Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 00:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6a1e3d17615b8623fceed72ca9a4a300_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
6a1e3d17615b8623fceed72ca9a4a300_NeikiAnalytics.exe
-
Size
63KB
-
MD5
6a1e3d17615b8623fceed72ca9a4a300
-
SHA1
b2f84f6cacfa23e5397dab8cb99545c111894a34
-
SHA256
82a5ec6481688837741cb774d8fb5099c37fe854fddfda4ca90a6e321b65e551
-
SHA512
faf5b8fa73ab68d175d890c70880fc600668f868d324c3c258b8ebf396b51e92941282a7bf1fe471ceab679d6b3c78b82b2c96a1046e04e0b14fc2a9f0c71081
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUwco5:ymb3NkkiQ3mdBjF0yjco5
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/1812-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-24-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3532-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3808-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1904 xlrlfff.exe 3920 bthbtb.exe 4296 btbbnn.exe 3532 vjpjd.exe 3272 vdjjd.exe 4980 tbbttn.exe 1696 hhhthn.exe 208 jvdvv.exe 2636 lffxrrl.exe 3260 tntthh.exe 4056 ffrlrxf.exe 2168 thnnnt.exe 3208 vjjjd.exe 2768 fxxrfxr.exe 4228 rlrllll.exe 4652 nhtntb.exe 784 5ddvp.exe 5044 7lrrffl.exe 2852 hbnhht.exe 1412 9hbtnh.exe 4748 dpppv.exe 4492 lflfxxf.exe 1996 bbhhbb.exe 3004 jjjdd.exe 4856 3pjdj.exe 4068 rfxrlxx.exe 4720 hnntbh.exe 3808 7bttnh.exe 4704 jpjvj.exe 920 rxxxrrr.exe 2936 rrrrllf.exe 1228 hbttnn.exe 3976 jpvjv.exe 960 frlfxxr.exe 4700 fxllllf.exe 1992 1bbtnn.exe 1068 tbbbtb.exe 4216 vdjvp.exe 2224 1jjpd.exe 1528 flxrxxr.exe 1508 bbtttt.exe 1904 jjppj.exe 2840 7pddp.exe 1612 9flfrrr.exe 3720 7lrrlrl.exe 2560 thhhhh.exe 4964 hhttnn.exe 3472 ddpjd.exe 3544 rrxrlrl.exe 1940 bnnttb.exe 4040 jjpjj.exe 3260 ppppj.exe 3904 rxffrxf.exe 3264 nntttt.exe 3236 hbhhtb.exe 2652 dpvjd.exe 316 5llfxfx.exe 3204 fxffrrf.exe 1416 bhntbt.exe 3140 3bnhhn.exe 2020 dvdvv.exe 1488 jvvpj.exe 2096 lfxrrxr.exe 812 lfxxrrr.exe -
resource yara_rule behavioral2/memory/1812-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3532-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1696-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1812 wrote to memory of 1904 1812 6a1e3d17615b8623fceed72ca9a4a300_NeikiAnalytics.exe 82 PID 1812 wrote to memory of 1904 1812 6a1e3d17615b8623fceed72ca9a4a300_NeikiAnalytics.exe 82 PID 1812 wrote to memory of 1904 1812 6a1e3d17615b8623fceed72ca9a4a300_NeikiAnalytics.exe 82 PID 1904 wrote to memory of 3920 1904 xlrlfff.exe 83 PID 1904 wrote to memory of 3920 1904 xlrlfff.exe 83 PID 1904 wrote to memory of 3920 1904 