Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 23:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6f92a47978dba204bac824c671d20c80_NEIKI.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
6f92a47978dba204bac824c671d20c80_NEIKI.exe
-
Size
433KB
-
MD5
6f92a47978dba204bac824c671d20c80
-
SHA1
b653fa1b9a68a599d196a9c25063fe127fc57cad
-
SHA256
f89397809333c39f43fba2b2c6822c90a00bb12aa5f91319aaf34566a4a8c014
-
SHA512
23a84b8001f2f79fb3214747aa1dfd2415b6b9c5cf88379687e6bd0a3a1c6d72f23d03a8c5b5f235b36f038a130134e264927bbe8ab1420825295d6c5c2d345f
-
SSDEEP
12288:n3C9uMPh2kkkkK4kXkkkkkkkkl888888888888888888nF:ShPh2kkkkK4kXkkkkkkkkr
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/2804-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2872-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5208-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5832-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5352-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/6004-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5404-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5604-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5472-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5612-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1228-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3040-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1220 3ntnhh.exe 3120 1xxrlfx.exe 3452 llrlffx.exe 2872 tbtnnn.exe 5208 hhtnnn.exe 4648 rllffxr.exe 3652 nthbtn.exe 400 7thhbt.exe 1676 dpjdv.exe 4592 nbbtnh.exe 5832 3jjpj.exe 3456 hthbbb.exe 3112 llxxrrr.exe 5352 dvpjp.exe 6004 9tntnn.exe 5404 5jpjv.exe 1276 dvvjd.exe 5632 llrrllr.exe 5876 bbtnhh.exe 5604 rflfxxr.exe 5124 1pvvp.exe 5472 rlxrrlf.exe 2496 hhtthh.exe 5612 pjvjd.exe 3268 thnhhb.exe 1236 dddvj.exe 1228 tnbnth.exe 3040 hhnhhh.exe 4532 jdppp.exe 6076 htbtnn.exe 5204 5flfxxr.exe 3308 jvjdv.exe 6116 rlxllff.exe 5904 hbnhhh.exe 3612 dvjjd.exe 2896 xrllffx.exe 448 hbhbbb.exe 4536 ttnhbb.exe 3644 vjpdd.exe 3420 3ffxrrr.exe 5812 nbnbtt.exe 5544 hbhbnt.exe 1684 vpdvv.exe 5540 rllxrrl.exe 3352 5flxxrx.exe 5328 nbnhbb.exe 1256 pvdvp.exe 3320 dvddv.exe 3048 lffxfll.exe 1580 nntnhh.exe 1616 tbtnhb.exe 1948 dppdd.exe 4552 rlrrxxf.exe 3844 3ntbth.exe 3184 btbhbt.exe 3244 dppjv.exe 2960 lxfxllf.exe 1036 1xxxlff.exe 2748 1bhnnb.exe 3432 dvdvd.exe 4972 rrrrllf.exe 4788 1lrrlfr.exe 2124 nnbbtn.exe 4428 9ddvj.exe -
