Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 07:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4af78181393af80dc69cb4ba28d031b0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
4af78181393af80dc69cb4ba28d031b0_NeikiAnalytics.exe
-
Size
100KB
-
MD5
4af78181393af80dc69cb4ba28d031b0
-
SHA1
dec68afa5f0d11be47295fdb513d2827f8b87408
-
SHA256
a2e6013fe104ddbbdb1604be27741c72a9e1c23af1f9bf8d46a06656e1bc86ad
-
SHA512
cbe7e238773f15dedbb75376f057d0549311b433d05c206284d1a02656b251360cb8830438cf8b00564e3ce95e4396ba20d48595f873c9ecdc3c299e4667848b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDodtzn6zDaE0R5J:ymb3NkkiQ3mdBjFodt2zE3J
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/2916-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1760-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1760-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/916-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/932-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1340-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3756-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/776-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2896-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1428-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1760 pdddp.exe 916 llrflxl.exe 2740 ddddv.exe 932 1rllflf.exe 372 nnhbtt.exe 1340 rfrllfl.exe 3756 httthb.exe 4004 pjdpv.exe 688 rxxrrll.exe 2312 bhnttt.exe 2096 dvpjp.exe 2284 hthnnt.exe 2452 dpvdp.exe 776 rlffxrl.exe 3268 bhhbnn.exe 1496 jvvvp.exe 2908 rlfxrxr.exe 4676 dvdjd.exe 4456 xxrlxrr.exe 2896 nnhtht.exe 428 vdjdv.exe 1660 lxrrlfx.exe 4816 nbbttt.exe 4784 nthnth.exe 4824 jpdvp.exe 4468 xxfrxfx.exe 3976 5nhhbn.exe 404 vpjvj.exe 1428 bhnnth.exe 3312 vvpvj.exe 2004 xxxxxfx.exe 4540 thnhnh.exe 3224 pjddv.exe 3236 rlxllrf.exe 2128 ttbtth.exe 4748 bbtbhn.exe 5080 jpvdj.exe 1840 rxrxfxf.exe 1684 nbhbbb.exe 4432 pjvvj.exe 1736 llxrfrf.exe 3412 xrlfrrl.exe 4480 thhbnn.exe 4616 vpdvv.exe 932 frfrfrf.exe 2764 hnntbt.exe 1340 vddjd.exe 552 lrfxxrx.exe 2844 rxrfxlf.exe 3272 tntttt.exe 2880 1jjdd.exe 3960 rlllffr.exe 2312 hhbbbb.exe 4312 vvvpv.exe 3604 xlrxlrf.exe 5108 hhtnth.exe 1012 dvvjv.exe 5064 vvvjd.exe 2168 9rflrxl.exe 5012 nhhbbb.exe 3532 hhbbnn.exe 4460 jdddj.exe 4676 dpppj.exe 1016 rrxrrrl.exe -
resource yara_rule behavioral2/memory/2916-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/916-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/916-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/932-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/932-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1340-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3756-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/776-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2896-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1428-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2916 wrote to memory of 1760 2916 4af78181393af80dc69cb4ba28d031b0_NeikiAnalytics.exe 82 PID 2916 wrote to memory of 1760 2916 4af78181393af80dc69cb4ba28d031b0_NeikiAnalytics.exe 82 PID 2916 wrote to memory of 1760 2916 4af78181393af80dc69cb4ba28d031b0_NeikiAnalytics.exe 82 PID 1760 wrote to memory of 916 1760 pdddp.exe 83 PID 1760 wrote to memory of 916 1760 pdddp.exe 83 PID 1760 wrote to memory of 916 1760 pdddp.exe 83 PID 916 wrote to memory of 2740 916 llrflxl.exe 