Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 09:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd7375b54596a1950f33491d803b2d40_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
bd7375b54596a1950f33491d803b2d40_NeikiAnalytics.exe
-
Size
90KB
-
MD5
bd7375b54596a1950f33491d803b2d40
-
SHA1
cdedb96014950d6bbfd7fd5f66d5f32ffcb4109a
-
SHA256
e547f5cdd3d2a6144bfb6642eb85678baf8b781eea47863715e72e8694ef219e
-
SHA512
2a9589639a91a25f85e36b6bdd40b913352f52c09dd8044cef5297ac77ff332505f9783815c5888dccb0d870e83d2f0bbbeaa3881a6394df559ba9e9c542a9a9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDodtzac0Hobv0byLufTJfJV1:ymb3NkkiQ3mdBjFodt27HobvcyLufNfp
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/1236-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1128-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1288-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1324-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2072 lrrlrxf.exe 4052 lrrlfxr.exe 4760 hhttbh.exe 1128 jjjdd.exe 1288 vpjdv.exe 3152 lrlrrff.exe 1968 7nbtnn.exe 2312 nttnnt.exe 5060 dvvvp.exe 1416 vdjjv.exe 1324 9fxrlxr.exe 2752 lflfxxl.exe 3976 vppdv.exe 860 rrxrxxf.exe 2272 btbtnh.exe 4784 ntnthn.exe 3272 xflffll.exe 2844 bbnnhn.exe 4392 hbbbnn.exe 2140 dvvjp.exe 4064 xffxlrl.exe 3472 7ntttt.exe 4240 pvvvp.exe 4728 xxffxxx.exe 4732 9thbtn.exe 4772 nbbbbh.exe 3284 jdpjp.exe 2960 dvvpp.exe 1544 1rxrfll.exe 4564 thtnhh.exe 4476 1bbttb.exe 1236 dvjdj.exe 3732 ppjdp.exe 220 rlfxrll.exe 4592 nhhbtt.exe 3484 1bbtnn.exe 1904 pjjdv.exe 2824 rrfrrrf.exe 4900 hhnbtn.exe 1564 nhtbtt.exe 2608 jvjdv.exe 756 pjjdd.exe 2732 lfffffx.exe 3296 flllllf.exe 1416 btbbnt.exe 3428 5hnhhn.exe 676 vddvd.exe 3976 jvdvp.exe 828 llfxlxf.exe 2460 rlfxxxr.exe 4848 nbnhbb.exe 3128 pvjjp.exe 5036 llfffff.exe 4328 hnthtt.exe 544 9tbthh.exe 1700 pjddv.exe 1380 vvddv.exe 3504 9ffffff.exe 1780 nbbhhn.exe 3340 7djpj.exe 4996 pjvvp.exe 936 rrlfrff.exe 4100 xxflffx.exe 1232 7ppjj.exe -
resource yara_rule behavioral2/memory/1236-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1128-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1288-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4392-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1236 wrote to memory of 2072 1236 bd7375b54596a1950f33491d803b2d40_NeikiAnalytics.exe 89 PID 1236 wrote to memory of 2072 1236 bd7375b54596a1950f33491d803b2d40_NeikiAnalytics.exe 89 PID 1236 wrote to memory of 2072 1236 bd7375b54596a1950f33491d803b2d40_NeikiAnalytics.exe 89 PID 2072 wrote to memory of 4052 2072 lrrlrxf.exe 90 PID 2072 wrote to