resource yara_rule behavioral2/memory/2804-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2872-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5208-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5832-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5352-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/6004-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5404-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5604-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5472-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5612-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1228-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3040-192-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2804 wrote to memory of 1220 2804 6f92a47978dba204bac824c671d20c80_NEIKI.exe 87 PID 2804 wrote to memory of 1220 2804 6f92a47978dba204bac824c671d20c80_NEIKI.exe 87 PID 2804 wrote to memory of 1220 2804 6f92a47978dba204bac824c671d20c80_NEIKI.exe 87 PID 1220 wrote to memory of 3120 1220 3ntnhh.exe 88 PID 1220 wrote to memory of 3120 1220 3ntnhh.exe 88 PID 1220 wrote to memory of 3120 1220 3ntnhh.exe 88 PID 3120 wrote to memory of 3452 3120 1xxrlfx.exe 89 PID 3120 wrote to memory of 3452 3120 1xxrlfx.exe 89 PID 3120 wrote to memory of 3452 3120 1xxrlfx.exe 89 PID 3452 wrote to memory of 2872 3452 llrlffx.exe 90 PID 3452 wrote to memory of 2872 3452 llrlffx.exe 90 PID 3452 wrote to memory of 2872 3452 llrlffx.exe 90 PID 2872 wrote to memory of 5208 2872 tbtnnn.exe 91 PID 2872 wrote to memory of 5208 2872 tbtnnn.exe 91 PID 2872 wrote to memory of 5208 2872 tbtnnn.exe 91 PID 5208 wrote to memory of 4648 5208 hhtnnn.exe 92 PID 5208 wrote to memory of 4648 5208 hhtnnn.exe 92 PID 5208 wrote to memory of 4648 5208 hhtnnn.exe 92 PID 4648 wrote to memory of 3652 4648 rllffxr.exe 93 PID 4648 wrote to memory of 3652 4648 rllffxr.exe 93 PID 4648 wrote to memory of 3652 4648 rllffxr.exe 93 PID 3652 wrote to memory of 400 3652 nthbtn.exe 94 PID 3652 wrote to memory of 400 3652 nthbtn.exe 94 PID 3652 wrote to memory of 400 3652 nthbtn.exe 94 PID 400 wrote to memory of 1676 400 7thhbt.exe 95 PID 400 wrote to memory of 1676 400 7thhbt.exe 95 PID 400 wrote to memory of 1676 400 7thhbt.exe 95 PID 1676 wrote to memory of 4592 1676 dpjdv.exe 96 PID 1676 wrote to memory of 4592 1676 dpjdv.exe 96 PID 1676 wrote to memory of 4592 1676 dpjdv.exe 96 PID 4592 wrote to memory of 5832 4592 nbbtnh.exe 97 PID 4592 wrote to memory of 5832 4592 nbbtnh.exe 97 PID 4592 wrote to memory of 5832 4592 nbbtnh.exe 97 PID 5832 wrote to memory of 3456 5832 3jjpj.exe 98 PID 5832 wrote to memory of 3456 5832 3jjpj.exe 98 PID 5832 wrote to memory of 3456 5832 3jjpj.exe 98 PID 3456 wrote to memory of 3112 3456 hthbbb.exe 99 PID 3456 wrote to memory of 3112 3456 hthbbb.exe 99 PID 3456 wrote to memory of 3112 3456 hthbbb.exe 99 PID 3112 wrote to memory of 5352 3112 llxxrrr.exe 100 PID 3112 wrote to memory of 5352 3112 llxxrrr.exe 100 PID 3112 wrote to memory of 5352 3112 llxxrrr.exe 100 PID 5352 wrote to memory of 6004 5352 dvpjp.exe 101 PID 5352 wrote to memory of 6004 5352 dvpjp.exe 101 PID 5352 wrote to memory