Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 19:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c86dfa8feef7c24c5b5137eae705760_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
0c86dfa8feef7c24c5b5137eae705760_NeikiAnalytics.exe
-
Size
62KB
-
MD5
0c86dfa8feef7c24c5b5137eae705760
-
SHA1
4521e0c33a974b2a1e64f2ab6e7997046916c7eb
-
SHA256
f049bc9b8865d0927215c0f6052f96263ff357ef8947bb92966dadb2cf58279a
-
SHA512
0f90a04a8bb8d871ee6d46ee765d9acbed8fc031fa572d82d8c624870f3ca7298fa741c21f7374892b4e65d3e1bef59540e7c567b3b62116ebc9eb790e273ecd
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDII9ZvHKE4:ymb3NkkiQ3mdBjFII9ZvHKE4
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2948-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2360-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2108-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2504-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3468 xrlrrxl.exe 2360 3nnbhn.exe 4168 9ttttt.exe 2908 rlrrrfl.exe 1772 rfxrffx.exe 2108 nhtbhn.exe 1016 5jvvj.exe 1908 pjjjj.exe 2164 rrrrrxf.exe 2608 fllllll.exe 4604 1tbttt.exe 4000 vjvdj.exe 4368 lfllfll.exe 3292 tttttt.exe 3120 9bhhhn.exe 4532 pvdjj.exe 4484 lrrrrrl.exe 2504 htnhbh.exe 1948 ppjjd.exe 4944 jpjjp.exe 3220 rlxffll.exe 536 hhtbtn.exe 4464 vjvvd.exe 2448 jdddj.exe 4516 lllxrxx.exe 400 bbhhnh.exe 4964 bbbbbh.exe 1752 ddvvj.exe 4860 rrfffff.exe 3508 nntbht.exe 548 hhnhhh.exe 3704 9dddd.exe 1156 1frrxff.exe 2120 ffxfxxf.exe 3104 1httbb.exe 3384 djppd.exe 3756 jpjjd.exe 3264 xlxrxrl.exe 3660 thnhbt.exe 208 dpddd.exe 2868 7ddvv.exe 2544 frrrlll.exe 768 fffrrrr.exe 4372 9ntnnn.exe 2192 bhtbhh.exe 1772 vvvvp.exe 3340 vjvdd.exe 2108 lffflll.exe 3112 rxflrrr.exe 4088 tbhhbh.exe 4896 tntbbb.exe 908 hbbtnt.exe 2568 1jpjd.exe 4604 lrxlfxl.exe 3992 frfflrx.exe 5092 hhnhtn.exe 5060 jjjjv.exe 1608 pvjjd.exe 3432 7lrxxff.exe 1916 lxfxxxr.exe 1080 hhtthh.exe 1860 3nhnnn.exe 1184 djjpp.exe 380 7dddv.exe -
resource yara_rule behavioral2/memory/2948-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2360-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2504-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1948-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2948 wrote to memory of 3468 2948 0c86dfa8feef7c24c5b5137eae705760_NeikiAnalytics.exe 83 PID 2948 wrote to memory of 3468 2948 0c86dfa8feef7c24c5b5137eae705760_NeikiAnalytics.exe 83 PID 2948 wrote to memory of 3468 2948 0c86dfa8feef7c24c5b5137eae705760_NeikiAnalytics.exe 83 PID 3468 wrote to memory of 2360 3468 xrlrrxl.exe 84 PID 3468 wrote to memory of 2360 