Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2024, 05:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe
-
Size
75KB
-
MD5
20c2ae1adf98979e676e81903e75a800
-
SHA1
90a9e1d227a8f2734fce9e66ce95a9d13125c822
-
SHA256
066e197becd04e501bb1faf937568c4b021aaac23b7765ee6b7f911fda05e686
-
SHA512
4bcad320fece15228c96188cebb7d8bfff8f69bc66fdee5138dcd48afc5746b29eb0f882c792528726bd8579e37b30b70a73dacf125fc7cf0eb609d6e22aa8dc
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAh2QpUnX1A2:ymb3NkkiQ3mdBjFIsIVbpUH
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2580-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3868-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4684 rxxrfxx.exe 3224 1hhhnn.exe 116 nhhhhh.exe 944 3vddv.exe 4756 5lxlflf.exe 3712 1bnthn.exe 3044 7tnbbh.exe 1832 rlxrfff.exe 3984 frffxff.exe 4976 pvdvv.exe 3624 rrffflr.exe 3868 rxlxfxx.exe 2068 5vjjj.exe 2328 1ffxrrl.exe 4996 btbhbb.exe 4964 bttnhh.exe 5060 dppjj.exe 3456 fxfxrlf.exe 4700 1hbnbt.exe 5116 pjddd.exe 1272 7lfxrrl.exe 2444 bbntbn.exe 1912 vvdjj.exe 3376 rflfrrl.exe 3424 nnhthh.exe 4704 pjvvv.exe 4064 rrxxrxr.exe 4988 tbtnhh.exe 2612 ddjdd.exe 4896 lfrlrrr.exe 2040 xlrrrrr.exe 3660 hbnnbh.exe 3436 dvppj.exe 2492 ffffllr.exe 1392 fxllfll.exe 2372 9tnnnt.exe 4616 jjvvd.exe 2620 5pvvv.exe 5064 xxlflfl.exe 4564 7ntttt.exe 4528 1nbbbb.exe 4876 dvvpd.exe 2396 vvvvd.exe 3252 llxrrlf.exe 224 7nhbhh.exe 4600 ddddv.exe 4124 5xlrrxx.exe 3560 nbbbhn.exe 2540 pdddd.exe 3152 3rxrllf.exe 1076 xxlrffl.exe 1396 ttttnn.exe 4992 hbtttt.exe 4976 pppjj.exe 2512 lxxxrrr.exe 2412 5xlrrrr.exe 5088 thhhhh.exe 2328 jpjjj.exe 3992 fxlfflf.exe 1224 xrffxxr.exe 1208 bthhnn.exe 5060 jdpdd.exe 1416 ppvvp.exe 1308 lflfxxx.exe -
resource yara_rule behavioral2/memory/2580-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3868-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-189-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2580 wrote to memory of 4684 2580 20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe 83 PID 2580 wrote to memory of 4684 2580 20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe 83 PID 2580 wrote to memory of 4684 2580 20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe 83 PID 4684 wrote to memory of 3224 4684 rxxrfxx.exe 84 PID 4684 wrote to memory of 3224 4684 rxxrfxx.exe 84 PID 4684 wrote to memory of 3224 4684 rxxrfxx.exe 84 PID 3224 wrote to memory of 116 3224 1hhhnn.exe 85 PID 3224 wrote to memory of 116 3224 1hhhnn.exe 85 PID 3224 wrote to memory of 116 3224 1hhhnn.exe 85 PID 116 wrote to memory of 944 116 nhhhhh.exe 86 PID 116 wrote to memory of 944 116 nhhhhh.exe 86 PID 116 wrote to memory of 944 116 nhhhhh.exe 86 PID 944 wrote to memory of 4756 944 3vddv.exe 87 PID 944 wrote to memory of 4756 944 3vddv.exe 87 PID 944 wrote to memory of 4756 944 3vddv.exe 87 PID 4756 wrote to memory of 3712 4756 5lxlflf.exe 88 PID 4756 wrote to memory of 3712 4756 5lxlflf.exe 88 PID 4756 wrote to memory of 3712 4756 5lxlflf.exe 88 PID 3712 wrote to memory of 3044 3712 1bnthn.exe 89 PID 3712 wrote to memory of 3044 3712 1bnthn.exe 89 PID 3712 wrote to memory of 3044 3712 1bnthn.exe 