Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 19:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2159b259021c83fd27bbf30c54074750_NEIKI.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
2159b259021c83fd27bbf30c54074750_NEIKI.exe
-
Size
447KB
-
MD5
2159b259021c83fd27bbf30c54074750
-
SHA1
2d94d80a50bb0ed9db2f3a49ee851b27b2dbad62
-
SHA256
8b05b4fa81c06919fb40133cdbe4f65c2062af87814f382a1b0647b697e891cb
-
SHA512
6cd4a3c47b2ee61630283d7f6856073bfb80362cf90d41bdac841381f20c308ad8051599de38a9f6fe8ddf56e81b36c55dc3c5313018c2ab81feca67133b87fc
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq78yoyfx93sEqkeGLk:n3C9yMo+S0L9xRnoq7H9xqYLk
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/1724-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1596-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3832-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2240-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4128-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1596 ttthhn.exe 4320 xllxfrl.exe 1748 9hnhnn.exe 368 vvjjj.exe 1212 rlrflrx.exe 4808 rxxrllf.exe 2280 jpddv.exe 3488 ffxxfll.exe 3832 bbbnnn.exe 1556 pdvdv.exe 1916 xfllrxr.exe 3276 hbbbtt.exe 1492 bnbnbt.exe 5100 bnbttn.exe 3412 hbhhnn.exe 4176 vvpjd.exe 4388 ffffxrl.exe 4472 fxrlrrx.exe 4860 rxxrlfx.exe 1196 jvvpj.exe 744 ddvpp.exe 1348 bnbbnt.exe 4220 pdvvv.exe 1924 vdpjp.exe 4168 xxllfff.exe 2892 vvvjv.exe 2240 pvvdd.exe 4412 vpvpd.exe 4604 5hnhtt.exe 4964 ddpjv.exe 4128 vvpjj.exe 3780 bbtttb.exe 1928 3rrlffx.exe 4516 thnhbt.exe 1320 7vvpd.exe 4588 frffflf.exe 1652 1nnhtt.exe 2928 dpvpp.exe 4432 fflxfff.exe 1648 ffxxfff.exe 4796 nbbhtn.exe 2396 xxlxfrr.exe 532 rfllllf.exe 3792 tnnnhn.exe 4592 pvpdv.exe 3408 fxrffxr.exe 3744 tttnnh.exe 1208 vjppp.exe 4260 vpvpj.exe 2280 rlllflf.exe 2512 5hbthb.exe 2640 pvvvp.exe 3832 llflxll.exe 2800 ttbnhh.exe 3476 nhnnhn.exe 1584 5ppjv.exe 3756 bbbnbt.exe 3056 tthhbt.exe 4912 9ttnnn.exe 2740 pppdd.exe 2704 jjvvp.exe 1340 rxxrrrl.exe 4728 3jjdj.exe 3196 vpvdv.exe -
resource yara_rule behavioral2/memory/1724-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1596-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3832-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3832-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2240-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4128-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1596 1724 2159b259021c83fd27bbf30c54074750_NEIKI.exe 80 PID 1724 wrote to memory of 1596 1724 2159b259021c83fd27bbf30c54074750_NEIKI.exe 80 PID 1724 wrote to memory of 1596 1724 2159b259021c83fd27bbf30c54074750_NEIKI.exe 80 PID 1596 wrote to memory of 4320 1596 ttthhn.exe 81 PID 1596 wrote to memory of 4320 1596 ttthhn.exe 81 PID 1596 wrote to memory of 4320 1596 ttthhn.exe 81 PID 4320 wrote to memory of 1748 4320 xllxfrl.exe 83 PID 4320 wrote to memory of 1748 4320 xllxfrl.exe 83 PID 4320 wrote to memory of 1748 4320 xllxfrl.exe 83 PID 1748 wrote to memory of 368 1748 9hnhnn.exe 85 PID 1748 wrote to memory of 368 1748 9hnhnn.exe 85 PID 1748 wrote to memory of 368 1748 9hnhnn.exe 85 PID 368 wrote to memory of 1212 368 vvjjj.exe 86 PID 368 wrote to memory of 1212 368 vvjjj.exe 86 PID 368 wrote to memory of 1212 368 vvjjj.exe 86 PID 1212 wrote to memory of 