Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 17:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06f88265a733f75cedcaeb50850c8d90_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
06f88265a733f75cedcaeb50850c8d90_NeikiAnalytics.exe
-
Size
146KB
-
MD5
06f88265a733f75cedcaeb50850c8d90
-
SHA1
13f968519506945875652a3de8a4faaf0d3bb3e3
-
SHA256
6ceeee70db37f7108b06b1065dbd0d99fd4120d1972f50654c2486f8cf148f27
-
SHA512
bf83b9e2c34a0df32c97a5f66b41b3523c8cf9209a5b2ad0924112413aeb8820b0a0083251c8eed5afd2afe1ca933cb59c815a6e523a65b4fd6b7e6bbec90d08
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9gFbctg0IyAyhZvjDUOy/nmPmT9seH:n3C9BRo7tvnJ9oH0IRgZvjDhy+PmxseH
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4036-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/632-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1516-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/336-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2004 xrffrxx.exe 3120 hthnnt.exe 4888 5ddvv.exe 2572 lrrrrrf.exe 8 hbtttb.exe 1676 tthhtn.exe 2764 frlrxrr.exe 1316 bbnnnt.exe 4956 5ppjj.exe 4824 tbntbb.exe 3320 vdjjj.exe 3280 rrfxxxx.exe 1056 5thhhh.exe 428 5djdd.exe 4500 rlxrrlr.exe 632 hnnnhh.exe 2976 ddvvv.exe 4248 lxlxfff.exe 1516 dvddj.exe 4852 pdjjd.exe 2788 rllrrrr.exe 1036 tntnnh.exe 4748 ppppd.exe 2620 xxfllxr.exe 2324 7htntb.exe 3684 jjjdp.exe 4060 3rxrlff.exe 336 hbttbh.exe 3916 ddjjj.exe 1892 rfrlfll.exe 3476 3bbttt.exe 4600 tththt.exe 2440 vpvvv.exe 4520 3ffxxxr.exe 3580 lfflflf.exe 1696 hnhnbt.exe 1428 rlffxff.exe 2004 lflllrr.exe 2588 hbttbh.exe 1372 jpvdd.exe 3188 5pjjj.exe 1368 xrlrrrr.exe 3324 5rlllrr.exe 4204 5tbbhn.exe 1464 hhnhhn.exe 2764 ppdjj.exe 3456 3dpjj.exe 5048 1rfffll.exe 5016 bthhhn.exe 1940 ttbbbh.exe 4824 9jdpv.exe 5044 jvdvv.exe 864 lfxrrff.exe 2116 xrrrffx.exe 4476 hbhbhh.exe 428 vjvvv.exe 3516 vpvpj.exe 2536 ffllfll.exe 4296 xlxxrxx.exe 2976 nhbhtt.exe 1532 jdppp.exe 2320 9xffflf.exe 4648 hhttnn.exe 4388 jdppp.exe -
resource yara_rule behavioral2/memory/4036-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2788-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/336-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4036 wrote to memory of 2004 4036 06f88265a733f75cedcaeb50850c8d90_NeikiAnalytics.exe 83 PID 4036 wrote to memory of 2004 4036 06f88265a733f75cedcaeb50850c8d90_NeikiAnalytics.exe 83 PID 4036 wrote to memory of 2004 4036 06f88265a733f75cedcaeb50850c8d90_NeikiAnalytics.exe 83 PID 2004 wrote to memory of 3120 2004 xrffrxx.exe 84 PID 2004 wrote to memory of 3120 2004 xrffrxx.exe 84 