Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 07:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
91ff6c48df9c11d80cf91dd37b3b1a10_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
91ff6c48df9c11d80cf91dd37b3b1a10_NeikiAnalytics.exe
-
Size
103KB
-
MD5
91ff6c48df9c11d80cf91dd37b3b1a10
-
SHA1
c3ae48eb15c61b918b6a02a3366621534229bc4a
-
SHA256
c0396674dc1f3bd16806afe2fb51c53358126b51b28290139cce6bacf316a505
-
SHA512
06b54e9c84d4e938217eebbfdc4dd5ac11a4c02996b272734fbee0ba3c78c490d33d2c70524caa0be7a1c2ff63f8e54893500bf006bf2155b0e008ebfc4ee454
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoTNKDeS98hPUdHV7RNzfnLnN3oT:ymb3NkkiQ3mdBjFo5KDe88g1fR8R
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/3608-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/932-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/932-63-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2592-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4084-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1712-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5040 dpjjj.exe 3548 flffrff.exe 2284 xrrrlff.exe 2488 3tnnhh.exe 2136 vjjjj.exe 2140 ddjjj.exe 2432 9xfxrrr.exe 932 bhthbb.exe 2592 vpvvd.exe 4456 rrxxrrr.exe 4892 5bhhhh.exe 4752 9jvvj.exe 4084 xllffff.exe 3224 hnhhhb.exe 1316 vpdvp.exe 1924 jdvpp.exe 4908 lxrrllf.exe 5016 btbbtb.exe 3468 tntbnh.exe 3948 jpjjd.exe 3564 rxlfxxx.exe 1896 bbnnbb.exe 3556 hbntbn.exe 4080 dddvp.exe 4956 fxrrllf.exe 2728 ttttnt.exe 1712 jjddv.exe 2148 vdjdd.exe 3328 rrxffxx.exe 4520 nnnhhn.exe 2196 ddddv.exe 5112 lfxxxxr.exe 1416 fxffxfr.exe 3792 thttnn.exe 4048 pjjjd.exe 2512 5vdvv.exe 4196 flrllff.exe 4832 frxfrll.exe 2588 htbbnt.exe 3260 3ttnhh.exe 5040 pvvvp.exe 4828 lxrrlfl.exe 2284 9flfxxr.exe 1828 nhtnhh.exe 4960 jpvpd.exe 1372 7jppp.exe 3852 3xllxrr.exe 3528 1thbhn.exe 2260 7dddp.exe 2592 9flfrxr.exe 5024 fxlrffl.exe 3000 bhnnnn.exe 3308 vdppj.exe 4392 vppjd.exe 1584 5fllfff.exe 1564 vpppp.exe 1316 1frlxxf.exe 1164 nntnhh.exe 860 pvvpj.exe 4036 pdpjj.exe 2940 lfxxffr.exe 3080 frrlllr.exe 1816 thhthn.exe 3416 9ttttt.exe -
resource yara_rule behavioral2/memory/3608-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3548-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/932-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4084-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1712-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3608 wrote to memory of 5040 3608 91ff6c48df9c11d80cf91dd37b3b1a10_NeikiAnalytics.exe 85 PID 3608 wrote to memory of 5040 3608 91ff6c48df9c11d80cf91dd37b3b1a10_NeikiAnalytics.exe 85 PID 3608 wrote