Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 22:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3bba46ae74145985f6dbdd6f15dc4fc0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
3bba46ae74145985f6dbdd6f15dc4fc0_NeikiAnalytics.exe
-
Size
492KB
-
MD5
3bba46ae74145985f6dbdd6f15dc4fc0
-
SHA1
e90e93452cd80b2932eec666f30da5341354165f
-
SHA256
705588bb761a841f1c2759bcb821cccdd35fb32b5ac8a827cba6e7475eea54a6
-
SHA512
4103bb630a48555a974a3a88123bbde5e7bf80589fe59aa0ace5af6595c1312ec788ca433d465fee9935c9faf1b26c790919bfa212eadc40f238486e96e849f3
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq78yoyfx93svqTbWL5wEpOQ9DRRi:n3C9yMo+S0L9xRnoq7H9QYcmeN9D6
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/856-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-60-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1372-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/276-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 872 dtttld.exe 2864 flnhn.exe 2572 phpfhl.exe 2576 phfxtt.exe 2156 hddxjxb.exe 2732 pxtdv.exe 2480 fhhdnfl.exe 2488 ltdxlx.exe 2172 jnjvn.exe 1736 fbbrhrx.exe 836 bvbpbtp.exe 2716 pvlvp.exe 2860 rtdbrfr.exe 1372 fdhhf.exe 1976 nfbxp.exe 2000 hblfrjt.exe 2184 pblll.exe 2220 hjjld.exe 1756 bxvll.exe 2280 bttbddd.exe 324 fpjttr.exe 592 vdrxrh.exe 1712 nbjhj.exe 276 htdrlnl.exe 2972 nphnjvf.exe 1960 htnph.exe 1884 bvbfrj.exe 2992 bbtfp.exe 908 fnrpv.exe 1544 htnhj.exe 2968 vrnrxph.exe 1708 fpxdl.exe 1600 jpdhvhl.exe 1408 hrvbrp.exe 1672 rlnblx.exe 1640 hpfvr.exe 2916 tjvjld.exe 2632 prvpdnx.exe 2572 pxtdhjf.exe 2576 xpxnn.exe 2704 ttjvh.exe 2828 xpnbbl.exe 2424 hrnnjph.exe 2420 bfffdtn.exe 2836 pfjxv.exe 2012 prfhn.exe 572 jbdjppf.exe 1748 rrndl.exe 2708 btjrhnl.exe 2712 pdfpb.exe 2236 nnrpjp.exe 2212 htfpdbd.exe 1372 tpvftrv.exe 2232 bjvrxvn.exe 2256 nthnl.exe 768 llpjrhj.exe 2184 xpntbtx.exe 1620 jbjvvvv.exe 2304 xfdbfvn.exe 2108 tphffnp.exe 336 fvbpj.exe 2292 vddvxr.exe 2772 hxfxfhv.exe 2316 tjnjrd.exe -
resource yara_rule behavioral1/memory/856-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1372-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/276-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 856 wrote to memory of 872 856 3bba46ae74145985f6dbdd6f15dc4fc0_NeikiAnalytics.exe 28 PID 856 wrote to memory of 872 856 3bba46ae74145985f6dbdd6f15dc4fc0_NeikiAnalytics.exe 28 PID 856 wrote to memory of 872 856 3bba46ae74145985f6dbdd6f15dc4fc0_NeikiAnalytics.exe 28 PID 856 wrote to memory of 872 856 3bba46ae74145985f6dbdd6f15dc4fc0_NeikiAnalytics.exe 28 PID 872 wrote to memory of 2864 872 dtttld.exe 29 PID 872 wrote to memory of 2864 872 dtttld.exe 29 PID 872 wrote to memory of 2864 872 dtttld.exe 29 PID 872 wrote to memory of 2864 872 dtttld.exe 29 PID 2864 wrote to memory of 2572 2864 flnhn.exe 30 PID 2864 wrote to memory of 2572 2864 flnhn.exe 30 PID 2864 wrote to memory of 2572 2864 flnhn.exe 30 PID 2864 wrote to memory of 2572 2864 flnhn.exe 30 PID 2572 wrote to memory of 2576 2572 phpfhl.exe 31 PID 2572 wrote to memory of 2576 2572 phpfhl.exe 31 PID 2572 wrote to memory of 2576 2572 phpfhl.exe 31 PID 2572 wrote to memory of 2576 2572 phpfhl.exe 31 PID 2576 wrote to memory of 2156 2576 phfxtt.exe 32 PID 2576 wrote to memory of 2156 2576 phfxtt.exe 32 PID 2576 wrote to memory of 2156 2576 phfxtt.exe 32 PID 2576 wrote to memory of 2156 2576 phfxtt.exe 32 PID 2156 wrote to memory of 2732 2156 hddxjxb.exe 33 PID 2156 wrote to memory of 2732 2156 hddxjxb.exe 33 PID 2156 wrote to memory of 2732 2156 hddxjxb.exe 33 PID 2156 wrote to memory of 2732 2156 hddxjxb.exe 33 PID 2732 wrote to memory of 2480 2732 pxtdv.exe 34 PID 2732 wrote to memory of 2480 2732 pxtdv.exe 34 PID 2732 wrote to memory of 2480 2732 pxtdv.exe 34 PID 2732 wrote to memory of 2480 2732 pxtdv.exe 34 PID 2480 wrote to memory of 2488 2480 fhhdnfl.exe 35 PID 2480 wrote to memory of 2488 2480 fhhdnfl.exe 35 PID 2480 wrote to memory of 2488 2480 fhhdnfl.exe 35 PID 2480 wrote to memory of 2488 2480 fhhdnfl.exe 35 PID 2488 wrote to memory of 2172 2488 ltdxlx.exe 36 PID 2488 wrote to memory of 2172 2488 