4808 1212 rlrflrx.exe 87 PID 1212 wrote to memory of 4808 1212 rlrflrx.exe 87 PID 1212 wrote to memory of 4808 1212 rlrflrx.exe 87 PID 4808 wrote to memory of 2280 4808 rxxrllf.exe 88 PID 4808 wrote to memory of 2280 4808 rxxrllf.exe 88 PID 4808 wrote to memory of 2280 4808 rxxrllf.exe 88 PID 2280 wrote to memory of 3488 2280 jpddv.exe 89 PID 2280 wrote to memory of 3488 2280 jpddv.exe 89 PID 2280 wrote to memory of 3488 2280 jpddv.exe 89 PID 3488 wrote to memory of 3832 3488 ffxxfll.exe 90 PID 3488 wrote to memory of 3832 3488 ffxxfll.exe 90 PID 3488 wrote to memory of 3832 3488 ffxxfll.exe 90 PID 3832 wrote to memory of 1556 3832 bbbnnn.exe 91 PID 3832 wrote to memory of 1556 3832 bbbnnn.exe 91 PID 3832 wrote to memory of 1556 3832 bbbnnn.exe 91 PID 1556 wrote to memory of 1916 1556 pdvdv.exe 92 PID 1556 wrote to memory of 1916 1556 pdvdv.exe 92 PID 1556 wrote to memory of 1916 1556 pdvdv.exe 92 PID 1916 wrote to memory of 3276 1916 xfllrxr.exe 93 PID 1916 wrote to memory of 3276 1916 xfllrxr.exe 93 PID 1916 wrote to memory of 3276 1916 xfllrxr.exe 93 PID 3276 wrote to memory of 1492 3276 hbbbtt.exe 95 PID 3276 wrote to memory of 1492 3276 hbbbtt.exe 95 PID 3276 wrote to memory of 1492 3276 hbbbtt.exe 95 PID 1492 wrote to memory of 5100 1492 bnbnbt.exe 96 PID 1492 wrote to memory of 5100 1492 bnbnbt.exe 96 PID 1492 wrote to memory of 5100 1492 bnbnbt.exe 96 PID 5100 wrote to memory of 3412 5100 bnbttn.exe 97 PID 5100 wrote to memory of 3412 5100 bnbttn.exe 97 PID 5100 wrote to memory of 3412 5100 bnbttn.exe 97 PID 3412 wrote to memory of 4176 3412 hbhhnn.exe 98 PID 3412 wrote to memory of 4176 3412 hbhhnn.exe 98 PID 3412 wrote to memory of 4176 3412 hbhhnn.exe 98 PID 4176 wrote to memory of 4388 4176 vvpjd.exe 99 PID 4176 wrote to memory of 4388 4176 vvpjd.exe 99 PID 4176 wrote to memory of 4388 4176 vvpjd.exe 99 PID 4388 wrote to memory of 4472 4388 ffffxrl.exe 100 PID 4388 wrote to memory of 4472 4388 ffffxrl.exe 100 PID 4388 wrote to memory of 4472 4388 ffffxrl.exe 100 PID 4472 wrote to memory of 4860 4472 fxrlrrx.exe 101 PID 4472 wrote to memory of 4860 4472 fxrlrrx.exe 101 PID 4472 wrote to memory of 4860 4472 fxrlrrx.exe 101 PID 4860 wrote to memory of 1196 4860 rxxrlfx.exe 102 PID 4860 wrote to memory of 1196 4860 rxxrlfx.exe 102 PID 4860 wrote to memory of 1196 4860 rxxrlfx.exe 102 PID 1196 wrote to memory of 744 1196 jvvpj.exe 103 PID 1196 wrote to memory of 744 1196 jvvpj.exe 103 PID 1196 wrote to memory of 744 1196 jvvpj.exe 103 PID 744 wrote to memory of 1348 744 ddvpp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2159b259021c83fd27bbf30c54074750_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\2159b259021c83fd27bbf30c54074750_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\ttthhn.exec:\ttthhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\xllxfrl.exec:\xllxfrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\9hnhnn.exec:\9hnhnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\vvjjj.exec:\vvjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\rlrflrx.exec:\rlrflrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\rxxrllf.exec:\rxxrllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\jpddv.exec:\jpddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\ffxxfll.exec