3468 xrlrrxl.exe 84 PID 3468 wrote to memory of 2360 3468 xrlrrxl.exe 84 PID 2360 wrote to memory of 4168 2360 3nnbhn.exe 85 PID 2360 wrote to memory of 4168 2360 3nnbhn.exe 85 PID 2360 wrote to memory of 4168 2360 3nnbhn.exe 85 PID 4168 wrote to memory of 2908 4168 9ttttt.exe 86 PID 4168 wrote to memory of 2908 4168 9ttttt.exe 86 PID 4168 wrote to memory of 2908 4168 9ttttt.exe 86 PID 2908 wrote to memory of 1772 2908 rlrrrfl.exe 87 PID 2908 wrote to memory of 1772 2908 rlrrrfl.exe 87 PID 2908 wrote to memory of 1772 2908 rlrrrfl.exe 87 PID 1772 wrote to memory of 2108 1772 rfxrffx.exe 88 PID 1772 wrote to memory of 2108 1772 rfxrffx.exe 88 PID 1772 wrote to memory of 2108 1772 rfxrffx.exe 88 PID 2108 wrote to memory of 1016 2108 nhtbhn.exe 89 PID 2108 wrote to memory of 1016 2108 nhtbhn.exe 89 PID 2108 wrote to memory of 1016 2108 nhtbhn.exe 89 PID 1016 wrote to memory of 1908 1016 5jvvj.exe 90 PID 1016 wrote to memory of 1908 1016 5jvvj.exe 90 PID 1016 wrote to memory of 1908 1016 5jvvj.exe 90 PID 1908 wrote to memory of 2164 1908 pjjjj.exe 91 PID 1908 wrote to memory of 2164 1908 pjjjj.exe 91 PID 1908 wrote to memory of 2164 1908 pjjjj.exe 91 PID 2164 wrote to memory of 2608 2164 rrrrrxf.exe 92 PID 2164 wrote to memory of 2608 2164 rrrrrxf.exe 92 PID 2164 wrote to memory of 2608 2164 rrrrrxf.exe 92 PID 2608 wrote to memory of 4604 2608 fllllll.exe 93 PID 2608 wrote to memory of 4604 2608 fllllll.exe 93 PID 2608 wrote to memory of 4604 2608 fllllll.exe 93 PID 4604 wrote to memory of 4000 4604 1tbttt.exe 94 PID 4604 wrote to memory of 4000 4604 1tbttt.exe 94 PID 4604 wrote to memory of 4000 4604 1tbttt.exe 94 PID 4000 wrote to memory of 4368 4000 vjvdj.exe 95 PID 4000 wrote to memory of 4368 4000 vjvdj.exe 95 PID 4000 wrote to memory of 4368 4000 vjvdj.exe 95 PID 4368 wrote to memory of 3292 4368 lfllfll.exe 96 PID 4368 wrote to memory of 3292 4368 lfllfll.exe 96 PID 4368 wrote to memory of 3292 4368 lfllfll.exe 96 PID 3292 wrote to memory of 3120 3292 tttttt.exe 97 PID 3292 wrote to memory of 3120 3292 tttttt.exe 97 PID 3292 wrote to memory of 3120 3292 tttttt.exe 97 PID 3120 wrote to memory of 4532 3120 9bhhhn.exe 98 PID 3120 wrote to memory of 4532 3120 9bhhhn.exe 98 PID 3120 wrote to memory of 4532 3120 9bhhhn.exe 98 PID 4532 wrote to memory of 4484 4532 pvdjj.exe 99 PID 4532 wrote to memory of 4484 4532 pvdjj.exe 99 PID 4532 wrote to memory of 4484 4532 pvdjj.exe 99 PID 4484 wrote to memory of 2504 4484 lrrrrrl.exe 100 PID 4484 wrote to memory of 2504 4484 lrrrrrl.exe 100 PID 4484 wrote to memory of 2504 4484 lrrrrrl.exe 100 PID 