Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 13:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a566634b4b0d6d5453c6e630dac89c10_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
a566634b4b0d6d5453c6e630dac89c10_NeikiAnalytics.exe
-
Size
224KB
-
MD5
a566634b4b0d6d5453c6e630dac89c10
-
SHA1
b1310e09e26a00284ff773ecab00b5e977ef781a
-
SHA256
f4761659efea3ff46d73acfa28b0fde50f94a6a08810cb0e31f5fff9f07ee58d
-
SHA512
ef4cefd1be22942c54bcc0c667059ada333320b4437141d19f6d6fa48595999e69c6a729f33cbb646b46576f97eb2a1023fcfc84190ae4a43f81ea133702acc3
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xL76:n3C9BRo7MlrWKo+lxKG
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral2/memory/536-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1596-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1392-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3736-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2020-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/444-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4772 lffrllr.exe 2988 nnthbt.exe 3568 ppvdv.exe 1596 pvdvp.exe 3660 thhbtt.exe 1144 vdvdv.exe 1900 rlrrlff.exe 1196 hnhbbh.exe 4140 rxxxflx.exe 2284 nnnhhn.exe 3156 vdjdd.exe 2308 llxxflr.exe 2460 jpddv.exe 1392 fffxlrl.exe 4764 tnhhhb.exe 1696 jdvvd.exe 2940 llffrxr.exe 4228 bbnbbh.exe 4728 ntthtt.exe 3736 pvjdv.exe 2252 rfxrllf.exe 1928 hnttnt.exe 1880 5ddpj.exe 4392 rlllxrx.exe 1444 7ntnhh.exe 2020 bthhbh.exe 1692 jppdj.exe 4412 5vjdj.exe 444 dvjvp.exe 2448 hbtntt.exe 1772 bbbhth.exe 5076 dpvpj.exe 4564 rxffxxr.exe 4992 tntnnh.exe 3044 pdjjj.exe 3924 lrfffrr.exe 2548 frlllll.exe 4320 hnbbbb.exe 5044 fxxxlrf.exe 4704 lxfxffl.exe 2988 tnhhnn.exe 3300 pvddv.exe 3568 pvdpp.exe 3024 ffrrllf.exe 1288 3tbtnt.exe 4240 bthhbh.exe 3152 ddjdp.exe 2128 fxxlfrf.exe 2532 lxxffrx.exe 2024 bbbttt.exe 4140 vvppd.exe 1916 jddvv.exe 3156 ffxrrrl.exe 4972 rflfxxx.exe 3688 btbbhh.exe 3172 dvjjv.exe 5060 vpppd.exe 2428 xfxxxxf.exe 2032 bhttnn.exe 5088 5vjpj.exe 3928 rrrrrrl.exe 3644 flxxrrr.exe 4868 ttbhbh.exe 804 ddjdv.exe -
resource yara_rule behavioral2/memory/536-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1596-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1696-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2020-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/444-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 536 wrote to memory of 4772 536 a566634b4b0d6d5453c6e630dac89c10_NeikiAnalytics.exe 83 PID 536 wrote to memory of 4772 536 a566634b4b0d6d5453c6e630dac89c10_NeikiAnalytics.exe 83 PID 536 wrote to memory of 4772 536 a566634b4b0d6d5453c6e630dac89c10_NeikiAnalytics.exe 83 PID 4772 wrote to memory of 2988 4772 lffrllr.exe 84 PID 4772 wrote to memory of 2988 4772 lffrllr.exe 84 PID 4772 wrote to memory of 2988 4772 lffrllr.exe 84 PID 2988 wrote to memory of 3568 2988 nnthbt.exe 85 PID 2988 wrote to memory of 3568 2988 nnthbt.exe 85 PID 2988 wrote to memory of 3568 2988 nnthbt.exe 85 PID 3568 wrote to memory of 1596 3568 ppvdv.exe 86 PID 3568 wrote to memory of 1596 3568 ppvdv.exe 86 PID 3568 wrote to memory of 1596 3568 ppvdv.exe 86 PID 1596 wrote to memory of 3660 1596 pvdvp.exe 87 PID 1596 wrote to memory of 3660 1596 pvdvp.exe 87 PID 1596 wrote to memory of 3660 1596 pvdvp.exe 87 PID 