Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 09:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d6fd7035ae058b0e0731719f6510b240_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
d6fd7035ae058b0e0731719f6510b240_NeikiAnalytics.exe
-
Size
266KB
-
MD5
d6fd7035ae058b0e0731719f6510b240
-
SHA1
04286631bb983423b61886cc384d9c21d47702dc
-
SHA256
48beca7421cf915b3a04d14b7f0a5ba4a39913304e5754579fb9f5a91154c767
-
SHA512
e54bc2a2bbb50770cc1438be8c1bab64f933083567b8085f09d70bdf53f9d906d9224bc64b23d4a534b071c01578e2f218e7dc86b19393ed9c0efa789f6ca810
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmPzTkV2y/QTa9RBZydZbf83pnzgmmIMS:n3C9BRIG0asYFm71mPfkVB8dKwaWC
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4252-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1004-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3788-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2544-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2088-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/856-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4676 jpvpp.exe 4424 7lrrrrr.exe 5060 bbtntn.exe 4776 tbhbnt.exe 5044 jpddv.exe 2692 fxlxlfl.exe 1004 vddpp.exe 1444 fllxrrf.exe 3652 nbhbbb.exe 3788 rxfxxxl.exe 2272 dpddd.exe 4268 lxxxrlf.exe 2816 dddpv.exe 4156 xxrxxxx.exe 3632 bbbbhh.exe 3012 ppjjd.exe 2544 rxxxrrf.exe 3508 ddppj.exe 1600 xflflxl.exe 1528 bnttth.exe 752 jpvpv.exe 1324 lfffffx.exe 4508 bnhhhn.exe 4628 9rxrlxr.exe 1860 ttnbhh.exe 2088 9lrrlrr.exe 4340 nnnntt.exe 1640 ddppv.exe 856 bbtnhn.exe 4012 htnhhb.exe 4692 ppdpp.exe 3700 fxfxfxx.exe 1288 pdjvp.exe 2792 xfxrlfr.exe 3436 nhhbbt.exe 4408 djjjd.exe 1652 dpvvv.exe 796 fxxrrrr.exe 2628 hntttb.exe 2548 bttnnn.exe 2652 ppdjp.exe 2364 rxfxffl.exe 4324 tthbbt.exe 4280 pjddj.exe 3520 xxlrrrx.exe 3316 nnnntt.exe 4624 3tbbnn.exe 2784 pdpjp.exe 1552 5pvpj.exe 2872 lfxxlll.exe 2760 hnnnnh.exe 400 jdjdv.exe 1896 xxrrrrr.exe 4108 thbhbb.exe 2816 hbhtnn.exe 3456 jvvpd.exe 1232 rfffffl.exe 4724 3rxrrxx.exe 2660 hbtthh.exe 1644 5djdd.exe 1772 ddpjv.exe 4616 7lllfff.exe 4348 bhntbh.exe 2640 vvddj.exe -
resource yara_rule behavioral2/memory/4252-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3788-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2088-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/856-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4252 wrote to memory of 4676 4252 d6fd7035ae058b0e0731719f6510b240_NeikiAnalytics.exe 83 PID 4252 wrote to memory of 4676 4252 d6fd7035ae058b0e0731719f6510b240_NeikiAnalytics.exe 83 PID 4252 wrote to memory of 4676 4252 