Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 20:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5e8866b36b2ee97022366a478b5e5fa0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
5e8866b36b2ee97022366a478b5e5fa0_NeikiAnalytics.exe
-
Size
480KB
-
MD5
5e8866b36b2ee97022366a478b5e5fa0
-
SHA1
bdce328c6c632a721cd77cb659f81566d2a3c1a9
-
SHA256
50fdba025f265f0981345b19be010ab5a3646d24b7b570ae02252f1a821a53b0
-
SHA512
e2cb9670ed3d45edcb491dbd762604ffc1534bf9e409cc7c3a757ac7ff9aea2b957db9d179e6dc484dd032dcccb56c79f44ea2f31034ecb8d1927ee91d3af8ae
-
SSDEEP
12288:n3C9uDVw6326pKZ9asZqoZHz+evcn0Meh2Fezf:Su326p0aroZt0sf
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3452-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1240-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1364-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3884-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3048-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3164-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 972 9nnhtn.exe 4900 1ppdp.exe 1240 rllflxx.exe 1364 lxrfrlx.exe 1588 bbhtbb.exe 4784 pvdvj.exe 2068 vdvjd.exe 3696 5pjvj.exe 3884 rrlxxlr.exe 3296 hnnhtt.exe 4976 vvpdp.exe 3048 tntthb.exe 2316 vjvpd.exe 1436 rllflrl.exe 1636 1djdv.exe 1920 7djvd.exe 2376 nbhhhh.exe 5116 jvjpv.exe 1112 xlrfrlx.exe 4696 ttnbht.exe 1880 pdvpd.exe 1824 bhtnhb.exe 400 jjpdv.exe 368 fxrlfxr.exe 3164 dvpdp.exe 3968 djpjd.exe 4296 9rrlxrf.exe 4764 pjppv.exe 3520 9lfrffr.exe 4544 5bnnhn.exe 2348 ddjvd.exe 3688 frxrlff.exe 1128 ppvpd.exe 212 pvdpj.exe 4584 1fxrlxl.exe 3264 nhbnht.exe 4448 vvvjp.exe 4708 lxxrlfx.exe 3092 3rxrlfl.exe 3648 bnntnh.exe 4896 7vjvp.exe 2460 lxffrfr.exe 1588 nnbbbh.exe 3476 3ddvj.exe 2472 dvjdp.exe 2068 rllxxrx.exe 1856 hnnnbt.exe 3044 dvvjd.exe 2720 pdjpv.exe 2464 9lfrfxl.exe 1988 nbnhtn.exe 1284 9ppdp.exe 2316 djvpj.exe 2300 bnthhb.exe 4364 tntntn.exe 2780 ddvvp.exe 3908 3xfrlll.exe 3616 3thbbb.exe 4212 3pvjd.exe 1252 rflxlfr.exe 5056 rxxllfx.exe 4660 bbthbb.exe 2572 vpdvp.exe 3672 5llxllx.exe -
resource yara_rule behavioral2/memory/3452-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1364-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3884-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3164-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3452 wrote to memory of 972 3452 5e8866b36b2ee97022366a478b5e5fa0_NeikiAnalytics.exe 83 PID 3452 wrote to memory of 972 3452 5e8866b36b2ee97022366a478b5e5fa0_NeikiAnalytics.exe 83 PID 3452 wrote to memory of 972 3452 5e8866b36b2ee97022366a478b5e5fa0_NeikiAnalytics.exe 83 PID 972 wrote to