Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 10:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6fdb54431bd0213071e72f9c5d879b90_NEIKI.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
6fdb54431bd0213071e72f9c5d879b90_NEIKI.exe
-
Size
70KB
-
MD5
6fdb54431bd0213071e72f9c5d879b90
-
SHA1
033914eb0fcab854ac9798acc33066af65133cf5
-
SHA256
bd6d2a318f19b6e573bd5ff7597ba7b1abc991da1819c12b24d2a64ee7372687
-
SHA512
b52ed78bf0ba0b93da7acbbc1e70ad91ca9083cfda438d43fcbc25069c2c647b401ba544d3e7db6da35f8e650c6853b8294e20c4ef6c92035c246fe561652d39
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgUVyiAn7:ymb3NkkiQ3mdBjFIgUE5
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2660-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5352-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5260-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/664-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/676-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3788-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5608-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5512-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5740-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5768-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5348-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1136 rfxxfrx.exe 1236 xllfxxr.exe 2756 7nnhhh.exe 5352 tnhbtt.exe 5260 bhbtnn.exe 864 vpjdp.exe 4168 rlxrxxx.exe 664 llxrrxl.exe 4056 hhhbnn.exe 3424 dppjd.exe 676 vjvpv.exe 4932 xllfrrl.exe 1200 httbtb.exe 3704 1pjjd.exe 3788 7vdvp.exe 2436 fxxlffx.exe 5608 bnhhbn.exe 4780 nbhbbt.exe 5512 pdpdp.exe 2968 pjvvp.exe 5740 xxfxrrx.exe 2560 bthnhb.exe 3564 nhnnbb.exe 5768 7dddv.exe 928 xlrfxxr.exe 3952 1xfxffx.exe 4152 bbnbht.exe 1500 jdvdv.exe 5348 jdddd.exe 1084 jppjd.exe 4620 vppjj.exe 3960 fffxllf.exe 2748 xrllfff.exe 2372 hbthhb.exe 2000 bhnhhh.exe 2200 vdpjv.exe 3136 pvvpd.exe 5272 lffffff.exe 3404 9lrrrrr.exe 5076 tnhbtt.exe 5064 pdpdp.exe 452 xxxrlrl.exe 1464 lxrlllf.exe 1528 tnnntt.exe 1220 3ttnhh.exe 2044 jvddp.exe 5784 dvddd.exe 3308 1ffxrlf.exe 1728 nttttt.exe 5684 bhhbtt.exe 944 vpjjd.exe 1600 rlrlllr.exe 3432 rfxfrrr.exe 1924 hhbbhn.exe 2236 hhbthh.exe 1448 1dddv.exe 4220 vpjdp.exe 3948 jdvpj.exe 5668 frrllrl.exe 1824 xllrxrx.exe 5444 hbnthh.exe 4856 hbtnbb.exe 4768 jpvpp.exe 5156 llxrrxx.exe -