84 PID 916 wrote to memory of 2740 916 llrflxl.exe 84 PID 916 wrote to memory of 2740 916 llrflxl.exe 84 PID 2740 wrote to memory of 932 2740 ddddv.exe 85 PID 2740 wrote to memory of 932 2740 ddddv.exe 85 PID 2740 wrote to memory of 932 2740 ddddv.exe 85 PID 932 wrote to memory of 372 932 1rllflf.exe 86 PID 932 wrote to memory of 372 932 1rllflf.exe 86 PID 932 wrote to memory of 372 932 1rllflf.exe 86 PID 372 wrote to memory of 1340 372 nnhbtt.exe 87 PID 372 wrote to memory of 1340 372 nnhbtt.exe 87 PID 372 wrote to memory of 1340 372 nnhbtt.exe 87 PID 1340 wrote to memory of 3756 1340 rfrllfl.exe 88 PID 1340 wrote to memory of 3756 1340 rfrllfl.exe 88 PID 1340 wrote to memory of 3756 1340 rfrllfl.exe 88 PID 3756 wrote to memory of 4004 3756 httthb.exe 89 PID 3756 wrote to memory of 4004 3756 httthb.exe 89 PID 3756 wrote to memory of 4004 3756 httthb.exe 89 PID 4004 wrote to memory of 688 4004 pjdpv.exe 90 PID 4004 wrote to memory of 688 4004 pjdpv.exe 90 PID 4004 wrote to memory of 688 4004 pjdpv.exe 90 PID 688 wrote to memory of 2312 688 rxxrrll.exe 91 PID 688 wrote to memory of 2312 688 rxxrrll.exe 91 PID 688 wrote to memory of 2312 688 rxxrrll.exe 91 PID 2312 wrote to memory of 2096 2312 bhnttt.exe 92 PID 2312 wrote to memory of 2096 2312 bhnttt.exe 92 PID 2312 wrote to memory of 2096 2312 bhnttt.exe 92 PID 2096 wrote to memory of 2284 2096 dvpjp.exe 93 PID 2096 wrote to memory of 2284 2096 dvpjp.exe 93 PID 2096 wrote to memory of 2284 2096 dvpjp.exe 93 PID 2284 wrote to memory of 2452 2284 hthnnt.exe 94 PID 2284 wrote to memory of 2452 2284 hthnnt.exe 94 PID 2284 wrote to memory of 2452 2284 hthnnt.exe 94 PID 2452 wrote to memory of 776 2452 dpvdp.exe 95 PID 2452 wrote to memory of 776 2452 dpvdp.exe 95 PID 2452 wrote to memory of 776 2452 dpvdp.exe 95 PID 776 wrote to memory of 3268 776 rlffxrl.exe 96 PID 776 wrote to memory of 3268 776 rlffxrl.exe 96 PID 776 wrote to memory of 3268 776 rlffxrl.exe 96 PID 3268 wrote to memory of 1496 3268 bhhbnn.exe 97 PID 3268 wrote to memory of 1496 3268 bhhbnn.exe 97 PID 3268 wrote to memory of 1496 3268 bhhbnn.exe 97 PID 1496 wrote to memory of 2908 1496 jvvvp.exe 98 PID 1496 wrote to memory of 2908 1496 jvvvp.exe 98 PID 1496 wrote to memory of 2908 1496 jvvvp.exe 98 PID 2908 wrote to memory of 4676 2908 rlfxrxr.exe 99 PID 2908 wrote to memory of 4676 2908 rlfxrxr.exe 99 PID 2908 wrote to memory of 4676 2908 rlfxrxr.exe 99 PID 4676 wrote to memory of 4456 4676 dvdjd.exe 100 PID 4676 wrote to memory of 4456 4676 dvdjd.exe 100 PID 4676 wrote to memory of 4456 4676 dvdjd.exe 100 PID 4456 wrote to memory of 2896 4456 xxrlxrr.exe 101 PID 4456 wrote to memory of 2896 4456 xxrlxrr.exe 101 PID 4456 wrote to memory of 2896 4456 xxrlxrr.exe 101 PID 2896 wrote to memory of 428 2896 nnhtht.exe 102 PID 2896 wrote to memory of 428 2896 nnhtht.exe 102 PID 2896 wrote to memory of 428 2896 nnhtht.exe 102 PID 428 wrote to memory of 1660 428 