Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ef08ab8fa9b6c767f1a1f8006c42f110_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
ef08ab8fa9b6c767f1a1f8006c42f110_NeikiAnalytics.exe
-
Size
492KB
-
MD5
ef08ab8fa9b6c767f1a1f8006c42f110
-
SHA1
430558510a4ed473e1b52572e52ae2beaaac8de0
-
SHA256
7efc8c5773b8996353453ab9cb02746dd3a4300fb0f897623c7fc50453f7ff0c
-
SHA512
801c0b09a031d06f83b2e7a5b09c27718e3929b9ff1e2f6295c413439b7531d7c6c31fc1f7dcf286c1aaa2102cfeadd8706f0d5a57c04aa75c3d1634e2038a00
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq78yoyfx93svqTbWL5wEpOQ9DRRv:n3C9yMo+S0L9xRnoq7H9QYcmeN9DX
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/5036-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4184-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4236-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1432 dvjvd.exe 2996 7xfrlfx.exe 4596 9fffrxl.exe 3156 hhnhtb.exe 2528 jdjvd.exe 3900 xrxlxxr.exe 4184 tbhtnt.exe 3080 ppvdp.exe 3184 rllrlfx.exe 4080 ttnhbb.exe 4580 thtnnt.exe 3984 nnhbbb.exe 4900 jvvjd.exe 880 fflfxlf.exe 2368 dpdpj.exe 4012 ddpjd.exe 4132 1bbtbb.exe 4236 djvpv.exe 4492 9frlfxr.exe 2740 httttt.exe 4140 1vvvv.exe 3512 3rffffl.exe 4668 tnbtnn.exe 1444 lfrlrlr.exe 3544 5nnhhn.exe 744 7djdj.exe 4824 rrrlfxx.exe 4616 1ffxrrl.exe 3456 hbbtnn.exe 3216 jjdvv.exe 3156 nbnnnh.exe 4888 pdjjj.exe 3632 5bbtnn.exe 2576 1pjdv.exe 2320 rfllxll.exe 896 1nnhtt.exe 2796 9hhhbh.exe 4516 rflrllf.exe 5028 tbhbtt.exe 1256 pdvvp.exe 696 fffxrlf.exe 3076 hnbtnh.exe 3120 jdvpj.exe 4676 dvvpj.exe 516 rfrxrrl.exe 956 bttntt.exe 1784 3vdvp.exe 3440 jvvjd.exe 4496 3rxrrrr.exe 3872 5pvvp.exe 924 9ffrfxr.exe 3020 hhhhhh.exe 1752 pdjdd.exe 3684 djpjp.exe 3280 nhhhbb.exe 4376 jjpjd.exe 4412 rflfffx.exe 116 hhhtnh.exe 932 btthtn.exe 2868 dvjdv.exe 4980 xxlllxr.exe 2892 dvvvd.exe 1748 bnnnnh.exe 4332 vvjjd.exe -
resource yara_rule behavioral2/memory/5036-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4236-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5036 wrote to memory of 1432 5036 ef08ab8fa9b6c767f1a1f8006c42f110_NeikiAnalytics.exe 91 PID 5036 wrote to memory of 1432 5036 ef08ab8fa9b6c767f1a1f8006c42f110_NeikiAnalytics.exe 91 PID 5036 wrote to memory of 1432 5036 ef08ab8fa9b6c767f1a1f8006c42f110_NeikiAnalytics.exe 91 PID 1432 wrote to memory of 2996 1432 dvjvd.exe 92 PID 1432 wrote to memory of 2996 1432 dvjvd.exe 92 PID 1432 wrote to memory of 2996 1432 dvjvd.exe 92 PID 2996 wrote to memory of 4596 2996 7xfrlfx.exe 93 PID 2996 wrote to memory of 4596 2996 7xfrlfx.exe 93 PID 