2504 wrote to memory of 1948 2504 htnhbh.exe 101 PID 2504 wrote to memory of 1948 2504 htnhbh.exe 101 PID 2504 wrote to memory of 1948 2504 htnhbh.exe 101 PID 1948 wrote to memory of 4944 1948 ppjjd.exe 102 PID 1948 wrote to memory of 4944 1948 ppjjd.exe 102 PID 1948 wrote to memory of 4944 1948 ppjjd.exe 102 PID 4944 wrote to memory of 3220 4944 jpjjp.exe 103 PID 4944 wrote to memory of 3220 4944 jpjjp.exe 103 PID 4944 wrote to memory of 3220 4944 jpjjp.exe 103 PID 3220 wrote to memory of 536 3220 rlxffll.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c86dfa8feef7c24c5b5137eae705760_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0c86dfa8feef7c24c5b5137eae705760_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\xrlrrxl.exec:\xrlrrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\3nnbhn.exec:\3nnbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\9ttttt.exec:\9ttttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\rlrrrfl.exec:\rlrrrfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\rfxrffx.exec:\rfxrffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\nhtbhn.exec:\nhtbhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\5jvvj.exec:\5jvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\pjjjj.exec:\pjjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\rrrrrxf.exec:\rrrrrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\fllllll.exec:\fllllll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\1tbttt.exec:\1tbttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\vjvdj.exec:\vjvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\lfllfll.exec:\lfllfll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\tttttt.exec:\tttttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\9bhhhn.exec:\9bhhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\pvdjj.exec:\pvdjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\lrrrrrl.exec:\lrrrrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\htnhbh.exec:\htnhbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\ppjjd.exec:\ppjjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\jpjjp.exec:\jpjjp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\rlxffll.exec:\rlxffll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\hhtbtn.exec:\hhtbtn.exe23⤵
- Executes dropped EXE
PID:536 -
\??\c:\vjvvd.exec:\vjvvd.exe24⤵
- Executes dropped EXE
PID:4464 -
\??\c:\jdddj.exec:\jdddj.exe25⤵
- Executes dropped EXE
PID:2448 -
\??\c:\lllxrxx.exec:\lllxrxx.exe26⤵
- Executes dropped EXE
PID:4516 -
\??\c:\bbhhnh.exec:\bbhhnh.exe27⤵
- Executes dropped EXE
PID:400 -