xlrlfff.exe 83 PID 3920 wrote to memory of 4296 3920 bthbtb.exe 84 PID 3920 wrote to memory of 4296 3920 bthbtb.exe 84 PID 3920 wrote to memory of 4296 3920 bthbtb.exe 84 PID 4296 wrote to memory of 3532 4296 btbbnn.exe 85 PID 4296 wrote to memory of 3532 4296 btbbnn.exe 85 PID 4296 wrote to memory of 3532 4296 btbbnn.exe 85 PID 3532 wrote to memory of 3272 3532 vjpjd.exe 86 PID 3532 wrote to memory of 3272 3532 vjpjd.exe 86 PID 3532 wrote to memory of 3272 3532 vjpjd.exe 86 PID 3272 wrote to memory of 4980 3272 vdjjd.exe 87 PID 3272 wrote to memory of 4980 3272 vdjjd.exe 87 PID 3272 wrote to memory of 4980 3272 vdjjd.exe 87 PID 4980 wrote to memory of 1696 4980 tbbttn.exe 88 PID 4980 wrote to memory of 1696 4980 tbbttn.exe 88 PID 4980 wrote to memory of 1696 4980 tbbttn.exe 88 PID 1696 wrote to memory of 208 1696 hhhthn.exe 89 PID 1696 wrote to memory of 208 1696 hhhthn.exe 89 PID 1696 wrote to memory of 208 1696 hhhthn.exe 89 PID 208 wrote to memory of 2636 208 jvdvv.exe 90 PID 208 wrote to memory of 2636 208 jvdvv.exe 90 PID 208 wrote to memory of 2636 208 jvdvv.exe 90 PID 2636 wrote to memory of 3260 2636 lffxrrl.exe 91 PID 2636 wrote to memory of 3260 2636 lffxrrl.exe 91 PID 2636 wrote to memory of 3260 2636 lffxrrl.exe 91 PID 3260 wrote to memory of 4056 3260 tntthh.exe 92 PID 3260 wrote to memory of 4056 3260 tntthh.exe 92 PID 3260 wrote to memory of 4056 3260 tntthh.exe 92 PID 4056 wrote to memory of 2168 4056 ffrlrxf.exe 93 PID 4056 wrote to memory of 2168 4056 ffrlrxf.exe 93 PID 4056 wrote to memory of 2168 4056 ffrlrxf.exe 93 PID 2168 wrote to memory of 3208 2168 thnnnt.exe 94 PID 2168 wrote to memory of 3208 2168 thnnnt.exe 94 PID 2168 wrote to memory of 3208 2168 thnnnt.exe 94 PID 3208 wrote to memory of 2768 3208 vjjjd.exe 95 PID 3208 wrote to memory of 2768 3208 vjjjd.exe 95 PID 3208 wrote to memory of 2768 3208 vjjjd.exe 95 PID 2768 wrote to memory of 4228 2768 fxxrfxr.exe 96 PID 2768 wrote to memory of 4228 2768 fxxrfxr.exe 96 PID 2768 wrote to memory of 4228 2768 fxxrfxr.exe 96 PID 4228 wrote to memory of 4652 4228 rlrllll.exe 97 PID 4228 wrote to memory of 4652 4228 rlrllll.exe 97 PID 4228 wrote to memory of 4652 4228 rlrllll.exe 97 PID 4652 wrote to memory of 784 4652 nhtntb.exe 98 PID 4652 wrote to memory of 784 4652 nhtntb.exe 98 PID 4652 wrote to memory of 784 4652 nhtntb.exe 98 PID 784 wrote to memory of 5044 784 5ddvp.exe 99 PID 784 wrote to memory of 5044 784 5ddvp.exe 99 PID 784 wrote to memory of 5044 784 5ddvp.exe 99 PID 5044 wrote to memory of 2852 5044 7lrrffl.exe 100 PID 5044 wrote to memory of 2852 