89 PID 3044 wrote to memory of 1832 3044 7tnbbh.exe 90 PID 3044 wrote to memory of 1832 3044 7tnbbh.exe 90 PID 3044 wrote to memory of 1832 3044 7tnbbh.exe 90 PID 1832 wrote to memory of 3984 1832 rlxrfff.exe 91 PID 1832 wrote to memory of 3984 1832 rlxrfff.exe 91 PID 1832 wrote to memory of 3984 1832 rlxrfff.exe 91 PID 3984 wrote to memory of 4976 3984 frffxff.exe 92 PID 3984 wrote to memory of 4976 3984 frffxff.exe 92 PID 3984 wrote to memory of 4976 3984 frffxff.exe 92 PID 4976 wrote to memory of 3624 4976 pvdvv.exe 93 PID 4976 wrote to memory of 3624 4976 pvdvv.exe 93 PID 4976 wrote to memory of 3624 4976 pvdvv.exe 93 PID 3624 wrote to memory of 3868 3624 rrffflr.exe 94 PID 3624 wrote to memory of 3868 3624 rrffflr.exe 94 PID 3624 wrote to memory of 3868 3624 rrffflr.exe 94 PID 3868 wrote to memory of 2068 3868 rxlxfxx.exe 95 PID 3868 wrote to memory of 2068 3868 rxlxfxx.exe 95 PID 3868 wrote to memory of 2068 3868 rxlxfxx.exe 95 PID 2068 wrote to memory of 2328 2068 5vjjj.exe 96 PID 2068 wrote to memory of 2328 2068 5vjjj.exe 96 PID 2068 wrote to memory of 2328 2068 5vjjj.exe 96 PID 2328 wrote to memory of 4996 2328 1ffxrrl.exe 97 PID 2328 wrote to memory of 4996 2328 1ffxrrl.exe 97 PID 2328 wrote to memory of 4996 2328 1ffxrrl.exe 97 PID 4996 wrote to memory of 4964 4996 btbhbb.exe 98 PID 4996 wrote to memory of 4964 4996 btbhbb.exe 98 PID 4996 wrote to memory of 4964 4996 btbhbb.exe 98 PID 4964 wrote to memory of 5060 4964 bttnhh.exe 99 PID 4964 wrote to memory of 5060 4964 bttnhh.exe 99 PID 4964 wrote to memory of 5060 4964 bttnhh.exe 99 PID 5060 wrote to memory of 3456 5060 dppjj.exe 100 PID 5060 wrote to memory of 3456 5060 dppjj.exe 100 PID 5060 wrote to memory of 3456 5060 dppjj.exe 100 PID 3456 wrote to memory of 4700 3456 fxfxrlf.exe 101 PID 3456 wrote to memory of 4700 3456 fxfxrlf.exe 101 PID 3456 wrote to memory of 4700 3456 fxfxrlf.exe 101 PID 4700 wrote to memory of 5116 4700 1hbnbt.exe 102 PID 4700 wrote to memory of 5116 4700 1hbnbt.exe 102 PID 4700 wrote to memory of 5116 4700 1hbnbt.exe 102 PID 5116 wrote to memory of 1272 5116 pjddd.exe 103 PID 5116 wrote to memory of 1272 5116 pjddd.exe 103 PID 5116 wrote to memory of 1272 5116 pjddd.exe 103 PID 1272 wrote to memory of 2444 1272 7lfxrrl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\20c2ae1adf98979e676e81903e75a800_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\rxxrfxx.exec:\rxxrfxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\1hhhnn.exec:\1hhhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\nhhhhh.exec:\nhhhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\3vddv.exec:\3vddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\5lxlflf.exec:\5lxlflf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\1bnthn.exec:\1bnthn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\7tnbbh.exec:\7tnbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\rlxrfff.exec:\rlxrfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\frffxff.exec:\frffxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\pvdvv.exec:\pvdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\rrffflr.exec:\rrffflr