Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 11:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eb0d5802013db668be9c89585d10f940_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
eb0d5802013db668be9c89585d10f940_NeikiAnalytics.exe
-
Size
61KB
-
MD5
eb0d5802013db668be9c89585d10f940
-
SHA1
ab80ad62580d795cbfe08bc46158f25f975f83dd
-
SHA256
814fad9d538970814edfab2489098ad61ed10fcec27b3208155226cbf7f6fd58
-
SHA512
19b7952b33fa5da56434838994902948886e0b879547cfd9e3b501a756da7fd580db039501fb81f1f545463f5b1af8551a5d4365991ca4c06143b721e396d5db
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIug6b+:ymb3NkkiQ3mdBjFIugR
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/64-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2252-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3444-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3816-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1044-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2656-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2608-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3528 vpdjj.exe 2252 fxrfrlf.exe 2948 tntttn.exe 3360 5hnhtt.exe 3692 jdvpd.exe 536 vvppd.exe 3444 xxlfllx.exe 2756 nbnbtb.exe 3984 1jdvd.exe 4776 7lxlfxr.exe 4824 hbnhtn.exe 2008 7jjdd.exe 3572 vdddp.exe 3816 lffxlff.exe 4388 lrrlxrl.exe 2944 1bbnbb.exe 4792 pjvvp.exe 1044 xfxrfxl.exe 2656 fxfxxrx.exe 3160 bnnhtt.exe 2608 5lxrxrf.exe 5076 pjjvp.exe 1860 lrxrfxl.exe 1176 lflflff.exe 816 1bhttn.exe 4556 3dvjd.exe 3836 1jdpd.exe 2068 xllfrlf.exe 3664 5rfxlfx.exe 4508 hnnhbb.exe 3264 vdddj.exe 1372 dvjpd.exe 968 ffxrxxx.exe 4364 3xrrlff.exe 4780 bttbtn.exe 2052 vppjd.exe 4268 1jpjj.exe 1248 7lffrll.exe 4836 xlrlrlx.exe 4964 tthtth.exe 3360 bnthtt.exe 1992 pdjdd.exe 5020 frrrlrf.exe 4156 bbbbtt.exe 3444 hhttth.exe 1668 pvdvj.exe 4452 rlflxfl.exe 2980 lflffff.exe 4776 btnbbb.exe 916 pjjjd.exe 880 1ddvj.exe 4288 rrlfrrl.exe 2892 1nbbnb.exe 4800 7jdvj.exe 772 ddvvj.exe 1140 fflfrlf.exe 5104 tbbhnb.exe 1360 pvvjv.exe 1436 pjjdd.exe 4040 lxfrxlf.exe 5000 5ffxrll.exe 1448 frlxrlf.exe 3500 bhhbtt.exe 5076 vpjvj.exe -
resource yara_rule behavioral2/memory/64-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3444-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1044-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2608-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 64 wrote to memory of 3528 64 eb0d5802013db668be9c89585d10f940_NeikiAnalytics.exe 85 PID 64 wrote to memory of 3528 64 eb0d5802013db668be9c89585d10f940_NeikiAnalytics.exe 85 PID 64 wrote to memory of 3528 64 