Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 22:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1d6fd8a4089a9e08a7b7d16886336cf0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
1d6fd8a4089a9e08a7b7d16886336cf0_NeikiAnalytics.exe
-
Size
387KB
-
MD5
1d6fd8a4089a9e08a7b7d16886336cf0
-
SHA1
89f85c831c905b774bbc16b9ad0ba81662c6f213
-
SHA256
8885e8737714d141d4da35e0238d0e4c3ff05e0766af7b39c553ccd7f63fc917
-
SHA512
24ee3df09b2a43209e2c1380c003ad8ed726481be7b616c6fc2ef989cbcc96b2788a2c54f6c953ca5929f2964774f264b4306f096934a4c041266b2b899b940d
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVw0:n3C9uYA7okVqdKwaO5CVt
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/3016-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1200-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/548-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/800-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/108-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2188 nbbnnb.exe 2612 lffrflf.exe 2804 dddjd.exe 2644 hnhhbn.exe 2680 jjdpd.exe 2412 hbhbhn.exe 2520 7vjjp.exe 2980 vpdpd.exe 1200 fxflflr.exe 2752 vddpj.exe 2880 ppjdp.exe 548 jppjd.exe 1732 llfrflx.exe 1372 1nhnbt.exe 380 rrrrxfr.exe 800 pjddv.exe 1752 fxrxflr.exe 1780 bbbnbh.exe 2084 pddpd.exe 2884 tnthth.exe 2696 jpjpd.exe 568 tntthn.exe 108 tnhnhh.exe 2300 3lflrrx.exe 1812 7bnbtb.exe 2056 xrlrfrf.exe 796 bbttbh.exe 1696 3lfflrr.exe 716 nnhthn.exe 1616 ttnhbh.exe 2212 ppjdp.exe 1756 5llxfxx.exe 1724 bbnbtb.exe 1712 5dvdj.exe 2236 fxlflfr.exe 2852 btttnn.exe 1592 jddpd.exe 2796 rrxfxfl.exe 2800 ttntnt.exe 2776 ntbhhb.exe 2672 ddvpd.exe 2768 3rrxllx.exe 2412 tbhbtb.exe 2592 ppdpj.exe 1956 5ffrxlr.exe 3012 nhnthn.exe 2736 5ppdp.exe 2872 jjjjv.exe 2876 xxxfrxf.exe 2880 5nnbtb.exe 776 1vpvj.exe 1868 rxrrfxr.exe 572 nhthnt.exe 1156 5pjvp.exe 380 1ddpj.exe 336 rxxxlxx.exe 1672 nhbhtb.exe 2264 ddvjj.exe 2088 rxfxflf.exe 2176 7htbnb.exe 2324 7nbhtb.exe 2080 dvjdj.exe 568 rfflrxl.exe 2476 nnnbnt.exe -
resource yara_rule behavioral1/memory/3016-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/548-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/800-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/108-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-273-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2188 3016 1d6fd8a4089a9e08a7b7d16886336cf0_NeikiAnalytics.exe 28 PID 3016 wrote to memory of 2188 3016 1d6fd8a4089a9e08a7b7d16886336cf0_NeikiAnalytics.exe 28 PID 3016 wrote to memory of 2188 3016 1d6fd8a4089a9e08a7b7d16886336cf0_NeikiAnalytics.exe 28 PID 3016 wrote to