vdjdv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\4af78181393af80dc69cb4ba28d031b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4af78181393af80dc69cb4ba28d031b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\pdddp.exec:\pdddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\llrflxl.exec:\llrflxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\ddddv.exec:\ddddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\1rllflf.exec:\1rllflf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\nnhbtt.exec:\nnhbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\rfrllfl.exec:\rfrllfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\httthb.exec:\httthb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\pjdpv.exec:\pjdpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\rxxrrll.exec:\rxxrrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\bhnttt.exec:\bhnttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\dvpjp.exec:\dvpjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\hthnnt.exec:\hthnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\dpvdp.exec:\dpvdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\rlffxrl.exec:\rlffxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\bhhbnn.exec:\bhhbnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\jvvvp.exec:\jvvvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\rlfxrxr.exec:\rlfxrxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\dvdjd.exec:\dvdjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\xxrlxrr.exec:\xxrlxrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\nnhtht.exec:\nnhtht.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\vdjdv.exec:\vdjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\lxrrlfx.exec:\lxrrlfx.exe23⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nbbttt.exec:\nbbttt.exe24⤵
- Executes dropped EXE
PID:4816 -
\??\c:\nthnth.exec:\nthnth.exe25⤵
- Executes dropped EXE
PID:4784 -
\??\c:\jpdvp.exec:\jpdvp.exe26⤵
- Executes dropped EXE
PID:4824 -
\??\c:\xxfrxfx.exec:\xxfrxfx.exe27⤵
- Executes dropped EXE
PID:4468 -
\??\c:\5nhhbn.exec:\5nhhbn.exe28⤵
- Executes dropped EXE
PID:3976 -
\??\c:\vpjvj.exec:\vpjvj.exe29⤵
- Executes dropped EXE
PID:404 -
\??\c:\bhnnth.exec:\bhnnth.exe30⤵
- Executes dropped EXE
PID:1428 -
\??\c:\vvpvj.exec:\vvpvj.exe31⤵
- Executes dropped EXE
PID:3312 -
\??\c:\xxxxxfx.exec:\xxxxxfx.exe32⤵
- Executes dropped EXE
PID:2004 -
\??\c:\thnhnh.exec:\thnhnh.exe33⤵
- Executes dropped EXE
PID:4540 -
\??\c:\pjddv.exec:\pjddv.exe34⤵
- Executes dropped EXE
PID:3224 -
\??\c:\rlxllrf.exec:\rlxllrf.exe35⤵
- Executes dropped EXE
PID:3236 -
\??\c:\ttbtth.exec:\ttbtth.exe36⤵
- Executes dropped EXE
PID:2128 -
\??\c:\bbtbhn.exec:\bbtbhn.exe37⤵
- Executes dropped EXE
PID:4748 -
\??\c:\jpvdj.exec:\jpvdj.exe38⤵
- Executes dropped EXE
PID:5080 -
\??\c:\rxrxfxf.exec:\rxrxfxf.exe39⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nbhbbb.exec:\nbhbbb.exe40⤵
- Executes dropped EXE
PID:1684 -
\??\c:\pjvvj.exec:\pjvvj.exe41⤵
- Executes dropped EXE
PID:4432 -
\??\c:\llxrfrf.exec:\llxrfrf.exe42⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe43⤵
- Executes dropped EXE
PID:3412 -
\??\c:\thhbnn.exec:\thhbnn.exe44⤵
- Executes dropped EXE
PID:4480 -
\??\c:\vpdvv.exec:\vpdvv.exe45⤵
- Executes dropped EXE
PID:4616 -
\??\c:\frfrfrf.exec:\frfrfrf.exe46⤵
- Executes dropped EXE
PID:932 -
\??\c:\hnntbt.exec:\hnntbt.exe47⤵
- Executes dropped EXE
PID:2764 -
\??\c:\vddjd.exec:\vddjd.exe48⤵
- Executes dropped EXE
PID:1340 -
\??\c:\lrfxxrx.exec:\lrfxxrx.exe49⤵
- Executes dropped EXE
PID:552 -
\??\c:\rxrfxlf.exec:\rxrfxlf.exe50⤵
- Executes dropped EXE
PID:2844 -
\??\c:\tntttt.exec:\tntttt.exe51⤵
- Executes dropped EXE
PID:3272 -
\??\c:\1jjdd.exec:\1jjdd.exe52⤵
- Executes dropped EXE
PID:2880 -
\??\c:\rlllffr.exec:\rlllffr.exe53⤵
- Executes dropped EXE
PID:3960 -
