Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 07:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d38573a15be7abde854f49ac976ad280_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
d38573a15be7abde854f49ac976ad280_NeikiAnalytics.exe
-
Size
64KB
-
MD5
d38573a15be7abde854f49ac976ad280
-
SHA1
957cf4f1f928e4fecd75b4b73e35a031930d55bf
-
SHA256
b8f821774c575f933a31879f6489a0ab71680c162248bbdd8b02b9f708041c6e
-
SHA512
0373dc23ff8278cf935abbc1104293befb6a3270e1f02f8514b49ff84bd8396f47d5de82a5707d020b0ae69259b038dec2e18a9a88c54e53b2be5251aefb6d3d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+Luvf:ymb3NkkiQ3mdBjF0yMlc
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2064-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2176-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1044-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2172-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4260-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1980 thnhnb.exe 2176 jjppp.exe 4004 xlrrrrf.exe 2592 1bnnnh.exe 3288 jpjjj.exe 2068 jdvjp.exe 3720 rrfxxll.exe 1044 1htthh.exe 4820 jppjd.exe 2924 xrffxxx.exe 728 rffffll.exe 1968 1jjjj.exe 2084 rflffff.exe 3356 lffxlrl.exe 4868 ttthnh.exe 3484 5jpjj.exe 3064 7xflfll.exe 2320 hbhhbh.exe 3768 7pjdv.exe 2624 3rflrxr.exe 4156 3hnhhh.exe 1960 jvdvp.exe 4540 jdpdj.exe 2172 rxlfrrr.exe 4260 tnbhbh.exe 4936 dvjdd.exe 3172 lxxxxfx.exe 2720 bttnhn.exe 2340 jppjd.exe 3020 flrrlll.exe 3676 lxfrrxf.exe 3584 htnbnt.exe 2060 7vdvp.exe 756 rlrrlxf.exe 1520 rflfxlr.exe 5000 nnhnhh.exe 4372 tbhtht.exe 2480 vdjdv.exe 1424 3llflxx.exe 4200 nhtnhh.exe 4292 nbbhtn.exe 212 rxrlxrr.exe 2132 rxxllfx.exe 2020 ntbbnt.exe 2136 dppjp.exe 2964 9jjjd.exe 4244 xfflrxl.exe 3984 hbhhnn.exe 1404 vvvvp.exe 1000 5vvdv.exe 4804 xrllrxl.exe 4876 xrrlllf.exe 4712 nhbthb.exe 1164 3vddv.exe 4228 1ddvp.exe 3752 flxxrrx.exe 392 tbbbtb.exe 1988 hhtbbb.exe 3064 9fxxrrr.exe 1640 fxffrxx.exe 4484 hbbttt.exe 5064 3dpdj.exe 5036 dpvvp.exe 4952 hbhbtn.exe -
resource yara_rule behavioral2/memory/2064-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2176-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1044-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2172-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2064 wrote to memory of 1980 2064 d38573a15be7abde854f49ac976ad280_NeikiAnalytics.exe 84 PID 2064 wrote to memory of 1980 2064 d38573a15be7abde854f49ac976ad280_NeikiAnalytics.exe 84 PID 2064 wrote to memory of 1980 2064 d38573a15be7abde854f49ac976ad280_NeikiAnalytics.exe 84 PID 1980 wrote to memory of 2176 1980 thnhnb.exe 