Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 14:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b71e2a0a6110584b9c634ea86e5b9d0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
0b71e2a0a6110584b9c634ea86e5b9d0_NeikiAnalytics.exe
-
Size
83KB
-
MD5
0b71e2a0a6110584b9c634ea86e5b9d0
-
SHA1
2d7efa1693c016d3799de886f6b6a6a2d56af258
-
SHA256
a3359f519c180bb0023c79db5a1543990ba80d5759b45ce70d40fec85351d0a9
-
SHA512
851968e66dc2c3fc524e562ecb6e3ac17c5b1bfa99df81ad98a51f634ba5b408c9be9367e1b1d6f21bc55f4715a545c23815c305c85b8aa8956f586daba2cb9b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJSLCBCO+HlMO7s0yOy:ymb3NkkiQ3mdBjFIwLMoHW8y7
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/4944-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2656-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/700-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/412-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2088-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/988-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/884-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/940-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4152 3ddjd.exe 2044 lffxlfx.exe 220 rlfxrlf.exe 116 vpvvj.exe 384 ffllfll.exe 4964 lrlrlll.exe 4900 nbbbhb.exe 2656 pjdvv.exe 548 fflrrxx.exe 700 nhnntt.exe 2120 dvdvp.exe 388 xrxrlff.exe 5088 fxlfxxf.exe 3936 jjpdp.exe 412 pjpjd.exe 4512 ffllrll.exe 2444 1bhhhh.exe 2088 thntbt.exe 3140 xrfllll.exe 2668 5xxxxrr.exe 1168 nnnntt.exe 4744 3hhbtt.exe 3648 vvddd.exe 624 rlrlffx.exe 1948 hnnnnn.exe 4960 tnnhbh.exe 3976 1ddvj.exe 988 lflfxxx.exe 4304 rlllflf.exe 884 nhbhhh.exe 940 bntnhh.exe 2440 ddvjd.exe 3476 fxfrlrl.exe 5008 rlfflrr.exe 1656 ffrrrxx.exe 772 nhbbnt.exe 2376 1vvvv.exe 2948 pjpjj.exe 4388 fxfxrxx.exe 4560 5hhtnn.exe 2656 jdddv.exe 2588 pjjjv.exe 3036 xfxxxfx.exe 456 rfxrlfx.exe 4520 5bnhnt.exe 2232 1hbbbb.exe 3736 djddd.exe 3064 rlrrlxx.exe 4512 bnbbhh.exe 2236 vpddv.exe 4544 3rfxfff.exe 1780 rllrlll.exe 3060 hbbbbn.exe 1592 djjjp.exe 2728 rxfxlrl.exe 1448 xfllffl.exe 4540 htbthh.exe 5004 dpddd.exe 2496 jddvp.exe 4568 fxllxxf.exe 1280 nhttnn.exe 4960 tntttt.exe 3976 ppvvv.exe 4324 rffxrrr.exe -
resource yara_rule behavioral2/memory/4944-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/384-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/700-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/412-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2088-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/940-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4944 wrote to memory of 4152 4944 0b71e2a0a6110584b9c634ea86e5b9d0_NeikiAnalytics.exe 