Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 17:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
03e0db243fa680ddfe34ed8b34b4b700_NEIKI.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
03e0db243fa680ddfe34ed8b34b4b700_NEIKI.exe
-
Size
201KB
-
MD5
03e0db243fa680ddfe34ed8b34b4b700
-
SHA1
7e3f34846e3a172610824f9b26085d19f9fc96f3
-
SHA256
748483fe1c50aa3764113a9ba6354dff35559bb2e402e9f8457c43ae303ed400
-
SHA512
5100ed252df440050f81773d975a54217ca0e79f8989cb9abe6f5da6c48a6a3af9f4917a9e0c383d52c29bb29c9e14cf38e4bdb514efb619e505b4a7fdae8fbe
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmc51+GqekBJCvr6zJBUmv:n3C9BRIG0asYFm71m8+GdkB9D
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/1396-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/844-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3444-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4196 rxfxxfx.exe 3872 bnnntn.exe 3900 5vppv.exe 3912 5bnnbh.exe 4192 bbbbnn.exe 4092 pdjjv.exe 3372 1tbbbb.exe 1212 jdddv.exe 844 llffrrx.exe 3084 hthhhb.exe 4056 dvvpj.exe 3780 xrxrrll.exe 4580 rrlxxrr.exe 4016 ntthbh.exe 3336 1jjjd.exe 3020 rxlxrlf.exe 3268 nbhbbb.exe 1492 lxrrllf.exe 4896 hbtntt.exe 2444 nbbbtn.exe 4848 dvdvp.exe 368 5tnnnt.exe 1616 djvvd.exe 3444 lfrlfxx.exe 3960 xxflfxx.exe 3880 bbbbtb.exe 4632 ppjdv.exe 3468 rlfffff.exe 3052 3thnhh.exe 4444 3nhhht.exe 380 djpjj.exe 2184 lrxxrrl.exe 2512 bnttnb.exe 3196 bthbtt.exe 4464 pjjdp.exe 2196 rlrllrr.exe 1076 5xffllr.exe 1072 httbbt.exe 3396 tthhtt.exe 1184 3dppd.exe 3068 xrffllr.exe 640 frfllxr.exe 3912 httnhn.exe 1488 pjpvv.exe 2308 7xlllrf.exe 1220 rrxxlrx.exe 3372 hbhhhh.exe 1400 5vjjj.exe 4100 1lfffll.exe 1000 7xxxrrr.exe 3420 nhnnnn.exe 3084 dvppp.exe 4736 lrfxxll.exe 1232 fxlrrxf.exe 4780 jpjdv.exe 2724 xrxrlrr.exe 4724 dvpvp.exe 3496 lflxxfr.exe 1148 rlffxxr.exe 3020 bnbbtb.exe 3268 jvjjj.exe 2692 nnhhhh.exe 5000 3vppp.exe 4896 1rrfxfx.exe -
resource yara_rule behavioral2/memory/1396-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3444-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-293-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1396 wrote to memory of 4196 1396 03e0db243fa680ddfe34ed8b34b4b700_NEIKI.exe 79 PID 1396 wrote to memory of 4196 1396 03e0db243fa680ddfe34ed8b34b4b700_NEIKI.exe 79 PID 1396 wrote to memory of 4196 1396 03e0db243fa680ddfe34ed8b34b4b700_NEIKI.exe 79 PID 4196 wrote to memory of 3872 4196 rxfxxfx.exe 80 PID 4196 wrote to memory of 3872 4196 rxfxxfx.exe 80 PID 4196 wrote to memory of 3872 4196 rxfxxfx.exe 80 PID 3872 wrote to memory of 