Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 16:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e418f0c6d353387a4f9f5ecbf2b57aa0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
e418f0c6d353387a4f9f5ecbf2b57aa0_NeikiAnalytics.exe
-
Size
471KB
-
MD5
e418f0c6d353387a4f9f5ecbf2b57aa0
-
SHA1
3f902786b3441fe0a49290e53b34fae2b089e371
-
SHA256
0b1baf6b62193648cbfd5345181179bbb7aa5b1715bfef29fd0c820ee0cc7a9d
-
SHA512
d9f720e3fbe008735953c1b62a773c14b12d134ef9e2b1497fa62b9fdf4d7dd059d18b6519d34aa8742fd7a28edccf58254c23e0f5455ead18df3c47402b1cdd
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq78yoyfx93sY0AJq4mZAx5O:n3C9yMo+S0L9xRnoq7H9pmom
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/1552-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-30-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1108-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1728-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2480-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1188 nnhbtt.exe 2200 xrxrfxr.exe 4256 dvpjv.exe 1108 jdvpj.exe 764 5rrrrfx.exe 1728 bhtnht.exe 2480 jdjdv.exe 3308 pddjd.exe 4232 7rxrffx.exe 4124 rxlxrlx.exe 1248 btbnnt.exe 2824 3lrlllf.exe 4712 tntnhh.exe 4568 jvvvp.exe 4472 bhhbtn.exe 1512 tbnnhn.exe 2856 pjpdp.exe 1928 lflxfff.exe 5036 nnthnh.exe 4544 5pddj.exe 4748 5dvvp.exe 3988 rflfxxr.exe 4932 hbhbtn.exe 2216 lxxrffx.exe 4016 llllrrx.exe 3648 1xxrrff.exe 4276 bbnntt.exe 5044 pddvv.exe 1924 xfllfff.exe 2920 3hnhnt.exe 736 jdvpj.exe 968 rrrlxrl.exe 5028 5hhthb.exe 8 3djjv.exe 4316 thbtbt.exe 4344 djpjd.exe 1252 ffxrlfx.exe 3308 1nhbtn.exe 4232 3nnhbb.exe 2300 pjpjp.exe 948 7llfxxr.exe 1380 3nttbb.exe 2824 5nbntn.exe 3268 pjjjd.exe 4912 rrfrllf.exe 1448 7btnhh.exe 4640 7nhbtt.exe 2780 jppdd.exe 4796 xrrrfxr.exe 4628 fxlxlfr.exe 4292 7hbnhb.exe 2676 dvpjd.exe 2316 xlrllff.exe 3412 fxrlxxr.exe 2464 3bbtnn.exe 4428 pvpdv.exe 2760 9jdvj.exe 1308 rfrlxxx.exe 4376 xrflfxr.exe 4860 bbbtnn.exe 2740 jvjvp.exe 4584 fxlxrrl.exe 3912 rlxlflr.exe 1552 nhnbtn.exe -
resource yara_rule behavioral2/memory/1552-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2480-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-124-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1552 wrote to memory of 1188 1552 e418f0c6d353387a4f9f5ecbf2b57aa0_NeikiAnalytics.exe 85 PID 1552 wrote to memory of 1188 1552 e418f0c6d353387a4f9f5ecbf2b57aa0_NeikiAnalytics.exe 85 PID 1552 wrote to memory of 1188 1552 e418f0c6d353387a4f9f5ecbf2b57aa0_NeikiAnalytics.exe 85 PID 1188 wrote to memory of 2200 1188 nnhbtt.exe 86 PID 1188 wrote to memory of 2200 1188 