memory of 4900 972 9nnhtn.exe 84 PID 972 wrote to memory of 4900 972 9nnhtn.exe 84 PID 972 wrote to memory of 4900 972 9nnhtn.exe 84 PID 4900 wrote to memory of 1240 4900 1ppdp.exe 85 PID 4900 wrote to memory of 1240 4900 1ppdp.exe 85 PID 4900 wrote to memory of 1240 4900 1ppdp.exe 85 PID 1240 wrote to memory of 1364 1240 rllflxx.exe 86 PID 1240 wrote to memory of 1364 1240 rllflxx.exe 86 PID 1240 wrote to memory of 1364 1240 rllflxx.exe 86 PID 1364 wrote to memory of 1588 1364 lxrfrlx.exe 87 PID 1364 wrote to memory of 1588 1364 lxrfrlx.exe 87 PID 1364 wrote to memory of 1588 1364 lxrfrlx.exe 87 PID 1588 wrote to memory of 4784 1588 bbhtbb.exe 88 PID 1588 wrote to memory of 4784 1588 bbhtbb.exe 88 PID 1588 wrote to memory of 4784 1588 bbhtbb.exe 88 PID 4784 wrote to memory of 2068 4784 pvdvj.exe 89 PID 4784 wrote to memory of 2068 4784 pvdvj.exe 89 PID 4784 wrote to memory of 2068 4784 pvdvj.exe 89 PID 2068 wrote to memory of 3696 2068 vdvjd.exe 90 PID 2068 wrote to memory of 3696 2068 vdvjd.exe 90 PID 2068 wrote to memory of 3696 2068 vdvjd.exe 90 PID 3696 wrote to memory of 3884 3696 5pjvj.exe 92 PID 3696 wrote to memory of 3884 3696 5pjvj.exe 92 PID 3696 wrote to memory of 3884 3696 5pjvj.exe 92 PID 3884 wrote to memory of 3296 3884 rrlxxlr.exe 93 PID 3884 wrote to memory of 3296 3884 rrlxxlr.exe 93 PID 3884 wrote to memory of 3296 3884 rrlxxlr.exe 93 PID 3296 wrote to memory of 4976 3296 hnnhtt.exe 94 PID 3296 wrote to memory of 4976 3296 hnnhtt.exe 94 PID 3296 wrote to memory of 4976 3296 hnnhtt.exe 94 PID 4976 wrote to memory of 3048 4976 vvpdp.exe 96 PID 4976 wrote to memory of 3048 4976 vvpdp.exe 96 PID 4976 wrote to memory of 3048 4976 vvpdp.exe 96 PID 3048 wrote to memory of 2316 3048 tntthb.exe 97 PID 3048 wrote to memory of 2316 3048 tntthb.exe 97 PID 3048 wrote to memory of 2316 3048 tntthb.exe 97 PID 2316 wrote to memory of 1436 2316 vjvpd.exe 98 PID 2316 wrote to memory of 1436 2316 vjvpd.exe 98 PID 2316 wrote to memory of 1436 2316 vjvpd.exe 98 PID 1436 wrote to memory of 1636 1436 rllflrl.exe 100 PID 1436 wrote to memory of 1636 1436 rllflrl.exe 100 PID 1436 wrote to memory of 1636 1436 rllflrl.exe 100 PID 1636 wrote to memory of 1920 1636 1djdv.exe 101 PID 1636 wrote to memory of 1920 1636 1djdv.exe 101 PID 1636 wrote to memory of 1920 1636 1djdv.exe 101 PID 1920 wrote to memory of 2376 1920 7djvd.exe 102 PID 1920 wrote to memory of 2376 1920 7djvd.exe 102 PID 1920 wrote to memory of 2376 1920 7djvd.exe 102 PID 2376 wrote to memory of 5116 2376 nbhhhh.exe 103 PID 2376 wrote to memory of 5116 2376 nbhhhh.exe 103 PID 2376 wrote to memory of 