3900 3872 bnnntn.exe 81 PID 3872 wrote to memory of 3900 3872 bnnntn.exe 81 PID 3872 wrote to memory of 3900 3872 bnnntn.exe 81 PID 3900 wrote to memory of 3912 3900 5vppv.exe 83 PID 3900 wrote to memory of 3912 3900 5vppv.exe 83 PID 3900 wrote to memory of 3912 3900 5vppv.exe 83 PID 3912 wrote to memory of 4192 3912 5bnnbh.exe 84 PID 3912 wrote to memory of 4192 3912 5bnnbh.exe 84 PID 3912 wrote to memory of 4192 3912 5bnnbh.exe 84 PID 4192 wrote to memory of 4092 4192 bbbbnn.exe 85 PID 4192 wrote to memory of 4092 4192 bbbbnn.exe 85 PID 4192 wrote to memory of 4092 4192 bbbbnn.exe 85 PID 4092 wrote to memory of 3372 4092 pdjjv.exe 87 PID 4092 wrote to memory of 3372 4092 pdjjv.exe 87 PID 4092 wrote to memory of 3372 4092 pdjjv.exe 87 PID 3372 wrote to memory of 1212 3372 1tbbbb.exe 88 PID 3372 wrote to memory of 1212 3372 1tbbbb.exe 88 PID 3372 wrote to memory of 1212 3372 1tbbbb.exe 88 PID 1212 wrote to memory of 844 1212 jdddv.exe 89 PID 1212 wrote to memory of 844 1212 jdddv.exe 89 PID 1212 wrote to memory of 844 1212 jdddv.exe 89 PID 844 wrote to memory of 3084 844 llffrrx.exe 90 PID 844 wrote to memory of 3084 844 llffrrx.exe 90 PID 844 wrote to memory of 3084 844 llffrrx.exe 90 PID 3084 wrote to memory of 4056 3084 hthhhb.exe 91 PID 3084 wrote to memory of 4056 3084 hthhhb.exe 91 PID 3084 wrote to memory of 4056 3084 hthhhb.exe 91 PID 4056 wrote to memory of 3780 4056 dvvpj.exe 93 PID 4056 wrote to memory of 3780 4056 dvvpj.exe 93 PID 4056 wrote to memory of 3780 4056 dvvpj.exe 93 PID 3780 wrote to memory of 4580 3780 xrxrrll.exe 94 PID 3780 wrote to memory of 4580 3780 xrxrrll.exe 94 PID 3780 wrote to memory of 4580 3780 xrxrrll.exe 94 PID 4580 wrote to memory of 4016 4580 rrlxxrr.exe 95 PID 4580 wrote to memory of 4016 4580 rrlxxrr.exe 95 PID 4580 wrote to memory of 4016 4580 rrlxxrr.exe 95 PID 4016 wrote to memory of 3336 4016 ntthbh.exe 96 PID 4016 wrote to memory of 3336 4016 ntthbh.exe 96 PID 4016 wrote to memory of 3336 4016 ntthbh.exe 96 PID 3336 wrote to memory of 3020 3336 1jjjd.exe 97 PID 3336 wrote to memory of 3020 3336 1jjjd.exe 97 PID 3336 wrote to memory of 3020 3336 1jjjd.exe 97 PID 3020 wrote to memory of 3268 3020 rxlxrlf.exe 98 PID 3020 wrote to memory of 3268 3020 rxlxrlf.exe 98 PID 3020 wrote to memory of 3268 3020 rxlxrlf.exe 98 PID 3268 wrote to memory of 1492 3268 nbhbbb.exe 99 PID 3268 wrote to memory of 1492 3268 nbhbbb.exe 99 PID 3268 wrote to memory of 1492 3268 nbhbbb.exe 99 PID 1492 wrote to memory of 4896 1492 lxrrllf.exe 101 PID 1492 wrote to memory of 4896 1492 lxrrllf.exe 101 