Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 21:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04126c7ea86c6e4bd4eeb1c1bb76ab20_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
04126c7ea86c6e4bd4eeb1c1bb76ab20_NeikiAnalytics.exe
-
Size
386KB
-
MD5
04126c7ea86c6e4bd4eeb1c1bb76ab20
-
SHA1
32a03d9db20f3f9882e3ebff7eb312eef0cba6ca
-
SHA256
787be39de0f4656ebb9786c640468107462e1bae0e7c5e2765d6fa11d0ab0991
-
SHA512
9401fb71cf37e28e37083bb579f9024171899f8ea729406ea38564571f2057a5c1080d53c3cc8d60102c904de9fbdd1cc15f947dd3c899b2dc8d91838093d519
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwthl:n3C9uYA7okVqdKwaO5CVMhl
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2156-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1528-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1360-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1228-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/588-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1424-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/792-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2936 tththb.exe 2628 ppjvd.exe 2512 9htntn.exe 2656 dvjpd.exe 2528 9rlxlxl.exe 2380 dvdjp.exe 2876 xfxxrrf.exe 1528 ttnthn.exe 2540 1jpvd.exe 2592 hhthnt.exe 1360 hhbhbh.exe 1620 3jjpv.exe 1240 hthbtb.exe 1640 jdppp.exe 1440 rxrlfrl.exe 1228 9vjvj.exe 2204 ddvvd.exe 588 3vpdp.exe 1424 jpppv.exe 1124 tthtbt.exe 652 5pddj.exe 3004 1frlrrf.exe 2964 1tnthn.exe 1708 1rrrxfl.exe 1060 1tthnn.exe 1992 7dvvd.exe 1908 xfxlrxx.exe 1484 hbntbb.exe 792 vvppd.exe 1452 xxxfrrf.exe 2996 bthtbh.exe 2692 9vjpp.exe 3008 btnntt.exe 2936 5pddj.exe 2520 ffrlfll.exe 2672 xrlfrxf.exe 2784 nbnbbt.exe 2124 5jpvv.exe 2676 5lrflrr.exe 2376 nnbthn.exe 2872 nttnnh.exe 2064 djddp.exe 2424 3lfrffr.exe 2432 tnbttn.exe 2612 nbhntb.exe 1664 pppvd.exe 1716 lflrxfr.exe 1560 tntthn.exe 1780 7ttbnt.exe 1588 jpjjv.exe 2320 7fxlrxl.exe 1676 nbnnnt.exe 2772 vddvj.exe 2736 frflffl.exe 2460 lfxfrxl.exe 560 7tntbb.exe 856 vpdpp.exe 2332 lllrflx.exe 1732 hbnbht.exe 852 1bbntb.exe 3004 5dppd.exe 1280 rlflxfx.exe 1304 nnnthn.exe 3056 hbthnt.exe -
resource yara_rule behavioral1/memory/2156-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1528-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1360-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1228-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/588-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1424-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/792-280-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2936 2156 04126c7ea86c6e4bd4eeb1c1bb76ab20_NeikiAnalytics.exe 28 PID 2156 wrote to memory