Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 04:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ca14135ae7a5d5e9ac9c3c7ecc89b980_NEIKI.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
ca14135ae7a5d5e9ac9c3c7ecc89b980_NEIKI.exe
-
Size
433KB
-
MD5
ca14135ae7a5d5e9ac9c3c7ecc89b980
-
SHA1
e92c7f7a656364c3c3b6363b386d47cdc34b6715
-
SHA256
9ffdffe225cc68e42d1ed4361e0f9b76244555a661d49868f3a99d743573c71a
-
SHA512
abb19969d64d291ade0a7b5a6006cc5eaf2e28b366f6eabd191bc88a1f93b5aa0cc5391baf9095358f855dc486d22904394dfaf86d2c31c37c47a5fb400389f4
-
SSDEEP
12288:n3C9uMPh2kkkkK4kXkkkkkkkkl888888888888888888nR:ShPh2kkkkK4kXkkkkkkkkD
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/1236-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1376-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1836-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4376-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/572-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1396-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/800-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 464 pvvvd.exe 1080 1lrlfxr.exe 1376 jdvpp.exe 1836 lrxlfxr.exe 4376 rrlffxr.exe 2592 pdvdv.exe 428 9fxlffx.exe 3752 vvdvd.exe 5008 vpvpj.exe 4728 lxxrffx.exe 2956 3rrllfr.exe 3396 jdjdv.exe 2760 xrflffx.exe 1620 thtnbt.exe 1600 jvvpd.exe 4584 3frfrxl.exe 440 btthhb.exe 3672 rxffrlx.exe 3700 bnnbht.exe 1396 hhtnnh.exe 572 3jdvj.exe 1680 fffrrll.exe 2768 jjvvp.exe 4108 7lrlxxf.exe 800 9hhbnh.exe 1664 jppjj.exe 5104 nnbnbn.exe 3676 jpvjv.exe 4248 xrlrrlr.exe 4812 vvpvj.exe 4936 lrxlfxr.exe 4380 rflfrlx.exe 368 9htnbt.exe 3852 pvvjd.exe 4868 lllfxrx.exe 1080 nbhbnn.exe 5048 nhhbnh.exe 3252 7jjdv.exe 1836 xllxrlf.exe 4212 hnthtn.exe 1460 hbhnhb.exe 1508 vdpdv.exe 5000 3xfrrrr.exe 4540 nhbnbb.exe 4644 jpvpp.exe 3412 vvjdp.exe 2628 xxffrfr.exe 4744 bbnbbh.exe 860 1jjdp.exe 1432 vpvpv.exe 4224 5rlxrfl.exe 3088 tttbtt.exe 2800 pvpdp.exe 2188 3ppdv.exe 3708 5xxfxlx.exe 3864 hhhtnh.exe 884 ppjvj.exe 4700 xflfrxr.exe 4824 bbnhtb.exe 856 htnbnh.exe 2804 pvvjv.exe 1520 9lfxlxr.exe 1680 xlllxrf.exe 2416 hntnbn.exe -
resource yara_rule behavioral2/memory/1236-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4376-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/572-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/800-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1236 wrote to memory of 464 1236 ca14135ae7a5d5e9ac9c3c7ecc89b980_NEIKI.exe 85 PID 1236 wrote to memory of 464 1236 ca14135ae7a5d5e9ac9c3c7ecc89b980_NEIKI.exe 85 PID 1236 wrote to memory of 464 1236 