of 6004 5352 dvpjp.exe 101 PID 6004 wrote to memory of 5404 6004 9tntnn.exe 102 PID 6004 wrote to memory of 5404 6004 9tntnn.exe 102 PID 6004 wrote to memory of 5404 6004 9tntnn.exe 102 PID 5404 wrote to memory of 1276 5404 5jpjv.exe 103 PID 5404 wrote to memory of 1276 5404 5jpjv.exe 103 PID 5404 wrote to memory of 1276 5404 5jpjv.exe 103 PID 1276 wrote to memory of 5632 1276 dvvjd.exe 104 PID 1276 wrote to memory of 5632 1276 dvvjd.exe 104 PID 1276 wrote to memory of 5632 1276 dvvjd.exe 104 PID 5632 wrote to memory of 5876 5632 llrrllr.exe 105 PID 5632 wrote to memory of 5876 5632 llrrllr.exe 105 PID 5632 wrote to memory of 5876 5632 llrrllr.exe 105 PID 5876 wrote to memory of 5604 5876 bbtnhh.exe 106 PID 5876 wrote to memory of 5604 5876 bbtnhh.exe 106 PID 5876 wrote to memory of 5604 5876 bbtnhh.exe 106 PID 5604 wrote to memory of 5124 5604 rflfxxr.exe 107 PID 5604 wrote to memory of 5124 5604 rflfxxr.exe 107 PID 5604 wrote to memory of 5124 5604 rflfxxr.exe 107 PID 5124 wrote to memory of 5472 5124 1pvvp.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f92a47978dba204bac824c671d20c80_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\6f92a47978dba204bac824c671d20c80_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\3ntnhh.exec:\3ntnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\1xxrlfx.exec:\1xxrlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\llrlffx.exec:\llrlffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\tbtnnn.exec:\tbtnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\hhtnnn.exec:\hhtnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
\??\c:\rllffxr.exec:\rllffxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\nthbtn.exec:\nthbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\7thhbt.exec:\7thhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\dpjdv.exec:\dpjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\nbbtnh.exec:\nbbtnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\3jjpj.exec:\3jjpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
\??\c:\hthbbb.exec:\hthbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\llxxrrr.exec:\llxxrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\dvpjp.exec:\dvpjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
\??\c:\9tntnn.exec:\9tntnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
\??\c:\5jpjv.exec:\5jpjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
\??\c:\dvvjd.exec:\dvvjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\llrrllr.exec:\llrrllr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
\??\c:\bbtnhh.exec:\bbtnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
\??\c:\rflfxxr.exec:\rflfxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
\??\c:\1pvvp.exec:\1pvvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
