Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 10:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e5f84a35e927bed93650998a0f6493b0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
e5f84a35e927bed93650998a0f6493b0_NeikiAnalytics.exe
-
Size
367KB
-
MD5
e5f84a35e927bed93650998a0f6493b0
-
SHA1
a0cdcff698e00f3648f386227c2d0dfbd933bcf3
-
SHA256
579f2d15b42b6f08fa0464da4ba705eb1415701fefd83f4ef4ab6eb5bb257d98
-
SHA512
085066558b8b0c5e5c120f8daabd932e29758484d9d2d6a1f49ddd86a9dac05521dacda352dcbe248eeec8a86bf853ce54a10cbb3db8a25fdb65a656e521954b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9FrHSwh/c/hdTWGIaxJ8TN005pWmjVwdSsyL:n3C9BRo7tvnJ9Fywhk/T7xyTpShZ6
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/3156-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2504-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/968-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/560-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2360-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 968 flxxffx.exe 3688 nntttt.exe 2504 jppjj.exe 4200 dvjdp.exe 228 rfxrrxl.exe 4012 djjdv.exe 1400 jpjvj.exe 2368 9thnbb.exe 3488 pvvpd.exe 4828 dpdvp.exe 2072 1tttnn.exe 3604 ppvpj.exe 3924 bbnnbb.exe 2768 rxrlfxx.exe 3460 hbnhth.exe 4724 jjdpd.exe 224 nnnnhh.exe 3124 vpddp.exe 2672 lxfxxfx.exe 560 tthhtn.exe 1944 nthbbb.exe 1676 vvdjv.exe 4304 flxxxrl.exe 2360 hbnhbt.exe 2668 frxfrfx.exe 2932 bhhbtn.exe 4316 5jjvv.exe 4308 xflflll.exe 3796 fflfrfl.exe 1584 nnbbbh.exe 1592 tbbntb.exe 2448 pjddj.exe 3132 rlllfrf.exe 4624 bthhtt.exe 2056 ddddj.exe 828 lxxfxff.exe 4984 bthbhh.exe 4408 ppdvp.exe 4160 rlrxxlf.exe 3044 bbhhnn.exe 5096 pjjdj.exe 5056 lfxxxfl.exe 3056 nnttbb.exe 4492 xlrxfrf.exe 3152 hhtbhb.exe 436 hhtbhn.exe 1884 djvvv.exe 1128 9frxfrr.exe 3488 1bhhnb.exe 2332 djvdd.exe 5040 jdvdd.exe 1332 lflrxff.exe 1704 bbbbhn.exe 2760 nnbtbb.exe 3064 pvvvd.exe 2204 lfrfrxx.exe 2940 hnnnth.exe 208 ddjpv.exe 3892 lfflflf.exe 3960 nbhnbh.exe 4456 vjjvp.exe 3108 frxrxrf.exe 4428 bnhbhh.exe 4832 jdpvv.exe -
resource yara_rule behavioral2/memory/3156-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2504-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/968-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/560-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2360-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-179-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3156 wrote to memory of 968 3156 e5f84a35e927bed93650998a0f6493b0_NeikiAnalytics.exe 83 PID 3156 wrote to memory of 968 3156 e5f84a35e927bed93650998a0f6493b0_NeikiAnalytics.exe 83 PID 3156 wrote to memory of 968 3156 e5f84a35e927bed93650998a0f6493b0_NeikiAnalytics.exe 83 PID 968 wrote to memory of 3688 968 flxxffx.exe 84 PID 968 wrote to memory of 3688 968 flxxffx.exe 84 PID 968 wrote to memory of 3688 968 flxxffx.exe 84 PID 3688 wrote to memory of 2504 3688 nntttt.exe 85 PID 3688 wrote to memory of 2504 3688 nntttt.exe 85 PID 3688 wrote to memory of 2504 3688 nntttt.exe 85 PID 2504 wrote to memory of 4200 2504 jppjj.exe 86 PID 2504 wrote to memory of 4200 2504 jppjj.exe 86 PID 2504 wrote to memory of 4200 2504 jppjj.exe 86 PID 4200 wrote to memory of 228 4200 dvjdp.exe 87 PID 4200 wrote to memory of 228 4200 dvjdp.exe 87 PID 4200 wrote to memory of 228 