Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 14:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
76fe96754c1143f0a2a220039ea45580_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
76fe96754c1143f0a2a220039ea45580_NeikiAnalytics.exe
-
Size
395KB
-
MD5
76fe96754c1143f0a2a220039ea45580
-
SHA1
303792313ed244eedd160fd5d8077532880e2186
-
SHA256
00478da94fbb88bd1f6adb9e43374d5b5cdf50f5b103a275913722c57f4b8e28
-
SHA512
c5228d07fe06ad8ae110dfbbe9c3a811f1fa90aecaad9157246c9f7fb451fa0520a8a160869a30c60b76c043431b64cb0f1e5dd1f236c8c0a017cbbcfbf5f363
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjkobjcSbcY+CaQdaFOY4iGFYtRdu/M:n3C9ytvngQjZbz+xt4vFBk
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4884-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1140-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2500-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2732 pvdpj.exe 3076 nnbtnh.exe 1796 7bnbtt.exe 2136 9lfxllf.exe 1292 dddjd.exe 1412 bbhhhb.exe 3000 xlxrrlx.exe 1704 vpjvp.exe 2560 9jvjd.exe 4212 lfxxrfx.exe 2428 7ffxxxr.exe 1984 htttnn.exe 3836 nhhbnn.exe 2316 bnhnht.exe 3024 lfflxxx.exe 3548 jpddj.exe 1140 jvddv.exe 540 bbbbtt.exe 4492 xlrrllx.exe 2620 9httnh.exe 2500 vvjvv.exe 4568 xlxrffx.exe 4580 nbhbnh.exe 5064 7tnhtb.exe 3228 3bbtnh.exe 2340 lffxrrl.exe 3704 5tbtnt.exe 4852 5ntnbb.exe 4148 xffxxxx.exe 716 jddvp.exe 980 hhbtnh.exe 4620 tnnhtt.exe 1616 5jdvp.exe 1260 1bbtnh.exe 2476 ppvpj.exe 3380 frlflfr.exe 4720 tnnbtn.exe 4380 nhhbnn.exe 4796 3jjdp.exe 5112 lflxrlf.exe 3668 nhnhbb.exe 2596 ttbnhh.exe 4680 3jjdv.exe 4432 rxfxrrl.exe 4360 llxflxl.exe 2672 bnthbt.exe 3924 3pjdd.exe 3300 vjvpd.exe 1248 fxfxllf.exe 1748 nnbttn.exe 4008 9tbnhh.exe 1712 jdvpj.exe 3464 rlfrflx.exe 2216 bhbthh.exe 3712 vjvvd.exe 4332 1ffxllf.exe 4916 hbbtnn.exe 4704 jddvd.exe 1636 vvvpj.exe 2976 3ffxrll.exe 4356 hhnhbb.exe 1944 1djdd.exe 4924 rllrfxr.exe 1984 htbtnn.exe -
resource yara_rule behavioral2/memory/4884-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3548-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1140-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2500-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4884 wrote to memory of 2732 4884 76fe96754c1143f0a2a220039ea45580_NeikiAnalytics.exe 81 PID 4884 wrote to memory of 2732 4884 76fe96754c1143f0a2a220039ea45580_NeikiAnalytics.exe 81 PID 4884 wrote to memory of 2732 4884 76fe96754c1143f0a2a220039ea45580_NeikiAnalytics.exe 81 PID 2732 wrote to memory of 3076 2732 pvdpj.exe 82 PID 2732 wrote to memory of 3076 2732 pvdpj.exe 82 PID 