Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 10:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6486a92d436cc53a45104816a7b6c04fa0393388f7a4da7dd0f6a037469ec477_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
6486a92d436cc53a45104816a7b6c04fa0393388f7a4da7dd0f6a037469ec477_NeikiAnalytics.exe
-
Size
88KB
-
MD5
572122dab9f2e7efcd30988c09151880
-
SHA1
1a7deadb2c3252f1908880b0b9024ef1e27e5926
-
SHA256
6486a92d436cc53a45104816a7b6c04fa0393388f7a4da7dd0f6a037469ec477
-
SHA512
446360475286a693edbc4d0938d2deb6ecf3f8a371c09494190fcf07da5da2c0d694d786600c57be3eb7db3182d7b15057f50588a5f0cb4802b54a3cea7259ed
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2iJvRirE0DmoLZsO4EUe:ymb3NkkiQ3mdBjF+3TU2iBRioSnZsTEZ
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/1904-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3040-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/380-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-77-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1204-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/700-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3140-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/348-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1916 hnhhbh.exe 3040 llrrllf.exe 3008 thhbnh.exe 380 dvpjd.exe 920 5lfxlfx.exe 2848 9nbhbn.exe 4692 3nnhnn.exe 2684 3jdpj.exe 4220 rrllrxx.exe 4560 tnnbtb.exe 1204 pppvv.exe 700 rlfrrlf.exe 976 1xxrllf.exe 3036 thnbnb.exe 4780 dvpjd.exe 3940 rrlxflx.exe 2228 htnnnn.exe 2324 dvpdv.exe 2400 rrxlffx.exe 2168 hhbbbt.exe 4752 ttbtnn.exe 4380 9xfxlff.exe 3140 jpdpd.exe 2668 fxxxrlx.exe 1168 pjpvp.exe 1748 frlfflf.exe 3680 rxrxrlf.exe 3872 hbtnhh.exe 1480 nnbthb.exe 4784 7dddp.exe 348 hnttnh.exe 760 bnhthh.exe 2516 jdvdd.exe 4216 lfxlfxl.exe 4440 xrrrxfx.exe 1652 bnhhnn.exe 3424 ntntnb.exe 5012 jvjvp.exe 1532 dpvpv.exe 932 thhtbb.exe 3008 httthb.exe 3320 3ddvp.exe 920 jdvjd.exe 4164 lffrllf.exe 2648 bhnnbh.exe 2692 pppjv.exe 436 pjjvj.exe 3988 9lllxrr.exe 2736 nnntnt.exe 2560 nnhtnh.exe 888 pdjdv.exe 4508 lrffxrr.exe 3684 xfffxrl.exe 2120 nnnnbb.exe 3496 tbhhhh.exe 2344 lxrlxxr.exe 3032 llrlfxr.exe 556 hnhbtt.exe 3936 bbnhnt.exe 2996 jpvvj.exe 2752 rrxxrxr.exe 2444 xlrllll.exe 1116 pjdjd.exe 3740 dppjv.exe -
resource yara_rule behavioral2/memory/1904-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3040-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/380-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1204-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/700-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/348-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1904 wrote to memory of 1916 1904 