Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 13:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bad63e165ca675f8be030d2f80421590_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
bad63e165ca675f8be030d2f80421590_NeikiAnalytics.exe
-
Size
140KB
-
MD5
bad63e165ca675f8be030d2f80421590
-
SHA1
a90ca820a0a9fe05ba08fbde89c9a5d31eba965e
-
SHA256
5bb2ac9cfd8feada0578bc6c86c46fe3c7f09693b92b8b1fd840f8d28794307f
-
SHA512
f48bab96b16de7cc85c08e6189c2964860fe9c131b03b10de7fc0e6e74a5178a4e8750280c59055f026b2eb11ed5a4562c818640abbb6276e3a2b9b2a25d3991
-
SSDEEP
3072:ymb3NkkiQ3mdBjFomR7UsyJC+n0Gsgyek1D:n3C9BRomRph+0GsgyeYD
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/1508-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-59-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1432-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1008-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1172-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1408-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2636 jdddv.exe 2572 5rffffr.exe 2780 bnhnnt.exe 2732 9pjjd.exe 2600 1jvdj.exe 2480 lllffrr.exe 2148 nnbbhb.exe 2856 nbhnnn.exe 1032 vpdpv.exe 2672 3rflrlr.exe 2016 nhhbnh.exe 2352 nbtbhn.exe 2040 9dppp.exe 1432 jpvvv.exe 1008 3lfllrf.exe 1932 htnhhn.exe 1172 7hbbhh.exe 1412 dvjjv.exe 1704 1lrxfxf.exe 2512 1frxfrx.exe 324 9hbhhb.exe 1408 5dvvd.exe 1400 xrlfllx.exe 2288 htttht.exe 2100 1bbnhh.exe 1896 pdvjp.exe 852 xlxrflf.exe 2292 nhtnnh.exe 2296 dvvvv.exe 2200 fxllrxx.exe 896 xlxrrxr.exe 2504 bhbhht.exe 2916 pddjv.exe 2928 jddjd.exe 2628 frrfflx.exe 2576 tnnnbh.exe 2772 tnbntb.exe 2556 dpjjd.exe 2540 vdjpp.exe 2420 vvjjd.exe 2440 lfxfffr.exe 3048 1fffrrf.exe 1576 ntbntt.exe 1628 bnbhtt.exe 2492 pvdjd.exe 1352 xlxxrxf.exe 2672 lrllfrr.exe 1960 hbntbb.exe 2028 nnbnnb.exe 2020 dppvp.exe 352 vvvvj.exe 2120 fxrrrrx.exe 752 flxlffr.exe 620 bbhthh.exe 2088 dvjjv.exe 2208 vdvdv.exe 2084 9xxxxlr.exe 1260 5fxxxfr.exe 2228 7nhtbh.exe 948 tbbntn.exe 1548 dvpvj.exe 1800 3vddj.exe 1128 5xxlxlr.exe 912 fxlxfrx.exe -
resource yara_rule behavioral1/memory/1508-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1432-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1008-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1172-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1408-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-289-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2636 1508 bad63e165ca675f8be030d2f80421590_NeikiAnalytics.exe 28 PID 1508 wrote to memory of 2636 1508 bad63e165ca675f8be030d2f80421590_NeikiAnalytics.exe 28 PID 1508 wrote to memory of 2636 