resource yara_rule behavioral2/memory/2660-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1136-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5352-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5260-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/676-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3788-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5608-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5512-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5740-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5768-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5348-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-195-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2660 wrote to memory of 1136 2660 6fdb54431bd0213071e72f9c5d879b90_NEIKI.exe 83 PID 2660 wrote to memory of 1136 2660 6fdb54431bd0213071e72f9c5d879b90_NEIKI.exe 83 PID 2660 wrote to memory of 1136 2660 6fdb54431bd0213071e72f9c5d879b90_NEIKI.exe 83 PID 1136 wrote to memory of 1236 1136 rfxxfrx.exe 84 PID 1136 wrote to memory of 1236 1136 rfxxfrx.exe 84 PID 1136 wrote to memory of 1236 1136 rfxxfrx.exe 84 PID 1236 wrote to memory of 2756 1236 xllfxxr.exe 85 PID 1236 wrote to memory of 2756 1236 xllfxxr.exe 85 PID 1236 wrote to memory of 2756 1236 xllfxxr.exe 85 PID 2756 wrote to memory of 5352 2756 7nnhhh.exe 86 PID 2756 wrote to memory of 5352 2756 7nnhhh.exe 86 PID 2756 wrote to memory of 5352 2756 7nnhhh.exe 86 PID 5352 wrote to memory of 5260 5352 tnhbtt.exe 87 PID 5352 wrote to memory of 5260 5352 tnhbtt.exe 87 PID 5352 wrote to memory of 5260 5352 tnhbtt.exe 87 PID 5260 wrote to memory of 864 5260 bhbtnn.exe 88 PID 5260 wrote to memory of 864 5260 bhbtnn.exe 88 PID 5260 wrote to memory of 864 5260 bhbtnn.exe 88 PID 864 wrote to memory of 4168 864 vpjdp.exe 89 PID 864 wrote to memory of 4168 864 vpjdp.exe 89 PID 864 wrote to memory of 4168 864 vpjdp.exe 89 PID 4168 wrote to memory of 664 4168 rlxrxxx.exe 90 PID 4168 wrote to memory of 664 4168 rlxrxxx.exe 90 PID 4168 wrote to memory of 664 4168 rlxrxxx.exe 90 PID 664 wrote to memory of 4056 664 llxrrxl.exe 91 PID 664 wrote to memory of 4056 664 llxrrxl.exe 91 PID 664 wrote to memory of 4056 664 llxrrxl.exe 91 PID 4056 wrote to memory of 3424 4056 hhhbnn.exe 92 PID 4056 wrote to memory of 3424 4056 hhhbnn.exe 92 PID 4056 wrote to memory of 3424 4056 hhhbnn.exe 92 PID 3424 wrote to memory of 676 3424 dppjd.exe 93 PID 3424 wrote to memory of 676 3424 dppjd.exe 93 PID 3424 wrote to memory of 676 3424 dppjd.exe 93 PID 676 wrote to memory of 4932 676 vjvpv.exe 94 PID 676 wrote to memory of 4932 676 vjvpv.exe 94 PID 676 wrote to memory of 4932 676 vjvpv.exe 94 PID 4932 wrote to memory of 1200 4932 xllfrrl.exe 95 PID 4932 wrote to memory of 1200 4932 xllfrrl.exe 95 PID 4932 wrote to memory of 1200 4932 xllfrrl.exe 95 PID 1200 wrote to memory of 3704 1200 httbtb.exe 96 PID 1200 wrote to memory of 3704 1200 httbtb.exe 96 PID 1200 wrote to memory of 3704 1200 httbtb.exe 96 PID 3704 wrote to memory of 3788 3704 1pjjd.exe 97 PID 3704 wrote to memory of 3788 3704 1pjjd.exe 97 PID 3704 wrote to memory of 3788 3704 1pjjd.exe 97 PID 3788 wrote