nnhbtt.exe 86 PID 1188 wrote to memory of 2200 1188 nnhbtt.exe 86 PID 2200 wrote to memory of 4256 2200 xrxrfxr.exe 88 PID 2200 wrote to memory of 4256 2200 xrxrfxr.exe 88 PID 2200 wrote to memory of 4256 2200 xrxrfxr.exe 88 PID 4256 wrote to memory of 1108 4256 dvpjv.exe 89 PID 4256 wrote to memory of 1108 4256 dvpjv.exe 89 PID 4256 wrote to memory of 1108 4256 dvpjv.exe 89 PID 1108 wrote to memory of 764 1108 jdvpj.exe 90 PID 1108 wrote to memory of 764 1108 jdvpj.exe 90 PID 1108 wrote to memory of 764 1108 jdvpj.exe 90 PID 764 wrote to memory of 1728 764 5rrrrfx.exe 91 PID 764 wrote to memory of 1728 764 5rrrrfx.exe 91 PID 764 wrote to memory of 1728 764 5rrrrfx.exe 91 PID 1728 wrote to memory of 2480 1728 bhtnht.exe 92 PID 1728 wrote to memory of 2480 1728 bhtnht.exe 92 PID 1728 wrote to memory of 2480 1728 bhtnht.exe 92 PID 2480 wrote to memory of 3308 2480 jdjdv.exe 126 PID 2480 wrote to memory of 3308 2480 jdjdv.exe 126 PID 2480 wrote to memory of 3308 2480 jdjdv.exe 126 PID 3308 wrote to memory of 4232 3308 pddjd.exe 127 PID 3308 wrote to memory of 4232 3308 pddjd.exe 127 PID 3308 wrote to memory of 4232 3308 pddjd.exe 127 PID 4232 wrote to memory of 4124 4232 7rxrffx.exe 96 PID 4232 wrote to memory of 4124 4232 7rxrffx.exe 96 PID 4232 wrote to memory of 4124 4232 7rxrffx.exe 96 PID 4124 wrote to memory of 1248 4124 rxlxrlx.exe 97 PID 4124 wrote to memory of 1248 4124 rxlxrlx.exe 97 PID 4124 wrote to memory of 1248 4124 rxlxrlx.exe 97 PID 1248 wrote to memory of 2824 1248 btbnnt.exe 131 PID 1248 wrote to memory of 2824 1248 btbnnt.exe 131 PID 1248 wrote to memory of 2824 1248 btbnnt.exe 131 PID 2824 wrote to memory of 4712 2824 3lrlllf.exe 99 PID 2824 wrote to memory of 4712 2824 3lrlllf.exe 99 PID 2824 wrote to memory of 4712 2824 3lrlllf.exe 99 PID 4712 wrote to memory of 4568 4712 tntnhh.exe 100 PID 4712 wrote to memory of 4568 4712 tntnhh.exe 100 PID 4712 wrote to memory of 4568 4712 tntnhh.exe 100 PID 4568 wrote to memory of 4472 4568 jvvvp.exe 101 PID 4568 wrote to memory of 4472 4568 jvvvp.exe 101 PID 4568 wrote to memory of 4472 4568 jvvvp.exe 101 PID 4472 wrote to memory of 1512 4472 bhhbtn.exe 102 PID 4472 wrote to memory of 1512 4472 bhhbtn.exe 102 PID 4472 wrote to memory of 1512 4472 bhhbtn.exe 102 PID 1512 wrote to memory of 2856 1512 tbnnhn.exe 104 PID 1512 wrote to memory of 2856 1512 tbnnhn.exe 104 PID 1512 wrote to memory of 2856 1512 tbnnhn.exe 104 PID 2856 wrote to memory of 1928 2856 pjpdp.exe 105 PID 2856 wrote to memory of 1928 2856 pjpdp.exe 105 PID 2856 wrote to memory of 1928 2856 pjpdp.exe 105 PID 1928 wrote to memory of 