Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 05:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
afae590fee0f526a31fff02dd6ddfb80_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
afae590fee0f526a31fff02dd6ddfb80_NeikiAnalytics.exe
-
Size
74KB
-
MD5
afae590fee0f526a31fff02dd6ddfb80
-
SHA1
d6d5b7165f94e65e41526f890f7375f36527c946
-
SHA256
4d3c1495196558a78676b376ac9a4dde2dc92c685170b4bade09206d8bf24f65
-
SHA512
2c68b79a803cd76ff366257520df50ee8192326e87d07177b34f28c9893e7342dc006e911942ebc2076d90a2d56e61723c8845a1b050aa60fb87e7ff403110e0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5TEom:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCqJ
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/1176-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1992-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/928-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2536-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1344-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5056 5nnbtb.exe 4608 jpdjp.exe 3940 1lxlxll.exe 4720 nhtbtt.exe 1180 xllfxxr.exe 1992 bhnnhn.exe 4844 hbtnhh.exe 744 7vvpd.exe 928 xxfxxlf.exe 4988 htnnhb.exe 3316 dvvpj.exe 2380 3llfrlf.exe 5028 lxfxlfr.exe 2780 nbtnbt.exe 1968 3pppd.exe 2536 jpvpj.exe 2936 rflfllf.exe 4012 btnhbb.exe 2168 vdvpd.exe 3476 xlfrffx.exe 4832 hhbtnn.exe 2684 5ntnhb.exe 3232 pdpjd.exe 1408 rrxrrrl.exe 1344 7btthb.exe 1828 5djjd.exe 868 pjjjp.exe 2028 rlfrfrr.exe 4788 9ntnhn.exe 1472 1jjdv.exe 2184 3ppjd.exe 4588 lffxrrl.exe 4828 nbtbtt.exe 3256 vpjjv.exe 632 9jvpp.exe 4576 9frffff.exe 1616 lrffxxr.exe 4488 nnnhhb.exe 2736 dvvjp.exe 4088 vjdvv.exe 384 lxlrrlf.exe 3048 hbhhhb.exe 4468 pjvdd.exe 3712 frxxrrl.exe 4144 xlffllf.exe 3636 nhttnn.exe 3556 thnnnn.exe 4264 pjpjj.exe 3208 jddvp.exe 2420 rrrlflf.exe 2008 xrffxxr.exe 2840 thnhbb.exe 892 tnbnnn.exe 3052 vdpdv.exe 2852 1pppj.exe 1756 lfxxlll.exe 2780 5tbbbb.exe 2460 1bbbtb.exe 4796 pvvvp.exe 2388 djvdj.exe 4412 1xfxllf.exe 4012 3rrffrr.exe 2232 htbbtt.exe 5012 hhhbtt.exe -
resource yara_rule behavioral2/memory/1176-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1992-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/928-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2536-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1344-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1176 wrote to memory of 5056 1176 afae590fee0f526a31fff02dd6ddfb80_NeikiAnalytics.exe 83 PID 1176 wrote to memory of 5056 1176 afae590fee0f526a31fff02dd6ddfb80_NeikiAnalytics.exe 83 PID 1176 wrote to memory of 5056 1176 