Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 02:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
733e256ea2349a7e7546fa7a205ab280_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
733e256ea2349a7e7546fa7a205ab280_NeikiAnalytics.exe
-
Size
54KB
-
MD5
733e256ea2349a7e7546fa7a205ab280
-
SHA1
8d2f1ae0eae614d18bdbe6830e510967e250ad8a
-
SHA256
bda02be31992ffd3c2737da30b1e35ea744aae0094b6a80320f404f9c4a66389
-
SHA512
834cdaa7ec6827d156174d8e3366fcfd5425354adc068e0ef892d4ccea1399b7e467f47a405050bbf5662326a623f73bc6ecb7eeef423f0b98fd319be42459ca
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFx:ymb3NkkiQ3mdBjFIFx
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4852-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2800-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1344-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3320 bbttnh.exe 2516 lrrrxxx.exe 2448 xrxxxrl.exe 388 1vjjd.exe 1168 jjjvv.exe 4348 1rllflx.exe 4020 3nntnb.exe 2288 jdpjd.exe 2800 rrlrfrx.exe 4376 nbtbht.exe 3544 jvpjd.exe 3692 fffxxrr.exe 5068 bbtntb.exe 5100 bbtnbb.exe 8 1vddv.exe 4844 xxlllll.exe 1560 bbhbbt.exe 3852 bbbbtt.exe 2484 jdddd.exe 4704 rfxxffx.exe 4472 hbtttn.exe 4308 vjpvd.exe 2180 dpvpp.exe 3484 thhhbh.exe 4980 tnttnn.exe 1344 3vddd.exe 2920 lllfxxx.exe 4852 tnnhbb.exe 968 vdddd.exe 2028 rlrlffl.exe 3668 tbtbbb.exe 2768 nnhhhn.exe 3904 vvddd.exe 3048 nnhtnt.exe 2568 5tnhnn.exe 1012 7jdvd.exe 4020 xxllrxf.exe 2040 nnbhht.exe 3732 3nbhht.exe 4668 jjdjv.exe 4968 ffrffrx.exe 4816 5xffffl.exe 3456 bhhhbb.exe 1668 vdppj.exe 5100 jjvvp.exe 1800 lxxrrxf.exe 2628 1bhbbb.exe 4196 3jpdd.exe 1460 jdpvp.exe 2216 rllfllr.exe 3532 nnnnnn.exe 5000 hnnnnn.exe 3240 tnthhb.exe 4556 pjpjj.exe 2612 lfffxff.exe 4804 xllffrr.exe 2672 btbhhn.exe 3444 jdppp.exe 4492 djppp.exe 4852 xrxxxxx.exe 968 rflllll.exe 4936 bthnnh.exe 3668 ntbtth.exe 548 ppvvj.exe -
resource yara_rule behavioral2/memory/4852-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2800-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4376-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1344-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4852 wrote to memory of 3320 4852 733e256ea2349a7e7546fa7a205ab280_NeikiAnalytics.exe 90 PID 4852 wrote to memory of 3320 4852 733e256ea2349a7e7546fa7a205ab280_NeikiAnalytics.exe 90 PID 4852 wrote to memory of 3320 4852 733e256ea2349a7e7546fa7a205ab280_NeikiAnalytics.exe 90 PID 3320 wrote to memory of 2516 3320 bbttnh.exe 91 PID 3320 wrote to memory of 2516 3320 bbttnh.exe 91 PID 3320 wrote to memory of 2516 3320 bbttnh.exe 91 PID 2516 wrote to memory of 2448 2516 lrrrxxx.exe 92 PID 2516 wrote to memory of 2448 2516 lrrrxxx.exe 92 PID 2516 wrote to memory of 2448 2516 lrrrxxx.exe 92 PID 2448 wrote to memory of 388 2448 xrxxxrl.exe 93 PID 2448 wrote to memory of 388 2448 xrxxxrl.exe 93 PID 2448 wrote to memory of 388 2448 xrxxxrl.exe 93 PID 388 wrote to memory of 1168 388 1vjjd.exe 94 PID 388 wrote to memory of 1168 388 1vjjd.exe 94 PID 388 wrote to memory of 1168 388 1vjjd.exe 94 PID 1168 wrote to memory of 4348 1168 jjjvv.exe 95 PID 1168 wrote to memory of 4348 1168 jjjvv.exe 95 PID 1168 wrote to memory of 4348 1168 jjjvv.exe 95 PID 4348 wrote to memory