Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 11:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a145b1276f3541b939527b9302ad4a80_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
a145b1276f3541b939527b9302ad4a80_NeikiAnalytics.exe
-
Size
55KB
-
MD5
a145b1276f3541b939527b9302ad4a80
-
SHA1
52caae4b4f57b0f3b934d556e3456e4720847c61
-
SHA256
23b91e7ecf1ab852ec8e7daa9f295d5fb74ab963a95d92a6987b0e5e967b0823
-
SHA512
f90fd737eaf869124aeffa007bbe6c6229b090f1f4cd554281998a3ab33cb35029acf01080a1fcd9990cf9ec1c863aca85f6e42a60a88f4c8f2fd252efb931d9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFyPYt:ymb3NkkiQ3mdBjFIFZt
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/4980-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-59-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1004-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2884-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1304-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2344 bhtnhb.exe 2520 vpjvp.exe 3260 flfxrxr.exe 436 nhbntt.exe 3320 dvpdv.exe 1004 lfxrllf.exe 3240 hbhhbb.exe 2884 nnnnnt.exe 3328 xlxxrxx.exe 1272 nttnnn.exe 5028 hnbhnt.exe 5076 pvppd.exe 4112 flxrlxr.exe 3688 hhbbhb.exe 4868 jpvpd.exe 4976 9xxrrlf.exe 3620 fllllfx.exe 2956 thbtnn.exe 2444 1pddp.exe 4512 xlxrrrl.exe 4316 5fxfxxx.exe 2872 9nbbhh.exe 1304 jvvvj.exe 5056 jjjjd.exe 4936 3xxrfxr.exe 392 hbttbb.exe 2012 7pdvj.exe 2288 3frlxxf.exe 968 3xfxrlf.exe 2372 tthhnn.exe 3424 jjjdv.exe 952 3llrrrl.exe 3208 lflrllf.exe 2136 bttnhh.exe 5096 9bhhbt.exe 1548 pddvv.exe 4500 5rlfxxx.exe 2880 rxrfxxr.exe 4932 thnbnn.exe 4488 nhhhtt.exe 988 dpjdv.exe 1220 fxxllfx.exe 4064 frrllff.exe 2640 hnhtnb.exe 436 ntbtnt.exe 3784 jvddd.exe 224 xxlrlll.exe 4120 bntttn.exe 4872 3dppp.exe 3972 pvpjj.exe 3744 frrlfff.exe 2788 xffxlll.exe 2148 hbhnnn.exe 3288 jvvpj.exe 1112 dppvv.exe 3024 frrlffx.exe 2656 bbhnth.exe 4388 pppjv.exe 2284 rffllrl.exe 4600 5tnhbb.exe 3756 bnhhtt.exe 2064 jjdpj.exe 1032 5vpjd.exe 2140 rllxlll.exe -
resource yara_rule behavioral2/memory/4980-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2884-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2884-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1304-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4980 wrote to memory of 2344 4980 a145b1276f3541b939527b9302ad4a80_NeikiAnalytics.exe 82 PID 4980 wrote to memory of 2344 4980 a145b1276f3541b939527b9302ad4a80_NeikiAnalytics.exe 82 PID 4980 wrote to memory of 2344 4980 a145b1276f3541b939527b9302ad4a80_NeikiAnalytics.exe 82 PID 2344 wrote to memory of 2520 2344 bhtnhb.exe 83 PID 2344 wrote to memory of 2520 2344 bhtnhb.exe 83 PID 2344 wrote to memory of 2520 2344 bhtnhb.exe 83 PID 2520 wrote to memory of 3260 2520 vpjvp.exe 84 PID 2520 wrote to memory of 3260 2520 vpjvp.exe 84 PID 2520 wrote to memory of 3260 2520 vpjvp.exe 84 PID 3260 wrote to memory of 436 3260 flfxrxr.exe 85 PID 3260 wrote to memory of 436 3260 flfxrxr.exe 85 PID 3260 wrote to memory of 436 3260 flfxrxr.exe 85 PID 436 wrote to memory of 3320 436 nhbntt.exe 86 PID 436 wrote to memory of 3320 436 nhbntt.exe 86 PID 436 wrote to memory of 3320 436 nhbntt.exe 86 PID 3320 wrote to memory of 1004 3320 dvpdv.exe 87 PID 3320 wrote to memory of 1004 3320 