afae590fee0f526a31fff02dd6ddfb80_NeikiAnalytics.exe 83 PID 5056 wrote to memory of 4608 5056 5nnbtb.exe 84 PID 5056 wrote to memory of 4608 5056 5nnbtb.exe 84 PID 5056 wrote to memory of 4608 5056 5nnbtb.exe 84 PID 4608 wrote to memory of 3940 4608 jpdjp.exe 85 PID 4608 wrote to memory of 3940 4608 jpdjp.exe 85 PID 4608 wrote to memory of 3940 4608 jpdjp.exe 85 PID 3940 wrote to memory of 4720 3940 1lxlxll.exe 86 PID 3940 wrote to memory of 4720 3940 1lxlxll.exe 86 PID 3940 wrote to memory of 4720 3940 1lxlxll.exe 86 PID 4720 wrote to memory of 1180 4720 nhtbtt.exe 87 PID 4720 wrote to memory of 1180 4720 nhtbtt.exe 87 PID 4720 wrote to memory of 1180 4720 nhtbtt.exe 87 PID 1180 wrote to memory of 1992 1180 xllfxxr.exe 88 PID 1180 wrote to memory of 1992 1180 xllfxxr.exe 88 PID 1180 wrote to memory of 1992 1180 xllfxxr.exe 88 PID 1992 wrote to memory of 4844 1992 bhnnhn.exe 89 PID 1992 wrote to memory of 4844 1992 bhnnhn.exe 89 PID 1992 wrote to memory of 4844 1992 bhnnhn.exe 89 PID 4844 wrote to memory of 744 4844 hbtnhh.exe 90 PID 4844 wrote to memory of 744 4844 hbtnhh.exe 90 PID 4844 wrote to memory of 744 4844 hbtnhh.exe 90 PID 744 wrote to memory of 928 744 7vvpd.exe 91 PID 744 wrote to memory of 928 744 7vvpd.exe 91 PID 744 wrote to memory of 928 744 7vvpd.exe 91 PID 928 wrote to memory of 4988 928 xxfxxlf.exe 92 PID 928 wrote to memory of 4988 928 xxfxxlf.exe 92 PID 928 wrote to memory of 4988 928 xxfxxlf.exe 92 PID 4988 wrote to memory of 3316 4988 htnnhb.exe 93 PID 4988 wrote to memory of 3316 4988 htnnhb.exe 93 PID 4988 wrote to memory of 3316 4988 htnnhb.exe 93 PID 3316 wrote to memory of 2380 3316 dvvpj.exe 94 PID 3316 wrote to memory of 2380 3316 dvvpj.exe 94 PID 3316 wrote to memory of 2380 3316 dvvpj.exe 94 PID 2380 wrote to memory of 5028 2380 3llfrlf.exe 95 PID 2380 wrote to memory of 5028 2380 3llfrlf.exe 95 PID 2380 wrote to memory of 5028 2380 3llfrlf.exe 95 PID 5028 wrote to memory of 2780 5028 lxfxlfr.exe 96 PID 5028 wrote to memory of 2780 5028 lxfxlfr.exe 96 PID 5028 wrote to memory of 2780 5028 lxfxlfr.exe 96 PID 2780 wrote to memory of 1968 2780 nbtnbt.exe 97 PID 2780 wrote to memory of 1968 2780 nbtnbt.exe 97 PID 2780 wrote to memory of 1968 2780 nbtnbt.exe 97 PID 1968 wrote to memory of 2536 1968 3pppd.exe 98 PID 1968 wrote to memory of 2536 1968 3pppd.exe 98 PID 1968 wrote to memory of 2536 1968 3pppd.exe 98 PID 2536 wrote to memory of 2936 2536 jpvpj.exe 99 PID 2536 wrote to memory of 2936 2536 jpvpj.exe 99 PID 2536 wrote to memory of 2936 2536 jpvpj.exe 99 PID 2936 wrote to memory of 4012 2936 rflfllf.exe 100 PID 2936 wrote to memory of 4012 2936 