Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2024, 03:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
86220463e884eb87c5f637949a578440_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
86220463e884eb87c5f637949a578440_NeikiAnalytics.exe
-
Size
480KB
-
MD5
86220463e884eb87c5f637949a578440
-
SHA1
bebd8f2833d5e6db55aad169699c7ff76bbdfa0b
-
SHA256
afa3e5aec89718cebdb5e7408a005433dd4355a667f5b6dc1ae3aa2228aea1fd
-
SHA512
dcdbe275534a23d9c9dd3d47b3e5d5ad2a67da8977d3a044259631362e7d3b4069737b0c35748cfbb8a3affbdb36bdf5f340356e31533401eab362f6626f1fea
-
SSDEEP
12288:n3C9uDVw6326pKZ9asZqoZHz+evcn0Meh2Fezu:Su326p0aroZt0su
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/3008-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/992-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3932-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3776-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1812-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3008 xllxrxx.exe 4684 nnnhtt.exe 3628 djdpj.exe 992 3flxfff.exe 1936 nntnbt.exe 1348 1vjdv.exe 1980 hbthtn.exe 4972 ppdvj.exe 4560 rxffxrl.exe 3932 fxfxxxx.exe 2984 xfrfflx.exe 3992 nhbthh.exe 4296 5pjdp.exe 2528 9nnnhb.exe 2876 dvdvj.exe 4168 nhhtnh.exe 4932 ffrfrrl.exe 3540 rllfxxl.exe 4884 vjdvv.exe 3776 fllrllf.exe 1812 jvvdp.exe 4116 nbbttn.exe 4756 jdjvv.exe 3580 1rxxrfx.exe 2540 tthhbb.exe 4124 vjpjj.exe 2420 5tnhbb.exe 1888 vpvvv.exe 4808 xxxxxrf.exe 4268 bttnhb.exe 5080 5hbtnn.exe 4528 bnhhbt.exe 5096 vdvpj.exe 1188 rrrffrf.exe 4868 hbhhht.exe 4920 5dvjv.exe 3552 xlfrrlr.exe 4596 5ttnhh.exe 1896 jvdvj.exe 4360 flfxrlf.exe 2952 tnbbhn.exe 1280 pjdpv.exe 1076 fxfxrlf.exe 4272 rrxrlfx.exe 1936 pddvj.exe 1284 pjvpv.exe 1056 fxffxlr.exe 1400 hbtbbh.exe 3808 pvjvp.exe 2028 rlfxlfr.exe 4080 rlrlrfl.exe 4888 tnnhtn.exe 4132 jvvpd.exe 3252 9pdpp.exe 1916 fxxrlfx.exe 4820 ttthbt.exe 3712 vvdvv.exe 4232 xfxrlfx.exe 3088 7hhhbb.exe 5008 tnttnt.exe 4176 5ddvd.exe 1884 xflfllx.exe 4416 rlxlxrr.exe 3488 ttbtnh.exe -
resource yara_rule behavioral2/memory/216-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/992-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3932-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3932-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1812-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 216 wrote to memory of 3008 216 86220463e884eb87c5f637949a578440_NeikiAnalytics.exe 82 PID 216 wrote to memory of 3008 216 86220463e884eb87c5f637949a578440_NeikiAnalytics.exe 82 PID 216 wrote to memory of 3008 216 86220463e884eb87c5f637949a578440_NeikiAnalytics.exe 