dvpdv.exe 87 PID 3320 wrote to memory of 1004 3320 dvpdv.exe 87 PID 1004 wrote to memory of 3240 1004 lfxrllf.exe 88 PID 1004 wrote to memory of 3240 1004 lfxrllf.exe 88 PID 1004 wrote to memory of 3240 1004 lfxrllf.exe 88 PID 3240 wrote to memory of 2884 3240 hbhhbb.exe 89 PID 3240 wrote to memory of 2884 3240 hbhhbb.exe 89 PID 3240 wrote to memory of 2884 3240 hbhhbb.exe 89 PID 2884 wrote to memory of 3328 2884 nnnnnt.exe 90 PID 2884 wrote to memory of 3328 2884 nnnnnt.exe 90 PID 2884 wrote to memory of 3328 2884 nnnnnt.exe 90 PID 3328 wrote to memory of 1272 3328 xlxxrxx.exe 91 PID 3328 wrote to memory of 1272 3328 xlxxrxx.exe 91 PID 3328 wrote to memory of 1272 3328 xlxxrxx.exe 91 PID 1272 wrote to memory of 5028 1272 nttnnn.exe 92 PID 1272 wrote to memory of 5028 1272 nttnnn.exe 92 PID 1272 wrote to memory of 5028 1272 nttnnn.exe 92 PID 5028 wrote to memory of 5076 5028 hnbhnt.exe 93 PID 5028 wrote to memory of 5076 5028 hnbhnt.exe 93 PID 5028 wrote to memory of 5076 5028 hnbhnt.exe 93 PID 5076 wrote to memory of 4112 5076 pvppd.exe 94 PID 5076 wrote to memory of 4112 5076 pvppd.exe 94 PID 5076 wrote to memory of 4112 5076 pvppd.exe 94 PID 4112 wrote to memory of 3688 4112 flxrlxr.exe 95 PID 4112 wrote to memory of 3688 4112 flxrlxr.exe 95 PID 4112 wrote to memory of 3688 4112 flxrlxr.exe 95 PID 3688 wrote to memory of 4868 3688 hhbbhb.exe 96 PID 3688 wrote to memory of 4868 3688 hhbbhb.exe 96 PID 3688 wrote to memory of 4868 3688 hhbbhb.exe 96 PID 4868 wrote to memory of 4976 4868 jpvpd.exe 97 PID 4868 wrote to memory of 4976 4868 jpvpd.exe 97 PID 4868 wrote to memory of 4976 4868 jpvpd.exe 97 PID 4976 wrote to memory of 3620 4976 9xxrrlf.exe 98 PID 4976 wrote to memory of 3620 4976 9xxrrlf.exe 98 PID 4976 wrote to memory of 3620 4976 9xxrrlf.exe 98 PID 3620 wrote to memory of 2956 3620 fllllfx.exe 99 PID 3620 wrote to memory of 2956 3620 fllllfx.exe 99 PID 3620 wrote to memory of 2956 3620 fllllfx.exe 99 PID 2956 wrote to memory of 2444 2956 thbtnn.exe 100 PID 2956 wrote to memory of 2444 2956 thbtnn.exe 100 PID 2956 wrote to memory of 2444 2956 thbtnn.exe 100 PID 2444 wrote to memory of 4512 2444 1pddp.exe 101 PID 2444 wrote to memory of 4512 2444 1pddp.exe 101 PID 2444 wrote to memory of 4512 2444 1pddp.exe 101 PID 4512 wrote to memory of 4316 4512 xlxrrrl.exe 102 PID 4512 wrote to memory of 4316 4512 xlxrrrl.exe 102 PID 4512 wrote to memory of 4316 4512 xlxrrrl.exe 102 PID 4316 wrote to memory of 2872 4316 5fxfxxx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a145b1276f3541b939527b9302ad4a80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a145b1276f3541b939527b9302ad4a80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\bhtnhb.exec:\bhtnhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\vpjvp.exec:\vpjvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\flfxrxr.exec:\flfxrxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\nhbntt.exec:\nhbntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\dvpdv.exec:\dvpdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\lfxrllf.exec:\lfxrllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\hbhhbb.exec:\hbhhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\nnnnnt.exec:\nnnnnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