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\rxlxfxx.exec:\rxlxfxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\5vjjj.exec:\5vjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\1ffxrrl.exec:\1ffxrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\btbhbb.exec:\btbhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\bttnhh.exec:\bttnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\dppjj.exec:\dppjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\1hbnbt.exec:\1hbnbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\pjddd.exec:\pjddd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\7lfxrrl.exec:\7lfxrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\bbntbn.exec:\bbntbn.exe23⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vvdjj.exec:\vvdjj.exe24⤵
- Executes dropped EXE
PID:1912 -
\??\c:\rflfrrl.exec:\rflfrrl.exe25⤵
- Executes dropped EXE
PID:3376 -
\??\c:\nnhthh.exec:\nnhthh.exe26⤵
- Executes dropped EXE
PID:3424 -
\??\c:\pjvvv.exec:\pjvvv.exe27⤵
- Executes dropped EXE
PID:4704 -
\??\c:\rrxxrxr.exec:\rrxxrxr.exe28⤵
- Executes dropped EXE
PID:4064 -
\??\c:\tbtnhh.exec:\tbtnhh.exe29⤵
- Executes dropped EXE
PID:4988 -
\??\c:\ddjdd.exec:\ddjdd.exe30⤵
- Executes dropped EXE
PID:2612 -
\??\c:\lfrlrrr.exec:\lfrlrrr.exe31⤵
- Executes dropped EXE
PID:4896 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe32⤵
- Executes dropped EXE
PID:2040 -
\??\c:\hbnnbh.exec:\hbnnbh.exe33⤵
- Executes dropped EXE
PID:3660 -
\??\c:\dvppj.exec:\dvppj.exe34⤵
- Executes dropped EXE
PID:3436 -
\??\c:\ffffllr.exec:\ffffllr.exe35⤵
- Executes dropped EXE
PID:2492 -
\??\c:\fxllfll.exec:\fxllfll.exe36⤵
- Executes dropped EXE
PID:1392 -
\??\c:\9tnnnt.exec:\9tnnnt.exe37⤵
- Executes dropped EXE
PID:2372 -
\??\c:\jjvvd.exec:\jjvvd.exe38⤵
- Executes dropped EXE
PID:4616 -
\??\c:\5pvvv.exec:\5pvvv.exe39⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xxlflfl.exec:\xxlflfl.exe40⤵
- Executes dropped EXE
PID:5064 -
\??\c:\7ntttt.exec:\7ntttt.exe41⤵
- Executes dropped EXE
PID:4564 -
\??\c:\1nbbbb.exec:\1nbbbb.exe42⤵
- Executes dropped EXE
PID:4528 -
\??\c:\dvvpd.exec:\dvvpd.exe43⤵
- Executes dropped EXE
PID:4876 -
\??\c:\vvvvd.exec:\vvvvd.exe44⤵
- Executes dropped EXE
PID:2396 -
\??\c:\llxrrlf.exec:\llxrrlf.exe45⤵
- Executes dropped EXE
PID:3252 -
\??\c:\7nhbhh.exec:\7nhbhh.exe46⤵
- Executes dropped EXE
PID:224 -
\??\c:\ddddv.exec:\ddddv.exe47⤵
- Executes dropped EXE
PID:4600 -
\??\c:\5xlrrxx.exec:\5xlrrxx.exe48⤵
- Executes dropped EXE
PID:4124 -
\??\c:\nbbbhn.exec:\nbbbhn.exe49⤵
- Executes dropped EXE
PID:3560 -
\??\c:\pdddd.exec:\pdddd.exe50⤵
- Executes dropped EXE
PID:2540 -
\??\c:\3rxrllf.exec:\3rxrllf.exe51⤵
- Executes dropped EXE
PID:3152 -
\??\c:\xxlrffl.exec:\xxlrffl.exe52⤵
- Executes dropped EXE
PID:1076 -
\??\c:\ttttnn.exec:\ttttnn.exe53⤵
- Executes dropped EXE
PID:1396 -
\??\c:\hbtttt.exec:\hbtttt.exe54⤵
- Executes dropped EXE
PID:4992 -
\??\c:\pppjj.exec:\pppjj.exe55⤵
- Executes dropped EXE
PID:4976 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe56⤵
- Executes dropped EXE
PID:2512 -
\??\c:\5xlrrrr.exec:\5xlrrrr.exe57⤵
- Executes dropped EXE
PID:2412 -
