Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 00:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6c1381517c4540ec3eea864fefd62100_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
6c1381517c4540ec3eea864fefd62100_NeikiAnalytics.exe
-
Size
67KB
-
MD5
6c1381517c4540ec3eea864fefd62100
-
SHA1
a7fc3cd1ddc597df3425f06e82896a93b136e57b
-
SHA256
9110b671c34043162139d93d7954e811e3fc4e2ae41dd07b29591e750af8d6c8
-
SHA512
ce9fb1b26cd64381a9f45ff1bbf888ac082cad631143fac8384ef709f19159ca02a56e2a56a0b56cf57fea484500ad90532f2196441ce590713f9a301d841570
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUPqrDZF:ymb3NkkiQ3mdBjF0yUmr
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/1824-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-40-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4844-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1280-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-60-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4564 bhtnhh.exe 1132 pdvjd.exe 1120 vvpdp.exe 4624 rfffxff.exe 4844 bntbhb.exe 1280 nhhbnb.exe 3168 dvdpd.exe 2992 fxfxrlf.exe 2832 xflrllf.exe 3288 vjjjd.exe 5104 dvdvp.exe 3124 xlrffxf.exe 1112 ttbhtt.exe 3988 7vddj.exe 2344 ppdvj.exe 4848 rxrrlrr.exe 3448 hbtttt.exe 3224 jdddv.exe 4116 lfrlffx.exe 3472 rxfllff.exe 4572 nbbnbb.exe 4312 pjjjv.exe 3208 vpvpj.exe 1136 xlffrrl.exe 2876 3bhbtn.exe 4636 tbtnhb.exe 4424 xrxrrlr.exe 4808 xrfffll.exe 4820 hbhbtt.exe 3504 tnnbtn.exe 3968 dvppj.exe 3180 lxlfxff.exe 2388 hbhbbh.exe 4244 btttnn.exe 1044 vjdvj.exe 4688 xflfffx.exe 4484 lfllrff.exe 1484 nhhtth.exe 1940 pjjjd.exe 4328 9jjdv.exe 2724 frrlxrf.exe 3344 1lffxxr.exe 3956 5bhhhn.exe 4800 jppjv.exe 212 jddvp.exe 1608 vvdvp.exe 4844 fxfrxrx.exe 5008 9llfxxx.exe 4168 5htttn.exe 3668 dvdvj.exe 4804 dvdpp.exe 5076 rflfxxx.exe 1200 9lrlllf.exe 1628 5bbbtn.exe 5104 5ddpj.exe 656 pddvp.exe 332 9frlffl.exe 2356 9lrlfxx.exe 4028 htttnh.exe 5092 tnhhhh.exe 3612 jvvpv.exe 4880 1jppj.exe 3764 rllfxxx.exe 1508 lfflflf.exe -
resource yara_rule behavioral2/memory/1824-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4848-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1824 wrote to memory of 4564 1824 6c1381517c4540ec3eea864fefd62100_NeikiAnalytics.exe 83 PID 1824 wrote to memory of 4564 1824 6c1381517c4540ec3eea864fefd62100_NeikiAnalytics.exe 83 PID 1824 wrote to memory of 4564 1824 6c1381517c4540ec3eea864fefd62100_NeikiAnalytics.exe 83 PID 4564 wrote to memory of 1132 4564 bhtnhh.exe 84 PID 4564 wrote to memory of 1132 4564 bhtnhh.exe 84 PID 4564 wrote to memory of 1132 4564 bhtnhh.exe 84 PID 1132 wrote to memory of 1120 1132 pdvjd.exe 85 PID 1132 wrote to memory of 1120 1132 pdvjd.exe 85 PID 1132 wrote to memory of 1120 1132 pdvjd.exe 85 PID 1120 wrote to memory of 4624 1120 vvpdp.exe 86 PID 1120 wrote to memory of 4624 1120 vvpdp.exe 86 PID 1120 wrote to memory of 4624 1120 vvpdp.exe 86 PID 4624 wrote to memory of 4844 4624 rfffxff.exe 87 PID 4624 wrote to memory of 4844 4624 rfffxff.exe 87 PID 4624 wrote to memory of 4844 4624 rfffxff.exe 87 PID 4844 wrote to memory of 1280 4844 bntbhb.exe 88 PID 4844 wrote to memory of 1280 4844 bntbhb.exe 88 PID 4844 wrote to memory of 1280 