PID 1492 wrote to memory of 4896 1492 lxrrllf.exe 101 PID 4896 wrote to memory of 2444 4896 hbtntt.exe 102 PID 4896 wrote to memory of 2444 4896 hbtntt.exe 102 PID 4896 wrote to memory of 2444 4896 hbtntt.exe 102 PID 2444 wrote to memory of 4848 2444 nbbbtn.exe 103 PID 2444 wrote to memory of 4848 2444 nbbbtn.exe 103 PID 2444 wrote to memory of 4848 2444 nbbbtn.exe 103 PID 4848 wrote to memory of 368 4848 dvdvp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\03e0db243fa680ddfe34ed8b34b4b700_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\03e0db243fa680ddfe34ed8b34b4b700_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\rxfxxfx.exec:\rxfxxfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\bnnntn.exec:\bnnntn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\5vppv.exec:\5vppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\5bnnbh.exec:\5bnnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\bbbbnn.exec:\bbbbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\pdjjv.exec:\pdjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\1tbbbb.exec:\1tbbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\jdddv.exec:\jdddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\llffrrx.exec:\llffrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\hthhhb.exec:\hthhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\dvvpj.exec:\dvvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\xrxrrll.exec:\xrxrrll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\rrlxxrr.exec:\rrlxxrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\ntthbh.exec:\ntthbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\1jjjd.exec:\1jjjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\rxlxrlf.exec:\rxlxrlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\nbhbbb.exec:\nbhbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\lxrrllf.exec:\lxrrllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\hbtntt.exec:\hbtntt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\nbbbtn.exec:\nbbbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\dvdvp.exec:\dvdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\5tnnnt.exec:\5tnnnt.exe23⤵
- Executes dropped EXE
PID:368 -
\??\c:\djvvd.exec:\djvvd.exe24⤵
- Executes dropped EXE
PID:1616 -
\??\c:\lfrlfxx.exec:\lfrlfxx.exe25⤵
- Executes dropped EXE
PID:3444 -
\??\c:\xxflfxx.exec:\xxflfxx.exe26⤵
- Executes dropped EXE
PID:3960 -
\??\c:\bbbbtb.exec:\bbbbtb.exe27⤵
- Executes dropped EXE
PID:3880 -
\??\c:\ppjdv.exec:\ppjdv.exe28⤵
- Executes dropped EXE
PID:4632 -