2996 wrote to memory of 4596 2996 7xfrlfx.exe 93 PID 4596 wrote to memory of 3156 4596 9fffrxl.exe 94 PID 4596 wrote to memory of 3156 4596 9fffrxl.exe 94 PID 4596 wrote to memory of 3156 4596 9fffrxl.exe 94 PID 3156 wrote to memory of 2528 3156 hhnhtb.exe 95 PID 3156 wrote to memory of 2528 3156 hhnhtb.exe 95 PID 3156 wrote to memory of 2528 3156 hhnhtb.exe 95 PID 2528 wrote to memory of 3900 2528 jdjvd.exe 96 PID 2528 wrote to memory of 3900 2528 jdjvd.exe 96 PID 2528 wrote to memory of 3900 2528 jdjvd.exe 96 PID 3900 wrote to memory of 4184 3900 xrxlxxr.exe 97 PID 3900 wrote to memory of 4184 3900 xrxlxxr.exe 97 PID 3900 wrote to memory of 4184 3900 xrxlxxr.exe 97 PID 4184 wrote to memory of 3080 4184 tbhtnt.exe 98 PID 4184 wrote to memory of 3080 4184 tbhtnt.exe 98 PID 4184 wrote to memory of 3080 4184 tbhtnt.exe 98 PID 3080 wrote to memory of 3184 3080 ppvdp.exe 99 PID 3080 wrote to memory of 3184 3080 ppvdp.exe 99 PID 3080 wrote to memory of 3184 3080 ppvdp.exe 99 PID 3184 wrote to memory of 4080 3184 rllrlfx.exe 100 PID 3184 wrote to memory of 4080 3184 rllrlfx.exe 100 PID 3184 wrote to memory of 4080 3184 rllrlfx.exe 100 PID 4080 wrote to memory of 4580 4080 ttnhbb.exe 101 PID 4080 wrote to memory of 4580 4080 ttnhbb.exe 101 PID 4080 wrote to memory of 4580 4080 ttnhbb.exe 101 PID 4580 wrote to memory of 3984 4580 thtnnt.exe 102 PID 4580 wrote to memory of 3984 4580 thtnnt.exe 102 PID 4580 wrote to memory of 3984 4580 thtnnt.exe 102 PID 3984 wrote to memory of 4900 3984 nnhbbb.exe 103 PID 3984 wrote to memory of 4900 3984 nnhbbb.exe 103 PID 3984 wrote to memory of 4900 3984 nnhbbb.exe 103 PID 4900 wrote to memory of 880 4900 jvvjd.exe 104 PID 4900 wrote to memory of 880 4900 jvvjd.exe 104 PID 4900 wrote to memory of 880 4900 jvvjd.exe 104 PID 880 wrote to memory of 2368 880 fflfxlf.exe 105 PID 880 wrote to memory of 2368 880 fflfxlf.exe 105 PID 880 wrote to memory of 2368 880 fflfxlf.exe 105 PID 2368 wrote to memory of 4012 2368 dpdpj.exe 107 PID 2368 wrote to memory of 4012 2368 dpdpj.exe 107 PID 2368 wrote to memory of 4012 2368 dpdpj.exe 107 PID 4012 wrote to memory of 4132 4012 ddpjd.exe 108 PID 4012 wrote to memory of 4132 4012 ddpjd.exe 108 PID 4012 wrote to memory of 4132 4012 ddpjd.exe 108 PID 4132 wrote to memory of 4236 4132 1bbtbb.exe 109 PID 4132 wrote to memory of 4236 4132 1bbtbb.exe 109 PID 4132 wrote to memory of 4236 4132 1bbtbb.exe 109 PID 4236 wrote to memory of 4492 4236 djvpv.exe 110 PID 4236 wrote to memory of 4492 4236 djvpv.exe 110 PID 4236 wrote to memory of 4492 4236 djvpv.exe 110 PID 4492 wrote to memory of 2740 4492 9frlfxr.exe 111 PID 4492 wrote to memory of 2740 4492 9frlfxr.exe 111 PID 4492 wrote to memory of 2740 4492 9frlfxr.exe 111 PID 2740 wrote to memory of 4140 2740 httttt.exe 112 PID 2740 wrote to memory of 4140 2740 httttt.exe 112 PID 2740 wrote to memory of 4140 2740 httttt.exe 112 PID 4140 wrote to memory of 3512 4140 1vvvv.