of 4020 4348 1rllflx.exe 96 PID 4348 wrote to memory of 4020 4348 1rllflx.exe 96 PID 4348 wrote to memory of 4020 4348 1rllflx.exe 96 PID 4020 wrote to memory of 2288 4020 3nntnb.exe 97 PID 4020 wrote to memory of 2288 4020 3nntnb.exe 97 PID 4020 wrote to memory of 2288 4020 3nntnb.exe 97 PID 2288 wrote to memory of 2800 2288 jdpjd.exe 98 PID 2288 wrote to memory of 2800 2288 jdpjd.exe 98 PID 2288 wrote to memory of 2800 2288 jdpjd.exe 98 PID 2800 wrote to memory of 4376 2800 rrlrfrx.exe 99 PID 2800 wrote to memory of 4376 2800 rrlrfrx.exe 99 PID 2800 wrote to memory of 4376 2800 rrlrfrx.exe 99 PID 4376 wrote to memory of 3544 4376 nbtbht.exe 100 PID 4376 wrote to memory of 3544 4376 nbtbht.exe 100 PID 4376 wrote to memory of 3544 4376 nbtbht.exe 100 PID 3544 wrote to memory of 3692 3544 jvpjd.exe 101 PID 3544 wrote to memory of 3692 3544 jvpjd.exe 101 PID 3544 wrote to memory of 3692 3544 jvpjd.exe 101 PID 3692 wrote to memory of 5068 3692 fffxxrr.exe 102 PID 3692 wrote to memory of 5068 3692 fffxxrr.exe 102 PID 3692 wrote to memory of 5068 3692 fffxxrr.exe 102 PID 5068 wrote to memory of 5100 5068 bbtntb.exe 103 PID 5068 wrote to memory of 5100 5068 bbtntb.exe 103 PID 5068 wrote to memory of 5100 5068 bbtntb.exe 103 PID 5100 wrote to memory of 8 5100 bbtnbb.exe 104 PID 5100 wrote to memory of 8 5100 bbtnbb.exe 104 PID 5100 wrote to memory of 8 5100 bbtnbb.exe 104 PID 8 wrote to memory of 4844 8 1vddv.exe 105 PID 8 wrote to memory of 4844 8 1vddv.exe 105 PID 8 wrote to memory of 4844 8 1vddv.exe 105 PID 4844 wrote to memory of 1560 4844 xxlllll.exe 106 PID 4844 wrote to memory of 1560 4844 xxlllll.exe 106 PID 4844 wrote to memory of 1560 4844 xxlllll.exe 106 PID 1560 wrote to memory of 3852 1560 bbhbbt.exe 107 PID 1560 wrote to memory of 3852 1560 bbhbbt.exe 107 PID 1560 wrote to memory of 3852 1560 bbhbbt.exe 107 PID 3852 wrote to memory of 2484 3852 bbbbtt.exe 108 PID 3852 wrote to memory of 2484 3852 bbbbtt.exe 108 PID 3852 wrote to memory of 2484 3852 bbbbtt.exe 108 PID 2484 wrote to memory of 4704 2484 jdddd.exe 109 PID 2484 wrote to memory of 4704 2484 jdddd.exe 109 PID 2484 wrote to memory of 4704 2484 jdddd.exe 109 PID 4704 wrote to memory of 4472 4704 rfxxffx.exe 110 PID 4704 wrote to memory of 4472 4704 rfxxffx.exe 110 PID 4704 wrote to memory of 4472 4704 rfxxffx.exe 110 PID 4472 wrote to memory of 4308 4472 hbtttn.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\733e256ea2349a7e7546fa7a205ab280_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\733e256ea2349a7e7546fa7a205ab280_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\bbttnh.exec:\bbttnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\lrrrxxx.exec:\lrrrxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\xrxxxrl.exec:\xrxxxrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\1vjjd.exec:\1vjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\jjjvv.exec:\jjjvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\1rllflx.exec:\1rllflx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\3nntnb.exec:\3nntnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\jdpjd.exec:\jdpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\rrlrfrx.exec:\rrlrfrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