ca14135ae7a5d5e9ac9c3c7ecc89b980_NEIKI.exe 85 PID 464 wrote to memory of 1080 464 pvvvd.exe 86 PID 464 wrote to memory of 1080 464 pvvvd.exe 86 PID 464 wrote to memory of 1080 464 pvvvd.exe 86 PID 1080 wrote to memory of 1376 1080 1lrlfxr.exe 87 PID 1080 wrote to memory of 1376 1080 1lrlfxr.exe 87 PID 1080 wrote to memory of 1376 1080 1lrlfxr.exe 87 PID 1376 wrote to memory of 1836 1376 jdvpp.exe 88 PID 1376 wrote to memory of 1836 1376 jdvpp.exe 88 PID 1376 wrote to memory of 1836 1376 jdvpp.exe 88 PID 1836 wrote to memory of 4376 1836 lrxlfxr.exe 89 PID 1836 wrote to memory of 4376 1836 lrxlfxr.exe 89 PID 1836 wrote to memory of 4376 1836 lrxlfxr.exe 89 PID 4376 wrote to memory of 2592 4376 rrlffxr.exe 90 PID 4376 wrote to memory of 2592 4376 rrlffxr.exe 90 PID 4376 wrote to memory of 2592 4376 rrlffxr.exe 90 PID 2592 wrote to memory of 428 2592 pdvdv.exe 91 PID 2592 wrote to memory of 428 2592 pdvdv.exe 91 PID 2592 wrote to memory of 428 2592 pdvdv.exe 91 PID 428 wrote to memory of 3752 428 9fxlffx.exe 92 PID 428 wrote to memory of 3752 428 9fxlffx.exe 92 PID 428 wrote to memory of 3752 428 9fxlffx.exe 92 PID 3752 wrote to memory of 5008 3752 vvdvd.exe 93 PID 3752 wrote to memory of 5008 3752 vvdvd.exe 93 PID 3752 wrote to memory of 5008 3752 vvdvd.exe 93 PID 5008 wrote to memory of 4728 5008 vpvpj.exe 94 PID 5008 wrote to memory of 4728 5008 vpvpj.exe 94 PID 5008 wrote to memory of 4728 5008 vpvpj.exe 94 PID 4728 wrote to memory of 2956 4728 lxxrffx.exe 95 PID 4728 wrote to memory of 2956 4728 lxxrffx.exe 95 PID 4728 wrote to memory of 2956 4728 lxxrffx.exe 95 PID 2956 wrote to memory of 3396 2956 3rrllfr.exe 96 PID 2956 wrote to memory of 3396 2956 3rrllfr.exe 96 PID 2956 wrote to memory of 3396 2956 3rrllfr.exe 96 PID 3396 wrote to memory of 2760 3396 jdjdv.exe 97 PID 3396 wrote to memory of 2760 3396 jdjdv.exe 97 PID 3396 wrote to memory of 2760 3396 jdjdv.exe 97 PID 2760 wrote to memory of 1620 2760 xrflffx.exe 98 PID 2760 wrote to memory of 1620 2760 xrflffx.exe 98 PID 2760 wrote to memory of 1620 2760 xrflffx.exe 98 PID 1620 wrote to memory of 1600 1620 thtnbt.exe 100 PID 1620 wrote to memory of 1600 1620 thtnbt.exe 100 PID 1620 wrote to memory of 1600 1620 thtnbt.exe 100 PID 1600 wrote to memory of 4584 1600 jvvpd.exe 101 PID 1600 wrote to memory of 4584 1600 jvvpd.exe 101 PID 1600 wrote to memory of 4584 1600 jvvpd.exe 101 PID 4584 wrote to memory of 440 4584 3frfrxl.exe 102 PID 4584 wrote to memory of 440 4584 3frfrxl.exe 102 PID 4584 wrote to memory of 440 4584 3frfrxl.exe 102 PID 440 wrote to memory of 3672 440 btthhb.exe 103 PID 440 wrote to memory of 3672 