4844 bntbhb.exe 88 PID 1280 wrote to memory of 3168 1280 nhhbnb.exe 89 PID 1280 wrote to memory of 3168 1280 nhhbnb.exe 89 PID 1280 wrote to memory of 3168 1280 nhhbnb.exe 89 PID 3168 wrote to memory of 2992 3168 dvdpd.exe 90 PID 3168 wrote to memory of 2992 3168 dvdpd.exe 90 PID 3168 wrote to memory of 2992 3168 dvdpd.exe 90 PID 2992 wrote to memory of 2832 2992 fxfxrlf.exe 91 PID 2992 wrote to memory of 2832 2992 fxfxrlf.exe 91 PID 2992 wrote to memory of 2832 2992 fxfxrlf.exe 91 PID 2832 wrote to memory of 3288 2832 xflrllf.exe 92 PID 2832 wrote to memory of 3288 2832 xflrllf.exe 92 PID 2832 wrote to memory of 3288 2832 xflrllf.exe 92 PID 3288 wrote to memory of 5104 3288 vjjjd.exe 93 PID 3288 wrote to memory of 5104 3288 vjjjd.exe 93 PID 3288 wrote to memory of 5104 3288 vjjjd.exe 93 PID 5104 wrote to memory of 3124 5104 dvdvp.exe 94 PID 5104 wrote to memory of 3124 5104 dvdvp.exe 94 PID 5104 wrote to memory of 3124 5104 dvdvp.exe 94 PID 3124 wrote to memory of 1112 3124 xlrffxf.exe 95 PID 3124 wrote to memory of 1112 3124 xlrffxf.exe 95 PID 3124 wrote to memory of 1112 3124 xlrffxf.exe 95 PID 1112 wrote to memory of 3988 1112 ttbhtt.exe 96 PID 1112 wrote to memory of 3988 1112 ttbhtt.exe 96 PID 1112 wrote to memory of 3988 1112 ttbhtt.exe 96 PID 3988 wrote to memory of 2344 3988 7vddj.exe 97 PID 3988 wrote to memory of 2344 3988 7vddj.exe 97 PID 3988 wrote to memory of 2344 3988 7vddj.exe 97 PID 2344 wrote to memory of 4848 2344 ppdvj.exe 98 PID 2344 wrote to memory of 4848 2344 ppdvj.exe 98 PID 2344 wrote to memory of 4848 2344 ppdvj.exe 98 PID 4848 wrote to memory of 3448 4848 rxrrlrr.exe 99 PID 4848 wrote to memory of 3448 4848 rxrrlrr.exe 99 PID 4848 wrote to memory of 3448 4848 rxrrlrr.exe 99 PID 3448 wrote to memory of 3224 3448 hbtttt.exe 100 PID 3448 wrote to memory of 3224 3448 hbtttt.exe 100 PID 3448 wrote to memory of 3224 3448 hbtttt.exe 100 PID 3224 wrote to memory of 4116 3224 jdddv.exe 101 PID 3224 wrote to memory of 4116 3224 jdddv.exe 101 PID 3224 wrote to memory of 4116 3224 jdddv.exe 101 PID 4116 wrote to memory of 3472 4116 lfrlffx.exe 102 PID 4116 wrote to memory of 3472 4116 lfrlffx.exe 102 PID 4116 wrote to memory of 3472 4116 lfrlffx.exe 102 PID 3472 wrote to memory of 4572 3472 rxfllff.exe 103 PID 3472 wrote to memory of 4572 3472 rxfllff.exe 103 PID 3472 wrote to memory of 4572 3472 rxfllff.exe 103 PID 4572 wrote to memory of 4312 4572 nbbnbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c1381517c4540ec3eea864fefd62100_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6c1381517c4540ec3eea864fefd62100_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\bhtnhh.exec:\bhtnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\pdvjd.exec:\pdvjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\vvpdp.exec:\vvpdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\rfffxff.exec:\rfffxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\bntbhb.exec:\bntbhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\nhhbnb.exec:\nhhbnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\dvdpd.exec:\dvdpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\xflrllf.exec:\xflrllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