Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 23:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
32015f5029c47f220b4ed9fdc679c7f0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
32015f5029c47f220b4ed9fdc679c7f0_NeikiAnalytics.exe
-
Size
63KB
-
MD5
32015f5029c47f220b4ed9fdc679c7f0
-
SHA1
df7e79db52df49bb4e340a99b43c608d19d734b7
-
SHA256
d53a130d50eb7678d0935e237e5a88eb1c9696c475134418ca9ea3e04a32138e
-
SHA512
560af17b0ef089c75779a9432ae3bdb5ec84e4b807f62774d0e0c8f3565489a0e340090dccfe0b3ab2af70180bb0a22003abaeb572f4561f8cc687a8b977cae4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIhJm/w/:ymb3NkkiQ3mdBjFILm2
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4516-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2868-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1392-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4268 lrflrrf.exe 2868 jdppp.exe 4748 ffxxrrr.exe 4632 rlfxxxr.exe 3244 thhnbb.exe 1464 jvvvv.exe 1456 fxlxlxr.exe 2516 tbnhbb.exe 2248 pjpjd.exe 4304 rfffxfx.exe 904 btbnth.exe 5068 nnbtnn.exe 3020 3jjdv.exe 1392 lfffffl.exe 4500 nntttb.exe 1776 dpjdv.exe 3936 xrrlfff.exe 1756 7rxllll.exe 2964 tbbnbh.exe 1460 1ddpp.exe 3556 ffxrrrf.exe 3284 dvdpj.exe 3992 vvjdv.exe 736 lxxxrxr.exe 1624 ttttnt.exe 4112 pdppp.exe 2212 jjppp.exe 2956 xxrllll.exe 5092 nnnnnn.exe 3852 ttbbtb.exe 3572 pjppp.exe 2456 rllllrx.exe 4028 hbbttn.exe 4052 bttnnn.exe 4380 jvvvv.exe 4452 ppddd.exe 2364 xrxrllx.exe 4612 hhhtnn.exe 4080 thbhhn.exe 4016 pdjjj.exe 4440 jjpdj.exe 2988 xxxxxlr.exe 2772 rrrlfff.exe 732 7ttnnt.exe 4544 ddjdd.exe 1576 fflrxfl.exe 4748 lfrxxxx.exe 4060 hbttbb.exe 2860 dddjd.exe 3496 vpdjp.exe 2008 xlllrrf.exe 4504 tbnbth.exe 3328 hntbnt.exe 4404 vjvdd.exe 2652 rlxxffl.exe 2228 nntbnb.exe 5060 jpddp.exe 3932 9ffxrrl.exe 1140 bnthnh.exe 1392 dddvv.exe 3088 xllfxrf.exe 1776 flffllf.exe 3936 hthhhh.exe 4912 jjpjj.exe -
resource yara_rule behavioral2/memory/4516-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2868-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4516 wrote to memory of 4268 4516 32015f5029c47f220b4ed9fdc679c7f0_NeikiAnalytics.exe 82 PID 4516 wrote to memory of 4268 4516 32015f5029c47f220b4ed9fdc679c7f0_NeikiAnalytics.exe 82 PID 4516 wrote to memory of 4268 4516 32015f5029c47f220b4ed9fdc679c7f0_NeikiAnalytics.exe 82 PID 4268 wrote to memory of 2868 4268 lrflrrf.exe 83 PID 4268 wrote to memory of 2868 4268 lrflrrf.exe 83 PID 4268 wrote to memory of 2868 4268 lrflrrf.exe 83 PID 2868 wrote to memory of 4748 2868 jdppp.exe 84 PID 2868 wrote to memory of 4748 2868 jdppp.exe 84 PID 2868 wrote to memory of 4748 2868 jdppp.exe 84 PID 4748 wrote to memory of 4632 4748 ffxxrrr.exe 85 PID 4748 wrote to memory of 4632 4748 ffxxrrr.exe 85 PID 4748 wrote to memory of 4632 4748 ffxxrrr.exe 85 PID 4632 wrote to memory of 3244 4632 rlfxxxr.exe 86 PID 4632 wrote to memory of 3244 4632 rlfxxxr.exe 86 PID 4632 wrote to memory of 3244 4632 rlfxxxr.exe 86 PID 3244 wrote to memory of 1464 3244 thhnbb.exe 87 PID 3244 wrote to memory of 1464 3244 thhnbb.exe 87 PID 3244 wrote to memory of 1464 3244 thhnbb.exe 87 PID 1464 wrote to memory of 1456 1464 jvvvv.exe 88 PID 1464 wrote to memory of 1456 1464 jvvvv.exe 