6486a92d436cc53a45104816a7b6c04fa0393388f7a4da7dd0f6a037469ec477_NeikiAnalytics.exe 88 PID 1904 wrote to memory of 1916 1904 6486a92d436cc53a45104816a7b6c04fa0393388f7a4da7dd0f6a037469ec477_NeikiAnalytics.exe 88 PID 1904 wrote to memory of 1916 1904 6486a92d436cc53a45104816a7b6c04fa0393388f7a4da7dd0f6a037469ec477_NeikiAnalytics.exe 88 PID 1916 wrote to memory of 3040 1916 hnhhbh.exe 89 PID 1916 wrote to memory of 3040 1916 hnhhbh.exe 89 PID 1916 wrote to memory of 3040 1916 hnhhbh.exe 89 PID 3040 wrote to memory of 3008 3040 llrrllf.exe 90 PID 3040 wrote to memory of 3008 3040 llrrllf.exe 90 PID 3040 wrote to memory of 3008 3040 llrrllf.exe 90 PID 3008 wrote to memory of 380 3008 thhbnh.exe 91 PID 3008 wrote to memory of 380 3008 thhbnh.exe 91 PID 3008 wrote to memory of 380 3008 thhbnh.exe 91 PID 380 wrote to memory of 920 380 dvpjd.exe 92 PID 380 wrote to memory of 920 380 dvpjd.exe 92 PID 380 wrote to memory of 920 380 dvpjd.exe 92 PID 920 wrote to memory of 2848 920 5lfxlfx.exe 93 PID 920 wrote to memory of 2848 920 5lfxlfx.exe 93 PID 920 wrote to memory of 2848 920 5lfxlfx.exe 93 PID 2848 wrote to memory of 4692 2848 9nbhbn.exe 94 PID 2848 wrote to memory of 4692 2848 9nbhbn.exe 94 PID 2848 wrote to memory of 4692 2848 9nbhbn.exe 94 PID 4692 wrote to memory of 2684 4692 3nnhnn.exe 95 PID 4692 wrote to memory of 2684 4692 3nnhnn.exe 95 PID 4692 wrote to memory of 2684 4692 3nnhnn.exe 95 PID 2684 wrote to memory of 4220 2684 3jdpj.exe 96 PID 2684 wrote to memory of 4220 2684 3jdpj.exe 96 PID 2684 wrote to memory of 4220 2684 3jdpj.exe 96 PID 4220 wrote to memory of 4560 4220 rrllrxx.exe 97 PID 4220 wrote to memory of 4560 4220 rrllrxx.exe 97 PID 4220 wrote to memory of 4560 4220 rrllrxx.exe 97 PID 4560 wrote to memory of 1204 4560 tnnbtb.exe 98 PID 4560 wrote to memory of 1204 4560 tnnbtb.exe 98 PID 4560 wrote to memory of 1204 4560 tnnbtb.exe 98 PID 1204 wrote to memory of 700 1204 pppvv.exe 99 PID 1204 wrote to memory of 700 1204 pppvv.exe 99 PID 1204 wrote to memory of 700 1204 pppvv.exe 99 PID 700 wrote to memory of 976 700 rlfrrlf.exe 100 PID 700 wrote to memory of 976 700 rlfrrlf.exe 100 PID 700 wrote to memory of 976 700 rlfrrlf.exe 100 PID 976 wrote to memory of 3036 976 1xxrllf.exe 101 PID 976 wrote to memory of 3036 976 1xxrllf.exe 101 PID 976 wrote to memory of 3036 976 1xxrllf.exe 101 PID 3036 wrote to memory of 4780 3036 thnbnb.exe 102 PID 3036 wrote to memory of 4780 3036 thnbnb.exe 102 PID 3036 wrote to memory of 4780 3036 thnbnb.exe 102 PID 4780 wrote to memory of 3940 4780 dvpjd.exe 103 PID 4780 wrote to memory of 3940 4780 dvpjd.exe 103 PID 4780 wrote to memory of 3940 4780 dvpjd.exe 103 PID 3940 wrote to memory of 2228 3940 rrlxflx.exe 104 PID 3940 wrote