5044 7lrrffl.exe 100 PID 5044 wrote to memory of 2852 5044 7lrrffl.exe 100 PID 2852 wrote to memory of 1412 2852 hbnhht.exe 101 PID 2852 wrote to memory of 1412 2852 hbnhht.exe 101 PID 2852 wrote to memory of 1412 2852 hbnhht.exe 101 PID 1412 wrote to memory of 4748 1412 9hbtnh.exe 102 PID 1412 wrote to memory of 4748 1412 9hbtnh.exe 102 PID 1412 wrote to memory of 4748 1412 9hbtnh.exe 102 PID 4748 wrote to memory of 4492 4748 dpppv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a1e3d17615b8623fceed72ca9a4a300_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6a1e3d17615b8623fceed72ca9a4a300_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\xlrlfff.exec:\xlrlfff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\bthbtb.exec:\bthbtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\btbbnn.exec:\btbbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\vjpjd.exec:\vjpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\vdjjd.exec:\vdjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\tbbttn.exec:\tbbttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\hhhthn.exec:\hhhthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\jvdvv.exec:\jvdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\lffxrrl.exec:\lffxrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\tntthh.exec:\tntthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\ffrlrxf.exec:\ffrlrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\thnnnt.exec:\thnnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\vjjjd.exec:\vjjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\fxxrfxr.exec:\fxxrfxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\rlrllll.exec:\rlrllll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\nhtntb.exec:\nhtntb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\5ddvp.exec:\5ddvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\7lrrffl.exec:\7lrrffl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\hbnhht.exec:\hbnhht.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\9hbtnh.exec:\9hbtnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\dpppv.exec:\dpppv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\lflfxxf.exec:\lflfxxf.exe23⤵
- Executes dropped EXE
PID:4492 -
\??\c:\bbhhbb.exec:\bbhhbb.exe24⤵
- Executes dropped EXE
PID:1996 -
\??\c:\jjjdd.exec:\jjjdd.exe25⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3pjdj.exec:\3pjdj.exe26⤵
- Executes dropped EXE
PID:4856 -
\??\c:\rfxrlxx.exec:\rfxrlxx.exe27⤵
- Executes dropped EXE
PID:4068 -
\??\c:\hnntbh.exec:\hnntbh.exe28⤵
- Executes dropped EXE
