Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
17/06/2024, 11:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
83f2ab36bda595afc10c03efe3400420_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
83f2ab36bda595afc10c03efe3400420_NeikiAnalytics.exe
-
Size
88KB
-
MD5
83f2ab36bda595afc10c03efe3400420
-
SHA1
c3f454876a76344883a5efad875b5c3c520d12c4
-
SHA256
6ea5a337cabc1b7a86eae78b72878ff7be68a3a6d7417d0fdd5f0dbf9fb33966
-
SHA512
b9eb92ca686769bd6c946065bc0bdfadb79ad40cc10758f921e4ec30d871d6b99864b95aac10909cf1ecba767fbc3bf98bdf0daa5c3b51ec041741653700d4e9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2iJvRirE0DmmdL2jqWkB9:ymb3NkkiQ3mdBjF+3TU2iBRioSumWS1P
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/632-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/856-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2568-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3800-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1000-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3504 dpppj.exe 4312 rlrlxfl.exe 1916 3xlffff.exe 536 thbbtt.exe 856 llfxxrr.exe 4904 rflffxx.exe 1212 tbhhbt.exe 3644 vpddv.exe 3620 lffrrrl.exe 2308 rfrrlrx.exe 1620 nnnhnh.exe 3348 5pvpd.exe 3488 ppjjj.exe 2588 lxfxrrl.exe 2568 pjpjj.exe 936 rllfxll.exe 4676 thbbth.exe 4408 ppvvj.exe 3800 7lxrlrl.exe 4092 tnnntb.exe 1040 jdjjd.exe 3292 fflfrrl.exe 1696 nhhbtt.exe 1968 1bhhhh.exe 3680 jdjpp.exe 3492 dvvpp.exe 3608 1rfrrlx.exe 4188 nnnbtt.exe 2576 pdvpp.exe 1000 lfrxxxx.exe 3200 5pvpp.exe 312 pjpjp.exe 1516 xrrxrxr.exe 3536 bntnhn.exe 4540 nbhnhh.exe 2368 dvvpp.exe 732 fflfxxr.exe 3376 ffffrll.exe 1224 9httbt.exe 2764 djdvv.exe 4996 dvvvv.exe 4440 rxllxxf.exe 4772 rrxfflr.exe 392 hbhhbb.exe 2552 bhhhbh.exe 3644 jpvpp.exe 1500 vdvvv.exe 5112 xlrrfff.exe 2964 rlxxxxf.exe 1768 ntbbtt.exe 3832 hthbhb.exe 1512 jpjvd.exe 2152 pdjpj.exe 4180 rllfxxr.exe 2636 rfllfrl.exe 4196 hhnbth.exe 796 5bbtnn.exe 5028 pdddv.exe 3324 dvjjd.exe 4552 rlrlxxx.exe 5052 htnbbt.exe 1192 btbtnn.exe 4000 hnhbbb.exe 3776 jdjjj.exe -
resource yara_rule behavioral2/memory/632-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/856-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3800-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1696-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1000-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 632 wrote to memory of 3504 632 83f2ab36bda595afc10c03efe3400420_NeikiAnalytics.exe 81 PID 632 wrote to memory of 3504 632 83f2ab36bda595afc10c03efe3400420_NeikiAnalytics.exe 81 PID 632 wrote to memory of 3504 632 