Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 15:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ed5d0cae4083465925ba0602c82fc9c0_NEIKI.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
ed5d0cae4083465925ba0602c82fc9c0_NEIKI.exe
-
Size
95KB
-
MD5
ed5d0cae4083465925ba0602c82fc9c0
-
SHA1
4971b37abd9b9a064b1ba4dcc2db759b16d7d5bc
-
SHA256
49d3f219d99cc969cab53cade411d4d5d1f67d46305d6b73cf08b22f6307b9a0
-
SHA512
bd68118213fb1b206cbdc94f1afed17130dd49e2e148ead9237090b5d8d5f2d9ff0c867f98feb93b0e7158fdd8c8d4d481db6e28747976272fe2505b19a87aa6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/2CC:ymb3NkkiQ3mdBjFo73PYP1lri3K8GwyV
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral2/memory/1880-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/756-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1368-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1240-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1268-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 868 jvvpj.exe 2436 tbtbth.exe 3916 vvjdj.exe 756 lrfxxlr.exe 4688 htnthb.exe 1952 jpvjj.exe 1368 xfffxxr.exe 1240 tbbbbb.exe 4748 vjpdv.exe 4440 jdddv.exe 3992 1ffxrrl.exe 1888 bnnbnh.exe 3312 pvddv.exe 1620 vvdvv.exe 4232 rrxxllr.exe 1380 hnttnn.exe 4560 vpjdv.exe 3940 djjvp.exe 2092 fxlfllx.exe 1200 bnhhhh.exe 4628 jpvpp.exe 1504 djpjd.exe 1568 xxlrllx.exe 968 tttnhh.exe 4364 nbhtnh.exe 3956 jvpjv.exe 4888 llffxxx.exe 1268 rflfffl.exe 4804 bnbtnh.exe 1036 pddvp.exe 2060 pjvpd.exe 1896 rflfxxx.exe 3980 bhthtn.exe 3128 ddvpj.exe 4356 lxlfllf.exe 3176 nhhhbt.exe 1808 7jjdv.exe 4252 rllfrfr.exe 3500 1hbttn.exe 2056 9tttnh.exe 4748 vpvjd.exe 4440 vdpvj.exe 2292 rrrrfll.exe 1204 tnttnt.exe 660 3djjp.exe 2596 9xxrrll.exe 1620 9tbbtt.exe 4932 tnttbb.exe 4792 vjpdj.exe 5092 vpjdv.exe 3032 fxxlllf.exe 4520 5ffxxxr.exe 744 nnnhtt.exe 5016 tnnbtt.exe 3756 pppjj.exe 2268 jjvpd.exe 1340 xrllxxr.exe 4492 tbbhtt.exe 4776 ttbtnh.exe 2212 vpddp.exe 776 rxxrllf.exe 3508 ttbthn.exe 2084 bbthnh.exe 4928 jvvpp.exe -
resource yara_rule behavioral2/memory/1880-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/756-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1368-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2060-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1880 wrote to memory of 868 1880 ed5d0cae4083465925ba0602c82fc9c0_NEIKI.exe 88 PID 1880 wrote to memory of 868 1880 ed5d0cae4083465925ba0602c82fc9c0_NEIKI.exe 88 PID 1880 wrote to memory of 868 1880 ed5d0cae4083465925ba0602c82fc9c0_NEIKI.exe 88 PID 868 wrote to memory of 2436 868 jvvpj.exe 89 PID 868 wrote to