of 2936 2156 04126c7ea86c6e4bd4eeb1c1bb76ab20_NeikiAnalytics.exe 28 PID 2156 wrote to memory of 2936 2156 04126c7ea86c6e4bd4eeb1c1bb76ab20_NeikiAnalytics.exe 28 PID 2156 wrote to memory of 2936 2156 04126c7ea86c6e4bd4eeb1c1bb76ab20_NeikiAnalytics.exe 28 PID 2936 wrote to memory of 2628 2936 tththb.exe 29 PID 2936 wrote to memory of 2628 2936 tththb.exe 29 PID 2936 wrote to memory of 2628 2936 tththb.exe 29 PID 2936 wrote to memory of 2628 2936 tththb.exe 29 PID 2628 wrote to memory of 2512 2628 ppjvd.exe 30 PID 2628 wrote to memory of 2512 2628 ppjvd.exe 30 PID 2628 wrote to memory of 2512 2628 ppjvd.exe 30 PID 2628 wrote to memory of 2512 2628 ppjvd.exe 30 PID 2512 wrote to memory of 2656 2512 9htntn.exe 31 PID 2512 wrote to memory of 2656 2512 9htntn.exe 31 PID 2512 wrote to memory of 2656 2512 9htntn.exe 31 PID 2512 wrote to memory of 2656 2512 9htntn.exe 31 PID 2656 wrote to memory of 2528 2656 dvjpd.exe 32 PID 2656 wrote to memory of 2528 2656 dvjpd.exe 32 PID 2656 wrote to memory of 2528 2656 dvjpd.exe 32 PID 2656 wrote to memory of 2528 2656 dvjpd.exe 32 PID 2528 wrote to memory of 2380 2528 9rlxlxl.exe 33 PID 2528 wrote to memory of 2380 2528 9rlxlxl.exe 33 PID 2528 wrote to memory of 2380 2528 9rlxlxl.exe 33 PID 2528 wrote to memory of 2380 2528 9rlxlxl.exe 33 PID 2380 wrote to memory of 2876 2380 dvdjp.exe 34 PID 2380 wrote to memory of 2876 2380 dvdjp.exe 34 PID 2380 wrote to memory of 2876 2380 dvdjp.exe 34 PID 2380 wrote to memory of 2876 2380 dvdjp.exe 34 PID 2876 wrote to memory of 1528 2876 xfxxrrf.exe 35 PID 2876 wrote to memory of 1528 2876 xfxxrrf.exe 35 PID 2876 wrote to memory of 1528 2876 xfxxrrf.exe 35 PID 2876 wrote to memory of 1528 2876 xfxxrrf.exe 35 PID 1528 wrote to memory of 2540 1528 ttnthn.exe 36 PID 1528 wrote to memory of 2540 1528 ttnthn.exe 36 PID 1528 wrote to memory of 2540 1528 ttnthn.exe 36 PID 1528 wrote to memory of 2540 1528 ttnthn.exe 36 PID 2540 wrote to memory of 2592 2540 1jpvd.exe 37 PID 2540 wrote to memory of 2592 2540 1jpvd.exe 37 PID 2540 wrote to memory of 2592 2540 1jpvd.exe 37 PID 2540 wrote to memory of 2592 2540 1jpvd.exe 37 PID 2592 wrote to memory of 1360 2592 hhthnt.exe 38 PID 2592 wrote to memory of 1360 2592 hhthnt.exe 38 PID 2592 wrote to memory of 1360 2592 hhthnt.exe 38 PID 2592 wrote to memory of 1360 2592 hhthnt.exe 38 PID 1360 wrote to memory of 1620 1360 hhbhbh.exe 39 PID 1360 wrote to memory of 1620 1360 hhbhbh.exe 39 PID 1360 wrote to memory of 1620 1360 hhbhbh.exe 39 PID 1360 wrote to memory of 1620 1360 hhbhbh.exe 39 PID 1620 wrote to memory of 1240 1620 3jjpv.exe 40 PID 1620 wrote to memory of 1240 1620 3jjpv.exe 40 PID 1620 wrote to