\nbtbht.exec:\nbtbht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\jvpjd.exec:\jvpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\fffxxrr.exec:\fffxxrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\bbtntb.exec:\bbtntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\bbtnbb.exec:\bbtnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\1vddv.exec:\1vddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\xxlllll.exec:\xxlllll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\bbhbbt.exec:\bbhbbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\bbbbtt.exec:\bbbbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\jdddd.exec:\jdddd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\rfxxffx.exec:\rfxxffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\hbtttn.exec:\hbtttn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\vjpvd.exec:\vjpvd.exe23⤵
- Executes dropped EXE
PID:4308 -
\??\c:\dpvpp.exec:\dpvpp.exe24⤵
- Executes dropped EXE
PID:2180 -
\??\c:\thhhbh.exec:\thhhbh.exe25⤵
- Executes dropped EXE
PID:3484 -
\??\c:\tnttnn.exec:\tnttnn.exe26⤵
- Executes dropped EXE
PID:4980 -
\??\c:\3vddd.exec:\3vddd.exe27⤵
- Executes dropped EXE
PID:1344 -
\??\c:\lllfxxx.exec:\lllfxxx.exe28⤵
- Executes dropped EXE
PID:2920 -
\??\c:\tnnhbb.exec:\tnnhbb.exe29⤵
- Executes dropped EXE
PID:4852 -
\??\c:\vdddd.exec:\vdddd.exe30⤵
- Executes dropped EXE
PID:968 -
\??\c:\rlrlffl.exec:\rlrlffl.exe31⤵
- Executes dropped EXE
PID:2028 -
\??\c:\tbtbbb.exec:\tbtbbb.exe32⤵
- Executes dropped EXE
PID:3668 -
\??\c:\nnhhhn.exec:\nnhhhn.exe33⤵
- Executes dropped EXE
PID:2768 -
\??\c:\vvddd.exec:\vvddd.exe34⤵
- Executes dropped EXE
PID:3904 -
\??\c:\nnhtnt.exec:\nnhtnt.exe35⤵
- Executes dropped EXE
PID:3048 -
\??\c:\5tnhnn.exec:\5tnhnn.exe36⤵
- Executes dropped EXE
PID:2568 -
\??\c:\7jdvd.exec:\7jdvd.exe37⤵
- Executes dropped EXE
PID:1012 -
\??\c:\xxllrxf.exec:\xxllrxf.exe38⤵
- Executes dropped EXE
PID:4020 -
\??\c:\nnbhht.exec:\nnbhht.exe39⤵
- Executes dropped EXE
PID:2040 -
\??\c:\3nbhht.exec:\3nbhht.exe40⤵
- Executes dropped EXE
PID:3732 -
\??\c:\jjdjv.exec:\jjdjv.exe41⤵
- Executes dropped EXE
PID:4668 -
\??\c:\ffrffrx.exec:\ffrffrx.exe42⤵
- Executes dropped EXE
PID:4968 -
\??\c:\5xffffl.exec:\5xffffl.exe43⤵
- Executes dropped EXE
PID:4816 -
\??\c:\bhhhbb.exec:\bhhhbb.exe44⤵
- Executes dropped EXE
PID:3456 -
\??\c:\vdppj.exec:\vdppj.exe45⤵
- Executes dropped EXE
PID:1668 -
\??\c:\jjvvp.exec:\jjvvp.exe46⤵
- Executes dropped EXE
PID:5100 -
\??\c:\lxxrrxf.exec:\lxxrrxf.exe47⤵
- Executes dropped EXE
PID:1800 -
\??\c:\1bhbbb.exec:\1bhbbb.exe48⤵
- Executes dropped EXE
PID:2628 -
\??\c:\3jpdd.exec:\3jpdd.exe49⤵
- Executes dropped EXE
PID:4196 -
\??\c:\jdpvp.exec:\jdpvp.exe50⤵
- Executes dropped EXE
PID:1460 -
\??\c:\rllfllr.exec:\rllfllr.exe51⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nnnnnn.exec:\nnnnnn.exe52⤵
- Executes dropped EXE
PID:3532 -
\??\c:\hnnnnn.exec:\hnnnnn.exe53⤵
- Executes dropped EXE
PID:5000 -
\??\c:\tnthhb.exec:\tnthhb.exe54⤵
- Executes dropped EXE
PID:3240 -
\??\c:\pjpjj.exec:\pjpjj.exe55⤵
- Executes dropped EXE
PID:4556 -
\??\c:\lfffxff.exec:\lfffxff.exe56⤵
- Executes dropped EXE
PID:2612 -
\??\c:\xllffrr.exec:\xllffrr.exe57⤵