memory of 2436 868 jvvpj.exe 89 PID 868 wrote to memory of 2436 868 jvvpj.exe 89 PID 2436 wrote to memory of 3916 2436 tbtbth.exe 90 PID 2436 wrote to memory of 3916 2436 tbtbth.exe 90 PID 2436 wrote to memory of 3916 2436 tbtbth.exe 90 PID 3916 wrote to memory of 756 3916 vvjdj.exe 91 PID 3916 wrote to memory of 756 3916 vvjdj.exe 91 PID 3916 wrote to memory of 756 3916 vvjdj.exe 91 PID 756 wrote to memory of 4688 756 lrfxxlr.exe 93 PID 756 wrote to memory of 4688 756 lrfxxlr.exe 93 PID 756 wrote to memory of 4688 756 lrfxxlr.exe 93 PID 4688 wrote to memory of 1952 4688 htnthb.exe 94 PID 4688 wrote to memory of 1952 4688 htnthb.exe 94 PID 4688 wrote to memory of 1952 4688 htnthb.exe 94 PID 1952 wrote to memory of 1368 1952 jpvjj.exe 95 PID 1952 wrote to memory of 1368 1952 jpvjj.exe 95 PID 1952 wrote to memory of 1368 1952 jpvjj.exe 95 PID 1368 wrote to memory of 1240 1368 xfffxxr.exe 96 PID 1368 wrote to memory of 1240 1368 xfffxxr.exe 96 PID 1368 wrote to memory of 1240 1368 xfffxxr.exe 96 PID 1240 wrote to memory of 4748 1240 tbbbbb.exe 98 PID 1240 wrote to memory of 4748 1240 tbbbbb.exe 98 PID 1240 wrote to memory of 4748 1240 tbbbbb.exe 98 PID 4748 wrote to memory of 4440 4748 vjpdv.exe 99 PID 4748 wrote to memory of 4440 4748 vjpdv.exe 99 PID 4748 wrote to memory of 4440 4748 vjpdv.exe 99 PID 4440 wrote to memory of 3992 4440 jdddv.exe 100 PID 4440 wrote to memory of 3992 4440 jdddv.exe 100 PID 4440 wrote to memory of 3992 4440 jdddv.exe 100 PID 3992 wrote to memory of 1888 3992 1ffxrrl.exe 101 PID 3992 wrote to memory of 1888 3992 1ffxrrl.exe 101 PID 3992 wrote to memory of 1888 3992 1ffxrrl.exe 101 PID 1888 wrote to memory of 3312 1888 bnnbnh.exe 102 PID 1888 wrote to memory of 3312 1888 bnnbnh.exe 102 PID 1888 wrote to memory of 3312 1888 bnnbnh.exe 102 PID 3312 wrote to memory of 1620 3312 pvddv.exe 103 PID 3312 wrote to memory of 1620 3312 pvddv.exe 103 PID 3312 wrote to memory of 1620 3312 pvddv.exe 103 PID 1620 wrote to memory of 4232 1620 vvdvv.exe 104 PID 1620 wrote to memory of 4232 1620 vvdvv.exe 104 PID 1620 wrote to memory of 4232 1620 vvdvv.exe 104 PID 4232 wrote to memory of 1380 4232 rrxxllr.exe 105 PID 4232 wrote to memory of 1380 4232 rrxxllr.exe 105 PID 4232 wrote to memory of 1380 4232 rrxxllr.exe 105 PID 1380 wrote to memory of 4560 1380 hnttnn.exe 106 PID 1380 wrote to memory of 4560 1380 hnttnn.exe 106 PID 1380 wrote to memory of 4560 1380 hnttnn.exe 106 PID 4560 wrote to memory of 3940 4560 vpjdv.exe 107 PID 4560 wrote to memory of 3940 4560 vpjdv.exe 107 PID 4560 wrote to memory of 3940 4560 vpjdv.exe 107 PID 3940 