PID:4720 -
\??\c:\7bttnh.exec:\7bttnh.exe29⤵
- Executes dropped EXE
PID:3808 -
\??\c:\jpjvj.exec:\jpjvj.exe30⤵
- Executes dropped EXE
PID:4704 -
\??\c:\rxxxrrr.exec:\rxxxrrr.exe31⤵
- Executes dropped EXE
PID:920 -
\??\c:\rrrrllf.exec:\rrrrllf.exe32⤵
- Executes dropped EXE
PID:2936 -
\??\c:\hbttnn.exec:\hbttnn.exe33⤵
- Executes dropped EXE
PID:1228 -
\??\c:\jpvjv.exec:\jpvjv.exe34⤵
- Executes dropped EXE
PID:3976 -
\??\c:\frlfxxr.exec:\frlfxxr.exe35⤵
- Executes dropped EXE
PID:960 -
\??\c:\fxllllf.exec:\fxllllf.exe36⤵
- Executes dropped EXE
PID:4700 -
\??\c:\1bbtnn.exec:\1bbtnn.exe37⤵
- Executes dropped EXE
PID:1992 -
\??\c:\tbbbtb.exec:\tbbbtb.exe38⤵
- Executes dropped EXE
PID:1068 -
\??\c:\vdjvp.exec:\vdjvp.exe39⤵
- Executes dropped EXE
PID:4216 -
\??\c:\1jjpd.exec:\1jjpd.exe40⤵
- Executes dropped EXE
PID:2224 -
\??\c:\flxrxxr.exec:\flxrxxr.exe41⤵
- Executes dropped EXE
PID:1528 -
\??\c:\bbtttt.exec:\bbtttt.exe42⤵
- Executes dropped EXE
PID:1508 -
\??\c:\jjppj.exec:\jjppj.exe43⤵
- Executes dropped EXE
PID:1904 -
\??\c:\7pddp.exec:\7pddp.exe44⤵
- Executes dropped EXE
PID:2840 -
\??\c:\9flfrrr.exec:\9flfrrr.exe45⤵
- Executes dropped EXE
PID:1612 -
\??\c:\7lrrlrl.exec:\7lrrlrl.exe46⤵
- Executes dropped EXE
PID:3720 -
\??\c:\thhhhh.exec:\thhhhh.exe47⤵
- Executes dropped EXE
PID:2560 -
\??\c:\hhttnn.exec:\hhttnn.exe48⤵
- Executes dropped EXE
PID:4964 -
\??\c:\ddpjd.exec:\ddpjd.exe49⤵
- Executes dropped EXE
PID:3472 -
\??\c:\rrxrlrl.exec:\rrxrlrl.exe50⤵
- Executes dropped EXE
PID:3544 -
\??\c:\bnnttb.exec:\bnnttb.exe51⤵
- Executes dropped EXE
PID:1940 -
\??\c:\jjpjj.exec:\jjpjj.exe52⤵
- Executes dropped EXE
PID:4040 -
\??\c:\ppppj.exec:\ppppj.exe53⤵
- Executes dropped EXE
PID:3260 -
\??\c:\rxffrxf.exec:\rxffrxf.exe54⤵
- Executes dropped EXE
PID:3904 -
\??\c:\nntttt.exec:\nntttt.exe55⤵
- Executes dropped EXE
PID:3264 -
\??\c:\hbhhtb.exec:\hbhhtb.exe56⤵
- Executes dropped EXE
PID:3236 -
\??\c:\dpvjd.exec:\dpvjd.exe57⤵
- Executes dropped EXE
PID:2652 -
\??\c:\5llfxfx.exec:\5llfxfx.exe58⤵
- Executes dropped EXE
PID:316 -
\??\c:\fxffrrf.exec:\fxffrrf.exe59⤵
- Executes dropped EXE
PID:3204 -
\??\c:\bhntbt.exec:\bhntbt.exe60⤵
- Executes dropped EXE
PID:1416 -
\??\c:\3bnhhn.exec:\3bnhhn.exe61⤵
- Executes dropped EXE
PID:3140 -
\??\c:\dvdvv.exec:\dvdvv.exe62⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jvvpj.exec:\jvvpj.exe63⤵
- Executes dropped EXE
PID:1488 -
\??\c:\lfxrrxr.exec:\lfxrrxr.exe64⤵
- Executes dropped EXE
PID:2096 -
\??\c:\lfxxrrr.exec:\lfxxrrr.exe65⤵
- Executes dropped EXE
PID:812 -
\??\c:\9ntbtt.exec:\9ntbtt.exe66⤵PID:4852
-