85 PID 1980 wrote to memory of 2176 1980 thnhnb.exe 85 PID 1980 wrote to memory of 2176 1980 thnhnb.exe 85 PID 2176 wrote to memory of 4004 2176 jjppp.exe 86 PID 2176 wrote to memory of 4004 2176 jjppp.exe 86 PID 2176 wrote to memory of 4004 2176 jjppp.exe 86 PID 4004 wrote to memory of 2592 4004 xlrrrrf.exe 87 PID 4004 wrote to memory of 2592 4004 xlrrrrf.exe 87 PID 4004 wrote to memory of 2592 4004 xlrrrrf.exe 87 PID 2592 wrote to memory of 3288 2592 1bnnnh.exe 88 PID 2592 wrote to memory of 3288 2592 1bnnnh.exe 88 PID 2592 wrote to memory of 3288 2592 1bnnnh.exe 88 PID 3288 wrote to memory of 2068 3288 jpjjj.exe 89 PID 3288 wrote to memory of 2068 3288 jpjjj.exe 89 PID 3288 wrote to memory of 2068 3288 jpjjj.exe 89 PID 2068 wrote to memory of 3720 2068 jdvjp.exe 90 PID 2068 wrote to memory of 3720 2068 jdvjp.exe 90 PID 2068 wrote to memory of 3720 2068 jdvjp.exe 90 PID 3720 wrote to memory of 1044 3720 rrfxxll.exe 91 PID 3720 wrote to memory of 1044 3720 rrfxxll.exe 91 PID 3720 wrote to memory of 1044 3720 rrfxxll.exe 91 PID 1044 wrote to memory of 4820 1044 1htthh.exe 92 PID 1044 wrote to memory of 4820 1044 1htthh.exe 92 PID 1044 wrote to memory of 4820 1044 1htthh.exe 92 PID 4820 wrote to memory of 2924 4820 jppjd.exe 93 PID 4820 wrote to memory of 2924 4820 jppjd.exe 93 PID 4820 wrote to memory of 2924 4820 jppjd.exe 93 PID 2924 wrote to memory of 728 2924 xrffxxx.exe 94 PID 2924 wrote to memory of 728 2924 xrffxxx.exe 94 PID 2924 wrote to memory of 728 2924 xrffxxx.exe 94 PID 728 wrote to memory of 1968 728 rffffll.exe 95 PID 728 wrote to memory of 1968 728 rffffll.exe 95 PID 728 wrote to memory of 1968 728 rffffll.exe 95 PID 1968 wrote to memory of 2084 1968 1jjjj.exe 96 PID 1968 wrote to memory of 2084 1968 1jjjj.exe 96 PID 1968 wrote to memory of 2084 1968 1jjjj.exe 96 PID 2084 wrote to memory of 3356 2084 rflffff.exe 97 PID 2084 wrote to memory of 3356 2084 rflffff.exe 97 PID 2084 wrote to memory of 3356 2084 rflffff.exe 97 PID 3356 wrote to memory of 4868 3356 lffxlrl.exe 98 PID 3356 wrote to memory of 4868 3356 lffxlrl.exe 98 PID 3356 wrote to memory of 4868 3356 lffxlrl.exe 98 PID 4868 wrote to memory of 3484 4868 ttthnh.exe 99 PID 4868 wrote to memory of 3484 4868 ttthnh.exe 99 PID 4868 wrote to memory of 3484 4868 ttthnh.exe 99 PID 3484 wrote to memory of 3064 3484 5jpjj.exe 100 PID 3484 wrote to memory of 3064 3484 5jpjj.exe 100 PID 3484 wrote to memory of 3064 3484 5jpjj.exe 100 PID 3064 wrote to memory of 2320 3064 7xflfll.exe 101 PID 3064 wrote to memory of 2320 3064 7xflfll.exe 101 PID 3064 wrote to memory of 2320 3064 