1508 bad63e165ca675f8be030d2f80421590_NeikiAnalytics.exe 28 PID 1508 wrote to memory of 2636 1508 bad63e165ca675f8be030d2f80421590_NeikiAnalytics.exe 28 PID 2636 wrote to memory of 2572 2636 jdddv.exe 29 PID 2636 wrote to memory of 2572 2636 jdddv.exe 29 PID 2636 wrote to memory of 2572 2636 jdddv.exe 29 PID 2636 wrote to memory of 2572 2636 jdddv.exe 29 PID 2572 wrote to memory of 2780 2572 5rffffr.exe 30 PID 2572 wrote to memory of 2780 2572 5rffffr.exe 30 PID 2572 wrote to memory of 2780 2572 5rffffr.exe 30 PID 2572 wrote to memory of 2780 2572 5rffffr.exe 30 PID 2780 wrote to memory of 2732 2780 bnhnnt.exe 31 PID 2780 wrote to memory of 2732 2780 bnhnnt.exe 31 PID 2780 wrote to memory of 2732 2780 bnhnnt.exe 31 PID 2780 wrote to memory of 2732 2780 bnhnnt.exe 31 PID 2732 wrote to memory of 2600 2732 9pjjd.exe 32 PID 2732 wrote to memory of 2600 2732 9pjjd.exe 32 PID 2732 wrote to memory of 2600 2732 9pjjd.exe 32 PID 2732 wrote to memory of 2600 2732 9pjjd.exe 32 PID 2600 wrote to memory of 2480 2600 1jvdj.exe 33 PID 2600 wrote to memory of 2480 2600 1jvdj.exe 33 PID 2600 wrote to memory of 2480 2600 1jvdj.exe 33 PID 2600 wrote to memory of 2480 2600 1jvdj.exe 33 PID 2480 wrote to memory of 2148 2480 lllffrr.exe 34 PID 2480 wrote to memory of 2148 2480 lllffrr.exe 34 PID 2480 wrote to memory of 2148 2480 lllffrr.exe 34 PID 2480 wrote to memory of 2148 2480 lllffrr.exe 34 PID 2148 wrote to memory of 2856 2148 nnbbhb.exe 35 PID 2148 wrote to memory of 2856 2148 nnbbhb.exe 35 PID 2148 wrote to memory of 2856 2148 nnbbhb.exe 35 PID 2148 wrote to memory of 2856 2148 nnbbhb.exe 35 PID 2856 wrote to memory of 1032 2856 nbhnnn.exe 36 PID 2856 wrote to memory of 1032 2856 nbhnnn.exe 36 PID 2856 wrote to memory of 1032 2856 nbhnnn.exe 36 PID 2856 wrote to memory of 1032 2856 nbhnnn.exe 36 PID 1032 wrote to memory of 2672 1032 vpdpv.exe 37 PID 1032 wrote to memory of 2672 1032 vpdpv.exe 37 PID 1032 wrote to memory of 2672 1032 vpdpv.exe 37 PID 1032 wrote to memory of 2672 1032 vpdpv.exe 37 PID 2672 wrote to memory of 2016 2672 3rflrlr.exe 38 PID 2672 wrote to memory of 2016 2672 3rflrlr.exe 38 PID 2672 wrote to memory of 2016 2672 3rflrlr.exe 38 PID 2672 wrote to memory of 2016 2672 3rflrlr.exe 38 PID 2016 wrote to memory of 2352 2016 nhhbnh.exe 39 PID 2016 wrote to memory of 2352 2016 nhhbnh.exe 39 PID 2016 wrote to memory of 2352 2016 nhhbnh.exe 39 PID 2016 wrote to memory of 2352 2016 nhhbnh.exe 39 PID 2352 wrote to memory of 2040 2352 nbtbhn.exe 40 PID 2352 wrote to memory of 2040 2352 nbtbhn.exe 40 PID 2352 wrote to memory of 2040 2352 nbtbhn.exe 40 PID 2352 wrote to memory of 2040 