Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 10:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
acc861445e790fc70af211a6a4667690_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
acc861445e790fc70af211a6a4667690_NeikiAnalytics.exe
-
Size
55KB
-
MD5
acc861445e790fc70af211a6a4667690
-
SHA1
4fdab77dc296262dc6a5b3e1a5dc2017a10a0532
-
SHA256
d43ee8db0c00cf4f6fd95be4090150de1ef4aeb6a29ed36e8aa5e590962e6719
-
SHA512
d869597dabd334ef95ed1a1204cec3b13b08f78b681954510e20ec25ad00524a70efc3cc51903d9383a40a70f8e90ef7e6e2d247b3da2ff56982e557093d511d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb6tZ9bm:ymb3NkkiQ3mdBjFIb6tZNm
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2096-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-50-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-70-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1460-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/300-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-594-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2096 5thbbt.exe 2644 vvppd.exe 2544 7xrllfl.exe 2448 3htbht.exe 2460 vvddj.exe 2432 9xfxrfr.exe 2864 xlffllr.exe 2304 ttnhnb.exe 1580 nnhnbh.exe 1460 dddvp.exe 300 jjdvj.exe 108 xxrxfrf.exe 1604 7rlfllr.exe 1688 3hhtnb.exe 856 nnhhnb.exe 1032 ddpvp.exe 1292 xrlxlxl.exe 1280 fxxlxfr.exe 2724 ttnnbb.exe 1660 thnnhh.exe 2764 pjdpv.exe 560 7jjpd.exe 640 lfxlrxf.exe 2692 lrxxxrr.exe 1568 hbnnbb.exe 2224 nhntnh.exe 2496 vpddj.exe 1488 vvpvd.exe 2352 xrfxxlr.exe 1960 lffrxrf.exe 900 hbhtbn.exe 2276 ppvjv.exe 1540 vppjv.exe 3056 fxxfxxl.exe 2904 xfrlxrl.exe 2120 ttttnb.exe 2712 hbhhtt.exe 2448 9vdjp.exe 292 ppddd.exe 2416 jdvdp.exe 2432 7fxrfrf.exe 2580 rrffrrl.exe 1916 bbhthn.exe 1020 nhhbnn.exe 1456 ppppv.exe 304 vvpdj.exe 2316 jjdpv.exe 2184 xxlfrrf.exe 2388 frxrllr.exe 2328 nnnbnb.exe 1748 hhbbhh.exe 484 vdvpd.exe 788 dvjjp.exe 1324 lrlfrrf.exe 1204 7dvdd.exe 2696 ddvpv.exe 272 lxxlxxf.exe 2356 rrfrxxr.exe 2144 tbhnnn.exe 2396 tttbbh.exe 2592 vppjp.exe 1792 vjjvv.exe 2260 ffxxflx.exe 2132 xrrlrlr.exe -
resource yara_rule behavioral1/memory/2096-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1460-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/300-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-594-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2604 wrote to memory of 2096 2604 acc861445e790fc70af211a6a4667690_NeikiAnalytics.exe 28 PID 2604 wrote to memory of 2096 2604 acc861445e790fc70af211a6a4667690_NeikiAnalytics.exe 28 PID 2604 wrote to memory of 2096 2604 acc861445e790fc70af211a6a4667690_NeikiAnalytics.exe 28 PID 2604 wrote