5116 2376 nbhhhh.exe 103 PID 5116 wrote to memory of 1112 5116 jvjpv.exe 104 PID 5116 wrote to memory of 1112 5116 jvjpv.exe 104 PID 5116 wrote to memory of 1112 5116 jvjpv.exe 104 PID 1112 wrote to memory of 4696 1112 xlrfrlx.exe 105 PID 1112 wrote to memory of 4696 1112 xlrfrlx.exe 105 PID 1112 wrote to memory of 4696 1112 xlrfrlx.exe 105 PID 4696 wrote to memory of 1880 4696 ttnbht.exe 106 PID 4696 wrote to memory of 1880 4696 ttnbht.exe 106 PID 4696 wrote to memory of 1880 4696 ttnbht.exe 106 PID 1880 wrote to memory of 1824 1880 pdvpd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e8866b36b2ee97022366a478b5e5fa0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5e8866b36b2ee97022366a478b5e5fa0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\9nnhtn.exec:\9nnhtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\1ppdp.exec:\1ppdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\rllflxx.exec:\rllflxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\lxrfrlx.exec:\lxrfrlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\bbhtbb.exec:\bbhtbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\pvdvj.exec:\pvdvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\vdvjd.exec:\vdvjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\5pjvj.exec:\5pjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\rrlxxlr.exec:\rrlxxlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\hnnhtt.exec:\hnnhtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\vvpdp.exec:\vvpdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\tntthb.exec:\tntthb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\vjvpd.exec:\vjvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\rllflrl.exec:\rllflrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\1djdv.exec:\1djdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\7djvd.exec:\7djvd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\nbhhhh.exec:\nbhhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\jvjpv.exec:\jvjpv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\xlrfrlx.exec:\xlrfrlx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\ttnbht.exec:\ttnbht.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\pdvpd.exec:\pdvpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\bhtnhb.exec:\bhtnhb.exe23⤵
- Executes dropped EXE
PID:1824 -
\??\c:\jjpdv.exec:\jjpdv.exe24⤵
- Executes dropped EXE
PID:400 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe25⤵
- Executes dropped EXE
PID:368 -
\??\c:\dvpdp.exec:\dvpdp.exe26⤵
- Executes dropped EXE
PID:3164 -
\??\c:\djpjd.exec:\djpjd.exe27⤵
- Executes dropped EXE