2352 nbtbhn.exe 40 PID 2040 wrote to memory of 1432 2040 9dppp.exe 41 PID 2040 wrote to memory of 1432 2040 9dppp.exe 41 PID 2040 wrote to memory of 1432 2040 9dppp.exe 41 PID 2040 wrote to memory of 1432 2040 9dppp.exe 41 PID 1432 wrote to memory of 1008 1432 jpvvv.exe 42 PID 1432 wrote to memory of 1008 1432 jpvvv.exe 42 PID 1432 wrote to memory of 1008 1432 jpvvv.exe 42 PID 1432 wrote to memory of 1008 1432 jpvvv.exe 42 PID 1008 wrote to memory of 1932 1008 3lfllrf.exe 43 PID 1008 wrote to memory of 1932 1008 3lfllrf.exe 43 PID 1008 wrote to memory of 1932 1008 3lfllrf.exe 43 PID 1008 wrote to memory of 1932 1008 3lfllrf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\bad63e165ca675f8be030d2f80421590_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bad63e165ca675f8be030d2f80421590_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\jdddv.exec:\jdddv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\5rffffr.exec:\5rffffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\bnhnnt.exec:\bnhnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\9pjjd.exec:\9pjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\1jvdj.exec:\1jvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\lllffrr.exec:\lllffrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\nnbbhb.exec:\nnbbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\nbhnnn.exec:\nbhnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\vpdpv.exec:\vpdpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\3rflrlr.exec:\3rflrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\nhhbnh.exec:\nhhbnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\nbtbhn.exec:\nbtbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\9dppp.exec:\9dppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\jpvvv.exec:\jpvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\3lfllrf.exec:\3lfllrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\htnhhn.exec:\htnhhn.exe17⤵
- Executes dropped EXE
PID:1932 -
\??\c:\7hbbhh.exec:\7hbbhh.exe18⤵
- Executes dropped EXE
PID:1172 -
\??\c:\dvjjv.exec:\dvjjv.exe19⤵
- Executes dropped EXE
PID:1412 -
\??\c:\1lrxfxf.exec:\1lrxfxf.exe20⤵
- Executes dropped EXE
PID:1704 -
\??\c:\1frxfrx.exec:\1frxfrx.exe21⤵
- Executes dropped EXE
PID:2512 -
\??\c:\9hbhhb.exec:\9hbhhb.exe22⤵
- Executes dropped EXE
PID:324 -
\??\c:\5dvvd.exec:\5dvvd.exe23⤵
- Executes dropped EXE
PID:1408 -
\??\c:\xrlfllx.exec:\xrlfllx.exe24⤵
- Executes dropped EXE
PID:1400 -
\??\c:\htttht.exec:\htttht.exe25⤵
- Executes dropped EXE
PID:2288 -
\??\c:\1bbnhh.exec:\1bbnhh.exe26⤵
- Executes dropped EXE
PID:2100 -
\??\c:\pdvjp.exec:\pdvjp.exe27⤵