memory of 2188 3016 1d6fd8a4089a9e08a7b7d16886336cf0_NeikiAnalytics.exe 28 PID 2188 wrote to memory of 2612 2188 nbbnnb.exe 29 PID 2188 wrote to memory of 2612 2188 nbbnnb.exe 29 PID 2188 wrote to memory of 2612 2188 nbbnnb.exe 29 PID 2188 wrote to memory of 2612 2188 nbbnnb.exe 29 PID 2612 wrote to memory of 2804 2612 lffrflf.exe 30 PID 2612 wrote to memory of 2804 2612 lffrflf.exe 30 PID 2612 wrote to memory of 2804 2612 lffrflf.exe 30 PID 2612 wrote to memory of 2804 2612 lffrflf.exe 30 PID 2804 wrote to memory of 2644 2804 dddjd.exe 31 PID 2804 wrote to memory of 2644 2804 dddjd.exe 31 PID 2804 wrote to memory of 2644 2804 dddjd.exe 31 PID 2804 wrote to memory of 2644 2804 dddjd.exe 31 PID 2644 wrote to memory of 2680 2644 hnhhbn.exe 32 PID 2644 wrote to memory of 2680 2644 hnhhbn.exe 32 PID 2644 wrote to memory of 2680 2644 hnhhbn.exe 32 PID 2644 wrote to memory of 2680 2644 hnhhbn.exe 32 PID 2680 wrote to memory of 2412 2680 jjdpd.exe 33 PID 2680 wrote to memory of 2412 2680 jjdpd.exe 33 PID 2680 wrote to memory of 2412 2680 jjdpd.exe 33 PID 2680 wrote to memory of 2412 2680 jjdpd.exe 33 PID 2412 wrote to memory of 2520 2412 hbhbhn.exe 34 PID 2412 wrote to memory of 2520 2412 hbhbhn.exe 34 PID 2412 wrote to memory of 2520 2412 hbhbhn.exe 34 PID 2412 wrote to memory of 2520 2412 hbhbhn.exe 34 PID 2520 wrote to memory of 2980 2520 7vjjp.exe 35 PID 2520 wrote to memory of 2980 2520 7vjjp.exe 35 PID 2520 wrote to memory of 2980 2520 7vjjp.exe 35 PID 2520 wrote to memory of 2980 2520 7vjjp.exe 35 PID 2980 wrote to memory of 1200 2980 vpdpd.exe 36 PID 2980 wrote to memory of 1200 2980 vpdpd.exe 36 PID 2980 wrote to memory of 1200 2980 vpdpd.exe 36 PID 2980 wrote to memory of 1200 2980 vpdpd.exe 36 PID 1200 wrote to memory of 2752 1200 fxflflr.exe 37 PID 1200 wrote to memory of 2752 1200 fxflflr.exe 37 PID 1200 wrote to memory of 2752 1200 fxflflr.exe 37 PID 1200 wrote to memory of 2752 1200 fxflflr.exe 37 PID 2752 wrote to memory of 2880 2752 vddpj.exe 38 PID 2752 wrote to memory of 2880 2752 vddpj.exe 38 PID 2752 wrote to memory of 2880 2752 vddpj.exe 38 PID 2752 wrote to memory of 2880 2752 vddpj.exe 38 PID 2880 wrote to memory of 548 2880 ppjdp.exe 39 PID 2880 wrote to memory of 548 2880 ppjdp.exe 39 PID 2880 wrote to memory of 548 2880 ppjdp.exe 39 PID 2880 wrote to memory of 548 2880 ppjdp.exe 39 PID 548 wrote to memory of 1732 548 jppjd.exe 40 PID 548 wrote to memory of 1732 548 jppjd.exe 40 PID 548 wrote to memory of 1732 548 jppjd.exe 40 PID 548 wrote to memory of 1732 548 jppjd.exe 40 PID 1732 wrote to memory of 1372 1732 llfrflx.exe 41 PID 