to memory of 2436 3788 7vdvp.exe 98 PID 3788 wrote to memory of 2436 3788 7vdvp.exe 98 PID 3788 wrote to memory of 2436 3788 7vdvp.exe 98 PID 2436 wrote to memory of 5608 2436 fxxlffx.exe 99 PID 2436 wrote to memory of 5608 2436 fxxlffx.exe 99 PID 2436 wrote to memory of 5608 2436 fxxlffx.exe 99 PID 5608 wrote to memory of 4780 5608 bnhhbn.exe 100 PID 5608 wrote to memory of 4780 5608 bnhhbn.exe 100 PID 5608 wrote to memory of 4780 5608 bnhhbn.exe 100 PID 4780 wrote to memory of 5512 4780 nbhbbt.exe 101 PID 4780 wrote to memory of 5512 4780 nbhbbt.exe 101 PID 4780 wrote to memory of 5512 4780 nbhbbt.exe 101 PID 5512 wrote to memory of 2968 5512 pdpdp.exe 102 PID 5512 wrote to memory of 2968 5512 pdpdp.exe 102 PID 5512 wrote to memory of 2968 5512 pdpdp.exe 102 PID 2968 wrote to memory of 5740 2968 pjvvp.exe 103 PID 2968 wrote to memory of 5740 2968 pjvvp.exe 103 PID 2968 wrote to memory of 5740 2968 pjvvp.exe 103 PID 5740 wrote to memory of 2560 5740 xxfxrrx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fdb54431bd0213071e72f9c5d879b90_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\6fdb54431bd0213071e72f9c5d879b90_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\rfxxfrx.exec:\rfxxfrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\xllfxxr.exec:\xllfxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\7nnhhh.exec:\7nnhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\tnhbtt.exec:\tnhbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
\??\c:\bhbtnn.exec:\bhbtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
\??\c:\vpjdp.exec:\vpjdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\rlxrxxx.exec:\rlxrxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\llxrrxl.exec:\llxrrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\hhhbnn.exec:\hhhbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\dppjd.exec:\dppjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\vjvpv.exec:\vjvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\xllfrrl.exec:\xllfrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\httbtb.exec:\httbtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\1pjjd.exec:\1pjjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\7vdvp.exec:\7vdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\fxxlffx.exec:\fxxlffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\bnhhbn.exec:\bnhhbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5608 -
\??\c:\nbhbbt.exec:\nbhbbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\pdpdp.exec:\pdpdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
\??\c:\pjvvp.exec:\pjvvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\xxfxrrx.exec:\xxfxrrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
\??\c:\bthnhb.exec:\bthnhb.exe23⤵