eb0d5802013db668be9c89585d10f940_NeikiAnalytics.exe 85 PID 3528 wrote to memory of 2252 3528 vpdjj.exe 86 PID 3528 wrote to memory of 2252 3528 vpdjj.exe 86 PID 3528 wrote to memory of 2252 3528 vpdjj.exe 86 PID 2252 wrote to memory of 2948 2252 fxrfrlf.exe 87 PID 2252 wrote to memory of 2948 2252 fxrfrlf.exe 87 PID 2252 wrote to memory of 2948 2252 fxrfrlf.exe 87 PID 2948 wrote to memory of 3360 2948 tntttn.exe 88 PID 2948 wrote to memory of 3360 2948 tntttn.exe 88 PID 2948 wrote to memory of 3360 2948 tntttn.exe 88 PID 3360 wrote to memory of 3692 3360 5hnhtt.exe 89 PID 3360 wrote to memory of 3692 3360 5hnhtt.exe 89 PID 3360 wrote to memory of 3692 3360 5hnhtt.exe 89 PID 3692 wrote to memory of 536 3692 jdvpd.exe 90 PID 3692 wrote to memory of 536 3692 jdvpd.exe 90 PID 3692 wrote to memory of 536 3692 jdvpd.exe 90 PID 536 wrote to memory of 3444 536 vvppd.exe 91 PID 536 wrote to memory of 3444 536 vvppd.exe 91 PID 536 wrote to memory of 3444 536 vvppd.exe 91 PID 3444 wrote to memory of 2756 3444 xxlfllx.exe 92 PID 3444 wrote to memory of 2756 3444 xxlfllx.exe 92 PID 3444 wrote to memory of 2756 3444 xxlfllx.exe 92 PID 2756 wrote to memory of 3984 2756 nbnbtb.exe 93 PID 2756 wrote to memory of 3984 2756 nbnbtb.exe 93 PID 2756 wrote to memory of 3984 2756 nbnbtb.exe 93 PID 3984 wrote to memory of 4776 3984 1jdvd.exe 94 PID 3984 wrote to memory of 4776 3984 1jdvd.exe 94 PID 3984 wrote to memory of 4776 3984 1jdvd.exe 94 PID 4776 wrote to memory of 4824 4776 7lxlfxr.exe 95 PID 4776 wrote to memory of 4824 4776 7lxlfxr.exe 95 PID 4776 wrote to memory of 4824 4776 7lxlfxr.exe 95 PID 4824 wrote to memory of 2008 4824 hbnhtn.exe 96 PID 4824 wrote to memory of 2008 4824 hbnhtn.exe 96 PID 4824 wrote to memory of 2008 4824 hbnhtn.exe 96 PID 2008 wrote to memory of 3572 2008 7jjdd.exe 97 PID 2008 wrote to memory of 3572 2008 7jjdd.exe 97 PID 2008 wrote to memory of 3572 2008 7jjdd.exe 97 PID 3572 wrote to memory of 3816 3572 vdddp.exe 98 PID 3572 wrote to memory of 3816 3572 vdddp.exe 98 PID 3572 wrote to memory of 3816 3572 vdddp.exe 98 PID 3816 wrote to memory of 4388 3816 lffxlff.exe 99 PID 3816 wrote to memory of 4388 3816 lffxlff.exe 99 PID 3816 wrote to memory of 4388 3816 lffxlff.exe 99 PID 4388 wrote to memory of 2944 4388 lrrlxrl.exe 100 PID 4388 wrote to memory of 2944 4388 lrrlxrl.exe 100 PID 4388 wrote to memory of 2944 4388 lrrlxrl.exe 100 PID 2944 wrote to memory of 4792 2944 1bbnbb.exe 101 PID 2944 wrote to memory of 4792 2944 1bbnbb.exe 101 PID 2944 wrote to memory of 4792 2944 1bbnbb.exe 101 PID 4792 wrote to memory of 1044 4792 pjvvp.exe 102 PID 4792 wrote to memory