to memory of 5040 3608 91ff6c48df9c11d80cf91dd37b3b1a10_NeikiAnalytics.exe 85 PID 5040 wrote to memory of 3548 5040 dpjjj.exe 86 PID 5040 wrote to memory of 3548 5040 dpjjj.exe 86 PID 5040 wrote to memory of 3548 5040 dpjjj.exe 86 PID 3548 wrote to memory of 2284 3548 flffrff.exe 87 PID 3548 wrote to memory of 2284 3548 flffrff.exe 87 PID 3548 wrote to memory of 2284 3548 flffrff.exe 87 PID 2284 wrote to memory of 2488 2284 xrrrlff.exe 88 PID 2284 wrote to memory of 2488 2284 xrrrlff.exe 88 PID 2284 wrote to memory of 2488 2284 xrrrlff.exe 88 PID 2488 wrote to memory of 2136 2488 3tnnhh.exe 89 PID 2488 wrote to memory of 2136 2488 3tnnhh.exe 89 PID 2488 wrote to memory of 2136 2488 3tnnhh.exe 89 PID 2136 wrote to memory of 2140 2136 vjjjj.exe 90 PID 2136 wrote to memory of 2140 2136 vjjjj.exe 90 PID 2136 wrote to memory of 2140 2136 vjjjj.exe 90 PID 2140 wrote to memory of 2432 2140 ddjjj.exe 91 PID 2140 wrote to memory of 2432 2140 ddjjj.exe 91 PID 2140 wrote to memory of 2432 2140 ddjjj.exe 91 PID 2432 wrote to memory of 932 2432 9xfxrrr.exe 92 PID 2432 wrote to memory of 932 2432 9xfxrrr.exe 92 PID 2432 wrote to memory of 932 2432 9xfxrrr.exe 92 PID 932 wrote to memory of 2592 932 bhthbb.exe 93 PID 932 wrote to memory of 2592 932 bhthbb.exe 93 PID 932 wrote to memory of 2592 932 bhthbb.exe 93 PID 2592 wrote to memory of 4456 2592 vpvvd.exe 94 PID 2592 wrote to memory of 4456 2592 vpvvd.exe 94 PID 2592 wrote to memory of 4456 2592 vpvvd.exe 94 PID 4456 wrote to memory of 4892 4456 rrxxrrr.exe 95 PID 4456 wrote to memory of 4892 4456 rrxxrrr.exe 95 PID 4456 wrote to memory of 4892 4456 rrxxrrr.exe 95 PID 4892 wrote to memory of 4752 4892 5bhhhh.exe 96 PID 4892 wrote to memory of 4752 4892 5bhhhh.exe 96 PID 4892 wrote to memory of 4752 4892 5bhhhh.exe 96 PID 4752 wrote to memory of 4084 4752 9jvvj.exe 97 PID 4752 wrote to memory of 4084 4752 9jvvj.exe 97 PID 4752 wrote to memory of 4084 4752 9jvvj.exe 97 PID 4084 wrote to memory of 3224 4084 xllffff.exe 98 PID 4084 wrote to memory of 3224 4084 xllffff.exe 98 PID 4084 wrote to memory of 3224 4084 xllffff.exe 98 PID 3224 wrote to memory of 1316 3224 hnhhhb.exe 99 PID 3224 wrote to memory of 1316 3224 hnhhhb.exe 99 PID 3224 wrote to memory of 1316 3224 hnhhhb.exe 99 PID 1316 wrote to memory of 1924 1316 vpdvp.exe 100 PID 1316 wrote to memory of 1924 1316 vpdvp.exe 100 PID 1316 wrote to memory of 1924 1316 vpdvp.exe 100 PID 1924 wrote to memory of 4908 1924 jdvpp.exe 101 PID 1924 wrote to memory of 4908 1924 jdvpp.exe 101 PID 1924 wrote to memory of 4908 1924 jdvpp.exe 101 PID 4908 wrote to memory of 5016 4908 lxrrllf.exe 102 PID 