to memory of 2228 3940 rrlxflx.exe 104 PID 3940 wrote to memory of 2228 3940 rrlxflx.exe 104 PID 2228 wrote to memory of 2324 2228 htnnnn.exe 105 PID 2228 wrote to memory of 2324 2228 htnnnn.exe 105 PID 2228 wrote to memory of 2324 2228 htnnnn.exe 105 PID 2324 wrote to memory of 2400 2324 dvpdv.exe 106 PID 2324 wrote to memory of 2400 2324 dvpdv.exe 106 PID 2324 wrote to memory of 2400 2324 dvpdv.exe 106 PID 2400 wrote to memory of 2168 2400 rrxlffx.exe 107 PID 2400 wrote to memory of 2168 2400 rrxlffx.exe 107 PID 2400 wrote to memory of 2168 2400 rrxlffx.exe 107 PID 2168 wrote to memory of 4752 2168 hhbbbt.exe 108 PID 2168 wrote to memory of 4752 2168 hhbbbt.exe 108 PID 2168 wrote to memory of 4752 2168 hhbbbt.exe 108 PID 4752 wrote to memory of 4380 4752 ttbtnn.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\6486a92d436cc53a45104816a7b6c04fa0393388f7a4da7dd0f6a037469ec477_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6486a92d436cc53a45104816a7b6c04fa0393388f7a4da7dd0f6a037469ec477_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\hnhhbh.exec:\hnhhbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\llrrllf.exec:\llrrllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\thhbnh.exec:\thhbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\dvpjd.exec:\dvpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\5lfxlfx.exec:\5lfxlfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\9nbhbn.exec:\9nbhbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\3nnhnn.exec:\3nnhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\3jdpj.exec:\3jdpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\rrllrxx.exec:\rrllrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\tnnbtb.exec:\tnnbtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\pppvv.exec:\pppvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\rlfrrlf.exec:\rlfrrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\1xxrllf.exec:\1xxrllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\thnbnb.exec:\thnbnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\dvpjd.exec:\dvpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\rrlxflx.exec:\rrlxflx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\htnnnn.exec:\htnnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\dvpdv.exec:\dvpdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\rrxlffx.exec:\rrxlffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\hhbbbt.exec:\hhbbbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\ttbtnn.exec:\ttbtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\9xfxlff.exec:\9xfxlff.exe23⤵
- Executes dropped EXE
PID:4380 -
\??\c:\jpdpd.exec:\jpdpd.exe24⤵
- Executes dropped EXE
PID:3140 -