1732 wrote to memory of 1372 1732 llfrflx.exe 41 PID 1732 wrote to memory of 1372 1732 llfrflx.exe 41 PID 1732 wrote to memory of 1372 1732 llfrflx.exe 41 PID 1372 wrote to memory of 380 1372 1nhnbt.exe 42 PID 1372 wrote to memory of 380 1372 1nhnbt.exe 42 PID 1372 wrote to memory of 380 1372 1nhnbt.exe 42 PID 1372 wrote to memory of 380 1372 1nhnbt.exe 42 PID 380 wrote to memory of 800 380 rrrrxfr.exe 43 PID 380 wrote to memory of 800 380 rrrrxfr.exe 43 PID 380 wrote to memory of 800 380 rrrrxfr.exe 43 PID 380 wrote to memory of 800 380 rrrrxfr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d6fd8a4089a9e08a7b7d16886336cf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1d6fd8a4089a9e08a7b7d16886336cf0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\nbbnnb.exec:\nbbnnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\lffrflf.exec:\lffrflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\dddjd.exec:\dddjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\hnhhbn.exec:\hnhhbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\jjdpd.exec:\jjdpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\hbhbhn.exec:\hbhbhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\7vjjp.exec:\7vjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\vpdpd.exec:\vpdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\fxflflr.exec:\fxflflr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\vddpj.exec:\vddpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\ppjdp.exec:\ppjdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\jppjd.exec:\jppjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\llfrflx.exec:\llfrflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\1nhnbt.exec:\1nhnbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\rrrrxfr.exec:\rrrrxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\pjddv.exec:\pjddv.exe17⤵
- Executes dropped EXE
PID:800 -
\??\c:\fxrxflr.exec:\fxrxflr.exe18⤵
- Executes dropped EXE
PID:1752 -
\??\c:\bbbnbh.exec:\bbbnbh.exe19⤵
- Executes dropped EXE
PID:1780 -
\??\c:\pddpd.exec:\pddpd.exe20⤵
- Executes dropped EXE
PID:2084 -
\??\c:\tnthth.exec:\tnthth.exe21⤵
- Executes dropped EXE
PID:2884 -
\??\c:\jpjpd.exec:\jpjpd.exe22⤵
- Executes dropped EXE
PID:2696 -
\??\c:\tntthn.exec:\tntthn.exe23⤵
- Executes dropped EXE
PID:568 -
\??\c:\tnhnhh.exec:\tnhnhh.exe24⤵
- Executes dropped EXE
PID:108 -
\??\c:\3lflrrx.exec:\3lflrrx.exe25⤵
- Executes dropped EXE
PID:2300 -
\??\c:\7bnbtb.exec:\7bnbtb.exe26⤵
- Executes dropped EXE
PID:1812 -
\??\c:\xrlrfrf.exec:\xrlrfrf.exe27⤵
- Executes dropped EXE
PID:2056 -
