Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 14:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7eb5404402d507e3ab70182391c2ce63662e358a4a99b8b3c0cd688110208920_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
7eb5404402d507e3ab70182391c2ce63662e358a4a99b8b3c0cd688110208920_NeikiAnalytics.exe
-
Size
78KB
-
MD5
25826b5e7e09848461d611c793e42460
-
SHA1
7dc4b8fddcb4075313c5df46f716392ba58172ef
-
SHA256
7eb5404402d507e3ab70182391c2ce63662e358a4a99b8b3c0cd688110208920
-
SHA512
3431018c24f3672782470900acd6219273b04abe48f5079ee9c7ae8f1217bde3638f1c6dd1c95e675dcae408617bee438825b95429821e97c4d628aca0bea28a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgygQwKjiawEmBg9t:ymb3NkkiQ3mdBjFo73thgQ/wEk2t
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2116-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4304-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1240-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2588 5xxfxrl.exe 1464 xlllxrl.exe 4304 nnnhnn.exe 1576 jvvvj.exe 1900 xxxllfl.exe 2452 xffrlff.exe 3932 ddvjv.exe 5020 ddpjd.exe 4004 xrxrrxx.exe 2876 tnbbbt.exe 3728 5hhhbb.exe 3160 pjddj.exe 4536 lflxrrf.exe 1580 nbhbhb.exe 4036 thnbbt.exe 2140 pvvpp.exe 4020 llffxfl.exe 2772 ntnnbt.exe 2412 vjvpj.exe 3200 7xrrrrl.exe 2448 tbnhbn.exe 1240 nhbhtt.exe 1032 pjjpj.exe 3240 rlfxxrl.exe 3296 jdppj.exe 4520 pvdpj.exe 4440 rrxrfrr.exe 4908 hbhbbt.exe 2908 vpjdp.exe 1940 rfflfff.exe 3644 ttnnbt.exe 3096 rflfrrl.exe 2688 htnttn.exe 3568 llflfff.exe 5036 hbttnh.exe 1788 dvjdv.exe 4076 vdjvj.exe 2360 jdddd.exe 3092 fxxlrlr.exe 3556 thhbtn.exe 3408 hhbtbt.exe 4892 pjppd.exe 1932 frlfrxx.exe 1076 rfxrrrx.exe 5016 3ttnbt.exe 3428 7hhbbt.exe 4556 vjpjd.exe 4516 fxxrllf.exe 1408 fxrxxxx.exe 4324 hbtnhb.exe 2152 tnhbtn.exe 1524 5ppdv.exe 4848 jppdv.exe 1660 lfxfrxr.exe 1412 3nhnhn.exe 2916 pvdjd.exe 2404 pjvpj.exe 1496 fxrlxrf.exe 732 frrfxrr.exe 2452 hhhhth.exe 208 nhhbtn.exe 1380 dvvpd.exe 3484 llrlxxr.exe 2012 flfrlfx.exe -
resource yara_rule behavioral2/memory/2116-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4304-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2588 2116 7eb5404402d507e3ab70182391c2ce63662e358a4a99b8b3c0cd688110208920_NeikiAnalytics.exe 81 PID 2116 wrote to memory of 2588 2116 7eb5404402d507e3ab70182391c2ce63662e358a4a99b8b3c0cd688110208920_NeikiAnalytics.exe 81 PID 2116 wrote to memory of 2588 2116 7eb5404402d507e3ab70182391c2ce63662e358a4a99b8b3c0cd688110208920_NeikiAnalytics.exe 81 PID 2588 wrote to memory of 1464 2588 5xxfxrl.exe 82 PID 2588 wrote to memory of 1464 2588 5xxfxrl.exe 82 PID 2588 wrote to