:\ffxxfll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\bbbnnn.exec:\bbbnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\pdvdv.exec:\pdvdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\xfllrxr.exec:\xfllrxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\hbbbtt.exec:\hbbbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\bnbnbt.exec:\bnbnbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\bnbttn.exec:\bnbttn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\hbhhnn.exec:\hbhhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\vvpjd.exec:\vvpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\ffffxrl.exec:\ffffxrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\fxrlrrx.exec:\fxrlrrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\rxxrlfx.exec:\rxxrlfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\jvvpj.exec:\jvvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\ddvpp.exec:\ddvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\bnbbnt.exec:\bnbbnt.exe23⤵
- Executes dropped EXE
PID:1348 -
\??\c:\pdvvv.exec:\pdvvv.exe24⤵
- Executes dropped EXE
PID:4220 -
\??\c:\vdpjp.exec:\vdpjp.exe25⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xxllfff.exec:\xxllfff.exe26⤵
- Executes dropped EXE
PID:4168 -
\??\c:\vvvjv.exec:\vvvjv.exe27⤵
- Executes dropped EXE
PID:2892 -
\??\c:\pvvdd.exec:\pvvdd.exe28⤵
- Executes dropped EXE
PID:2240 -
\??\c:\vpvpd.exec:\vpvpd.exe29⤵
- Executes dropped EXE
PID:4412 -
\??\c:\5hnhtt.exec:\5hnhtt.exe30⤵
- Executes dropped EXE
PID:4604 -
\??\c:\ddpjv.exec:\ddpjv.exe31⤵
- Executes dropped EXE
PID:4964 -
\??\c:\vvpjj.exec:\vvpjj.exe32⤵
- Executes dropped EXE
PID:4128 -
\??\c:\bbtttb.exec:\bbtttb.exe33⤵
- Executes dropped EXE
PID:3780 -
\??\c:\3rrlffx.exec:\3rrlffx.exe34⤵
- Executes dropped EXE
PID:1928 -
\??\c:\thnhbt.exec:\thnhbt.exe35⤵
- Executes dropped EXE
PID:4516 -
\??\c:\7vvpd.exec:\7vvpd.exe36⤵
- Executes dropped EXE
PID:1320 -
\??\c:\frffflf.exec:\frffflf.exe37⤵
- Executes dropped EXE
PID:4588 -
\??\c:\1nnhtt.exec:\1nnhtt.exe38⤵
- Executes dropped EXE
PID:1652 -
\??\c:\dpvpp.exec:\dpvpp.exe39⤵
- Executes dropped EXE
PID:2928 -
\??\c:\fflxfff.exec:\fflxfff.exe40⤵
- Executes dropped EXE
PID:4432 -
\??\c:\ffxxfff.exec:\ffxxfff.exe41⤵
- Executes dropped EXE
PID:1648 -
\??\c:\nbbhtn.exec:\nbbhtn.exe42⤵
- Executes dropped EXE
PID:4796 -
\??\c:\xxlxfrr.exec:\xxlxfrr.exe43⤵
- Executes dropped EXE
PID:2396 -
\??\c:\rfllllf.exec:\rfllllf.exe44⤵
- Executes dropped EXE
PID:532 -
\??\c:\tnnnhn.exec:\tnnnhn.exe45⤵
- Executes dropped EXE
PID:3792 -
\??\c:\pvpdv.exec:\pvpdv.exe46⤵
- Executes dropped EXE
PID:4592 -
\??\c:\fxrffxr.exec:\fxrffxr.exe47⤵
- Executes dropped EXE
PID:3408 -
\??\c:\tttnnh.exec:\tttnnh.exe48⤵
- Executes dropped EXE
PID:3744 -
\??\c:\vjppp.exec:\vjppp.exe49⤵
- Executes dropped EXE
PID:1208 -
\??\c:\vpvpj.exec:\vpvpj.exe50⤵
- Executes dropped EXE
PID:4260 -
\??\c:\rlllflf.exec:\rlllflf.exe51⤵
- Executes dropped EXE
PID:2280 -
\??\c:\5hbthb.exec:\5hbthb.exe52⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pvvvp.exec:\pvvvp.exe53⤵
- Executes dropped EXE
PID:2640 -
\??\c:\llflxll.exec:\llflxll.exe54⤵
- Executes dropped EXE
PID:3832 -
\??\c:\ttbnhh.exec:\ttbnhh.exe55⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nhnnhn.exec:\nhnnhn.exe56⤵