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef08ab8fa9b6c767f1a1f8006c42f110_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ef08ab8fa9b6c767f1a1f8006c42f110_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\dvjvd.exec:\dvjvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\7xfrlfx.exec:\7xfrlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\9fffrxl.exec:\9fffrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\hhnhtb.exec:\hhnhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\jdjvd.exec:\jdjvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\xrxlxxr.exec:\xrxlxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\tbhtnt.exec:\tbhtnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\ppvdp.exec:\ppvdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\rllrlfx.exec:\rllrlfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\ttnhbb.exec:\ttnhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\thtnnt.exec:\thtnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\nnhbbb.exec:\nnhbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\jvvjd.exec:\jvvjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\fflfxlf.exec:\fflfxlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\dpdpj.exec:\dpdpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\ddpjd.exec:\ddpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\1bbtbb.exec:\1bbtbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\djvpv.exec:\djvpv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\9frlfxr.exec:\9frlfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\httttt.exec:\httttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\1vvvv.exec:\1vvvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\3rffffl.exec:\3rffffl.exe23⤵
- Executes dropped EXE
PID:3512 -
\??\c:\tnbtnn.exec:\tnbtnn.exe24⤵
- Executes dropped EXE
PID:4668 -
\??\c:\lfrlrlr.exec:\lfrlrlr.exe25⤵
- Executes dropped EXE
PID:1444 -
\??\c:\5nnhhn.exec:\5nnhhn.exe26⤵
- Executes dropped EXE
PID:3544 -
\??\c:\7djdj.exec:\7djdj.exe27⤵
- Executes dropped EXE
PID:744 -
\??\c:\rrrlfxx.exec:\rrrlfxx.exe28⤵
- Executes dropped EXE
PID:4824 -
\??\c:\1ffxrrl.exec:\1ffxrrl.exe29⤵