\??\c:\bbttbh.exec:\bbttbh.exe28⤵
- Executes dropped EXE
PID:796 -
\??\c:\3lfflrr.exec:\3lfflrr.exe29⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nnhthn.exec:\nnhthn.exe30⤵
- Executes dropped EXE
PID:716 -
\??\c:\ttnhbh.exec:\ttnhbh.exe31⤵
- Executes dropped EXE
PID:1616 -
\??\c:\ppjdp.exec:\ppjdp.exe32⤵
- Executes dropped EXE
PID:2212 -
\??\c:\5llxfxx.exec:\5llxfxx.exe33⤵
- Executes dropped EXE
PID:1756 -
\??\c:\bbnbtb.exec:\bbnbtb.exe34⤵
- Executes dropped EXE
PID:1724 -
\??\c:\5dvdj.exec:\5dvdj.exe35⤵
- Executes dropped EXE
PID:1712 -
\??\c:\fxlflfr.exec:\fxlflfr.exe36⤵
- Executes dropped EXE
PID:2236 -
\??\c:\btttnn.exec:\btttnn.exe37⤵
- Executes dropped EXE
PID:2852 -
\??\c:\jddpd.exec:\jddpd.exe38⤵
- Executes dropped EXE
PID:1592 -
\??\c:\rrxfxfl.exec:\rrxfxfl.exe39⤵
- Executes dropped EXE
PID:2796 -
\??\c:\ttntnt.exec:\ttntnt.exe40⤵
- Executes dropped EXE
PID:2800 -
\??\c:\ntbhhb.exec:\ntbhhb.exe41⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ddvpd.exec:\ddvpd.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\3rrxllx.exec:\3rrxllx.exe43⤵
- Executes dropped EXE
PID:2768 -
\??\c:\tbhbtb.exec:\tbhbtb.exe44⤵
- Executes dropped EXE
PID:2412 -
\??\c:\ppdpj.exec:\ppdpj.exe45⤵
- Executes dropped EXE
PID:2592 -
\??\c:\5ffrxlr.exec:\5ffrxlr.exe46⤵
- Executes dropped EXE
PID:1956 -
\??\c:\nhnthn.exec:\nhnthn.exe47⤵
- Executes dropped EXE
PID:3012 -
\??\c:\5ppdp.exec:\5ppdp.exe48⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jjjjv.exec:\jjjjv.exe49⤵
- Executes dropped EXE
PID:2872 -
\??\c:\xxxfrxf.exec:\xxxfrxf.exe50⤵
- Executes dropped EXE
PID:2876 -
\??\c:\5nnbtb.exec:\5nnbtb.exe51⤵
- Executes dropped EXE
PID:2880 -
\??\c:\1vpvj.exec:\1vpvj.exe52⤵
- Executes dropped EXE
PID:776 -
\??\c:\rxrrfxr.exec:\rxrrfxr.exe53⤵
- Executes dropped EXE
PID:1868 -
\??\c:\nhthnt.exec:\nhthnt.exe54⤵
- Executes dropped EXE
PID:572 -
\??\c:\5pjvp.exec:\5pjvp.exe55⤵
- Executes dropped EXE
PID:1156 -
\??\c:\1ddpj.exec:\1ddpj.exe56⤵
- Executes dropped EXE
PID:380 -
\??\c:\rxxxlxx.exec:\rxxxlxx.exe57⤵
- Executes dropped EXE
PID:336 -
\??\c:\nhbhtb.exec:\nhbhtb.exe58⤵
- Executes dropped EXE
PID:1672 -
\??\c:\ddvjj.exec:\ddvjj.exe59⤵
- Executes dropped EXE
PID:2264 -
\??\c:\rxfxflf.exec:\rxfxflf.exe60⤵
- Executes dropped EXE
PID:2088 -
\??\c:\7htbnb.exec:\7htbnb.exe61⤵
- Executes dropped EXE
PID:2176 -
\??\c:\7nbhtb.exec:\7nbhtb.exe62⤵
- Executes dropped EXE
PID:2324 -
\??\c:\dvjdj.exec:\dvjdj.exe63⤵
- Executes dropped EXE
PID:2080 -
\??\c:\rfflrxl.exec:\rfflrxl.exe64⤵
- Executes dropped EXE
PID:568 -
\??\c:\nnnbnt.exec:\nnnbnt.exe65⤵
- Executes dropped EXE