\??\c:\fxxxrlx.exec:\fxxxrlx.exe25⤵
- Executes dropped EXE
PID:2668 -
\??\c:\pjpvp.exec:\pjpvp.exe26⤵
- Executes dropped EXE
PID:1168 -
\??\c:\frlfflf.exec:\frlfflf.exe27⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rxrxrlf.exec:\rxrxrlf.exe28⤵
- Executes dropped EXE
PID:3680 -
\??\c:\hbtnhh.exec:\hbtnhh.exe29⤵
- Executes dropped EXE
PID:3872 -
\??\c:\nnbthb.exec:\nnbthb.exe30⤵
- Executes dropped EXE
PID:1480 -
\??\c:\7dddp.exec:\7dddp.exe31⤵
- Executes dropped EXE
PID:4784 -
\??\c:\hnttnh.exec:\hnttnh.exe32⤵
- Executes dropped EXE
PID:348 -
\??\c:\bnhthh.exec:\bnhthh.exe33⤵
- Executes dropped EXE
PID:760 -
\??\c:\jdvdd.exec:\jdvdd.exe34⤵
- Executes dropped EXE
PID:2516 -
\??\c:\lfxlfxl.exec:\lfxlfxl.exe35⤵
- Executes dropped EXE
PID:4216 -
\??\c:\xrrrxfx.exec:\xrrrxfx.exe36⤵
- Executes dropped EXE
PID:4440 -
\??\c:\bnhhnn.exec:\bnhhnn.exe37⤵
- Executes dropped EXE
PID:1652 -
\??\c:\ntntnb.exec:\ntntnb.exe38⤵
- Executes dropped EXE
PID:3424 -
\??\c:\jvjvp.exec:\jvjvp.exe39⤵
- Executes dropped EXE
PID:5012 -
\??\c:\dpvpv.exec:\dpvpv.exe40⤵
- Executes dropped EXE
PID:1532 -
\??\c:\thhtbb.exec:\thhtbb.exe41⤵
- Executes dropped EXE
PID:932 -
\??\c:\httthb.exec:\httthb.exe42⤵
- Executes dropped EXE
PID:3008 -
\??\c:\3ddvp.exec:\3ddvp.exe43⤵
- Executes dropped EXE
PID:3320 -
\??\c:\jdvjd.exec:\jdvjd.exe44⤵
- Executes dropped EXE
PID:920 -
\??\c:\lffrllf.exec:\lffrllf.exe45⤵
- Executes dropped EXE
PID:4164 -
\??\c:\bhnnbh.exec:\bhnnbh.exe46⤵
- Executes dropped EXE
PID:2648 -
\??\c:\pppjv.exec:\pppjv.exe47⤵
- Executes dropped EXE
PID:2692 -
\??\c:\pjjvj.exec:\pjjvj.exe48⤵
- Executes dropped EXE
PID:436 -
\??\c:\9lllxrr.exec:\9lllxrr.exe49⤵
- Executes dropped EXE
PID:3988 -
\??\c:\nnntnt.exec:\nnntnt.exe50⤵
- Executes dropped EXE
PID:2736 -
\??\c:\nnhtnh.exec:\nnhtnh.exe51⤵
- Executes dropped EXE
PID:2560 -
\??\c:\pdjdv.exec:\pdjdv.exe52⤵
- Executes dropped EXE
PID:888 -
\??\c:\lrffxrr.exec:\lrffxrr.exe53⤵
- Executes dropped EXE
PID:4508 -
\??\c:\xfffxrl.exec:\xfffxrl.exe54⤵
- Executes dropped EXE
PID:3684 -
\??\c:\nnnnbb.exec:\nnnnbb.exe55⤵
- Executes dropped EXE
PID:2120 -
\??\c:\tbhhhh.exec:\tbhhhh.exe56⤵
- Executes dropped EXE
PID:3496 -
\??\c:\lxrlxxr.exec:\lxrlxxr.exe57⤵
- Executes dropped EXE
PID:2344 -
\??\c:\llrlfxr.exec:\llrlfxr.exe58⤵
- Executes dropped EXE
PID:3032 -
\??\c:\hnhbtt.exec:\hnhbtt.exe59⤵
- Executes dropped EXE
PID:556 -
\??\c:\bbnhnt.exec:\bbnhnt.exe60⤵
- Executes dropped EXE
PID:3936 -
\??\c:\jpvvj.exec:\jpvvj.exe61⤵
- Executes dropped EXE
PID:2996 -
\??\c:\rrxxrxr.exec:\rrxxrxr.exe62⤵
- Executes dropped EXE
PID:2752 -
\??\c:\xlrllll.exec:\xlrllll.exe63⤵
- Executes dropped EXE
PID:2444 -
\??\c:\pjdjd.exec:\pjdjd.exe64⤵
- Executes dropped EXE