\xlxxrxx.exec:\xlxxrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\nttnnn.exec:\nttnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\hnbhnt.exec:\hnbhnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\pvppd.exec:\pvppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\flxrlxr.exec:\flxrlxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\hhbbhb.exec:\hhbbhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\jpvpd.exec:\jpvpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\9xxrrlf.exec:\9xxrrlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\fllllfx.exec:\fllllfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\thbtnn.exec:\thbtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\1pddp.exec:\1pddp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\xlxrrrl.exec:\xlxrrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\5fxfxxx.exec:\5fxfxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\9nbbhh.exec:\9nbbhh.exe23⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jvvvj.exec:\jvvvj.exe24⤵
- Executes dropped EXE
PID:1304 -
\??\c:\jjjjd.exec:\jjjjd.exe25⤵
- Executes dropped EXE
PID:5056 -
\??\c:\3xxrfxr.exec:\3xxrfxr.exe26⤵
- Executes dropped EXE
PID:4936 -
\??\c:\hbttbb.exec:\hbttbb.exe27⤵
- Executes dropped EXE
PID:392 -
\??\c:\7pdvj.exec:\7pdvj.exe28⤵
- Executes dropped EXE
PID:2012 -
\??\c:\3frlxxf.exec:\3frlxxf.exe29⤵
- Executes dropped EXE
PID:2288 -
\??\c:\3xfxrlf.exec:\3xfxrlf.exe30⤵
- Executes dropped EXE
PID:968 -
\??\c:\tthhnn.exec:\tthhnn.exe31⤵
- Executes dropped EXE
PID:2372 -
\??\c:\jjjdv.exec:\jjjdv.exe32⤵
- Executes dropped EXE
PID:3424 -
\??\c:\3llrrrl.exec:\3llrrrl.exe33⤵
- Executes dropped EXE
PID:952 -
\??\c:\lflrllf.exec:\lflrllf.exe34⤵
- Executes dropped EXE
PID:3208 -
\??\c:\bttnhh.exec:\bttnhh.exe35⤵
- Executes dropped EXE
PID:2136 -
\??\c:\9bhhbt.exec:\9bhhbt.exe36⤵
- Executes dropped EXE
PID:5096 -
\??\c:\pddvv.exec:\pddvv.exe37⤵
- Executes dropped EXE
PID:1548 -
\??\c:\5rlfxxx.exec:\5rlfxxx.exe38⤵
- Executes dropped EXE
PID:4500 -
\??\c:\rxrfxxr.exec:\rxrfxxr.exe39⤵
- Executes dropped EXE
PID:2880 -
\??\c:\thnbnn.exec:\thnbnn.exe40⤵
- Executes dropped EXE
PID:4932 -
\??\c:\nhhhtt.exec:\nhhhtt.exe41⤵
- Executes dropped EXE
PID:4488 -
\??\c:\dpjdv.exec:\dpjdv.exe42⤵
- Executes dropped EXE
PID:988 -
\??\c:\fxxllfx.exec:\fxxllfx.exe43⤵
- Executes dropped EXE
PID:1220 -
\??\c:\frrllff.exec:\frrllff.exe44⤵
- Executes dropped EXE
PID:4064 -
\??\c:\hnhtnb.exec:\hnhtnb.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\ntbtnt.exec:\ntbtnt.exe46⤵
- Executes dropped EXE
PID:436 -
\??\c:\jvddd.exec:\jvddd.exe47⤵
- Executes dropped EXE
PID:3784 -
\??\c:\xxlrlll.exec:\xxlrlll.exe48⤵
- Executes dropped EXE
PID:224 -
\??\c:\bntttn.exec:\bntttn.exe49⤵
- Executes dropped EXE
PID:4120 -
\??\c:\3dppp.exec:\3dppp.exe50⤵
- Executes dropped EXE
PID:4872 -
\??\c:\pvpjj.exec:\pvpjj.exe51⤵
- Executes dropped EXE
PID:3972 -
\??\c:\frrlfff.exec:\frrlfff.exe52⤵
- Executes dropped EXE
PID:3744 -
\??\c:\xffxlll.exec:\xffxlll.exe53⤵
- Executes dropped EXE
PID:2788 -
\??\c:\hbhnnn.exec:\hbhnnn.exe54⤵
- Executes dropped EXE
PID:2148 -
\??\c:\jvvpj.exec:\jvvpj.exe55⤵
- Executes dropped EXE
PID:3288 -
\??\c:\dppvv.exec:\dppvv.exe56⤵
- Executes dropped EXE