88 PID 1464 wrote to memory of 1456 1464 jvvvv.exe 88 PID 1456 wrote to memory of 2516 1456 fxlxlxr.exe 89 PID 1456 wrote to memory of 2516 1456 fxlxlxr.exe 89 PID 1456 wrote to memory of 2516 1456 fxlxlxr.exe 89 PID 2516 wrote to memory of 2248 2516 tbnhbb.exe 91 PID 2516 wrote to memory of 2248 2516 tbnhbb.exe 91 PID 2516 wrote to memory of 2248 2516 tbnhbb.exe 91 PID 2248 wrote to memory of 4304 2248 pjpjd.exe 92 PID 2248 wrote to memory of 4304 2248 pjpjd.exe 92 PID 2248 wrote to memory of 4304 2248 pjpjd.exe 92 PID 4304 wrote to memory of 904 4304 rfffxfx.exe 93 PID 4304 wrote to memory of 904 4304 rfffxfx.exe 93 PID 4304 wrote to memory of 904 4304 rfffxfx.exe 93 PID 904 wrote to memory of 5068 904 btbnth.exe 94 PID 904 wrote to memory of 5068 904 btbnth.exe 94 PID 904 wrote to memory of 5068 904 btbnth.exe 94 PID 5068 wrote to memory of 3020 5068 nnbtnn.exe 95 PID 5068 wrote to memory of 3020 5068 nnbtnn.exe 95 PID 5068 wrote to memory of 3020 5068 nnbtnn.exe 95 PID 3020 wrote to memory of 1392 3020 3jjdv.exe 96 PID 3020 wrote to memory of 1392 3020 3jjdv.exe 96 PID 3020 wrote to memory of 1392 3020 3jjdv.exe 96 PID 1392 wrote to memory of 4500 1392 lfffffl.exe 97 PID 1392 wrote to memory of 4500 1392 lfffffl.exe 97 PID 1392 wrote to memory of 4500 1392 lfffffl.exe 97 PID 4500 wrote to memory of 1776 4500 nntttb.exe 98 PID 4500 wrote to memory of 1776 4500 nntttb.exe 98 PID 4500 wrote to memory of 1776 4500 nntttb.exe 98 PID 1776 wrote to memory of 3936 1776 dpjdv.exe 100 PID 1776 wrote to memory of 3936 1776 dpjdv.exe 100 PID 1776 wrote to memory of 3936 1776 dpjdv.exe 100 PID 3936 wrote to memory of 1756 3936 xrrlfff.exe 101 PID 3936 wrote to memory of 1756 3936 xrrlfff.exe 101 PID 3936 wrote to memory of 1756 3936 xrrlfff.exe 101 PID 1756 wrote to memory of 2964 1756 7rxllll.exe 102 PID 1756 wrote to memory of 2964 1756 7rxllll.exe 102 PID 1756 wrote to memory of 2964 1756 7rxllll.exe 102 PID 2964 wrote to memory of 1460 2964 tbbnbh.exe 103 PID 2964 wrote to memory of 1460 2964 tbbnbh.exe 103 PID 2964 wrote to memory of 1460 2964 tbbnbh.exe 103 PID 1460 wrote to memory of 3556 1460 1ddpp.exe 104 PID 1460 wrote to memory of 3556 1460 1ddpp.exe 104 PID 1460 wrote to memory of 3556 1460 1ddpp.exe 104 PID 3556 wrote to memory of 3284 3556 ffxrrrf.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\32015f5029c47f220b4ed9fdc679c7f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\32015f5029c47f220b4ed9fdc679c7f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\lrflrrf.exec:\lrflrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\jdppp.exec:\jdppp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\ffxxrrr.exec:\ffxxrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\rlfxxxr.exec:\rlfxxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\thhnbb.exec:\thhnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\jvvvv.exec:\jvvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\fxlxlxr.exec:\fxlxlxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\tbnhbb.exec:\tbnhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\pjpjd.exec:\pjpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\rfffxfx.exec:\rfffxfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\btbnth.exec:\btbnth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
