Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 21:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
211fdfa0c83483cf93bdc96aa7babdd0_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
211fdfa0c83483cf93bdc96aa7babdd0_NeikiAnalytics.exe
-
Size
457KB
-
MD5
211fdfa0c83483cf93bdc96aa7babdd0
-
SHA1
dd556a7911e3e16c203aa3a72eb895073d403f57
-
SHA256
75490944d21db57835c022f685420f79cacc632f0617540dd45dc6539237a8d8
-
SHA512
db932474ba8a1aca04d92d46602ef17eb9530981fd7f0da5a18057639807821616158157c784ee31fc538ede24f75fb171e1261183d9a9c89da59a16def3f91d
-
SSDEEP
12288:n3C9uDIPh2kkkkK4kXkkkkkkkkl888888888888888888nQR:ShPh2kkkkK4kXkkkkkkkkSR
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2152-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3064-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1188-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/996-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1060-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2324 bhnhbt.exe 3064 dpdvd.exe 2512 htbhnh.exe 2628 pjvdp.exe 2712 7hbnbh.exe 2456 nthttn.exe 2704 lxlrxxr.exe 2484 7tbbhn.exe 3032 pjjpj.exe 1800 ntbhtb.exe 2596 1jppv.exe 1904 rrxrflf.exe 2664 nhbhtb.exe 1188 thttnn.exe 2824 fxrxxfx.exe 1672 9hntbn.exe 1748 vjvdp.exe 2516 5ntnnh.exe 1676 jvpdp.exe 1504 1dppv.exe 1716 btbtbh.exe 996 5hbhhn.exe 828 9lrrxrx.exe 600 httthb.exe 1032 9pjjj.exe 2236 1flxxxf.exe 1060 5dvdj.exe 836 rlxxffr.exe 1420 3htnhh.exe 2804 7dppv.exe 1740 frrrlll.exe 1224 tthhnh.exe 1596 jdvvd.exe 2036 7rxllll.exe 2376 5llffxf.exe 3064 thtttt.exe 2700 vjpjj.exe 2620 5pddp.exe 2428 xlxrxrf.exe 2976 bntntn.exe 2444 1hbhnt.exe 2456 dpvvv.exe 2796 xrxrxxf.exe 2472 3lxxxfr.exe 1952 9htnnn.exe 2372 5djjj.exe 2140 ddvjd.exe 1064 rfffxrx.exe 2608 7xxrrrr.exe 2408 3bnntt.exe 2656 dvdpp.exe 2780 5rfffxr.exe 796 3flffxf.exe 1752 nhnntn.exe 2972 nnbttn.exe 2220 7vvpp.exe 2260 rlxxxxf.exe 2252 bntbbb.exe 660 9thbnn.exe 536 dpdjp.exe 1268 vpdjp.exe 348 xrfrxrf.exe 1104 tntttt.exe 1964 thtnhh.exe -
resource yara_rule behavioral1/memory/2152-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1188-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/996-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2152 wrote to memory of 2324 2152 211fdfa0c83483cf93bdc96aa7babdd0_NeikiAnalytics.exe 28 PID 2152 wrote to memory of 2324 2152 211fdfa0c83483cf93bdc96aa7babdd0_NeikiAnalytics.exe 28 PID 2152 wrote to memory of 2324 2152 211fdfa0c83483cf93bdc96aa7babdd0_NeikiAnalytics.exe 28 PID 2152 wrote to memory of 2324 2152 211fdfa0c83483cf93bdc96aa7babdd0_NeikiAnalytics.exe 28 