89 PID 4944 wrote to memory of 4152 4944 0b71e2a0a6110584b9c634ea86e5b9d0_NeikiAnalytics.exe 89 PID 4944 wrote to memory of 4152 4944 0b71e2a0a6110584b9c634ea86e5b9d0_NeikiAnalytics.exe 89 PID 4152 wrote to memory of 2044 4152 3ddjd.exe 90 PID 4152 wrote to memory of 2044 4152 3ddjd.exe 90 PID 4152 wrote to memory of 2044 4152 3ddjd.exe 90 PID 2044 wrote to memory of 220 2044 lffxlfx.exe 91 PID 2044 wrote to memory of 220 2044 lffxlfx.exe 91 PID 2044 wrote to memory of 220 2044 lffxlfx.exe 91 PID 220 wrote to memory of 116 220 rlfxrlf.exe 92 PID 220 wrote to memory of 116 220 rlfxrlf.exe 92 PID 220 wrote to memory of 116 220 rlfxrlf.exe 92 PID 116 wrote to memory of 384 116 vpvvj.exe 93 PID 116 wrote to memory of 384 116 vpvvj.exe 93 PID 116 wrote to memory of 384 116 vpvvj.exe 93 PID 384 wrote to memory of 4964 384 ffllfll.exe 94 PID 384 wrote to memory of 4964 384 ffllfll.exe 94 PID 384 wrote to memory of 4964 384 ffllfll.exe 94 PID 4964 wrote to memory of 4900 4964 lrlrlll.exe 95 PID 4964 wrote to memory of 4900 4964 lrlrlll.exe 95 PID 4964 wrote to memory of 4900 4964 lrlrlll.exe 95 PID 4900 wrote to memory of 2656 4900 nbbbhb.exe 96 PID 4900 wrote to memory of 2656 4900 nbbbhb.exe 96 PID 4900 wrote to memory of 2656 4900 nbbbhb.exe 96 PID 2656 wrote to memory of 548 2656 pjdvv.exe 97 PID 2656 wrote to memory of 548 2656 pjdvv.exe 97 PID 2656 wrote to memory of 548 2656 pjdvv.exe 97 PID 548 wrote to memory of 700 548 fflrrxx.exe 98 PID 548 wrote to memory of 700 548 fflrrxx.exe 98 PID 548 wrote to memory of 700 548 fflrrxx.exe 98 PID 700 wrote to memory of 2120 700 nhnntt.exe 100 PID 700 wrote to memory of 2120 700 nhnntt.exe 100 PID 700 wrote to memory of 2120 700 nhnntt.exe 100 PID 2120 wrote to memory of 388 2120 dvdvp.exe 101 PID 2120 wrote to memory of 388 2120 dvdvp.exe 101 PID 2120 wrote to memory of 388 2120 dvdvp.exe 101 PID 388 wrote to memory of 5088 388 xrxrlff.exe 102 PID 388 wrote to memory of 5088 388 xrxrlff.exe 102 PID 388 wrote to memory of 5088 388 xrxrlff.exe 102 PID 5088 wrote to memory of 3936 5088 fxlfxxf.exe 104 PID 5088 wrote to memory of 3936 5088 fxlfxxf.exe 104 PID 5088 wrote to memory of 3936 5088 fxlfxxf.exe 104 PID 3936 wrote to memory of 412 3936 jjpdp.exe 105 PID 3936 wrote to memory of 412 3936 jjpdp.exe 105 PID 3936 wrote to memory of 412 3936 jjpdp.exe 105 PID 412 wrote to memory of 4512 412 pjpjd.exe 106 PID 412 wrote to memory of 4512 412 pjpjd.exe 106 PID 412 wrote to memory of 4512 412 pjpjd.exe 106 PID 4512 wrote to memory of 2444 4512 ffllrll.exe 107 PID 4512 wrote to memory of 2444 4512 ffllrll.exe 107 PID 4512 wrote to