\??\c:\nnbtnn.exec:\nnbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\3jjdv.exec:\3jjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\lfffffl.exec:\lfffffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\nntttb.exec:\nntttb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\dpjdv.exec:\dpjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\xrrlfff.exec:\xrrlfff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\7rxllll.exec:\7rxllll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\tbbnbh.exec:\tbbnbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\1ddpp.exec:\1ddpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\ffxrrrf.exec:\ffxrrrf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\dvdpj.exec:\dvdpj.exe23⤵
- Executes dropped EXE
PID:3284 -
\??\c:\vvjdv.exec:\vvjdv.exe24⤵
- Executes dropped EXE
PID:3992 -
\??\c:\lxxxrxr.exec:\lxxxrxr.exe25⤵
- Executes dropped EXE
PID:736 -
\??\c:\ttttnt.exec:\ttttnt.exe26⤵
- Executes dropped EXE
PID:1624 -
\??\c:\pdppp.exec:\pdppp.exe27⤵
- Executes dropped EXE
PID:4112 -
\??\c:\jjppp.exec:\jjppp.exe28⤵
- Executes dropped EXE
PID:2212 -
\??\c:\xxrllll.exec:\xxrllll.exe29⤵
- Executes dropped EXE
PID:2956 -
\??\c:\nnnnnn.exec:\nnnnnn.exe30⤵
- Executes dropped EXE
PID:5092 -
\??\c:\ttbbtb.exec:\ttbbtb.exe31⤵
- Executes dropped EXE
PID:3852 -
\??\c:\pjppp.exec:\pjppp.exe32⤵
- Executes dropped EXE
PID:3572 -
\??\c:\rllllrx.exec:\rllllrx.exe33⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hbbttn.exec:\hbbttn.exe34⤵
- Executes dropped EXE
PID:4028 -
\??\c:\bttnnn.exec:\bttnnn.exe35⤵
- Executes dropped EXE
PID:4052 -
\??\c:\jvvvv.exec:\jvvvv.exe36⤵
- Executes dropped EXE
PID:4380 -
\??\c:\ppddd.exec:\ppddd.exe37⤵
- Executes dropped EXE
PID:4452 -
\??\c:\xrxrllx.exec:\xrxrllx.exe38⤵
- Executes dropped EXE
PID:2364 -
\??\c:\hhhtnn.exec:\hhhtnn.exe39⤵
- Executes dropped EXE
PID:4612 -
\??\c:\thbhhn.exec:\thbhhn.exe40⤵
- Executes dropped EXE
PID:4080 -
\??\c:\pdjjj.exec:\pdjjj.exe41⤵
- Executes dropped EXE
PID:4016 -
\??\c:\jjpdj.exec:\jjpdj.exe42⤵
- Executes dropped EXE
PID:4440 -
\??\c:\xxxxxlr.exec:\xxxxxlr.exe43⤵
- Executes dropped EXE
PID:2988 -
\??\c:\rrrlfff.exec:\rrrlfff.exe44⤵
- Executes dropped EXE
PID:2772 -
\??\c:\7ttnnt.exec:\7ttnnt.exe45⤵
- Executes dropped EXE
PID:732 -
\??\c:\ddjdd.exec:\ddjdd.exe46⤵
- Executes dropped EXE
PID:4544 -
\??\c:\fflrxfl.exec:\fflrxfl.exe47⤵
- Executes dropped EXE
PID:1576 -
\??\c:\lfrxxxx.exec:\lfrxxxx.exe48⤵
- Executes dropped EXE
PID:4748 -
\??\c:\hbttbb.exec:\hbttbb.exe49⤵
- Executes dropped EXE
PID:4060 -
\??\c:\dddjd.exec:\dddjd.exe50⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vpdjp.exec:\vpdjp.exe51⤵
- Executes dropped EXE
PID:3496 -
\??\c:\xlllrrf.exec:\xlllrrf.exe52⤵
- Executes dropped EXE
PID:2008 -
\??\c:\tbnbth.exec:\tbnbth.exe53⤵
- Executes dropped EXE
PID:4504 -
\??\c:\hntbnt.exec:\hntbnt.exe54⤵
- Executes dropped EXE
PID:3328 -
\??\c:\vjvdd.exec:\vjvdd.exe55⤵
- Executes dropped EXE
PID:4404 -
\??\c:\rlxxffl.exec:\rlxxffl.exe56⤵
- Executes dropped EXE
PID:2652 -
