Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 08:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b310a3112037b2c29616794ef38c7cb0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
b310a3112037b2c29616794ef38c7cb0_NeikiAnalytics.exe
-
Size
94KB
-
MD5
b310a3112037b2c29616794ef38c7cb0
-
SHA1
1402c309b452483d85bd45de33059b9c5ffcb6ea
-
SHA256
d29cd5748d7a37dd1a328b05d047f232fbaf4456c3bb0685f0c0f76eb37759cd
-
SHA512
8ce2243dd1d9af736c04e46b5bddd967df979463f6f7d3090b413a4f1eb8d23b56d08377a738d8038258610803e3a75319880c7fb578ec24eb13d47ff1a29e7e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JxJAg8dtB:ymb3NkkiQ3mdBjFIWeFGyAsJAg2B
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/1028-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/812-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2076-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/532-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/460-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/364-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 812 vjppj.exe 8 pjjdv.exe 4368 rlxrlff.exe 4560 9nbbtt.exe 4996 pjddd.exe 3220 3btttb.exe 4004 bhnhhh.exe 3920 pdjjj.exe 2096 7bhbht.exe 2416 9nbbtt.exe 2076 5vvvv.exe 676 fffffff.exe 1368 hhbtnh.exe 3580 dddvv.exe 532 jvddd.exe 460 hhbbtb.exe 1896 nhnhhh.exe 3052 vpvpj.exe 3188 7flfllx.exe 3256 tttnnt.exe 3324 vvddj.exe 2488 9lfxrxx.exe 4812 rxllxfl.exe 4388 hhhnhh.exe 364 vpdvj.exe 4724 xrxxfll.exe 5068 bbbbbb.exe 2872 jdddd.exe 2556 7rrrxfx.exe 2044 llfllxr.exe 4536 hbnnnn.exe 824 jdpvv.exe 784 7vddd.exe 4352 rrfxffr.exe 3792 1xfffrr.exe 3128 hhnbtb.exe 5112 7pvvj.exe 4372 ddpjv.exe 4300 lxfxxfx.exe 1072 5ttthn.exe 3592 ntbbbh.exe 2400 7jpvp.exe 768 jdvvd.exe 216 xrrlllf.exe 4940 rffffff.exe 2404 nnnbbn.exe 1056 ttnnnn.exe 1528 9pvpj.exe 3928 pdvdv.exe 3044 xxfxxxx.exe 2968 rfrrlll.exe 2904 nntbbn.exe 4648 ttnhhn.exe 3784 7djdd.exe 4208 lfrxlrf.exe 3672 lrflxxf.exe 3780 1hhhhh.exe 4548 nbtnhh.exe 676 7jjjd.exe 4904 ddddd.exe 2500 lxflfff.exe 4772 ttnttt.exe 4932 btttnb.exe 2364 3dvpj.exe -
resource yara_rule behavioral2/memory/1028-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/812-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/532-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/460-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/364-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1028 wrote to memory of 812 1028 b310a3112037b2c29616794ef38c7cb0_NeikiAnalytics.exe 82 PID 1028 wrote to memory of 812 1028 b310a3112037b2c29616794ef38c7cb0_NeikiAnalytics.exe 82 PID 1028 wrote to memory of 812 1028 b310a3112037b2c29616794ef38c7cb0_NeikiAnalytics.exe 82 PID 812 wrote to memory of 8 812 vjppj.exe 83 PID 812 wrote to memory of 8 812 vjppj.exe 83 PID 812 wrote to memory of 8 812 vjppj.exe 83 PID 8 wrote to memory of 4368 8 pjjdv.exe 84 PID 8 wrote to memory of 4368 8 pjjdv.exe 84 PID 8 wrote to memory of 4368 8 pjjdv.exe 84 PID 4368 wrote to memory of 4560 4368 rlxrlff.exe 85 PID 4368 wrote to memory of 4560 4368 rlxrlff.exe 85 PID 4368 wrote to memory of 4560 4368 rlxrlff.exe 85 PID 4560 wrote to memory of 4996 4560 9nbbtt.exe 86 PID 4560 wrote to memory of 4996 4560 9nbbtt.exe 86 PID 4560 wrote to memory of 4996 4560 9nbbtt.exe 86 PID 4996 