- Executes dropped EXE
PID:2560 -
\??\c:\nhnnbb.exec:\nhnnbb.exe24⤵
- Executes dropped EXE
PID:3564 -
\??\c:\7dddv.exec:\7dddv.exe25⤵
- Executes dropped EXE
PID:5768 -
\??\c:\xlrfxxr.exec:\xlrfxxr.exe26⤵
- Executes dropped EXE
PID:928 -
\??\c:\1xfxffx.exec:\1xfxffx.exe27⤵
- Executes dropped EXE
PID:3952 -
\??\c:\bbnbht.exec:\bbnbht.exe28⤵
- Executes dropped EXE
PID:4152 -
\??\c:\jdvdv.exec:\jdvdv.exe29⤵
- Executes dropped EXE
PID:1500 -
\??\c:\jdddd.exec:\jdddd.exe30⤵
- Executes dropped EXE
PID:5348 -
\??\c:\jppjd.exec:\jppjd.exe31⤵
- Executes dropped EXE
PID:1084 -
\??\c:\vppjj.exec:\vppjj.exe32⤵
- Executes dropped EXE
PID:4620 -
\??\c:\fffxllf.exec:\fffxllf.exe33⤵
- Executes dropped EXE
PID:3960 -
\??\c:\xrllfff.exec:\xrllfff.exe34⤵
- Executes dropped EXE
PID:2748 -
\??\c:\hbthhb.exec:\hbthhb.exe35⤵
- Executes dropped EXE
PID:2372 -
\??\c:\bhnhhh.exec:\bhnhhh.exe36⤵
- Executes dropped EXE
PID:2000 -
\??\c:\vdpjv.exec:\vdpjv.exe37⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pvvpd.exec:\pvvpd.exe38⤵
- Executes dropped EXE
PID:3136 -
\??\c:\lffffff.exec:\lffffff.exe39⤵
- Executes dropped EXE
PID:5272 -
\??\c:\9lrrrrr.exec:\9lrrrrr.exe40⤵
- Executes dropped EXE
PID:3404 -
\??\c:\tnhbtt.exec:\tnhbtt.exe41⤵
- Executes dropped EXE
PID:5076 -
\??\c:\pdpdp.exec:\pdpdp.exe42⤵
- Executes dropped EXE
PID:5064 -
\??\c:\xxxrlrl.exec:\xxxrlrl.exe43⤵
- Executes dropped EXE
PID:452 -
\??\c:\lxrlllf.exec:\lxrlllf.exe44⤵
- Executes dropped EXE
PID:1464 -
\??\c:\tnnntt.exec:\tnnntt.exe45⤵
- Executes dropped EXE
PID:1528 -
\??\c:\3ttnhh.exec:\3ttnhh.exe46⤵
- Executes dropped EXE
PID:1220 -
\??\c:\jvddp.exec:\jvddp.exe47⤵
- Executes dropped EXE
PID:2044 -
\??\c:\dvddd.exec:\dvddd.exe48⤵
- Executes dropped EXE
PID:5784 -
\??\c:\1ffxrlf.exec:\1ffxrlf.exe49⤵
- Executes dropped EXE
PID:3308 -
\??\c:\nttttt.exec:\nttttt.exe50⤵
- Executes dropped EXE
PID:1728 -
\??\c:\bhhbtt.exec:\bhhbtt.exe51⤵
- Executes dropped EXE
PID:5684 -
\??\c:\vpjjd.exec:\vpjjd.exe52⤵
- Executes dropped EXE
PID:944 -
\??\c:\rlrlllr.exec:\rlrlllr.exe53⤵
- Executes dropped EXE
PID:1600 -
\??\c:\rfxfrrr.exec:\rfxfrrr.exe54⤵
- Executes dropped EXE
PID:3432 -
\??\c:\hhbbhn.exec:\hhbbhn.exe55⤵
- Executes dropped EXE
PID:1924 -
\??\c:\hhbthh.exec:\hhbthh.exe56⤵
- Executes dropped EXE
PID:2236 -
\??\c:\1dddv.exec:\1dddv.exe57⤵
- Executes dropped EXE
PID:1448 -
\??\c:\vpjdp.exec:\vpjdp.exe58⤵
- Executes dropped EXE
PID:4220 -
\??\c:\jdvpj.exec:\jdvpj.exe59⤵
- Executes dropped EXE
PID:3948 -
\??\c:\frrllrl.exec:\frrllrl.exe60⤵
- Executes dropped EXE
PID:5668 -
\??\c:\xllrxrx.exec:\xllrxrx.exe61⤵
- Executes dropped EXE
PID:1824 -
\??\c:\hbnthh.exec:\hbnthh.exe62⤵
- Executes dropped EXE
PID:5444 -
\??\c:\hbtnbb.exec:\hbtnbb.exe63⤵