7xflfll.exe 101 PID 2320 wrote to memory of 3768 2320 hbhhbh.exe 102 PID 2320 wrote to memory of 3768 2320 hbhhbh.exe 102 PID 2320 wrote to memory of 3768 2320 hbhhbh.exe 102 PID 3768 wrote to memory of 2624 3768 7pjdv.exe 103 PID 3768 wrote to memory of 2624 3768 7pjdv.exe 103 PID 3768 wrote to memory of 2624 3768 7pjdv.exe 103 PID 2624 wrote to memory of 4156 2624 3rflrxr.exe 104 PID 2624 wrote to memory of 4156 2624 3rflrxr.exe 104 PID 2624 wrote to memory of 4156 2624 3rflrxr.exe 104 PID 4156 wrote to memory of 1960 4156 3hnhhh.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\d38573a15be7abde854f49ac976ad280_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d38573a15be7abde854f49ac976ad280_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\thnhnb.exec:\thnhnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\jjppp.exec:\jjppp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\xlrrrrf.exec:\xlrrrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\1bnnnh.exec:\1bnnnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\jpjjj.exec:\jpjjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\jdvjp.exec:\jdvjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\rrfxxll.exec:\rrfxxll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\1htthh.exec:\1htthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\jppjd.exec:\jppjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\xrffxxx.exec:\xrffxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\rffffll.exec:\rffffll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\1jjjj.exec:\1jjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\rflffff.exec:\rflffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\lffxlrl.exec:\lffxlrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\ttthnh.exec:\ttthnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\5jpjj.exec:\5jpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\7xflfll.exec:\7xflfll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\hbhhbh.exec:\hbhhbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\7pjdv.exec:\7pjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\3rflrxr.exec:\3rflrxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\3hnhhh.exec:\3hnhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\jvdvp.exec:\jvdvp.exe23⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jdpdj.exec:\jdpdj.exe24⤵
- Executes dropped EXE
PID:4540 -
\??\c:\rxlfrrr.exec:\rxlfrrr.exe25⤵
- Executes dropped EXE
PID:2172 -
\??\c:\tnbhbh.exec:\tnbhbh.exe26⤵
- Executes dropped EXE
PID:4260 -
\??\c:\dvjdd.exec:\dvjdd.exe27⤵
- Executes dropped EXE
