Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 02:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9896cd1b796bafac8faaa7a66aef4a70_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
9896cd1b796bafac8faaa7a66aef4a70_NeikiAnalytics.exe
-
Size
92KB
-
MD5
9896cd1b796bafac8faaa7a66aef4a70
-
SHA1
7dc75f7e4a7168ce99a0f13435ad9a1eb065523c
-
SHA256
02e6da3b50bad1d34e88cfebd404318e698e3868a0da6b37502cd52489857f72
-
SHA512
0f518e2271bfa2d52c9cae295cdeb9ac91f4989f609991ffa7bca1ff988ce777cd3e22a1f557421bc73fba20181f64d78e038a3a567f597a1890f7b0fdcf85d8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/21+:ymb3NkkiQ3mdBjFo73PYP1lri3K8GN4f
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2424-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4336-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2564-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-48-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4112-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1276-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1300-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4336-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4336 9dddd.exe 4000 jpdvv.exe 2920 9lllfff.exe 2564 ttbbth.exe 2524 jjppd.exe 1580 lxllllr.exe 4112 hbhtth.exe 4192 ntbbtb.exe 8 dvvpj.exe 4548 frxxxxx.exe 2540 tbnbnt.exe 1004 jdppv.exe 1276 fxlfxrl.exe 4632 btbbhh.exe 1300 jvddv.exe 2320 flrrrxx.exe 4108 lxlfrrr.exe 4724 5hhbtt.exe 3376 jjjvp.exe 3620 xllxrrl.exe 1648 htttnn.exe 4120 vddjd.exe 3024 ddppp.exe 3988 rrlxxrr.exe 3716 9hhbbt.exe 1092 bnnhtt.exe 4336 jdddd.exe 1212 xllllll.exe 4900 ttbtnn.exe 4836 hhbbtt.exe 2176 vvpjj.exe 3772 rffxllf.exe 4824 rxxxrxf.exe 468 1dvvv.exe 4776 rllfxxr.exe 4636 rffffff.exe 368 tntttb.exe 3248 jjjdd.exe 4672 pjdvp.exe 4028 lrxfffx.exe 3952 nbbbtt.exe 1852 vpvpv.exe 1688 flxxxxx.exe 2284 bnttnn.exe 2320 thtnbh.exe 1976 dpdvp.exe 3660 lfffxxx.exe 3476 tnnnhn.exe 4564 hnnhbb.exe 4008 pjppp.exe 1680 djjjd.exe 4292 1xxxlll.exe 4144 5bbttb.exe 4380 vddvv.exe 3908 vvppj.exe 4000 frfxrll.exe 916 nttttb.exe 1212 vdpjd.exe 4420 jddvp.exe 3756 xrxfrxf.exe 1220 rxxxxfx.exe 860 bthbbh.exe 2588 nbtbhh.exe 3772 pdddv.exe -
resource yara_rule behavioral2/memory/2424-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2564-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1276-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1300-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2424 wrote to memory of 4336 2424 9896cd1b796bafac8faaa7a66aef4a70_NeikiAnalytics.exe 92 PID 2424 wrote to memory of 4336 2424 9896cd1b796bafac8faaa7a66aef4a70_NeikiAnalytics.exe 