PID:1112 -
\??\c:\frrlffx.exec:\frrlffx.exe57⤵
- Executes dropped EXE
PID:3024 -
\??\c:\bbhnth.exec:\bbhnth.exe58⤵
- Executes dropped EXE
PID:2656 -
\??\c:\pppjv.exec:\pppjv.exe59⤵
- Executes dropped EXE
PID:4388 -
\??\c:\rffllrl.exec:\rffllrl.exe60⤵
- Executes dropped EXE
PID:2284 -
\??\c:\5tnhbb.exec:\5tnhbb.exe61⤵
- Executes dropped EXE
PID:4600 -
\??\c:\bnhhtt.exec:\bnhhtt.exe62⤵
- Executes dropped EXE
PID:3756 -
\??\c:\jjdpj.exec:\jjdpj.exe63⤵
- Executes dropped EXE
PID:2064 -
\??\c:\5vpjd.exec:\5vpjd.exe64⤵
- Executes dropped EXE
PID:1032 -
\??\c:\rllxlll.exec:\rllxlll.exe65⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rlxfxll.exec:\rlxfxll.exe66⤵PID:452
-
\??\c:\nbttnn.exec:\nbttnn.exe67⤵PID:2872
-
\??\c:\jjjvp.exec:\jjjvp.exe68⤵PID:4852
-
\??\c:\9vdvp.exec:\9vdvp.exe69⤵PID:4820
-
\??\c:\fflxxfx.exec:\fflxxfx.exe70⤵PID:4828
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe71⤵PID:1364
-
\??\c:\5hbnhb.exec:\5hbnhb.exe72⤵PID:2016
-
\??\c:\tttthh.exec:\tttthh.exe73⤵PID:4672
-
\??\c:\jjvpj.exec:\jjvpj.exe74⤵PID:4084
-
\??\c:\jvvpj.exec:\jvvpj.exe75⤵PID:5072
-
\??\c:\rfrxlrl.exec:\rfrxlrl.exe76⤵PID:3832
-
\??\c:\btthhb.exec:\btthhb.exe77⤵PID:956
-
\??\c:\tbbtnn.exec:\tbbtnn.exe78⤵PID:4284
-
\??\c:\vvvdd.exec:\vvvdd.exe79⤵PID:2236
-
\??\c:\dvjpj.exec:\dvjpj.exe80⤵PID:5112
-
\??\c:\fxrlfff.exec:\fxrlfff.exe81⤵PID:3236
-
\??\c:\rrfxfff.exec:\rrfxfff.exe82⤵PID:2452
-
\??\c:\5nnbtb.exec:\5nnbtb.exe83⤵PID:2172
-
\??\c:\thhbnn.exec:\thhbnn.exe84⤵PID:1108
-
\??\c:\vdjdp.exec:\vdjdp.exe85⤵PID:4336
-
\??\c:\djppj.exec:\djppj.exe86⤵PID:1916
-
\??\c:\1rrlffr.exec:\1rrlffr.exe87⤵PID:1992
-
\??\c:\hbtnnn.exec:\hbtnnn.exe88⤵PID:2772
-
\??\c:\bnnnhn.exec:\bnnnhn.exe89⤵PID:3576
-
\??\c:\pjjvj.exec:\pjjvj.exe90⤵PID:4204
-
\??\c:\bnhbbt.exec:\bnhbbt.exe91⤵PID:2316
-
\??\c:\1htnbn.exec:\1htnbn.exe92⤵PID:3320
-
\??\c:\vvpjv.exec:\vvpjv.exe93⤵PID:224
-
\??\c:\ddpjd.exec:\ddpjd.exe94⤵PID:4660
-
\??\c:\xxfxxll.exec:\xxfxxll.exe95⤵PID:3928
-
\??\c:\nbbnhh.exec:\nbbnhh.exe96⤵PID:3352
-
\??\c:\hnnhhn.exec:\hnnhhn.exe97⤵PID:2204
-
\??\c:\pjdpj.exec:\pjdpj.exe98⤵PID:3040
-
\??\c:\rlffxff.exec:\rlffxff.exe99⤵PID:4812
-
\??\c:\rlxxlrf.exec:\rlxxlrf.exe100⤵PID:5076
-
\??\c:\nhnnnt.exec:\nhnnnt.exe101⤵PID:4028
-
\??\c:\hnnhbb.exec:\hnnhbb.exe102⤵PID:3372
-
\??\c:\dvddd.exec:\dvddd.exe103⤵PID:2068
-
\??\c:\fffffff.exec:\fffffff.exe104⤵PID:2656
-
\??\c:\fxllfrr.exec:\fxllfrr.exe105⤵PID:2132
-
\??\c:\bnbbtt.exec:\bnbbtt.exe106⤵PID:5044
-
\??\c:\nnnntt.exec:\nnnntt.exe107⤵PID:1964
-
\??\c:\vdppj.exec:\vdppj.exe108⤵PID:2600
-
\??\c:\dddvj.exec:\dddvj.exe109⤵PID:4512
-
\??\c:\5lxrllx.exec:\5lxrllx.exe110⤵PID:2220
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe111⤵PID:1568
-
\??\c:\btnnnn.exec:\btnnnn.exe112⤵PID:448
-
\??\c:\pjjpv.exec:\pjjpv.exe113⤵PID:5056
-
\??\c:\pvvpj.exec:\pvvpj.exe114⤵PID:4832
-
\??\c:\ddjpp.exec:\ddjpp.exe115⤵PID:1012
-
\??\c:\lflfxxx.exec:\lflfxxx.exe116⤵PID:4344
-
\??\c:\1frrxxl.exec:\1frrxxl.exe117⤵PID:4540
-
\??\c:\btbtnn.exec:\btbtnn.exe118⤵PID:2016
-
\??\c:\tbttnn.exec:\tbttnn.exe119⤵PID:4672
-
\??\c:\pdjdv.exec:\pdjdv.exe120⤵PID:4084
-
\??\c:\pppjj.exec:\pppjj.exe121⤵PID:5072
-
\??\c:\rlfrfrl.exec:\rlfrfrl.exe122⤵PID:1420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-