82 PID 3008 wrote to memory of 4684 3008 xllxrxx.exe 83 PID 3008 wrote to memory of 4684 3008 xllxrxx.exe 83 PID 3008 wrote to memory of 4684 3008 xllxrxx.exe 83 PID 4684 wrote to memory of 3628 4684 nnnhtt.exe 84 PID 4684 wrote to memory of 3628 4684 nnnhtt.exe 84 PID 4684 wrote to memory of 3628 4684 nnnhtt.exe 84 PID 3628 wrote to memory of 992 3628 djdpj.exe 85 PID 3628 wrote to memory of 992 3628 djdpj.exe 85 PID 3628 wrote to memory of 992 3628 djdpj.exe 85 PID 992 wrote to memory of 1936 992 3flxfff.exe 86 PID 992 wrote to memory of 1936 992 3flxfff.exe 86 PID 992 wrote to memory of 1936 992 3flxfff.exe 86 PID 1936 wrote to memory of 1348 1936 nntnbt.exe 87 PID 1936 wrote to memory of 1348 1936 nntnbt.exe 87 PID 1936 wrote to memory of 1348 1936 nntnbt.exe 87 PID 1348 wrote to memory of 1980 1348 1vjdv.exe 88 PID 1348 wrote to memory of 1980 1348 1vjdv.exe 88 PID 1348 wrote to memory of 1980 1348 1vjdv.exe 88 PID 1980 wrote to memory of 4972 1980 hbthtn.exe 89 PID 1980 wrote to memory of 4972 1980 hbthtn.exe 89 PID 1980 wrote to memory of 4972 1980 hbthtn.exe 89 PID 4972 wrote to memory of 4560 4972 ppdvj.exe 90 PID 4972 wrote to memory of 4560 4972 ppdvj.exe 90 PID 4972 wrote to memory of 4560 4972 ppdvj.exe 90 PID 4560 wrote to memory of 3932 4560 rxffxrl.exe 91 PID 4560 wrote to memory of 3932 4560 rxffxrl.exe 91 PID 4560 wrote to memory of 3932 4560 rxffxrl.exe 91 PID 3932 wrote to memory of 2984 3932 fxfxxxx.exe 92 PID 3932 wrote to memory of 2984 3932 fxfxxxx.exe 92 PID 3932 wrote to memory of 2984 3932 fxfxxxx.exe 92 PID 2984 wrote to memory of 3992 2984 xfrfflx.exe 93 PID 2984 wrote to memory of 3992 2984 xfrfflx.exe 93 PID 2984 wrote to memory of 3992 2984 xfrfflx.exe 93 PID 3992 wrote to memory of 4296 3992 nhbthh.exe 95 PID 3992 wrote to memory of 4296 3992 nhbthh.exe 95 PID 3992 wrote to memory of 4296 3992 nhbthh.exe 95 PID 4296 wrote to memory of 2528 4296 5pjdp.exe 96 PID 4296 wrote to memory of 2528 4296 5pjdp.exe 96 PID 4296 wrote to memory of 2528 4296 5pjdp.exe 96 PID 2528 wrote to memory of 2876 2528 9nnnhb.exe 98 PID 2528 wrote to memory of 2876 2528 9nnnhb.exe 98 PID 2528 wrote to memory of 2876 2528 9nnnhb.exe 98 PID 2876 wrote to memory of 4168 2876 dvdvj.exe 99 PID 2876 wrote to memory of 4168 2876 dvdvj.exe 99 PID 2876 wrote to memory of 4168 2876 dvdvj.exe 99 PID 4168 wrote to memory of 4932 4168 nhhtnh.exe 101 PID 4168 wrote to memory of 4932 4168 nhhtnh.exe 101 PID 4168 wrote to memory of 4932 4168 nhhtnh.exe 101 PID 4932 wrote to memory of 3540 4932 ffrfrrl.exe 102 PID 4932 wrote to memory of 3540 4932 ffrfrrl.exe 