wrote to memory of 3220 4996 pjddd.exe 87 PID 4996 wrote to memory of 3220 4996 pjddd.exe 87 PID 4996 wrote to memory of 3220 4996 pjddd.exe 87 PID 3220 wrote to memory of 4004 3220 3btttb.exe 88 PID 3220 wrote to memory of 4004 3220 3btttb.exe 88 PID 3220 wrote to memory of 4004 3220 3btttb.exe 88 PID 4004 wrote to memory of 3920 4004 bhnhhh.exe 89 PID 4004 wrote to memory of 3920 4004 bhnhhh.exe 89 PID 4004 wrote to memory of 3920 4004 bhnhhh.exe 89 PID 3920 wrote to memory of 2096 3920 pdjjj.exe 90 PID 3920 wrote to memory of 2096 3920 pdjjj.exe 90 PID 3920 wrote to memory of 2096 3920 pdjjj.exe 90 PID 2096 wrote to memory of 2416 2096 7bhbht.exe 91 PID 2096 wrote to memory of 2416 2096 7bhbht.exe 91 PID 2096 wrote to memory of 2416 2096 7bhbht.exe 91 PID 2416 wrote to memory of 2076 2416 9nbbtt.exe 93 PID 2416 wrote to memory of 2076 2416 9nbbtt.exe 93 PID 2416 wrote to memory of 2076 2416 9nbbtt.exe 93 PID 2076 wrote to memory of 676 2076 5vvvv.exe 94 PID 2076 wrote to memory of 676 2076 5vvvv.exe 94 PID 2076 wrote to memory of 676 2076 5vvvv.exe 94 PID 676 wrote to memory of 1368 676 fffffff.exe 95 PID 676 wrote to memory of 1368 676 fffffff.exe 95 PID 676 wrote to memory of 1368 676 fffffff.exe 95 PID 1368 wrote to memory of 3580 1368 hhbtnh.exe 96 PID 1368 wrote to memory of 3580 1368 hhbtnh.exe 96 PID 1368 wrote to memory of 3580 1368 hhbtnh.exe 96 PID 3580 wrote to memory of 532 3580 dddvv.exe 97 PID 3580 wrote to memory of 532 3580 dddvv.exe 97 PID 3580 wrote to memory of 532 3580 dddvv.exe 97 PID 532 wrote to memory of 460 532 jvddd.exe 99 PID 532 wrote to memory of 460 532 jvddd.exe 99 PID 532 wrote to memory of 460 532 jvddd.exe 99 PID 460 wrote to memory of 1896 460 hhbbtb.exe 100 PID 460 wrote to memory of 1896 460 hhbbtb.exe 100 PID 460 wrote to memory of 1896 460 hhbbtb.exe 100 PID 1896 wrote to memory of 3052 1896 nhnhhh.exe 101 PID 1896 wrote to memory of 3052 1896 nhnhhh.exe 101 PID 1896 wrote to memory of 3052 1896 nhnhhh.exe 101 PID 3052 wrote to memory of 3188 3052 vpvpj.exe 102 PID 3052 wrote to memory of 3188 3052 vpvpj.exe 102 PID 3052 wrote to memory of 3188 3052 vpvpj.exe 102 PID 3188 wrote to memory of 3256 3188 7flfllx.exe 103 PID 3188 wrote to memory of 3256 3188 7flfllx.exe 103 PID 3188 wrote to memory of 3256 3188 7flfllx.exe 103 PID 3256 wrote to memory of 3324 3256 tttnnt.exe 104 PID 3256 wrote to memory of 3324 3256 tttnnt.exe 104 PID 3256 wrote to memory of 3324 3256 tttnnt.exe 104 PID 3324 wrote to memory of 2488 3324 vvddj.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\b310a3112037b2c29616794ef38c7cb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b310a3112037b2c29616794ef38c7cb0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\vjppj.exec:\vjppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\pjjdv.exec:\pjjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\rlxrlff.exec:\rlxrlff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\9nbbtt.exec:\9nbbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\pjddd.exec:\pjddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\3btttb.exec:\3btttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\bhnhhh.exec:\bhnhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\pdjjj.exec:\pdjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\7bhbht.exec:\7bhbht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\9nbbtt.exec:\9nbbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\5vvvv.exec:\5vvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\fffffff.exec:\fffffff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\hhbtnh.exec:\hhbtnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\dddvv.exec:\dddvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\jvddd.exec:\jvddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\hhbbtb.exec:\hhbbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
\??\c:\nhnhhh.exec:\nhnhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\vpvpj.exec:\vpvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\7flfllx.exec:\7flfllx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\tttnnt.exec:\tttnnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\vvddj.exec:\vvddj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\9lfxrxx.exec:\9lfxrxx.exe23⤵
- Executes dropped EXE
PID:2488 -
\??\c:\rxllxfl.exec:\rxllxfl.exe24⤵
- Executes dropped EXE
PID:4812 -
\??\c:\hhhnhh.exec:\hhhnhh.exe25⤵
- Executes dropped EXE
PID:4388 -
\??\c:\vpdvj.exec:\vpdvj.exe26⤵
- Executes dropped EXE
PID:364 -
\??\c:\xrxxfll.exec:\xrxxfll.exe27⤵
- Executes dropped EXE
PID:4724 -
\??\c:\bbbbbb.exec:\bbbbbb.exe28⤵
- Executes dropped EXE
PID:5068 -
\??\c:\jdddd.exec:\jdddd.exe29⤵
- Executes dropped EXE
PID:2872 -
\??\c:\7rrrxfx.exec:\7rrrxfx.exe30⤵
- Executes dropped EXE
PID:2556 -
\??\c:\llfllxr.exec:\llfllxr.exe31⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hbnnnn.exec:\hbnnnn.exe32⤵
- Executes dropped EXE
PID:4536 -
\??\c:\jdpvv.exec:\jdpvv.exe33⤵
- Executes dropped EXE
PID:824 -
\??\c:\7vddd.exec:\7vddd.exe34⤵
- Executes dropped EXE
PID:784 -
\??\c:\rrfxffr.exec:\rrfxffr.exe35⤵
- Executes dropped EXE
PID:4352 -
\??\c:\1xfffrr.exec:\1xfffrr.exe36⤵
- Executes dropped EXE
PID:3792 -
\??\c:\hhnbtb.exec:\hhnbtb.exe37⤵
- Executes dropped EXE
PID:3128 -
\??\c:\7pvvj.exec:\7pvvj.exe38⤵
- Executes dropped EXE
PID:5112 -
\??\c:\ddpjv.exec:\ddpjv.exe39⤵
- Executes dropped EXE
PID:4372 -
\??\c:\lxfxxfx.exec:\lxfxxfx.exe40⤵
- Executes dropped EXE
PID:4300 -
\??\c:\5ttthn.exec:\5ttthn.exe41⤵
- Executes dropped EXE
PID:1072 -
\??\c:\ntbbbh.exec:\ntbbbh.exe42⤵
- Executes dropped EXE
PID:3592 -
\??\c:\7jpvp.exec:\7jpvp.exe43⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jdvvd.exec:\jdvvd.exe44⤵
- Executes dropped EXE
PID:768 -
\??\c:\xrrlllf.exec:\xrrlllf.exe45⤵
- Executes dropped EXE
PID:216 -
\??\c:\rffffff.exec:\rffffff.exe46⤵
- Executes dropped EXE
PID:4940 -
\??\c:\nnnbbn.exec:\nnnbbn.exe47⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ttnnnn.exec:\ttnnnn.exe48⤵
- Executes dropped EXE
PID:1056 -
\??\c:\9pvpj.exec:\9pvpj.exe49⤵
- Executes dropped EXE
PID:1528 -
\??\c:\pdvdv.exec:\pdvdv.exe50⤵
- Executes dropped EXE
PID:3928 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe51⤵
- Executes dropped EXE
PID:3044 -
\??\c:\rfrrlll.exec:\rfrrlll.exe52⤵
- Executes dropped EXE
PID:2968 -
\??\c:\nntbbn.exec:\nntbbn.exe53⤵
- Executes dropped EXE
PID:2904 -
\??\c:\ttnhhn.exec:\ttnhhn.exe54⤵
- Executes dropped EXE
PID:4648 -
\??\c:\7djdd.exec:\7djdd.exe55⤵
- Executes dropped EXE