92 PID 2424 wrote to memory of 4336 2424 9896cd1b796bafac8faaa7a66aef4a70_NeikiAnalytics.exe 92 PID 4336 wrote to memory of 4000 4336 9dddd.exe 93 PID 4336 wrote to memory of 4000 4336 9dddd.exe 93 PID 4336 wrote to memory of 4000 4336 9dddd.exe 93 PID 4000 wrote to memory of 2920 4000 jpdvv.exe 94 PID 4000 wrote to memory of 2920 4000 jpdvv.exe 94 PID 4000 wrote to memory of 2920 4000 jpdvv.exe 94 PID 2920 wrote to memory of 2564 2920 9lllfff.exe 95 PID 2920 wrote to memory of 2564 2920 9lllfff.exe 95 PID 2920 wrote to memory of 2564 2920 9lllfff.exe 95 PID 2564 wrote to memory of 2524 2564 ttbbth.exe 96 PID 2564 wrote to memory of 2524 2564 ttbbth.exe 96 PID 2564 wrote to memory of 2524 2564 ttbbth.exe 96 PID 2524 wrote to memory of 1580 2524 jjppd.exe 97 PID 2524 wrote to memory of 1580 2524 jjppd.exe 97 PID 2524 wrote to memory of 1580 2524 jjppd.exe 97 PID 1580 wrote to memory of 4112 1580 lxllllr.exe 98 PID 1580 wrote to memory of 4112 1580 lxllllr.exe 98 PID 1580 wrote to memory of 4112 1580 lxllllr.exe 98 PID 4112 wrote to memory of 4192 4112 hbhtth.exe 99 PID 4112 wrote to memory of 4192 4112 hbhtth.exe 99 PID 4112 wrote to memory of 4192 4112 hbhtth.exe 99 PID 4192 wrote to memory of 8 4192 ntbbtb.exe 100 PID 4192 wrote to memory of 8 4192 ntbbtb.exe 100 PID 4192 wrote to memory of 8 4192 ntbbtb.exe 100 PID 8 wrote to memory of 4548 8 dvvpj.exe 101 PID 8 wrote to memory of 4548 8 dvvpj.exe 101 PID 8 wrote to memory of 4548 8 dvvpj.exe 101 PID 4548 wrote to memory of 2540 4548 frxxxxx.exe 102 PID 4548 wrote to memory of 2540 4548 frxxxxx.exe 102 PID 4548 wrote to memory of 2540 4548 frxxxxx.exe 102 PID 2540 wrote to memory of 1004 2540 tbnbnt.exe 103 PID 2540 wrote to memory of 1004 2540 tbnbnt.exe 103 PID 2540 wrote to memory of 1004 2540 tbnbnt.exe 103 PID 1004 wrote to memory of 1276 1004 jdppv.exe 104 PID 1004 wrote to memory of 1276 1004 jdppv.exe 104 PID 1004 wrote to memory of 1276 1004 jdppv.exe 104 PID 1276 wrote to memory of 4632 1276 fxlfxrl.exe 105 PID 1276 wrote to memory of 4632 1276 fxlfxrl.exe 105 PID 1276 wrote to memory of 4632 1276 fxlfxrl.exe 105 PID 4632 wrote to memory of 1300 4632 btbbhh.exe 106 PID 4632 wrote to memory of 1300 4632 btbbhh.exe 106 PID 4632 wrote to memory of 1300 4632 btbbhh.exe 106 PID 1300 wrote to memory of 2320 1300 jvddv.exe 107 PID 1300 wrote to memory of 2320 1300 jvddv.exe 107 PID 1300 wrote to memory of 2320 1300 jvddv.exe 107 PID 2320 wrote to memory of 4108 2320 flrrrxx.exe 108 PID 2320 wrote to memory of 4108 2320 flrrrxx.exe 108 PID 2320 wrote to memory of 4108 2320 flrrrxx.exe 108 PID 4108 wrote to memory of 4724 4108 