- Executes dropped EXE
PID:1896 -
\??\c:\xlxrflf.exec:\xlxrflf.exe28⤵
- Executes dropped EXE
PID:852 -
\??\c:\nhtnnh.exec:\nhtnnh.exe29⤵
- Executes dropped EXE
PID:2292 -
\??\c:\dvvvv.exec:\dvvvv.exe30⤵
- Executes dropped EXE
PID:2296 -
\??\c:\fxllrxx.exec:\fxllrxx.exe31⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xlxrrxr.exec:\xlxrrxr.exe32⤵
- Executes dropped EXE
PID:896 -
\??\c:\bhbhht.exec:\bhbhht.exe33⤵
- Executes dropped EXE
PID:2504 -
\??\c:\pddjv.exec:\pddjv.exe34⤵
- Executes dropped EXE
PID:2916 -
\??\c:\jddjd.exec:\jddjd.exe35⤵
- Executes dropped EXE
PID:2928 -
\??\c:\frrfflx.exec:\frrfflx.exe36⤵
- Executes dropped EXE
PID:2628 -
\??\c:\tnnnbh.exec:\tnnnbh.exe37⤵
- Executes dropped EXE
PID:2576 -
\??\c:\tnbntb.exec:\tnbntb.exe38⤵
- Executes dropped EXE
PID:2772 -
\??\c:\dpjjd.exec:\dpjjd.exe39⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vdjpp.exec:\vdjpp.exe40⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vvjjd.exec:\vvjjd.exe41⤵
- Executes dropped EXE
PID:2420 -
\??\c:\lfxfffr.exec:\lfxfffr.exe42⤵
- Executes dropped EXE
PID:2440 -
\??\c:\1fffrrf.exec:\1fffrrf.exe43⤵
- Executes dropped EXE
PID:3048 -
\??\c:\ntbntt.exec:\ntbntt.exe44⤵
- Executes dropped EXE
PID:1576 -
\??\c:\bnbhtt.exec:\bnbhtt.exe45⤵
- Executes dropped EXE
PID:1628 -
\??\c:\pvdjd.exec:\pvdjd.exe46⤵
- Executes dropped EXE
PID:2492 -
\??\c:\xlxxrxf.exec:\xlxxrxf.exe47⤵
- Executes dropped EXE
PID:1352 -
\??\c:\lrllfrr.exec:\lrllfrr.exe48⤵
- Executes dropped EXE
PID:2672 -
\??\c:\hbntbb.exec:\hbntbb.exe49⤵
- Executes dropped EXE
PID:1960 -
\??\c:\nnbnnb.exec:\nnbnnb.exe50⤵
- Executes dropped EXE
PID:2028 -
\??\c:\dppvp.exec:\dppvp.exe51⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vvvvj.exec:\vvvvj.exe52⤵
- Executes dropped EXE
PID:352 -
\??\c:\fxrrrrx.exec:\fxrrrrx.exe53⤵
- Executes dropped EXE
PID:2120 -
\??\c:\flxlffr.exec:\flxlffr.exe54⤵
- Executes dropped EXE
PID:752 -
\??\c:\bbhthh.exec:\bbhthh.exe55⤵
- Executes dropped EXE
PID:620 -
\??\c:\dvjjv.exec:\dvjjv.exe56⤵
- Executes dropped EXE
PID:2088 -
\??\c:\vdvdv.exec:\vdvdv.exe57⤵
- Executes dropped EXE
PID:2208 -
\??\c:\9xxxxlr.exec:\9xxxxlr.exe58⤵
- Executes dropped EXE
PID:2084 -
\??\c:\5fxxxfr.exec:\5fxxxfr.exe59⤵
- Executes dropped EXE
PID:1260 -
\??\c:\7nhtbh.exec:\7nhtbh.exe60⤵
- Executes dropped EXE
PID:2228 -
\??\c:\tbbntn.exec:\tbbntn.exe61⤵
- Executes dropped EXE
PID:948 -
\??\c:\dvpvj.exec:\dvpvj.exe62⤵
- Executes dropped EXE
PID:1548 -
\??\c:\3vddj.exec:\3vddj.exe63⤵
- Executes dropped EXE
PID:1800 -
\??\c:\5xxlxlr.exec:\5xxlxlr.exe64⤵
- Executes dropped EXE
PID:1128 -
\??\c:\fxlxfrx.exec:\fxlxfrx.exe65⤵