d6fd7035ae058b0e0731719f6510b240_NeikiAnalytics.exe 83 PID 4676 wrote to memory of 4424 4676 jpvpp.exe 84 PID 4676 wrote to memory of 4424 4676 jpvpp.exe 84 PID 4676 wrote to memory of 4424 4676 jpvpp.exe 84 PID 4424 wrote to memory of 5060 4424 7lrrrrr.exe 85 PID 4424 wrote to memory of 5060 4424 7lrrrrr.exe 85 PID 4424 wrote to memory of 5060 4424 7lrrrrr.exe 85 PID 5060 wrote to memory of 4776 5060 bbtntn.exe 86 PID 5060 wrote to memory of 4776 5060 bbtntn.exe 86 PID 5060 wrote to memory of 4776 5060 bbtntn.exe 86 PID 4776 wrote to memory of 5044 4776 tbhbnt.exe 87 PID 4776 wrote to memory of 5044 4776 tbhbnt.exe 87 PID 4776 wrote to memory of 5044 4776 tbhbnt.exe 87 PID 5044 wrote to memory of 2692 5044 jpddv.exe 88 PID 5044 wrote to memory of 2692 5044 jpddv.exe 88 PID 5044 wrote to memory of 2692 5044 jpddv.exe 88 PID 2692 wrote to memory of 1004 2692 fxlxlfl.exe 89 PID 2692 wrote to memory of 1004 2692 fxlxlfl.exe 89 PID 2692 wrote to memory of 1004 2692 fxlxlfl.exe 89 PID 1004 wrote to memory of 1444 1004 vddpp.exe 90 PID 1004 wrote to memory of 1444 1004 vddpp.exe 90 PID 1004 wrote to memory of 1444 1004 vddpp.exe 90 PID 1444 wrote to memory of 3652 1444 fllxrrf.exe 91 PID 1444 wrote to memory of 3652 1444 fllxrrf.exe 91 PID 1444 wrote to memory of 3652 1444 fllxrrf.exe 91 PID 3652 wrote to memory of 3788 3652 nbhbbb.exe 92 PID 3652 wrote to memory of 3788 3652 nbhbbb.exe 92 PID 3652 wrote to memory of 3788 3652 nbhbbb.exe 92 PID 3788 wrote to memory of 2272 3788 rxfxxxl.exe 93 PID 3788 wrote to memory of 2272 3788 rxfxxxl.exe 93 PID 3788 wrote to memory of 2272 3788 rxfxxxl.exe 93 PID 2272 wrote to memory of 4268 2272 dpddd.exe 94 PID 2272 wrote to memory of 4268 2272 dpddd.exe 94 PID 2272 wrote to memory of 4268 2272 dpddd.exe 94 PID 4268 wrote to memory of 2816 4268 lxxxrlf.exe 95 PID 4268 wrote to memory of 2816 4268 lxxxrlf.exe 95 PID 4268 wrote to memory of 2816 4268 lxxxrlf.exe 95 PID 2816 wrote to memory of 4156 2816 dddpv.exe 96 PID 2816 wrote to memory of 4156 2816 dddpv.exe 96 PID 2816 wrote to memory of 4156 2816 dddpv.exe 96 PID 4156 wrote to memory of 3632 4156 xxrxxxx.exe 97 PID 4156 wrote to memory of 3632 4156 xxrxxxx.exe 97 PID 4156 wrote to memory of 3632 4156 xxrxxxx.exe 97 PID 3632 wrote to memory of 3012 3632 bbbbhh.exe 98 PID 3632 wrote to memory of 3012 3632 bbbbhh.exe 98 PID 3632 wrote to memory of 3012 3632 bbbbhh.exe 98 PID 3012 wrote to memory of 2544 3012 ppjjd.exe 99 PID 3012 wrote to memory of 2544 3012 ppjjd.exe 99 PID 3012 wrote to memory of 2544 3012 ppjjd.exe 99 PID 2544 wrote to memory of 3508 2544 rxxxrrf.exe 100 PID 2544 wrote to memory of 3508 