5036 1928 lflxfff.exe 106 PID 1928 wrote to memory of 5036 1928 lflxfff.exe 106 PID 1928 wrote to memory of 5036 1928 lflxfff.exe 106 PID 5036 wrote to memory of 4544 5036 nnthnh.exe 107 PID 5036 wrote to memory of 4544 5036 nnthnh.exe 107 PID 5036 wrote to memory of 4544 5036 nnthnh.exe 107 PID 4544 wrote to memory of 4748 4544 5pddj.exe 108 PID 4544 wrote to memory of 4748 4544 5pddj.exe 108 PID 4544 wrote to memory of 4748 4544 5pddj.exe 108 PID 4748 wrote to memory of 3988 4748 5dvvp.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\e418f0c6d353387a4f9f5ecbf2b57aa0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e418f0c6d353387a4f9f5ecbf2b57aa0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\nnhbtt.exec:\nnhbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\xrxrfxr.exec:\xrxrfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\dvpjv.exec:\dvpjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\jdvpj.exec:\jdvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\5rrrrfx.exec:\5rrrrfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\bhtnht.exec:\bhtnht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\jdjdv.exec:\jdjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\pddjd.exec:\pddjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\7rxrffx.exec:\7rxrffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\rxlxrlx.exec:\rxlxrlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\btbnnt.exec:\btbnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\3lrlllf.exec:\3lrlllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\tntnhh.exec:\tntnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\jvvvp.exec:\jvvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\bhhbtn.exec:\bhhbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\tbnnhn.exec:\tbnnhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\pjpdp.exec:\pjpdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\lflxfff.exec:\lflxfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\nnthnh.exec:\nnthnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\5pddj.exec:\5pddj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\5dvvp.exec:\5dvvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\rflfxxr.exec:\rflfxxr.exe23⤵
- Executes dropped EXE
PID:3988 -
\??\c:\hbhbtn.exec:\hbhbtn.exe24⤵
- Executes dropped EXE
PID:4932 -
\??\c:\lxxrffx.exec:\lxxrffx.exe25⤵
- Executes dropped EXE
PID:2216 -
\??\c:\llllrrx.exec:\llllrrx.exe26⤵
- Executes dropped EXE
PID:4016 -
\??\c:\1xxrrff.exec:\1xxrrff.exe27⤵
- Executes dropped EXE
PID:3648 -
\??\c:\bbnntt.exec:\bbnntt.exe28⤵
- Executes dropped EXE