440 btthhb.exe 103 PID 440 wrote to memory of 3672 440 btthhb.exe 103 PID 3672 wrote to memory of 3700 3672 rxffrlx.exe 105 PID 3672 wrote to memory of 3700 3672 rxffrlx.exe 105 PID 3672 wrote to memory of 3700 3672 rxffrlx.exe 105 PID 3700 wrote to memory of 1396 3700 bnnbht.exe 106 PID 3700 wrote to memory of 1396 3700 bnnbht.exe 106 PID 3700 wrote to memory of 1396 3700 bnnbht.exe 106 PID 1396 wrote to memory of 572 1396 hhtnnh.exe 107 PID 1396 wrote to memory of 572 1396 hhtnnh.exe 107 PID 1396 wrote to memory of 572 1396 hhtnnh.exe 107 PID 572 wrote to memory of 1680 572 3jdvj.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca14135ae7a5d5e9ac9c3c7ecc89b980_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\ca14135ae7a5d5e9ac9c3c7ecc89b980_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\pvvvd.exec:\pvvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\1lrlfxr.exec:\1lrlfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\jdvpp.exec:\jdvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\lrxlfxr.exec:\lrxlfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\rrlffxr.exec:\rrlffxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\pdvdv.exec:\pdvdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\9fxlffx.exec:\9fxlffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\vvdvd.exec:\vvdvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\vpvpj.exec:\vpvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\lxxrffx.exec:\lxxrffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\3rrllfr.exec:\3rrllfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\jdjdv.exec:\jdjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\xrflffx.exec:\xrflffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\thtnbt.exec:\thtnbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\jvvpd.exec:\jvvpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\3frfrxl.exec:\3frfrxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\btthhb.exec:\btthhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\rxffrlx.exec:\rxffrlx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\bnnbht.exec:\bnnbht.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\hhtnnh.exec:\hhtnnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\3jdvj.exec:\3jdvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\fffrrll.exec:\fffrrll.exe23⤵
- Executes dropped EXE
PID:1680 -
\??\c:\jjvvp.exec:\jjvvp.exe24⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7lrlxxf.exec:\7lrlxxf.exe25⤵
- Executes dropped EXE
PID:4108 -
\??\c:\9hhbnh.exec:\9hhbnh.exe26⤵
- Executes dropped EXE
PID:800 -