PID:4936 -
\??\c:\lxxxxfx.exec:\lxxxxfx.exe28⤵
- Executes dropped EXE
PID:3172 -
\??\c:\bttnhn.exec:\bttnhn.exe29⤵
- Executes dropped EXE
PID:2720 -
\??\c:\jppjd.exec:\jppjd.exe30⤵
- Executes dropped EXE
PID:2340 -
\??\c:\flrrlll.exec:\flrrlll.exe31⤵
- Executes dropped EXE
PID:3020 -
\??\c:\lxfrrxf.exec:\lxfrrxf.exe32⤵
- Executes dropped EXE
PID:3676 -
\??\c:\htnbnt.exec:\htnbnt.exe33⤵
- Executes dropped EXE
PID:3584 -
\??\c:\7vdvp.exec:\7vdvp.exe34⤵
- Executes dropped EXE
PID:2060 -
\??\c:\rlrrlxf.exec:\rlrrlxf.exe35⤵
- Executes dropped EXE
PID:756 -
\??\c:\rflfxlr.exec:\rflfxlr.exe36⤵
- Executes dropped EXE
PID:1520 -
\??\c:\nnhnhh.exec:\nnhnhh.exe37⤵
- Executes dropped EXE
PID:5000 -
\??\c:\tbhtht.exec:\tbhtht.exe38⤵
- Executes dropped EXE
PID:4372 -
\??\c:\vdjdv.exec:\vdjdv.exe39⤵
- Executes dropped EXE
PID:2480 -
\??\c:\3llflxx.exec:\3llflxx.exe40⤵
- Executes dropped EXE
PID:1424 -
\??\c:\nhtnhh.exec:\nhtnhh.exe41⤵
- Executes dropped EXE
PID:4200 -
\??\c:\nbbhtn.exec:\nbbhtn.exe42⤵
- Executes dropped EXE
PID:4292 -
\??\c:\rxrlxrr.exec:\rxrlxrr.exe43⤵
- Executes dropped EXE
PID:212 -
\??\c:\rxxllfx.exec:\rxxllfx.exe44⤵
- Executes dropped EXE
PID:2132 -
\??\c:\ntbbnt.exec:\ntbbnt.exe45⤵
- Executes dropped EXE
PID:2020 -
\??\c:\dppjp.exec:\dppjp.exe46⤵
- Executes dropped EXE
PID:2136 -
\??\c:\9jjjd.exec:\9jjjd.exe47⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xfflrxl.exec:\xfflrxl.exe48⤵
- Executes dropped EXE
PID:4244 -
\??\c:\hbhhnn.exec:\hbhhnn.exe49⤵
- Executes dropped EXE
PID:3984 -
\??\c:\vvvvp.exec:\vvvvp.exe50⤵
- Executes dropped EXE
PID:1404 -
\??\c:\5vvdv.exec:\5vvdv.exe51⤵
- Executes dropped EXE
PID:1000 -
\??\c:\xrllrxl.exec:\xrllrxl.exe52⤵
- Executes dropped EXE
PID:4804 -
\??\c:\xrrlllf.exec:\xrrlllf.exe53⤵
- Executes dropped EXE
PID:4876 -
\??\c:\nhbthb.exec:\nhbthb.exe54⤵
- Executes dropped EXE
PID:4712 -
\??\c:\3vddv.exec:\3vddv.exe55⤵
- Executes dropped EXE
PID:1164 -
\??\c:\1ddvp.exec:\1ddvp.exe56⤵
- Executes dropped EXE
PID:4228 -
\??\c:\flxxrrx.exec:\flxxrrx.exe57⤵
- Executes dropped EXE
PID:3752 -
\??\c:\tbbbtb.exec:\tbbbtb.exe58⤵
- Executes dropped EXE
PID:392 -
\??\c:\hhtbbb.exec:\hhtbbb.exe59⤵
- Executes dropped EXE
PID:1988 -
\??\c:\9fxxrrr.exec:\9fxxrrr.exe60⤵
- Executes dropped EXE
PID:3064 -
\??\c:\fxffrxx.exec:\fxffrxx.exe61⤵
- Executes dropped EXE
PID:1640 -
\??\c:\hbbttt.exec:\hbbttt.exe62⤵
- Executes dropped EXE
PID:4484 -
\??\c:\3dpdj.exec:\3dpdj.exe63⤵
- Executes dropped EXE
PID:5064 -
\??\c:\dpvvp.exec:\dpvvp.exe64⤵
- Executes dropped EXE
PID:5036 -
\??\c:\hbhbtn.exec:\hbhbtn.exe65⤵
- Executes dropped EXE