2732 wrote to memory of 3076 2732 pvdpj.exe 82 PID 3076 wrote to memory of 1796 3076 nnbtnh.exe 83 PID 3076 wrote to memory of 1796 3076 nnbtnh.exe 83 PID 3076 wrote to memory of 1796 3076 nnbtnh.exe 83 PID 1796 wrote to memory of 2136 1796 7bnbtt.exe 84 PID 1796 wrote to memory of 2136 1796 7bnbtt.exe 84 PID 1796 wrote to memory of 2136 1796 7bnbtt.exe 84 PID 2136 wrote to memory of 1292 2136 9lfxllf.exe 85 PID 2136 wrote to memory of 1292 2136 9lfxllf.exe 85 PID 2136 wrote to memory of 1292 2136 9lfxllf.exe 85 PID 1292 wrote to memory of 1412 1292 dddjd.exe 86 PID 1292 wrote to memory of 1412 1292 dddjd.exe 86 PID 1292 wrote to memory of 1412 1292 dddjd.exe 86 PID 1412 wrote to memory of 3000 1412 bbhhhb.exe 87 PID 1412 wrote to memory of 3000 1412 bbhhhb.exe 87 PID 1412 wrote to memory of 3000 1412 bbhhhb.exe 87 PID 3000 wrote to memory of 1704 3000 xlxrrlx.exe 88 PID 3000 wrote to memory of 1704 3000 xlxrrlx.exe 88 PID 3000 wrote to memory of 1704 3000 xlxrrlx.exe 88 PID 1704 wrote to memory of 2560 1704 vpjvp.exe 89 PID 1704 wrote to memory of 2560 1704 vpjvp.exe 89 PID 1704 wrote to memory of 2560 1704 vpjvp.exe 89 PID 2560 wrote to memory of 4212 2560 9jvjd.exe 90 PID 2560 wrote to memory of 4212 2560 9jvjd.exe 90 PID 2560 wrote to memory of 4212 2560 9jvjd.exe 90 PID 4212 wrote to memory of 2428 4212 lfxxrfx.exe 91 PID 4212 wrote to memory of 2428 4212 lfxxrfx.exe 91 PID 4212 wrote to memory of 2428 4212 lfxxrfx.exe 91 PID 2428 wrote to memory of 1984 2428 7ffxxxr.exe 92 PID 2428 wrote to memory of 1984 2428 7ffxxxr.exe 92 PID 2428 wrote to memory of 1984 2428 7ffxxxr.exe 92 PID 1984 wrote to memory of 3836 1984 htttnn.exe 93 PID 1984 wrote to memory of 3836 1984 htttnn.exe 93 PID 1984 wrote to memory of 3836 1984 htttnn.exe 93 PID 3836 wrote to memory of 2316 3836 nhhbnn.exe 94 PID 3836 wrote to memory of 2316 3836 nhhbnn.exe 94 PID 3836 wrote to memory of 2316 3836 nhhbnn.exe 94 PID 2316 wrote to memory of 3024 2316 bnhnht.exe 95 PID 2316 wrote to memory of 3024 2316 bnhnht.exe 95 PID 2316 wrote to memory of 3024 2316 bnhnht.exe 95 PID 3024 wrote to memory of 3548 3024 lfflxxx.exe 96 PID 3024 wrote to memory of 3548 3024 lfflxxx.exe 96 PID 3024 wrote to memory of 3548 3024 lfflxxx.exe 96 PID 3548 wrote to memory of 1140 3548 jpddj.exe 97 PID 3548 wrote to memory of 1140 3548 jpddj.exe 97 PID 3548 wrote to memory of 1140 3548 jpddj.exe 97 PID 1140 wrote to memory of 540 1140 jvddv.exe 98 PID 1140 wrote to memory of 540 1140 jvddv.exe 98 PID 1140 wrote to memory of 540 1140 jvddv.exe 98 PID 540 wrote to memory of 4492 