wrote to memory of 2092 3940 djjvp.exe 109 PID 3940 wrote to memory of 2092 3940 djjvp.exe 109 PID 3940 wrote to memory of 2092 3940 djjvp.exe 109 PID 2092 wrote to memory of 1200 2092 fxlfllx.exe 110 PID 2092 wrote to memory of 1200 2092 fxlfllx.exe 110 PID 2092 wrote to memory of 1200 2092 fxlfllx.exe 110 PID 1200 wrote to memory of 4628 1200 bnhhhh.exe 111 PID 1200 wrote to memory of 4628 1200 bnhhhh.exe 111 PID 1200 wrote to memory of 4628 1200 bnhhhh.exe 111 PID 4628 wrote to memory of 1504 4628 jpvpp.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed5d0cae4083465925ba0602c82fc9c0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\ed5d0cae4083465925ba0602c82fc9c0_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\jvvpj.exec:\jvvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\tbtbth.exec:\tbtbth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\vvjdj.exec:\vvjdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\lrfxxlr.exec:\lrfxxlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\htnthb.exec:\htnthb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\jpvjj.exec:\jpvjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\xfffxxr.exec:\xfffxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\tbbbbb.exec:\tbbbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\vjpdv.exec:\vjpdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\jdddv.exec:\jdddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\1ffxrrl.exec:\1ffxrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\bnnbnh.exec:\bnnbnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\pvddv.exec:\pvddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\vvdvv.exec:\vvdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\rrxxllr.exec:\rrxxllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\hnttnn.exec:\hnttnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\vpjdv.exec:\vpjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\djjvp.exec:\djjvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\fxlfllx.exec:\fxlfllx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\bnhhhh.exec:\bnhhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\jpvpp.exec:\jpvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\djpjd.exec:\djpjd.exe23⤵
- Executes dropped EXE
PID:1504 -
\??\c:\xxlrllx.exec:\xxlrllx.exe24⤵
- Executes dropped EXE
PID:1568 -
\??\c:\tttnhh.exec:\tttnhh.exe25⤵
- Executes dropped EXE
PID:968 -
\??\c:\nbhtnh.exec:\nbhtnh.exe26⤵
- Executes dropped EXE
PID:4364 -
\??\c:\jvpjv.exec:\jvpjv.exe27⤵
- Executes dropped EXE
PID:3956 -
\??\c:\llffxxx.exec:\llffxxx.exe28⤵