memory of 2444 4512 ffllrll.exe 107 PID 2444 wrote to memory of 2088 2444 1bhhhh.exe 108 PID 2444 wrote to memory of 2088 2444 1bhhhh.exe 108 PID 2444 wrote to memory of 2088 2444 1bhhhh.exe 108 PID 2088 wrote to memory of 3140 2088 thntbt.exe 110 PID 2088 wrote to memory of 3140 2088 thntbt.exe 110 PID 2088 wrote to memory of 3140 2088 thntbt.exe 110 PID 3140 wrote to memory of 2668 3140 xrfllll.exe 111 PID 3140 wrote to memory of 2668 3140 xrfllll.exe 111 PID 3140 wrote to memory of 2668 3140 xrfllll.exe 111 PID 2668 wrote to memory of 1168 2668 5xxxxrr.exe 112 PID 2668 wrote to memory of 1168 2668 5xxxxrr.exe 112 PID 2668 wrote to memory of 1168 2668 5xxxxrr.exe 112 PID 1168 wrote to memory of 4744 1168 nnnntt.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b71e2a0a6110584b9c634ea86e5b9d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0b71e2a0a6110584b9c634ea86e5b9d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\3ddjd.exec:\3ddjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\lffxlfx.exec:\lffxlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\vpvvj.exec:\vpvvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\ffllfll.exec:\ffllfll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\lrlrlll.exec:\lrlrlll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\nbbbhb.exec:\nbbbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\pjdvv.exec:\pjdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\fflrrxx.exec:\fflrrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\nhnntt.exec:\nhnntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\dvdvp.exec:\dvdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\xrxrlff.exec:\xrxrlff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\fxlfxxf.exec:\fxlfxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\jjpdp.exec:\jjpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\pjpjd.exec:\pjpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\ffllrll.exec:\ffllrll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\1bhhhh.exec:\1bhhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\thntbt.exec:\thntbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\xrfllll.exec:\xrfllll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\5xxxxrr.exec:\5xxxxrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\nnnntt.exec:\nnnntt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\3hhbtt.exec:\3hhbtt.exe23⤵
- Executes dropped EXE
PID:4744 -
\??\c:\vvddd.exec:\vvddd.exe24⤵
- Executes dropped EXE
PID:3648 -
\??\c:\rlrlffx.exec:\rlrlffx.exe25⤵
- Executes dropped EXE
PID:624 -
\??\c:\hnnnnn.exec:\hnnnnn.exe26⤵
- Executes dropped EXE