\??\c:\bbbbbh.exec:\bbbbbh.exe28⤵
- Executes dropped EXE
PID:4964 -
\??\c:\ddvvj.exec:\ddvvj.exe29⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rrfffff.exec:\rrfffff.exe30⤵
- Executes dropped EXE
PID:4860 -
\??\c:\nntbht.exec:\nntbht.exe31⤵
- Executes dropped EXE
PID:3508 -
\??\c:\hhnhhh.exec:\hhnhhh.exe32⤵
- Executes dropped EXE
PID:548 -
\??\c:\9dddd.exec:\9dddd.exe33⤵
- Executes dropped EXE
PID:3704 -
\??\c:\1frrxff.exec:\1frrxff.exe34⤵
- Executes dropped EXE
PID:1156 -
\??\c:\ffxfxxf.exec:\ffxfxxf.exe35⤵
- Executes dropped EXE
PID:2120 -
\??\c:\1httbb.exec:\1httbb.exe36⤵
- Executes dropped EXE
PID:3104 -
\??\c:\djppd.exec:\djppd.exe37⤵
- Executes dropped EXE
PID:3384 -
\??\c:\jpjjd.exec:\jpjjd.exe38⤵
- Executes dropped EXE
PID:3756 -
\??\c:\xlxrxrl.exec:\xlxrxrl.exe39⤵
- Executes dropped EXE
PID:3264 -
\??\c:\thnhbt.exec:\thnhbt.exe40⤵
- Executes dropped EXE
PID:3660 -
\??\c:\3nbbhn.exec:\3nbbhn.exe41⤵PID:4340
-
\??\c:\dpddd.exec:\dpddd.exe42⤵
- Executes dropped EXE
PID:208 -
\??\c:\7ddvv.exec:\7ddvv.exe43⤵
- Executes dropped EXE
PID:2868 -
\??\c:\frrrlll.exec:\frrrlll.exe44⤵
- Executes dropped EXE
PID:2544 -
\??\c:\fffrrrr.exec:\fffrrrr.exe45⤵
- Executes dropped EXE
PID:768 -
\??\c:\9ntnnn.exec:\9ntnnn.exe46⤵
- Executes dropped EXE
PID:4372 -
\??\c:\bhtbhh.exec:\bhtbhh.exe47⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vvvvp.exec:\vvvvp.exe48⤵
- Executes dropped EXE
PID:1772 -
\??\c:\vjvdd.exec:\vjvdd.exe49⤵
- Executes dropped EXE
PID:3340 -
\??\c:\lffflll.exec:\lffflll.exe50⤵
- Executes dropped EXE
PID:2108 -
\??\c:\rxflrrr.exec:\rxflrrr.exe51⤵
- Executes dropped EXE
PID:3112 -
\??\c:\tbhhbh.exec:\tbhhbh.exe52⤵
- Executes dropped EXE
PID:4088 -
\??\c:\tntbbb.exec:\tntbbb.exe53⤵
- Executes dropped EXE
PID:4896 -
\??\c:\hbbtnt.exec:\hbbtnt.exe54⤵
- Executes dropped EXE
PID:908 -
\??\c:\1jpjd.exec:\1jpjd.exe55⤵
- Executes dropped EXE
PID:2568 -
\??\c:\lrxlfxl.exec:\lrxlfxl.exe56⤵
- Executes dropped EXE
PID:4604 -
\??\c:\frfflrx.exec:\frfflrx.exe57⤵
- Executes dropped EXE
PID:3992 -
\??\c:\hhnhtn.exec:\hhnhtn.exe58⤵
- Executes dropped EXE
PID:5092 -
\??\c:\jjjjv.exec:\jjjjv.exe59⤵
- Executes dropped EXE
PID:5060 -
\??\c:\pvjjd.exec:\pvjjd.exe60⤵
- Executes dropped EXE
PID:1608 -
\??\c:\7lrxxff.exec:\7lrxxff.exe61⤵
- Executes dropped EXE
PID:3432 -
\??\c:\lxfxxxr.exec:\lxfxxxr.exe62⤵
- Executes dropped EXE
PID:1916 -
\??\c:\hhtthh.exec:\hhtthh.exe63⤵
- Executes dropped EXE
PID:1080 -
\??\c:\3nhnnn.exec:\3nhnnn.exe64⤵
- Executes dropped EXE
PID:1860 -
\??\c:\djjpp.exec:\djjpp.exe65⤵
- Executes dropped EXE
PID:1184 -