- Executes dropped EXE
PID:912 -
\??\c:\nhbnbb.exec:\nhbnbb.exe66⤵PID:2100
-
\??\c:\httbhh.exec:\httbhh.exe67⤵PID:904
-
\??\c:\1vppv.exec:\1vppv.exe68⤵PID:2964
-
\??\c:\djjdj.exec:\djjdj.exe69⤵PID:2380
-
\??\c:\3lxxlrl.exec:\3lxxlrl.exe70⤵PID:2292
-
\??\c:\ttnhnb.exec:\ttnhnb.exe71⤵PID:1612
-
\??\c:\nhbnbb.exec:\nhbnbb.exe72⤵PID:1948
-
\??\c:\ddpdp.exec:\ddpdp.exe73⤵PID:3052
-
\??\c:\fllxlrl.exec:\fllxlrl.exe74⤵PID:1632
-
\??\c:\lxflrrr.exec:\lxflrrr.exe75⤵PID:2504
-
\??\c:\hbtntt.exec:\hbtntt.exe76⤵PID:2972
-
\??\c:\hbhhhh.exec:\hbhhhh.exe77⤵PID:2924
-
\??\c:\7jvjv.exec:\7jvjv.exe78⤵PID:2552
-
\??\c:\3dppp.exec:\3dppp.exe79⤵PID:2616
-
\??\c:\7lfrflx.exec:\7lfrflx.exe80⤵PID:2584
-
\??\c:\tnttbh.exec:\tnttbh.exe81⤵PID:2524
-
\??\c:\hhbhbh.exec:\hhbhbh.exe82⤵PID:2424
-
\??\c:\1dpvv.exec:\1dpvv.exe83⤵PID:2144
-
\??\c:\dvjvp.exec:\dvjvp.exe84⤵PID:2444
-
\??\c:\lfffffl.exec:\lfffffl.exe85⤵PID:2148
-
\??\c:\7xfrfxl.exec:\7xfrfxl.exe86⤵PID:1844
-
\??\c:\tnnbbh.exec:\tnnbbh.exe87⤵PID:2596
-
\??\c:\vvvjv.exec:\vvvjv.exe88⤵PID:2492
-
\??\c:\dpvpj.exec:\dpvpj.exe89⤵PID:2308
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe90⤵PID:1864
-
\??\c:\nbhnbb.exec:\nbhnbb.exe91⤵PID:1888
-
\??\c:\btttth.exec:\btttth.exe92⤵PID:2012
-
\??\c:\5dpdp.exec:\5dpdp.exe93⤵PID:988
-
\??\c:\xxflfrl.exec:\xxflfrl.exe94⤵PID:1676
-
\??\c:\1rxxffl.exec:\1rxxffl.exe95⤵PID:328
-
\??\c:\7hbttb.exec:\7hbttb.exe96⤵PID:2992
-
\??\c:\dvjvj.exec:\dvjvj.exe97⤵PID:620
-
\??\c:\1jppd.exec:\1jppd.exe98⤵PID:2236
-
\??\c:\lffrfrf.exec:\lffrfrf.exe99⤵PID:2520
-
\??\c:\bttbnt.exec:\bttbnt.exe100⤵PID:2252
-
\??\c:\thbhnt.exec:\thbhnt.exe101⤵PID:2248
-
\??\c:\vvvjj.exec:\vvvjj.exe102⤵PID:676
-
\??\c:\xrrxffr.exec:\xrrxffr.exe103⤵PID:2872
-
\??\c:\lflxllf.exec:\lflxllf.exe104⤵PID:1396
-
\??\c:\bntbtb.exec:\bntbtb.exe105⤵PID:1400
-
\??\c:\tnbhhh.exec:\tnbhhh.exe106⤵PID:1128
-
\??\c:\jdpdd.exec:\jdpdd.exe107⤵PID:1900
-
\??\c:\jdpvp.exec:\jdpvp.exe108⤵PID:1532
-
\??\c:\llfrflx.exec:\llfrflx.exe109⤵PID:932
-
\??\c:\nhttnt.exec:\nhttnt.exe110⤵PID:2108
-
\??\c:\hthnbh.exec:\hthnbh.exe111⤵PID:3028
-
\??\c:\vddjv.exec:\vddjv.exe112⤵PID:1540
-
\??\c:\xrlflxf.exec:\xrlflxf.exe113⤵PID:884
-
\??\c:\frxrxxl.exec:\frxrxxl.exe114⤵PID:2080
-
\??\c:\nnbnhn.exec:\nnbnhn.exe115⤵PID:356
-
\??\c:\djvpv.exec:\djvpv.exe116⤵PID:1596
-
\??\c:\djvjd.exec:\djvjd.exe117⤵PID:2916
-
\??\c:\5flrrxl.exec:\5flrrxl.exe118⤵PID:2972
-
\??\c:\hbtthn.exec:\hbtthn.exe119⤵PID:2628
-
\??\c:\rfxxllr.exec:\rfxxllr.exe120⤵PID:2576
-
\??\c:\fxfrxfl.exec:\fxfrxfl.exe121⤵PID:2640
-
\??\c:\btntnn.exec:\btntnn.exe122⤵PID:2584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-