PID:4276 -
\??\c:\pddvv.exec:\pddvv.exe29⤵
- Executes dropped EXE
PID:5044 -
\??\c:\xfllfff.exec:\xfllfff.exe30⤵
- Executes dropped EXE
PID:1924 -
\??\c:\3hnhnt.exec:\3hnhnt.exe31⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jdvpj.exec:\jdvpj.exe32⤵
- Executes dropped EXE
PID:736 -
\??\c:\rrrlxrl.exec:\rrrlxrl.exe33⤵
- Executes dropped EXE
PID:968 -
\??\c:\5hhthb.exec:\5hhthb.exe34⤵
- Executes dropped EXE
PID:5028 -
\??\c:\3djjv.exec:\3djjv.exe35⤵
- Executes dropped EXE
PID:8 -
\??\c:\thbtbt.exec:\thbtbt.exe36⤵
- Executes dropped EXE
PID:4316 -
\??\c:\djpjd.exec:\djpjd.exe37⤵
- Executes dropped EXE
PID:4344 -
\??\c:\ffxrlfx.exec:\ffxrlfx.exe38⤵
- Executes dropped EXE
PID:1252 -
\??\c:\1nhbtn.exec:\1nhbtn.exe39⤵
- Executes dropped EXE
PID:3308 -
\??\c:\3nnhbb.exec:\3nnhbb.exe40⤵
- Executes dropped EXE
PID:4232 -
\??\c:\pjpjp.exec:\pjpjp.exe41⤵
- Executes dropped EXE
PID:2300 -
\??\c:\7llfxxr.exec:\7llfxxr.exe42⤵
- Executes dropped EXE
PID:948 -
\??\c:\3nttbb.exec:\3nttbb.exe43⤵
- Executes dropped EXE
PID:1380 -
\??\c:\5nbntn.exec:\5nbntn.exe44⤵
- Executes dropped EXE
PID:2824 -
\??\c:\pjjjd.exec:\pjjjd.exe45⤵
- Executes dropped EXE
PID:3268 -
\??\c:\rrfrllf.exec:\rrfrllf.exe46⤵
- Executes dropped EXE
PID:4912 -
\??\c:\7btnhh.exec:\7btnhh.exe47⤵
- Executes dropped EXE
PID:1448 -
\??\c:\7nhbtt.exec:\7nhbtt.exe48⤵
- Executes dropped EXE
PID:4640 -
\??\c:\jppdd.exec:\jppdd.exe49⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xrrrfxr.exec:\xrrrfxr.exe50⤵
- Executes dropped EXE
PID:4796 -
\??\c:\fxlxlfr.exec:\fxlxlfr.exe51⤵
- Executes dropped EXE
PID:4628 -
\??\c:\7hbnhb.exec:\7hbnhb.exe52⤵
- Executes dropped EXE
PID:4292 -
\??\c:\dvpjd.exec:\dvpjd.exe53⤵
- Executes dropped EXE
PID:2676 -
\??\c:\xlrllff.exec:\xlrllff.exe54⤵
- Executes dropped EXE
PID:2316 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe55⤵
- Executes dropped EXE
PID:3412 -
\??\c:\3bbtnn.exec:\3bbtnn.exe56⤵
- Executes dropped EXE
PID:2464 -
\??\c:\pvpdv.exec:\pvpdv.exe57⤵
- Executes dropped EXE
PID:4428 -
\??\c:\9jdvj.exec:\9jdvj.exe58⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rfrlxxx.exec:\rfrlxxx.exe59⤵
- Executes dropped EXE
PID:1308 -
\??\c:\xrflfxr.exec:\xrflfxr.exe60⤵
- Executes dropped EXE
PID:4376 -
\??\c:\bbbtnn.exec:\bbbtnn.exe61⤵
- Executes dropped EXE
PID:4860 -
\??\c:\jvjvp.exec:\jvjvp.exe62⤵
- Executes dropped EXE
PID:2740 -
\??\c:\fxlxrrl.exec:\fxlxrrl.exe63⤵
- Executes dropped EXE
PID:4584 -
\??\c:\rlxlflr.exec:\rlxlflr.exe64⤵
- Executes dropped EXE
PID:3912 -
\??\c:\nhnbtn.exec:\nhnbtn.exe65⤵
- Executes dropped EXE
PID:1552 -