102 PID 4932 wrote to memory of 3540 4932 ffrfrrl.exe 102 PID 3540 wrote to memory of 4884 3540 rllfxxl.exe 103 PID 3540 wrote to memory of 4884 3540 rllfxxl.exe 103 PID 3540 wrote to memory of 4884 3540 rllfxxl.exe 103 PID 4884 wrote to memory of 3776 4884 vjdvv.exe 104 PID 4884 wrote to memory of 3776 4884 vjdvv.exe 104 PID 4884 wrote to memory of 3776 4884 vjdvv.exe 104 PID 3776 wrote to memory of 1812 3776 fllrllf.exe 105 PID 3776 wrote to memory of 1812 3776 fllrllf.exe 105 PID 3776 wrote to memory of 1812 3776 fllrllf.exe 105 PID 1812 wrote to memory of 4116 1812 jvvdp.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\86220463e884eb87c5f637949a578440_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\86220463e884eb87c5f637949a578440_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\xllxrxx.exec:\xllxrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\nnnhtt.exec:\nnnhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\djdpj.exec:\djdpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\3flxfff.exec:\3flxfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\nntnbt.exec:\nntnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\1vjdv.exec:\1vjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\hbthtn.exec:\hbthtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\ppdvj.exec:\ppdvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\rxffxrl.exec:\rxffxrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\xfrfflx.exec:\xfrfflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\nhbthh.exec:\nhbthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\5pjdp.exec:\5pjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\9nnnhb.exec:\9nnnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\dvdvj.exec:\dvdvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\nhhtnh.exec:\nhhtnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\ffrfrrl.exec:\ffrfrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\rllfxxl.exec:\rllfxxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\vjdvv.exec:\vjdvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\fllrllf.exec:\fllrllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\jvvdp.exec:\jvvdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\nbbttn.exec:\nbbttn.exe23⤵
- Executes dropped EXE
PID:4116 -
\??\c:\jdjvv.exec:\jdjvv.exe24⤵
- Executes dropped EXE
PID:4756 -
\??\c:\1rxxrfx.exec:\1rxxrfx.exe25⤵
- Executes dropped EXE
PID:3580 -
\??\c:\tthhbb.exec:\tthhbb.exe26⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vjpjj.exec:\vjpjj.exe27⤵
- Executes dropped EXE
PID:4124 -