\??\c:\7dddv.exec:\7dddv.exe66⤵
- Executes dropped EXE
PID:380 -
\??\c:\rxrxllf.exec:\rxrxllf.exe67⤵PID:4928
-
\??\c:\rflllrr.exec:\rflllrr.exe68⤵PID:1056
-
\??\c:\bbbbbh.exec:\bbbbbh.exe69⤵PID:736
-
\??\c:\tththn.exec:\tththn.exe70⤵PID:1580
-
\??\c:\3pvvd.exec:\3pvvd.exe71⤵PID:888
-
\??\c:\jjppj.exec:\jjppj.exe72⤵PID:2124
-
\??\c:\7xlllrf.exec:\7xlllrf.exe73⤵PID:3060
-
\??\c:\xrfxxff.exec:\xrfxxff.exe74⤵PID:5104
-
\??\c:\nntnnb.exec:\nntnnb.exe75⤵PID:1848
-
\??\c:\ttnnht.exec:\ttnnht.exe76⤵PID:2528
-
\??\c:\jdjdd.exec:\jdjdd.exe77⤵PID:4816
-
\??\c:\jjpdd.exec:\jjpdd.exe78⤵PID:628
-
\??\c:\xrxxlll.exec:\xrxxlll.exe79⤵PID:4628
-
\??\c:\1xxlxxf.exec:\1xxlxxf.exe80⤵PID:3544
-
\??\c:\9bntbh.exec:\9bntbh.exe81⤵PID:3388
-
\??\c:\nbnttb.exec:\nbnttb.exe82⤵PID:5084
-
\??\c:\ppddp.exec:\ppddp.exe83⤵PID:2028
-
\??\c:\jjdvd.exec:\jjdvd.exe84⤵PID:1152
-
\??\c:\rfrxrxf.exec:\rfrxrxf.exe85⤵PID:2592
-
\??\c:\5rffrxx.exec:\5rffrxx.exe86⤵PID:936
-
\??\c:\hhhhhn.exec:\hhhhhn.exe87⤵PID:624
-
\??\c:\nhttbb.exec:\nhttbb.exe88⤵PID:4328
-
\??\c:\vvdjv.exec:\vvdjv.exe89⤵PID:4528
-
\??\c:\vvddd.exec:\vvddd.exe90⤵PID:2596
-
\??\c:\hbbtnn.exec:\hbbtnn.exe91⤵PID:2868
-
\??\c:\3vvpp.exec:\3vvpp.exe92⤵PID:4080
-
\??\c:\jpjdd.exec:\jpjdd.exe93⤵PID:2872
-
\??\c:\fxxfxff.exec:\fxxfxff.exe94⤵PID:4372
-
\??\c:\hbhhhn.exec:\hbhhhn.exe95⤵PID:2192
-
\??\c:\5hntnn.exec:\5hntnn.exe96⤵PID:1524
-
\??\c:\ddvjp.exec:\ddvjp.exe97⤵PID:1804
-
\??\c:\llxxffr.exec:\llxxffr.exe98⤵PID:4680
-
\??\c:\bthhhn.exec:\bthhhn.exe99⤵PID:2164
-
\??\c:\nhhhbh.exec:\nhhhbh.exe100⤵PID:4836
-
\??\c:\ppppj.exec:\ppppj.exe101⤵PID:4896
-
\??\c:\ddppj.exec:\ddppj.exe102⤵PID:908
-
\??\c:\xxfflll.exec:\xxfflll.exe103⤵PID:1808
-
\??\c:\9flrxff.exec:\9flrxff.exe104⤵PID:2172
-
\??\c:\3hhnhb.exec:\3hhnhb.exe105⤵PID:4368
-
\??\c:\htttnt.exec:\htttnt.exe106⤵PID:4500
-
\??\c:\vvddv.exec:\vvddv.exe107⤵PID:1212
-
\??\c:\jdjjd.exec:\jdjjd.exe108⤵PID:1796
-
\??\c:\rxrxxll.exec:\rxrxxll.exe109⤵PID:4484
-
\??\c:\lflfrrx.exec:\lflfrrx.exe110⤵PID:3212
-
\??\c:\1tttbh.exec:\1tttbh.exe111⤵PID:3912
-
\??\c:\hhttbh.exec:\hhttbh.exe112⤵PID:3400
-
\??\c:\jpjjv.exec:\jpjjv.exe113⤵PID:4944
-
\??\c:\jpjjj.exec:\jpjjj.exe114⤵PID:3100
-
\??\c:\xxrrlll.exec:\xxrrlll.exe115⤵PID:804
-
\??\c:\3fflxxl.exec:\3fflxxl.exe116⤵PID:1904
-
\??\c:\thhttb.exec:\thhttb.exe117⤵PID:736
-
\??\c:\nhnhbb.exec:\nhnhbb.exe118⤵PID:1580
-
\??\c:\jjppp.exec:\jjppp.exe119⤵PID:4956
-
\??\c:\dpvjj.exec:\dpvjj.exe120⤵PID:1648
-
\??\c:\vjdvp.exec:\vjdvp.exe121⤵PID:4964
-
\??\c:\xfllfff.exec:\xfllfff.exe122⤵PID:1752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-