memory of 4052 2072 lrrlrxf.exe 90 PID 2072 wrote to memory of 4052 2072 lrrlrxf.exe 90 PID 4052 wrote to memory of 4760 4052 lrrlfxr.exe 91 PID 4052 wrote to memory of 4760 4052 lrrlfxr.exe 91 PID 4052 wrote to memory of 4760 4052 lrrlfxr.exe 91 PID 4760 wrote to memory of 1128 4760 hhttbh.exe 92 PID 4760 wrote to memory of 1128 4760 hhttbh.exe 92 PID 4760 wrote to memory of 1128 4760 hhttbh.exe 92 PID 1128 wrote to memory of 1288 1128 jjjdd.exe 93 PID 1128 wrote to memory of 1288 1128 jjjdd.exe 93 PID 1128 wrote to memory of 1288 1128 jjjdd.exe 93 PID 1288 wrote to memory of 3152 1288 vpjdv.exe 94 PID 1288 wrote to memory of 3152 1288 vpjdv.exe 94 PID 1288 wrote to memory of 3152 1288 vpjdv.exe 94 PID 3152 wrote to memory of 1968 3152 lrlrrff.exe 95 PID 3152 wrote to memory of 1968 3152 lrlrrff.exe 95 PID 3152 wrote to memory of 1968 3152 lrlrrff.exe 95 PID 1968 wrote to memory of 2312 1968 7nbtnn.exe 96 PID 1968 wrote to memory of 2312 1968 7nbtnn.exe 96 PID 1968 wrote to memory of 2312 1968 7nbtnn.exe 96 PID 2312 wrote to memory of 5060 2312 nttnnt.exe 97 PID 2312 wrote to memory of 5060 2312 nttnnt.exe 97 PID 2312 wrote to memory of 5060 2312 nttnnt.exe 97 PID 5060 wrote to memory of 1416 5060 dvvvp.exe 98 PID 5060 wrote to memory of 1416 5060 dvvvp.exe 98 PID 5060 wrote to memory of 1416 5060 dvvvp.exe 98 PID 1416 wrote to memory of 1324 1416 vdjjv.exe 99 PID 1416 wrote to memory of 1324 1416 vdjjv.exe 99 PID 1416 wrote to memory of 1324 1416 vdjjv.exe 99 PID 1324 wrote to memory of 2752 1324 9fxrlxr.exe 100 PID 1324 wrote to memory of 2752 1324 9fxrlxr.exe 100 PID 1324 wrote to memory of 2752 1324 9fxrlxr.exe 100 PID 2752 wrote to memory of 3976 2752 lflfxxl.exe 101 PID 2752 wrote to memory of 3976 2752 lflfxxl.exe 101 PID 2752 wrote to memory of 3976 2752 lflfxxl.exe 101 PID 3976 wrote to memory of 860 3976 vppdv.exe 102 PID 3976 wrote to memory of 860 3976 vppdv.exe 102 PID 3976 wrote to memory of 860 3976 vppdv.exe 102 PID 860 wrote to memory of 2272 860 rrxrxxf.exe 103 PID 860 wrote to memory of 2272 860 rrxrxxf.exe 103 PID 860 wrote to memory of 2272 860 rrxrxxf.exe 103 PID 2272 wrote to memory of 4784 2272 btbtnh.exe 104 PID 2272 wrote to memory of 4784 2272 btbtnh.exe 104 PID 2272 wrote to memory of 4784 2272 btbtnh.exe 104 PID 4784 wrote to memory of 3272 4784 ntnthn.exe 105 PID 4784 wrote to memory of 3272 4784 ntnthn.exe 105 PID 4784 wrote to memory of 3272 4784 ntnthn.exe 105 PID 3272 wrote to memory of 2844 3272 xflffll.exe 107 PID 3272 wrote to memory of 2844 3272 xflffll.exe 107 PID 3272 wrote to memory of 2844 3272 xflffll.exe 