\??\c:\5tnhbb.exec:\5tnhbb.exe28⤵
- Executes dropped EXE
PID:2420 -
\??\c:\vpvvv.exec:\vpvvv.exe29⤵
- Executes dropped EXE
PID:1888 -
\??\c:\xxxxxrf.exec:\xxxxxrf.exe30⤵
- Executes dropped EXE
PID:4808 -
\??\c:\bttnhb.exec:\bttnhb.exe31⤵
- Executes dropped EXE
PID:4268 -
\??\c:\5hbtnn.exec:\5hbtnn.exe32⤵
- Executes dropped EXE
PID:5080 -
\??\c:\bnhhbt.exec:\bnhhbt.exe33⤵
- Executes dropped EXE
PID:4528 -
\??\c:\vdvpj.exec:\vdvpj.exe34⤵
- Executes dropped EXE
PID:5096 -
\??\c:\rrrffrf.exec:\rrrffrf.exe35⤵
- Executes dropped EXE
PID:1188 -
\??\c:\hbhhht.exec:\hbhhht.exe36⤵
- Executes dropped EXE
PID:4868 -
\??\c:\5dvjv.exec:\5dvjv.exe37⤵
- Executes dropped EXE
PID:4920 -
\??\c:\xlfrrlr.exec:\xlfrrlr.exe38⤵
- Executes dropped EXE
PID:3552 -
\??\c:\5ttnhh.exec:\5ttnhh.exe39⤵
- Executes dropped EXE
PID:4596 -
\??\c:\jvdvj.exec:\jvdvj.exe40⤵
- Executes dropped EXE
PID:1896 -
\??\c:\flfxrlf.exec:\flfxrlf.exe41⤵
- Executes dropped EXE
PID:4360 -
\??\c:\tnbbhn.exec:\tnbbhn.exe42⤵
- Executes dropped EXE
PID:2952 -
\??\c:\pjdpv.exec:\pjdpv.exe43⤵
- Executes dropped EXE
PID:1280 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe44⤵
- Executes dropped EXE
PID:1076 -
\??\c:\rrxrlfx.exec:\rrxrlfx.exe45⤵
- Executes dropped EXE
PID:4272 -
\??\c:\pddvj.exec:\pddvj.exe46⤵
- Executes dropped EXE
PID:1936 -
\??\c:\pjvpv.exec:\pjvpv.exe47⤵
- Executes dropped EXE
PID:1284 -
\??\c:\fxffxlr.exec:\fxffxlr.exe48⤵
- Executes dropped EXE
PID:1056 -
\??\c:\hbtbbh.exec:\hbtbbh.exe49⤵
- Executes dropped EXE
PID:1400 -
\??\c:\pvjvp.exec:\pvjvp.exe50⤵
- Executes dropped EXE
PID:3808 -
\??\c:\rlfxlfr.exec:\rlfxlfr.exe51⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rlrlrfl.exec:\rlrlrfl.exe52⤵
- Executes dropped EXE
PID:4080 -
\??\c:\tnnhtn.exec:\tnnhtn.exe53⤵
- Executes dropped EXE
PID:4888 -
\??\c:\jvvpd.exec:\jvvpd.exe54⤵
- Executes dropped EXE
PID:4132 -
\??\c:\9pdpp.exec:\9pdpp.exe55⤵
- Executes dropped EXE
PID:3252 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe56⤵
- Executes dropped EXE
PID:1916 -
\??\c:\ttthbt.exec:\ttthbt.exe57⤵
- Executes dropped EXE
PID:4820 -
\??\c:\vvdvv.exec:\vvdvv.exe58⤵
- Executes dropped EXE
PID:3712 -
\??\c:\xfxrlfx.exec:\xfxrlfx.exe59⤵
- Executes dropped EXE
PID:4232 -
\??\c:\7hhhbb.exec:\7hhhbb.exe60⤵
- Executes dropped EXE
PID:3088 -
\??\c:\tnttnt.exec:\tnttnt.exe61⤵
- Executes dropped EXE
PID:5008 -
\??\c:\5ddvd.exec:\5ddvd.exe62⤵
- Executes dropped EXE
PID:4176 -
\??\c:\xflfllx.exec:\xflfllx.exe63⤵
- Executes dropped EXE
PID:1884 -
\??\c:\rlxlxrr.exec:\rlxlxrr.exe64⤵
- Executes dropped EXE
PID:4416 -
\??\c:\ttbtnh.exec:\ttbtnh.exe65⤵
- Executes dropped EXE