memory of 1464 2588 5xxfxrl.exe 82 PID 1464 wrote to memory of 4304 1464 xlllxrl.exe 83 PID 1464 wrote to memory of 4304 1464 xlllxrl.exe 83 PID 1464 wrote to memory of 4304 1464 xlllxrl.exe 83 PID 4304 wrote to memory of 1576 4304 nnnhnn.exe 84 PID 4304 wrote to memory of 1576 4304 nnnhnn.exe 84 PID 4304 wrote to memory of 1576 4304 nnnhnn.exe 84 PID 1576 wrote to memory of 1900 1576 jvvvj.exe 85 PID 1576 wrote to memory of 1900 1576 jvvvj.exe 85 PID 1576 wrote to memory of 1900 1576 jvvvj.exe 85 PID 1900 wrote to memory of 2452 1900 xxxllfl.exe 86 PID 1900 wrote to memory of 2452 1900 xxxllfl.exe 86 PID 1900 wrote to memory of 2452 1900 xxxllfl.exe 86 PID 2452 wrote to memory of 3932 2452 xffrlff.exe 87 PID 2452 wrote to memory of 3932 2452 xffrlff.exe 87 PID 2452 wrote to memory of 3932 2452 xffrlff.exe 87 PID 3932 wrote to memory of 5020 3932 ddvjv.exe 88 PID 3932 wrote to memory of 5020 3932 ddvjv.exe 88 PID 3932 wrote to memory of 5020 3932 ddvjv.exe 88 PID 5020 wrote to memory of 4004 5020 ddpjd.exe 89 PID 5020 wrote to memory of 4004 5020 ddpjd.exe 89 PID 5020 wrote to memory of 4004 5020 ddpjd.exe 89 PID 4004 wrote to memory of 2876 4004 xrxrrxx.exe 90 PID 4004 wrote to memory of 2876 4004 xrxrrxx.exe 90 PID 4004 wrote to memory of 2876 4004 xrxrrxx.exe 90 PID 2876 wrote to memory of 3728 2876 tnbbbt.exe 91 PID 2876 wrote to memory of 3728 2876 tnbbbt.exe 91 PID 2876 wrote to memory of 3728 2876 tnbbbt.exe 91 PID 3728 wrote to memory of 3160 3728 5hhhbb.exe 92 PID 3728 wrote to memory of 3160 3728 5hhhbb.exe 92 PID 3728 wrote to memory of 3160 3728 5hhhbb.exe 92 PID 3160 wrote to memory of 4536 3160 pjddj.exe 93 PID 3160 wrote to memory of 4536 3160 pjddj.exe 93 PID 3160 wrote to memory of 4536 3160 pjddj.exe 93 PID 4536 wrote to memory of 1580 4536 lflxrrf.exe 94 PID 4536 wrote to memory of 1580 4536 lflxrrf.exe 94 PID 4536 wrote to memory of 1580 4536 lflxrrf.exe 94 PID 1580 wrote to memory of 4036 1580 nbhbhb.exe 95 PID 1580 wrote to memory of 4036 1580 nbhbhb.exe 95 PID 1580 wrote to memory of 4036 1580 nbhbhb.exe 95 PID 4036 wrote to memory of 2140 4036 thnbbt.exe 96 PID 4036 wrote to memory of 2140 4036 thnbbt.exe 96 PID 4036 wrote to memory of 2140 4036 thnbbt.exe 96 PID 2140 wrote to memory of 4020 2140 pvvpp.exe 97 PID 2140 wrote to memory of 4020 2140 pvvpp.exe 97 PID 2140 wrote to memory of 4020 2140 pvvpp.exe 97 PID 4020 wrote to memory of 2772 4020 llffxfl.exe 98 PID 4020 wrote to memory of 2772 4020 llffxfl.exe 98 PID 4020 wrote to memory of 2772 4020 llffxfl.exe 98 PID 2772 wrote to memory of 2412 2772 ntnnbt.exe 99 PID 2772 wrote