4908 wrote to memory of 5016 4908 lxrrllf.exe 102 PID 4908 wrote to memory of 5016 4908 lxrrllf.exe 102 PID 5016 wrote to memory of 3468 5016 btbbtb.exe 103 PID 5016 wrote to memory of 3468 5016 btbbtb.exe 103 PID 5016 wrote to memory of 3468 5016 btbbtb.exe 103 PID 3468 wrote to memory of 3948 3468 tntbnh.exe 104 PID 3468 wrote to memory of 3948 3468 tntbnh.exe 104 PID 3468 wrote to memory of 3948 3468 tntbnh.exe 104 PID 3948 wrote to memory of 3564 3948 jpjjd.exe 105 PID 3948 wrote to memory of 3564 3948 jpjjd.exe 105 PID 3948 wrote to memory of 3564 3948 jpjjd.exe 105 PID 3564 wrote to memory of 1896 3564 rxlfxxx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\91ff6c48df9c11d80cf91dd37b3b1a10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\91ff6c48df9c11d80cf91dd37b3b1a10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\dpjjj.exec:\dpjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\flffrff.exec:\flffrff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\xrrrlff.exec:\xrrrlff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\3tnnhh.exec:\3tnnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\vjjjj.exec:\vjjjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\ddjjj.exec:\ddjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\9xfxrrr.exec:\9xfxrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\bhthbb.exec:\bhthbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\vpvvd.exec:\vpvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rrxxrrr.exec:\rrxxrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\5bhhhh.exec:\5bhhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\9jvvj.exec:\9jvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\xllffff.exec:\xllffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\hnhhhb.exec:\hnhhhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\vpdvp.exec:\vpdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\jdvpp.exec:\jdvpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\lxrrllf.exec:\lxrrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\btbbtb.exec:\btbbtb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\tntbnh.exec:\tntbnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\jpjjd.exec:\jpjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\rxlfxxx.exec:\rxlfxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\bbnnbb.exec:\bbnnbb.exe23⤵
- Executes dropped EXE
PID:1896 -
\??\c:\hbntbn.exec:\hbntbn.exe24⤵
- Executes dropped EXE
PID:3556 -
\??\c:\dddvp.exec:\dddvp.exe25⤵
- Executes dropped EXE
PID:4080 -
\??\c:\fxrrllf.exec:\fxrrllf.exe26⤵
- Executes dropped EXE
PID:4956 -