3660 wrote to memory of 1144 3660 thhbtt.exe 88 PID 3660 wrote to memory of 1144 3660 thhbtt.exe 88 PID 3660 wrote to memory of 1144 3660 thhbtt.exe 88 PID 1144 wrote to memory of 1900 1144 vdvdv.exe 89 PID 1144 wrote to memory of 1900 1144 vdvdv.exe 89 PID 1144 wrote to memory of 1900 1144 vdvdv.exe 89 PID 1900 wrote to memory of 1196 1900 rlrrlff.exe 90 PID 1900 wrote to memory of 1196 1900 rlrrlff.exe 90 PID 1900 wrote to memory of 1196 1900 rlrrlff.exe 90 PID 1196 wrote to memory of 4140 1196 hnhbbh.exe 91 PID 1196 wrote to memory of 4140 1196 hnhbbh.exe 91 PID 1196 wrote to memory of 4140 1196 hnhbbh.exe 91 PID 4140 wrote to memory of 2284 4140 rxxxflx.exe 92 PID 4140 wrote to memory of 2284 4140 rxxxflx.exe 92 PID 4140 wrote to memory of 2284 4140 rxxxflx.exe 92 PID 2284 wrote to memory of 3156 2284 nnnhhn.exe 93 PID 2284 wrote to memory of 3156 2284 nnnhhn.exe 93 PID 2284 wrote to memory of 3156 2284 nnnhhn.exe 93 PID 3156 wrote to memory of 2308 3156 vdjdd.exe 94 PID 3156 wrote to memory of 2308 3156 vdjdd.exe 94 PID 3156 wrote to memory of 2308 3156 vdjdd.exe 94 PID 2308 wrote to memory of 2460 2308 llxxflr.exe 96 PID 2308 wrote to memory of 2460 2308 llxxflr.exe 96 PID 2308 wrote to memory of 2460 2308 llxxflr.exe 96 PID 2460 wrote to memory of 1392 2460 jpddv.exe 97 PID 2460 wrote to memory of 1392 2460 jpddv.exe 97 PID 2460 wrote to memory of 1392 2460 jpddv.exe 97 PID 1392 wrote to memory of 4764 1392 fffxlrl.exe 98 PID 1392 wrote to memory of 4764 1392 fffxlrl.exe 98 PID 1392 wrote to memory of 4764 1392 fffxlrl.exe 98 PID 4764 wrote to memory of 1696 4764 tnhhhb.exe 99 PID 4764 wrote to memory of 1696 4764 tnhhhb.exe 99 PID 4764 wrote to memory of 1696 4764 tnhhhb.exe 99 PID 1696 wrote to memory of 2940 1696 jdvvd.exe 100 PID 1696 wrote to memory of 2940 1696 jdvvd.exe 100 PID 1696 wrote to memory of 2940 1696 jdvvd.exe 100 PID 2940 wrote to memory of 4228 2940 llffrxr.exe 101 PID 2940 wrote to memory of 4228 2940 llffrxr.exe 101 PID 2940 wrote to memory of 4228 2940 llffrxr.exe 101 PID 4228 wrote to memory of 4728 4228 bbnbbh.exe 102 PID 4228 wrote to memory of 4728 4228 bbnbbh.exe 102 PID 4228 wrote to memory of 4728 4228 bbnbbh.exe 102 PID 4728 wrote to memory of 3736 4728 ntthtt.exe 103 PID 4728 wrote to memory of 3736 4728 ntthtt.exe 103 PID 4728 wrote to memory of 3736 4728 ntthtt.exe 103 PID 3736 wrote to memory of 2252 3736 pvjdv.exe 104 PID 3736 wrote to memory of 2252 3736 pvjdv.exe 104 PID 3736 wrote to memory of 2252 3736 pvjdv.exe 104 PID 2252 wrote to memory of 1928 2252 rfxrllf.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\a566634b4b0d6d5453c6e630dac89c10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a566634b4b0d6d5453c6e630dac89c10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\lffrllr.exec:\lffrllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\nnthbt.exec:\nnthbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\ppvdv.exec:\ppvdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\pvdvp.exec:\pvdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\thhbtt.exec:\thhbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\vdvdv.exec:\vdvdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\rlrrlff.exec:\rlrrlff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\hnhbbh.exec:\hnhbbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\rxxxflx.exec:\rxxxflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\nnnhhn.exec:\nnnhhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\vdjdd.exec:\vdjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\llxxflr.exec:\llxxflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\jpddv.exec:\jpddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\fffxlrl.exec:\fffxlrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\tnhhhb.exec:\tnhhhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\jdvvd.exec:\jdvvd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\llffrxr.exec:\llffrxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\bbnbbh.exec:\bbnbbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\ntthtt.exec:\ntthtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\pvjdv.exec:\pvjdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\rfxrllf.exec:\rfxrllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\hnttnt.exec:\hnttnt.exe23⤵
- Executes dropped EXE
PID:1928 -
\??\c:\5ddpj.exec:\5ddpj.exe24⤵
- Executes dropped EXE
PID:1880 -
\??\c:\rlllxrx.exec:\rlllxrx.exe25⤵
- Executes dropped EXE
PID:4392 -
\??\c:\7ntnhh.exec:\7ntnhh.exe26⤵
- Executes dropped EXE
PID:1444 -
\??\c:\bthhbh.exec:\bthhbh.exe27⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jppdj.exec:\jppdj.exe28⤵
- Executes dropped EXE
PID:1692 -
\??\c:\5vjdj.exec:\5vjdj.exe29⤵
- Executes dropped EXE
PID:4412 -
\??\c:\dvjvp.exec:\dvjvp.exe30⤵
- Executes dropped EXE
PID:444 -
\??\c:\hbtntt.exec:\hbtntt.exe31⤵
- Executes dropped EXE
PID:2448 -
\??\c:\bbbhth.exec:\bbbhth.exe32⤵
- Executes dropped EXE
PID:1772 -
\??\c:\dpvpj.exec:\dpvpj.exe33⤵
- Executes dropped EXE
PID:5076 -
\??\c:\rxffxxr.exec:\rxffxxr.exe34⤵
- Executes dropped EXE
PID:4564 -
\??\c:\tntnnh.exec:\tntnnh.exe35⤵
- Executes dropped EXE
PID:4992 -
\??\c:\pdjjj.exec:\pdjjj.exe36⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lrfffrr.exec:\lrfffrr.exe37⤵
- Executes dropped EXE
PID:3924 -
\??\c:\frlllll.exec:\frlllll.exe38⤵
- Executes dropped EXE
PID:2548 -
\??\c:\hnbbbb.exec:\hnbbbb.exe39⤵
- Executes dropped EXE
PID:4320 -
\??\c:\fxxxlrf.exec:\fxxxlrf.exe40⤵
- Executes dropped EXE
PID:5044 -
\??\c:\lxfxffl.exec:\lxfxffl.exe41⤵
- Executes dropped EXE
PID:4704 -
\??\c:\tnhhnn.exec:\tnhhnn.exe42⤵
- Executes dropped EXE
PID:2988 -
\??\c:\pvddv.exec:\pvddv.exe43⤵
- Executes dropped EXE
PID:3300 -
\??\c:\pvdpp.exec:\pvdpp.exe44⤵
- Executes dropped EXE
PID:3568 -
\??\c:\ffrrllf.exec:\ffrrllf.exe45⤵
- Executes dropped EXE
PID:3024 -
\??\c:\3tbtnt.exec:\3tbtnt.exe46⤵
- Executes dropped EXE
PID:1288 -
\??\c:\bthhbh.exec:\bthhbh.exe47⤵
- Executes dropped EXE
PID:4240 -
\??\c:\ddjdp.exec:\ddjdp.exe48⤵
- Executes dropped EXE
PID:3152 -
\??\c:\fxxlfrf.exec:\fxxlfrf.exe49⤵
- Executes dropped EXE
PID:2128 -
\??\c:\lxxffrx.exec:\lxxffrx.exe50⤵
- Executes dropped EXE
PID:2532 -
\??\c:\bbbttt.exec:\bbbttt.exe51⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vvppd.exec:\vvppd.exe52⤵
- Executes dropped EXE
PID:4140 -
\??\c:\jddvv.exec:\jddvv.exe53⤵
- Executes dropped EXE
PID:1916 -
\??\c:\ffxrrrl.exec:\ffxrrrl.exe54⤵
- Executes dropped EXE
PID:3156 -
\??\c:\rflfxxx.exec:\rflfxxx.exe55⤵
- Executes dropped EXE
PID:4972 -
\??\c:\btbbhh.exec:\btbbhh.exe56⤵