540 bbbbtt.exe 99 PID 540 wrote to memory of 4492 540 bbbbtt.exe 99 PID 540 wrote to memory of 4492 540 bbbbtt.exe 99 PID 4492 wrote to memory of 2620 4492 xlrrllx.exe 100 PID 4492 wrote to memory of 2620 4492 xlrrllx.exe 100 PID 4492 wrote to memory of 2620 4492 xlrrllx.exe 100 PID 2620 wrote to memory of 2500 2620 9httnh.exe 101 PID 2620 wrote to memory of 2500 2620 9httnh.exe 101 PID 2620 wrote to memory of 2500 2620 9httnh.exe 101 PID 2500 wrote to memory of 4568 2500 vvjvv.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\76fe96754c1143f0a2a220039ea45580_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\76fe96754c1143f0a2a220039ea45580_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\pvdpj.exec:\pvdpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\nnbtnh.exec:\nnbtnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\7bnbtt.exec:\7bnbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\9lfxllf.exec:\9lfxllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\dddjd.exec:\dddjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\bbhhhb.exec:\bbhhhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\xlxrrlx.exec:\xlxrrlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\vpjvp.exec:\vpjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\9jvjd.exec:\9jvjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\lfxxrfx.exec:\lfxxrfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\7ffxxxr.exec:\7ffxxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\htttnn.exec:\htttnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\nhhbnn.exec:\nhhbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\bnhnht.exec:\bnhnht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\lfflxxx.exec:\lfflxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\jpddj.exec:\jpddj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\jvddv.exec:\jvddv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\bbbbtt.exec:\bbbbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\xlrrllx.exec:\xlrrllx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\9httnh.exec:\9httnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\vvjvv.exec:\vvjvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\xlxrffx.exec:\xlxrffx.exe23⤵
- Executes dropped EXE
PID:4568 -
\??\c:\nbhbnh.exec:\nbhbnh.exe24⤵
- Executes dropped EXE
PID:4580 -
\??\c:\7tnhtb.exec:\7tnhtb.exe25⤵
- Executes dropped EXE
PID:5064 -
\??\c:\3bbtnh.exec:\3bbtnh.exe26⤵
- Executes dropped EXE
PID:3228 -
\??\c:\lffxrrl.exec:\lffxrrl.exe27⤵
- Executes dropped EXE
PID:2340 -
\??\c:\5tbtnt.exec:\5tbtnt.exe28⤵