to memory of 2412 2772 ntnnbt.exe 99 PID 2772 wrote to memory of 2412 2772 ntnnbt.exe 99 PID 2412 wrote to memory of 3200 2412 vjvpj.exe 100 PID 2412 wrote to memory of 3200 2412 vjvpj.exe 100 PID 2412 wrote to memory of 3200 2412 vjvpj.exe 100 PID 3200 wrote to memory of 2448 3200 7xrrrrl.exe 101 PID 3200 wrote to memory of 2448 3200 7xrrrrl.exe 101 PID 3200 wrote to memory of 2448 3200 7xrrrrl.exe 101 PID 2448 wrote to memory of 1240 2448 tbnhbn.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\7eb5404402d507e3ab70182391c2ce63662e358a4a99b8b3c0cd688110208920_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7eb5404402d507e3ab70182391c2ce63662e358a4a99b8b3c0cd688110208920_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\5xxfxrl.exec:\5xxfxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\xlllxrl.exec:\xlllxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\nnnhnn.exec:\nnnhnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\jvvvj.exec:\jvvvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\xxxllfl.exec:\xxxllfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\xffrlff.exec:\xffrlff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\ddvjv.exec:\ddvjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\ddpjd.exec:\ddpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\xrxrrxx.exec:\xrxrrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\tnbbbt.exec:\tnbbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\5hhhbb.exec:\5hhhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\pjddj.exec:\pjddj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\lflxrrf.exec:\lflxrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\nbhbhb.exec:\nbhbhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\thnbbt.exec:\thnbbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\pvvpp.exec:\pvvpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\llffxfl.exec:\llffxfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\ntnnbt.exec:\ntnnbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\vjvpj.exec:\vjvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\7xrrrrl.exec:\7xrrrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\tbnhbn.exec:\tbnhbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\nhbhtt.exec:\nhbhtt.exe23⤵
- Executes dropped EXE
PID:1240 -
\??\c:\pjjpj.exec:\pjjpj.exe24⤵
- Executes dropped EXE
PID:1032 -
\??\c:\rlfxxrl.exec:\rlfxxrl.exe25⤵
- Executes dropped EXE
PID:3240 -
\??\c:\jdppj.exec:\jdppj.exe26⤵
- Executes dropped EXE
PID:3296 -
\??\c:\pvdpj.exec:\pvdpj.exe27⤵
- Executes dropped EXE
PID:4520 -
\??\c:\rrxrfrr.exec:\rrxrfrr.exe28⤵