PID 2004 wrote to memory of 3120 2004 xrffrxx.exe 84 PID 3120 wrote to memory of 4888 3120 hthnnt.exe 85 PID 3120 wrote to memory of 4888 3120 hthnnt.exe 85 PID 3120 wrote to memory of 4888 3120 hthnnt.exe 85 PID 4888 wrote to memory of 2572 4888 5ddvv.exe 86 PID 4888 wrote to memory of 2572 4888 5ddvv.exe 86 PID 4888 wrote to memory of 2572 4888 5ddvv.exe 86 PID 2572 wrote to memory of 8 2572 lrrrrrf.exe 87 PID 2572 wrote to memory of 8 2572 lrrrrrf.exe 87 PID 2572 wrote to memory of 8 2572 lrrrrrf.exe 87 PID 8 wrote to memory of 1676 8 hbtttb.exe 88 PID 8 wrote to memory of 1676 8 hbtttb.exe 88 PID 8 wrote to memory of 1676 8 hbtttb.exe 88 PID 1676 wrote to memory of 2764 1676 tthhtn.exe 89 PID 1676 wrote to memory of 2764 1676 tthhtn.exe 89 PID 1676 wrote to memory of 2764 1676 tthhtn.exe 89 PID 2764 wrote to memory of 1316 2764 frlrxrr.exe 90 PID 2764 wrote to memory of 1316 2764 frlrxrr.exe 90 PID 2764 wrote to memory of 1316 2764 frlrxrr.exe 90 PID 1316 wrote to memory of 4956 1316 bbnnnt.exe 91 PID 1316 wrote to memory of 4956 1316 bbnnnt.exe 91 PID 1316 wrote to memory of 4956 1316 bbnnnt.exe 91 PID 4956 wrote to memory of 4824 4956 5ppjj.exe 93 PID 4956 wrote to memory of 4824 4956 5ppjj.exe 93 PID 4956 wrote to memory of 4824 4956 5ppjj.exe 93 PID 4824 wrote to memory of 3320 4824 tbntbb.exe 94 PID 4824 wrote to memory of 3320 4824 tbntbb.exe 94 PID 4824 wrote to memory of 3320 4824 tbntbb.exe 94 PID 3320 wrote to memory of 3280 3320 vdjjj.exe 95 PID 3320 wrote to memory of 3280 3320 vdjjj.exe 95 PID 3320 wrote to memory of 3280 3320 vdjjj.exe 95 PID 3280 wrote to memory of 1056 3280 rrfxxxx.exe 96 PID 3280 wrote to memory of 1056 3280 rrfxxxx.exe 96 PID 3280 wrote to memory of 1056 3280 rrfxxxx.exe 96 PID 1056 wrote to memory of 428 1056 5thhhh.exe 98 PID 1056 wrote to memory of 428 1056 5thhhh.exe 98 PID 1056 wrote to memory of 428 1056 5thhhh.exe 98 PID 428 wrote to memory of 4500 428 5djdd.exe 99 PID 428 wrote to memory of 4500 428 5djdd.exe 99 PID 428 wrote to memory of 4500 428 5djdd.exe 99 PID 4500 wrote to memory of 632 4500 rlxrrlr.exe 100 PID 4500 wrote to memory of 632 4500 rlxrrlr.exe 100 PID 4500 wrote to memory of 632 4500 rlxrrlr.exe 100 PID 632 wrote to memory of 2976 632 hnnnhh.exe 101 PID 632 wrote to memory of 2976 632 hnnnhh.exe 101 PID 632 wrote to memory of 2976 632 hnnnhh.exe 101 PID 2976 wrote to memory of 4248 2976 ddvvv.exe 102 PID 2976 wrote to memory of 4248 2976 ddvvv.exe 102 PID 2976 wrote to memory of 4248 2976 ddvvv.exe 102 PID 4248 wrote to memory of 1516 4248 lxlxfff.exe 103 PID 4248 