rflfllf.exe 100 PID 2936 wrote to memory of 4012 2936 rflfllf.exe 100 PID 4012 wrote to memory of 2168 4012 btnhbb.exe 101 PID 4012 wrote to memory of 2168 4012 btnhbb.exe 101 PID 4012 wrote to memory of 2168 4012 btnhbb.exe 101 PID 2168 wrote to memory of 3476 2168 vdvpd.exe 102 PID 2168 wrote to memory of 3476 2168 vdvpd.exe 102 PID 2168 wrote to memory of 3476 2168 vdvpd.exe 102 PID 3476 wrote to memory of 4832 3476 xlfrffx.exe 104 PID 3476 wrote to memory of 4832 3476 xlfrffx.exe 104 PID 3476 wrote to memory of 4832 3476 xlfrffx.exe 104 PID 4832 wrote to memory of 2684 4832 hhbtnn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\afae590fee0f526a31fff02dd6ddfb80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\afae590fee0f526a31fff02dd6ddfb80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\5nnbtb.exec:\5nnbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\jpdjp.exec:\jpdjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\1lxlxll.exec:\1lxlxll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\nhtbtt.exec:\nhtbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\xllfxxr.exec:\xllfxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\bhnnhn.exec:\bhnnhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\hbtnhh.exec:\hbtnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\7vvpd.exec:\7vvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\xxfxxlf.exec:\xxfxxlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\htnnhb.exec:\htnnhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\dvvpj.exec:\dvvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\3llfrlf.exec:\3llfrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\lxfxlfr.exec:\lxfxlfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\nbtnbt.exec:\nbtnbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\3pppd.exec:\3pppd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\jpvpj.exec:\jpvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\rflfllf.exec:\rflfllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\btnhbb.exec:\btnhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\vdvpd.exec:\vdvpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\xlfrffx.exec:\xlfrffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\hhbtnn.exec:\hhbtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\5ntnhb.exec:\5ntnhb.exe23⤵
- Executes dropped EXE
PID:2684 -
\??\c:\pdpjd.exec:\pdpjd.exe24⤵
- Executes dropped EXE
PID:3232 -
\??\c:\rrxrrrl.exec:\rrxrrrl.exe25⤵
- Executes dropped EXE
PID:1408 -
\??\c:\7btthb.exec:\7btthb.exe26⤵
- Executes dropped EXE
PID:1344 -
\??\c:\5djjd.exec:\5djjd.exe27⤵