- Executes dropped EXE
PID:3704 -
\??\c:\5ntnbb.exec:\5ntnbb.exe29⤵
- Executes dropped EXE
PID:4852 -
\??\c:\xffxxxx.exec:\xffxxxx.exe30⤵
- Executes dropped EXE
PID:4148 -
\??\c:\jddvp.exec:\jddvp.exe31⤵
- Executes dropped EXE
PID:716 -
\??\c:\hhbtnh.exec:\hhbtnh.exe32⤵
- Executes dropped EXE
PID:980 -
\??\c:\tnnhtt.exec:\tnnhtt.exe33⤵
- Executes dropped EXE
PID:4620 -
\??\c:\5jdvp.exec:\5jdvp.exe34⤵
- Executes dropped EXE
PID:1616 -
\??\c:\1bbtnh.exec:\1bbtnh.exe35⤵
- Executes dropped EXE
PID:1260 -
\??\c:\ppvpj.exec:\ppvpj.exe36⤵
- Executes dropped EXE
PID:2476 -
\??\c:\frlflfr.exec:\frlflfr.exe37⤵
- Executes dropped EXE
PID:3380 -
\??\c:\tnnbtn.exec:\tnnbtn.exe38⤵
- Executes dropped EXE
PID:4720 -
\??\c:\nhhbnn.exec:\nhhbnn.exe39⤵
- Executes dropped EXE
PID:4380 -
\??\c:\3jjdp.exec:\3jjdp.exe40⤵
- Executes dropped EXE
PID:4796 -
\??\c:\lflxrlf.exec:\lflxrlf.exe41⤵
- Executes dropped EXE
PID:5112 -
\??\c:\nhnhbb.exec:\nhnhbb.exe42⤵
- Executes dropped EXE
PID:3668 -
\??\c:\ttbnhh.exec:\ttbnhh.exe43⤵
- Executes dropped EXE
PID:2596 -
\??\c:\3jjdv.exec:\3jjdv.exe44⤵
- Executes dropped EXE
PID:4680 -
\??\c:\rxfxrrl.exec:\rxfxrrl.exe45⤵
- Executes dropped EXE
PID:4432 -
\??\c:\llxflxl.exec:\llxflxl.exe46⤵
- Executes dropped EXE
PID:4360 -
\??\c:\bnthbt.exec:\bnthbt.exe47⤵
- Executes dropped EXE
PID:2672 -
\??\c:\3pjdd.exec:\3pjdd.exe48⤵
- Executes dropped EXE
PID:3924 -
\??\c:\vjvpd.exec:\vjvpd.exe49⤵
- Executes dropped EXE
PID:3300 -
\??\c:\fxfxllf.exec:\fxfxllf.exe50⤵
- Executes dropped EXE
PID:1248 -
\??\c:\nnbttn.exec:\nnbttn.exe51⤵
- Executes dropped EXE
PID:1748 -
\??\c:\9tbnhh.exec:\9tbnhh.exe52⤵
- Executes dropped EXE
PID:4008 -
\??\c:\jdvpj.exec:\jdvpj.exe53⤵
- Executes dropped EXE
PID:1712 -
\??\c:\rlfrflx.exec:\rlfrflx.exe54⤵
- Executes dropped EXE
PID:3464 -
\??\c:\bhbthh.exec:\bhbthh.exe55⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vjvvd.exec:\vjvvd.exe56⤵
- Executes dropped EXE
PID:3712 -
\??\c:\1ffxllf.exec:\1ffxllf.exe57⤵
- Executes dropped EXE
PID:4332 -
\??\c:\hbbtnn.exec:\hbbtnn.exe58⤵
- Executes dropped EXE
PID:4916 -
\??\c:\jddvd.exec:\jddvd.exe59⤵
- Executes dropped EXE
PID:4704 -
\??\c:\vvvpj.exec:\vvvpj.exe60⤵
- Executes dropped EXE
PID:1636 -
\??\c:\3ffxrll.exec:\3ffxrll.exe61⤵
- Executes dropped EXE
PID:2976 -
\??\c:\hhnhbb.exec:\hhnhbb.exe62⤵
- Executes dropped EXE
PID:4356 -
\??\c:\1djdd.exec:\1djdd.exe63⤵
- Executes dropped EXE
PID:1944 -
\??\c:\rllrfxr.exec:\rllrfxr.exe64⤵
- Executes dropped EXE
PID:4924 -
\??\c:\htbtnn.exec:\htbtnn.exe65⤵
- Executes dropped EXE
PID:1984 -