of 1044 4792 pjvvp.exe 102 PID 4792 wrote to memory of 1044 4792 pjvvp.exe 102 PID 1044 wrote to memory of 2656 1044 xfxrfxl.exe 103 PID 1044 wrote to memory of 2656 1044 xfxrfxl.exe 103 PID 1044 wrote to memory of 2656 1044 xfxrfxl.exe 103 PID 2656 wrote to memory of 3160 2656 fxfxxrx.exe 104 PID 2656 wrote to memory of 3160 2656 fxfxxrx.exe 104 PID 2656 wrote to memory of 3160 2656 fxfxxrx.exe 104 PID 3160 wrote to memory of 2608 3160 bnnhtt.exe 105 PID 3160 wrote to memory of 2608 3160 bnnhtt.exe 105 PID 3160 wrote to memory of 2608 3160 bnnhtt.exe 105 PID 2608 wrote to memory of 5076 2608 5lxrxrf.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb0d5802013db668be9c89585d10f940_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\eb0d5802013db668be9c89585d10f940_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\vpdjj.exec:\vpdjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\fxrfrlf.exec:\fxrfrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\tntttn.exec:\tntttn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\5hnhtt.exec:\5hnhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\jdvpd.exec:\jdvpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\vvppd.exec:\vvppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\xxlfllx.exec:\xxlfllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\nbnbtb.exec:\nbnbtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\1jdvd.exec:\1jdvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\7lxlfxr.exec:\7lxlfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\hbnhtn.exec:\hbnhtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\7jjdd.exec:\7jjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\vdddp.exec:\vdddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\lffxlff.exec:\lffxlff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\lrrlxrl.exec:\lrrlxrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\1bbnbb.exec:\1bbnbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\pjvvp.exec:\pjvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\xfxrfxl.exec:\xfxrfxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\fxfxxrx.exec:\fxfxxrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\bnnhtt.exec:\bnnhtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\5lxrxrf.exec:\5lxrxrf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\pjjvp.exec:\pjjvp.exe23⤵
- Executes dropped EXE
PID:5076 -
\??\c:\lrxrfxl.exec:\lrxrfxl.exe24⤵
- Executes dropped EXE
PID:1860 -
\??\c:\lflflff.exec:\lflflff.exe25⤵
- Executes dropped EXE
PID:1176 -
\??\c:\1bhttn.exec:\1bhttn.exe26⤵
- Executes dropped EXE
PID:816 -