PID:1948 -
\??\c:\tnnhbh.exec:\tnnhbh.exe27⤵
- Executes dropped EXE
PID:4960 -
\??\c:\1ddvj.exec:\1ddvj.exe28⤵
- Executes dropped EXE
PID:3976 -
\??\c:\lflfxxx.exec:\lflfxxx.exe29⤵
- Executes dropped EXE
PID:988 -
\??\c:\rlllflf.exec:\rlllflf.exe30⤵
- Executes dropped EXE
PID:4304 -
\??\c:\nhbhhh.exec:\nhbhhh.exe31⤵
- Executes dropped EXE
PID:884 -
\??\c:\bntnhh.exec:\bntnhh.exe32⤵
- Executes dropped EXE
PID:940 -
\??\c:\ddvjd.exec:\ddvjd.exe33⤵
- Executes dropped EXE
PID:2440 -
\??\c:\fxfrlrl.exec:\fxfrlrl.exe34⤵
- Executes dropped EXE
PID:3476 -
\??\c:\rlfflrr.exec:\rlfflrr.exe35⤵
- Executes dropped EXE
PID:5008 -
\??\c:\ffrrrxx.exec:\ffrrrxx.exe36⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nhbbnt.exec:\nhbbnt.exe37⤵
- Executes dropped EXE
PID:772 -
\??\c:\1vvvv.exec:\1vvvv.exe38⤵
- Executes dropped EXE
PID:2376 -
\??\c:\pjpjj.exec:\pjpjj.exe39⤵
- Executes dropped EXE
PID:2948 -
\??\c:\fxfxrxx.exec:\fxfxrxx.exe40⤵
- Executes dropped EXE
PID:4388 -
\??\c:\5hhtnn.exec:\5hhtnn.exe41⤵
- Executes dropped EXE
PID:4560 -
\??\c:\jdddv.exec:\jdddv.exe42⤵
- Executes dropped EXE
PID:2656 -
\??\c:\pjjjv.exec:\pjjjv.exe43⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xfxxxfx.exec:\xfxxxfx.exe44⤵
- Executes dropped EXE
PID:3036 -
\??\c:\rfxrlfx.exec:\rfxrlfx.exe45⤵
- Executes dropped EXE
PID:456 -
\??\c:\5bnhnt.exec:\5bnhnt.exe46⤵
- Executes dropped EXE
PID:4520 -
\??\c:\1hbbbb.exec:\1hbbbb.exe47⤵
- Executes dropped EXE
PID:2232 -
\??\c:\djddd.exec:\djddd.exe48⤵
- Executes dropped EXE
PID:3736 -
\??\c:\rlrrlxx.exec:\rlrrlxx.exe49⤵
- Executes dropped EXE
PID:3064 -
\??\c:\bnbbhh.exec:\bnbbhh.exe50⤵
- Executes dropped EXE
PID:4512 -
\??\c:\vpddv.exec:\vpddv.exe51⤵
- Executes dropped EXE
PID:2236 -
\??\c:\3rfxfff.exec:\3rfxfff.exe52⤵
- Executes dropped EXE
PID:4544 -
\??\c:\rllrlll.exec:\rllrlll.exe53⤵
- Executes dropped EXE
PID:1780 -
\??\c:\hbbbbn.exec:\hbbbbn.exe54⤵
- Executes dropped EXE
PID:3060 -
\??\c:\djjjp.exec:\djjjp.exe55⤵
- Executes dropped EXE
PID:1592 -
\??\c:\rxfxlrl.exec:\rxfxlrl.exe56⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xfllffl.exec:\xfllffl.exe57⤵
- Executes dropped EXE
PID:1448 -
\??\c:\htbthh.exec:\htbthh.exe58⤵
- Executes dropped EXE
PID:4540 -
\??\c:\dpddd.exec:\dpddd.exe59⤵
- Executes dropped EXE
PID:5004 -
\??\c:\jddvp.exec:\jddvp.exe60⤵
- Executes dropped EXE
PID:2496 -
\??\c:\fxllxxf.exec:\fxllxxf.exe61⤵
- Executes dropped EXE
PID:4568 -
\??\c:\nhttnn.exec:\nhttnn.exe62⤵
- Executes dropped EXE
PID:1280 -
\??\c:\tntttt.exec:\tntttt.exe63⤵
- Executes dropped EXE
PID:4960 -
\??\c:\ppvvv.exec:\ppvvv.exe64⤵
- Executes dropped EXE
PID:3976 -