PID 2324 wrote to memory of 3064 2324 bhnhbt.exe 29 PID 2324 wrote to memory of 3064 2324 bhnhbt.exe 29 PID 2324 wrote to memory of 3064 2324 bhnhbt.exe 29 PID 2324 wrote to memory of 3064 2324 bhnhbt.exe 29 PID 3064 wrote to memory of 2512 3064 dpdvd.exe 30 PID 3064 wrote to memory of 2512 3064 dpdvd.exe 30 PID 3064 wrote to memory of 2512 3064 dpdvd.exe 30 PID 3064 wrote to memory of 2512 3064 dpdvd.exe 30 PID 2512 wrote to memory of 2628 2512 htbhnh.exe 31 PID 2512 wrote to memory of 2628 2512 htbhnh.exe 31 PID 2512 wrote to memory of 2628 2512 htbhnh.exe 31 PID 2512 wrote to memory of 2628 2512 htbhnh.exe 31 PID 2628 wrote to memory of 2712 2628 pjvdp.exe 32 PID 2628 wrote to memory of 2712 2628 pjvdp.exe 32 PID 2628 wrote to memory of 2712 2628 pjvdp.exe 32 PID 2628 wrote to memory of 2712 2628 pjvdp.exe 32 PID 2712 wrote to memory of 2456 2712 7hbnbh.exe 33 PID 2712 wrote to memory of 2456 2712 7hbnbh.exe 33 PID 2712 wrote to memory of 2456 2712 7hbnbh.exe 33 PID 2712 wrote to memory of 2456 2712 7hbnbh.exe 33 PID 2456 wrote to memory of 2704 2456 nthttn.exe 34 PID 2456 wrote to memory of 2704 2456 nthttn.exe 34 PID 2456 wrote to memory of 2704 2456 nthttn.exe 34 PID 2456 wrote to memory of 2704 2456 nthttn.exe 34 PID 2704 wrote to memory of 2484 2704 lxlrxxr.exe 35 PID 2704 wrote to memory of 2484 2704 lxlrxxr.exe 35 PID 2704 wrote to memory of 2484 2704 lxlrxxr.exe 35 PID 2704 wrote to memory of 2484 2704 lxlrxxr.exe 35 PID 2484 wrote to memory of 3032 2484 7tbbhn.exe 36 PID 2484 wrote to memory of 3032 2484 7tbbhn.exe 36 PID 2484 wrote to memory of 3032 2484 7tbbhn.exe 36 PID 2484 wrote to memory of 3032 2484 7tbbhn.exe 36 PID 3032 wrote to memory of 1800 3032 pjjpj.exe 37 PID 3032 wrote to memory of 1800 3032 pjjpj.exe 37 PID 3032 wrote to memory of 1800 3032 pjjpj.exe 37 PID 3032 wrote to memory of 1800 3032 pjjpj.exe 37 PID 1800 wrote to memory of 2596 1800 ntbhtb.exe 38 PID 1800 wrote to memory of 2596 1800 ntbhtb.exe 38 PID 1800 wrote to memory of 2596 1800 ntbhtb.exe 38 PID 1800 wrote to memory of 2596 1800 ntbhtb.exe 38 PID 2596 wrote to memory of 1904 2596 1jppv.exe 39 PID 2596 wrote to memory of 1904 2596 1jppv.exe 39 PID 2596 wrote to memory of 1904 2596 1jppv.exe 39 PID 2596 wrote to memory of 1904 2596 1jppv.exe 39 PID 1904 wrote to memory of 2664 1904 rrxrflf.exe 40 PID 1904 wrote to memory of 2664 1904 rrxrflf.exe 40 PID 1904 wrote to memory of 2664 1904 rrxrflf.exe 40 PID 1904 wrote to memory of 2664 1904 rrxrflf.exe 40 PID 2664 wrote to memory of 1188 2664 nhbhtb.exe 41 PID 2664 wrote to memory of 1188 2664 nhbhtb.exe 