\??\c:\3dvjd.exec:\3dvjd.exe27⤵
- Executes dropped EXE
PID:4556 -
\??\c:\1jdpd.exec:\1jdpd.exe28⤵
- Executes dropped EXE
PID:3836 -
\??\c:\xllfrlf.exec:\xllfrlf.exe29⤵
- Executes dropped EXE
PID:2068 -
\??\c:\5rfxlfx.exec:\5rfxlfx.exe30⤵
- Executes dropped EXE
PID:3664 -
\??\c:\hnnhbb.exec:\hnnhbb.exe31⤵
- Executes dropped EXE
PID:4508 -
\??\c:\vdddj.exec:\vdddj.exe32⤵
- Executes dropped EXE
PID:3264 -
\??\c:\dvjpd.exec:\dvjpd.exe33⤵
- Executes dropped EXE
PID:1372 -
\??\c:\ffxrxxx.exec:\ffxrxxx.exe34⤵
- Executes dropped EXE
PID:968 -
\??\c:\3xrrlff.exec:\3xrrlff.exe35⤵
- Executes dropped EXE
PID:4364 -
\??\c:\bttbtn.exec:\bttbtn.exe36⤵
- Executes dropped EXE
PID:4780 -
\??\c:\vppjd.exec:\vppjd.exe37⤵
- Executes dropped EXE
PID:2052 -
\??\c:\1jpjj.exec:\1jpjj.exe38⤵
- Executes dropped EXE
PID:4268 -
\??\c:\7lffrll.exec:\7lffrll.exe39⤵
- Executes dropped EXE
PID:1248 -
\??\c:\xlrlrlx.exec:\xlrlrlx.exe40⤵
- Executes dropped EXE
PID:4836 -
\??\c:\tthtth.exec:\tthtth.exe41⤵
- Executes dropped EXE
PID:4964 -
\??\c:\bnthtt.exec:\bnthtt.exe42⤵
- Executes dropped EXE
PID:3360 -
\??\c:\pdjdd.exec:\pdjdd.exe43⤵
- Executes dropped EXE
PID:1992 -
\??\c:\frrrlrf.exec:\frrrlrf.exe44⤵
- Executes dropped EXE
PID:5020 -
\??\c:\bbbbtt.exec:\bbbbtt.exe45⤵
- Executes dropped EXE
PID:4156 -
\??\c:\hhttth.exec:\hhttth.exe46⤵
- Executes dropped EXE
PID:3444 -
\??\c:\pvdvj.exec:\pvdvj.exe47⤵
- Executes dropped EXE
PID:1668 -
\??\c:\rlflxfl.exec:\rlflxfl.exe48⤵
- Executes dropped EXE
PID:4452 -
\??\c:\lflffff.exec:\lflffff.exe49⤵
- Executes dropped EXE
PID:2980 -
\??\c:\btnbbb.exec:\btnbbb.exe50⤵
- Executes dropped EXE
PID:4776 -
\??\c:\pjjjd.exec:\pjjjd.exe51⤵
- Executes dropped EXE
PID:916 -
\??\c:\1ddvj.exec:\1ddvj.exe52⤵
- Executes dropped EXE
PID:880 -
\??\c:\rrlfrrl.exec:\rrlfrrl.exe53⤵
- Executes dropped EXE
PID:4288 -
\??\c:\1nbbnb.exec:\1nbbnb.exe54⤵
- Executes dropped EXE
PID:2892 -
\??\c:\7jdvj.exec:\7jdvj.exe55⤵
- Executes dropped EXE
PID:4800 -
\??\c:\ddvvj.exec:\ddvvj.exe56⤵
- Executes dropped EXE
PID:772 -
\??\c:\fflfrlf.exec:\fflfrlf.exe57⤵
- Executes dropped EXE
PID:1140 -
\??\c:\tbbhnb.exec:\tbbhnb.exe58⤵
- Executes dropped EXE
PID:5104 -
\??\c:\pvvjv.exec:\pvvjv.exe59⤵
- Executes dropped EXE
PID:1360 -
\??\c:\pjjdd.exec:\pjjdd.exe60⤵
- Executes dropped EXE
PID:1436 -
\??\c:\lxfrxlf.exec:\lxfrxlf.exe61⤵
- Executes dropped EXE
PID:4040 -
\??\c:\5ffxrll.exec:\5ffxrll.exe62⤵
- Executes dropped EXE
PID:5000 -
\??\c:\frlxrlf.exec:\frlxrlf.exe63⤵
- Executes dropped EXE
PID:1448 -
\??\c:\bhhbtt.exec:\bhhbtt.exe64⤵
- Executes dropped EXE
PID:3500 -
\??\c:\vpjvj.exec:\vpjvj.exe65⤵