4200 dvjdp.exe 87 PID 228 wrote to memory of 4012 228 rfxrrxl.exe 88 PID 228 wrote to memory of 4012 228 rfxrrxl.exe 88 PID 228 wrote to memory of 4012 228 rfxrrxl.exe 88 PID 4012 wrote to memory of 1400 4012 djjdv.exe 89 PID 4012 wrote to memory of 1400 4012 djjdv.exe 89 PID 4012 wrote to memory of 1400 4012 djjdv.exe 89 PID 1400 wrote to memory of 2368 1400 jpjvj.exe 90 PID 1400 wrote to memory of 2368 1400 jpjvj.exe 90 PID 1400 wrote to memory of 2368 1400 jpjvj.exe 90 PID 2368 wrote to memory of 3488 2368 9thnbb.exe 91 PID 2368 wrote to memory of 3488 2368 9thnbb.exe 91 PID 2368 wrote to memory of 3488 2368 9thnbb.exe 91 PID 3488 wrote to memory of 4828 3488 pvvpd.exe 92 PID 3488 wrote to memory of 4828 3488 pvvpd.exe 92 PID 3488 wrote to memory of 4828 3488 pvvpd.exe 92 PID 4828 wrote to memory of 2072 4828 dpdvp.exe 93 PID 4828 wrote to memory of 2072 4828 dpdvp.exe 93 PID 4828 wrote to memory of 2072 4828 dpdvp.exe 93 PID 2072 wrote to memory of 3604 2072 1tttnn.exe 94 PID 2072 wrote to memory of 3604 2072 1tttnn.exe 94 PID 2072 wrote to memory of 3604 2072 1tttnn.exe 94 PID 3604 wrote to memory of 3924 3604 ppvpj.exe 95 PID 3604 wrote to memory of 3924 3604 ppvpj.exe 95 PID 3604 wrote to memory of 3924 3604 ppvpj.exe 95 PID 3924 wrote to memory of 2768 3924 bbnnbb.exe 96 PID 3924 wrote to memory of 2768 3924 bbnnbb.exe 96 PID 3924 wrote to memory of 2768 3924 bbnnbb.exe 96 PID 2768 wrote to memory of 3460 2768 rxrlfxx.exe 97 PID 2768 wrote to memory of 3460 2768 rxrlfxx.exe 97 PID 2768 wrote to memory of 3460 2768 rxrlfxx.exe 97 PID 3460 wrote to memory of 4724 3460 hbnhth.exe 98 PID 3460 wrote to memory of 4724 3460 hbnhth.exe 98 PID 3460 wrote to memory of 4724 3460 hbnhth.exe 98 PID 4724 wrote to memory of 224 4724 jjdpd.exe 99 PID 4724 wrote to memory of 224 4724 jjdpd.exe 99 PID 4724 wrote to memory of 224 4724 jjdpd.exe 99 PID 224 wrote to memory of 3124 224 nnnnhh.exe 100 PID 224 wrote to memory of 3124 224 nnnnhh.exe 100 PID 224 wrote to memory of 3124 224 nnnnhh.exe 100 PID 3124 wrote to memory of 2672 3124 vpddp.exe 101 PID 3124 wrote to memory of 2672 3124 vpddp.exe 101 PID 3124 wrote to memory of 2672 3124 vpddp.exe 101 PID 2672 wrote to memory of 560 2672 lxfxxfx.exe 102 PID 2672 wrote to memory of 560 2672 lxfxxfx.exe 102 PID 2672 wrote to memory of 560 2672 lxfxxfx.exe 102 PID 560 wrote to memory of 1944 560 tthhtn.exe 103 PID 560 wrote to memory of 1944 560 tthhtn.exe 103 PID 560 wrote to memory of 1944 560 tthhtn.exe 103 PID 1944 wrote to memory of 1676 1944 nthbbb.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5f84a35e927bed93650998a0f6493b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e5f84a35e927bed93650998a0f6493b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\flxxffx.exec:\flxxffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\nntttt.exec:\nntttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\jppjj.exec:\jppjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\dvjdp.exec:\dvjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\rfxrrxl.exec:\rfxrrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\djjdv.exec:\djjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\jpjvj.exec:\jpjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\9thnbb.exec:\9thnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\pvvpd.exec:\pvvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\dpdvp.exec:\dpdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\1tttnn.exec:\1tttnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\ppvpj.exec:\ppvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\bbnnbb.exec:\bbnnbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\rxrlfxx.exec:\rxrlfxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\hbnhth.exec:\hbnhth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\jjdpd.exec:\jjdpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\nnnnhh.exec:\nnnnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\vpddp.exec:\vpddp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\lxfxxfx.exec:\lxfxxfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\tthhtn.exec:\tthhtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\nthbbb.exec:\nthbbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\vvdjv.exec:\vvdjv.exe23⤵
- Executes dropped EXE
PID:1676 -
\??\c:\flxxxrl.exec:\flxxxrl.exe24⤵
- Executes dropped EXE
PID:4304 -
\??\c:\hbnhbt.exec:\hbnhbt.exe25⤵
- Executes dropped EXE
PID:2360 -
\??\c:\frxfrfx.exec:\frxfrfx.exe26⤵
- Executes dropped EXE
PID:2668 -
\??\c:\bhhbtn.exec:\bhhbtn.exe27⤵
- Executes dropped EXE
PID:2932 -
\??\c:\5jjvv.exec:\5jjvv.exe28⤵
- Executes dropped EXE
PID:4316 -
\??\c:\xflflll.exec:\xflflll.exe29⤵
- Executes dropped EXE
PID:4308 -
\??\c:\fflfrfl.exec:\fflfrfl.exe30⤵
- Executes dropped EXE
PID:3796 -
\??\c:\nnbbbh.exec:\nnbbbh.exe31⤵
- Executes dropped EXE
PID:1584 -
\??\c:\tbbntb.exec:\tbbntb.exe32⤵
- Executes dropped EXE
PID:1592 -
\??\c:\pjddj.exec:\pjddj.exe33⤵
- Executes dropped EXE
PID:2448 -
\??\c:\rlllfrf.exec:\rlllfrf.exe34⤵
- Executes dropped EXE
PID:3132 -
\??\c:\bthhtt.exec:\bthhtt.exe35⤵
- Executes dropped EXE
PID:4624 -
\??\c:\ddddj.exec:\ddddj.exe36⤵
- Executes dropped EXE
PID:2056 -
\??\c:\lxxfxff.exec:\lxxfxff.exe37⤵
- Executes dropped EXE
PID:828 -
\??\c:\bthbhh.exec:\bthbhh.exe38⤵
- Executes dropped EXE
PID:4984 -
\??\c:\ppdvp.exec:\ppdvp.exe39⤵
- Executes dropped EXE
PID:4408 -
\??\c:\rlrxxlf.exec:\rlrxxlf.exe40⤵
- Executes dropped EXE
PID:4160 -
\??\c:\bbhhnn.exec:\bbhhnn.exe41⤵
- Executes dropped EXE
PID:3044 -
\??\c:\pjjdj.exec:\pjjdj.exe42⤵
- Executes dropped EXE
PID:5096 -
\??\c:\lfxxxfl.exec:\lfxxxfl.exe43⤵
- Executes dropped EXE
PID:5056 -
\??\c:\nnttbb.exec:\nnttbb.exe44⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xlrxfrf.exec:\xlrxfrf.exe45⤵
- Executes dropped EXE
PID:4492 -
\??\c:\hhtbhb.exec:\hhtbhb.exe46⤵
- Executes dropped EXE
PID:3152 -
\??\c:\hhtbhn.exec:\hhtbhn.exe47⤵
- Executes dropped EXE
PID:436 -
\??\c:\djvvv.exec:\djvvv.exe48⤵
- Executes dropped EXE
PID:1884 -
\??\c:\9frxfrr.exec:\9frxfrr.exe49⤵
- Executes dropped EXE
PID:1128 -
\??\c:\1bhhnb.exec:\1bhhnb.exe50⤵
- Executes dropped EXE
PID:3488 -
\??\c:\djvdd.exec:\djvdd.exe51⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jdvdd.exec:\jdvdd.exe52⤵
- Executes dropped EXE
PID:5040 -
\??\c:\lflrxff.exec:\lflrxff.exe53⤵
- Executes dropped EXE
PID:1332 -
\??\c:\bbbbhn.exec:\bbbbhn.exe54⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nnbtbb.exec:\nnbtbb.exe55⤵
- Executes dropped EXE
PID:2760 -
\??\c:\pvvvd.exec:\pvvvd.exe56⤵
- Executes dropped EXE