\??\c:\hhbbbb.exec:\hhbbbb.exe54⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vvvpv.exec:\vvvpv.exe55⤵
- Executes dropped EXE
PID:4312 -
\??\c:\xlrxlrf.exec:\xlrxlrf.exe56⤵
- Executes dropped EXE
PID:3604 -
\??\c:\hhtnth.exec:\hhtnth.exe57⤵
- Executes dropped EXE
PID:5108 -
\??\c:\dvvjv.exec:\dvvjv.exe58⤵
- Executes dropped EXE
PID:1012 -
\??\c:\vvvjd.exec:\vvvjd.exe59⤵
- Executes dropped EXE
PID:5064 -
\??\c:\9rflrxl.exec:\9rflrxl.exe60⤵
- Executes dropped EXE
PID:2168 -
\??\c:\nhhbbb.exec:\nhhbbb.exe61⤵
- Executes dropped EXE
PID:5012 -
\??\c:\hhbbnn.exec:\hhbbnn.exe62⤵
- Executes dropped EXE
PID:3532 -
\??\c:\jdddj.exec:\jdddj.exe63⤵
- Executes dropped EXE
PID:4460 -
\??\c:\dpppj.exec:\dpppj.exe64⤵
- Executes dropped EXE
PID:4676 -
\??\c:\rrxrrrl.exec:\rrxrrrl.exe65⤵
- Executes dropped EXE
PID:1016 -
\??\c:\bhbhnb.exec:\bhbhnb.exe66⤵PID:1916
-
\??\c:\dvjdd.exec:\dvjdd.exe67⤵PID:4796
-
\??\c:\flflfrr.exec:\flflfrr.exe68⤵PID:4492
-
\??\c:\llrflfl.exec:\llrflfl.exe69⤵PID:2924
-
\??\c:\hntnbn.exec:\hntnbn.exe70⤵PID:2744
-
\??\c:\7jdvp.exec:\7jdvp.exe71⤵PID:1888
-
\??\c:\xlxrflr.exec:\xlxrflr.exe72⤵PID:3588
-
\??\c:\hbnbbn.exec:\hbnbbn.exe73⤵PID:4176
-
\??\c:\dpvjp.exec:\dpvjp.exe74⤵PID:3844
-
\??\c:\pjppj.exec:\pjppj.exe75⤵PID:3472
-
\??\c:\5frllrr.exec:\5frllrr.exe76⤵PID:404
-
\??\c:\bhtnhh.exec:\bhtnhh.exe77⤵PID:2628
-
\??\c:\pvjpp.exec:\pvjpp.exe78⤵PID:1172
-
\??\c:\lflfflf.exec:\lflfflf.exe79⤵PID:4056
-
\??\c:\flrrfff.exec:\flrrfff.exe80⤵PID:3252
-
\??\c:\htbhhb.exec:\htbhhb.exe81⤵PID:4532
-
\??\c:\lrlrrxf.exec:\lrlrrxf.exe82⤵PID:868
-
\??\c:\bnnnhn.exec:\bnnnhn.exe83⤵PID:4624
-
\??\c:\hnnnhb.exec:\hnnnhb.exe84⤵PID:4852
-
\??\c:\dpjvd.exec:\dpjvd.exe85⤵PID:5040
-
\??\c:\xfllffx.exec:\xfllffx.exe86⤵PID:4348
-
\??\c:\ddjdd.exec:\ddjdd.exe87⤵PID:764
-
\??\c:\xlxxxxx.exec:\xlxxxxx.exe88⤵PID:2308
-
\??\c:\tnnhbn.exec:\tnnhbn.exe89⤵PID:1588
-
\??\c:\hnnnbn.exec:\hnnnbn.exe90⤵PID:3612
-
\??\c:\djpjd.exec:\djpjd.exe91⤵PID:4480
-
\??\c:\jvvjd.exec:\jvvjd.exe92⤵PID:3292
-
\??\c:\ffllllf.exec:\ffllllf.exe93⤵PID:744
-
\??\c:\hnbbnn.exec:\hnbbnn.exe94⤵PID:932
-
\??\c:\thbbnn.exec:\thbbnn.exe95⤵PID:2764
-
\??\c:\vjvvp.exec:\vjvvp.exe96⤵PID:1340
-
\??\c:\djppd.exec:\djppd.exe97⤵PID:552
-
\??\c:\9xfrlrf.exec:\9xfrlrf.exe98⤵PID:4004
-
\??\c:\nhhbnh.exec:\nhhbnh.exe99⤵PID:636
-
\??\c:\9jppj.exec:\9jppj.exe100⤵PID:860
-
\??\c:\pvjvp.exec:\pvjvp.exe101⤵PID:1484
-
\??\c:\rxlxxxl.exec:\rxlxxxl.exe102⤵PID:1732
-
\??\c:\rxxlrrl.exec:\rxxlrrl.exe103⤵PID:2284
-
\??\c:\htnbnn.exec:\htnbnn.exe104⤵PID:2452
-
\??\c:\vjjdv.exec:\vjjdv.exe105⤵PID:5092
-
\??\c:\djppd.exec:\djppd.exe106⤵PID:1504
-
\??\c:\flrrrrr.exec:\flrrrrr.exe107⤵PID:5064
-
\??\c:\xffrllx.exec:\xffrllx.exe108⤵PID:3684
-
\??\c:\hnttnn.exec:\hnttnn.exe109⤵PID:2608
-
\??\c:\dpjvp.exec:\dpjvp.exe110⤵PID:4472
-
\??\c:\vddvp.exec:\vddvp.exe111⤵PID:1756
-
\??\c:\xrlxrlf.exec:\xrlxrlf.exe112⤵PID:1040
-
\??\c:\httbbh.exec:\httbbh.exe113⤵PID:2008
-
\??\c:\5tbbtb.exec:\5tbbtb.exe114⤵PID:1916
-
\??\c:\vpddv.exec:\vpddv.exe115⤵PID:4796
-
\??\c:\fxxxxlx.exec:\fxxxxlx.exe116⤵PID:3540
-
\??\c:\lrxrrrx.exec:\lrxrrrx.exe117⤵PID:3504
-
\??\c:\hhnbbh.exec:\hhnbbh.exe118⤵PID:4020
-
\??\c:\hhnbtn.exec:\hhnbtn.exe119⤵PID:3444
-
\??\c:\pdppj.exec:\pdppj.exe120⤵PID:2412
-
\??\c:\lflllrr.exec:\lflllrr.exe121⤵PID:2212
-
\??\c:\ffrrrxx.exec:\ffrrrxx.exe122⤵PID:2536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-