- Executes dropped EXE
PID:1828 -
\??\c:\pjjjp.exec:\pjjjp.exe28⤵
- Executes dropped EXE
PID:868 -
\??\c:\rlfrfrr.exec:\rlfrfrr.exe29⤵
- Executes dropped EXE
PID:2028 -
\??\c:\9ntnhn.exec:\9ntnhn.exe30⤵
- Executes dropped EXE
PID:4788 -
\??\c:\1jjdv.exec:\1jjdv.exe31⤵
- Executes dropped EXE
PID:1472 -
\??\c:\3ppjd.exec:\3ppjd.exe32⤵
- Executes dropped EXE
PID:2184 -
\??\c:\lffxrrl.exec:\lffxrrl.exe33⤵
- Executes dropped EXE
PID:4588 -
\??\c:\nbtbtt.exec:\nbtbtt.exe34⤵
- Executes dropped EXE
PID:4828 -
\??\c:\vpjjv.exec:\vpjjv.exe35⤵
- Executes dropped EXE
PID:3256 -
\??\c:\9jvpp.exec:\9jvpp.exe36⤵
- Executes dropped EXE
PID:632 -
\??\c:\9frffff.exec:\9frffff.exe37⤵
- Executes dropped EXE
PID:4576 -
\??\c:\lrffxxr.exec:\lrffxxr.exe38⤵
- Executes dropped EXE
PID:1616 -
\??\c:\nnnhhb.exec:\nnnhhb.exe39⤵
- Executes dropped EXE
PID:4488 -
\??\c:\dvvjp.exec:\dvvjp.exe40⤵
- Executes dropped EXE
PID:2736 -
\??\c:\vjdvv.exec:\vjdvv.exe41⤵
- Executes dropped EXE
PID:4088 -
\??\c:\lxlrrlf.exec:\lxlrrlf.exe42⤵
- Executes dropped EXE
PID:384 -
\??\c:\hbhhhb.exec:\hbhhhb.exe43⤵
- Executes dropped EXE
PID:3048 -
\??\c:\pjvdd.exec:\pjvdd.exe44⤵
- Executes dropped EXE
PID:4468 -
\??\c:\frxxrrl.exec:\frxxrrl.exe45⤵
- Executes dropped EXE
PID:3712 -
\??\c:\xlffllf.exec:\xlffllf.exe46⤵
- Executes dropped EXE
PID:4144 -
\??\c:\nhttnn.exec:\nhttnn.exe47⤵
- Executes dropped EXE
PID:3636 -
\??\c:\thnnnn.exec:\thnnnn.exe48⤵
- Executes dropped EXE
PID:3556 -
\??\c:\pjpjj.exec:\pjpjj.exe49⤵
- Executes dropped EXE
PID:4264 -
\??\c:\jddvp.exec:\jddvp.exe50⤵
- Executes dropped EXE
PID:3208 -
\??\c:\rrrlflf.exec:\rrrlflf.exe51⤵
- Executes dropped EXE
PID:2420 -
\??\c:\xrffxxr.exec:\xrffxxr.exe52⤵
- Executes dropped EXE
PID:2008 -
\??\c:\thnhbb.exec:\thnhbb.exe53⤵
- Executes dropped EXE
PID:2840 -
\??\c:\tnbnnn.exec:\tnbnnn.exe54⤵
- Executes dropped EXE
PID:892 -
\??\c:\vdpdv.exec:\vdpdv.exe55⤵
- Executes dropped EXE
PID:3052 -
\??\c:\1pppj.exec:\1pppj.exe56⤵
- Executes dropped EXE
PID:2852 -
\??\c:\lfxxlll.exec:\lfxxlll.exe57⤵
- Executes dropped EXE
PID:1756 -
\??\c:\5tbbbb.exec:\5tbbbb.exe58⤵
- Executes dropped EXE
PID:2780 -
\??\c:\1bbbtb.exec:\1bbbtb.exe59⤵
- Executes dropped EXE
PID:2460 -
\??\c:\pvvvp.exec:\pvvvp.exe60⤵
- Executes dropped EXE
PID:4796 -
\??\c:\djvdj.exec:\djvdj.exe61⤵
- Executes dropped EXE
PID:2388 -
\??\c:\1xfxllf.exec:\1xfxllf.exe62⤵
- Executes dropped EXE
PID:4412 -
\??\c:\3rrffrr.exec:\3rrffrr.exe63⤵
- Executes dropped EXE
PID:4012 -
\??\c:\htbbtt.exec:\htbbtt.exe64⤵
- Executes dropped EXE
PID:2232 -
\??\c:\hhhbtt.exec:\hhhbtt.exe65⤵
- Executes dropped EXE