wrote to memory of 1516 4248 lxlxfff.exe 103 PID 4248 wrote to memory of 1516 4248 lxlxfff.exe 103 PID 1516 wrote to memory of 4852 1516 dvddj.exe 104 PID 1516 wrote to memory of 4852 1516 dvddj.exe 104 PID 1516 wrote to memory of 4852 1516 dvddj.exe 104 PID 4852 wrote to memory of 2788 4852 pdjjd.exe 105 PID 4852 wrote to memory of 2788 4852 pdjjd.exe 105 PID 4852 wrote to memory of 2788 4852 pdjjd.exe 105 PID 2788 wrote to memory of 1036 2788 rllrrrr.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\06f88265a733f75cedcaeb50850c8d90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\06f88265a733f75cedcaeb50850c8d90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\xrffrxx.exec:\xrffrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\hthnnt.exec:\hthnnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\5ddvv.exec:\5ddvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\lrrrrrf.exec:\lrrrrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\hbtttb.exec:\hbtttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\tthhtn.exec:\tthhtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\frlrxrr.exec:\frlrxrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\bbnnnt.exec:\bbnnnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\5ppjj.exec:\5ppjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\tbntbb.exec:\tbntbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\vdjjj.exec:\vdjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\rrfxxxx.exec:\rrfxxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\5thhhh.exec:\5thhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\5djdd.exec:\5djdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\rlxrrlr.exec:\rlxrrlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\hnnnhh.exec:\hnnnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\ddvvv.exec:\ddvvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\lxlxfff.exec:\lxlxfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\dvddj.exec:\dvddj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\pdjjd.exec:\pdjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\rllrrrr.exec:\rllrrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\tntnnh.exec:\tntnnh.exe23⤵
- Executes dropped EXE
PID:1036 -
\??\c:\ppppd.exec:\ppppd.exe24⤵
- Executes dropped EXE
PID:4748 -
\??\c:\xxfllxr.exec:\xxfllxr.exe25⤵
- Executes dropped EXE
PID:2620 -
\??\c:\7htntb.exec:\7htntb.exe26⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jjjdp.exec:\jjjdp.exe27⤵
- Executes dropped EXE
PID:3684 -
\??\c:\3rxrlff.exec:\3rxrlff.exe28⤵
- Executes dropped EXE