\??\c:\ttttnt.exec:\ttttnt.exe27⤵
- Executes dropped EXE
PID:2728 -
\??\c:\jjddv.exec:\jjddv.exe28⤵
- Executes dropped EXE
PID:1712 -
\??\c:\vdjdd.exec:\vdjdd.exe29⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rrxffxx.exec:\rrxffxx.exe30⤵
- Executes dropped EXE
PID:3328 -
\??\c:\nnnhhn.exec:\nnnhhn.exe31⤵
- Executes dropped EXE
PID:4520 -
\??\c:\ddddv.exec:\ddddv.exe32⤵
- Executes dropped EXE
PID:2196 -
\??\c:\lfxxxxr.exec:\lfxxxxr.exe33⤵
- Executes dropped EXE
PID:5112 -
\??\c:\fxffxfr.exec:\fxffxfr.exe34⤵
- Executes dropped EXE
PID:1416 -
\??\c:\thttnn.exec:\thttnn.exe35⤵
- Executes dropped EXE
PID:3792 -
\??\c:\pjjjd.exec:\pjjjd.exe36⤵
- Executes dropped EXE
PID:4048 -
\??\c:\5vdvv.exec:\5vdvv.exe37⤵
- Executes dropped EXE
PID:2512 -
\??\c:\flrllff.exec:\flrllff.exe38⤵
- Executes dropped EXE
PID:4196 -
\??\c:\frxfrll.exec:\frxfrll.exe39⤵
- Executes dropped EXE
PID:4832 -
\??\c:\htbbnt.exec:\htbbnt.exe40⤵
- Executes dropped EXE
PID:2588 -
\??\c:\3ttnhh.exec:\3ttnhh.exe41⤵
- Executes dropped EXE
PID:3260 -
\??\c:\pvvvp.exec:\pvvvp.exe42⤵
- Executes dropped EXE
PID:5040 -
\??\c:\lxrrlfl.exec:\lxrrlfl.exe43⤵
- Executes dropped EXE
PID:4828 -
\??\c:\9flfxxr.exec:\9flfxxr.exe44⤵
- Executes dropped EXE
PID:2284 -
\??\c:\nhtnhh.exec:\nhtnhh.exe45⤵
- Executes dropped EXE
PID:1828 -
\??\c:\jpvpd.exec:\jpvpd.exe46⤵
- Executes dropped EXE
PID:4960 -
\??\c:\7jppp.exec:\7jppp.exe47⤵
- Executes dropped EXE
PID:1372 -
\??\c:\3xllxrr.exec:\3xllxrr.exe48⤵
- Executes dropped EXE
PID:3852 -
\??\c:\1thbhn.exec:\1thbhn.exe49⤵
- Executes dropped EXE
PID:3528 -
\??\c:\7dddp.exec:\7dddp.exe50⤵
- Executes dropped EXE
PID:2260 -
\??\c:\9flfrxr.exec:\9flfrxr.exe51⤵
- Executes dropped EXE
PID:2592 -
\??\c:\fxlrffl.exec:\fxlrffl.exe52⤵
- Executes dropped EXE
PID:5024 -
\??\c:\bhnnnn.exec:\bhnnnn.exe53⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vdppj.exec:\vdppj.exe54⤵
- Executes dropped EXE
PID:3308 -
\??\c:\vppjd.exec:\vppjd.exe55⤵
- Executes dropped EXE
PID:4392 -
\??\c:\5fllfff.exec:\5fllfff.exe56⤵
- Executes dropped EXE
PID:1584 -
\??\c:\vpppp.exec:\vpppp.exe57⤵
- Executes dropped EXE
PID:1564 -
\??\c:\1frlxxf.exec:\1frlxxf.exe58⤵
- Executes dropped EXE
PID:1316 -
\??\c:\nntnhh.exec:\nntnhh.exe59⤵
- Executes dropped EXE
PID:1164 -
\??\c:\pvvpj.exec:\pvvpj.exe60⤵
- Executes dropped EXE
PID:860 -
\??\c:\pdpjj.exec:\pdpjj.exe61⤵
- Executes dropped EXE
PID:4036 -
\??\c:\lfxxffr.exec:\lfxxffr.exe62⤵
- Executes dropped EXE
PID:2940 -
\??\c:\frrlllr.exec:\frrlllr.exe63⤵
- Executes dropped EXE
PID:3080 -
\??\c:\thhthn.exec:\thhthn.exe64⤵
- Executes dropped EXE
PID:1816 -
\??\c:\9ttttt.exec:\9ttttt.exe65⤵