\??\c:\rlxrrlf.exec:\rlxrrlf.exe23⤵
- Executes dropped EXE
PID:5472 -
\??\c:\hhtthh.exec:\hhtthh.exe24⤵
- Executes dropped EXE
PID:2496 -
\??\c:\pjvjd.exec:\pjvjd.exe25⤵
- Executes dropped EXE
PID:5612 -
\??\c:\thnhhb.exec:\thnhhb.exe26⤵
- Executes dropped EXE
PID:3268 -
\??\c:\dddvj.exec:\dddvj.exe27⤵
- Executes dropped EXE
PID:1236 -
\??\c:\tnbnth.exec:\tnbnth.exe28⤵
- Executes dropped EXE
PID:1228 -
\??\c:\hhnhhh.exec:\hhnhhh.exe29⤵
- Executes dropped EXE
PID:3040 -
\??\c:\jdppp.exec:\jdppp.exe30⤵
- Executes dropped EXE
PID:4532 -
\??\c:\htbtnn.exec:\htbtnn.exe31⤵
- Executes dropped EXE
PID:6076 -
\??\c:\5flfxxr.exec:\5flfxxr.exe32⤵
- Executes dropped EXE
PID:5204 -
\??\c:\jvjdv.exec:\jvjdv.exe33⤵
- Executes dropped EXE
PID:3308 -
\??\c:\rlxllff.exec:\rlxllff.exe34⤵
- Executes dropped EXE
PID:6116 -
\??\c:\hbnhhh.exec:\hbnhhh.exe35⤵
- Executes dropped EXE
PID:5904 -
\??\c:\dvjjd.exec:\dvjjd.exe36⤵
- Executes dropped EXE
PID:3612 -
\??\c:\xrllffx.exec:\xrllffx.exe37⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hbhbbb.exec:\hbhbbb.exe38⤵
- Executes dropped EXE
PID:448 -
\??\c:\ttnhbb.exec:\ttnhbb.exe39⤵
- Executes dropped EXE
PID:4536 -
\??\c:\vjpdd.exec:\vjpdd.exe40⤵
- Executes dropped EXE
PID:3644 -
\??\c:\3ffxrrr.exec:\3ffxrrr.exe41⤵
- Executes dropped EXE
PID:3420 -
\??\c:\nbnbtt.exec:\nbnbtt.exe42⤵
- Executes dropped EXE
PID:5812 -
\??\c:\hbhbnt.exec:\hbhbnt.exe43⤵
- Executes dropped EXE
PID:5544 -
\??\c:\vpdvv.exec:\vpdvv.exe44⤵
- Executes dropped EXE
PID:1684 -
\??\c:\rllxrrl.exec:\rllxrrl.exe45⤵
- Executes dropped EXE
PID:5540 -
\??\c:\5flxxrx.exec:\5flxxrx.exe46⤵
- Executes dropped EXE
PID:3352 -
\??\c:\nbnhbb.exec:\nbnhbb.exe47⤵
- Executes dropped EXE
PID:5328 -
\??\c:\pvdvp.exec:\pvdvp.exe48⤵
- Executes dropped EXE
PID:1256 -
\??\c:\dvddv.exec:\dvddv.exe49⤵
- Executes dropped EXE
PID:3320 -
\??\c:\lffxfll.exec:\lffxfll.exe50⤵
- Executes dropped EXE
PID:3048 -
\??\c:\nntnhh.exec:\nntnhh.exe51⤵
- Executes dropped EXE
PID:1580 -
\??\c:\tbtnhb.exec:\tbtnhb.exe52⤵
- Executes dropped EXE
PID:1616 -
\??\c:\dppdd.exec:\dppdd.exe53⤵
- Executes dropped EXE
PID:1948 -
\??\c:\rlrrxxf.exec:\rlrrxxf.exe54⤵
- Executes dropped EXE
PID:4552 -
\??\c:\3ntbth.exec:\3ntbth.exe55⤵
- Executes dropped EXE
PID:3844 -
\??\c:\btbhbt.exec:\btbhbt.exe56⤵
- Executes dropped EXE
PID:3184 -
\??\c:\dppjv.exec:\dppjv.exe57⤵
- Executes dropped EXE
PID:3244 -
\??\c:\lxfxllf.exec:\lxfxllf.exe58⤵
- Executes dropped EXE
PID:2960 -
\??\c:\1xxxlff.exec:\1xxxlff.exe59⤵
- Executes dropped EXE
PID:1036 -
\??\c:\1bhnnb.exec:\1bhnnb.exe60⤵
- Executes dropped EXE
PID:2748 -
\??\c:\dvdvd.exec:\dvdvd.exe61⤵
- Executes dropped EXE
PID:3432 -
\??\c:\rrrrllf.exec:\rrrrllf.exe62⤵
- Executes dropped EXE
PID:4972 -
\??\c:\1lrrlfr.exec:\1lrrlfr.exe63⤵