PID:3784 -
\??\c:\lfrxlrf.exec:\lfrxlrf.exe56⤵
- Executes dropped EXE
PID:4208 -
\??\c:\lrflxxf.exec:\lrflxxf.exe57⤵
- Executes dropped EXE
PID:3672 -
\??\c:\1hhhhh.exec:\1hhhhh.exe58⤵
- Executes dropped EXE
PID:3780 -
\??\c:\nbtnhh.exec:\nbtnhh.exe59⤵
- Executes dropped EXE
PID:4548 -
\??\c:\7jjjd.exec:\7jjjd.exe60⤵
- Executes dropped EXE
PID:676 -
\??\c:\ddddd.exec:\ddddd.exe61⤵
- Executes dropped EXE
PID:4904 -
\??\c:\lxflfff.exec:\lxflfff.exe62⤵
- Executes dropped EXE
PID:2500 -
\??\c:\ttnttt.exec:\ttnttt.exe63⤵
- Executes dropped EXE
PID:4772 -
\??\c:\btttnb.exec:\btttnb.exe64⤵
- Executes dropped EXE
PID:4932 -
\??\c:\3dvpj.exec:\3dvpj.exe65⤵
- Executes dropped EXE
PID:2364 -
\??\c:\pjpjd.exec:\pjpjd.exe66⤵PID:2924
-
\??\c:\rfrxrxx.exec:\rfrxrxx.exe67⤵PID:2316
-
\??\c:\lfxxfff.exec:\lfxxfff.exe68⤵PID:972
-
\??\c:\thnnhn.exec:\thnnhn.exe69⤵PID:2748
-
\??\c:\hbhhhh.exec:\hbhhhh.exe70⤵PID:1348
-
\??\c:\ddpdj.exec:\ddpdj.exe71⤵PID:2152
-
\??\c:\7rrlffx.exec:\7rrlffx.exe72⤵PID:1232
-
\??\c:\xlrrfxx.exec:\xlrrfxx.exe73⤵PID:1792
-
\??\c:\bttttb.exec:\bttttb.exe74⤵PID:3316
-
\??\c:\1ntnbb.exec:\1ntnbb.exe75⤵PID:2216
-
\??\c:\ddjjv.exec:\ddjjv.exe76⤵PID:364
-
\??\c:\lfflffx.exec:\lfflffx.exe77⤵PID:4140
-
\??\c:\rfllfxx.exec:\rfllfxx.exe78⤵PID:3144
-
\??\c:\hbhttt.exec:\hbhttt.exe79⤵PID:2844
-
\??\c:\jddjv.exec:\jddjv.exe80⤵PID:1316
-
\??\c:\llxxxll.exec:\llxxxll.exe81⤵PID:2900
-
\??\c:\hbtnhh.exec:\hbtnhh.exe82⤵PID:4424
-
\??\c:\jdppv.exec:\jdppv.exe83⤵PID:680
-
\??\c:\ppvpj.exec:\ppvpj.exe84⤵PID:1096
-
\??\c:\lfxrlrl.exec:\lfxrlrl.exe85⤵PID:3524
-
\??\c:\nnhnnt.exec:\nnhnnt.exe86⤵PID:4824
-
\??\c:\9dvpj.exec:\9dvpj.exe87⤵PID:60
-
\??\c:\jvdvj.exec:\jvdvj.exe88⤵PID:3740
-
\??\c:\rllflll.exec:\rllflll.exe89⤵PID:4568
-
\??\c:\rlllfff.exec:\rlllfff.exe90⤵PID:1776
-
\??\c:\nbthtn.exec:\nbthtn.exe91⤵PID:780
-
\??\c:\vpdvp.exec:\vpdvp.exe92⤵PID:4952
-
\??\c:\vpjjj.exec:\vpjjj.exe93⤵PID:4336
-
\??\c:\rlrlfff.exec:\rlrlfff.exe94⤵PID:768
-
\??\c:\btbnnb.exec:\btbnnb.exe95⤵PID:5028
-
\??\c:\pdjjj.exec:\pdjjj.exe96⤵PID:3152
-
\??\c:\vvjpv.exec:\vvjpv.exe97⤵PID:3884
-
\??\c:\fflfrrr.exec:\fflfrrr.exe98⤵PID:864
-
\??\c:\tntnhh.exec:\tntnhh.exe99⤵PID:3220
-
\??\c:\htttbt.exec:\htttbt.exe100⤵PID:2688
-
\??\c:\dddvv.exec:\dddvv.exe101⤵PID:1644
-
\??\c:\ddpdv.exec:\ddpdv.exe102⤵PID:2712
-
\??\c:\rxfffff.exec:\rxfffff.exe103⤵PID:4648
-
\??\c:\bbbbtn.exec:\bbbbtn.exe104⤵PID:3784
-
\??\c:\hhbtbb.exec:\hhbtbb.exe105⤵PID:4208
-
\??\c:\3dpjd.exec:\3dpjd.exe106⤵PID:2076
-
\??\c:\dvjjd.exec:\dvjjd.exe107⤵PID:3184
-
\??\c:\rlxrllf.exec:\rlxrllf.exe108⤵PID:636
-
\??\c:\nnnhnt.exec:\nnnhnt.exe109⤵PID:1368
-
\??\c:\nbbbbb.exec:\nbbbbb.exe110⤵PID:2372
-
\??\c:\jdjjd.exec:\jdjjd.exe111⤵PID:2964
-
\??\c:\vppjd.exec:\vppjd.exe112⤵PID:1536
-
\??\c:\llfxxxf.exec:\llfxxxf.exe113⤵PID:2584
-
\??\c:\9frflrr.exec:\9frflrr.exe114⤵PID:1896
-
\??\c:\btbbnt.exec:\btbbnt.exe115⤵PID:2480
-
\??\c:\hntnnn.exec:\hntnnn.exe116⤵PID:4440
-
\??\c:\jdpjp.exec:\jdpjp.exe117⤵PID:4992
-
\??\c:\jdjdv.exec:\jdjdv.exe118⤵PID:2848
-
\??\c:\frxrxrr.exec:\frxrxrr.exe119⤵PID:1544
-
\??\c:\1lllffx.exec:\1lllffx.exe120⤵PID:1232
-
\??\c:\tthbhh.exec:\tthbhh.exe121⤵PID:1168
-
\??\c:\dpppd.exec:\dpppd.exe122⤵PID:5088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-