- Executes dropped EXE
PID:3416 -
\??\c:\5pvdp.exec:\5pvdp.exe66⤵PID:748
-
\??\c:\ppvpp.exec:\ppvpp.exe67⤵PID:788
-
\??\c:\ffffxxx.exec:\ffffxxx.exe68⤵PID:384
-
\??\c:\nnbbht.exec:\nnbbht.exe69⤵PID:3628
-
\??\c:\btnhhh.exec:\btnhhh.exe70⤵PID:1940
-
\??\c:\ppjdp.exec:\ppjdp.exe71⤵PID:4952
-
\??\c:\1flfxll.exec:\1flfxll.exe72⤵PID:3328
-
\??\c:\htttnb.exec:\htttnb.exe73⤵PID:4488
-
\??\c:\rrflrxl.exec:\rrflrxl.exe74⤵PID:1124
-
\??\c:\7bnnnt.exec:\7bnnnt.exe75⤵PID:1948
-
\??\c:\ddppd.exec:\ddppd.exe76⤵PID:4264
-
\??\c:\vdppp.exec:\vdppp.exe77⤵PID:4756
-
\??\c:\rxffxxx.exec:\rxffxxx.exe78⤵PID:2028
-
\??\c:\rrfxrfl.exec:\rrfxrfl.exe79⤵PID:4472
-
\??\c:\hbhbbb.exec:\hbhbbb.exe80⤵PID:744
-
\??\c:\vddvp.exec:\vddvp.exe81⤵PID:4868
-
\??\c:\xrxrlll.exec:\xrxrlll.exe82⤵PID:3608
-
\??\c:\hbnnnt.exec:\hbnnnt.exe83⤵PID:1284
-
\??\c:\bbbtnt.exec:\bbbtnt.exe84⤵PID:704
-
\??\c:\9pvpp.exec:\9pvpp.exe85⤵PID:3548
-
\??\c:\jpvvp.exec:\jpvvp.exe86⤵PID:1020
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe87⤵PID:2464
-
\??\c:\fxxrxfx.exec:\fxxrxfx.exe88⤵PID:2296
-
\??\c:\7thbbb.exec:\7thbbb.exe89⤵PID:1900
-
\??\c:\9ttbtb.exec:\9ttbtb.exe90⤵PID:4880
-
\??\c:\pjpjd.exec:\pjpjd.exe91⤵PID:1968
-
\??\c:\fffffrl.exec:\fffffrl.exe92⤵PID:2260
-
\??\c:\7hhbnh.exec:\7hhbnh.exe93⤵PID:2592
-
\??\c:\nthhht.exec:\nthhht.exe94⤵PID:5024
-
\??\c:\jjjjd.exec:\jjjjd.exe95⤵PID:4752
-
\??\c:\pjddv.exec:\pjddv.exe96⤵PID:2544
-
\??\c:\5lrxlrl.exec:\5lrxlrl.exe97⤵PID:4920
-
\??\c:\xxrlrrr.exec:\xxrlrrr.exe98⤵PID:5080
-
\??\c:\nnbbhh.exec:\nnbbhh.exe99⤵PID:2172
-
\??\c:\vjjjd.exec:\vjjjd.exe100⤵PID:4800
-
\??\c:\1dddv.exec:\1dddv.exe101⤵PID:1084
-
\??\c:\pjvpd.exec:\pjvpd.exe102⤵PID:1832
-
\??\c:\frrxrrl.exec:\frrxrrl.exe103⤵PID:2380
-
\??\c:\nnnnbb.exec:\nnnnbb.exe104⤵PID:2884
-
\??\c:\9bbbhh.exec:\9bbbhh.exe105⤵PID:5000
-
\??\c:\pjddv.exec:\pjddv.exe106⤵PID:3296
-
\??\c:\dvdvp.exec:\dvdvp.exe107⤵PID:1988
-
\??\c:\frfxrrr.exec:\frfxrrr.exe108⤵PID:2984
-
\??\c:\1hbtnb.exec:\1hbtnb.exe109⤵PID:2608
-
\??\c:\ntbbbh.exec:\ntbbbh.exe110⤵PID:64
-
\??\c:\pppvv.exec:\pppvv.exe111⤵PID:4708
-
\??\c:\7ppjd.exec:\7ppjd.exe112⤵PID:2784
-
\??\c:\xrlfffx.exec:\xrlfffx.exe113⤵PID:3824
-
\??\c:\rxfxxxr.exec:\rxfxxxr.exe114⤵PID:4492
-
\??\c:\htbbth.exec:\htbbth.exe115⤵PID:2148
-
\??\c:\9ntnhn.exec:\9ntnhn.exe116⤵PID:3692
-
\??\c:\vdpjj.exec:\vdpjj.exe117⤵PID:2276
-
\??\c:\dvvvj.exec:\dvvvj.exe118⤵PID:4268
-
\??\c:\rlrllfr.exec:\rlrllfr.exe119⤵PID:5112
-
\??\c:\jdpjd.exec:\jdpjd.exe120⤵PID:4756
-
\??\c:\fxrrffr.exec:\fxrrffr.exe121⤵PID:2512
-
\??\c:\xflffll.exec:\xflffll.exe122⤵PID:4404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-