\??\c:\hthbbb.exec:\hthbbb.exe66⤵PID:2624
-
\??\c:\vdjvp.exec:\vdjvp.exe67⤵PID:900
-
\??\c:\lflfxxl.exec:\lflfxxl.exe68⤵PID:2408
-
\??\c:\hbhbtn.exec:\hbhbtn.exe69⤵PID:1508
-
\??\c:\ddvpv.exec:\ddvpv.exe70⤵PID:1356
-
\??\c:\tbttnn.exec:\tbttnn.exe71⤵PID:3960
-
\??\c:\3jjpj.exec:\3jjpj.exe72⤵PID:2492
-
\??\c:\fxxfxfx.exec:\fxxfxfx.exe73⤵PID:4956
-
\??\c:\bbhnnb.exec:\bbhnnb.exe74⤵PID:4492
-
\??\c:\dvddv.exec:\dvddv.exe75⤵PID:512
-
\??\c:\xfxxlfr.exec:\xfxxlfr.exe76⤵PID:3912
-
\??\c:\hbbtnn.exec:\hbbtnn.exe77⤵PID:3016
-
\??\c:\ddjjd.exec:\ddjjd.exe78⤵PID:4696
-
\??\c:\rfxxlfr.exec:\rfxxlfr.exe79⤵PID:4660
-
\??\c:\bhtbnb.exec:\bhtbnb.exe80⤵PID:4528
-
\??\c:\ppjjv.exec:\ppjjv.exe81⤵PID:2336
-
\??\c:\3pjdd.exec:\3pjdd.exe82⤵PID:5080
-
\??\c:\lrxrllx.exec:\lrxrllx.exe83⤵PID:884
-
\??\c:\1hhhbb.exec:\1hhhbb.exe84⤵PID:2112
-
\??\c:\hbbthh.exec:\hbbthh.exe85⤵PID:5036
-
\??\c:\jpjdv.exec:\jpjdv.exe86⤵PID:776
-
\??\c:\rxlfllr.exec:\rxlfllr.exe87⤵PID:2740
-
\??\c:\5hnhhh.exec:\5hnhhh.exe88⤵PID:2968
-
\??\c:\hbbbbb.exec:\hbbbbb.exe89⤵PID:1616
-
\??\c:\1vvpd.exec:\1vvpd.exe90⤵PID:2728
-
\??\c:\fffxffl.exec:\fffxffl.exe91⤵PID:3380
-
\??\c:\1flllrl.exec:\1flllrl.exe92⤵PID:3180
-
\??\c:\htnhhh.exec:\htnhhh.exe93⤵PID:4796
-
\??\c:\jdvpj.exec:\jdvpj.exe94⤵PID:208
-
\??\c:\pvddv.exec:\pvddv.exe95⤵PID:3668
-
\??\c:\ffffffl.exec:\ffffffl.exe96⤵PID:1720
-
\??\c:\9hbbtn.exec:\9hbbtn.exe97⤵PID:1580
-
\??\c:\jvvvp.exec:\jvvvp.exe98⤵PID:4360
-
\??\c:\3htnhh.exec:\3htnhh.exe99⤵PID:2672
-
\??\c:\pjppp.exec:\pjppp.exe100⤵PID:3924
-
\??\c:\rfxrrlf.exec:\rfxrrlf.exe101⤵PID:3300
-
\??\c:\hhnhbb.exec:\hhnhbb.exe102⤵PID:3076
-
\??\c:\1pdvd.exec:\1pdvd.exe103⤵PID:1748
-
\??\c:\7xlfffl.exec:\7xlfffl.exe104⤵PID:4204
-
\??\c:\tnnhbb.exec:\tnnhbb.exe105⤵PID:1712
-
\??\c:\vdvpd.exec:\vdvpd.exe106⤵PID:5000
-
\??\c:\rllfxxr.exec:\rllfxxr.exe107⤵PID:2748
-
\??\c:\9nnhhb.exec:\9nnhhb.exe108⤵PID:3132
-
\??\c:\5tbbtt.exec:\5tbbtt.exe109⤵PID:2276
-
\??\c:\dvvvp.exec:\dvvvp.exe110⤵PID:2920
-
\??\c:\rxrrxlr.exec:\rxrrxlr.exe111⤵PID:4704
-
\??\c:\ttbnbb.exec:\ttbnbb.exe112⤵PID:1360
-
\??\c:\vpvpp.exec:\vpvpp.exe113⤵PID:4212
-
\??\c:\9rfxrrl.exec:\9rfxrrl.exe114⤵PID:1888
-
\??\c:\ththhh.exec:\ththhh.exe115⤵PID:4376
-
\??\c:\7bbbtt.exec:\7bbbtt.exe116⤵PID:1168
-
\??\c:\jpvvd.exec:\jpvvd.exe117⤵PID:4640
-
\??\c:\fflfrlr.exec:\fflfrlr.exe118⤵PID:5088
-
\??\c:\3nnhhn.exec:\3nnhhn.exe119⤵PID:2092
-
\??\c:\1jvpp.exec:\1jvpp.exe120⤵PID:3724
-
\??\c:\xxrlrrf.exec:\xxrlrrf.exe121⤵PID:1124
-
\??\c:\hbbnnb.exec:\hbbnnb.exe122⤵PID:2124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-