- Executes dropped EXE
PID:4616 -
\??\c:\hbbtnn.exec:\hbbtnn.exe30⤵
- Executes dropped EXE
PID:3456 -
\??\c:\jjdvv.exec:\jjdvv.exe31⤵
- Executes dropped EXE
PID:3216 -
\??\c:\nbnnnh.exec:\nbnnnh.exe32⤵
- Executes dropped EXE
PID:3156 -
\??\c:\pdjjj.exec:\pdjjj.exe33⤵
- Executes dropped EXE
PID:4888 -
\??\c:\5bbtnn.exec:\5bbtnn.exe34⤵
- Executes dropped EXE
PID:3632 -
\??\c:\1pjdv.exec:\1pjdv.exe35⤵
- Executes dropped EXE
PID:2576 -
\??\c:\rfllxll.exec:\rfllxll.exe36⤵
- Executes dropped EXE
PID:2320 -
\??\c:\1nnhtt.exec:\1nnhtt.exe37⤵
- Executes dropped EXE
PID:896 -
\??\c:\9hhhbh.exec:\9hhhbh.exe38⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rflrllf.exec:\rflrllf.exe39⤵
- Executes dropped EXE
PID:4516 -
\??\c:\tbhbtt.exec:\tbhbtt.exe40⤵
- Executes dropped EXE
PID:5028 -
\??\c:\pdvvp.exec:\pdvvp.exe41⤵
- Executes dropped EXE
PID:1256 -
\??\c:\fffxrlf.exec:\fffxrlf.exe42⤵
- Executes dropped EXE
PID:696 -
\??\c:\hnbtnh.exec:\hnbtnh.exe43⤵
- Executes dropped EXE
PID:3076 -
\??\c:\jdvpj.exec:\jdvpj.exe44⤵
- Executes dropped EXE
PID:3120 -
\??\c:\dvvpj.exec:\dvvpj.exe45⤵
- Executes dropped EXE
PID:4676 -
\??\c:\rfrxrrl.exec:\rfrxrrl.exe46⤵
- Executes dropped EXE
PID:516 -
\??\c:\bttntt.exec:\bttntt.exe47⤵
- Executes dropped EXE
PID:956 -
\??\c:\3vdvp.exec:\3vdvp.exe48⤵
- Executes dropped EXE
PID:1784 -
\??\c:\jvvjd.exec:\jvvjd.exe49⤵
- Executes dropped EXE
PID:3440 -
\??\c:\3rxrrrr.exec:\3rxrrrr.exe50⤵
- Executes dropped EXE
PID:4496 -
\??\c:\5pvvp.exec:\5pvvp.exe51⤵
- Executes dropped EXE
PID:3872 -
\??\c:\9ffrfxr.exec:\9ffrfxr.exe52⤵
- Executes dropped EXE
PID:924 -
\??\c:\hhhhhh.exec:\hhhhhh.exe53⤵
- Executes dropped EXE
PID:3020 -
\??\c:\pdjdd.exec:\pdjdd.exe54⤵
- Executes dropped EXE
PID:1752 -
\??\c:\djpjp.exec:\djpjp.exe55⤵
- Executes dropped EXE
PID:3684 -
\??\c:\nhhhbb.exec:\nhhhbb.exe56⤵
- Executes dropped EXE
PID:3280 -
\??\c:\jjpjd.exec:\jjpjd.exe57⤵
- Executes dropped EXE
PID:4376 -
\??\c:\rflfffx.exec:\rflfffx.exe58⤵
- Executes dropped EXE
PID:4412 -
\??\c:\hhhtnh.exec:\hhhtnh.exe59⤵
- Executes dropped EXE
PID:116 -
\??\c:\btthtn.exec:\btthtn.exe60⤵
- Executes dropped EXE
PID:932 -
\??\c:\dvjdv.exec:\dvjdv.exe61⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xxlllxr.exec:\xxlllxr.exe62⤵
- Executes dropped EXE
PID:4980 -
\??\c:\dvvvd.exec:\dvvvd.exe63⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bnnnnh.exec:\bnnnnh.exe64⤵
- Executes dropped EXE
PID:1748 -
\??\c:\vvjjd.exec:\vvjjd.exe65⤵
- Executes dropped EXE
PID:4332 -
\??\c:\frxrxrr.exec:\frxrxrr.exe66⤵PID:1184
-