107 PID 2844 wrote to memory of 4392 2844 bbnnhn.exe 108 PID 2844 wrote to memory of 4392 2844 bbnnhn.exe 108 PID 2844 wrote to memory of 4392 2844 bbnnhn.exe 108 PID 4392 wrote to memory of 2140 4392 hbbbnn.exe 109 PID 4392 wrote to memory of 2140 4392 hbbbnn.exe 109 PID 4392 wrote to memory of 2140 4392 hbbbnn.exe 109 PID 2140 wrote to memory of 4064 2140 dvvjp.exe 110 PID 2140 wrote to memory of 4064 2140 dvvjp.exe 110 PID 2140 wrote to memory of 4064 2140 dvvjp.exe 110 PID 4064 wrote to memory of 3472 4064 xffxlrl.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd7375b54596a1950f33491d803b2d40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bd7375b54596a1950f33491d803b2d40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\lrrlrxf.exec:\lrrlrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\lrrlfxr.exec:\lrrlfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\hhttbh.exec:\hhttbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\jjjdd.exec:\jjjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\vpjdv.exec:\vpjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\lrlrrff.exec:\lrlrrff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\7nbtnn.exec:\7nbtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\nttnnt.exec:\nttnnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\dvvvp.exec:\dvvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\vdjjv.exec:\vdjjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\9fxrlxr.exec:\9fxrlxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\lflfxxl.exec:\lflfxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\vppdv.exec:\vppdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\rrxrxxf.exec:\rrxrxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\btbtnh.exec:\btbtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\ntnthn.exec:\ntnthn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\xflffll.exec:\xflffll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\bbnnhn.exec:\bbnnhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\hbbbnn.exec:\hbbbnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\dvvjp.exec:\dvvjp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\xffxlrl.exec:\xffxlrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\7ntttt.exec:\7ntttt.exe23⤵
- Executes dropped EXE
PID:3472 -
\??\c:\pvvvp.exec:\pvvvp.exe24⤵
- Executes dropped EXE
PID:4240 -
\??\c:\xxffxxx.exec:\xxffxxx.exe25⤵
- Executes dropped EXE
PID:4728 -
\??\c:\9thbtn.exec:\9thbtn.exe26⤵
- Executes dropped EXE
PID:4732 -
\??\c:\nbbbbh.exec:\nbbbbh.exe27⤵
- Executes dropped EXE