83f2ab36bda595afc10c03efe3400420_NeikiAnalytics.exe 81 PID 3504 wrote to memory of 4312 3504 dpppj.exe 82 PID 3504 wrote to memory of 4312 3504 dpppj.exe 82 PID 3504 wrote to memory of 4312 3504 dpppj.exe 82 PID 4312 wrote to memory of 1916 4312 rlrlxfl.exe 83 PID 4312 wrote to memory of 1916 4312 rlrlxfl.exe 83 PID 4312 wrote to memory of 1916 4312 rlrlxfl.exe 83 PID 1916 wrote to memory of 536 1916 3xlffff.exe 84 PID 1916 wrote to memory of 536 1916 3xlffff.exe 84 PID 1916 wrote to memory of 536 1916 3xlffff.exe 84 PID 536 wrote to memory of 856 536 thbbtt.exe 85 PID 536 wrote to memory of 856 536 thbbtt.exe 85 PID 536 wrote to memory of 856 536 thbbtt.exe 85 PID 856 wrote to memory of 4904 856 llfxxrr.exe 86 PID 856 wrote to memory of 4904 856 llfxxrr.exe 86 PID 856 wrote to memory of 4904 856 llfxxrr.exe 86 PID 4904 wrote to memory of 1212 4904 rflffxx.exe 87 PID 4904 wrote to memory of 1212 4904 rflffxx.exe 87 PID 4904 wrote to memory of 1212 4904 rflffxx.exe 87 PID 1212 wrote to memory of 3644 1212 tbhhbt.exe 88 PID 1212 wrote to memory of 3644 1212 tbhhbt.exe 88 PID 1212 wrote to memory of 3644 1212 tbhhbt.exe 88 PID 3644 wrote to memory of 3620 3644 vpddv.exe 89 PID 3644 wrote to memory of 3620 3644 vpddv.exe 89 PID 3644 wrote to memory of 3620 3644 vpddv.exe 89 PID 3620 wrote to memory of 2308 3620 lffrrrl.exe 90 PID 3620 wrote to memory of 2308 3620 lffrrrl.exe 90 PID 3620 wrote to memory of 2308 3620 lffrrrl.exe 90 PID 2308 wrote to memory of 1620 2308 rfrrlrx.exe 91 PID 2308 wrote to memory of 1620 2308 rfrrlrx.exe 91 PID 2308 wrote to memory of 1620 2308 rfrrlrx.exe 91 PID 1620 wrote to memory of 3348 1620 nnnhnh.exe 92 PID 1620 wrote to memory of 3348 1620 nnnhnh.exe 92 PID 1620 wrote to memory of 3348 1620 nnnhnh.exe 92 PID 3348 wrote to memory of 3488 3348 5pvpd.exe 93 PID 3348 wrote to memory of 3488 3348 5pvpd.exe 93 PID 3348 wrote to memory of 3488 3348 5pvpd.exe 93 PID 3488 wrote to memory of 2588 3488 ppjjj.exe 94 PID 3488 wrote to memory of 2588 3488 ppjjj.exe 94 PID 3488 wrote to memory of 2588 3488 ppjjj.exe 94 PID 2588 wrote to memory of 2568 2588 lxfxrrl.exe 96 PID 2588 wrote to memory of 2568 2588 lxfxrrl.exe 96 PID 2588 wrote to memory of 2568 2588 lxfxrrl.exe 96 PID 2568 wrote to memory of 936 2568 pjpjj.exe 97 PID 2568 wrote to memory of 936 2568 pjpjj.exe 97 PID 2568 wrote to memory of 936 2568 pjpjj.exe 97 PID 936 wrote to memory of 4676 936 rllfxll.exe 98 PID 936 wrote to memory of 4676 936 rllfxll.exe 98 PID 936 wrote to memory of 4676 936 rllfxll.exe 98 PID 4676 wrote to memory of 4408 4676 thbbth.exe 99 PID 4676 wrote to memory of 4408 