- Executes dropped EXE
PID:4440 -
\??\c:\hbhbbt.exec:\hbhbbt.exe29⤵
- Executes dropped EXE
PID:4908 -
\??\c:\vpjdp.exec:\vpjdp.exe30⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rfflfff.exec:\rfflfff.exe31⤵
- Executes dropped EXE
PID:1940 -
\??\c:\ttnnbt.exec:\ttnnbt.exe32⤵
- Executes dropped EXE
PID:3644 -
\??\c:\rflfrrl.exec:\rflfrrl.exe33⤵
- Executes dropped EXE
PID:3096 -
\??\c:\htnttn.exec:\htnttn.exe34⤵
- Executes dropped EXE
PID:2688 -
\??\c:\llflfff.exec:\llflfff.exe35⤵
- Executes dropped EXE
PID:3568 -
\??\c:\hbttnh.exec:\hbttnh.exe36⤵
- Executes dropped EXE
PID:5036 -
\??\c:\dvjdv.exec:\dvjdv.exe37⤵
- Executes dropped EXE
PID:1788 -
\??\c:\vdjvj.exec:\vdjvj.exe38⤵
- Executes dropped EXE
PID:4076 -
\??\c:\jdddd.exec:\jdddd.exe39⤵
- Executes dropped EXE
PID:2360 -
\??\c:\fxxlrlr.exec:\fxxlrlr.exe40⤵
- Executes dropped EXE
PID:3092 -
\??\c:\thhbtn.exec:\thhbtn.exe41⤵
- Executes dropped EXE
PID:3556 -
\??\c:\hhbtbt.exec:\hhbtbt.exe42⤵
- Executes dropped EXE
PID:3408 -
\??\c:\pjppd.exec:\pjppd.exe43⤵
- Executes dropped EXE
PID:4892 -
\??\c:\frlfrxx.exec:\frlfrxx.exe44⤵
- Executes dropped EXE
PID:1932 -
\??\c:\rfxrrrx.exec:\rfxrrrx.exe45⤵
- Executes dropped EXE
PID:1076 -
\??\c:\3ttnbt.exec:\3ttnbt.exe46⤵
- Executes dropped EXE
PID:5016 -
\??\c:\7hhbbt.exec:\7hhbbt.exe47⤵
- Executes dropped EXE
PID:3428 -
\??\c:\vjpjd.exec:\vjpjd.exe48⤵
- Executes dropped EXE
PID:4556 -
\??\c:\fxxrllf.exec:\fxxrllf.exe49⤵
- Executes dropped EXE
PID:4516 -
\??\c:\fxrxxxx.exec:\fxrxxxx.exe50⤵
- Executes dropped EXE
PID:1408 -
\??\c:\hbtnhb.exec:\hbtnhb.exe51⤵
- Executes dropped EXE
PID:4324 -
\??\c:\tnhbtn.exec:\tnhbtn.exe52⤵
- Executes dropped EXE
PID:2152 -
\??\c:\5ppdv.exec:\5ppdv.exe53⤵
- Executes dropped EXE
PID:1524 -
\??\c:\jppdv.exec:\jppdv.exe54⤵
- Executes dropped EXE
PID:4848 -
\??\c:\lfxfrxr.exec:\lfxfrxr.exe55⤵
- Executes dropped EXE
PID:1660 -
\??\c:\3nhnhn.exec:\3nhnhn.exe56⤵
- Executes dropped EXE
PID:1412 -
\??\c:\pvdjd.exec:\pvdjd.exe57⤵
- Executes dropped EXE
PID:2916 -
\??\c:\pjvpj.exec:\pjvpj.exe58⤵
- Executes dropped EXE
PID:2404 -
\??\c:\fxrlxrf.exec:\fxrlxrf.exe59⤵
- Executes dropped EXE
PID:1496 -
\??\c:\frrfxrr.exec:\frrfxrr.exe60⤵
- Executes dropped EXE
PID:732 -
\??\c:\hhhhth.exec:\hhhhth.exe61⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nhhbtn.exec:\nhhbtn.exe62⤵
- Executes dropped EXE
PID:208 -
\??\c:\dvvpd.exec:\dvvpd.exe63⤵
- Executes dropped EXE
PID:1380 -
\??\c:\llrlxxr.exec:\llrlxxr.exe64⤵
- Executes dropped EXE
PID:3484 -
\??\c:\flfrlfx.exec:\flfrlfx.exe65⤵
- Executes dropped EXE
PID:2012 -