PID:2476 -
\??\c:\ppppv.exec:\ppppv.exe66⤵PID:1276
-
\??\c:\dvpvj.exec:\dvpvj.exe67⤵PID:2000
-
\??\c:\fxxlxlf.exec:\fxxlxlf.exe68⤵PID:1676
-
\??\c:\hhbhbb.exec:\hhbhbb.exe69⤵PID:2056
-
\??\c:\5vvvd.exec:\5vvvd.exe70⤵PID:1704
-
\??\c:\lrfxxrr.exec:\lrfxxrr.exe71⤵PID:1892
-
\??\c:\lrflflf.exec:\lrflflf.exe72⤵PID:1176
-
\??\c:\nnnbnt.exec:\nnnbnt.exe73⤵PID:624
-
\??\c:\pdvjj.exec:\pdvjj.exe74⤵PID:1700
-
\??\c:\rllfxfr.exec:\rllfxfr.exe75⤵PID:2112
-
\??\c:\5nnhnb.exec:\5nnhnb.exe76⤵PID:1800
-
\??\c:\hhhbnn.exec:\hhhbnn.exe77⤵PID:2488
-
\??\c:\djpdd.exec:\djpdd.exe78⤵PID:2004
-
\??\c:\xxrxllx.exec:\xxrxllx.exe79⤵PID:3056
-
\??\c:\hnhtth.exec:\hnhtth.exe80⤵PID:2076
-
\??\c:\jjjvp.exec:\jjjvp.exe81⤵PID:2788
-
\??\c:\5llfxrl.exec:\5llfxrl.exe82⤵PID:2784
-
\??\c:\nnhthn.exec:\nnhthn.exe83⤵PID:3048
-
\??\c:\nbttnh.exec:\nbttnh.exe84⤵PID:1464
-
\??\c:\ppdjv.exec:\ppdjv.exe85⤵PID:3004
-
\??\c:\5rxlrxx.exec:\5rxlrxx.exe86⤵PID:2516
-
\??\c:\tbhtth.exec:\tbhtth.exe87⤵PID:2536
-
\??\c:\9nhtnb.exec:\9nhtnb.exe88⤵PID:2640
-
\??\c:\vjddd.exec:\vjddd.exe89⤵PID:2988
-
\??\c:\rlxfrlr.exec:\rlxfrlr.exe90⤵PID:2756
-
\??\c:\ntntnt.exec:\ntntnt.exe91⤵PID:1972
-
\??\c:\ddjjv.exec:\ddjjv.exe92⤵PID:2400
-
\??\c:\llflffx.exec:\llflffx.exe93⤵PID:1048
-
\??\c:\fffrfff.exec:\fffrfff.exe94⤵PID:552
-
\??\c:\hhbhbh.exec:\hhbhbh.exe95⤵PID:2008
-
\??\c:\vvpvp.exec:\vvpvp.exe96⤵PID:1976
-
\??\c:\rrrrrll.exec:\rrrrrll.exe97⤵PID:584
-
\??\c:\ttthbh.exec:\ttthbh.exe98⤵PID:1260
-
\??\c:\bbthtt.exec:\bbthtt.exe99⤵PID:2228
-
\??\c:\5vvdp.exec:\5vvdp.exe100⤵PID:1668
-
\??\c:\ffxfxfx.exec:\ffxfxfx.exe101⤵PID:1752
-
\??\c:\xxxxlfx.exec:\xxxxlfx.exe102⤵PID:1116
-
\??\c:\7hbbtb.exec:\7hbbtb.exe103⤵PID:1312
-
\??\c:\jdvvp.exec:\jdvvp.exe104⤵PID:1284
-
\??\c:\fxrxfrf.exec:\fxrxfrf.exe105⤵PID:2364
-
\??\c:\xxlrxfx.exec:\xxlrxfx.exe106⤵PID:2136
-
\??\c:\tbhthn.exec:\tbhthn.exe107⤵PID:3032
-
\??\c:\pddpp.exec:\pddpp.exe108⤵PID:1988
-
\??\c:\7ffrfrf.exec:\7ffrfrf.exe109⤵PID:1792
-
\??\c:\nnnbth.exec:\nnnbth.exe110⤵PID:1532
-
\??\c:\nnhbnt.exec:\nnhbnt.exe111⤵PID:2924
-
\??\c:\1pppd.exec:\1pppd.exe112⤵PID:1844
-
\??\c:\ffrlxll.exec:\ffrlxll.exe113⤵PID:796
-
\??\c:\lfxlrfr.exec:\lfxlrfr.exe114⤵PID:1816
-
\??\c:\hhhthn.exec:\hhhthn.exe115⤵PID:2044
-
\??\c:\dvpdd.exec:\dvpdd.exe116⤵PID:1748
-
\??\c:\jpppd.exec:\jpppd.exe117⤵PID:2012
-
\??\c:\7rllxrf.exec:\7rllxrf.exe118⤵PID:1180
-
\??\c:\ffllxfx.exec:\ffllxfx.exe119⤵PID:1736
-
\??\c:\ttbnnb.exec:\ttbnnb.exe120⤵PID:640
-
\??\c:\dvpvj.exec:\dvpvj.exe121⤵PID:1524
-
\??\c:\5vvpv.exec:\5vvpv.exe122⤵PID:2188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-