\??\c:\thhhhh.exec:\thhhhh.exe58⤵
- Executes dropped EXE
PID:5088 -
\??\c:\jpjjj.exec:\jpjjj.exe59⤵
- Executes dropped EXE
PID:2328 -
\??\c:\fxlfflf.exec:\fxlfflf.exe60⤵
- Executes dropped EXE
PID:3992 -
\??\c:\xrffxxr.exec:\xrffxxr.exe61⤵
- Executes dropped EXE
PID:1224 -
\??\c:\bthhnn.exec:\bthhnn.exe62⤵
- Executes dropped EXE
PID:1208 -
\??\c:\jdpdd.exec:\jdpdd.exe63⤵
- Executes dropped EXE
PID:5060 -
\??\c:\ppvvp.exec:\ppvvp.exe64⤵
- Executes dropped EXE
PID:1416 -
\??\c:\lflfxxx.exec:\lflfxxx.exe65⤵
- Executes dropped EXE
PID:1308 -
\??\c:\xxllrxf.exec:\xxllrxf.exe66⤵PID:1908
-
\??\c:\hbbbbb.exec:\hbbbbb.exe67⤵PID:4140
-
\??\c:\ppjdd.exec:\ppjdd.exe68⤵PID:4424
-
\??\c:\jdjdd.exec:\jdjdd.exe69⤵PID:2472
-
\??\c:\xrlxrrr.exec:\xrlxrrr.exe70⤵PID:5056
-
\??\c:\9tttnt.exec:\9tttnt.exe71⤵PID:1156
-
\??\c:\hhtnbt.exec:\hhtnbt.exe72⤵PID:1644
-
\??\c:\lflllrf.exec:\lflllrf.exe73⤵PID:1788
-
\??\c:\rllfffr.exec:\rllfffr.exe74⤵PID:4704
-
\??\c:\bbhbnn.exec:\bbhbnn.exe75⤵PID:1340
-
\??\c:\jdjdv.exec:\jdjdv.exe76⤵PID:4984
-
\??\c:\jpvpj.exec:\jpvpj.exe77⤵PID:916
-
\??\c:\rlxxlrr.exec:\rlxxlrr.exe78⤵PID:3256
-
\??\c:\xxxlffx.exec:\xxxlffx.exe79⤵PID:3400
-
\??\c:\1tttnt.exec:\1tttnt.exe80⤵PID:760
-
\??\c:\ppjdp.exec:\ppjdp.exe81⤵PID:5036
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe82⤵PID:4908
-
\??\c:\frrrlrl.exec:\frrrlrl.exe83⤵PID:3244
-
\??\c:\htbtth.exec:\htbtth.exe84⤵PID:2284
-
\??\c:\hhtttt.exec:\hhtttt.exe85⤵PID:1756
-
\??\c:\vdjdv.exec:\vdjdv.exe86⤵PID:2620
-
\??\c:\ddppd.exec:\ddppd.exe87⤵PID:5064
-
\??\c:\5xlfxxx.exec:\5xlfxxx.exe88⤵PID:4868
-
\??\c:\bttnhh.exec:\bttnhh.exe89⤵PID:4304
-
\??\c:\hnbhbh.exec:\hnbhbh.exe90⤵PID:900
-
\??\c:\9jvvp.exec:\9jvvp.exe91⤵PID:100
-
\??\c:\7pvvd.exec:\7pvvd.exe92⤵PID:228
-
\??\c:\xxlflxl.exec:\xxlflxl.exe93⤵PID:1972
-
\??\c:\rxxrllf.exec:\rxxrllf.exe94⤵PID:1148
-
\??\c:\7bnntb.exec:\7bnntb.exe95⤵PID:1020
-
\??\c:\ttnhbt.exec:\ttnhbt.exe96⤵PID:3432
-
\??\c:\djjdv.exec:\djjdv.exe97⤵PID:3044
-
\??\c:\xflrxxx.exec:\xflrxxx.exe98⤵PID:3720
-
\??\c:\rlrxxrf.exec:\rlrxxrf.exe99⤵PID:1088
-
\??\c:\nbhhbt.exec:\nbhhbt.exe100⤵PID:1896
-
\??\c:\hntnhh.exec:\hntnhh.exe101⤵PID:1700
-
\??\c:\3dvvp.exec:\3dvvp.exe102⤵PID:4852
-
\??\c:\vddvv.exec:\vddvv.exe103⤵PID:4520
-
\??\c:\lflflff.exec:\lflflff.exe104⤵PID:4928
-
\??\c:\lllfffx.exec:\lllfffx.exe105⤵PID:4132
-
\??\c:\nhnhbh.exec:\nhnhbh.exe106⤵PID:4996
-
\??\c:\ddjdj.exec:\ddjdj.exe107⤵PID:3736
-
\??\c:\7dppv.exec:\7dppv.exe108⤵PID:2116
-
\??\c:\xlxlrll.exec:\xlxlrll.exe109⤵PID:4752
-
\??\c:\vpdpv.exec:\vpdpv.exe110⤵PID:3948
-
\??\c:\llflxll.exec:\llflxll.exe111⤵PID:3100
-
\??\c:\9hbtbb.exec:\9hbtbb.exe112⤵PID:3348
-
\??\c:\vvvvp.exec:\vvvvp.exe113⤵PID:4068
-
\??\c:\5xffrxf.exec:\5xffrxf.exe114⤵PID:4400
-
\??\c:\hnnttt.exec:\hnnttt.exe115⤵PID:3020
-
\??\c:\btnhtt.exec:\btnhtt.exe116⤵PID:2472
-
\??\c:\dpvvp.exec:\dpvvp.exe117⤵PID:2224
-
\??\c:\lffxrrl.exec:\lffxrrl.exe118⤵PID:1540
-
\??\c:\lllxrxr.exec:\lllxrxr.exe119⤵PID:1656
-
\??\c:\tbhbbt.exec:\tbhbbt.exe120⤵PID:4584
-
\??\c:\vdpdd.exec:\vdpdd.exe121⤵PID:4984
-
\??\c:\jpdvd.exec:\jpdvd.exe122⤵PID:4972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-