\??\c:\jppjj.exec:\jppjj.exe27⤵
- Executes dropped EXE
PID:1664 -
\??\c:\nnbnbn.exec:\nnbnbn.exe28⤵
- Executes dropped EXE
PID:5104 -
\??\c:\jpvjv.exec:\jpvjv.exe29⤵
- Executes dropped EXE
PID:3676 -
\??\c:\xrlrrlr.exec:\xrlrrlr.exe30⤵
- Executes dropped EXE
PID:4248 -
\??\c:\vvpvj.exec:\vvpvj.exe31⤵
- Executes dropped EXE
PID:4812 -
\??\c:\lrxlfxr.exec:\lrxlfxr.exe32⤵
- Executes dropped EXE
PID:4936 -
\??\c:\rflfrlx.exec:\rflfrlx.exe33⤵
- Executes dropped EXE
PID:4380 -
\??\c:\9htnbt.exec:\9htnbt.exe34⤵
- Executes dropped EXE
PID:368 -
\??\c:\pvvjd.exec:\pvvjd.exe35⤵
- Executes dropped EXE
PID:3852 -
\??\c:\lllfxrx.exec:\lllfxrx.exe36⤵
- Executes dropped EXE
PID:4868 -
\??\c:\nbhbnn.exec:\nbhbnn.exe37⤵
- Executes dropped EXE
PID:1080 -
\??\c:\nhhbnh.exec:\nhhbnh.exe38⤵
- Executes dropped EXE
PID:5048 -
\??\c:\7jjdv.exec:\7jjdv.exe39⤵
- Executes dropped EXE
PID:3252 -
\??\c:\xllxrlf.exec:\xllxrlf.exe40⤵
- Executes dropped EXE
PID:1836 -
\??\c:\hnthtn.exec:\hnthtn.exe41⤵
- Executes dropped EXE
PID:4212 -
\??\c:\hbhnhb.exec:\hbhnhb.exe42⤵
- Executes dropped EXE
PID:1460 -
\??\c:\vdpdv.exec:\vdpdv.exe43⤵
- Executes dropped EXE
PID:1508 -
\??\c:\3xfrrrr.exec:\3xfrrrr.exe44⤵
- Executes dropped EXE
PID:5000 -
\??\c:\nhbnbb.exec:\nhbnbb.exe45⤵
- Executes dropped EXE
PID:4540 -
\??\c:\jpvpp.exec:\jpvpp.exe46⤵
- Executes dropped EXE
PID:4644 -
\??\c:\vvjdp.exec:\vvjdp.exe47⤵
- Executes dropped EXE
PID:3412 -
\??\c:\xxffrfr.exec:\xxffrfr.exe48⤵
- Executes dropped EXE
PID:2628 -
\??\c:\bbnbbh.exec:\bbnbbh.exe49⤵
- Executes dropped EXE
PID:4744 -
\??\c:\1jjdp.exec:\1jjdp.exe50⤵
- Executes dropped EXE
PID:860 -
\??\c:\vpvpv.exec:\vpvpv.exe51⤵
- Executes dropped EXE
PID:1432 -
\??\c:\5rlxrfl.exec:\5rlxrfl.exe52⤵
- Executes dropped EXE
PID:4224 -
\??\c:\tttbtt.exec:\tttbtt.exe53⤵
- Executes dropped EXE
PID:3088 -
\??\c:\pvpdp.exec:\pvpdp.exe54⤵
- Executes dropped EXE
PID:2800 -
\??\c:\3ppdv.exec:\3ppdv.exe55⤵
- Executes dropped EXE
PID:2188 -
\??\c:\5xxfxlx.exec:\5xxfxlx.exe56⤵
- Executes dropped EXE
PID:3708 -
\??\c:\hhhtnh.exec:\hhhtnh.exe57⤵
- Executes dropped EXE
PID:3864 -
\??\c:\ppjvj.exec:\ppjvj.exe58⤵
- Executes dropped EXE
PID:884 -
\??\c:\xflfrxr.exec:\xflfrxr.exe59⤵
- Executes dropped EXE
PID:4700 -
\??\c:\bbnhtb.exec:\bbnhtb.exe60⤵
- Executes dropped EXE
PID:4824 -
\??\c:\htnbnh.exec:\htnbnh.exe61⤵
- Executes dropped EXE
PID:856 -
\??\c:\pvvjv.exec:\pvvjv.exe62⤵
- Executes dropped EXE
PID:2804 -
\??\c:\9lfxlxr.exec:\9lfxlxr.exe63⤵
- Executes dropped EXE
PID:1520 -
\??\c:\xlllxrf.exec:\xlllxrf.exe64⤵
- Executes dropped EXE
PID:1680 -
\??\c:\hntnbn.exec:\hntnbn.exe65⤵