41 PID 2664 wrote to memory of 1188 2664 nhbhtb.exe 41 PID 2664 wrote to memory of 1188 2664 nhbhtb.exe 41 PID 1188 wrote to memory of 2824 1188 thttnn.exe 42 PID 1188 wrote to memory of 2824 1188 thttnn.exe 42 PID 1188 wrote to memory of 2824 1188 thttnn.exe 42 PID 1188 wrote to memory of 2824 1188 thttnn.exe 42 PID 2824 wrote to memory of 1672 2824 fxrxxfx.exe 43 PID 2824 wrote to memory of 1672 2824 fxrxxfx.exe 43 PID 2824 wrote to memory of 1672 2824 fxrxxfx.exe 43 PID 2824 wrote to memory of 1672 2824 fxrxxfx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\211fdfa0c83483cf93bdc96aa7babdd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\211fdfa0c83483cf93bdc96aa7babdd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\bhnhbt.exec:\bhnhbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\dpdvd.exec:\dpdvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\htbhnh.exec:\htbhnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\pjvdp.exec:\pjvdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\7hbnbh.exec:\7hbnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\nthttn.exec:\nthttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\lxlrxxr.exec:\lxlrxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\7tbbhn.exec:\7tbbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\pjjpj.exec:\pjjpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\ntbhtb.exec:\ntbhtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\1jppv.exec:\1jppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\rrxrflf.exec:\rrxrflf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\nhbhtb.exec:\nhbhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\thttnn.exec:\thttnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\fxrxxfx.exec:\fxrxxfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\9hntbn.exec:\9hntbn.exe17⤵
- Executes dropped EXE
PID:1672 -
\??\c:\vjvdp.exec:\vjvdp.exe18⤵
- Executes dropped EXE
PID:1748 -
\??\c:\5ntnnh.exec:\5ntnnh.exe19⤵
- Executes dropped EXE
PID:2516 -
\??\c:\jvpdp.exec:\jvpdp.exe20⤵
- Executes dropped EXE
PID:1676 -
\??\c:\1dppv.exec:\1dppv.exe21⤵
- Executes dropped EXE
PID:1504 -
\??\c:\btbtbh.exec:\btbtbh.exe22⤵
- Executes dropped EXE
PID:1716 -
\??\c:\5hbhhn.exec:\5hbhhn.exe23⤵
- Executes dropped EXE
PID:996 -
\??\c:\9lrrxrx.exec:\9lrrxrx.exe24⤵
- Executes dropped EXE
PID:828 -
\??\c:\httthb.exec:\httthb.exe25⤵
- Executes dropped EXE
PID:600 -
\??\c:\9pjjj.exec:\9pjjj.exe26⤵
- Executes dropped EXE
PID:1032 -
\??\c:\1flxxxf.exec:\1flxxxf.exe27⤵
- Executes dropped EXE
PID:2236 -
\??\c:\5dvdj.exec:\5dvdj.exe28⤵