PID:3968 -
\??\c:\9rrlxrf.exec:\9rrlxrf.exe28⤵
- Executes dropped EXE
PID:4296 -
\??\c:\pjppv.exec:\pjppv.exe29⤵
- Executes dropped EXE
PID:4764 -
\??\c:\9lfrffr.exec:\9lfrffr.exe30⤵
- Executes dropped EXE
PID:3520 -
\??\c:\5bnnhn.exec:\5bnnhn.exe31⤵
- Executes dropped EXE
PID:4544 -
\??\c:\ddjvd.exec:\ddjvd.exe32⤵
- Executes dropped EXE
PID:2348 -
\??\c:\frxrlff.exec:\frxrlff.exe33⤵
- Executes dropped EXE
PID:3688 -
\??\c:\ppvpd.exec:\ppvpd.exe34⤵
- Executes dropped EXE
PID:1128 -
\??\c:\pvdpj.exec:\pvdpj.exe35⤵
- Executes dropped EXE
PID:212 -
\??\c:\1fxrlxl.exec:\1fxrlxl.exe36⤵
- Executes dropped EXE
PID:4584 -
\??\c:\nhbnht.exec:\nhbnht.exe37⤵
- Executes dropped EXE
PID:3264 -
\??\c:\vvvjp.exec:\vvvjp.exe38⤵
- Executes dropped EXE
PID:4448 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe39⤵
- Executes dropped EXE
PID:4708 -
\??\c:\3rxrlfl.exec:\3rxrlfl.exe40⤵
- Executes dropped EXE
PID:3092 -
\??\c:\bnntnh.exec:\bnntnh.exe41⤵
- Executes dropped EXE
PID:3648 -
\??\c:\7vjvp.exec:\7vjvp.exe42⤵
- Executes dropped EXE
PID:4896 -
\??\c:\lxffrfr.exec:\lxffrfr.exe43⤵
- Executes dropped EXE
PID:2460 -
\??\c:\nnbbbh.exec:\nnbbbh.exe44⤵
- Executes dropped EXE
PID:1588 -
\??\c:\3ddvj.exec:\3ddvj.exe45⤵
- Executes dropped EXE
PID:3476 -
\??\c:\dvjdp.exec:\dvjdp.exe46⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rllxxrx.exec:\rllxxrx.exe47⤵
- Executes dropped EXE
PID:2068 -
\??\c:\hnnnbt.exec:\hnnnbt.exe48⤵
- Executes dropped EXE
PID:1856 -
\??\c:\dvvjd.exec:\dvvjd.exe49⤵
- Executes dropped EXE
PID:3044 -
\??\c:\pdjpv.exec:\pdjpv.exe50⤵
- Executes dropped EXE
PID:2720 -
\??\c:\9lfrfxl.exec:\9lfrfxl.exe51⤵
- Executes dropped EXE
PID:2464 -
\??\c:\nbnhtn.exec:\nbnhtn.exe52⤵
- Executes dropped EXE
PID:1988 -
\??\c:\9ppdp.exec:\9ppdp.exe53⤵
- Executes dropped EXE
PID:1284 -
\??\c:\djvpj.exec:\djvpj.exe54⤵
- Executes dropped EXE
PID:2316 -
\??\c:\bnthhb.exec:\bnthhb.exe55⤵
- Executes dropped EXE
PID:2300 -
\??\c:\tntntn.exec:\tntntn.exe56⤵
- Executes dropped EXE
PID:4364 -
\??\c:\ddvvp.exec:\ddvvp.exe57⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3xfrlll.exec:\3xfrlll.exe58⤵
- Executes dropped EXE
PID:3908 -
\??\c:\3thbbb.exec:\3thbbb.exe59⤵
- Executes dropped EXE
PID:3616 -
\??\c:\3pvjd.exec:\3pvjd.exe60⤵
- Executes dropped EXE
PID:4212 -
\??\c:\rflxlfr.exec:\rflxlfr.exe61⤵
- Executes dropped EXE
PID:1252 -
\??\c:\rxxllfx.exec:\rxxllfx.exe62⤵
- Executes dropped EXE
PID:5056 -
\??\c:\bbthbb.exec:\bbthbb.exe63⤵
- Executes dropped EXE
PID:4660 -
\??\c:\vpdvp.exec:\vpdvp.exe64⤵
- Executes dropped EXE
PID:2572 -
\??\c:\5llxllx.exec:\5llxllx.exe65⤵