- Executes dropped EXE
PID:2416 -
\??\c:\hhnhtb.exec:\hhnhtb.exe66⤵PID:3112
-
\??\c:\1vpdp.exec:\1vpdp.exe67⤵PID:436
-
\??\c:\dvdvv.exec:\dvdvv.exe68⤵PID:828
-
\??\c:\xlllllx.exec:\xlllllx.exe69⤵PID:3784
-
\??\c:\bhnbtn.exec:\bhnbtn.exe70⤵PID:848
-
\??\c:\vjvjj.exec:\vjvjj.exe71⤵PID:3256
-
\??\c:\9xrxlfl.exec:\9xrxlfl.exe72⤵PID:3456
-
\??\c:\xflfxrl.exec:\xflfxrl.exe73⤵PID:3676
-
\??\c:\nhbtnb.exec:\nhbtnb.exe74⤵PID:3348
-
\??\c:\vppvv.exec:\vppvv.exe75⤵PID:3476
-
\??\c:\fxllfxl.exec:\fxllfxl.exe76⤵PID:4852
-
\??\c:\nnhhnh.exec:\nnhhnh.exe77⤵PID:4516
-
\??\c:\ttbnhb.exec:\ttbnhb.exe78⤵PID:2476
-
\??\c:\vvvjv.exec:\vvvjv.exe79⤵PID:1376
-
\??\c:\5xfrfxx.exec:\5xfrfxx.exe80⤵PID:1080
-
\??\c:\tbbnbt.exec:\tbbnbt.exe81⤵PID:5048
-
\??\c:\3jdpp.exec:\3jdpp.exe82⤵PID:1956
-
\??\c:\rffrlxr.exec:\rffrlxr.exe83⤵PID:3468
-
\??\c:\nthnhb.exec:\nthnhb.exe84⤵PID:3380
-
\??\c:\pdjdv.exec:\pdjdv.exe85⤵PID:3388
-
\??\c:\1jpdv.exec:\1jpdv.exe86⤵PID:940
-
\??\c:\rxfrrrl.exec:\rxfrrrl.exe87⤵PID:4616
-
\??\c:\ntnbtn.exec:\ntnbtn.exe88⤵PID:1328
-
\??\c:\pvdvp.exec:\pvdvp.exe89⤵PID:2796
-
\??\c:\ppdpv.exec:\ppdpv.exe90⤵PID:2832
-
\??\c:\rlxllff.exec:\rlxllff.exe91⤵PID:2908
-
\??\c:\btttnn.exec:\btttnn.exe92⤵PID:820
-
\??\c:\vvpjv.exec:\vvpjv.exe93⤵PID:3396
-
\??\c:\9dvpv.exec:\9dvpv.exe94⤵PID:2760
-
\??\c:\flfrllx.exec:\flfrllx.exe95⤵PID:384
-
\??\c:\thhthb.exec:\thhthb.exe96⤵PID:2800
-
\??\c:\7jjdd.exec:\7jjdd.exe97⤵PID:2188
-
\??\c:\jvvjv.exec:\jvvjv.exe98⤵PID:4584
-
\??\c:\fllrfrl.exec:\fllrfrl.exe99⤵PID:3864
-
\??\c:\btnhtn.exec:\btnhtn.exe100⤵PID:4424
-
\??\c:\thhtnh.exec:\thhtnh.exe101⤵PID:4700
-
\??\c:\jpvdp.exec:\jpvdp.exe102⤵PID:1492
-
\??\c:\fllfrff.exec:\fllfrff.exe103⤵PID:1456
-
\??\c:\lxxrllr.exec:\lxxrllr.exe104⤵PID:4984
-
\??\c:\hbbttn.exec:\hbbttn.exe105⤵PID:2408
-
\??\c:\jvvjd.exec:\jvvjd.exe106⤵PID:2416
-
\??\c:\3fxrflx.exec:\3fxrflx.exe107⤵PID:2764
-
\??\c:\3hhtnh.exec:\3hhtnh.exe108⤵PID:1664
-
\??\c:\pdvjp.exec:\pdvjp.exe109⤵PID:232
-
\??\c:\dpjvj.exec:\dpjvj.exe110⤵PID:4084
-
\??\c:\1rffxlx.exec:\1rffxlx.exe111⤵PID:1552
-
\??\c:\3nhthb.exec:\3nhthb.exe112⤵PID:3332
-
\??\c:\nhhttn.exec:\nhhttn.exe113⤵PID:3284
-
\??\c:\5vvpv.exec:\5vvpv.exe114⤵PID:1316
-
\??\c:\fflxlfr.exec:\fflxlfr.exe115⤵PID:920
-
\??\c:\9fffflf.exec:\9fffflf.exe116⤵PID:2184
-
\??\c:\ttthtn.exec:\ttthtn.exe117⤵PID:1080
-
\??\c:\5jdvp.exec:\5jdvp.exe118⤵PID:4028
-
\??\c:\xlfrfxl.exec:\xlfrfxl.exe119⤵PID:3684
-
\??\c:\ttnthb.exec:\ttnthb.exe120⤵PID:428
-
\??\c:\pvpjp.exec:\pvpjp.exe121⤵PID:3380
-
\??\c:\ffxxrll.exec:\ffxxrll.exe122⤵PID:3752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-