PID:3064 -
\??\c:\lfrfrxx.exec:\lfrfrxx.exe57⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hnnnth.exec:\hnnnth.exe58⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ddjpv.exec:\ddjpv.exe59⤵
- Executes dropped EXE
PID:208 -
\??\c:\lfflflf.exec:\lfflflf.exe60⤵
- Executes dropped EXE
PID:3892 -
\??\c:\nbhnbh.exec:\nbhnbh.exe61⤵
- Executes dropped EXE
PID:3960 -
\??\c:\vjjvp.exec:\vjjvp.exe62⤵
- Executes dropped EXE
PID:4456 -
\??\c:\frxrxrf.exec:\frxrxrf.exe63⤵
- Executes dropped EXE
PID:3108 -
\??\c:\bnhbhh.exec:\bnhbhh.exe64⤵
- Executes dropped EXE
PID:4428 -
\??\c:\jdpvv.exec:\jdpvv.exe65⤵
- Executes dropped EXE
PID:4832 -
\??\c:\ffrlfrr.exec:\ffrlfrr.exe66⤵PID:1120
-
\??\c:\hbnnhn.exec:\hbnnhn.exe67⤵PID:3636
-
\??\c:\vvddj.exec:\vvddj.exe68⤵PID:3180
-
\??\c:\lxrlfxr.exec:\lxrlfxr.exe69⤵PID:3616
-
\??\c:\jpppv.exec:\jpppv.exe70⤵PID:3288
-
\??\c:\xxlllfl.exec:\xxlllfl.exe71⤵PID:1424
-
\??\c:\7bbbhn.exec:\7bbbhn.exe72⤵PID:4880
-
\??\c:\hnnthn.exec:\hnnthn.exe73⤵PID:3136
-
\??\c:\9djdd.exec:\9djdd.exe74⤵PID:4736
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe75⤵PID:2860
-
\??\c:\bthhhh.exec:\bthhhh.exe76⤵PID:1500
-
\??\c:\jjpjd.exec:\jjpjd.exe77⤵PID:1872
-
\??\c:\frrfllr.exec:\frrfllr.exe78⤵PID:3828
-
\??\c:\ffrfxrx.exec:\ffrfxrx.exe79⤵PID:4980
-
\??\c:\bntttb.exec:\bntttb.exe80⤵PID:5012
-
\??\c:\ddjjj.exec:\ddjjj.exe81⤵PID:1156
-
\??\c:\htbnbn.exec:\htbnbn.exe82⤵PID:3196
-
\??\c:\llxxxff.exec:\llxxxff.exe83⤵PID:2676
-
\??\c:\bbhhtb.exec:\bbhhtb.exe84⤵PID:624
-
\??\c:\tntnnh.exec:\tntnnh.exe85⤵PID:4596
-
\??\c:\dvjpp.exec:\dvjpp.exe86⤵PID:1420
-
\??\c:\jjppj.exec:\jjppj.exe87⤵PID:968
-
\??\c:\bttttb.exec:\bttttb.exe88⤵PID:2504
-
\??\c:\ddpjj.exec:\ddpjj.exe89⤵PID:2264
-
\??\c:\rlxffll.exec:\rlxffll.exe90⤵PID:1240
-
\??\c:\xrfxlfl.exec:\xrfxlfl.exe91⤵PID:4296
-
\??\c:\vddvj.exec:\vddvj.exe92⤵PID:3600
-
\??\c:\ddddp.exec:\ddddp.exe93⤵PID:4012
-
\??\c:\tbhhbt.exec:\tbhhbt.exe94⤵PID:5060
-
\??\c:\1nbbht.exec:\1nbbht.exe95⤵PID:1884
-
\??\c:\ddjvd.exec:\ddjvd.exe96⤵PID:1988
-
\??\c:\rlrxrrx.exec:\rlrxrrx.exe97⤵PID:4928
-
\??\c:\lllxfxx.exec:\lllxfxx.exe98⤵PID:2072
-
\??\c:\hhhnhn.exec:\hhhnhn.exe99⤵PID:1004
-
\??\c:\vvjjp.exec:\vvjjp.exe100⤵PID:2276
-
\??\c:\lrrxfll.exec:\lrrxfll.exe101⤵PID:2400
-
\??\c:\fxxxxxf.exec:\fxxxxxf.exe102⤵PID:2584
-
\??\c:\nbtbbn.exec:\nbtbbn.exe103⤵PID:1848
-
\??\c:\nhtttb.exec:\nhtttb.exe104⤵PID:4760
-
\??\c:\7jjjd.exec:\7jjjd.exe105⤵PID:4412
-
\??\c:\vpvjv.exec:\vpvjv.exe106⤵PID:4936
-
\??\c:\rfrlrlx.exec:\rfrlrlx.exe107⤵PID:4224
-
\??\c:\bttbhh.exec:\bttbhh.exe108⤵PID:5004
-
\??\c:\tntnnn.exec:\tntnnn.exe109⤵PID:3272
-
\??\c:\ddjjp.exec:\ddjjp.exe110⤵PID:3932
-
\??\c:\xfllrrx.exec:\xfllrrx.exe111⤵PID:1152
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe112⤵PID:4696
-
\??\c:\bhbbht.exec:\bhbbht.exe113⤵PID:3788
-
\??\c:\xxrllll.exec:\xxrllll.exe114⤵PID:4880
-
\??\c:\bbntbn.exec:\bbntbn.exe115⤵PID:3280
-
\??\c:\jvvpd.exec:\jvvpd.exe116⤵PID:4736
-
\??\c:\1lrrrrr.exec:\1lrrrrr.exe117⤵PID:1584
-
\??\c:\hthhhh.exec:\hthhhh.exe118⤵PID:1500
-
\??\c:\jjjjv.exec:\jjjjv.exe119⤵PID:4860
-
\??\c:\vpppd.exec:\vpppd.exe120⤵PID:1632
-
\??\c:\rllfxxr.exec:\rllfxxr.exe121⤵PID:5012
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe122⤵PID:2692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-