- Executes dropped EXE
PID:5076 -
\??\c:\dvdvd.exec:\dvdvd.exe66⤵PID:1860
-
\??\c:\rffxlfx.exec:\rffxlfx.exe67⤵PID:2916
-
\??\c:\rrxrlfr.exec:\rrxrlfr.exe68⤵PID:4468
-
\??\c:\thntnn.exec:\thntnn.exe69⤵PID:404
-
\??\c:\hnthht.exec:\hnthht.exe70⤵PID:4520
-
\??\c:\5dvdp.exec:\5dvdp.exe71⤵PID:4668
-
\??\c:\dvjjd.exec:\dvjjd.exe72⤵PID:2068
-
\??\c:\xffrxxl.exec:\xffrxxl.exe73⤵PID:1920
-
\??\c:\xxxxrrx.exec:\xxxxrrx.exe74⤵PID:2732
-
\??\c:\7nnhtn.exec:\7nnhtn.exe75⤵PID:3116
-
\??\c:\hbbtht.exec:\hbbtht.exe76⤵PID:2864
-
\??\c:\jdjdj.exec:\jdjdj.exe77⤵PID:4592
-
\??\c:\lrlfllf.exec:\lrlfllf.exe78⤵PID:3936
-
\??\c:\fxfrrlr.exec:\fxfrrlr.exe79⤵PID:5116
-
\??\c:\ttnhbb.exec:\ttnhbb.exe80⤵PID:3620
-
\??\c:\nttbnn.exec:\nttbnn.exe81⤵PID:3188
-
\??\c:\vddvj.exec:\vddvj.exe82⤵PID:2252
-
\??\c:\lxfrflf.exec:\lxfrflf.exe83⤵PID:4836
-
\??\c:\7fxrlfx.exec:\7fxrlfx.exe84⤵PID:448
-
\??\c:\tbbthb.exec:\tbbthb.exe85⤵PID:4236
-
\??\c:\thbnbt.exec:\thbnbt.exe86⤵PID:3360
-
\??\c:\jpvpd.exec:\jpvpd.exe87⤵PID:2224
-
\??\c:\jvjvd.exec:\jvjvd.exe88⤵PID:1812
-
\??\c:\fflfrrf.exec:\fflfrrf.exe89⤵PID:2220
-
\??\c:\bnhntt.exec:\bnhntt.exe90⤵PID:2756
-
\??\c:\hnnbtt.exec:\hnnbtt.exe91⤵PID:4404
-
\??\c:\dvvjd.exec:\dvvjd.exe92⤵PID:3704
-
\??\c:\fxxrffx.exec:\fxxrffx.exe93⤵PID:2340
-
\??\c:\lxxfxxx.exec:\lxxfxxx.exe94⤵PID:1896
-
\??\c:\btbbth.exec:\btbbth.exe95⤵PID:8
-
\??\c:\1bbbtt.exec:\1bbbtt.exe96⤵PID:4852
-
\??\c:\vvjdd.exec:\vvjdd.exe97⤵PID:3184
-
\??\c:\vpjjp.exec:\vpjjp.exe98⤵PID:3028
-
\??\c:\xfrlffx.exec:\xfrlffx.exe99⤵PID:2588
-
\??\c:\5xxfxrr.exec:\5xxfxrr.exe100⤵PID:4672
-
\??\c:\thnnhb.exec:\thnnhb.exe101⤵PID:3136
-
\??\c:\tntnbb.exec:\tntnbb.exe102⤵PID:3596
-
\??\c:\5vvpj.exec:\5vvpj.exe103⤵PID:1504
-
\??\c:\vpjvj.exec:\vpjvj.exe104⤵PID:408
-
\??\c:\rrlfflr.exec:\rrlfflr.exe105⤵PID:2128
-
\??\c:\thtnhb.exec:\thtnhb.exe106⤵PID:3468
-
\??\c:\5vvjj.exec:\5vvjj.exe107⤵PID:1608
-
\??\c:\pvpjp.exec:\pvpjp.exe108⤵PID:4004
-
\??\c:\fxfxlfr.exec:\fxfxlfr.exe109⤵PID:1692
-
\??\c:\5bnhbt.exec:\5bnhbt.exe110⤵PID:1860
-
\??\c:\tbbtnh.exec:\tbbtnh.exe111⤵PID:5108
-
\??\c:\jpvdd.exec:\jpvdd.exe112⤵PID:4028
-
\??\c:\dvdvv.exec:\dvdvv.exe113⤵PID:1000
-
\??\c:\frxrfxr.exec:\frxrfxr.exe114⤵PID:4520
-
\??\c:\bnbbtt.exec:\bnbbtt.exe115⤵PID:4668
-
\??\c:\vppjd.exec:\vppjd.exe116⤵PID:3420
-
\??\c:\3dvpj.exec:\3dvpj.exe117⤵PID:2436
-
\??\c:\lllxlfx.exec:\lllxlfx.exe118⤵PID:3324
-
\??\c:\thhthb.exec:\thhthb.exe119⤵PID:2420
-
\??\c:\9jdvd.exec:\9jdvd.exe120⤵PID:4356
-
\??\c:\ddvjv.exec:\ddvjv.exe121⤵PID:1636
-
\??\c:\lfxrlxr.exec:\lfxrlxr.exe122⤵PID:4008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-