to memory of 2096 2604 acc861445e790fc70af211a6a4667690_NeikiAnalytics.exe 28 PID 2096 wrote to memory of 2644 2096 5thbbt.exe 29 PID 2096 wrote to memory of 2644 2096 5thbbt.exe 29 PID 2096 wrote to memory of 2644 2096 5thbbt.exe 29 PID 2096 wrote to memory of 2644 2096 5thbbt.exe 29 PID 2644 wrote to memory of 2544 2644 vvppd.exe 30 PID 2644 wrote to memory of 2544 2644 vvppd.exe 30 PID 2644 wrote to memory of 2544 2644 vvppd.exe 30 PID 2644 wrote to memory of 2544 2644 vvppd.exe 30 PID 2544 wrote to memory of 2448 2544 7xrllfl.exe 31 PID 2544 wrote to memory of 2448 2544 7xrllfl.exe 31 PID 2544 wrote to memory of 2448 2544 7xrllfl.exe 31 PID 2544 wrote to memory of 2448 2544 7xrllfl.exe 31 PID 2448 wrote to memory of 2460 2448 3htbht.exe 32 PID 2448 wrote to memory of 2460 2448 3htbht.exe 32 PID 2448 wrote to memory of 2460 2448 3htbht.exe 32 PID 2448 wrote to memory of 2460 2448 3htbht.exe 32 PID 2460 wrote to memory of 2432 2460 vvddj.exe 33 PID 2460 wrote to memory of 2432 2460 vvddj.exe 33 PID 2460 wrote to memory of 2432 2460 vvddj.exe 33 PID 2460 wrote to memory of 2432 2460 vvddj.exe 33 PID 2432 wrote to memory of 2864 2432 9xfxrfr.exe 34 PID 2432 wrote to memory of 2864 2432 9xfxrfr.exe 34 PID 2432 wrote to memory of 2864 2432 9xfxrfr.exe 34 PID 2432 wrote to memory of 2864 2432 9xfxrfr.exe 34 PID 2864 wrote to memory of 2304 2864 xlffllr.exe 35 PID 2864 wrote to memory of 2304 2864 xlffllr.exe 35 PID 2864 wrote to memory of 2304 2864 xlffllr.exe 35 PID 2864 wrote to memory of 2304 2864 xlffllr.exe 35 PID 2304 wrote to memory of 1580 2304 ttnhnb.exe 36 PID 2304 wrote to memory of 1580 2304 ttnhnb.exe 36 PID 2304 wrote to memory of 1580 2304 ttnhnb.exe 36 PID 2304 wrote to memory of 1580 2304 ttnhnb.exe 36 PID 1580 wrote to memory of 1460 1580 nnhnbh.exe 37 PID 1580 wrote to memory of 1460 1580 nnhnbh.exe 37 PID 1580 wrote to memory of 1460 1580 nnhnbh.exe 37 PID 1580 wrote to memory of 1460 1580 nnhnbh.exe 37 PID 1460 wrote to memory of 300 1460 dddvp.exe 38 PID 1460 wrote to memory of 300 1460 dddvp.exe 38 PID 1460 wrote to memory of 300 1460 dddvp.exe 38 PID 1460 wrote to memory of 300 1460 dddvp.exe 38 PID 300 wrote to memory of 108 300 jjdvj.exe 39 PID 300 wrote to memory of 108 300 jjdvj.exe 39 PID 300 wrote to memory of 108 300 jjdvj.exe 39 PID 300 wrote to memory of 108 300 jjdvj.exe 39 PID 108 wrote to memory of 1604 108 xxrxfrf.exe 40 PID 108 wrote to memory of 1604 108 xxrxfrf.exe 40 PID 108 wrote to memory of 1604 108 xxrxfrf.exe 40 PID 108 wrote to memory of 1604 108 xxrxfrf.exe 40 PID 1604 wrote to memory of 1688 1604 7rlfllr.exe 41 PID 1604 