\??\c:\jpjpd.exec:\jpjpd.exe66⤵PID:2524
-
\??\c:\rrfxfxf.exec:\rrfxfxf.exe67⤵PID:3556
-
\??\c:\hbbttn.exec:\hbbttn.exe68⤵PID:1108
-
\??\c:\5ppjv.exec:\5ppjv.exe69⤵PID:1188
-
\??\c:\9fxrffx.exec:\9fxrffx.exe70⤵PID:2976
-
\??\c:\bhhbtt.exec:\bhhbtt.exe71⤵PID:1204
-
\??\c:\dppjd.exec:\dppjd.exe72⤵PID:1728
-
\??\c:\xllfxxf.exec:\xllfxxf.exe73⤵PID:3864
-
\??\c:\bhtbnb.exec:\bhtbnb.exe74⤵PID:2684
-
\??\c:\5jjpv.exec:\5jjpv.exe75⤵PID:4668
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe76⤵PID:4516
-
\??\c:\bnthbb.exec:\bnthbb.exe77⤵PID:748
-
\??\c:\pvvdv.exec:\pvvdv.exe78⤵PID:3232
-
\??\c:\5rfxrlf.exec:\5rfxrlf.exe79⤵PID:404
-
\??\c:\httnbb.exec:\httnbb.exe80⤵PID:1112
-
\??\c:\pjdvv.exec:\pjdvv.exe81⤵PID:1248
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe82⤵PID:3644
-
\??\c:\ntnnhh.exec:\ntnnhh.exe83⤵PID:4468
-
\??\c:\1fllfxx.exec:\1fllfxx.exe84⤵PID:3268
-
\??\c:\xrxrrrx.exec:\xrxrrrx.exe85⤵PID:4020
-
\??\c:\5bbtnh.exec:\5bbtnh.exe86⤵PID:1452
-
\??\c:\lllfxrl.exec:\lllfxrl.exe87⤵PID:684
-
\??\c:\nbbbnt.exec:\nbbbnt.exe88⤵PID:3160
-
\??\c:\jvvdv.exec:\jvvdv.exe89⤵PID:4320
-
\??\c:\xflfxxx.exec:\xflfxxx.exe90⤵PID:2060
-
\??\c:\ttnbtn.exec:\ttnbtn.exe91⤵PID:2120
-
\??\c:\ppjdp.exec:\ppjdp.exe92⤵PID:3928
-
\??\c:\fflfxll.exec:\fflfxll.exe93⤵PID:1128
-
\??\c:\httnhh.exec:\httnhh.exe94⤵PID:1136
-
\??\c:\lxrlfxf.exec:\lxrlfxf.exe95⤵PID:3460
-
\??\c:\1bhbhh.exec:\1bhbhh.exe96⤵PID:2868
-
\??\c:\hbhbtt.exec:\hbhbtt.exe97⤵PID:3388
-
\??\c:\pddjj.exec:\pddjj.exe98⤵PID:4416
-
\??\c:\xflfxxl.exec:\xflfxxl.exe99⤵PID:5100
-
\??\c:\5bhbbb.exec:\5bhbbb.exe100⤵PID:2196
-
\??\c:\vjpdj.exec:\vjpdj.exe101⤵PID:2632
-
\??\c:\dvddd.exec:\dvddd.exe102⤵PID:4948
-
\??\c:\frxrrfl.exec:\frxrrfl.exe103⤵PID:1108
-
\??\c:\tbbthb.exec:\tbbthb.exe104⤵PID:1812
-
\??\c:\dpvdp.exec:\dpvdp.exe105⤵PID:1960
-
\??\c:\lflfllr.exec:\lflfllr.exe106⤵PID:2888
-
\??\c:\hbtnhh.exec:\hbtnhh.exe107⤵PID:4384
-
\??\c:\pjdpj.exec:\pjdpj.exe108⤵PID:4316
-
\??\c:\frfxrxr.exec:\frfxrxr.exe109⤵PID:2448
-
\??\c:\nhnhbn.exec:\nhnhbn.exe110⤵PID:4668
-
\??\c:\tthbtn.exec:\tthbtn.exe111⤵PID:220
-
\??\c:\pppjj.exec:\pppjj.exe112⤵PID:748
-
\??\c:\frrlffx.exec:\frrlffx.exe113⤵PID:2416
-
\??\c:\hnnnhn.exec:\hnnnhn.exe114⤵PID:440
-
\??\c:\ddjdd.exec:\ddjdd.exe115⤵PID:2092
-
\??\c:\xxxrffx.exec:\xxxrffx.exe116⤵PID:2420
-
\??\c:\3bbttb.exec:\3bbttb.exe117⤵PID:4868
-
\??\c:\nhbbtt.exec:\nhbbtt.exe118⤵PID:2088
-
\??\c:\7pjpj.exec:\7pjpj.exe119⤵PID:216
-
\??\c:\xlxrllx.exec:\xlxrllx.exe120⤵PID:1780
-
\??\c:\tnnhnh.exec:\tnnhnh.exe121⤵PID:3480
-
\??\c:\jdvdj.exec:\jdvdj.exe122⤵PID:3504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-