4676 thbbth.exe 99 PID 4676 wrote to memory of 4408 4676 thbbth.exe 99 PID 4408 wrote to memory of 3800 4408 ppvvj.exe 100 PID 4408 wrote to memory of 3800 4408 ppvvj.exe 100 PID 4408 wrote to memory of 3800 4408 ppvvj.exe 100 PID 3800 wrote to memory of 4092 3800 7lxrlrl.exe 102 PID 3800 wrote to memory of 4092 3800 7lxrlrl.exe 102 PID 3800 wrote to memory of 4092 3800 7lxrlrl.exe 102 PID 4092 wrote to memory of 1040 4092 tnnntb.exe 103 PID 4092 wrote to memory of 1040 4092 tnnntb.exe 103 PID 4092 wrote to memory of 1040 4092 tnnntb.exe 103 PID 1040 wrote to memory of 3292 1040 jdjjd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\83f2ab36bda595afc10c03efe3400420_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\83f2ab36bda595afc10c03efe3400420_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\dpppj.exec:\dpppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\rlrlxfl.exec:\rlrlxfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\3xlffff.exec:\3xlffff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\thbbtt.exec:\thbbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\llfxxrr.exec:\llfxxrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\rflffxx.exec:\rflffxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\tbhhbt.exec:\tbhhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\vpddv.exec:\vpddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\lffrrrl.exec:\lffrrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\rfrrlrx.exec:\rfrrlrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\nnnhnh.exec:\nnnhnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\5pvpd.exec:\5pvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\ppjjj.exec:\ppjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\pjpjj.exec:\pjpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\rllfxll.exec:\rllfxll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\thbbth.exec:\thbbth.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\ppvvj.exec:\ppvvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\7lxrlrl.exec:\7lxrlrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\tnnntb.exec:\tnnntb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\jdjjd.exec:\jdjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\fflfrrl.exec:\fflfrrl.exe23⤵
- Executes dropped EXE
PID:3292 -
\??\c:\nhhbtt.exec:\nhhbtt.exe24⤵
- Executes dropped EXE
PID:1696 -
\??\c:\1bhhhh.exec:\1bhhhh.exe25⤵
- Executes dropped EXE
PID:1968 -
\??\c:\jdjpp.exec:\jdjpp.exe26⤵
- Executes dropped EXE
PID:3680 -
\??\c:\dvvpp.exec:\dvvpp.exe27⤵
- Executes dropped EXE
PID:3492 -