wrote to memory of 1688 1604 7rlfllr.exe 41 PID 1604 wrote to memory of 1688 1604 7rlfllr.exe 41 PID 1604 wrote to memory of 1688 1604 7rlfllr.exe 41 PID 1688 wrote to memory of 856 1688 3hhtnb.exe 42 PID 1688 wrote to memory of 856 1688 3hhtnb.exe 42 PID 1688 wrote to memory of 856 1688 3hhtnb.exe 42 PID 1688 wrote to memory of 856 1688 3hhtnb.exe 42 PID 856 wrote to memory of 1032 856 nnhhnb.exe 43 PID 856 wrote to memory of 1032 856 nnhhnb.exe 43 PID 856 wrote to memory of 1032 856 nnhhnb.exe 43 PID 856 wrote to memory of 1032 856 nnhhnb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\acc861445e790fc70af211a6a4667690_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\acc861445e790fc70af211a6a4667690_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\5thbbt.exec:\5thbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\vvppd.exec:\vvppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\7xrllfl.exec:\7xrllfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\3htbht.exec:\3htbht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\vvddj.exec:\vvddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\9xfxrfr.exec:\9xfxrfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\xlffllr.exec:\xlffllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\ttnhnb.exec:\ttnhnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\nnhnbh.exec:\nnhnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\dddvp.exec:\dddvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\jjdvj.exec:\jjdvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
\??\c:\xxrxfrf.exec:\xxrxfrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
\??\c:\7rlfllr.exec:\7rlfllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\3hhtnb.exec:\3hhtnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\nnhhnb.exec:\nnhhnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\ddpvp.exec:\ddpvp.exe17⤵
- Executes dropped EXE
PID:1032 -
\??\c:\xrlxlxl.exec:\xrlxlxl.exe18⤵
- Executes dropped EXE
PID:1292 -
\??\c:\fxxlxfr.exec:\fxxlxfr.exe19⤵
- Executes dropped EXE
PID:1280 -
\??\c:\ttnnbb.exec:\ttnnbb.exe20⤵
- Executes dropped EXE
PID:2724 -
\??\c:\thnnhh.exec:\thnnhh.exe21⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pjdpv.exec:\pjdpv.exe22⤵
- Executes dropped EXE
PID:2764 -
\??\c:\7jjpd.exec:\7jjpd.exe23⤵
- Executes dropped EXE
PID:560 -
\??\c:\lfxlrxf.exec:\lfxlrxf.exe24⤵
- Executes dropped EXE
PID:640 -
\??\c:\lrxxxrr.exec:\lrxxxrr.exe25⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hbnnbb.exec:\hbnnbb.exe26⤵
- Executes dropped EXE
PID:1568 -
\??\c:\nhntnh.exec:\nhntnh.exe27⤵
- Executes dropped EXE