\vjjjd.exec:\vjjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\dvdvp.exec:\dvdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\xlrffxf.exec:\xlrffxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\ttbhtt.exec:\ttbhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\7vddj.exec:\7vddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\ppdvj.exec:\ppdvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\rxrrlrr.exec:\rxrrlrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\hbtttt.exec:\hbtttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\jdddv.exec:\jdddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\lfrlffx.exec:\lfrlffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\rxfllff.exec:\rxfllff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\nbbnbb.exec:\nbbnbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\pjjjv.exec:\pjjjv.exe23⤵
- Executes dropped EXE
PID:4312 -
\??\c:\vpvpj.exec:\vpvpj.exe24⤵
- Executes dropped EXE
PID:3208 -
\??\c:\xlffrrl.exec:\xlffrrl.exe25⤵
- Executes dropped EXE
PID:1136 -
\??\c:\3bhbtn.exec:\3bhbtn.exe26⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tbtnhb.exec:\tbtnhb.exe27⤵
- Executes dropped EXE
PID:4636 -
\??\c:\xrxrrlr.exec:\xrxrrlr.exe28⤵
- Executes dropped EXE
PID:4424 -
\??\c:\xrfffll.exec:\xrfffll.exe29⤵
- Executes dropped EXE
PID:4808 -
\??\c:\hbhbtt.exec:\hbhbtt.exe30⤵
- Executes dropped EXE
PID:4820 -
\??\c:\tnnbtn.exec:\tnnbtn.exe31⤵
- Executes dropped EXE
PID:3504 -
\??\c:\dvppj.exec:\dvppj.exe32⤵
- Executes dropped EXE
PID:3968 -
\??\c:\lxlfxff.exec:\lxlfxff.exe33⤵
- Executes dropped EXE
PID:3180 -
\??\c:\hbhbbh.exec:\hbhbbh.exe34⤵
- Executes dropped EXE
PID:2388 -
\??\c:\btttnn.exec:\btttnn.exe35⤵
- Executes dropped EXE
PID:4244 -
\??\c:\vjdvj.exec:\vjdvj.exe36⤵
- Executes dropped EXE
PID:1044 -
\??\c:\xflfffx.exec:\xflfffx.exe37⤵
- Executes dropped EXE
PID:4688 -
\??\c:\lfllrff.exec:\lfllrff.exe38⤵
- Executes dropped EXE
PID:4484 -
\??\c:\nhhtth.exec:\nhhtth.exe39⤵
- Executes dropped EXE
PID:1484 -
\??\c:\pjjjd.exec:\pjjjd.exe40⤵
- Executes dropped EXE
PID:1940 -
\??\c:\9jjdv.exec:\9jjdv.exe41⤵
- Executes dropped EXE
PID:4328 -
\??\c:\frrlxrf.exec:\frrlxrf.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\1lffxxr.exec:\1lffxxr.exe43⤵
- Executes dropped EXE
PID:3344 -
\??\c:\5bhhhn.exec:\5bhhhn.exe44⤵
- Executes dropped EXE
PID:3956 -
\??\c:\jppjv.exec:\jppjv.exe45⤵
- Executes dropped EXE
PID:4800 -
\??\c:\jddvp.exec:\jddvp.exe46⤵
- Executes dropped EXE
PID:212 -
\??\c:\vvdvp.exec:\vvdvp.exe47⤵
- Executes dropped EXE
PID:1608 -
\??\c:\fxfrxrx.exec:\fxfrxrx.exe48⤵
- Executes dropped EXE
PID:4844 -
\??\c:\9llfxxx.exec:\9llfxxx.exe49⤵
- Executes dropped EXE
PID:5008 -
\??\c:\5htttn.exec:\5htttn.exe50⤵
- Executes dropped EXE
PID:4168 -
\??\c:\dvdvj.exec:\dvdvj.exe51⤵
- Executes dropped EXE
PID:3668 -
\??\c:\dvdpp.exec:\dvdpp.exe52⤵
- Executes dropped EXE
PID:4804 -
\??\c:\rflfxxx.exec:\rflfxxx.exe53⤵
- Executes dropped EXE
PID:5076 -
\??\c:\9lrlllf.exec:\9lrlllf.exe54⤵
- Executes dropped EXE
PID:1200 -
\??\c:\5bbbtn.exec:\5bbbtn.exe55⤵
- Executes dropped EXE
PID:1628 -
\??\c:\5ddpj.exec:\5ddpj.exe56⤵
- Executes dropped EXE
PID:5104 -