2544 rxxxrrf.exe 100 PID 2544 wrote to memory of 3508 2544 rxxxrrf.exe 100 PID 3508 wrote to memory of 1600 3508 ddppj.exe 101 PID 3508 wrote to memory of 1600 3508 ddppj.exe 101 PID 3508 wrote to memory of 1600 3508 ddppj.exe 101 PID 1600 wrote to memory of 1528 1600 xflflxl.exe 103 PID 1600 wrote to memory of 1528 1600 xflflxl.exe 103 PID 1600 wrote to memory of 1528 1600 xflflxl.exe 103 PID 1528 wrote to memory of 752 1528 bnttth.exe 104 PID 1528 wrote to memory of 752 1528 bnttth.exe 104 PID 1528 wrote to memory of 752 1528 bnttth.exe 104 PID 752 wrote to memory of 1324 752 jpvpv.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6fd7035ae058b0e0731719f6510b240_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d6fd7035ae058b0e0731719f6510b240_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\jpvpp.exec:\jpvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\7lrrrrr.exec:\7lrrrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\bbtntn.exec:\bbtntn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\tbhbnt.exec:\tbhbnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\jpddv.exec:\jpddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\fxlxlfl.exec:\fxlxlfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\vddpp.exec:\vddpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\fllxrrf.exec:\fllxrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\nbhbbb.exec:\nbhbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\rxfxxxl.exec:\rxfxxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\dpddd.exec:\dpddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\lxxxrlf.exec:\lxxxrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\dddpv.exec:\dddpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\xxrxxxx.exec:\xxrxxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\bbbbhh.exec:\bbbbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\ppjjd.exec:\ppjjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\rxxxrrf.exec:\rxxxrrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\ddppj.exec:\ddppj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\xflflxl.exec:\xflflxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\bnttth.exec:\bnttth.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\jpvpv.exec:\jpvpv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\lfffffx.exec:\lfffffx.exe23⤵
- Executes dropped EXE
PID:1324 -
\??\c:\bnhhhn.exec:\bnhhhn.exe24⤵
- Executes dropped EXE
PID:4508 -
\??\c:\9rxrlxr.exec:\9rxrlxr.exe25⤵
- Executes dropped EXE
PID:4628 -
\??\c:\ttnbhh.exec:\ttnbhh.exe26⤵
- Executes dropped EXE
PID:1860 -
\??\c:\9lrrlrr.exec:\9lrrlrr.exe27⤵
