Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 08:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6e550c40c14154a48efd409fdf4ffef0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
6e550c40c14154a48efd409fdf4ffef0_NeikiAnalytics.exe
-
Size
247KB
-
MD5
6e550c40c14154a48efd409fdf4ffef0
-
SHA1
403c3a0bf7130a5db09afc5b8b93848017962e3c
-
SHA256
b2338a3c77f6caa6ee825778a4fe3fef41c68f96297383ffdf2e852d8bd1562e
-
SHA512
8e9081f2071db8adb0aea339030b7cea9891a6eec176adf1a61d916638e3472f7fb1fb20025bfb0ba99500f9bb37c44741f937d54b87259536d8a8a31fb93787
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4MAWvGjR1+:n3C9BRo7MlrWKo+lxtvGt1+
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/1724-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1288-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4244 1vdjp.exe 1288 7ffxrrl.exe 1796 htbbtn.exe 4200 7hthtn.exe 2940 jddjd.exe 4560 pdjdv.exe 2900 vjdvp.exe 3608 flrrfrr.exe 2132 btbbtt.exe 4636 btbtnn.exe 4036 3ddvp.exe 864 ffxxrxr.exe 1460 fxlfxxr.exe 60 hbttnn.exe 3440 hbbbtt.exe 4100 vpdvp.exe 4940 xxfxrxx.exe 400 rlfxrrl.exe 2236 hbhhbh.exe 548 ttbttb.exe 4744 ddvvj.exe 2864 vdpjd.exe 3088 xrfxffx.exe 4628 bntnnt.exe 2308 llrlffx.exe 5016 lxffxll.exe 2364 hnbbbb.exe 4456 pvjdj.exe 4480 frxflff.exe 1788 ttthhh.exe 3336 3dvvv.exe 1160 fxlffxx.exe 3720 fxllrrf.exe 3596 5pppv.exe 1404 xxffxff.exe 1296 hnnttt.exe 3444 vpjjp.exe 4512 llllxxl.exe 1656 nbbnnh.exe 4324 9nbbtt.exe 4372 dpddd.exe 756 fxxrrrr.exe 3604 1bhtnt.exe 4188 1ttnhh.exe 1616 5ppvj.exe 1740 3fllfxr.exe 4964 btnhtt.exe 5116 nbtnbh.exe 3648 vpvpj.exe 1144 xrlffff.exe 64 hbtnnb.exe 5000 pvppv.exe 1604 ppddj.exe 864 xlxrrrl.exe 1076 1nnnhh.exe 3332 ddjdj.exe 4376 llxxflr.exe 4520 bttnbt.exe 3812 pvppp.exe 4388 3vpjj.exe 1508 7ffxrrl.exe 3852 fxfxrfx.exe 2380 btbtnh.exe 3924 ppppj.exe -
resource yara_rule behavioral2/memory/1724-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1288-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-189-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1724 wrote to memory of 4244 1724 6e550c40c14154a48efd409fdf4ffef0_NeikiAnalytics.exe 83 PID 1724 wrote to memory of 4244 1724 6e550c40c14154a48efd409fdf4ffef0_NeikiAnalytics.exe 83 PID 1724 wrote to memory of 4244 1724 6e550c40c14154a48efd409fdf4ffef0_NeikiAnalytics.exe 83 PID 4244 wrote to memory of 1288 4244 1vdjp.exe 84 PID 4244 wrote to memory of 1288 4244 1vdjp.exe 84 PID 4244 wrote to memory of 1288 4244 1vdjp.exe 84 PID 1288 wrote to memory of 1796 1288 7ffxrrl.exe 85 PID 1288 wrote to memory of 1796 1288 7ffxrrl.exe 85 PID 1288 wrote to memory of 1796 1288 7ffxrrl.exe 85 PID 1796 wrote to memory of 4200 1796 htbbtn.exe 86 PID 1796 wrote to memory of 4200 1796 htbbtn.exe 86 PID 1796 wrote to memory of 4200 1796 htbbtn.exe 86 PID 4200 wrote to memory of 2940 4200 7hthtn.exe 87 PID 4200 wrote to memory of 2940 4200 7hthtn.exe 87 PID 4200 wrote to memory of 2940 4200 7hthtn.exe 87 PID 2940 wrote to memory of 4560 2940 jddjd.exe 88 PID 2940 wrote to memory of 4560 2940 jddjd.exe 88 PID 2940 wrote to memory of 4560 2940 jddjd.exe 88 PID 4560 wrote to memory of 2900 4560 