memory of 1240 1620 3jjpv.exe 40 PID 1620 wrote to memory of 1240 1620 3jjpv.exe 40 PID 1240 wrote to memory of 1640 1240 hthbtb.exe 41 PID 1240 wrote to memory of 1640 1240 hthbtb.exe 41 PID 1240 wrote to memory of 1640 1240 hthbtb.exe 41 PID 1240 wrote to memory of 1640 1240 hthbtb.exe 41 PID 1640 wrote to memory of 1440 1640 jdppp.exe 42 PID 1640 wrote to memory of 1440 1640 jdppp.exe 42 PID 1640 wrote to memory of 1440 1640 jdppp.exe 42 PID 1640 wrote to memory of 1440 1640 jdppp.exe 42 PID 1440 wrote to memory of 1228 1440 rxrlfrl.exe 43 PID 1440 wrote to memory of 1228 1440 rxrlfrl.exe 43 PID 1440 wrote to memory of 1228 1440 rxrlfrl.exe 43 PID 1440 wrote to memory of 1228 1440 rxrlfrl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\04126c7ea86c6e4bd4eeb1c1bb76ab20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\04126c7ea86c6e4bd4eeb1c1bb76ab20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\tththb.exec:\tththb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\ppjvd.exec:\ppjvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\9htntn.exec:\9htntn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\dvjpd.exec:\dvjpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\9rlxlxl.exec:\9rlxlxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\dvdjp.exec:\dvdjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\xfxxrrf.exec:\xfxxrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\ttnthn.exec:\ttnthn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\1jpvd.exec:\1jpvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\hhthnt.exec:\hhthnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\hhbhbh.exec:\hhbhbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\3jjpv.exec:\3jjpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\hthbtb.exec:\hthbtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\jdppp.exec:\jdppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\rxrlfrl.exec:\rxrlfrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\9vjvj.exec:\9vjvj.exe17⤵
- Executes dropped EXE
PID:1228 -
\??\c:\ddvvd.exec:\ddvvd.exe18⤵
- Executes dropped EXE
PID:2204 -
\??\c:\3vpdp.exec:\3vpdp.exe19⤵
- Executes dropped EXE
PID:588 -
\??\c:\jpppv.exec:\jpppv.exe20⤵
- Executes dropped EXE
PID:1424 -
\??\c:\tthtbt.exec:\tthtbt.exe21⤵
- Executes dropped EXE
PID:1124 -
\??\c:\5pddj.exec:\5pddj.exe22⤵
- Executes dropped EXE
PID:652 -
\??\c:\1frlrrf.exec:\1frlrrf.exe23⤵
- Executes dropped EXE
PID:3004 -
\??\c:\1tnthn.exec:\1tnthn.exe24⤵
- Executes dropped EXE
PID:2964 -
\??\c:\1rrrxfl.exec:\1rrrxfl.exe25⤵
- Executes dropped EXE
PID:1708 -
\??\c:\1tthnn.exec:\1tthnn.exe26⤵
- Executes dropped EXE