\??\c:\bbbbhn.exec:\bbbbhn.exe67⤵PID:1004
-
\??\c:\pjjvp.exec:\pjjvp.exe68⤵PID:4492
-
\??\c:\7djjd.exec:\7djjd.exe69⤵PID:3268
-
\??\c:\9xlffxl.exec:\9xlffxl.exe70⤵PID:1136
-
\??\c:\9xffxxx.exec:\9xffxxx.exe71⤵PID:1624
-
\??\c:\ttbbhh.exec:\ttbbhh.exe72⤵PID:1844
-
\??\c:\1ntnbb.exec:\1ntnbb.exe73⤵PID:2084
-
\??\c:\7vvvp.exec:\7vvvp.exe74⤵PID:5104
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe75⤵PID:3808
-
\??\c:\3lxxrrx.exec:\3lxxrrx.exe76⤵PID:4372
-
\??\c:\nthhtb.exec:\nthhtb.exe77⤵PID:4704
-
\??\c:\tnbhhn.exec:\tnbhhn.exe78⤵PID:4644
-
\??\c:\pvdvv.exec:\pvdvv.exe79⤵PID:224
-
\??\c:\1lrlfff.exec:\1lrlfff.exe80⤵PID:4596
-
\??\c:\7ffffxx.exec:\7ffffxx.exe81⤵PID:3456
-
\??\c:\9ttnnn.exec:\9ttnnn.exe82⤵PID:1800
-
\??\c:\nntnth.exec:\nntnth.exe83⤵PID:2616
-
\??\c:\vvdvd.exec:\vvdvd.exe84⤵PID:5032
-
\??\c:\lrfxflx.exec:\lrfxflx.exe85⤵PID:928
-
\??\c:\lxxxxxf.exec:\lxxxxxf.exe86⤵PID:4216
-
\??\c:\5xrllrr.exec:\5xrllrr.exe87⤵PID:2224
-
\??\c:\nhbnht.exec:\nhbnht.exe88⤵PID:924
-
\??\c:\pjdvv.exec:\pjdvv.exe89⤵PID:2868
-
\??\c:\dvdjv.exec:\dvdjv.exe90⤵PID:396
-
\??\c:\rlfxlll.exec:\rlfxlll.exe91⤵PID:3916
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe92⤵PID:3280
-
\??\c:\nbtntb.exec:\nbtntb.exe93⤵PID:4360
-
\??\c:\3dvvj.exec:\3dvvj.exe94⤵PID:4980
-
\??\c:\ddddd.exec:\ddddd.exe95⤵PID:2164
-
\??\c:\lxrrlll.exec:\lxrrlll.exe96⤵PID:4876
-
\??\c:\hhthnn.exec:\hhthnn.exe97⤵PID:1208
-
\??\c:\bbhhhb.exec:\bbhhhb.exe98⤵PID:3844
-
\??\c:\9ppjd.exec:\9ppjd.exe99⤵PID:5064
-
\??\c:\jvdvp.exec:\jvdvp.exe100⤵PID:4668
-
\??\c:\lllfxff.exec:\lllfxff.exe101⤵PID:3520
-
\??\c:\1ntttt.exec:\1ntttt.exe102⤵PID:3256
-
\??\c:\bhbthb.exec:\bhbthb.exe103⤵PID:2212
-
\??\c:\jpddj.exec:\jpddj.exe104⤵PID:3876
-
\??\c:\frrxfxr.exec:\frrxfxr.exe105⤵PID:3596
-
\??\c:\ffrffxr.exec:\ffrffxr.exe106⤵PID:316
-
\??\c:\httnnt.exec:\httnnt.exe107⤵PID:3204
-
\??\c:\5vvvv.exec:\5vvvv.exe108⤵PID:2244
-
\??\c:\lxxrllf.exec:\lxxrllf.exe109⤵PID:1100
-
\??\c:\nbhttb.exec:\nbhttb.exe110⤵PID:1636
-
\??\c:\5ntbht.exec:\5ntbht.exe111⤵PID:2852
-
\??\c:\pjppj.exec:\pjppj.exe112⤵PID:3576
-
\??\c:\rllfxxx.exec:\rllfxxx.exe113⤵PID:4852
-
\??\c:\vpvpp.exec:\vpvpp.exe114⤵PID:4088
-
\??\c:\vvdvp.exec:\vvdvp.exe115⤵PID:3476
-
\??\c:\7rxxflx.exec:\7rxxflx.exe116⤵PID:4556
-
\??\c:\nbbnnh.exec:\nbbnnh.exe117⤵PID:1624
-
\??\c:\bbbttb.exec:\bbbttb.exe118⤵PID:2520
-
\??\c:\pvjvp.exec:\pvjvp.exe119⤵PID:4768
-
\??\c:\frxrfxr.exec:\frxrfxr.exe120⤵PID:840
-
\??\c:\5xrllrr.exec:\5xrllrr.exe121⤵PID:780
-
\??\c:\5hhhhb.exec:\5hhhhb.exe122⤵PID:4372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-