx.exec:\xxllflx.exe52⤵
- Executes dropped EXE
PID:5064 -
\??\c:\ttbhhn.exec:\ttbhhn.exe53⤵
- Executes dropped EXE
PID:3000 -
\??\c:\dvdjd.exec:\dvdjd.exe54⤵
- Executes dropped EXE
PID:3544 -
\??\c:\tnntnb.exec:\tnntnb.exe55⤵
- Executes dropped EXE
PID:1756 -
\??\c:\jppvd.exec:\jppvd.exe56⤵
- Executes dropped EXE
PID:2768 -
\??\c:\fxxrllx.exec:\fxxrllx.exe57⤵
- Executes dropped EXE
PID:440 -
\??\c:\9hbnhh.exec:\9hbnhh.exe58⤵
- Executes dropped EXE
PID:4376 -
\??\c:\dvppj.exec:\dvppj.exe59⤵
- Executes dropped EXE
PID:1172 -
\??\c:\xflxrxf.exec:\xflxrxf.exe60⤵
- Executes dropped EXE
PID:3772 -
\??\c:\thhhbt.exec:\thhhbt.exe61⤵
- Executes dropped EXE
PID:5108 -
\??\c:\bbthtt.exec:\bbthtt.exe62⤵
- Executes dropped EXE
PID:3280 -
\??\c:\1ddjp.exec:\1ddjp.exe63⤵
- Executes dropped EXE
PID:4172 -
\??\c:\9lxxffl.exec:\9lxxffl.exe64⤵
- Executes dropped EXE
PID:2264 -
\??\c:\tbnnth.exec:\tbnnth.exe65⤵
- Executes dropped EXE
PID:1204 -
\??\c:\dpvvd.exec:\dpvvd.exe66⤵PID:2892
-
\??\c:\xrxrfrf.exec:\xrxrfrf.exe67⤵PID:2192
-
\??\c:\nbhhhh.exec:\nbhhhh.exe68⤵PID:4952
-
\??\c:\jppdv.exec:\jppdv.exe69⤵PID:4028
-
\??\c:\xxflfxr.exec:\xxflfxr.exe70⤵PID:3296
-
\??\c:\9tbbth.exec:\9tbbth.exe71⤵PID:2716
-
\??\c:\jjvpv.exec:\jjvpv.exe72⤵PID:2848
-
\??\c:\3lxxrxl.exec:\3lxxrxl.exe73⤵PID:3384
-
\??\c:\tnbtbh.exec:\tnbtbh.exe74⤵PID:2440
-
\??\c:\7vdvd.exec:\7vdvd.exe75⤵PID:3748
-
\??\c:\rrxxfll.exec:\rrxxfll.exe76⤵PID:1860
-
\??\c:\5nbbtb.exec:\5nbbtb.exe77⤵PID:2808
-
\??\c:\3jdjp.exec:\3jdjp.exe78⤵PID:5116
-
\??\c:\nnnnbt.exec:\nnnnbt.exe79⤵PID:2292
-
\??\c:\tnbhtn.exec:\tnbhtn.exe80⤵PID:3436
-
\??\c:\xxrfxlx.exec:\xxrfxlx.exe81⤵PID:2812
-
\??\c:\xxfxfxl.exec:\xxfxfxl.exe82⤵PID:2300
-
\??\c:\htbtnn.exec:\htbtnn.exe83⤵PID:324
-
\??\c:\3pvpp.exec:\3pvpp.exe84⤵PID:3912
-
\??\c:\flxrxfr.exec:\flxrxfr.exe85⤵PID:3800
-
\??\c:\tbhbtn.exec:\tbhbtn.exe86⤵PID:4784
-
\??\c:\3jpjv.exec:\3jpjv.exe87⤵PID:2400
-
\??\c:\xrflfrf.exec:\xrflfrf.exe88⤵PID:812
-
\??\c:\bhhtht.exec:\bhhtht.exe89⤵PID:5020
-
\??\c:\dpdjj.exec:\dpdjj.exe90⤵PID:4580
-
\??\c:\nbbbnh.exec:\nbbbnh.exe91⤵PID:3064
-
\??\c:\5vppj.exec:\5vppj.exe92⤵PID:2720
-
\??\c:\fxlrflf.exec:\fxlrflf.exe93⤵PID:3544
-
\??\c:\thnhhn.exec:\thnhhn.exe94⤵PID:3628
-
\??\c:\jjddp.exec:\jjddp.exe95⤵PID:5112
-
\??\c:\frxxxff.exec:\frxxxff.exe96⤵PID:4528
-
\??\c:\btttbb.exec:\btttbb.exe97⤵PID:1644
-
\??\c:\jpvvj.exec:\jpvvj.exe98⤵PID:1716
-
\??\c:\rrrrlrr.exec:\rrrrlrr.exe99⤵PID:4332
-
\??\c:\bbnnnt.exec:\bbnnnt.exe100⤵PID:5004
-
\??\c:\jjjjj.exec:\jjjjj.exe101⤵PID:5072
-
\??\c:\lrfrlfr.exec:\lrfrlfr.exe102⤵PID:1320
-
\??\c:\hhthnh.exec:\hhthnh.exe103⤵PID:1744
-
\??\c:\djdjv.exec:\djdjv.exe104⤵PID:3828
-
\??\c:\nhnhbb.exec:\nhnhbb.exe105⤵PID:2640
-
\??\c:\vdvvj.exec:\vdvvj.exe106⤵PID:5040
-
\??\c:\xllxllx.exec:\xllxllx.exe107⤵PID:4288
-
\??\c:\nthhhn.exec:\nthhhn.exe108⤵PID:2212
-
\??\c:\ddddj.exec:\ddddj.exe109⤵PID:3296
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe110⤵PID:4264
-
\??\c:\bbthht.exec:\bbthht.exe111⤵PID:2848
-
\??\c:\5vddd.exec:\5vddd.exe112⤵PID:3384
-
\??\c:\xxlrrrr.exec:\xxlrrrr.exe113⤵PID:528
-
\??\c:\htnnnt.exec:\htnnnt.exe114⤵PID:4300
-
\??\c:\htbtnn.exec:\htbtnn.exe115⤵PID:4084
-
\??\c:\9rllrxf.exec:\9rllrxf.exe116⤵PID:3216
-
\??\c:\btnhnh.exec:\btnhnh.exe117⤵PID:4204
-
\??\c:\pdpjv.exec:\pdpjv.exe118⤵PID:4472
-
\??\c:\llffxxx.exec:\llffxxx.exe119⤵PID:3220
-
\??\c:\bntttn.exec:\bntttn.exe120⤵PID:976
-
\??\c:\jpjvj.exec:\jpjvj.exe121⤵PID:544
-
\??\c:\rrxrrlf.exec:\rrxrrlf.exe122⤵PID:1920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-