PID:1060 -
\??\c:\7dvvd.exec:\7dvvd.exe27⤵
- Executes dropped EXE
PID:1992 -
\??\c:\xfxlrxx.exec:\xfxlrxx.exe28⤵
- Executes dropped EXE
PID:1908 -
\??\c:\hbntbb.exec:\hbntbb.exe29⤵
- Executes dropped EXE
PID:1484 -
\??\c:\vvppd.exec:\vvppd.exe30⤵
- Executes dropped EXE
PID:792 -
\??\c:\xxxfrrf.exec:\xxxfrrf.exe31⤵
- Executes dropped EXE
PID:1452 -
\??\c:\bthtbh.exec:\bthtbh.exe32⤵
- Executes dropped EXE
PID:2996 -
\??\c:\9vjpp.exec:\9vjpp.exe33⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rxrlrlx.exec:\rxrlrlx.exe34⤵PID:1532
-
\??\c:\btnntt.exec:\btnntt.exe35⤵
- Executes dropped EXE
PID:3008 -
\??\c:\5pddj.exec:\5pddj.exe36⤵
- Executes dropped EXE
PID:2936 -
\??\c:\ffrlfll.exec:\ffrlfll.exe37⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xrlfrxf.exec:\xrlfrxf.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\nbnbbt.exec:\nbnbbt.exe39⤵
- Executes dropped EXE
PID:2784 -
\??\c:\5jpvv.exec:\5jpvv.exe40⤵
- Executes dropped EXE
PID:2124 -
\??\c:\5lrflrr.exec:\5lrflrr.exe41⤵
- Executes dropped EXE
PID:2676 -
\??\c:\nnbthn.exec:\nnbthn.exe42⤵
- Executes dropped EXE
PID:2376 -
\??\c:\nttnnh.exec:\nttnnh.exe43⤵
- Executes dropped EXE
PID:2872 -
\??\c:\djddp.exec:\djddp.exe44⤵
- Executes dropped EXE
PID:2064 -
\??\c:\3lfrffr.exec:\3lfrffr.exe45⤵
- Executes dropped EXE
PID:2424 -
\??\c:\tnbttn.exec:\tnbttn.exe46⤵
- Executes dropped EXE
PID:2432 -
\??\c:\nbhntb.exec:\nbhntb.exe47⤵
- Executes dropped EXE
PID:2612 -
\??\c:\pppvd.exec:\pppvd.exe48⤵
- Executes dropped EXE
PID:1664 -
\??\c:\lflrxfr.exec:\lflrxfr.exe49⤵
- Executes dropped EXE
PID:1716 -
\??\c:\tntthn.exec:\tntthn.exe50⤵
- Executes dropped EXE
PID:1560 -
\??\c:\7ttbnt.exec:\7ttbnt.exe51⤵
- Executes dropped EXE
PID:1780 -
\??\c:\jpjjv.exec:\jpjjv.exe52⤵
- Executes dropped EXE
PID:1588 -
\??\c:\7fxlrxl.exec:\7fxlrxl.exe53⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nbnnnt.exec:\nbnnnt.exe54⤵
- Executes dropped EXE
PID:1676 -
\??\c:\vddvj.exec:\vddvj.exe55⤵
- Executes dropped EXE
PID:2772 -
\??\c:\frflffl.exec:\frflffl.exe56⤵
- Executes dropped EXE
PID:2736 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe57⤵
- Executes dropped EXE
PID:2460 -
\??\c:\7tntbb.exec:\7tntbb.exe58⤵
- Executes dropped EXE
PID:560 -
\??\c:\vpdpp.exec:\vpdpp.exe59⤵
- Executes dropped EXE
PID:856 -
\??\c:\lllrflx.exec:\lllrflx.exe60⤵
- Executes dropped EXE
PID:2332 -
\??\c:\hbnbht.exec:\hbnbht.exe61⤵
- Executes dropped EXE
PID:1732 -
\??\c:\1bbntb.exec:\1bbntb.exe62⤵
- Executes dropped EXE
PID:852 -
\??\c:\5dppd.exec:\5dppd.exe63⤵
- Executes dropped EXE
PID:3004 -
\??\c:\rlflxfx.exec:\rlflxfx.exe64⤵
- Executes dropped EXE
PID:1280 -
\??\c:\nnnthn.exec:\nnnthn.exe65⤵