lxlfrrr.exe 109 PID 4108 wrote to memory of 4724 4108 lxlfrrr.exe 109 PID 4108 wrote to memory of 4724 4108 lxlfrrr.exe 109 PID 4724 wrote to memory of 3376 4724 5hhbtt.exe 110 PID 4724 wrote to memory of 3376 4724 5hhbtt.exe 110 PID 4724 wrote to memory of 3376 4724 5hhbtt.exe 110 PID 3376 wrote to memory of 3620 3376 jjjvp.exe 111 PID 3376 wrote to memory of 3620 3376 jjjvp.exe 111 PID 3376 wrote to memory of 3620 3376 jjjvp.exe 111 PID 3620 wrote to memory of 1648 3620 xllxrrl.exe 112 PID 3620 wrote to memory of 1648 3620 xllxrrl.exe 112 PID 3620 wrote to memory of 1648 3620 xllxrrl.exe 112 PID 1648 wrote to memory of 4120 1648 htttnn.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\9896cd1b796bafac8faaa7a66aef4a70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9896cd1b796bafac8faaa7a66aef4a70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\9dddd.exec:\9dddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\jpdvv.exec:\jpdvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\9lllfff.exec:\9lllfff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\ttbbth.exec:\ttbbth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\jjppd.exec:\jjppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\lxllllr.exec:\lxllllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\hbhtth.exec:\hbhtth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\ntbbtb.exec:\ntbbtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\dvvpj.exec:\dvvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\frxxxxx.exec:\frxxxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\tbnbnt.exec:\tbnbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\jdppv.exec:\jdppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\fxlfxrl.exec:\fxlfxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\btbbhh.exec:\btbbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\jvddv.exec:\jvddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\flrrrxx.exec:\flrrrxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\lxlfrrr.exec:\lxlfrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\5hhbtt.exec:\5hhbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\jjjvp.exec:\jjjvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\xllxrrl.exec:\xllxrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\htttnn.exec:\htttnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\vddjd.exec:\vddjd.exe23⤵
- Executes dropped EXE
PID:4120 -
\??\c:\ddppp.exec:\ddppp.exe24⤵
- Executes dropped EXE
PID:3024 -
\??\c:\rrlxxrr.exec:\rrlxxrr.exe25⤵
- Executes dropped EXE
PID:3988 -
\??\c:\9hhbbt.exec:\9hhbbt.exe26⤵
- Executes dropped EXE