pdjdv.exe 89 PID 4560 wrote to memory of 2900 4560 pdjdv.exe 89 PID 4560 wrote to memory of 2900 4560 pdjdv.exe 89 PID 2900 wrote to memory of 3608 2900 vjdvp.exe 90 PID 2900 wrote to memory of 3608 2900 vjdvp.exe 90 PID 2900 wrote to memory of 3608 2900 vjdvp.exe 90 PID 3608 wrote to memory of 2132 3608 flrrfrr.exe 91 PID 3608 wrote to memory of 2132 3608 flrrfrr.exe 91 PID 3608 wrote to memory of 2132 3608 flrrfrr.exe 91 PID 2132 wrote to memory of 4636 2132 btbbtt.exe 92 PID 2132 wrote to memory of 4636 2132 btbbtt.exe 92 PID 2132 wrote to memory of 4636 2132 btbbtt.exe 92 PID 4636 wrote to memory of 4036 4636 btbtnn.exe 93 PID 4636 wrote to memory of 4036 4636 btbtnn.exe 93 PID 4636 wrote to memory of 4036 4636 btbtnn.exe 93 PID 4036 wrote to memory of 864 4036 3ddvp.exe 94 PID 4036 wrote to memory of 864 4036 3ddvp.exe 94 PID 4036 wrote to memory of 864 4036 3ddvp.exe 94 PID 864 wrote to memory of 1460 864 ffxxrxr.exe 95 PID 864 wrote to memory of 1460 864 ffxxrxr.exe 95 PID 864 wrote to memory of 1460 864 ffxxrxr.exe 95 PID 1460 wrote to memory of 60 1460 fxlfxxr.exe 96 PID 1460 wrote to memory of 60 1460 fxlfxxr.exe 96 PID 1460 wrote to memory of 60 1460 fxlfxxr.exe 96 PID 60 wrote to memory of 3440 60 hbttnn.exe 97 PID 60 wrote to memory of 3440 60 hbttnn.exe 97 PID 60 wrote to memory of 3440 60 hbttnn.exe 97 PID 3440 wrote to memory of 4100 3440 hbbbtt.exe 98 PID 3440 wrote to memory of 4100 3440 hbbbtt.exe 98 PID 3440 wrote to memory of 4100 3440 hbbbtt.exe 98 PID 4100 wrote to memory of 4940 4100 vpdvp.exe 99 PID 4100 wrote to memory of 4940 4100 vpdvp.exe 99 PID 4100 wrote to memory of 4940 4100 vpdvp.exe 99 PID 4940 wrote to memory of 400 4940 xxfxrxx.exe 100 PID 4940 wrote to memory of 400 4940 xxfxrxx.exe 100 PID 4940 wrote to memory of 400 4940 xxfxrxx.exe 100 PID 400 wrote to memory of 2236 400 rlfxrrl.exe 101 PID 400 wrote to memory of 2236 400 rlfxrrl.exe 101 PID 400 wrote to memory of 2236 400 rlfxrrl.exe 101 PID 2236 wrote to memory of 548 2236 hbhhbh.exe 102 PID 2236 wrote to memory of 548 2236 hbhhbh.exe 102 PID 2236 wrote to memory of 548 2236 hbhhbh.exe 102 PID 548 wrote to memory of 4744 548 ttbttb.exe 103 PID 548 wrote to memory of 4744 548 ttbttb.exe 103 PID 548 wrote to memory of 4744 548 ttbttb.exe 103 PID 4744 wrote to memory of 2864 4744 ddvvj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e550c40c14154a48efd409fdf4ffef0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6e550c40c14154a48efd409fdf4ffef0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\1vdjp.exec:\1vdjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\7ffxrrl.exec:\7ffxrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\htbbtn.exec:\htbbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\7hthtn.exec:\7hthtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\jddjd.exec:\jddjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\pdjdv.exec:\pdjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\vjdvp.exec:\vjdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\flrrfrr.exec:\flrrfrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\btbbtt.exec:\btbbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\btbtnn.exec:\btbtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\3ddvp.exec:\3ddvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\ffxxrxr.exec:\ffxxrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\hbttnn.exec:\hbttnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\hbbbtt.exec:\hbbbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\vpdvp.exec:\vpdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\xxfxrxx.exec:\xxfxrxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\hbhhbh.exec:\hbhhbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\ttbttb.exec:\ttbttb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\ddvvj.exec:\ddvvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\vdpjd.exec:\vdpjd.exe23⤵
- Executes dropped EXE
PID:2864 -
\??\c:\xrfxffx.exec:\xrfxffx.exe24⤵
- Executes dropped EXE
PID:3088 -
\??\c:\bntnnt.exec:\bntnnt.exe25⤵
- Executes dropped EXE
PID:4628 -
\??\c:\llrlffx.exec:\llrlffx.exe26⤵
- Executes dropped EXE
PID:2308 -
\??\c:\lxffxll.exec:\lxffxll.exe27⤵
- Executes dropped EXE
PID:5016 -
\??\c:\hnbbbb.exec:\hnbbbb.exe28⤵
- Executes dropped EXE
PID:2364 -
\??\c:\pvjdj.exec:\pvjdj.exe29⤵
- Executes dropped EXE
PID:4456 -
\??\c:\frxflff.exec:\frxflff.exe30⤵
- Executes dropped EXE
PID:4480 -
\??\c:\ttthhh.exec:\ttthhh.exe31⤵
- Executes dropped EXE
PID:1788 -
\??\c:\3dvvv.exec:\3dvvv.exe32⤵
- Executes dropped EXE
PID:3336 -
\??\c:\fxlffxx.exec:\fxlffxx.exe33⤵
- Executes dropped EXE
PID:1160 -
\??\c:\fxllrrf.exec:\fxllrrf.exe34⤵
- Executes dropped EXE
PID:3720 -
\??\c:\5pppv.exec:\5pppv.exe35⤵
- Executes dropped EXE
PID:3596 -
\??\c:\xxffxff.exec:\xxffxff.exe36⤵
- Executes dropped EXE
PID:1404 -
\??\c:\hnnttt.exec:\hnnttt.exe37⤵
- Executes dropped EXE
PID:1296 -
\??\c:\vpjjp.exec:\vpjjp.exe38⤵
- Executes dropped EXE
PID:3444 -
\??\c:\llllxxl.exec:\llllxxl.exe39⤵
- Executes dropped EXE
PID:4512 -
\??\c:\nbbnnh.exec:\nbbnnh.exe40⤵
- Executes dropped EXE
PID:1656 -
\??\c:\9nbbtt.exec:\9nbbtt.exe41⤵
- Executes dropped EXE
PID:4324 -
\??\c:\dpddd.exec:\dpddd.exe42⤵
- Executes dropped EXE
PID:4372 -
\??\c:\fxxrrrr.exec:\fxxrrrr.exe43⤵
- Executes dropped EXE
PID:756 -
\??\c:\1bhtnt.exec:\1bhtnt.exe44⤵
- Executes dropped EXE
PID:3604 -
\??\c:\1ttnhh.exec:\1ttnhh.exe45⤵
- Executes dropped EXE
PID:4188 -
\??\c:\5ppvj.exec:\5ppvj.exe46⤵
- Executes dropped EXE
PID:1616 -
\??\c:\3fllfxr.exec:\3fllfxr.exe47⤵
- Executes dropped EXE
PID:1740 -
\??\c:\btnhtt.exec:\btnhtt.exe48⤵
- Executes dropped EXE
PID:4964 -
\??\c:\nbtnbh.exec:\nbtnbh.exe49⤵
- Executes dropped EXE
PID:5116 -
\??\c:\vpvpj.exec:\vpvpj.exe50⤵
- Executes dropped EXE
PID:3648 -
\??\c:\xrlffff.exec:\xrlffff.exe51⤵
- Executes dropped EXE
PID:1144 -
\??\c:\hbtnnb.exec:\hbtnnb.exe52⤵
- Executes dropped EXE
PID:64 -
\??\c:\pvppv.exec:\pvppv.exe53⤵
- Executes dropped EXE
PID:5000 -
\??\c:\ppddj.exec:\ppddj.exe54⤵
- Executes dropped EXE
PID:1604 -
\??\c:\xlxrrrl.exec:\xlxrrrl.exe55⤵
- Executes dropped EXE
PID:864 -
\??\c:\1nnnhh.exec:\1nnnhh.exe56⤵
- Executes dropped EXE
PID:1076 -
\??\c:\ddjdj.exec:\ddjdj.exe57⤵
- Executes dropped EXE
PID:3332 -
\??\c:\llxxflr.exec:\llxxflr.exe58⤵