- Executes dropped EXE
PID:4788 -
\??\c:\nnbbtn.exec:\nnbbtn.exe64⤵
- Executes dropped EXE
PID:2124 -
\??\c:\9ddvj.exec:\9ddvj.exe65⤵
- Executes dropped EXE
PID:4428 -
\??\c:\dpvpv.exec:\dpvpv.exe66⤵PID:1480
-
\??\c:\5ffxrlf.exec:\5ffxrlf.exe67⤵PID:948
-
\??\c:\tttnbb.exec:\tttnbb.exe68⤵PID:1968
-
\??\c:\btnhbb.exec:\btnhbb.exe69⤵PID:4288
-
\??\c:\1jppj.exec:\1jppj.exe70⤵PID:4476
-
\??\c:\xxlllrr.exec:\xxlllrr.exe71⤵PID:4112
-
\??\c:\ntbbtb.exec:\ntbbtb.exe72⤵PID:692
-
\??\c:\bnbhtn.exec:\bnbhtn.exe73⤵PID:5032
-
\??\c:\3pjjd.exec:\3pjjd.exe74⤵PID:4568
-
\??\c:\1jjdv.exec:\1jjdv.exe75⤵PID:4028
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe76⤵PID:4516
-
\??\c:\7bhbtt.exec:\7bhbtt.exe77⤵PID:4648
-
\??\c:\vvvvj.exec:\vvvvj.exe78⤵PID:1732
-
\??\c:\fxrrlfx.exec:\fxrrlfx.exe79⤵PID:2452
-
\??\c:\bntnhb.exec:\bntnhb.exe80⤵PID:4852
-
\??\c:\vvvpj.exec:\vvvpj.exe81⤵PID:1676
-
\??\c:\pjvvj.exec:\pjvvj.exe82⤵PID:4328
-
\??\c:\flxrlfx.exec:\flxrlfx.exe83⤵PID:5164
-
\??\c:\htbbtt.exec:\htbbtt.exe84⤵PID:3316
-
\??\c:\jdvpj.exec:\jdvpj.exe85⤵PID:932
-
\??\c:\lxlffff.exec:\lxlffff.exe86⤵PID:4072
-
\??\c:\5ffxxff.exec:\5ffxxff.exe87⤵PID:2528
-
\??\c:\tnnbnb.exec:\tnnbnb.exe88⤵PID:2144
-
\??\c:\jjpjd.exec:\jjpjd.exe89⤵PID:4888
-
\??\c:\xfrllll.exec:\xfrllll.exe90⤵PID:5404
-
\??\c:\tbnnnn.exec:\tbnnnn.exe91⤵PID:4832
-
\??\c:\5vvvj.exec:\5vvvj.exe92⤵PID:4120
-
\??\c:\fffxrrl.exec:\fffxrrl.exe93⤵PID:3956
-
\??\c:\flffxrr.exec:\flffxrr.exe94⤵PID:4652
-
\??\c:\bnhbhb.exec:\bnhbhb.exe95⤵PID:4496
-
\??\c:\jpdvv.exec:\jpdvv.exe96⤵PID:4800
-
\??\c:\jjpjj.exec:\jjpjj.exe97⤵PID:2408
-
\??\c:\xrrxrfx.exec:\xrrxrfx.exe98⤵PID:3872
-
\??\c:\bbhbbb.exec:\bbhbbb.exe99⤵PID:2792
-
\??\c:\dppjd.exec:\dppjd.exe100⤵PID:5612
-
\??\c:\dpdvp.exec:\dpdvp.exe101⤵PID:3268
-
\??\c:\fffxrxr.exec:\fffxrxr.exe102⤵PID:4208
-
\??\c:\bnbbtt.exec:\bnbbtt.exe103⤵PID:5356
-
\??\c:\jjddv.exec:\jjddv.exe104⤵PID:4016
-
\??\c:\xxrrrrr.exec:\xxrrrrr.exe105⤵PID:5252
-
\??\c:\rllllrf.exec:\rllllrf.exe106⤵PID:4432
-
\??\c:\thnhhh.exec:\thnhhh.exe107⤵PID:3920
-
\??\c:\vppvd.exec:\vppvd.exe108⤵PID:2508
-
\??\c:\lxrllff.exec:\lxrllff.exe109⤵PID:5224
-
\??\c:\9lllfll.exec:\9lllfll.exe110⤵PID:5204
-
\??\c:\hbthhb.exec:\hbthhb.exe111⤵PID:1988
-
\??\c:\1dvpv.exec:\1dvpv.exe112⤵PID:3972
-
\??\c:\lllffxx.exec:\lllffxx.exe113⤵PID:5904
-
\??\c:\ffxrxxl.exec:\ffxrxxl.exe114⤵PID:3612
-
\??\c:\tnthbt.exec:\tnthbt.exe115⤵PID:4480
-
\??\c:\vpdvj.exec:\vpdvj.exe116⤵PID:5040
-
\??\c:\vvpjd.exec:\vvpjd.exe117⤵PID:2728
-
\??\c:\ffflffx.exec:\ffflffx.exe118⤵PID:2864
-
\??\c:\tbnhhb.exec:\tbnhhb.exe119⤵PID:1716
-
\??\c:\vpppj.exec:\vpppj.exe120⤵PID:5220
-
\??\c:\frrrxxx.exec:\frrrxxx.exe121⤵PID:2072
-
\??\c:\3lllrxr.exec:\3lllrxr.exe122⤵PID:5468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-