\??\c:\rlfffff.exec:\rlfffff.exe29⤵
- Executes dropped EXE
PID:3468 -
\??\c:\3thnhh.exec:\3thnhh.exe30⤵
- Executes dropped EXE
PID:3052 -
\??\c:\3nhhht.exec:\3nhhht.exe31⤵
- Executes dropped EXE
PID:4444 -
\??\c:\djpjj.exec:\djpjj.exe32⤵
- Executes dropped EXE
PID:380 -
\??\c:\lrxxrrl.exec:\lrxxrrl.exe33⤵
- Executes dropped EXE
PID:2184 -
\??\c:\bnttnb.exec:\bnttnb.exe34⤵
- Executes dropped EXE
PID:2512 -
\??\c:\bthbtt.exec:\bthbtt.exe35⤵
- Executes dropped EXE
PID:3196 -
\??\c:\pjjdp.exec:\pjjdp.exe36⤵
- Executes dropped EXE
PID:4464 -
\??\c:\rlrllrr.exec:\rlrllrr.exe37⤵
- Executes dropped EXE
PID:2196 -
\??\c:\5xffllr.exec:\5xffllr.exe38⤵
- Executes dropped EXE
PID:1076 -
\??\c:\httbbt.exec:\httbbt.exe39⤵
- Executes dropped EXE
PID:1072 -
\??\c:\tthhtt.exec:\tthhtt.exe40⤵
- Executes dropped EXE
PID:3396 -
\??\c:\3dppd.exec:\3dppd.exe41⤵
- Executes dropped EXE
PID:1184 -
\??\c:\xrffllr.exec:\xrffllr.exe42⤵
- Executes dropped EXE
PID:3068 -
\??\c:\frfllxr.exec:\frfllxr.exe43⤵
- Executes dropped EXE
PID:640 -
\??\c:\httnhn.exec:\httnhn.exe44⤵
- Executes dropped EXE
PID:3912 -
\??\c:\pjpvv.exec:\pjpvv.exe45⤵
- Executes dropped EXE
PID:1488 -
\??\c:\7xlllrf.exec:\7xlllrf.exe46⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rrxxlrx.exec:\rrxxlrx.exe47⤵
- Executes dropped EXE
PID:1220 -
\??\c:\hbhhhh.exec:\hbhhhh.exe48⤵
- Executes dropped EXE
PID:3372 -
\??\c:\5vjjj.exec:\5vjjj.exe49⤵
- Executes dropped EXE
PID:1400 -
\??\c:\1lfffll.exec:\1lfffll.exe50⤵
- Executes dropped EXE
PID:4100 -
\??\c:\7xxxrrr.exec:\7xxxrrr.exe51⤵
- Executes dropped EXE
PID:1000 -
\??\c:\nhnnnn.exec:\nhnnnn.exe52⤵
- Executes dropped EXE
PID:3420 -
\??\c:\dvppp.exec:\dvppp.exe53⤵
- Executes dropped EXE
PID:3084 -
\??\c:\lrfxxll.exec:\lrfxxll.exe54⤵
- Executes dropped EXE
PID:4736 -
\??\c:\fxlrrxf.exec:\fxlrrxf.exe55⤵
- Executes dropped EXE
PID:1232 -
\??\c:\jpjdv.exec:\jpjdv.exe56⤵
- Executes dropped EXE
PID:4780 -
\??\c:\xrxrlrr.exec:\xrxrlrr.exe57⤵
- Executes dropped EXE
PID:2724 -
\??\c:\dvpvp.exec:\dvpvp.exe58⤵
- Executes dropped EXE
PID:4724 -
\??\c:\lflxxfr.exec:\lflxxfr.exe59⤵
- Executes dropped EXE
PID:3496 -
\??\c:\rlffxxr.exec:\rlffxxr.exe60⤵
- Executes dropped EXE
PID:1148 -
\??\c:\bnbbtb.exec:\bnbbtb.exe61⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jvjjj.exec:\jvjjj.exe62⤵
- Executes dropped EXE
PID:3268 -
\??\c:\nnhhhh.exec:\nnhhhh.exe63⤵
- Executes dropped EXE
PID:2692 -
\??\c:\3vppp.exec:\3vppp.exe64⤵
- Executes dropped EXE
PID:5000 -
\??\c:\1rrfxfx.exec:\1rrfxfx.exe65⤵
- Executes dropped EXE
PID:4896 -
\??\c:\dpdjj.exec:\dpdjj.exe66⤵PID:1392