- Executes dropped EXE
PID:1060 -
\??\c:\rlxxffr.exec:\rlxxffr.exe29⤵
- Executes dropped EXE
PID:836 -
\??\c:\3htnhh.exec:\3htnhh.exe30⤵
- Executes dropped EXE
PID:1420 -
\??\c:\7dppv.exec:\7dppv.exe31⤵
- Executes dropped EXE
PID:2804 -
\??\c:\frrrlll.exec:\frrrlll.exe32⤵
- Executes dropped EXE
PID:1740 -
\??\c:\tthhnh.exec:\tthhnh.exe33⤵
- Executes dropped EXE
PID:1224 -
\??\c:\jdvvd.exec:\jdvvd.exe34⤵
- Executes dropped EXE
PID:1596 -
\??\c:\7rxllll.exec:\7rxllll.exe35⤵
- Executes dropped EXE
PID:2036 -
\??\c:\5llffxf.exec:\5llffxf.exe36⤵
- Executes dropped EXE
PID:2376 -
\??\c:\thtttt.exec:\thtttt.exe37⤵
- Executes dropped EXE
PID:3064 -
\??\c:\vjpjj.exec:\vjpjj.exe38⤵
- Executes dropped EXE
PID:2700 -
\??\c:\5pddp.exec:\5pddp.exe39⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xlxrxrf.exec:\xlxrxrf.exe40⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bntntn.exec:\bntntn.exe41⤵
- Executes dropped EXE
PID:2976 -
\??\c:\1hbhnt.exec:\1hbhnt.exe42⤵
- Executes dropped EXE
PID:2444 -
\??\c:\dpvvv.exec:\dpvvv.exe43⤵
- Executes dropped EXE
PID:2456 -
\??\c:\xrxrxxf.exec:\xrxrxxf.exe44⤵
- Executes dropped EXE
PID:2796 -
\??\c:\3lxxxfr.exec:\3lxxxfr.exe45⤵
- Executes dropped EXE
PID:2472 -
\??\c:\9htnnn.exec:\9htnnn.exe46⤵
- Executes dropped EXE
PID:1952 -
\??\c:\5djjj.exec:\5djjj.exe47⤵
- Executes dropped EXE
PID:2372 -
\??\c:\ddvjd.exec:\ddvjd.exe48⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rfffxrx.exec:\rfffxrx.exe49⤵
- Executes dropped EXE
PID:1064 -
\??\c:\7xxrrrr.exec:\7xxrrrr.exe50⤵
- Executes dropped EXE
PID:2608 -
\??\c:\3bnntt.exec:\3bnntt.exe51⤵
- Executes dropped EXE
PID:2408 -
\??\c:\dvdpp.exec:\dvdpp.exe52⤵
- Executes dropped EXE
PID:2656 -
\??\c:\5rfffxr.exec:\5rfffxr.exe53⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3flffxf.exec:\3flffxf.exe54⤵
- Executes dropped EXE
PID:796 -
\??\c:\nhnntn.exec:\nhnntn.exe55⤵
- Executes dropped EXE
PID:1752 -
\??\c:\nnbttn.exec:\nnbttn.exe56⤵
- Executes dropped EXE
PID:2972 -
\??\c:\7vvpp.exec:\7vvpp.exe57⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe58⤵
- Executes dropped EXE
PID:2260 -
\??\c:\bntbbb.exec:\bntbbb.exe59⤵
- Executes dropped EXE
PID:2252 -
\??\c:\9thbnn.exec:\9thbnn.exe60⤵
- Executes dropped EXE
PID:660 -
\??\c:\dpdjp.exec:\dpdjp.exe61⤵
- Executes dropped EXE
PID:536 -
\??\c:\vpdjp.exec:\vpdjp.exe62⤵
- Executes dropped EXE
PID:1268 -
\??\c:\xrfrxrf.exec:\xrfrxrf.exe63⤵
- Executes dropped EXE
PID:348 -
\??\c:\tntttt.exec:\tntttt.exe64⤵
- Executes dropped EXE
PID:1104 -
\??\c:\thtnhh.exec:\thtnhh.exe65⤵
- Executes dropped EXE
PID:1964 -