- Executes dropped EXE
PID:4856 -
\??\c:\jpvpp.exec:\jpvpp.exe64⤵
- Executes dropped EXE
PID:4768 -
\??\c:\llxrrxx.exec:\llxrrxx.exe65⤵
- Executes dropped EXE
PID:5156 -
\??\c:\xlfffxx.exec:\xlfffxx.exe66⤵PID:908
-
\??\c:\rxrxrlf.exec:\rxrxrlf.exe67⤵PID:4480
-
\??\c:\9tbbtt.exec:\9tbbtt.exe68⤵PID:1524
-
\??\c:\htbttt.exec:\htbttt.exe69⤵PID:5904
-
\??\c:\jdpjj.exec:\jdpjj.exe70⤵PID:1236
-
\??\c:\pddvj.exec:\pddvj.exe71⤵PID:1280
-
\??\c:\xflfxrr.exec:\xflfxrr.exe72⤵PID:4212
-
\??\c:\lrrxrfr.exec:\lrrxrfr.exe73⤵PID:5028
-
\??\c:\tbbbbb.exec:\tbbbbb.exe74⤵PID:5836
-
\??\c:\3tbtnn.exec:\3tbtnn.exe75⤵PID:1868
-
\??\c:\jvjdd.exec:\jvjdd.exe76⤵PID:864
-
\??\c:\9jppd.exec:\9jppd.exe77⤵PID:6112
-
\??\c:\rxffxfl.exec:\rxffxfl.exe78⤵PID:4168
-
\??\c:\7rrrllf.exec:\7rrrllf.exe79⤵PID:4060
-
\??\c:\nbthnb.exec:\nbthnb.exe80⤵PID:4144
-
\??\c:\httnhh.exec:\httnhh.exe81⤵PID:4332
-
\??\c:\bhtnbb.exec:\bhtnbb.exe82⤵PID:4216
-
\??\c:\vpddv.exec:\vpddv.exe83⤵PID:3720
-
\??\c:\vjjvp.exec:\vjjvp.exe84⤵PID:5604
-
\??\c:\frrrllf.exec:\frrrllf.exe85⤵PID:4672
-
\??\c:\rxffffl.exec:\rxffffl.exe86⤵PID:2752
-
\??\c:\thnhnn.exec:\thnhnn.exe87⤵PID:4568
-
\??\c:\9thbnn.exec:\9thbnn.exe88⤵PID:1472
-
\??\c:\hhbbnn.exec:\hhbbnn.exe89⤵PID:5712
-
\??\c:\vvddp.exec:\vvddp.exe90⤵PID:5112
-
\??\c:\dpddv.exec:\dpddv.exe91⤵PID:4204
-
\??\c:\pjpjj.exec:\pjpjj.exe92⤵PID:508
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe93⤵PID:5448
-
\??\c:\lrrlffx.exec:\lrrlffx.exe94⤵PID:6108
-
\??\c:\nbhbbt.exec:\nbhbbt.exe95⤵PID:5124
-
\??\c:\5nnhbn.exec:\5nnhbn.exe96⤵PID:3188
-
\??\c:\dvvpv.exec:\dvvpv.exe97⤵PID:812
-
\??\c:\djdvv.exec:\djdvv.exe98⤵PID:2460
-
\??\c:\1lfxllf.exec:\1lfxllf.exe99⤵PID:3292
-
\??\c:\rfxxrfx.exec:\rfxxrfx.exe100⤵PID:4372
-
\??\c:\hntttb.exec:\hntttb.exe101⤵PID:4556
-
\??\c:\bbttnb.exec:\bbttnb.exe102⤵PID:3172
-
\??\c:\vppjj.exec:\vppjj.exe103⤵PID:756
-
\??\c:\vppjd.exec:\vppjd.exe104⤵PID:5248
-
\??\c:\dpjdv.exec:\dpjdv.exe105⤵PID:2964
-
\??\c:\rfffrrl.exec:\rfffrrl.exe106⤵PID:3380
-
\??\c:\lffxxxr.exec:\lffxxxr.exe107⤵PID:3960
-
\??\c:\bhbtbt.exec:\bhbtbt.exe108⤵PID:2276
-
\??\c:\tnhbtn.exec:\tnhbtn.exe109⤵PID:4920
-
\??\c:\jvpjd.exec:\jvpjd.exe110⤵PID:3280
-
\??\c:\ppvvj.exec:\ppvvj.exe111⤵PID:924
-
\??\c:\lffxlll.exec:\lffxlll.exe112⤵PID:4344
-
\??\c:\xlrrllr.exec:\xlrrllr.exe113⤵PID:2932
-
\??\c:\ntttnh.exec:\ntttnh.exe114⤵PID:5672
-
\??\c:\nnhnhb.exec:\nnhnhb.exe115⤵PID:4380
-
\??\c:\jjdvd.exec:\jjdvd.exe116⤵PID:4240
-
\??\c:\fllfxxf.exec:\fllfxxf.exe117⤵PID:3268
-
\??\c:\tnbhbt.exec:\tnbhbt.exe118⤵PID:1608
-
\??\c:\9nnnbn.exec:\9nnnbn.exe119⤵PID:4296
-
\??\c:\jdddp.exec:\jdddp.exe120⤵PID:1052
-
\??\c:\jjpjv.exec:\jjpjv.exe121⤵PID:3024
-
\??\c:\rlxlfll.exec:\rlxlfll.exe122⤵PID:1100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-