- Executes dropped EXE
PID:4804 -
\??\c:\btbhhn.exec:\btbhhn.exe58⤵
- Executes dropped EXE
PID:2672 -
\??\c:\jdppp.exec:\jdppp.exe59⤵
- Executes dropped EXE
PID:3444 -
\??\c:\djppp.exec:\djppp.exe60⤵
- Executes dropped EXE
PID:4492 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe61⤵
- Executes dropped EXE
PID:4852 -
\??\c:\rflllll.exec:\rflllll.exe62⤵
- Executes dropped EXE
PID:968 -
\??\c:\bthnnh.exec:\bthnnh.exe63⤵
- Executes dropped EXE
PID:4936 -
\??\c:\ntbtth.exec:\ntbtth.exe64⤵
- Executes dropped EXE
PID:3668 -
\??\c:\ppvvj.exec:\ppvvj.exe65⤵
- Executes dropped EXE
PID:548 -
\??\c:\7vdvp.exec:\7vdvp.exe66⤵PID:2768
-
\??\c:\llxrlll.exec:\llxrlll.exe67⤵PID:1160
-
\??\c:\hbbbtb.exec:\hbbbtb.exe68⤵PID:4888
-
\??\c:\bbnttn.exec:\bbnttn.exe69⤵PID:3684
-
\??\c:\pjjpv.exec:\pjjpv.exe70⤵PID:4372
-
\??\c:\flffxxx.exec:\flffxxx.exe71⤵PID:1600
-
\??\c:\bhbbbh.exec:\bhbbbh.exe72⤵PID:3996
-
\??\c:\lllllrf.exec:\lllllrf.exe73⤵PID:3448
-
\??\c:\ffffxfx.exec:\ffffxfx.exe74⤵PID:3744
-
\??\c:\nnbbth.exec:\nnbbth.exe75⤵PID:1352
-
\??\c:\vppdj.exec:\vppdj.exe76⤵PID:3628
-
\??\c:\pdjvp.exec:\pdjvp.exe77⤵PID:1248
-
\??\c:\bnntbn.exec:\bnntbn.exe78⤵PID:3940
-
\??\c:\jpjjj.exec:\jpjjj.exe79⤵PID:2076
-
\??\c:\1lrlffx.exec:\1lrlffx.exe80⤵PID:3660
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe81⤵PID:3064
-
\??\c:\hnttnt.exec:\hnttnt.exe82⤵PID:2432
-
\??\c:\7jjdd.exec:\7jjdd.exe83⤵PID:1000
-
\??\c:\djvdd.exec:\djvdd.exe84⤵PID:3256
-
\??\c:\flxxrxf.exec:\flxxrxf.exe85⤵PID:5016
-
\??\c:\ffrfrrx.exec:\ffrfrrx.exe86⤵PID:3068
-
\??\c:\bhtttt.exec:\bhtttt.exe87⤵PID:4584
-
\??\c:\hbhhnb.exec:\hbhhnb.exe88⤵PID:1728
-
\??\c:\ddjdd.exec:\ddjdd.exe89⤵PID:1756
-
\??\c:\ppppp.exec:\ppppp.exe90⤵PID:3172
-
\??\c:\5rrlxrf.exec:\5rrlxrf.exe91⤵PID:4316
-
\??\c:\fxffxff.exec:\fxffxff.exe92⤵PID:4492
-
\??\c:\tntthh.exec:\tntthh.exe93⤵PID:404
-
\??\c:\hntttt.exec:\hntttt.exe94⤵PID:4928
-
\??\c:\vjpjd.exec:\vjpjd.exe95⤵PID:2012
-
\??\c:\pdjdp.exec:\pdjdp.exe96⤵PID:4360
-
\??\c:\fxlfxrr.exec:\fxlfxrr.exe97⤵PID:3516
-
\??\c:\rlxrlrr.exec:\rlxrlrr.exe98⤵PID:1392
-
\??\c:\tbthtn.exec:\tbthtn.exe99⤵PID:2892
-
\??\c:\9nnbnn.exec:\9nnbnn.exe100⤵PID:868
-
\??\c:\vdvpd.exec:\vdvpd.exe101⤵PID:4660
-
\??\c:\ppvvp.exec:\ppvvp.exe102⤵PID:1748
-
\??\c:\llxxlrf.exec:\llxxlrf.exe103⤵PID:3092
-
\??\c:\fxxrllx.exec:\fxxrllx.exe104⤵PID:2264
-
\??\c:\7hbtnn.exec:\7hbtnn.exe105⤵PID:3448
-
\??\c:\bbbtnn.exec:\bbbtnn.exe106⤵PID:3744
-
\??\c:\9nttbt.exec:\9nttbt.exe107⤵PID:1352
-
\??\c:\vpdvp.exec:\vpdvp.exe108⤵PID:8
-
\??\c:\3pppv.exec:\3pppv.exe109⤵PID:3152
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe110⤵PID:4528
-
\??\c:\frxrrfx.exec:\frxrrfx.exe111⤵PID:2484
-
\??\c:\bhhbnn.exec:\bhhbnn.exe112⤵PID:636
-
\??\c:\1jvpj.exec:\1jvpj.exe113⤵PID:376
-
\??\c:\vdvpp.exec:\vdvpp.exe114⤵PID:3040
-
\??\c:\ffrxrrr.exec:\ffrxrrr.exe115⤵PID:5000
-
\??\c:\xxfxllf.exec:\xxfxllf.exe116⤵PID:3256
-
\??\c:\httnnn.exec:\httnnn.exe117⤵PID:5016
-
\??\c:\jvjdj.exec:\jvjdj.exe118⤵PID:3140
-
\??\c:\pddpj.exec:\pddpj.exe119⤵PID:4980
-
\??\c:\rrrlfll.exec:\rrrlfll.exe120⤵PID:1768
-
\??\c:\1lxrllf.exec:\1lxrllf.exe121⤵PID:4588
-
\??\c:\bbhtnh.exec:\bbhtnh.exe122⤵PID:2928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-