\??\c:\pddvp.exec:\pddvp.exe57⤵
- Executes dropped EXE
PID:656 -
\??\c:\9frlffl.exec:\9frlffl.exe58⤵
- Executes dropped EXE
PID:332 -
\??\c:\9lrlfxx.exec:\9lrlfxx.exe59⤵
- Executes dropped EXE
PID:2356 -
\??\c:\htttnh.exec:\htttnh.exe60⤵
- Executes dropped EXE
PID:4028 -
\??\c:\tnhhhh.exec:\tnhhhh.exe61⤵
- Executes dropped EXE
PID:5092 -
\??\c:\jvvpv.exec:\jvvpv.exe62⤵
- Executes dropped EXE
PID:3612 -
\??\c:\1jppj.exec:\1jppj.exe63⤵
- Executes dropped EXE
PID:4880 -
\??\c:\rllfxxx.exec:\rllfxxx.exe64⤵
- Executes dropped EXE
PID:3764 -
\??\c:\lfflflf.exec:\lfflflf.exe65⤵
- Executes dropped EXE
PID:1508 -
\??\c:\7nnhtt.exec:\7nnhtt.exe66⤵PID:4596
-
\??\c:\ttnnnn.exec:\ttnnnn.exe67⤵PID:740
-
\??\c:\vppjv.exec:\vppjv.exe68⤵PID:952
-
\??\c:\ppdvd.exec:\ppdvd.exe69⤵PID:3108
-
\??\c:\frrlffx.exec:\frrlffx.exe70⤵PID:5096
-
\??\c:\7xfrrrx.exec:\7xfrrrx.exe71⤵PID:1664
-
\??\c:\bntnhh.exec:\bntnhh.exe72⤵PID:2396
-
\??\c:\3bnhtt.exec:\3bnhtt.exe73⤵PID:2924
-
\??\c:\dvvjd.exec:\dvvjd.exe74⤵PID:4412
-
\??\c:\dvvpj.exec:\dvvpj.exe75⤵PID:4372
-
\??\c:\lflllfr.exec:\lflllfr.exe76⤵PID:4644
-
\??\c:\1hnttb.exec:\1hnttb.exe77⤵PID:2248
-
\??\c:\dvvjp.exec:\dvvjp.exe78⤵PID:4900
-
\??\c:\jpjdv.exec:\jpjdv.exe79⤵PID:2600
-
\??\c:\lxffxff.exec:\lxffxff.exe80⤵PID:1952
-
\??\c:\tnnhhb.exec:\tnnhhb.exe81⤵PID:5108
-
\??\c:\1nttbb.exec:\1nttbb.exe82⤵PID:2580
-
\??\c:\djppp.exec:\djppp.exe83⤵PID:4812
-
\??\c:\rxxrllf.exec:\rxxrllf.exe84⤵PID:964
-
\??\c:\frxxxxx.exec:\frxxxxx.exe85⤵PID:4904
-
\??\c:\7tttnn.exec:\7tttnn.exe86⤵PID:3664
-
\??\c:\djvvd.exec:\djvvd.exe87⤵PID:3188
-
\??\c:\xrfrxxl.exec:\xrfrxxl.exe88⤵PID:4672
-
\??\c:\9bbbtt.exec:\9bbbtt.exe89⤵PID:412
-
\??\c:\vpvvp.exec:\vpvvp.exe90⤵PID:2328
-
\??\c:\xxflffl.exec:\xxflffl.exe91⤵PID:3148
-
\??\c:\thnntn.exec:\thnntn.exe92⤵PID:3884
-
\??\c:\jvjdv.exec:\jvjdv.exe93⤵PID:3936
-
\??\c:\lrlxrlf.exec:\lrlxrlf.exe94⤵PID:4556
-
\??\c:\nhhhbb.exec:\nhhhbb.exe95⤵PID:1140
-
\??\c:\djjvp.exec:\djjvp.exe96⤵PID:4368
-
\??\c:\jpddd.exec:\jpddd.exe97⤵PID:3844
-
\??\c:\flrlfxr.exec:\flrlfxr.exe98⤵PID:3348
-
\??\c:\tnhhbn.exec:\tnhhbn.exe99⤵PID:940
-
\??\c:\3jvpj.exec:\3jvpj.exe100⤵PID:4868
-
\??\c:\xrlfffx.exec:\xrlfffx.exe101⤵PID:1832
-
\??\c:\vpjpj.exec:\vpjpj.exe102⤵PID:1980
-
\??\c:\jvdpj.exec:\jvdpj.exe103⤵PID:4152
-
\??\c:\rffrlfx.exec:\rffrlfx.exe104⤵PID:384
-
\??\c:\xrrrlfx.exec:\xrrrlfx.exe105⤵PID:780
-
\??\c:\tbhbbb.exec:\tbhbbb.exe106⤵PID:1492
-
\??\c:\1tbbtt.exec:\1tbbtt.exe107⤵PID:1112
-
\??\c:\3djpv.exec:\3djpv.exe108⤵PID:3988
-
\??\c:\pdjvv.exec:\pdjvv.exe109⤵PID:3252
-
\??\c:\xlffrrx.exec:\xlffrrx.exe110⤵PID:3152
-
\??\c:\hbhbtt.exec:\hbhbtt.exe111⤵PID:3684
-
\??\c:\9jpdv.exec:\9jpdv.exe112⤵PID:3000
-
\??\c:\vvvvp.exec:\vvvvp.exe113⤵PID:2648
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe114⤵PID:1036
-
\??\c:\ffrlffr.exec:\ffrlffr.exe115⤵PID:4596
-
\??\c:\nnnbth.exec:\nnnbth.exe116⤵PID:740
-
\??\c:\5hhhbb.exec:\5hhhbb.exe117⤵PID:952
-
\??\c:\jpdpd.exec:\jpdpd.exe118⤵PID:3108
-
\??\c:\xlrlxrl.exec:\xlrlxrl.exe119⤵PID:2728
-
\??\c:\lrffxrl.exec:\lrffxrl.exe120⤵PID:3256
-
\??\c:\hhttbb.exec:\hhttbb.exe121⤵PID:4064
-
\??\c:\vppjj.exec:\vppjj.exe122⤵PID:4424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-