- Executes dropped EXE
PID:2088 -
\??\c:\nnnntt.exec:\nnnntt.exe28⤵
- Executes dropped EXE
PID:4340 -
\??\c:\ddppv.exec:\ddppv.exe29⤵
- Executes dropped EXE
PID:1640 -
\??\c:\bbtnhn.exec:\bbtnhn.exe30⤵
- Executes dropped EXE
PID:856 -
\??\c:\htnhhb.exec:\htnhhb.exe31⤵
- Executes dropped EXE
PID:4012 -
\??\c:\ppdpp.exec:\ppdpp.exe32⤵
- Executes dropped EXE
PID:4692 -
\??\c:\fxfxfxx.exec:\fxfxfxx.exe33⤵
- Executes dropped EXE
PID:3700 -
\??\c:\pdjvp.exec:\pdjvp.exe34⤵
- Executes dropped EXE
PID:1288 -
\??\c:\xfxrlfr.exec:\xfxrlfr.exe35⤵
- Executes dropped EXE
PID:2792 -
\??\c:\nhhbbt.exec:\nhhbbt.exe36⤵
- Executes dropped EXE
PID:3436 -
\??\c:\djjjd.exec:\djjjd.exe37⤵
- Executes dropped EXE
PID:4408 -
\??\c:\dpvvv.exec:\dpvvv.exe38⤵
- Executes dropped EXE
PID:1652 -
\??\c:\fxxrrrr.exec:\fxxrrrr.exe39⤵
- Executes dropped EXE
PID:796 -
\??\c:\hntttb.exec:\hntttb.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\bttnnn.exec:\bttnnn.exe41⤵
- Executes dropped EXE
PID:2548 -
\??\c:\ppdjp.exec:\ppdjp.exe42⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rxfxffl.exec:\rxfxffl.exe43⤵
- Executes dropped EXE
PID:2364 -
\??\c:\tthbbt.exec:\tthbbt.exe44⤵
- Executes dropped EXE
PID:4324 -
\??\c:\pjddj.exec:\pjddj.exe45⤵
- Executes dropped EXE
PID:4280 -
\??\c:\xxlrrrx.exec:\xxlrrrx.exe46⤵
- Executes dropped EXE
PID:3520 -
\??\c:\nnnntt.exec:\nnnntt.exe47⤵
- Executes dropped EXE
PID:3316 -
\??\c:\3tbbnn.exec:\3tbbnn.exe48⤵
- Executes dropped EXE
PID:4624 -
\??\c:\pdpjp.exec:\pdpjp.exe49⤵
- Executes dropped EXE
PID:2784 -
\??\c:\5pvpj.exec:\5pvpj.exe50⤵
- Executes dropped EXE
PID:1552 -
\??\c:\lfxxlll.exec:\lfxxlll.exe51⤵
- Executes dropped EXE
PID:2872 -
\??\c:\hnnnnh.exec:\hnnnnh.exe52⤵
- Executes dropped EXE
PID:2760 -
\??\c:\jdjdv.exec:\jdjdv.exe53⤵
- Executes dropped EXE
PID:400 -
\??\c:\xxrrrrr.exec:\xxrrrrr.exe54⤵
- Executes dropped EXE
PID:1896 -
\??\c:\thbhbb.exec:\thbhbb.exe55⤵
- Executes dropped EXE
PID:4108 -
\??\c:\hbhtnn.exec:\hbhtnn.exe56⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jvvpd.exec:\jvvpd.exe57⤵
- Executes dropped EXE
PID:3456 -
\??\c:\rfffffl.exec:\rfffffl.exe58⤵
- Executes dropped EXE
PID:1232 -
\??\c:\3rxrrxx.exec:\3rxrrxx.exe59⤵
- Executes dropped EXE
PID:4724 -
\??\c:\hbtthh.exec:\hbtthh.exe60⤵
- Executes dropped EXE
PID:2660 -
\??\c:\5djdd.exec:\5djdd.exe61⤵
- Executes dropped EXE
PID:1644 -
\??\c:\ddpjv.exec:\ddpjv.exe62⤵
- Executes dropped EXE
PID:1772 -
\??\c:\7lllfff.exec:\7lllfff.exe63⤵
- Executes dropped EXE
PID:4616 -
\??\c:\bhntbh.exec:\bhntbh.exe64⤵
- Executes dropped EXE
PID:4348 -
\??\c:\vvddj.exec:\vvddj.exe65⤵