\??\c:\3rxrlxx.exec:\3rxrlxx.exe67⤵PID:4116
-
\??\c:\5btbth.exec:\5btbth.exe68⤵PID:2980
-
\??\c:\xffrlfx.exec:\xffrlfx.exe69⤵PID:2576
-
\??\c:\nhhhhh.exec:\nhhhhh.exe70⤵PID:4060
-
\??\c:\djjdv.exec:\djjdv.exe71⤵PID:1612
-
\??\c:\5pdvj.exec:\5pdvj.exe72⤵PID:3008
-
\??\c:\rffxxrx.exec:\rffxxrx.exe73⤵PID:2888
-
\??\c:\tbhhhh.exec:\tbhhhh.exe74⤵PID:2144
-
\??\c:\3djjp.exec:\3djjp.exe75⤵PID:3564
-
\??\c:\1fxlfrl.exec:\1fxlfrl.exe76⤵PID:880
-
\??\c:\1fxrllf.exec:\1fxrllf.exe77⤵PID:4676
-
\??\c:\tnhhbh.exec:\tnhhbh.exe78⤵PID:516
-
\??\c:\jpdvp.exec:\jpdvp.exe79⤵PID:4944
-
\??\c:\3jpjd.exec:\3jpjd.exe80⤵PID:4132
-
\??\c:\lxxrllf.exec:\lxxrllf.exe81⤵PID:4760
-
\??\c:\nhhhhh.exec:\nhhhhh.exe82⤵PID:3716
-
\??\c:\ddjdv.exec:\ddjdv.exe83⤵PID:2740
-
\??\c:\jjjpj.exec:\jjjpj.exe84⤵PID:2352
-
\??\c:\xxxfxxx.exec:\xxxfxxx.exe85⤵PID:2092
-
\??\c:\tnntnt.exec:\tnntnt.exe86⤵PID:4724
-
\??\c:\hhnhbb.exec:\hhnhbb.exe87⤵PID:4660
-
\??\c:\vjpjd.exec:\vjpjd.exe88⤵PID:5064
-
\??\c:\1lrlxxl.exec:\1lrlxxl.exe89⤵PID:4376
-
\??\c:\9rxrxrl.exec:\9rxrxrl.exe90⤵PID:4412
-
\??\c:\nnnhbb.exec:\nnnhbb.exe91⤵PID:1432
-
\??\c:\dvvpj.exec:\dvvpj.exe92⤵PID:3740
-
\??\c:\vpddv.exec:\vpddv.exe93⤵PID:2868
-
\??\c:\rrfxrll.exec:\rrfxrll.exe94⤵PID:3456
-
\??\c:\1nthbb.exec:\1nthbb.exe95⤵PID:3876
-
\??\c:\5ppjp.exec:\5ppjp.exe96⤵PID:788
-
\??\c:\pjddd.exec:\pjddd.exe97⤵PID:2788
-
\??\c:\ffllxxf.exec:\ffllxxf.exe98⤵PID:2412
-
\??\c:\hnnnhh.exec:\hnnnhh.exe99⤵PID:4556
-
\??\c:\7vppd.exec:\7vppd.exe100⤵PID:4052
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe101⤵PID:3984
-
\??\c:\rxlxlrl.exec:\rxlxlrl.exe102⤵PID:544
-
\??\c:\5bbhht.exec:\5bbhht.exe103⤵PID:2156
-
\??\c:\5ppjd.exec:\5ppjd.exe104⤵PID:1624
-
\??\c:\frxrxrx.exec:\frxrxrx.exe105⤵PID:4676
-
\??\c:\rllflfx.exec:\rllflfx.exe106⤵PID:516
-
\??\c:\tbttbb.exec:\tbttbb.exe107⤵PID:4236
-
\??\c:\jdjjj.exec:\jdjjj.exe108⤵PID:2196
-
\??\c:\5xrfxrl.exec:\5xrfxrl.exe109⤵PID:4720
-
\??\c:\7frlffx.exec:\7frlffx.exe110⤵PID:1752
-
\??\c:\nnnhbb.exec:\nnnhbb.exe111⤵PID:2364
-
\??\c:\jpvvp.exec:\jpvvp.exe112⤵PID:3684
-
\??\c:\rrlfxxx.exec:\rrlfxxx.exe113⤵PID:2356
-
\??\c:\frfxfxf.exec:\frfxfxf.exe114⤵PID:4532
-
\??\c:\1bbbtt.exec:\1bbbtt.exe115⤵PID:3152
-
\??\c:\vpvvv.exec:\vpvvv.exe116⤵PID:4412
-
\??\c:\1jdvv.exec:\1jdvv.exe117⤵PID:3572
-
\??\c:\lfxxxxr.exec:\lfxxxxr.exe118⤵PID:2252
-
\??\c:\1tnbtt.exec:\1tnbtt.exe119⤵PID:1304
-
\??\c:\pvjdv.exec:\pvjdv.exe120⤵PID:3216
-
\??\c:\pdjdv.exec:\pdjdv.exe121⤵PID:2280
-
\??\c:\xxrrlll.exec:\xxrrlll.exe122⤵PID:3948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-