PID:3488 -
\??\c:\vpppj.exec:\vpppj.exe66⤵PID:4480
-
\??\c:\7vpdp.exec:\7vpdp.exe67⤵PID:2904
-
\??\c:\xflxrrf.exec:\xflxrrf.exe68⤵PID:960
-
\??\c:\hbnhth.exec:\hbnhth.exe69⤵PID:892
-
\??\c:\pdvjv.exec:\pdvjv.exe70⤵PID:3572
-
\??\c:\vjdvj.exec:\vjdvj.exe71⤵PID:4376
-
\??\c:\rxfrffr.exec:\rxfrffr.exe72⤵PID:3608
-
\??\c:\bnhbnb.exec:\bnhbnb.exe73⤵PID:3984
-
\??\c:\dvjvv.exec:\dvjvv.exe74⤵PID:2696
-
\??\c:\djpdd.exec:\djpdd.exe75⤵PID:3960
-
\??\c:\rxfrlfr.exec:\rxfrlfr.exe76⤵PID:2524
-
\??\c:\htbtbb.exec:\htbtbb.exe77⤵PID:3680
-
\??\c:\nhthhh.exec:\nhthhh.exe78⤵PID:2560
-
\??\c:\7ppjj.exec:\7ppjj.exe79⤵PID:3352
-
\??\c:\xfllfxr.exec:\xfllfxr.exe80⤵PID:1556
-
\??\c:\nbntht.exec:\nbntht.exe81⤵PID:2300
-
\??\c:\nbhbtt.exec:\nbhbtt.exe82⤵PID:4564
-
\??\c:\vjjdv.exec:\vjjdv.exe83⤵PID:4948
-
\??\c:\xfrlxxx.exec:\xfrlxxx.exe84⤵PID:5096
-
\??\c:\vpjjd.exec:\vpjjd.exe85⤵PID:2616
-
\??\c:\rffxxxr.exec:\rffxxxr.exe86⤵PID:4760
-
\??\c:\nhbhbh.exec:\nhbhbh.exe87⤵PID:4920
-
\??\c:\3jppj.exec:\3jppj.exe88⤵PID:1808
-
\??\c:\9lxrxxr.exec:\9lxrxxr.exe89⤵PID:4580
-
\??\c:\xxxrllf.exec:\xxxrllf.exe90⤵PID:2956
-
\??\c:\7nnnnt.exec:\7nnnnt.exe91⤵PID:4360
-
\??\c:\1vddd.exec:\1vddd.exe92⤵PID:1692
-
\??\c:\jjpjd.exec:\jjpjd.exe93⤵PID:1280
-
\??\c:\frxrrrl.exec:\frxrrrl.exe94⤵PID:4632
-
\??\c:\htbhhn.exec:\htbhhn.exe95⤵PID:5068
-
\??\c:\pjjdd.exec:\pjjdd.exe96⤵PID:1936
-
\??\c:\rrxrrrx.exec:\rrxrrrx.exe97⤵PID:1284
-
\??\c:\9tnhbt.exec:\9tnhbt.exe98⤵PID:1056
-
\??\c:\bnnnhb.exec:\bnnnhb.exe99⤵PID:1400
-
\??\c:\3vvvv.exec:\3vvvv.exe100⤵PID:4396
-
\??\c:\3xxxlxr.exec:\3xxxlxr.exe101⤵PID:4100
-
\??\c:\3fffflr.exec:\3fffflr.exe102⤵PID:2068
-
\??\c:\3tbtht.exec:\3tbtht.exe103⤵PID:3308
-
\??\c:\jvjdv.exec:\jvjdv.exe104⤵PID:1636
-
\??\c:\1lfffff.exec:\1lfffff.exe105⤵PID:4820
-
\??\c:\rlfxrlx.exec:\rlfxrlx.exe106⤵PID:4448
-
\??\c:\hbtnnh.exec:\hbtnnh.exe107⤵PID:2772
-
\??\c:\djvpd.exec:\djvpd.exe108⤵PID:4144
-
\??\c:\1djdv.exec:\1djdv.exe109⤵PID:4960
-
\??\c:\xlrlffr.exec:\xlrlffr.exe110⤵PID:3540
-
\??\c:\bnhhnt.exec:\bnhhnt.exe111⤵PID:2440
-
\??\c:\pvppj.exec:\pvppj.exe112⤵PID:4076
-
\??\c:\rfffxxx.exec:\rfffxxx.exe113⤵PID:2808
-
\??\c:\lxxrllf.exec:\lxxrllf.exe114⤵PID:428
-
\??\c:\httntt.exec:\httntt.exe115⤵PID:4404
-
\??\c:\vdpjp.exec:\vdpjp.exe116⤵PID:1736
-
\??\c:\rrrfxxr.exec:\rrrfxxr.exe117⤵PID:3348
-
\??\c:\ttbttt.exec:\ttbttt.exe118⤵PID:2804
-
\??\c:\jdddv.exec:\jdddv.exe119⤵PID:2084
-
\??\c:\flrlrlf.exec:\flrlrlf.exe120⤵PID:3728
-
\??\c:\7bbthb.exec:\7bbthb.exe121⤵PID:2728
-
\??\c:\thhhbb.exec:\thhhbb.exe122⤵PID:3408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-