PID:4772 -
\??\c:\jdpjp.exec:\jdpjp.exe28⤵
- Executes dropped EXE
PID:3284 -
\??\c:\dvvpp.exec:\dvvpp.exe29⤵
- Executes dropped EXE
PID:2960 -
\??\c:\1rxrfll.exec:\1rxrfll.exe30⤵
- Executes dropped EXE
PID:1544 -
\??\c:\thtnhh.exec:\thtnhh.exe31⤵
- Executes dropped EXE
PID:4564 -
\??\c:\1bbttb.exec:\1bbttb.exe32⤵
- Executes dropped EXE
PID:4476 -
\??\c:\dvjdj.exec:\dvjdj.exe33⤵
- Executes dropped EXE
PID:1236 -
\??\c:\ppjdp.exec:\ppjdp.exe34⤵
- Executes dropped EXE
PID:3732 -
\??\c:\rlfxrll.exec:\rlfxrll.exe35⤵
- Executes dropped EXE
PID:220 -
\??\c:\nhhbtt.exec:\nhhbtt.exe36⤵
- Executes dropped EXE
PID:4592 -
\??\c:\1bbtnn.exec:\1bbtnn.exe37⤵
- Executes dropped EXE
PID:3484 -
\??\c:\pjjdv.exec:\pjjdv.exe38⤵
- Executes dropped EXE
PID:1904 -
\??\c:\rrfrrrf.exec:\rrfrrrf.exe39⤵
- Executes dropped EXE
PID:2824 -
\??\c:\hhnbtn.exec:\hhnbtn.exe40⤵
- Executes dropped EXE
PID:4900 -
\??\c:\nhtbtt.exec:\nhtbtt.exe41⤵
- Executes dropped EXE
PID:1564 -
\??\c:\jvjdv.exec:\jvjdv.exe42⤵
- Executes dropped EXE
PID:2608 -
\??\c:\pjjdd.exec:\pjjdd.exe43⤵
- Executes dropped EXE
PID:756 -
\??\c:\lfffffx.exec:\lfffffx.exe44⤵
- Executes dropped EXE
PID:2732 -
\??\c:\flllllf.exec:\flllllf.exe45⤵
- Executes dropped EXE
PID:3296 -
\??\c:\btbbnt.exec:\btbbnt.exe46⤵
- Executes dropped EXE
PID:1416 -
\??\c:\5hnhhn.exec:\5hnhhn.exe47⤵
- Executes dropped EXE
PID:3428 -
\??\c:\vddvd.exec:\vddvd.exe48⤵
- Executes dropped EXE
PID:676 -
\??\c:\jvdvp.exec:\jvdvp.exe49⤵
- Executes dropped EXE
PID:3976 -
\??\c:\llfxlxf.exec:\llfxlxf.exe50⤵
- Executes dropped EXE
PID:828 -
\??\c:\rlfxxxr.exec:\rlfxxxr.exe51⤵
- Executes dropped EXE
PID:2460 -
\??\c:\nbnhbb.exec:\nbnhbb.exe52⤵
- Executes dropped EXE
PID:4848 -
\??\c:\pvjjp.exec:\pvjjp.exe53⤵
- Executes dropped EXE
PID:3128 -
\??\c:\llfffff.exec:\llfffff.exe54⤵
- Executes dropped EXE
PID:5036 -
\??\c:\hnthtt.exec:\hnthtt.exe55⤵
- Executes dropped EXE
PID:4328 -
\??\c:\9tbthh.exec:\9tbthh.exe56⤵
- Executes dropped EXE
PID:544 -
\??\c:\pjddv.exec:\pjddv.exe57⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vvddv.exec:\vvddv.exe58⤵
- Executes dropped EXE
PID:1380 -
\??\c:\9ffffff.exec:\9ffffff.exe59⤵
- Executes dropped EXE
PID:3504 -
\??\c:\nbbhhn.exec:\nbbhhn.exe60⤵
- Executes dropped EXE
PID:1780 -
\??\c:\7djpj.exec:\7djpj.exe61⤵
- Executes dropped EXE
PID:3340 -
\??\c:\pjvvp.exec:\pjvvp.exe62⤵
- Executes dropped EXE
PID:4996 -
\??\c:\rrlfrff.exec:\rrlfrff.exe63⤵
- Executes dropped EXE
PID:936 -
\??\c:\xxflffx.exec:\xxflffx.exe64⤵
- Executes dropped EXE
PID:4100 -
\??\c:\7ppjj.exec:\7ppjj.exe65⤵
- Executes dropped EXE
PID:1232 -