PID:5012 -
\??\c:\3jvpj.exec:\3jvpj.exe66⤵PID:1256
-
\??\c:\vdddv.exec:\vdddv.exe67⤵PID:4832
-
\??\c:\rrrrfll.exec:\rrrrfll.exe68⤵PID:4080
-
\??\c:\bhbtnh.exec:\bhbtnh.exe69⤵PID:2752
-
\??\c:\1nnhnn.exec:\1nnhnn.exe70⤵PID:2924
-
\??\c:\3dpjv.exec:\3dpjv.exe71⤵PID:1808
-
\??\c:\3vpjd.exec:\3vpjd.exe72⤵PID:1540
-
\??\c:\rllfxxx.exec:\rllfxxx.exe73⤵PID:2100
-
\??\c:\5xrrlfx.exec:\5xrrlfx.exe74⤵PID:2072
-
\??\c:\tnbhnn.exec:\tnbhnn.exe75⤵PID:2028
-
\??\c:\hbnhnn.exec:\hbnhnn.exe76⤵PID:908
-
\??\c:\7jppp.exec:\7jppp.exe77⤵PID:3040
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe78⤵PID:548
-
\??\c:\llfxrxr.exec:\llfxrxr.exe79⤵PID:2184
-
\??\c:\3nbtnh.exec:\3nbtnh.exe80⤵PID:620
-
\??\c:\pjppd.exec:\pjppd.exe81⤵PID:2060
-
\??\c:\dvvpp.exec:\dvvpp.exe82⤵PID:3456
-
\??\c:\1lllxxr.exec:\1lllxxr.exe83⤵PID:3748
-
\??\c:\xlfrffl.exec:\xlfrffl.exe84⤵PID:2320
-
\??\c:\btbbbt.exec:\btbbbt.exe85⤵PID:4184
-
\??\c:\hhhtbb.exec:\hhhtbb.exe86⤵PID:2712
-
\??\c:\pvddp.exec:\pvddp.exe87⤵PID:1176
-
\??\c:\ddjjp.exec:\ddjjp.exe88⤵PID:1036
-
\??\c:\lfxrlrr.exec:\lfxrlrr.exe89⤵PID:4732
-
\??\c:\1frxrrf.exec:\1frxrrf.exe90⤵PID:540
-
\??\c:\tnnhht.exec:\tnnhht.exe91⤵PID:384
-
\??\c:\pjjvp.exec:\pjjvp.exe92⤵PID:3356
-
\??\c:\jjjdv.exec:\jjjdv.exe93⤵PID:4468
-
\??\c:\flxxrrr.exec:\flxxrrr.exe94⤵PID:3712
-
\??\c:\3flffrl.exec:\3flffrl.exe95⤵PID:4144
-
\??\c:\bhbtth.exec:\bhbtth.exe96⤵PID:1420
-
\??\c:\7jjjd.exec:\7jjjd.exe97⤵PID:3556
-
\??\c:\jvjdv.exec:\jvjdv.exe98⤵PID:1320
-
\??\c:\7fffxff.exec:\7fffxff.exe99⤵PID:3208
-
\??\c:\llrrrrx.exec:\llrrrrx.exe100⤵PID:2420
-
\??\c:\nbbttn.exec:\nbbttn.exe101⤵PID:2008
-
\??\c:\tnhbtt.exec:\tnhbtt.exe102⤵PID:3512
-
\??\c:\jpjdv.exec:\jpjdv.exe103⤵PID:3312
-
\??\c:\xrxrllf.exec:\xrxrllf.exe104⤵PID:3052
-
\??\c:\tbtnbn.exec:\tbtnbn.exe105⤵PID:3420
-
\??\c:\ntbttt.exec:\ntbttt.exe106⤵PID:1756
-
\??\c:\dvpjj.exec:\dvpjj.exe107⤵PID:2780
-
\??\c:\jjdvp.exec:\jjdvp.exe108⤵PID:4500
-
\??\c:\xxlllrx.exec:\xxlllrx.exe109⤵PID:3932
-
\??\c:\5lffllf.exec:\5lffllf.exe110⤵PID:2388
-
\??\c:\thtnbn.exec:\thtnbn.exe111⤵PID:3536
-
\??\c:\pjppp.exec:\pjppp.exe112⤵PID:748
-
\??\c:\jddvv.exec:\jddvv.exe113⤵PID:2040
-
\??\c:\xlrrrff.exec:\xlrrrff.exe114⤵PID:1028
-
\??\c:\lrxxrrl.exec:\lrxxrrl.exe115⤵PID:1096
-
\??\c:\7bhbhb.exec:\7bhbhb.exe116⤵PID:4736
-
\??\c:\bthbhb.exec:\bthbhb.exe117⤵PID:1264
-
\??\c:\pdjjv.exec:\pdjjv.exe118⤵PID:1744
-
\??\c:\9pvpd.exec:\9pvpd.exe119⤵PID:4228
-
\??\c:\fxrrrlf.exec:\fxrrrlf.exe120⤵PID:868
-
\??\c:\5fxrllf.exec:\5fxrllf.exe121⤵PID:1908
-
\??\c:\hhhtbb.exec:\hhhtbb.exe122⤵PID:2188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-