\??\c:\1rfrrlx.exec:\1rfrrlx.exe28⤵
- Executes dropped EXE
PID:3608 -
\??\c:\nnnbtt.exec:\nnnbtt.exe29⤵
- Executes dropped EXE
PID:4188 -
\??\c:\pdvpp.exec:\pdvpp.exe30⤵
- Executes dropped EXE
PID:2576 -
\??\c:\lfrxxxx.exec:\lfrxxxx.exe31⤵
- Executes dropped EXE
PID:1000 -
\??\c:\5pvpp.exec:\5pvpp.exe32⤵
- Executes dropped EXE
PID:3200 -
\??\c:\pjpjp.exec:\pjpjp.exe33⤵
- Executes dropped EXE
PID:312 -
\??\c:\xrrxrxr.exec:\xrrxrxr.exe34⤵
- Executes dropped EXE
PID:1516 -
\??\c:\bntnhn.exec:\bntnhn.exe35⤵
- Executes dropped EXE
PID:3536 -
\??\c:\nbhnhh.exec:\nbhnhh.exe36⤵
- Executes dropped EXE
PID:4540 -
\??\c:\dvvpp.exec:\dvvpp.exe37⤵
- Executes dropped EXE
PID:2368 -
\??\c:\fflfxxr.exec:\fflfxxr.exe38⤵
- Executes dropped EXE
PID:732 -
\??\c:\ffffrll.exec:\ffffrll.exe39⤵
- Executes dropped EXE
PID:3376 -
\??\c:\9httbt.exec:\9httbt.exe40⤵
- Executes dropped EXE
PID:1224 -
\??\c:\djdvv.exec:\djdvv.exe41⤵
- Executes dropped EXE
PID:2764 -
\??\c:\dvvvv.exec:\dvvvv.exe42⤵
- Executes dropped EXE
PID:4996 -
\??\c:\rxllxxf.exec:\rxllxxf.exe43⤵
- Executes dropped EXE
PID:4440 -
\??\c:\rrxfflr.exec:\rrxfflr.exe44⤵
- Executes dropped EXE
PID:4772 -
\??\c:\hbhhbb.exec:\hbhhbb.exe45⤵
- Executes dropped EXE
PID:392 -
\??\c:\bhhhbh.exec:\bhhhbh.exe46⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jpvpp.exec:\jpvpp.exe47⤵
- Executes dropped EXE
PID:3644 -
\??\c:\vdvvv.exec:\vdvvv.exe48⤵
- Executes dropped EXE
PID:1500 -
\??\c:\xlrrfff.exec:\xlrrfff.exe49⤵
- Executes dropped EXE
PID:5112 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe50⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ntbbtt.exec:\ntbbtt.exe51⤵
- Executes dropped EXE
PID:1768 -
\??\c:\hthbhb.exec:\hthbhb.exe52⤵
- Executes dropped EXE
PID:3832 -
\??\c:\jpjvd.exec:\jpjvd.exe53⤵
- Executes dropped EXE
PID:1512 -
\??\c:\pdjpj.exec:\pdjpj.exe54⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rllfxxr.exec:\rllfxxr.exe55⤵
- Executes dropped EXE
PID:4180 -
\??\c:\rfllfrl.exec:\rfllfrl.exe56⤵
- Executes dropped EXE
PID:2636 -
\??\c:\hhnbth.exec:\hhnbth.exe57⤵
- Executes dropped EXE
PID:4196 -
\??\c:\5bbtnn.exec:\5bbtnn.exe58⤵
- Executes dropped EXE
PID:796 -
\??\c:\pdddv.exec:\pdddv.exe59⤵
- Executes dropped EXE
PID:5028 -
\??\c:\dvjjd.exec:\dvjjd.exe60⤵
- Executes dropped EXE
PID:3324 -
\??\c:\rlrlxxx.exec:\rlrlxxx.exe61⤵
- Executes dropped EXE
PID:4552 -
\??\c:\htnbbt.exec:\htnbbt.exe62⤵
- Executes dropped EXE
PID:5052 -
\??\c:\btbtnn.exec:\btbtnn.exe63⤵
- Executes dropped EXE
PID:1192 -
\??\c:\hnhbbb.exec:\hnhbbb.exe64⤵
- Executes dropped EXE
PID:4000 -
\??\c:\jdjjj.exec:\jdjjj.exe65⤵
- Executes dropped EXE