- Executes dropped EXE
PID:1304 -
\??\c:\hbthnt.exec:\hbthnt.exe66⤵
- Executes dropped EXE
PID:3056 -
\??\c:\jvvdd.exec:\jvvdd.exe67⤵PID:920
-
\??\c:\5rflrrx.exec:\5rflrrx.exe68⤵PID:2284
-
\??\c:\xxflxxl.exec:\xxflxxl.exe69⤵PID:1968
-
\??\c:\ththnt.exec:\ththnt.exe70⤵PID:2008
-
\??\c:\ppjvd.exec:\ppjvd.exe71⤵PID:2068
-
\??\c:\fxrxllx.exec:\fxrxllx.exe72⤵PID:896
-
\??\c:\fxrfxxl.exec:\fxrfxxl.exe73⤵PID:2212
-
\??\c:\bbhtth.exec:\bbhtth.exe74⤵PID:3060
-
\??\c:\7pjjp.exec:\7pjjp.exe75⤵PID:1540
-
\??\c:\dvvvj.exec:\dvvvj.exe76⤵PID:2216
-
\??\c:\5xrxflr.exec:\5xrxflr.exe77⤵PID:2620
-
\??\c:\ttnhtb.exec:\ttnhtb.exe78⤵PID:2936
-
\??\c:\vpvdd.exec:\vpvdd.exe79⤵PID:2664
-
\??\c:\xxlrrff.exec:\xxlrrff.exe80⤵PID:2624
-
\??\c:\llrlxll.exec:\llrlxll.exe81⤵PID:2420
-
\??\c:\1hhnbb.exec:\1hhnbb.exe82⤵PID:2124
-
\??\c:\ddvdj.exec:\ddvdj.exe83⤵PID:2380
-
\??\c:\fxxlrxf.exec:\fxxlrxf.exe84⤵PID:2376
-
\??\c:\hhbbhh.exec:\hhbbhh.exe85⤵PID:2948
-
\??\c:\ttnthh.exec:\ttnthh.exe86⤵PID:2064
-
\??\c:\1pddd.exec:\1pddd.exe87⤵PID:2600
-
\??\c:\rrfflrx.exec:\rrfflrx.exe88⤵PID:2704
-
\??\c:\thbhtb.exec:\thbhtb.exe89⤵PID:2612
-
\??\c:\jdvdp.exec:\jdvdp.exe90⤵PID:1664
-
\??\c:\vvpdj.exec:\vvpdj.exe91⤵PID:1716
-
\??\c:\lrrlxlf.exec:\lrrlxlf.exe92⤵PID:1560
-
\??\c:\hhnntb.exec:\hhnntb.exe93⤵PID:872
-
\??\c:\vppvp.exec:\vppvp.exe94⤵PID:332
-
\??\c:\xrrrffr.exec:\xrrrffr.exe95⤵PID:2320
-
\??\c:\5ntbnn.exec:\5ntbnn.exe96⤵PID:1676
-
\??\c:\5djjp.exec:\5djjp.exe97⤵PID:324
-
\??\c:\dddpj.exec:\dddpj.exe98⤵PID:2736
-
\??\c:\xrfrflx.exec:\xrfrflx.exe99⤵PID:1064
-
\??\c:\fxxfrxr.exec:\fxxfrxr.exe100⤵PID:560
-
\??\c:\hbthtt.exec:\hbthtt.exe101⤵PID:2608
-
\??\c:\vpddp.exec:\vpddp.exe102⤵PID:2332
-
\??\c:\ddvdp.exec:\ddvdp.exe103⤵PID:2984
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe104⤵PID:852
-
\??\c:\hnhhnt.exec:\hnhhnt.exe105⤵PID:3004
-
\??\c:\5hnhtb.exec:\5hnhtb.exe106⤵PID:1280
-
\??\c:\7vjvd.exec:\7vjvd.exe107⤵PID:404
-
\??\c:\jjdjp.exec:\jjdjp.exe108⤵PID:3056
-
\??\c:\ffxfxfx.exec:\ffxfxfx.exe109⤵PID:1028
-
\??\c:\nnbbnt.exec:\nnbbnt.exe110⤵PID:2284
-
\??\c:\vvpvj.exec:\vvpvj.exe111⤵PID:1484
-
\??\c:\9jdpd.exec:\9jdpd.exe112⤵PID:2008
-
\??\c:\rlxfrrf.exec:\rlxfrrf.exe113⤵PID:2328
-
\??\c:\tnhtnn.exec:\tnhtnn.exe114⤵PID:896
-
\??\c:\tbbhbh.exec:\tbbhbh.exe115⤵PID:2940
-
\??\c:\jvpjd.exec:\jvpjd.exe116⤵PID:1660
-
\??\c:\fffrfxl.exec:\fffrfxl.exe117⤵PID:2632
-
\??\c:\1rllrfl.exec:\1rllrfl.exe118⤵PID:2216
-
\??\c:\bbhnbh.exec:\bbhnbh.exe119⤵PID:2496
-
\??\c:\ddpvj.exec:\ddpvj.exe120⤵PID:2936
-
\??\c:\5pjdj.exec:\5pjdj.exe121⤵PID:2896
-
\??\c:\7fxxxxf.exec:\7fxxxxf.exe122⤵PID:2624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-