PID:2224 -
\??\c:\vpddj.exec:\vpddj.exe28⤵
- Executes dropped EXE
PID:2496 -
\??\c:\vvpvd.exec:\vvpvd.exe29⤵
- Executes dropped EXE
PID:1488 -
\??\c:\xrfxxlr.exec:\xrfxxlr.exe30⤵
- Executes dropped EXE
PID:2352 -
\??\c:\lffrxrf.exec:\lffrxrf.exe31⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hbhtbn.exec:\hbhtbn.exe32⤵
- Executes dropped EXE
PID:900 -
\??\c:\ppvjv.exec:\ppvjv.exe33⤵
- Executes dropped EXE
PID:2276 -
\??\c:\vppjv.exec:\vppjv.exe34⤵
- Executes dropped EXE
PID:1540 -
\??\c:\fxxfxxl.exec:\fxxfxxl.exe35⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xfrlxrl.exec:\xfrlxrl.exe36⤵
- Executes dropped EXE
PID:2904 -
\??\c:\ttttnb.exec:\ttttnb.exe37⤵
- Executes dropped EXE
PID:2120 -
\??\c:\hbhhtt.exec:\hbhhtt.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\9vdjp.exec:\9vdjp.exe39⤵
- Executes dropped EXE
PID:2448 -
\??\c:\ppddd.exec:\ppddd.exe40⤵
- Executes dropped EXE
PID:292 -
\??\c:\jdvdp.exec:\jdvdp.exe41⤵
- Executes dropped EXE
PID:2416 -
\??\c:\7fxrfrf.exec:\7fxrfrf.exe42⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rrffrrl.exec:\rrffrrl.exe43⤵
- Executes dropped EXE
PID:2580 -
\??\c:\bbhthn.exec:\bbhthn.exe44⤵
- Executes dropped EXE
PID:1916 -
\??\c:\nhhbnn.exec:\nhhbnn.exe45⤵
- Executes dropped EXE
PID:1020 -
\??\c:\ppppv.exec:\ppppv.exe46⤵
- Executes dropped EXE
PID:1456 -
\??\c:\vvpdj.exec:\vvpdj.exe47⤵
- Executes dropped EXE
PID:304 -
\??\c:\jjdpv.exec:\jjdpv.exe48⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xxlfrrf.exec:\xxlfrrf.exe49⤵
- Executes dropped EXE
PID:2184 -
\??\c:\frxrllr.exec:\frxrllr.exe50⤵
- Executes dropped EXE
PID:2388 -
\??\c:\nnnbnb.exec:\nnnbnb.exe51⤵
- Executes dropped EXE
PID:2328 -
\??\c:\hhbbhh.exec:\hhbbhh.exe52⤵
- Executes dropped EXE
PID:1748 -
\??\c:\vdvpd.exec:\vdvpd.exe53⤵
- Executes dropped EXE
PID:484 -
\??\c:\dvjjp.exec:\dvjjp.exe54⤵
- Executes dropped EXE
PID:788 -
\??\c:\lrlfrrf.exec:\lrlfrrf.exe55⤵
- Executes dropped EXE
PID:1324 -
\??\c:\7dvdd.exec:\7dvdd.exe56⤵
- Executes dropped EXE
PID:1204 -
\??\c:\ddvpv.exec:\ddvpv.exe57⤵
- Executes dropped EXE
PID:2696 -
\??\c:\lxxlxxf.exec:\lxxlxxf.exe58⤵
- Executes dropped EXE
PID:272 -
\??\c:\rrfrxxr.exec:\rrfrxxr.exe59⤵
- Executes dropped EXE
PID:2356 -
\??\c:\tbhnnn.exec:\tbhnnn.exe60⤵
- Executes dropped EXE
PID:2144 -
\??\c:\tttbbh.exec:\tttbbh.exe61⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vppjp.exec:\vppjp.exe62⤵
- Executes dropped EXE
PID:2592 -
\??\c:\vjjvv.exec:\vjjvv.exe63⤵
- Executes dropped EXE
PID:1792 -
\??\c:\ffxxflx.exec:\ffxxflx.exe64⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xrrlrlr.exec:\xrrlrlr.exe65⤵