PID:3716 -
\??\c:\bnnhtt.exec:\bnnhtt.exe27⤵
- Executes dropped EXE
PID:1092 -
\??\c:\jdddd.exec:\jdddd.exe28⤵
- Executes dropped EXE
PID:4336 -
\??\c:\xllllll.exec:\xllllll.exe29⤵
- Executes dropped EXE
PID:1212 -
\??\c:\ttbtnn.exec:\ttbtnn.exe30⤵
- Executes dropped EXE
PID:4900 -
\??\c:\hhbbtt.exec:\hhbbtt.exe31⤵
- Executes dropped EXE
PID:4836 -
\??\c:\vvpjj.exec:\vvpjj.exe32⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rffxllf.exec:\rffxllf.exe33⤵
- Executes dropped EXE
PID:3772 -
\??\c:\rxxxrxf.exec:\rxxxrxf.exe34⤵
- Executes dropped EXE
PID:4824 -
\??\c:\1dvvv.exec:\1dvvv.exe35⤵
- Executes dropped EXE
PID:468 -
\??\c:\rllfxxr.exec:\rllfxxr.exe36⤵
- Executes dropped EXE
PID:4776 -
\??\c:\rffffff.exec:\rffffff.exe37⤵
- Executes dropped EXE
PID:4636 -
\??\c:\tntttb.exec:\tntttb.exe38⤵
- Executes dropped EXE
PID:368 -
\??\c:\jjjdd.exec:\jjjdd.exe39⤵
- Executes dropped EXE
PID:3248 -
\??\c:\pjdvp.exec:\pjdvp.exe40⤵
- Executes dropped EXE
PID:4672 -
\??\c:\lrxfffx.exec:\lrxfffx.exe41⤵
- Executes dropped EXE
PID:4028 -
\??\c:\nbbbtt.exec:\nbbbtt.exe42⤵
- Executes dropped EXE
PID:3952 -
\??\c:\vpvpv.exec:\vpvpv.exe43⤵
- Executes dropped EXE
PID:1852 -
\??\c:\flxxxxx.exec:\flxxxxx.exe44⤵
- Executes dropped EXE
PID:1688 -
\??\c:\bnttnn.exec:\bnttnn.exe45⤵
- Executes dropped EXE
PID:2284 -
\??\c:\thtnbh.exec:\thtnbh.exe46⤵
- Executes dropped EXE
PID:2320 -
\??\c:\dpdvp.exec:\dpdvp.exe47⤵
- Executes dropped EXE
PID:1976 -
\??\c:\lfffxxx.exec:\lfffxxx.exe48⤵
- Executes dropped EXE
PID:3660 -
\??\c:\tnnnhn.exec:\tnnnhn.exe49⤵
- Executes dropped EXE
PID:3476 -
\??\c:\hnnhbb.exec:\hnnhbb.exe50⤵
- Executes dropped EXE
PID:4564 -
\??\c:\pjppp.exec:\pjppp.exe51⤵
- Executes dropped EXE
PID:4008 -
\??\c:\djjjd.exec:\djjjd.exe52⤵
- Executes dropped EXE
PID:1680 -
\??\c:\1xxxlll.exec:\1xxxlll.exe53⤵
- Executes dropped EXE
PID:4292 -
\??\c:\5bbttb.exec:\5bbttb.exe54⤵
- Executes dropped EXE
PID:4144 -
\??\c:\tnhbtb.exec:\tnhbtb.exe55⤵PID:4484
-
\??\c:\vddvv.exec:\vddvv.exe56⤵
- Executes dropped EXE
PID:4380 -
\??\c:\vvppj.exec:\vvppj.exe57⤵
- Executes dropped EXE
PID:3908 -
\??\c:\frfxrll.exec:\frfxrll.exe58⤵
- Executes dropped EXE
PID:4000 -
\??\c:\nttttb.exec:\nttttb.exe59⤵
- Executes dropped EXE
PID:916 -
\??\c:\vdpjd.exec:\vdpjd.exe60⤵
- Executes dropped EXE
PID:1212 -
\??\c:\jddvp.exec:\jddvp.exe61⤵
- Executes dropped EXE
PID:4420 -
\??\c:\xrxfrxf.exec:\xrxfrxf.exe62⤵
- Executes dropped EXE
PID:3756 -
\??\c:\rxxxxfx.exec:\rxxxxfx.exe63⤵
- Executes dropped EXE
PID:1220 -
\??\c:\bthbbh.exec:\bthbbh.exe64⤵
- Executes dropped EXE
PID:860 -
\??\c:\nbtbhh.exec:\nbtbhh.exe65⤵
- Executes dropped EXE