PID:3776 -
\??\c:\rrrrfff.exec:\rrrrfff.exe66⤵PID:3756
-
\??\c:\rllffxr.exec:\rllffxr.exe67⤵PID:5104
-
\??\c:\btbtbb.exec:\btbtbb.exe68⤵PID:3680
-
\??\c:\bnbthh.exec:\bnbthh.exe69⤵PID:3692
-
\??\c:\1vdpj.exec:\1vdpj.exe70⤵PID:2872
-
\??\c:\ffrllxx.exec:\ffrllxx.exe71⤵PID:3556
-
\??\c:\llllfrl.exec:\llllfrl.exe72⤵PID:3608
-
\??\c:\thnnhn.exec:\thnnhn.exe73⤵PID:2268
-
\??\c:\3ddvp.exec:\3ddvp.exe74⤵PID:1884
-
\??\c:\nhhhbb.exec:\nhhhbb.exe75⤵PID:4364
-
\??\c:\pddvp.exec:\pddvp.exe76⤵PID:3840
-
\??\c:\fxffllr.exec:\fxffllr.exe77⤵PID:1516
-
\??\c:\xxxllrr.exec:\xxxllrr.exe78⤵PID:3536
-
\??\c:\htbtnn.exec:\htbtnn.exe79⤵PID:4468
-
\??\c:\ddppd.exec:\ddppd.exe80⤵PID:4944
-
\??\c:\jjpjd.exec:\jjpjd.exe81⤵PID:2900
-
\??\c:\3ffxrrl.exec:\3ffxrrl.exe82⤵PID:3628
-
\??\c:\bbhtbn.exec:\bbhtbn.exe83⤵PID:1652
-
\??\c:\dpdvp.exec:\dpdvp.exe84⤵PID:2764
-
\??\c:\xlxxrxr.exec:\xlxxrxr.exe85⤵PID:536
-
\??\c:\rlflllf.exec:\rlflllf.exe86⤵PID:892
-
\??\c:\bthbnt.exec:\bthbnt.exe87⤵PID:1680
-
\??\c:\nbhbtt.exec:\nbhbtt.exe88⤵PID:392
-
\??\c:\dvpjd.exec:\dvpjd.exe89⤵PID:3668
-
\??\c:\1fxrffx.exec:\1fxrffx.exe90⤵PID:4508
-
\??\c:\nhhbtt.exec:\nhhbtt.exe91⤵PID:4896
-
\??\c:\5jvpj.exec:\5jvpj.exe92⤵PID:3704
-
\??\c:\rxfxrrf.exec:\rxfxrrf.exe93⤵PID:5012
-
\??\c:\bbttnt.exec:\bbttnt.exe94⤵PID:4304
-
\??\c:\9jjjj.exec:\9jjjj.exe95⤵PID:4380
-
\??\c:\rrxxxrf.exec:\rrxxxrf.exe96⤵PID:3488
-
\??\c:\3rxrlrl.exec:\3rxrlrl.exe97⤵PID:1940
-
\??\c:\7hhhhh.exec:\7hhhhh.exe98⤵PID:4132
-
\??\c:\1hhbbt.exec:\1hhbbt.exe99⤵PID:3092
-
\??\c:\5vddv.exec:\5vddv.exe100⤵PID:3368
-
\??\c:\llrlrlr.exec:\llrlrlr.exe101⤵PID:3040
-
\??\c:\xrfxfxf.exec:\xrfxfxf.exe102⤵PID:3380
-
\??\c:\1tbbth.exec:\1tbbth.exe103⤵PID:5028
-
\??\c:\tbnntn.exec:\tbnntn.exe104⤵PID:5056
-
\??\c:\vpdvp.exec:\vpdvp.exe105⤵PID:212
-
\??\c:\5rxrxfl.exec:\5rxrxfl.exe106⤵PID:2088
-
\??\c:\5ttnhh.exec:\5ttnhh.exe107⤵PID:1404
-
\??\c:\nnnhbb.exec:\nnnhbb.exe108⤵PID:4620
-
\??\c:\pjvvj.exec:\pjvvj.exe109⤵PID:3640
-
\??\c:\jjjjv.exec:\jjjjv.exe110⤵PID:4228
-
\??\c:\flxxrlr.exec:\flxxrlr.exe111⤵PID:5104
-
\??\c:\hnbhbb.exec:\hnbhbb.exe112⤵PID:3792
-
\??\c:\nhnbbt.exec:\nhnbbt.exe113⤵PID:3692
-
\??\c:\hhhbtb.exec:\hhhbtb.exe114⤵PID:992
-
\??\c:\jvdvp.exec:\jvdvp.exe115⤵PID:4432
-
\??\c:\ddvvv.exec:\ddvvv.exe116⤵PID:1292
-
\??\c:\frfxrrr.exec:\frfxrrr.exe117⤵PID:2504
-
\??\c:\bbhbhh.exec:\bbhbhh.exe118⤵PID:1560
-
\??\c:\tnbnhh.exec:\tnbnhh.exe119⤵PID:1000
-
\??\c:\djpjp.exec:\djpjp.exe120⤵PID:1216
-
\??\c:\vvjdd.exec:\vvjdd.exe121⤵PID:3084
-
\??\c:\lrlrxlr.exec:\lrlrxlr.exe122⤵PID:5068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-