- Executes dropped EXE
PID:2132 -
\??\c:\nhtbbn.exec:\nhtbbn.exe66⤵PID:1912
-
\??\c:\tthhbb.exec:\tthhbb.exe67⤵PID:972
-
\??\c:\jvvdd.exec:\jvvdd.exe68⤵PID:2116
-
\??\c:\1ppjv.exec:\1ppjv.exe69⤵PID:2272
-
\??\c:\lxlfrxr.exec:\lxlfrxr.exe70⤵PID:1156
-
\??\c:\nbbbnn.exec:\nbbbnn.exe71⤵PID:2352
-
\??\c:\htbtnh.exec:\htbtnh.exe72⤵PID:1444
-
\??\c:\jjpdv.exec:\jjpdv.exe73⤵PID:2796
-
\??\c:\pjpdv.exec:\pjpdv.exe74⤵PID:2604
-
\??\c:\llflllx.exec:\llflllx.exe75⤵PID:1656
-
\??\c:\hthhnt.exec:\hthhnt.exe76⤵PID:2672
-
\??\c:\hbnbbh.exec:\hbnbbh.exe77⤵PID:2644
-
\??\c:\vvpdj.exec:\vvpdj.exe78⤵PID:2552
-
\??\c:\dddpp.exec:\dddpp.exe79⤵PID:2544
-
\??\c:\xrllxxl.exec:\xrllxxl.exe80⤵PID:2572
-
\??\c:\1xllxrx.exec:\1xllxrx.exe81⤵PID:2428
-
\??\c:\nhhthb.exec:\nhhthb.exe82⤵PID:2412
-
\??\c:\ddjvp.exec:\ddjvp.exe83⤵PID:2456
-
\??\c:\pjvdj.exec:\pjvdj.exe84⤵PID:2432
-
\??\c:\xxrxxff.exec:\xxrxxff.exe85⤵PID:2864
-
\??\c:\xrllxrx.exec:\xrllxrx.exe86⤵PID:2148
-
\??\c:\1bthnb.exec:\1bthnb.exe87⤵PID:112
-
\??\c:\djdpd.exec:\djdpd.exe88⤵PID:1944
-
\??\c:\5jjdp.exec:\5jjdp.exe89⤵PID:1616
-
\??\c:\xxrxflr.exec:\xxrxflr.exe90⤵PID:2332
-
\??\c:\9ffxflr.exec:\9ffxflr.exe91⤵PID:296
-
\??\c:\bhnthh.exec:\bhnthh.exe92⤵PID:1648
-
\??\c:\hhbnbn.exec:\hhbnbn.exe93⤵PID:604
-
\??\c:\btntbh.exec:\btntbh.exe94⤵PID:1420
-
\??\c:\jdddv.exec:\jdddv.exe95⤵PID:2344
-
\??\c:\dvjpp.exec:\dvjpp.exe96⤵PID:1284
-
\??\c:\rlxlllr.exec:\rlxlllr.exe97⤵PID:848
-
\??\c:\xrrrrrx.exec:\xrrrrrx.exe98⤵PID:868
-
\??\c:\tbbnth.exec:\tbbnth.exe99⤵PID:1956
-
\??\c:\3tnbbh.exec:\3tnbbh.exe100⤵PID:2704
-
\??\c:\vddjd.exec:\vddjd.exe101⤵PID:2760
-
\??\c:\ddvdj.exec:\ddvdj.exe102⤵PID:2144
-
\??\c:\9rlxlrl.exec:\9rlxlrl.exe103⤵PID:1412
-
\??\c:\llrfrxl.exec:\llrfrxl.exe104⤵PID:2296
-
\??\c:\bbttnb.exec:\bbttnb.exe105⤵PID:276
-
\??\c:\ttnbhn.exec:\ttnbhn.exe106⤵PID:1632
-
\??\c:\7dppp.exec:\7dppp.exe107⤵PID:2132
-
\??\c:\pppjv.exec:\pppjv.exe108⤵PID:1716
-
\??\c:\fxxxfxl.exec:\fxxxfxl.exe109⤵PID:932
-
\??\c:\rrrlfrf.exec:\rrrlfrf.exe110⤵PID:2116
-
\??\c:\3lffrxl.exec:\3lffrxl.exe111⤵PID:1584
-
\??\c:\ttnbth.exec:\ttnbth.exe112⤵PID:596
-
\??\c:\hhttth.exec:\hhttth.exe113⤵PID:2140
-
\??\c:\dvdjj.exec:\dvdjj.exe114⤵PID:900
-
\??\c:\3vvdj.exec:\3vvdj.exe115⤵PID:2268
-
\??\c:\xxxrflx.exec:\xxxrflx.exe116⤵PID:2748
-
\??\c:\llrrxrx.exec:\llrrxrx.exe117⤵PID:2108
-
\??\c:\rxxrxlr.exec:\rxxrxlr.exe118⤵PID:2640
-
\??\c:\tntnbb.exec:\tntnbb.exe119⤵PID:2564
-
\??\c:\bbttnt.exec:\bbttnt.exe120⤵PID:2536
-
\??\c:\9jdpv.exec:\9jdpv.exe121⤵PID:2620
-
\??\c:\pvppd.exec:\pvppd.exe122⤵PID:3048
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-