\??\c:\1rrxrrr.exec:\1rrxrrr.exe66⤵PID:3064
-
\??\c:\nnhhnn.exec:\nnhhnn.exe67⤵PID:552
-
\??\c:\nbbttt.exec:\nbbttt.exe68⤵PID:4556
-
\??\c:\7vdvj.exec:\7vdvj.exe69⤵PID:748
-
\??\c:\jddvv.exec:\jddvv.exe70⤵PID:2072
-
\??\c:\rrllffx.exec:\rrllffx.exe71⤵PID:1236
-
\??\c:\bnttnt.exec:\bnttnt.exe72⤵PID:3732
-
\??\c:\pvvpj.exec:\pvvpj.exe73⤵PID:220
-
\??\c:\fxrlxrr.exec:\fxrlxrr.exe74⤵PID:4592
-
\??\c:\tbnbhh.exec:\tbnbhh.exe75⤵PID:4724
-
\??\c:\bttnhh.exec:\bttnhh.exe76⤵PID:2492
-
\??\c:\jddvp.exec:\jddvp.exe77⤵PID:4364
-
\??\c:\fxlxffl.exec:\fxlxffl.exe78⤵PID:4600
-
\??\c:\tnhbtt.exec:\tnhbtt.exe79⤵PID:224
-
\??\c:\3ddvp.exec:\3ddvp.exe80⤵PID:3364
-
\??\c:\flrxxxl.exec:\flrxxxl.exe81⤵PID:636
-
\??\c:\bnttbb.exec:\bnttbb.exe82⤵PID:4156
-
\??\c:\jjppp.exec:\jjppp.exe83⤵PID:4928
-
\??\c:\jddvp.exec:\jddvp.exe84⤵PID:4160
-
\??\c:\7ddjv.exec:\7ddjv.exe85⤵PID:1560
-
\??\c:\rffxrfr.exec:\rffxrfr.exe86⤵PID:3108
-
\??\c:\rfxffff.exec:\rfxffff.exe87⤵PID:4408
-
\??\c:\hhbbtt.exec:\hhbbtt.exe88⤵PID:732
-
\??\c:\9bhbth.exec:\9bhbth.exe89⤵PID:4296
-
\??\c:\jpdvp.exec:\jpdvp.exe90⤵PID:1480
-
\??\c:\rfffxrr.exec:\rfffxrr.exe91⤵PID:2404
-
\??\c:\nntttt.exec:\nntttt.exe92⤵PID:4436
-
\??\c:\nhhbbb.exec:\nhhbbb.exe93⤵PID:1992
-
\??\c:\ddddj.exec:\ddddj.exe94⤵PID:1700
-
\??\c:\vjjdv.exec:\vjjdv.exe95⤵PID:3148
-
\??\c:\5lrlllr.exec:\5lrlllr.exe96⤵PID:1188
-
\??\c:\llllxxl.exec:\llllxxl.exe97⤵PID:3120
-
\??\c:\tnttnh.exec:\tnttnh.exe98⤵PID:1060
-
\??\c:\hbnbnh.exec:\hbnbnh.exe99⤵PID:4292
-
\??\c:\jjvpp.exec:\jjvpp.exe100⤵PID:2360
-
\??\c:\3jpdp.exec:\3jpdp.exe101⤵PID:208
-
\??\c:\fllfxfx.exec:\fllfxfx.exe102⤵PID:2028
-
\??\c:\ffffxxx.exec:\ffffxxx.exe103⤵PID:3368
-
\??\c:\5hnttb.exec:\5hnttb.exe104⤵PID:3348
-
\??\c:\btntnt.exec:\btntnt.exe105⤵PID:1072
-
\??\c:\7ddvp.exec:\7ddvp.exe106⤵PID:4624
-
\??\c:\pvpjv.exec:\pvpjv.exe107⤵PID:744
-
\??\c:\rrrlffx.exec:\rrrlffx.exe108⤵PID:4736
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe109⤵PID:3956
-
\??\c:\7hhbtt.exec:\7hhbtt.exe110⤵PID:868
-
\??\c:\thhbnh.exec:\thhbnh.exe111⤵PID:4416
-
\??\c:\dpvpj.exec:\dpvpj.exe112⤵PID:532
-
\??\c:\dvvpj.exec:\dvvpj.exe113⤵PID:3320
-
\??\c:\xlfxllf.exec:\xlfxllf.exe114⤵PID:5060
-
\??\c:\3fllfll.exec:\3fllfll.exe115⤵PID:756
-
\??\c:\thhbtt.exec:\thhbtt.exe116⤵PID:1792
-
\??\c:\7bnbtb.exec:\7bnbtb.exe117⤵PID:4812
-
\??\c:\vvjdv.exec:\vvjdv.exe118⤵PID:4032
-
\??\c:\jjddv.exec:\jjddv.exe119⤵PID:676
-
\??\c:\xrrrlll.exec:\xrrrlll.exe120⤵PID:3096
-
\??\c:\fxlfrlx.exec:\fxlfrlx.exe121⤵PID:4764
-
\??\c:\nttttb.exec:\nttttb.exe122⤵PID:4408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-