PID:4060 -
\??\c:\hbttbh.exec:\hbttbh.exe29⤵
- Executes dropped EXE
PID:336 -
\??\c:\ddjjj.exec:\ddjjj.exe30⤵
- Executes dropped EXE
PID:3916 -
\??\c:\rfrlfll.exec:\rfrlfll.exe31⤵
- Executes dropped EXE
PID:1892 -
\??\c:\3bbttt.exec:\3bbttt.exe32⤵
- Executes dropped EXE
PID:3476 -
\??\c:\tththt.exec:\tththt.exe33⤵
- Executes dropped EXE
PID:4600 -
\??\c:\vpvvv.exec:\vpvvv.exe34⤵
- Executes dropped EXE
PID:2440 -
\??\c:\3ffxxxr.exec:\3ffxxxr.exe35⤵
- Executes dropped EXE
PID:4520 -
\??\c:\lfflflf.exec:\lfflflf.exe36⤵
- Executes dropped EXE
PID:3580 -
\??\c:\hnhnbt.exec:\hnhnbt.exe37⤵
- Executes dropped EXE
PID:1696 -
\??\c:\vvjdj.exec:\vvjdj.exe38⤵PID:4356
-
\??\c:\rlffxff.exec:\rlffxff.exe39⤵
- Executes dropped EXE
PID:1428 -
\??\c:\lflllrr.exec:\lflllrr.exe40⤵
- Executes dropped EXE
PID:2004 -
\??\c:\hbttbh.exec:\hbttbh.exe41⤵
- Executes dropped EXE
PID:2588 -
\??\c:\jpvdd.exec:\jpvdd.exe42⤵
- Executes dropped EXE
PID:1372 -
\??\c:\5pjjj.exec:\5pjjj.exe43⤵
- Executes dropped EXE
PID:3188 -
\??\c:\xrlrrrr.exec:\xrlrrrr.exe44⤵
- Executes dropped EXE
PID:1368 -
\??\c:\5rlllrr.exec:\5rlllrr.exe45⤵
- Executes dropped EXE
PID:3324 -
\??\c:\5tbbhn.exec:\5tbbhn.exe46⤵
- Executes dropped EXE
PID:4204 -
\??\c:\hhnhhn.exec:\hhnhhn.exe47⤵
- Executes dropped EXE
PID:1464 -
\??\c:\ppdjj.exec:\ppdjj.exe48⤵
- Executes dropped EXE
PID:2764 -
\??\c:\3dpjj.exec:\3dpjj.exe49⤵
- Executes dropped EXE
PID:3456 -
\??\c:\1rfffll.exec:\1rfffll.exe50⤵
- Executes dropped EXE
PID:5048 -
\??\c:\bthhhn.exec:\bthhhn.exe51⤵
- Executes dropped EXE
PID:5016 -
\??\c:\ttbbbh.exec:\ttbbbh.exe52⤵
- Executes dropped EXE
PID:1940 -
\??\c:\9jdpv.exec:\9jdpv.exe53⤵
- Executes dropped EXE
PID:4824 -
\??\c:\jvdvv.exec:\jvdvv.exe54⤵
- Executes dropped EXE
PID:5044 -
\??\c:\lfxrrff.exec:\lfxrrff.exe55⤵
- Executes dropped EXE
PID:864 -
\??\c:\xrrrffx.exec:\xrrrffx.exe56⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hbhbhh.exec:\hbhbhh.exe57⤵
- Executes dropped EXE
PID:4476 -
\??\c:\vjvvv.exec:\vjvvv.exe58⤵
- Executes dropped EXE
PID:428 -
\??\c:\vpvpj.exec:\vpvpj.exe59⤵
- Executes dropped EXE
PID:3516 -
\??\c:\ffllfll.exec:\ffllfll.exe60⤵
- Executes dropped EXE
PID:2536 -
\??\c:\xlxxrxx.exec:\xlxxrxx.exe61⤵
- Executes dropped EXE
PID:4296 -
\??\c:\nhbhtt.exec:\nhbhtt.exe62⤵
- Executes dropped EXE
PID:2976 -
\??\c:\jdppp.exec:\jdppp.exe63⤵
- Executes dropped EXE
PID:1532 -
\??\c:\9xffflf.exec:\9xffflf.exe64⤵
- Executes dropped EXE
PID:2320 -
\??\c:\hhttnn.exec:\hhttnn.exe65⤵
- Executes dropped EXE
PID:4648 -
\??\c:\jdppp.exec:\jdppp.exe66⤵
- Executes dropped EXE