- Executes dropped EXE
PID:4888 -
\??\c:\rflfffl.exec:\rflfffl.exe29⤵
- Executes dropped EXE
PID:1268 -
\??\c:\bnbtnh.exec:\bnbtnh.exe30⤵
- Executes dropped EXE
PID:4804 -
\??\c:\pddvp.exec:\pddvp.exe31⤵
- Executes dropped EXE
PID:1036 -
\??\c:\pjvpd.exec:\pjvpd.exe32⤵
- Executes dropped EXE
PID:2060 -
\??\c:\rflfxxx.exec:\rflfxxx.exe33⤵
- Executes dropped EXE
PID:1896 -
\??\c:\bhthtn.exec:\bhthtn.exe34⤵
- Executes dropped EXE
PID:3980 -
\??\c:\ddvpj.exec:\ddvpj.exe35⤵
- Executes dropped EXE
PID:3128 -
\??\c:\lxlfllf.exec:\lxlfllf.exe36⤵
- Executes dropped EXE
PID:4356 -
\??\c:\nhhhbt.exec:\nhhhbt.exe37⤵
- Executes dropped EXE
PID:3176 -
\??\c:\7jjdv.exec:\7jjdv.exe38⤵
- Executes dropped EXE
PID:1808 -
\??\c:\rllfrfr.exec:\rllfrfr.exe39⤵
- Executes dropped EXE
PID:4252 -
\??\c:\1hbttn.exec:\1hbttn.exe40⤵
- Executes dropped EXE
PID:3500 -
\??\c:\9tttnh.exec:\9tttnh.exe41⤵
- Executes dropped EXE
PID:2056 -
\??\c:\vpvjd.exec:\vpvjd.exe42⤵
- Executes dropped EXE
PID:4748 -
\??\c:\vdpvj.exec:\vdpvj.exe43⤵
- Executes dropped EXE
PID:4440 -
\??\c:\rrrrfll.exec:\rrrrfll.exe44⤵
- Executes dropped EXE
PID:2292 -
\??\c:\tnttnt.exec:\tnttnt.exe45⤵
- Executes dropped EXE
PID:1204 -
\??\c:\3djjp.exec:\3djjp.exe46⤵
- Executes dropped EXE
PID:660 -
\??\c:\9xxrrll.exec:\9xxrrll.exe47⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9tbbtt.exec:\9tbbtt.exe48⤵
- Executes dropped EXE
PID:1620 -
\??\c:\tnttbb.exec:\tnttbb.exe49⤵
- Executes dropped EXE
PID:4932 -
\??\c:\vjpdj.exec:\vjpdj.exe50⤵
- Executes dropped EXE
PID:4792 -
\??\c:\vpjdv.exec:\vpjdv.exe51⤵
- Executes dropped EXE
PID:5092 -
\??\c:\fxxlllf.exec:\fxxlllf.exe52⤵
- Executes dropped EXE
PID:3032 -
\??\c:\5ffxxxr.exec:\5ffxxxr.exe53⤵
- Executes dropped EXE
PID:4520 -
\??\c:\nnnhtt.exec:\nnnhtt.exe54⤵
- Executes dropped EXE
PID:744 -
\??\c:\tnnbtt.exec:\tnnbtt.exe55⤵
- Executes dropped EXE
PID:5016 -
\??\c:\pppjj.exec:\pppjj.exe56⤵
- Executes dropped EXE
PID:3756 -
\??\c:\jjvpd.exec:\jjvpd.exe57⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xrllxxr.exec:\xrllxxr.exe58⤵
- Executes dropped EXE
PID:1340 -
\??\c:\tbbhtt.exec:\tbbhtt.exe59⤵
- Executes dropped EXE
PID:4492 -
\??\c:\ttbtnh.exec:\ttbtnh.exe60⤵
- Executes dropped EXE
PID:4776 -
\??\c:\vpddp.exec:\vpddp.exe61⤵
- Executes dropped EXE
PID:2212 -
\??\c:\rxxrllf.exec:\rxxrllf.exe62⤵
- Executes dropped EXE
PID:776 -
\??\c:\ttbthn.exec:\ttbthn.exe63⤵
- Executes dropped EXE
PID:3508 -
\??\c:\bbthnh.exec:\bbthnh.exe64⤵
- Executes dropped EXE
PID:2084 -
\??\c:\jvvpp.exec:\jvvpp.exe65⤵
- Executes dropped EXE
PID:4928 -
\??\c:\dvvpj.exec:\dvvpj.exe66⤵PID:1268