PID:2588 -
\??\c:\pdddv.exec:\pdddv.exe66⤵
- Executes dropped EXE
PID:3772 -
\??\c:\pvvpp.exec:\pvvpp.exe67⤵PID:1084
-
\??\c:\1rfxrxx.exec:\1rfxrxx.exe68⤵PID:1520
-
\??\c:\flrrllf.exec:\flrrllf.exe69⤵PID:3252
-
\??\c:\nbbhhn.exec:\nbbhhn.exe70⤵PID:752
-
\??\c:\htbbtt.exec:\htbbtt.exe71⤵PID:3248
-
\??\c:\dvvvv.exec:\dvvvv.exe72⤵PID:3728
-
\??\c:\1pjpj.exec:\1pjpj.exe73⤵PID:4968
-
\??\c:\lfllfll.exec:\lfllfll.exe74⤵PID:2652
-
\??\c:\lfffxxr.exec:\lfffxxr.exe75⤵PID:732
-
\??\c:\1bbtnn.exec:\1bbtnn.exe76⤵PID:2020
-
\??\c:\3nttbb.exec:\3nttbb.exe77⤵PID:3984
-
\??\c:\dvdvv.exec:\dvdvv.exe78⤵PID:2320
-
\??\c:\vppjd.exec:\vppjd.exe79⤵PID:5008
-
\??\c:\vjjjv.exec:\vjjjv.exe80⤵PID:3660
-
\??\c:\xrrrrrx.exec:\xrrrrrx.exe81⤵PID:1264
-
\??\c:\rflxxxr.exec:\rflxxxr.exe82⤵PID:2312
-
\??\c:\nhnhhb.exec:\nhnhhb.exe83⤵PID:4008
-
\??\c:\jvvpv.exec:\jvvpv.exe84⤵PID:1680
-
\??\c:\xllfffr.exec:\xllfffr.exe85⤵PID:4292
-
\??\c:\ffrrlxx.exec:\ffrrlxx.exe86⤵PID:2796
-
\??\c:\thbnhh.exec:\thbnhh.exe87⤵PID:5112
-
\??\c:\bthnhn.exec:\bthnhn.exe88⤵PID:408
-
\??\c:\jvvvv.exec:\jvvvv.exe89⤵PID:4840
-
\??\c:\pdjdv.exec:\pdjdv.exe90⤵PID:3908
-
\??\c:\rrrlllr.exec:\rrrlllr.exe91⤵PID:4984
-
\??\c:\lflxllx.exec:\lflxllx.exe92⤵PID:828
-
\??\c:\1htbbb.exec:\1htbbb.exe93⤵PID:1212
-
\??\c:\5hhbbb.exec:\5hhbbb.exe94⤵PID:1340
-
\??\c:\vjjdv.exec:\vjjdv.exe95⤵PID:1220
-
\??\c:\ppjvp.exec:\ppjvp.exe96⤵PID:860
-
\??\c:\3llllxx.exec:\3llllxx.exe97⤵PID:4588
-
\??\c:\thbbth.exec:\thbbth.exe98⤵PID:3772
-
\??\c:\bntthb.exec:\bntthb.exe99⤵PID:2028
-
\??\c:\pvpjp.exec:\pvpjp.exe100⤵PID:1384
-
\??\c:\dppvp.exec:\dppvp.exe101⤵PID:4396
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe102⤵PID:1096
-
\??\c:\fxfffff.exec:\fxfffff.exe103⤵PID:4616
-
\??\c:\1nnnnt.exec:\1nnnnt.exe104⤵PID:4676
-
\??\c:\nntntt.exec:\nntntt.exe105⤵PID:3160
-
\??\c:\3jddv.exec:\3jddv.exe106⤵PID:1836
-
\??\c:\dvdpp.exec:\dvdpp.exe107⤵PID:1776
-
\??\c:\5lrrlll.exec:\5lrrlll.exe108⤵PID:548
-
\??\c:\1xxfffl.exec:\1xxfffl.exe109⤵PID:4288
-
\??\c:\bttttb.exec:\bttttb.exe110⤵PID:1540
-
\??\c:\5ddvv.exec:\5ddvv.exe111⤵PID:220
-
\??\c:\vdjjv.exec:\vdjjv.exe112⤵PID:5076
-
\??\c:\xllxffr.exec:\xllxffr.exe113⤵PID:4120
-
\??\c:\xxrlxrf.exec:\xxrlxrf.exe114⤵PID:1812
-
\??\c:\3tttnn.exec:\3tttnn.exe115⤵PID:3044
-
\??\c:\thnnbb.exec:\thnnbb.exe116⤵PID:3708
-
\??\c:\3dppv.exec:\3dppv.exe117⤵PID:4144
-
\??\c:\rffrlfx.exec:\rffrlfx.exe118⤵PID:2424
-
\??\c:\lllfffx.exec:\lllfffx.exe119⤵PID:3716
-
\??\c:\5nbtnh.exec:\5nbtnh.exe120⤵PID:4872
-
\??\c:\pvvpd.exec:\pvvpd.exe121⤵PID:1116
-
\??\c:\dvjdv.exec:\dvjdv.exe122⤵PID:4644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-