\??\c:\rffxrrr.exec:\rffxrrr.exe65⤵
- Executes dropped EXE
PID:4324 -
\??\c:\lrllfll.exec:\lrllfll.exe66⤵PID:2460
-
\??\c:\djpjj.exec:\djpjj.exe67⤵PID:2788
-
\??\c:\vppjv.exec:\vppjv.exe68⤵PID:3008
-
\??\c:\lfffxrf.exec:\lfffxrf.exe69⤵PID:940
-
\??\c:\rflffff.exec:\rflffff.exe70⤵PID:5052
-
\??\c:\btbbhh.exec:\btbbhh.exe71⤵PID:4308
-
\??\c:\thttbt.exec:\thttbt.exe72⤵PID:4364
-
\??\c:\jjjdv.exec:\jjjdv.exe73⤵PID:3096
-
\??\c:\xfllffx.exec:\xfllffx.exe74⤵PID:4328
-
\??\c:\9xrllfx.exec:\9xrllfx.exe75⤵PID:2376
-
\??\c:\nbnnhh.exec:\nbnnhh.exe76⤵PID:1596
-
\??\c:\tnnhbb.exec:\tnnhbb.exe77⤵PID:4388
-
\??\c:\3jjvp.exec:\3jjvp.exe78⤵PID:4560
-
\??\c:\jdjdv.exec:\jdjdv.exe79⤵PID:2656
-
\??\c:\1ffxrrx.exec:\1ffxrrx.exe80⤵PID:3496
-
\??\c:\rfxrlrl.exec:\rfxrlrl.exe81⤵PID:1296
-
\??\c:\1hhhbb.exec:\1hhhbb.exe82⤵PID:1992
-
\??\c:\hbbbnn.exec:\hbbbnn.exe83⤵PID:3936
-
\??\c:\ppvpp.exec:\ppvpp.exe84⤵PID:4844
-
\??\c:\7pvvj.exec:\7pvvj.exe85⤵PID:1848
-
\??\c:\ffrrrxx.exec:\ffrrrxx.exe86⤵PID:1192
-
\??\c:\9xffxlr.exec:\9xffxlr.exe87⤵PID:756
-
\??\c:\btbtnn.exec:\btbtnn.exe88⤵PID:2088
-
\??\c:\tnttnn.exec:\tnttnn.exe89⤵PID:4508
-
\??\c:\nhbtnn.exec:\nhbtnn.exe90⤵PID:3616
-
\??\c:\vpvvj.exec:\vpvvj.exe91⤵PID:2100
-
\??\c:\dvvvj.exec:\dvvvj.exe92⤵PID:1448
-
\??\c:\lrfxxxf.exec:\lrfxxxf.exe93⤵PID:4540
-
\??\c:\lllrllf.exec:\lllrllf.exe94⤵PID:5004
-
\??\c:\1htntt.exec:\1htntt.exe95⤵PID:1744
-
\??\c:\tnnnhn.exec:\tnnnhn.exe96⤵PID:2604
-
\??\c:\hhttnn.exec:\hhttnn.exe97⤵PID:3640
-
\??\c:\pjvvp.exec:\pjvvp.exe98⤵PID:4764
-
\??\c:\jdjdd.exec:\jdjdd.exe99⤵PID:4440
-
\??\c:\llllxff.exec:\llllxff.exe100⤵PID:3408
-
\??\c:\lflrrxr.exec:\lflrrxr.exe101⤵PID:4944
-
\??\c:\ntttnn.exec:\ntttnn.exe102⤵PID:1648
-
\??\c:\7bhhtb.exec:\7bhhtb.exe103⤵PID:3012
-
\??\c:\ddvdd.exec:\ddvdd.exe104⤵PID:4256
-
\??\c:\jddvd.exec:\jddvd.exe105⤵PID:744
-
\??\c:\9rxrlrl.exec:\9rxrlrl.exe106⤵PID:5008
-
\??\c:\rfffffx.exec:\rfffffx.exe107⤵PID:4820
-
\??\c:\thbbtn.exec:\thbbtn.exe108⤵PID:384
-
\??\c:\nbhbtn.exec:\nbhbtn.exe109⤵PID:2684
-
\??\c:\fxrllfx.exec:\fxrllfx.exe110⤵PID:4860
-
\??\c:\nbtthn.exec:\nbtthn.exe111⤵PID:4360
-
\??\c:\7tbbtt.exec:\7tbbtt.exe112⤵PID:1400
-
\??\c:\jpppj.exec:\jpppj.exe113⤵PID:4560
-
\??\c:\jjppp.exec:\jjppp.exe114⤵PID:4608
-
\??\c:\1xlxlfx.exec:\1xlxlfx.exe115⤵PID:3036
-
\??\c:\btnnbb.exec:\btnnbb.exe116⤵PID:456
-
\??\c:\btbtbb.exec:\btbtbb.exe117⤵PID:1264
-
\??\c:\5vddd.exec:\5vddd.exe118⤵PID:3876
-
\??\c:\jjjvd.exec:\jjjvd.exe119⤵PID:4752
-
\??\c:\fxxrrrx.exec:\fxxrrrx.exe120⤵PID:4588
-
\??\c:\xxfffll.exec:\xxfffll.exe121⤵PID:2076
-
\??\c:\frxxfll.exec:\frxxfll.exe122⤵PID:1780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-