- Executes dropped EXE
PID:3476 -
\??\c:\5ppjv.exec:\5ppjv.exe57⤵
- Executes dropped EXE
PID:1584 -
\??\c:\bbbnbt.exec:\bbbnbt.exe58⤵
- Executes dropped EXE
PID:3756 -
\??\c:\tthhbt.exec:\tthhbt.exe59⤵
- Executes dropped EXE
PID:3056 -
\??\c:\9ttnnn.exec:\9ttnnn.exe60⤵
- Executes dropped EXE
PID:4912 -
\??\c:\pppdd.exec:\pppdd.exe61⤵
- Executes dropped EXE
PID:2740 -
\??\c:\jjvvp.exec:\jjvvp.exe62⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rxxrrrl.exec:\rxxrrrl.exe63⤵
- Executes dropped EXE
PID:1340 -
\??\c:\3jjdj.exec:\3jjdj.exe64⤵
- Executes dropped EXE
PID:4728 -
\??\c:\vpvdv.exec:\vpvdv.exe65⤵
- Executes dropped EXE
PID:3196 -
\??\c:\xflfxxx.exec:\xflfxxx.exe66⤵PID:3428
-
\??\c:\1tnbtt.exec:\1tnbtt.exe67⤵PID:1196
-
\??\c:\dvpvp.exec:\dvpvp.exe68⤵PID:2876
-
\??\c:\lfrlrxf.exec:\lfrlrxf.exe69⤵PID:3012
-
\??\c:\nhhbbb.exec:\nhhbbb.exe70⤵PID:1956
-
\??\c:\bhnntt.exec:\bhnntt.exe71⤵PID:1308
-
\??\c:\djpjd.exec:\djpjd.exe72⤵PID:1740
-
\??\c:\pjjjd.exec:\pjjjd.exe73⤵PID:2892
-
\??\c:\lfrrxrf.exec:\lfrrxrf.exe74⤵PID:2240
-
\??\c:\hthbtt.exec:\hthbtt.exe75⤵PID:4740
-
\??\c:\bntnhh.exec:\bntnhh.exe76⤵PID:4884
-
\??\c:\dvddd.exec:\dvddd.exe77⤵PID:3216
-
\??\c:\7rrllff.exec:\7rrllff.exe78⤵PID:3748
-
\??\c:\ttbbth.exec:\ttbbth.exe79⤵PID:4944
-
\??\c:\tbnhhh.exec:\tbnhhh.exe80⤵PID:5008
-
\??\c:\pdppj.exec:\pdppj.exe81⤵PID:960
-
\??\c:\xlffxxx.exec:\xlffxxx.exe82⤵PID:1912
-
\??\c:\xlflfxl.exec:\xlflfxl.exe83⤵PID:1780
-
\??\c:\bnbntt.exec:\bnbntt.exe84⤵PID:4788
-
\??\c:\jddvd.exec:\jddvd.exe85⤵PID:5068
-
\??\c:\fflxxxl.exec:\fflxxxl.exe86⤵PID:4444
-
\??\c:\bhnhhb.exec:\bhnhhb.exe87⤵PID:592
-
\??\c:\nhtnhh.exec:\nhtnhh.exe88⤵PID:1736
-
\??\c:\ppvdd.exec:\ppvdd.exe89⤵PID:3608
-
\??\c:\5lrlfxx.exec:\5lrlfxx.exe90⤵PID:1576
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe91⤵PID:2736
-
\??\c:\nbnttt.exec:\nbnttt.exe92⤵PID:1592
-
\??\c:\djpjv.exec:\djpjv.exe93⤵PID:1184
-
\??\c:\flrrllx.exec:\flrrllx.exe94⤵PID:4100
-
\??\c:\ffxxfff.exec:\ffxxfff.exe95⤵PID:456
-
\??\c:\1htttb.exec:\1htttb.exe96⤵PID:3136
-
\??\c:\vdpjj.exec:\vdpjj.exe97⤵PID:660
-
\??\c:\7dvjd.exec:\7dvjd.exe98⤵PID:4132
-
\??\c:\fxffffx.exec:\fxffffx.exe99⤵PID:3032
-
\??\c:\nntttb.exec:\nntttb.exe100⤵PID:2912
-
\??\c:\thhnht.exec:\thhnht.exe101⤵PID:648
-
\??\c:\pdddv.exec:\pdddv.exe102⤵PID:2584
-
\??\c:\lflllxr.exec:\lflllxr.exe103⤵PID:2980
-
\??\c:\flrlffx.exec:\flrlffx.exe104⤵PID:4584
-
\??\c:\nbbnht.exec:\nbbnht.exe105⤵PID:1980
-
\??\c:\pjpjp.exec:\pjpjp.exe106⤵PID:2100
-
\??\c:\vdjdp.exec:\vdjdp.exe107⤵PID:2716
-
\??\c:\xflxxxx.exec:\xflxxxx.exe108⤵PID:4664
-
\??\c:\7hnhhn.exec:\7hnhhn.exe109⤵PID:4460
-
\??\c:\7nhnnb.exec:\7nhnnb.exe110⤵PID:2740
-
\??\c:\vjpjp.exec:\vjpjp.exe111⤵PID:2704
-
\??\c:\ffxfffl.exec:\ffxfffl.exe112⤵PID:3764
-
\??\c:\nntttt.exec:\nntttt.exe113⤵PID:2420
-
\??\c:\vdjdv.exec:\vdjdv.exe114⤵PID:3204
-
\??\c:\pvjdd.exec:\pvjdd.exe115⤵PID:4436
-
\??\c:\ffffxff.exec:\ffffxff.exe116⤵PID:3196
-
\??\c:\hhhbhh.exec:\hhhbhh.exe117⤵PID:5044
-
\??\c:\pvdvp.exec:\pvdvp.exe118⤵PID:3112
-
\??\c:\fxllfff.exec:\fxllfff.exe119⤵PID:1656
-
\??\c:\lflfxxx.exec:\lflfxxx.exe120⤵PID:3040
-
\??\c:\htttnb.exec:\htttnb.exe121⤵PID:1484
-
\??\c:\vvpjd.exec:\vvpjd.exe122⤵PID:3312
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-