- Executes dropped EXE
PID:3672 -
\??\c:\lffxllf.exec:\lffxllf.exe66⤵PID:3556
-
\??\c:\nbhbnh.exec:\nbhbnh.exe67⤵PID:4980
-
\??\c:\3vpjv.exec:\3vpjv.exe68⤵PID:2140
-
\??\c:\llrlfxr.exec:\llrlfxr.exe69⤵PID:368
-
\??\c:\3bbnbt.exec:\3bbnbt.exe70⤵PID:3164
-
\??\c:\1htnhb.exec:\1htnhb.exe71⤵PID:2056
-
\??\c:\pjjdd.exec:\pjjdd.exe72⤵PID:3964
-
\??\c:\lfrfrlx.exec:\lfrfrlx.exe73⤵PID:828
-
\??\c:\ffxrrff.exec:\ffxrrff.exe74⤵PID:624
-
\??\c:\btnhnh.exec:\btnhnh.exe75⤵PID:1544
-
\??\c:\9vpvp.exec:\9vpvp.exe76⤵PID:3176
-
\??\c:\dvvjd.exec:\dvvjd.exe77⤵PID:4824
-
\??\c:\frrlfxf.exec:\frrlfxf.exe78⤵PID:4296
-
\??\c:\tbbthh.exec:\tbbthh.exe79⤵PID:4224
-
\??\c:\dpddj.exec:\dpddj.exe80⤵PID:2820
-
\??\c:\jdvpd.exec:\jdvpd.exe81⤵PID:3520
-
\??\c:\rffffll.exec:\rffffll.exe82⤵PID:3108
-
\??\c:\thbtnb.exec:\thbtnb.exe83⤵PID:4028
-
\??\c:\jppjv.exec:\jppjv.exe84⤵PID:1108
-
\??\c:\xffrllx.exec:\xffrllx.exe85⤵PID:1176
-
\??\c:\frxrrrl.exec:\frxrrrl.exe86⤵PID:640
-
\??\c:\7bnthh.exec:\7bnthh.exe87⤵PID:4532
-
\??\c:\vjdpj.exec:\vjdpj.exe88⤵PID:4112
-
\??\c:\rrrlffx.exec:\rrrlffx.exe89⤵PID:4300
-
\??\c:\tnnhtn.exec:\tnnhtn.exe90⤵PID:2020
-
\??\c:\bnhnbb.exec:\bnhnbb.exe91⤵PID:3460
-
\??\c:\7jpdv.exec:\7jpdv.exe92⤵PID:412
-
\??\c:\flllfxr.exec:\flllfxr.exe93⤵PID:728
-
\??\c:\htbntt.exec:\htbntt.exe94⤵PID:4600
-
\??\c:\1pvpp.exec:\1pvpp.exe95⤵PID:1320
-
\??\c:\xllxrrl.exec:\xllxrrl.exe96⤵PID:2472
-
\??\c:\ttbnbt.exec:\ttbnbt.exe97⤵PID:2760
-
\??\c:\nhhhnn.exec:\nhhhnn.exe98⤵PID:4712
-
\??\c:\dpdpv.exec:\dpdpv.exe99⤵PID:2564
-
\??\c:\rrxxffr.exec:\rrxxffr.exe100⤵PID:532
-
\??\c:\xlrfrlr.exec:\xlrfrlr.exe101⤵PID:1116
-
\??\c:\tbnhtt.exec:\tbnhtt.exe102⤵PID:2452
-
\??\c:\dddjd.exec:\dddjd.exe103⤵PID:3892
-
\??\c:\lxfxllf.exec:\lxfxllf.exe104⤵PID:2844
-
\??\c:\bhbbtt.exec:\bhbbtt.exe105⤵PID:5032
-
\??\c:\7nnnhh.exec:\7nnnhh.exe106⤵PID:4080
-
\??\c:\pjpjj.exec:\pjpjj.exe107⤵PID:920
-
\??\c:\rllrllf.exec:\rllrllf.exe108⤵PID:1252
-
\??\c:\bnbbtt.exec:\bnbbtt.exe109⤵PID:3480
-
\??\c:\pjjdv.exec:\pjjdv.exe110⤵PID:4668
-
\??\c:\3xrrfff.exec:\3xrrfff.exe111⤵PID:1316
-
\??\c:\3hhhbb.exec:\3hhhbb.exe112⤵PID:3672
-
\??\c:\5htnnt.exec:\5htnnt.exe113⤵PID:2196
-
\??\c:\9pdvp.exec:\9pdvp.exe114⤵PID:3568
-
\??\c:\7lfrxrl.exec:\7lfrxrl.exe115⤵PID:2624
-
\??\c:\xrrllll.exec:\xrrllll.exe116⤵PID:3184
-
\??\c:\7hhttn.exec:\7hhttn.exe117⤵PID:404
-
\??\c:\pddvj.exec:\pddvj.exe118⤵PID:5112
-
\??\c:\3lrffff.exec:\3lrffff.exe119⤵PID:4524
-
\??\c:\btnhbn.exec:\btnhbn.exe120⤵PID:3540
-
\??\c:\hhhtnh.exec:\hhhtnh.exe121⤵PID:2260
-
\??\c:\dpppd.exec:\dpppd.exe122⤵PID:4636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-