PID:1116 -
\??\c:\dppjv.exec:\dppjv.exe65⤵
- Executes dropped EXE
PID:3740 -
\??\c:\xrflfff.exec:\xrflfff.exe66⤵PID:716
-
\??\c:\llllfxr.exec:\llllfxr.exe67⤵PID:1936
-
\??\c:\thhnbb.exec:\thhnbb.exe68⤵PID:3780
-
\??\c:\vjjdp.exec:\vjjdp.exe69⤵PID:2000
-
\??\c:\vdjjd.exec:\vdjjd.exe70⤵PID:1812
-
\??\c:\xlfrffx.exec:\xlfrffx.exe71⤵PID:4504
-
\??\c:\hbnnbt.exec:\hbnnbt.exe72⤵PID:3092
-
\??\c:\7nnhbb.exec:\7nnhbb.exe73⤵PID:5004
-
\??\c:\vjvpp.exec:\vjvpp.exe74⤵PID:3656
-
\??\c:\dddpd.exec:\dddpd.exe75⤵PID:1480
-
\??\c:\9lrlflf.exec:\9lrlflf.exe76⤵PID:1276
-
\??\c:\lfxfflf.exec:\lfxfflf.exe77⤵PID:4040
-
\??\c:\hbtbbt.exec:\hbtbbt.exe78⤵PID:3152
-
\??\c:\pvvpd.exec:\pvvpd.exe79⤵PID:1472
-
\??\c:\jvjjv.exec:\jvjjv.exe80⤵PID:520
-
\??\c:\rlfrrll.exec:\rlfrrll.exe81⤵PID:3512
-
\??\c:\rffllfr.exec:\rffllfr.exe82⤵PID:1904
-
\??\c:\bttnbb.exec:\bttnbb.exe83⤵PID:1652
-
\??\c:\pdddp.exec:\pdddp.exe84⤵PID:3112
-
\??\c:\vjvpv.exec:\vjvpv.exe85⤵PID:1580
-
\??\c:\fxxxlfx.exec:\fxxxlfx.exe86⤵PID:3476
-
\??\c:\lrflllr.exec:\lrflllr.exe87⤵PID:3348
-
\??\c:\7bbhbt.exec:\7bbhbt.exe88⤵PID:3096
-
\??\c:\jvpdp.exec:\jvpdp.exe89⤵PID:4328
-
\??\c:\lfxrllf.exec:\lfxrllf.exe90⤵PID:2376
-
\??\c:\lfxrlrf.exec:\lfxrlrf.exe91⤵PID:1900
-
\??\c:\lrxxxfx.exec:\lrxxxfx.exe92⤵PID:4388
-
\??\c:\nhbtnn.exec:\nhbtnn.exe93⤵PID:2684
-
\??\c:\vdjdj.exec:\vdjdj.exe94⤵PID:436
-
\??\c:\jdjvv.exec:\jdjvv.exe95⤵PID:4960
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe96⤵PID:2736
-
\??\c:\lflrrrl.exec:\lflrrrl.exe97⤵PID:4488
-
\??\c:\nbttnn.exec:\nbttnn.exe98⤵PID:1056
-
\??\c:\tntnhh.exec:\tntnhh.exe99⤵PID:3104
-
\??\c:\jdddd.exec:\jdddd.exe100⤵PID:3088
-
\??\c:\9rrrllf.exec:\9rrrllf.exe101⤵PID:2120
-
\??\c:\rlrlrrr.exec:\rlrlrrr.exe102⤵PID:3564
-
\??\c:\bnhhhh.exec:\bnhhhh.exe103⤵PID:2344
-
\??\c:\tnnhhh.exec:\tnnhhh.exe104⤵PID:412
-
\??\c:\vvddv.exec:\vvddv.exe105⤵PID:2660
-
\??\c:\djjdv.exec:\djjdv.exe106⤵PID:4416
-
\??\c:\pddvj.exec:\pddvj.exe107⤵PID:4432
-
\??\c:\lflflfr.exec:\lflflfr.exe108⤵PID:4100
-
\??\c:\btbttt.exec:\btbttt.exe109⤵PID:2052
-
\??\c:\pjjdv.exec:\pjjdv.exe110⤵PID:4376
-
\??\c:\vpjdd.exec:\vpjdd.exe111⤵PID:1592
-
\??\c:\3lllfrl.exec:\3lllfrl.exe112⤵PID:3060
-
\??\c:\ffrrrrx.exec:\ffrrrrx.exe113⤵PID:3616
-
\??\c:\btttnt.exec:\btttnt.exe114⤵PID:5064
-
\??\c:\1ppdp.exec:\1ppdp.exe115⤵PID:2100
-
\??\c:\vjdvv.exec:\vjdvv.exe116⤵PID:2908
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe117⤵PID:4540
-
\??\c:\frrlfxl.exec:\frrlfxl.exe118⤵PID:3092
-
\??\c:\hbnhbb.exec:\hbnhbb.exe119⤵PID:5004
-
\??\c:\thhbnn.exec:\thhbnn.exe120⤵PID:1280
-
\??\c:\dvpjj.exec:\dvpjj.exe121⤵PID:4784
-
\??\c:\vdjdp.exec:\vdjdp.exe122⤵PID:3644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-