-
\??\c:\5fxlxrl.exec:\5fxlxrl.exe67⤵PID:2896
-
\??\c:\xrxrxrl.exec:\xrxrxrl.exe68⤵PID:3900
-
\??\c:\3hnhhh.exec:\3hnhhh.exe69⤵PID:868
-
\??\c:\tnnhth.exec:\tnnhth.exe70⤵PID:976
-
\??\c:\hhnhbb.exec:\hhnhbb.exe71⤵PID:4824
-
\??\c:\rxxrfff.exec:\rxxrfff.exe72⤵PID:3980
-
\??\c:\bhtttb.exec:\bhtttb.exe73⤵PID:4688
-
\??\c:\pdppp.exec:\pdppp.exe74⤵PID:4844
-
\??\c:\fffrfxr.exec:\fffrfxr.exe75⤵PID:3176
-
\??\c:\llffxxr.exec:\llffxxr.exe76⤵PID:3804
-
\??\c:\hntnnt.exec:\hntnnt.exe77⤵PID:1624
-
\??\c:\lrrllxr.exec:\lrrllxr.exe78⤵PID:1904
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe79⤵PID:3684
-
\??\c:\dpvvj.exec:\dpvvj.exe80⤵PID:1000
-
\??\c:\dddvp.exec:\dddvp.exe81⤵PID:3992
-
\??\c:\xlfxrll.exec:\xlfxrll.exe82⤵PID:3144
-
\??\c:\bbbtnn.exec:\bbbtnn.exe83⤵PID:4736
-
\??\c:\dvjpd.exec:\dvjpd.exe84⤵PID:4652
-
\??\c:\xlrlxxx.exec:\xlrlxxx.exe85⤵PID:2596
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe86⤵PID:1620
-
\??\c:\tbbttn.exec:\tbbttn.exe87⤵PID:3400
-
\??\c:\vpjpp.exec:\vpjpp.exe88⤵PID:1244
-
\??\c:\jjpjv.exec:\jjpjv.exe89⤵PID:2216
-
\??\c:\lfrlrrl.exec:\lfrlrrl.exe90⤵PID:3680
-
\??\c:\hhnntt.exec:\hhnntt.exe91⤵PID:1588
-
\??\c:\hbbtnn.exec:\hbbtnn.exe92⤵PID:744
-
\??\c:\jjddv.exec:\jjddv.exe93⤵PID:5016
-
\??\c:\rlrrlrr.exec:\rlrrlrr.exe94⤵PID:3756
-
\??\c:\llfxlfx.exec:\llfxlfx.exe95⤵PID:2268
-
\??\c:\9hhbnn.exec:\9hhbnn.exe96⤵PID:4460
-
\??\c:\jdjjd.exec:\jdjjd.exe97⤵PID:4492
-
\??\c:\jvvpj.exec:\jvvpj.exe98⤵PID:1356
-
\??\c:\xrxrlrl.exec:\xrxrlrl.exe99⤵PID:3280
-
\??\c:\frlfxrl.exec:\frlfxrl.exe100⤵PID:3436
-
\??\c:\nbttnh.exec:\nbttnh.exe101⤵PID:4888
-
\??\c:\dpvpj.exec:\dpvpj.exe102⤵PID:4488
-
\??\c:\pjpdp.exec:\pjpdp.exe103⤵PID:4840
-
\??\c:\xlfxllf.exec:\xlfxllf.exe104⤵PID:3740
-
\??\c:\rlrfxxr.exec:\rlrfxxr.exe105⤵PID:2668
-
\??\c:\1hbthb.exec:\1hbthb.exe106⤵PID:3952
-
\??\c:\dpjjj.exec:\dpjjj.exe107⤵PID:564
-
\??\c:\jvpjd.exec:\jvpjd.exe108⤵PID:3520
-
\??\c:\5fffxxx.exec:\5fffxxx.exe109⤵PID:5056
-
\??\c:\fllfxxl.exec:\fllfxxl.exe110⤵PID:976
-
\??\c:\tbttnh.exec:\tbttnh.exe111⤵PID:2012
-
\??\c:\pvdvp.exec:\pvdvp.exe112⤵PID:3980
-
\??\c:\9jdvj.exec:\9jdvj.exe113⤵PID:4688
-
\??\c:\xrlfrlr.exec:\xrlfrlr.exe114⤵PID:2168
-
\??\c:\bhnhbh.exec:\bhnhbh.exe115⤵PID:3176
-
\??\c:\hhhbtn.exec:\hhhbtn.exe116⤵PID:3804
-
\??\c:\vpdvd.exec:\vpdvd.exe117⤵PID:2156
-
\??\c:\vvppp.exec:\vvppp.exe118⤵PID:3444
-
\??\c:\3rrlxfx.exec:\3rrlxfx.exe119⤵PID:3684
-
\??\c:\hnttnn.exec:\hnttnn.exe120⤵PID:1000
-
\??\c:\btnhtt.exec:\btnhtt.exe121⤵PID:3992
-
\??\c:\pppjd.exec:\pppjd.exe122⤵PID:3580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-