- Executes dropped EXE
PID:3688 -
\??\c:\dvjjv.exec:\dvjjv.exe57⤵
- Executes dropped EXE
PID:3172 -
\??\c:\vpppd.exec:\vpppd.exe58⤵
- Executes dropped EXE
PID:5060 -
\??\c:\xfxxxxf.exec:\xfxxxxf.exe59⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bhttnn.exec:\bhttnn.exe60⤵
- Executes dropped EXE
PID:2032 -
\??\c:\5vjpj.exec:\5vjpj.exe61⤵
- Executes dropped EXE
PID:5088 -
\??\c:\rrrrrrl.exec:\rrrrrrl.exe62⤵
- Executes dropped EXE
PID:3928 -
\??\c:\flxxrrr.exec:\flxxrrr.exe63⤵
- Executes dropped EXE
PID:3644 -
\??\c:\ttbhbh.exec:\ttbhbh.exe64⤵
- Executes dropped EXE
PID:4868 -
\??\c:\ddjdv.exec:\ddjdv.exe65⤵
- Executes dropped EXE
PID:804 -
\??\c:\dvvpj.exec:\dvvpj.exe66⤵PID:3736
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe67⤵PID:1808
-
\??\c:\hbhhbb.exec:\hbhhbb.exe68⤵PID:4028
-
\??\c:\nhhhbt.exec:\nhhhbt.exe69⤵PID:3636
-
\??\c:\pdvdj.exec:\pdvdj.exe70⤵PID:1780
-
\??\c:\rrfxrrr.exec:\rrfxrrr.exe71⤵PID:3112
-
\??\c:\rrfxrrr.exec:\rrfxrrr.exe72⤵PID:1624
-
\??\c:\nnbttt.exec:\nnbttt.exe73⤵PID:4528
-
\??\c:\vvvpv.exec:\vvvpv.exe74⤵PID:4988
-
\??\c:\vdppj.exec:\vdppj.exe75⤵PID:4092
-
\??\c:\rllfffl.exec:\rllfffl.exe76⤵PID:4160
-
\??\c:\tnbbbt.exec:\tnbbbt.exe77⤵PID:2212
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe78⤵PID:2520
-
\??\c:\xrrxrff.exec:\xrrxrff.exe79⤵PID:3336
-
\??\c:\nhhbbn.exec:\nhhbbn.exe80⤵PID:552
-
\??\c:\jdjdd.exec:\jdjdd.exe81⤵PID:1956
-
\??\c:\xrffxrl.exec:\xrffxrl.exe82⤵PID:4568
-
\??\c:\thhhbb.exec:\thhhbb.exe83⤵PID:4472
-
\??\c:\bbhtnt.exec:\bbhtnt.exe84⤵PID:3808
-
\??\c:\djdjd.exec:\djdjd.exe85⤵PID:3924
-
\??\c:\llrrrll.exec:\llrrrll.exe86⤵PID:3020
-
\??\c:\bttttt.exec:\bttttt.exe87⤵PID:544
-
\??\c:\bnbbtt.exec:\bnbbtt.exe88⤵PID:1356
-
\??\c:\7jpvp.exec:\7jpvp.exe89⤵PID:4548
-
\??\c:\ffllxff.exec:\ffllxff.exe90⤵PID:1276
-
\??\c:\rxfffxr.exec:\rxfffxr.exe91⤵PID:712
-
\??\c:\7hbhhn.exec:\7hbhhn.exe92⤵PID:4268
-
\??\c:\7jjjd.exec:\7jjjd.exe93⤵PID:4840
-
\??\c:\3ffxxxl.exec:\3ffxxxl.exe94⤵PID:3576
-
\??\c:\5xxxrxr.exec:\5xxxrxr.exe95⤵PID:1468
-
\??\c:\bbbbtt.exec:\bbbbtt.exe96⤵PID:3968
-
\??\c:\bnbbbb.exec:\bnbbbb.exe97⤵PID:2084
-
\??\c:\vdjdd.exec:\vdjdd.exe98⤵PID:336
-
\??\c:\rrxrfxf.exec:\rrxrfxf.exe99⤵PID:3560
-
\??\c:\lfflfrr.exec:\lfflfrr.exe100⤵PID:1820
-
\??\c:\jjvpv.exec:\jjvpv.exe101⤵PID:2720
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe102⤵PID:4496
-
\??\c:\htnnbb.exec:\htnnbb.exe103⤵PID:5052
-
\??\c:\9hbbnn.exec:\9hbbnn.exe104⤵PID:1856
-
\??\c:\vvvpj.exec:\vvvpj.exe105⤵PID:3860
-
\??\c:\fxfxrll.exec:\fxfxrll.exe106⤵PID:2440
-
\??\c:\lfrxlfr.exec:\lfrxlfr.exe107⤵PID:3344
-
\??\c:\hnnntb.exec:\hnnntb.exe108⤵PID:2028
-
\??\c:\jdjjv.exec:\jdjjv.exe109⤵PID:2512
-
\??\c:\jjpjp.exec:\jjpjp.exe110⤵PID:1524
-
\??\c:\lllxrrr.exec:\lllxrrr.exe111⤵PID:4676
-
\??\c:\nnnnhh.exec:\nnnnhh.exe112⤵PID:4052
-
\??\c:\ntbtnh.exec:\ntbtnh.exe113⤵PID:1236
-
\??\c:\3pdvj.exec:\3pdvj.exe114⤵PID:1928
-
\??\c:\3rxrllf.exec:\3rxrllf.exe115⤵PID:2352
-
\??\c:\lfxffff.exec:\lfxffff.exe116⤵PID:3952
-
\??\c:\hhnhnn.exec:\hhnhnn.exe117⤵PID:4604
-
\??\c:\pjpjp.exec:\pjpjp.exe118⤵PID:4136
-
\??\c:\jpjdd.exec:\jpjdd.exe119⤵PID:1692
-
\??\c:\xxllxxx.exec:\xxllxxx.exe120⤵PID:4092
-
\??\c:\thnnhh.exec:\thnnhh.exe121⤵PID:1564
-
\??\c:\bbbbhn.exec:\bbbbhn.exe122⤵PID:2520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-