PID:4388 -
\??\c:\jpvjd.exec:\jpvjd.exe67⤵PID:4988
-
\??\c:\lflfxrl.exec:\lflfxrl.exe68⤵PID:4276
-
\??\c:\3lxxxfl.exec:\3lxxxfl.exe69⤵PID:1668
-
\??\c:\tbtbtb.exec:\tbtbtb.exe70⤵PID:3596
-
\??\c:\jjdvj.exec:\jjdvj.exe71⤵PID:1104
-
\??\c:\rllxxxf.exec:\rllxxxf.exe72⤵PID:3656
-
\??\c:\thbhnn.exec:\thbhnn.exe73⤵PID:3980
-
\??\c:\dvddv.exec:\dvddv.exe74⤵PID:544
-
\??\c:\1lrxxlr.exec:\1lrxxlr.exe75⤵PID:3616
-
\??\c:\thbhbh.exec:\thbhbh.exe76⤵PID:2560
-
\??\c:\nhtttb.exec:\nhtttb.exe77⤵PID:2556
-
\??\c:\vvvvv.exec:\vvvvv.exe78⤵PID:4376
-
\??\c:\5flffff.exec:\5flffff.exe79⤵PID:4332
-
\??\c:\lxflrxx.exec:\lxflrxx.exe80⤵PID:1068
-
\??\c:\nhthhh.exec:\nhthhh.exe81⤵PID:2336
-
\??\c:\bnntnt.exec:\bnntnt.exe82⤵PID:628
-
\??\c:\jjvvj.exec:\jjvvj.exe83⤵PID:1808
-
\??\c:\xrflrlr.exec:\xrflrlr.exe84⤵PID:4344
-
\??\c:\xrfffff.exec:\xrfffff.exe85⤵PID:1900
-
\??\c:\hbnnnt.exec:\hbnnnt.exe86⤵PID:4036
-
\??\c:\vvjdv.exec:\vvjdv.exe87⤵PID:3120
-
\??\c:\9frxxfx.exec:\9frxxfx.exe88⤵PID:316
-
\??\c:\xfffflr.exec:\xfffflr.exe89⤵PID:4888
-
\??\c:\tbbbbh.exec:\tbbbbh.exe90⤵PID:3940
-
\??\c:\bbbbbb.exec:\bbbbbb.exe91⤵PID:2448
-
\??\c:\vvjpv.exec:\vvjpv.exe92⤵PID:4596
-
\??\c:\djjpp.exec:\djjpp.exe93⤵PID:3008
-
\??\c:\xrxffll.exec:\xrxffll.exe94⤵PID:1356
-
\??\c:\lxrxflf.exec:\lxrxflf.exe95⤵PID:5036
-
\??\c:\bbbthh.exec:\bbbthh.exe96⤵PID:1624
-
\??\c:\hhttbh.exec:\hhttbh.exe97⤵PID:1760
-
\??\c:\vvjjp.exec:\vvjjp.exe98⤵PID:400
-
\??\c:\5pvvp.exec:\5pvvp.exe99⤵PID:1876
-
\??\c:\3fllrrr.exec:\3fllrrr.exe100⤵PID:4824
-
\??\c:\tthnnn.exec:\tthnnn.exe101⤵PID:3876
-
\??\c:\7tbbhn.exec:\7tbbhn.exe102⤵PID:864
-
\??\c:\jpdjp.exec:\jpdjp.exe103⤵PID:4492
-
\??\c:\jvjjd.exec:\jvjjd.exe104⤵PID:4476
-
\??\c:\xxxxflr.exec:\xxxxflr.exe105⤵PID:2596
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe106⤵PID:2536
-
\??\c:\hhbhtb.exec:\hhbhtb.exe107⤵PID:4296
-
\??\c:\5hhnhn.exec:\5hhnhn.exe108⤵PID:2976
-
\??\c:\vjjjd.exec:\vjjjd.exe109⤵PID:1532
-
\??\c:\xrrxxff.exec:\xrrxxff.exe110⤵PID:1756
-
\??\c:\rrxflrx.exec:\rrxflrx.exe111⤵PID:4648
-
\??\c:\hhtttb.exec:\hhtttb.exe112⤵PID:4388
-
\??\c:\tntbhh.exec:\tntbhh.exe113⤵PID:4988
-
\??\c:\vdjdp.exec:\vdjdp.exe114⤵PID:4544
-
\??\c:\fxxrlll.exec:\fxxrlll.exe115⤵PID:1668
-
\??\c:\rfxrlrl.exec:\rfxrlrl.exe116⤵PID:4428
-
\??\c:\hhttbh.exec:\hhttbh.exe117⤵PID:3196
-
\??\c:\hbbttt.exec:\hbbttt.exe118⤵PID:4028
-
\??\c:\hhthnt.exec:\hhthnt.exe119⤵PID:4448
-
\??\c:\vjppj.exec:\vjppj.exe120⤵PID:1632
-
\??\c:\pdjjd.exec:\pdjjd.exe121⤵PID:1248
-
\??\c:\rrxrrrf.exec:\rrxrrrf.exe122⤵PID:4376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-