- Executes dropped EXE
PID:4376 -
\??\c:\bttnbt.exec:\bttnbt.exe59⤵
- Executes dropped EXE
PID:4520 -
\??\c:\pvppp.exec:\pvppp.exe60⤵
- Executes dropped EXE
PID:3812 -
\??\c:\3vpjj.exec:\3vpjj.exe61⤵
- Executes dropped EXE
PID:4388 -
\??\c:\7ffxrrl.exec:\7ffxrrl.exe62⤵
- Executes dropped EXE
PID:1508 -
\??\c:\fxfxrfx.exec:\fxfxrfx.exe63⤵
- Executes dropped EXE
PID:3852 -
\??\c:\btbtnh.exec:\btbtnh.exe64⤵
- Executes dropped EXE
PID:2380 -
\??\c:\ppppj.exec:\ppppj.exe65⤵
- Executes dropped EXE
PID:3924 -
\??\c:\vdpjd.exec:\vdpjd.exe66⤵PID:2892
-
\??\c:\llxxxxx.exec:\llxxxxx.exe67⤵PID:2780
-
\??\c:\xxxxrxr.exec:\xxxxrxr.exe68⤵PID:228
-
\??\c:\hhhhbb.exec:\hhhhbb.exe69⤵PID:2136
-
\??\c:\3djdd.exec:\3djdd.exe70⤵PID:1052
-
\??\c:\pjvvv.exec:\pjvvv.exe71⤵PID:4816
-
\??\c:\9ffxxxx.exec:\9ffxxxx.exe72⤵PID:2836
-
\??\c:\7tnbtt.exec:\7tnbtt.exe73⤵PID:5016
-
\??\c:\tbnhhh.exec:\tbnhhh.exe74⤵PID:2684
-
\??\c:\3pppj.exec:\3pppj.exe75⤵PID:1448
-
\??\c:\lxxfxxx.exec:\lxxfxxx.exe76⤵PID:1944
-
\??\c:\lflllll.exec:\lflllll.exe77⤵PID:2444
-
\??\c:\hbbbtt.exec:\hbbbtt.exe78⤵PID:1788
-
\??\c:\nhtnnb.exec:\nhtnnb.exe79⤵PID:3548
-
\??\c:\pjjdv.exec:\pjjdv.exe80⤵PID:4984
-
\??\c:\9xxrlll.exec:\9xxrlll.exe81⤵PID:3664
-
\??\c:\fxfxrxx.exec:\fxfxrxx.exe82⤵PID:3940
-
\??\c:\nbhbnn.exec:\nbhbnn.exe83⤵PID:3904
-
\??\c:\djjvj.exec:\djjvj.exe84⤵PID:1536
-
\??\c:\fxxxrxx.exec:\fxxxrxx.exe85⤵PID:972
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe86⤵PID:1644
-
\??\c:\5thtnb.exec:\5thtnb.exe87⤵PID:1264
-
\??\c:\1hnnnt.exec:\1hnnnt.exe88⤵PID:4364
-
\??\c:\7vppj.exec:\7vppj.exe89⤵PID:3176
-
\??\c:\ddddp.exec:\ddddp.exe90⤵PID:116
-
\??\c:\xllfffx.exec:\xllfffx.exe91⤵PID:4468
-
\??\c:\hthhhh.exec:\hthhhh.exe92⤵PID:32
-
\??\c:\btnnnn.exec:\btnnnn.exe93⤵PID:828
-
\??\c:\7jpdv.exec:\7jpdv.exe94⤵PID:3360
-
\??\c:\xfxrlll.exec:\xfxrlll.exe95⤵PID:868
-
\??\c:\lxfffxl.exec:\lxfffxl.exe96⤵PID:920
-
\??\c:\btbbnt.exec:\btbbnt.exe97⤵PID:936
-
\??\c:\tbhbht.exec:\tbhbht.exe98⤵PID:2020
-
\??\c:\1djdv.exec:\1djdv.exe99⤵PID:4836
-
\??\c:\9flllrr.exec:\9flllrr.exe100⤵PID:4844
-
\??\c:\3xfffxf.exec:\3xfffxf.exe101⤵PID:2704
-
\??\c:\hbhbtt.exec:\hbhbtt.exe102⤵PID:1872
-
\??\c:\ppvpj.exec:\ppvpj.exe103⤵PID:1604
-
\??\c:\jdddp.exec:\jdddp.exe104⤵PID:4896
-
\??\c:\7xffrxl.exec:\7xffrxl.exe105⤵PID:4556
-
\??\c:\7tbtbb.exec:\7tbtbb.exe106⤵PID:2460
-
\??\c:\frxxrrl.exec:\frxxrrl.exe107⤵PID:1252
-
\??\c:\hthbbb.exec:\hthbbb.exe108⤵PID:1096
-
\??\c:\vpdvp.exec:\vpdvp.exe109⤵PID:3864
-
\??\c:\xrllfff.exec:\xrllfff.exe110⤵PID:4368
-
\??\c:\tttttn.exec:\tttttn.exe111⤵PID:1508
-
\??\c:\3jvdj.exec:\3jvdj.exe112⤵PID:4660
-
\??\c:\1jpjd.exec:\1jpjd.exe113⤵PID:1592
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe114⤵PID:2884
-
\??\c:\bbtnhb.exec:\bbtnhb.exe115⤵PID:3876
-
\??\c:\ddjvv.exec:\ddjvv.exe116⤵PID:1728
-
\??\c:\fxrflxr.exec:\fxrflxr.exe117⤵PID:1052
-
\??\c:\5xrrllf.exec:\5xrrllf.exe118⤵PID:4268
-
\??\c:\tnbtnt.exec:\tnbtnt.exe119⤵PID:3544
-
\??\c:\vvpjj.exec:\vvpjj.exe120⤵PID:4424
-
\??\c:\vdjdd.exec:\vdjdd.exe121⤵PID:1084
-
\??\c:\5rrxrrf.exec:\5rrxrrf.exe122⤵PID:4724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-