\??\c:\bttnbb.exec:\bttnbb.exe66⤵PID:4124
-
\??\c:\vpppj.exec:\vpppj.exe67⤵PID:1828
-
\??\c:\jdpjd.exec:\jdpjd.exe68⤵PID:3728
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe69⤵PID:4308
-
\??\c:\tnbthh.exec:\tnbthh.exe70⤵PID:1696
-
\??\c:\htbttt.exec:\htbttt.exe71⤵PID:3492
-
\??\c:\1ppjd.exec:\1ppjd.exe72⤵PID:2488
-
\??\c:\hbhtnh.exec:\hbhtnh.exe73⤵PID:5044
-
\??\c:\jjjjd.exec:\jjjjd.exe74⤵PID:4732
-
\??\c:\dvvpp.exec:\dvvpp.exe75⤵PID:2140
-
\??\c:\5fxfrlf.exec:\5fxfrlf.exe76⤵PID:3372
-
\??\c:\tnhhhb.exec:\tnhhhb.exe77⤵PID:4980
-
\??\c:\jdjvv.exec:\jdjvv.exe78⤵PID:3152
-
\??\c:\1vpdv.exec:\1vpdv.exe79⤵PID:1620
-
\??\c:\rxxxrll.exec:\rxxxrll.exe80⤵PID:4344
-
\??\c:\3bhbnh.exec:\3bhbnh.exe81⤵PID:948
-
\??\c:\tnbtnn.exec:\tnbtnn.exe82⤵PID:2508
-
\??\c:\9jjdd.exec:\9jjdd.exe83⤵PID:1240
-
\??\c:\flrfxxr.exec:\flrfxxr.exe84⤵PID:4716
-
\??\c:\rxffxll.exec:\rxffxll.exe85⤵PID:2424
-
\??\c:\thbbtt.exec:\thbbtt.exe86⤵PID:4388
-
\??\c:\5vvdd.exec:\5vvdd.exe87⤵PID:1500
-
\??\c:\5vvpp.exec:\5vvpp.exe88⤵PID:3280
-
\??\c:\lrrlxrl.exec:\lrrlxrl.exe89⤵PID:2868
-
\??\c:\tnnnnh.exec:\tnnnnh.exe90⤵PID:3196
-
\??\c:\nbtnnn.exec:\nbtnnn.exe91⤵PID:3356
-
\??\c:\vpvvp.exec:\vpvvp.exe92⤵PID:1804
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe93⤵PID:1516
-
\??\c:\1lflflx.exec:\1lflflx.exe94⤵PID:112
-
\??\c:\nnnnhh.exec:\nnnnhh.exe95⤵PID:4040
-
\??\c:\hbnbnh.exec:\hbnbnh.exe96⤵PID:3452
-
\??\c:\dpjdd.exec:\dpjdd.exe97⤵PID:4148
-
\??\c:\djjvp.exec:\djjvp.exe98⤵PID:3796
-
\??\c:\xlffxxr.exec:\xlffxxr.exe99⤵PID:768
-
\??\c:\bnbtnb.exec:\bnbtnb.exe100⤵PID:2660
-
\??\c:\bbtnbt.exec:\bbtnbt.exe101⤵PID:396
-
\??\c:\pdpvj.exec:\pdpvj.exe102⤵PID:5080
-
\??\c:\9lrlllr.exec:\9lrlllr.exe103⤵PID:3628
-
\??\c:\xxxrfff.exec:\xxxrfff.exe104⤵PID:5024
-
\??\c:\tnntbt.exec:\tnntbt.exe105⤵PID:4224
-
\??\c:\5bbtnh.exec:\5bbtnh.exe106⤵PID:3260
-
\??\c:\djjdp.exec:\djjdp.exe107⤵PID:3748
-
\??\c:\xllfffx.exec:\xllfffx.exe108⤵PID:3616
-
\??\c:\5fllflf.exec:\5fllflf.exe109⤵PID:2460
-
\??\c:\hhhbbt.exec:\hhhbbt.exe110⤵PID:3608
-
\??\c:\3bbthb.exec:\3bbthb.exe111⤵PID:4556
-
\??\c:\jpvpv.exec:\jpvpv.exe112⤵PID:4316
-
\??\c:\xrfxllx.exec:\xrfxllx.exe113⤵PID:1244
-
\??\c:\frrlxrl.exec:\frrlxrl.exe114⤵PID:4324
-
\??\c:\tnnhhb.exec:\tnnhhb.exe115⤵PID:2152
-
\??\c:\jdjjp.exec:\jdjjp.exe116⤵PID:1524
-
\??\c:\jjdvj.exec:\jjdvj.exe117⤵PID:2004
-
\??\c:\xxlfxrr.exec:\xxlfxrr.exe118⤵PID:1288
-
\??\c:\xxrlxrl.exec:\xxrlxrl.exe119⤵PID:1920
-
\??\c:\hbnnhh.exec:\hbnnhh.exe120⤵PID:2916
-
\??\c:\vddvj.exec:\vddvj.exe121⤵PID:2436
-
\??\c:\jddjp.exec:\jddjp.exe122⤵PID:1496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-