-
\??\c:\7hbbbh.exec:\7hbbbh.exe67⤵PID:1504
-
\??\c:\djjjv.exec:\djjjv.exe68⤵PID:4980
-
\??\c:\jpjvp.exec:\jpjvp.exe69⤵PID:3204
-
\??\c:\1xlfffx.exec:\1xlfffx.exe70⤵PID:4360
-
\??\c:\tnttnn.exec:\tnttnn.exe71⤵PID:4028
-
\??\c:\3bhbtt.exec:\3bhbtt.exe72⤵PID:3444
-
\??\c:\pjppp.exec:\pjppp.exe73⤵PID:2360
-
\??\c:\xllfflf.exec:\xllfflf.exe74⤵PID:3960
-
\??\c:\hhbtnn.exec:\hhbtnn.exe75⤵PID:1484
-
\??\c:\jpvdd.exec:\jpvdd.exe76⤵PID:816
-
\??\c:\3dppj.exec:\3dppj.exe77⤵PID:1472
-
\??\c:\rfrrfrr.exec:\rfrrfrr.exe78⤵PID:5008
-
\??\c:\hhtbhb.exec:\hhtbhb.exe79⤵PID:396
-
\??\c:\tbbbth.exec:\tbbbth.exe80⤵PID:3800
-
\??\c:\djppj.exec:\djppj.exe81⤵PID:1656
-
\??\c:\flrlrlf.exec:\flrlrlf.exe82⤵PID:3176
-
\??\c:\ttnhbb.exec:\ttnhbb.exe83⤵PID:3160
-
\??\c:\htbbtt.exec:\htbbtt.exe84⤵PID:4316
-
\??\c:\7dppj.exec:\7dppj.exe85⤵PID:4768
-
\??\c:\xffxxll.exec:\xffxxll.exe86⤵PID:4764
-
\??\c:\9rrxrxl.exec:\9rrxrxl.exe87⤵PID:1396
-
\??\c:\tbttnn.exec:\tbttnn.exe88⤵PID:1380
-
\??\c:\3ddvp.exec:\3ddvp.exe89⤵PID:1984
-
\??\c:\3vvjj.exec:\3vvjj.exe90⤵PID:2632
-
\??\c:\xlrrlxx.exec:\xlrrlxx.exe91⤵PID:4320
-
\??\c:\1htbbh.exec:\1htbbh.exe92⤵PID:696
-
\??\c:\ppvpj.exec:\ppvpj.exe93⤵PID:5052
-
\??\c:\lllrrxf.exec:\lllrrxf.exe94⤵PID:4748
-
\??\c:\lxlrrrr.exec:\lxlrrrr.exe95⤵PID:4776
-
\??\c:\ththtn.exec:\ththtn.exe96⤵PID:2828
-
\??\c:\nnnnnt.exec:\nnnnnt.exe97⤵PID:3576
-
\??\c:\jjjjj.exec:\jjjjj.exe98⤵PID:1776
-
\??\c:\xxllfff.exec:\xxllfff.exe99⤵PID:4460
-
\??\c:\rxfxrxx.exec:\rxfxrxx.exe100⤵PID:1940
-
\??\c:\hnbbbb.exec:\hnbbbb.exe101⤵PID:1212
-
\??\c:\vdvvd.exec:\vdvvd.exe102⤵PID:1040
-
\??\c:\dvpjp.exec:\dvpjp.exe103⤵PID:3784
-
\??\c:\3flfffx.exec:\3flfffx.exe104⤵PID:1696
-
\??\c:\bhnnhh.exec:\bhnnhh.exe105⤵PID:2468
-
\??\c:\tbnnbh.exec:\tbnnbh.exe106⤵PID:4064
-
\??\c:\dvpjp.exec:\dvpjp.exe107⤵PID:1624
-
\??\c:\1pjjd.exec:\1pjjd.exe108⤵PID:3764
-
\??\c:\fxlllll.exec:\fxlllll.exe109⤵PID:2728
-
\??\c:\bbtttn.exec:\bbtttn.exe110⤵PID:1836
-
\??\c:\pjppv.exec:\pjppv.exe111⤵PID:4656
-
\??\c:\rlfxxff.exec:\rlfxxff.exe112⤵PID:4016
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe113⤵PID:4756
-
\??\c:\5ttttt.exec:\5ttttt.exe114⤵PID:2676
-
\??\c:\7dvvp.exec:\7dvvp.exe115⤵PID:2404
-
\??\c:\5frrrfx.exec:\5frrrfx.exe116⤵PID:2228
-
\??\c:\lfrrrxx.exec:\lfrrrxx.exe117⤵PID:916
-
\??\c:\1nnhhh.exec:\1nnhhh.exe118⤵PID:4880
-
\??\c:\hhbtnh.exec:\hhbtnh.exe119⤵PID:2788
-
\??\c:\jdjjj.exec:\jdjjj.exe120⤵PID:4164
-
\??\c:\lxflfff.exec:\lxflfff.exe121⤵PID:4848
-
\??\c:\rrxxllr.exec:\rrxxllr.exe122⤵PID:1972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-