PID:4952 -
\??\c:\thnhhh.exec:\thnhhh.exe66⤵PID:1892
-
\??\c:\ppjjj.exec:\ppjjj.exe67⤵PID:2172
-
\??\c:\xffxrlf.exec:\xffxrlf.exe68⤵PID:4624
-
\??\c:\htbhth.exec:\htbhth.exe69⤵PID:1728
-
\??\c:\pvddv.exec:\pvddv.exe70⤵PID:432
-
\??\c:\frrrlll.exec:\frrrlll.exe71⤵PID:4172
-
\??\c:\htbbtt.exec:\htbbtt.exe72⤵PID:5008
-
\??\c:\jjddd.exec:\jjddd.exe73⤵PID:3648
-
\??\c:\pdvvp.exec:\pdvvp.exe74⤵PID:4356
-
\??\c:\xrrllrl.exec:\xrrllrl.exe75⤵PID:5032
-
\??\c:\ntnbnb.exec:\ntnbnb.exe76⤵PID:3232
-
\??\c:\vpvpv.exec:\vpvpv.exe77⤵PID:676
-
\??\c:\rrrlxfl.exec:\rrrlxfl.exe78⤵PID:3408
-
\??\c:\thbttt.exec:\thbttt.exe79⤵PID:3780
-
\??\c:\jpdvv.exec:\jpdvv.exe80⤵PID:4388
-
\??\c:\7jpdd.exec:\7jpdd.exe81⤵PID:3704
-
\??\c:\rlrrrfl.exec:\rlrrrfl.exe82⤵PID:764
-
\??\c:\xrlllrl.exec:\xrlllrl.exe83⤵PID:388
-
\??\c:\hnhhhh.exec:\hnhhhh.exe84⤵PID:4004
-
\??\c:\vjjdp.exec:\vjjdp.exe85⤵PID:3236
-
\??\c:\fxffrrl.exec:\fxffrrl.exe86⤵PID:396
-
\??\c:\xrfffll.exec:\xrfffll.exe87⤵PID:1212
-
\??\c:\bntntb.exec:\bntntb.exe88⤵PID:3288
-
\??\c:\thnhtb.exec:\thnhtb.exe89⤵PID:2068
-
\??\c:\ppjdd.exec:\ppjdd.exe90⤵PID:4740
-
\??\c:\fxrrrfl.exec:\fxrrrfl.exe91⤵PID:4588
-
\??\c:\xlrxffr.exec:\xlrxffr.exe92⤵PID:1044
-
\??\c:\nnnthn.exec:\nnnthn.exe93⤵PID:4532
-
\??\c:\bthhbh.exec:\bthhbh.exe94⤵PID:4820
-
\??\c:\pvjvj.exec:\pvjvj.exe95⤵PID:1000
-
\??\c:\xffxlxr.exec:\xffxlxr.exe96⤵PID:3012
-
\??\c:\rrlrxrf.exec:\rrlrxrf.exe97⤵PID:4396
-
\??\c:\httnbt.exec:\httnbt.exe98⤵PID:2084
-
\??\c:\bvvvpv.exec:\bvvvpv.exe99⤵PID:5084
-
\??\c:\jjvpd.exec:\jjvpd.exe100⤵PID:4868
-
\??\c:\tbtbth.exec:\tbtbth.exe101⤵PID:4552
-
\??\c:\pvvjj.exec:\pvvjj.exe102⤵PID:3764
-
\??\c:\llllrrr.exec:\llllrrr.exe103⤵PID:536
-
\??\c:\lfrrxfr.exec:\lfrrxfr.exe104⤵PID:1756
-
\??\c:\bbbbtb.exec:\bbbbtb.exe105⤵PID:808
-
\??\c:\thnnnn.exec:\thnnnn.exe106⤵PID:4736
-
\??\c:\jpjjj.exec:\jpjjj.exe107⤵PID:4716
-
\??\c:\vdddd.exec:\vdddd.exe108⤵PID:4548
-
\??\c:\xllfxff.exec:\xllfxff.exe109⤵PID:4952
-
\??\c:\xlllrrr.exec:\xlllrrr.exe110⤵PID:1880
-
\??\c:\ttnnnb.exec:\ttnnnb.exe111⤵PID:1412
-
\??\c:\vjvjj.exec:\vjvjj.exe112⤵PID:4520
-
\??\c:\dvpjd.exec:\dvpjd.exe113⤵PID:4788
-
\??\c:\xxrrrrr.exec:\xxrrrrr.exe114⤵PID:232
-
\??\c:\lfrxflr.exec:\lfrxflr.exe115⤵PID:3184
-
\??\c:\nbhnbt.exec:\nbhnbt.exe116⤵PID:3588
-
\??\c:\ttbttt.exec:\ttbttt.exe117⤵PID:3616
-
\??\c:\djpjj.exec:\djpjj.exe118⤵PID:4444
-
\??\c:\ppdvj.exec:\ppdvj.exe119⤵PID:756
-
\??\c:\1rllfff.exec:\1rllfff.exe120⤵PID:3408
-
\??\c:\lxrrrrr.exec:\lxrrrrr.exe121⤵PID:4388
-
\??\c:\bbbthh.exec:\bbbthh.exe122⤵PID:3128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-