\??\c:\dpvvp.exec:\dpvvp.exe66⤵PID:1960
-
\??\c:\xrllllr.exec:\xrllllr.exe67⤵PID:1956
-
\??\c:\9rxxxrx.exec:\9rxxxrx.exe68⤵PID:2068
-
\??\c:\5tbnhb.exec:\5tbnhb.exe69⤵PID:2912
-
\??\c:\jvjdd.exec:\jvjdd.exe70⤵PID:836
-
\??\c:\dvpvd.exec:\dvpvd.exe71⤵PID:1624
-
\??\c:\lxllrll.exec:\lxllrll.exe72⤵PID:2932
-
\??\c:\rrffllr.exec:\rrffllr.exe73⤵PID:1736
-
\??\c:\nbnttt.exec:\nbnttt.exe74⤵PID:2032
-
\??\c:\9vvvd.exec:\9vvvd.exe75⤵PID:2144
-
\??\c:\rfrllfr.exec:\rfrllfr.exe76⤵PID:1592
-
\??\c:\3rlfxrr.exec:\3rlfxrr.exe77⤵PID:2172
-
\??\c:\hbtnbb.exec:\hbtnbb.exe78⤵PID:2376
-
\??\c:\dpvpp.exec:\dpvpp.exe79⤵PID:2528
-
\??\c:\jdddj.exec:\jdddj.exe80⤵PID:2888
-
\??\c:\xrlfllx.exec:\xrlfllx.exe81⤵PID:2732
-
\??\c:\tnhthn.exec:\tnhthn.exe82⤵PID:2428
-
\??\c:\7jddj.exec:\7jddj.exe83⤵PID:2520
-
\??\c:\vpjjp.exec:\vpjjp.exe84⤵PID:2444
-
\??\c:\7rlllff.exec:\7rlllff.exe85⤵PID:2792
-
\??\c:\tnbbbn.exec:\tnbbbn.exe86⤵PID:2492
-
\??\c:\ttnntt.exec:\ttnntt.exe87⤵PID:2968
-
\??\c:\pjjjp.exec:\pjjjp.exe88⤵PID:1952
-
\??\c:\9lxrxrx.exec:\9lxrxrx.exe89⤵PID:1768
-
\??\c:\7tnbbh.exec:\7tnbbh.exe90⤵PID:1652
-
\??\c:\btbhtt.exec:\btbhtt.exe91⤵PID:1196
-
\??\c:\pvppv.exec:\pvppv.exe92⤵PID:1884
-
\??\c:\fxlfflr.exec:\fxlfflr.exe93⤵PID:1076
-
\??\c:\tbbhnn.exec:\tbbhnn.exe94⤵PID:2776
-
\??\c:\btnthh.exec:\btnthh.exe95⤵PID:2396
-
\??\c:\1pjjp.exec:\1pjjp.exe96⤵PID:496
-
\??\c:\7flllll.exec:\7flllll.exe97⤵PID:800
-
\??\c:\3rflffr.exec:\3rflffr.exe98⤵PID:1580
-
\??\c:\btnntt.exec:\btnntt.exe99⤵PID:2368
-
\??\c:\vpjpd.exec:\vpjpd.exe100⤵PID:1404
-
\??\c:\7rfxlll.exec:\7rfxlll.exe101⤵PID:2268
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe102⤵PID:1160
-
\??\c:\nnbhnt.exec:\nnbhnt.exe103⤵PID:1716
-
\??\c:\jjdpd.exec:\jjdpd.exe104⤵PID:828
-
\??\c:\vjvpd.exec:\vjvpd.exe105⤵PID:348
-
\??\c:\1fllrxf.exec:\1fllrxf.exe106⤵PID:1992
-
\??\c:\frfflfl.exec:\frfflfl.exe107⤵PID:600
-
\??\c:\htnttb.exec:\htnttb.exe108⤵PID:1960
-
\??\c:\vpvvd.exec:\vpvvd.exe109⤵PID:1956
-
\??\c:\7xlrflx.exec:\7xlrflx.exe110⤵PID:2068
-
\??\c:\3lrxllr.exec:\3lrxllr.exe111⤵PID:2844
-
\??\c:\bthntb.exec:\bthntb.exe112⤵PID:2940
-
\??\c:\vjppp.exec:\vjppp.exe113⤵PID:1636
-
\??\c:\vpdjp.exec:\vpdjp.exe114⤵PID:3052
-
\??\c:\rxrrfxl.exec:\rxrrfxl.exe115⤵PID:1632
-
\??\c:\nnbhnt.exec:\nnbhnt.exe116⤵PID:2152
-
\??\c:\3pdvd.exec:\3pdvd.exe117⤵PID:1560
-
\??\c:\7vddd.exec:\7vddd.exe118⤵PID:1596
-
\??\c:\xrfxffl.exec:\xrfxffl.exe119⤵PID:2524
-
\??\c:\5hhbtn.exec:\5hhbtn.exe120⤵PID:2624
-
\??\c:\nnhnbt.exec:\nnhnbt.exe121⤵PID:2636
-
\??\c:\5dvdv.exec:\5dvdv.exe122⤵PID:3048
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-