- Executes dropped EXE
PID:2640 -
\??\c:\vppdv.exec:\vppdv.exe66⤵PID:2876
-
\??\c:\lffffxr.exec:\lffffxr.exe67⤵PID:1324
-
\??\c:\rrxxlll.exec:\rrxxlll.exe68⤵PID:1580
-
\??\c:\hhbtnb.exec:\hhbtnb.exe69⤵PID:2756
-
\??\c:\jdvpp.exec:\jdvpp.exe70⤵PID:3076
-
\??\c:\dddvv.exec:\dddvv.exe71⤵PID:5028
-
\??\c:\xxlfffx.exec:\xxlfffx.exe72⤵PID:2896
-
\??\c:\bntnnt.exec:\bntnnt.exe73⤵PID:1548
-
\??\c:\ppjjd.exec:\ppjjd.exe74⤵PID:1072
-
\??\c:\3dvjj.exec:\3dvjj.exe75⤵PID:2452
-
\??\c:\rrrfxrl.exec:\rrrfxrl.exe76⤵PID:3272
-
\??\c:\lrlllxx.exec:\lrlllxx.exe77⤵PID:4012
-
\??\c:\hbnnnt.exec:\hbnnnt.exe78⤵PID:4416
-
\??\c:\ppvvp.exec:\ppvvp.exe79⤵PID:2068
-
\??\c:\jjddd.exec:\jjddd.exe80⤵PID:528
-
\??\c:\rrfflrx.exec:\rrfflrx.exe81⤵PID:208
-
\??\c:\nbbhhh.exec:\nbbhhh.exe82⤵PID:4824
-
\??\c:\jdpjp.exec:\jdpjp.exe83⤵PID:4400
-
\??\c:\jppjv.exec:\jppjv.exe84⤵PID:2268
-
\??\c:\xfrfrfr.exec:\xfrfrfr.exe85⤵PID:640
-
\??\c:\hnhbnb.exec:\hnhbnb.exe86⤵PID:1532
-
\??\c:\djjpv.exec:\djjpv.exe87⤵PID:2812
-
\??\c:\5lxrffx.exec:\5lxrffx.exe88⤵PID:2336
-
\??\c:\xrrlrll.exec:\xrrlrll.exe89⤵PID:4324
-
\??\c:\fxffffx.exec:\fxffffx.exe90⤵PID:2040
-
\??\c:\tntttn.exec:\tntttn.exe91⤵PID:4440
-
\??\c:\nnhhhh.exec:\nnhhhh.exe92⤵PID:1088
-
\??\c:\pvdvv.exec:\pvdvv.exe93⤵PID:1128
-
\??\c:\xxxxffr.exec:\xxxxffr.exe94⤵PID:2760
-
\??\c:\frrrrrr.exec:\frrrrrr.exe95⤵PID:1912
-
\??\c:\bttttt.exec:\bttttt.exe96⤵PID:2312
-
\??\c:\vdddd.exec:\vdddd.exe97⤵PID:2816
-
\??\c:\fllrlrf.exec:\fllrlrf.exe98⤵PID:3632
-
\??\c:\7hbhhn.exec:\7hbhhn.exe99⤵PID:4188
-
\??\c:\ppppv.exec:\ppppv.exe100⤵PID:4848
-
\??\c:\rrrrrxr.exec:\rrrrrxr.exe101⤵PID:2544
-
\??\c:\3hbnhn.exec:\3hbnhn.exe102⤵PID:2316
-
\??\c:\9vjdd.exec:\9vjdd.exe103⤵PID:4560
-
\??\c:\llrrlrf.exec:\llrrlrf.exe104⤵PID:752
-
\??\c:\ntthht.exec:\ntthht.exe105⤵PID:4892
-
\??\c:\djddj.exec:\djddj.exe106⤵PID:1612
-
\??\c:\xlxrxxf.exec:\xlxrxxf.exe107⤵PID:396
-
\??\c:\bntnhb.exec:\bntnhb.exe108⤵PID:4540
-
\??\c:\jpvjd.exec:\jpvjd.exe109⤵PID:3888
-
\??\c:\lfxlxrx.exec:\lfxlxrx.exe110⤵PID:4876
-
\??\c:\ttnnbn.exec:\ttnnbn.exe111⤵PID:1656
-
\??\c:\pjpjj.exec:\pjpjj.exe112⤵PID:4620
-
\??\c:\xffxlfx.exec:\xffxlfx.exe113⤵PID:4340
-
\??\c:\nbbnnt.exec:\nbbnnt.exe114⤵PID:2612
-
\??\c:\xllxrlf.exec:\xllxrlf.exe115⤵PID:3200
-
\??\c:\5xxxxrf.exec:\5xxxxrf.exe116⤵PID:1420
-
\??\c:\httnnn.exec:\httnnn.exe117⤵PID:1840
-
\??\c:\9vddv.exec:\9vddv.exe118⤵PID:4924
-
\??\c:\jddvj.exec:\jddvj.exe119⤵PID:2328
-
\??\c:\rlrfffx.exec:\rlrfffx.exe120⤵PID:3944
-
\??\c:\5bhbbb.exec:\5bhbbb.exe121⤵PID:4332
-
\??\c:\pdpjj.exec:\pdpjj.exe122⤵PID:4464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-