\??\c:\nntbnb.exec:\nntbnb.exe57⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jpddp.exec:\jpddp.exe58⤵
- Executes dropped EXE
PID:5060 -
\??\c:\9ffxrrl.exec:\9ffxrrl.exe59⤵
- Executes dropped EXE
PID:3932 -
\??\c:\bnthnh.exec:\bnthnh.exe60⤵
- Executes dropped EXE
PID:1140 -
\??\c:\dddvv.exec:\dddvv.exe61⤵
- Executes dropped EXE
PID:1392 -
\??\c:\xllfxrf.exec:\xllfxrf.exe62⤵
- Executes dropped EXE
PID:3088 -
\??\c:\flffllf.exec:\flffllf.exe63⤵
- Executes dropped EXE
PID:1776 -
\??\c:\hthhhh.exec:\hthhhh.exe64⤵
- Executes dropped EXE
PID:3936 -
\??\c:\jjpjj.exec:\jjpjj.exe65⤵
- Executes dropped EXE
PID:4912 -
\??\c:\3ffxxxx.exec:\3ffxxxx.exe66⤵PID:2808
-
\??\c:\lfrffxr.exec:\lfrffxr.exe67⤵PID:3676
-
\??\c:\jjvpv.exec:\jjvpv.exe68⤵PID:5004
-
\??\c:\rllfxxr.exec:\rllfxxr.exe69⤵PID:3980
-
\??\c:\nhtntt.exec:\nhtntt.exe70⤵PID:3856
-
\??\c:\jvjdv.exec:\jvjdv.exe71⤵PID:4892
-
\??\c:\lrfxxxr.exec:\lrfxxxr.exe72⤵PID:1360
-
\??\c:\nnnhhh.exec:\nnnhhh.exe73⤵PID:2500
-
\??\c:\jddjj.exec:\jddjj.exe74⤵PID:716
-
\??\c:\jvjjj.exec:\jvjjj.exe75⤵PID:4352
-
\??\c:\llxrxxx.exec:\llxrxxx.exe76⤵PID:764
-
\??\c:\bbbnnn.exec:\bbbnnn.exe77⤵PID:2212
-
\??\c:\hbbtnn.exec:\hbbtnn.exe78⤵PID:4240
-
\??\c:\jjjjd.exec:\jjjjd.exe79⤵PID:1280
-
\??\c:\ppjjd.exec:\ppjjd.exe80⤵PID:5092
-
\??\c:\frxrlrr.exec:\frxrlrr.exe81⤵PID:5020
-
\??\c:\hbnnhn.exec:\hbnnhn.exe82⤵PID:1368
-
\??\c:\pvpjj.exec:\pvpjj.exe83⤵PID:1436
-
\??\c:\dvdvp.exec:\dvdvp.exe84⤵PID:4340
-
\??\c:\lxlffff.exec:\lxlffff.exe85⤵PID:4312
-
\??\c:\lflrlll.exec:\lflrlll.exe86⤵PID:4508
-
\??\c:\nhhhhh.exec:\nhhhhh.exe87⤵PID:528
-
\??\c:\5hbbhn.exec:\5hbbhn.exe88⤵PID:1780
-
\??\c:\pjpjp.exec:\pjpjp.exe89⤵PID:2308
-
\??\c:\rlxffrr.exec:\rlxffrr.exe90⤵PID:4584
-
\??\c:\btbbbb.exec:\btbbbb.exe91⤵PID:4388
-
\??\c:\tnbbbt.exec:\tnbbbt.exe92⤵PID:2552
-
\??\c:\jdvvv.exec:\jdvvv.exe93⤵PID:4268
-
\??\c:\pvdvj.exec:\pvdvj.exe94⤵PID:2424
-
\??\c:\rllfxxx.exec:\rllfxxx.exe95⤵PID:3468
-
\??\c:\nnbhnb.exec:\nnbhnb.exe96⤵PID:3804
-
\??\c:\hbhhbb.exec:\hbhhbb.exe97⤵PID:820
-
\??\c:\pjjjv.exec:\pjjjv.exe98⤵PID:4632
-
\??\c:\flrrrrr.exec:\flrrrrr.exe99⤵PID:1880
-
\??\c:\bhtnhh.exec:\bhtnhh.exe100⤵PID:3028
-
\??\c:\hhntnt.exec:\hhntnt.exe101⤵PID:4472
-
\??\c:\jvjjj.exec:\jvjjj.exe102⤵PID:1900
-
\??\c:\jpdjd.exec:\jpdjd.exe103⤵PID:3084
-
\??\c:\lfllffl.exec:\lfllffl.exe104⤵PID:4304
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe105⤵PID:2652
-
\??\c:\btbtbb.exec:\btbtbb.exe106⤵PID:2228
-
\??\c:\vpvjj.exec:\vpvjj.exe107⤵PID:5060
-
\??\c:\jdppp.exec:\jdppp.exe108⤵PID:3932
-
\??\c:\fffxxxx.exec:\fffxxxx.exe109⤵PID:4744
-
\??\c:\xffffff.exec:\xffffff.exe110⤵PID:3004
-
\??\c:\htbtbh.exec:\htbtbh.exe111⤵PID:1356
-
\??\c:\flffffl.exec:\flffffl.exe112⤵PID:4940
-
\??\c:\hbtthb.exec:\hbtthb.exe113⤵PID:2556
-
\??\c:\pdjjj.exec:\pdjjj.exe114⤵PID:2936
-
\??\c:\pppvd.exec:\pppvd.exe115⤵PID:320
-
\??\c:\xfllllr.exec:\xfllllr.exe116⤵PID:592
-
\??\c:\ffxllfl.exec:\ffxllfl.exe117⤵PID:3556
-
\??\c:\ntbnbh.exec:\ntbnbh.exe118⤵PID:2284
-
\??\c:\bbbbnn.exec:\bbbbnn.exe119⤵PID:1548
-
\??\c:\5jddv.exec:\5jddv.exe120⤵PID:1124
-
\??\c:\5lrlflf.exec:\5lrlflf.exe121⤵PID:624
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe122⤵PID:1624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-