ltdxlx.exe 36 PID 2488 wrote to memory of 2172 2488 ltdxlx.exe 36 PID 2488 wrote to memory of 2172 2488 ltdxlx.exe 36 PID 2172 wrote to memory of 1736 2172 jnjvn.exe 37 PID 2172 wrote to memory of 1736 2172 jnjvn.exe 37 PID 2172 wrote to memory of 1736 2172 jnjvn.exe 37 PID 2172 wrote to memory of 1736 2172 jnjvn.exe 37 PID 1736 wrote to memory of 836 1736 fbbrhrx.exe 38 PID 1736 wrote to memory of 836 1736 fbbrhrx.exe 38 PID 1736 wrote to memory of 836 1736 fbbrhrx.exe 38 PID 1736 wrote to memory of 836 1736 fbbrhrx.exe 38 PID 836 wrote to memory of 2716 836 bvbpbtp.exe 39 PID 836 wrote to memory of 2716 836 bvbpbtp.exe 39 PID 836 wrote to memory of 2716 836 bvbpbtp.exe 39 PID 836 wrote to memory of 2716 836 bvbpbtp.exe 39 PID 2716 wrote to memory of 2860 2716 pvlvp.exe 40 PID 2716 wrote to memory of 2860 2716 pvlvp.exe 40 PID 2716 wrote to memory of 2860 2716 pvlvp.exe 40 PID 2716 wrote to memory of 2860 2716 pvlvp.exe 40 PID 2860 wrote to memory of 1372 2860 rtdbrfr.exe 41 PID 2860 wrote to memory of 1372 2860 rtdbrfr.exe 41 PID 2860 wrote to memory of 1372 2860 rtdbrfr.exe 41 PID 2860 wrote to memory of 1372 2860 rtdbrfr.exe 41 PID 1372 wrote to memory of 1976 1372 fdhhf.exe 42 PID 1372 wrote to memory of 1976 1372 fdhhf.exe 42 PID 1372 wrote to memory of 1976 1372 fdhhf.exe 42 PID 1372 wrote to memory of 1976 1372 fdhhf.exe 42 PID 1976 wrote to memory of 2000 1976 nfbxp.exe 43 PID 1976 wrote to memory of 2000 1976 nfbxp.exe 43 PID 1976 wrote to memory of 2000 1976 nfbxp.exe 43 PID 1976 wrote to memory of 2000 1976 nfbxp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bba46ae74145985f6dbdd6f15dc4fc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bba46ae74145985f6dbdd6f15dc4fc0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\dtttld.exec:\dtttld.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\flnhn.exec:\flnhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\phpfhl.exec:\phpfhl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\phfxtt.exec:\phfxtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\hddxjxb.exec:\hddxjxb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\pxtdv.exec:\pxtdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\fhhdnfl.exec:\fhhdnfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\ltdxlx.exec:\ltdxlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\jnjvn.exec:\jnjvn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\fbbrhrx.exec:\fbbrhrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\bvbpbtp.exec:\bvbpbtp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\pvlvp.exec:\pvlvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\rtdbrfr.exec:\rtdbrfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\fdhhf.exec:\fdhhf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\nfbxp.exec:\nfbxp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\hblfrjt.exec:\hblfrjt.exe17⤵
- Executes dropped EXE
PID:2000 -
\??\c:\pblll.exec:\pblll.exe18⤵
- Executes dropped EXE
PID:2184 -
\??\c:\hjjld.exec:\hjjld.exe19⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bxvll.exec:\bxvll.exe20⤵
- Executes dropped EXE
PID:1756 -
\??\c:\bttbddd.exec:\bttbddd.exe21⤵
- Executes dropped EXE
PID:2280 -
\??\c:\fpjttr.exec:\fpjttr.exe22⤵
- Executes dropped EXE
PID:324 -
\??\c:\vdrxrh.exec:\vdrxrh.exe23⤵
- Executes dropped EXE
PID:592 -
\??\c:\nbjhj.exec:\nbjhj.exe24⤵
- Executes dropped EXE
PID:1712 -
\??\c:\htdrlnl.exec:\htdrlnl.exe25⤵
- Executes dropped EXE
PID:276 -
\??\c:\nphnjvf.exec:\nphnjvf.exe26⤵
- Executes dropped EXE
PID:2972 -
\??\c:\htnph.exec:\htnph.exe27⤵
- Executes dropped EXE
PID:1960 -
\??\c:\bvbfrj.exec:\bvbfrj.exe28⤵
- Executes dropped EXE
PID:1884 -
\??\c:\bbtfp.exec:\bbtfp.exe29⤵
- Executes dropped EXE
PID:2992 -
\??\c:\fnrpv.exec:\fnrpv.exe30⤵
- Executes dropped EXE
PID:908 -
\??\c:\htnhj.exec:\htnhj.exe31⤵
- Executes dropped EXE
PID:1544 -
\??\c:\vrnrxph.exec:\vrnrxph.exe32⤵
- Executes dropped EXE
PID:2968 -
\??\c:\fpxdl.exec:\fpxdl.exe33⤵
- Executes dropped EXE
PID:1708 -
\??\c:\jpdhvhl.exec:\jpdhvhl.exe34⤵
- Executes dropped EXE
PID:1600 -
\??\c:\hrvbrp.exec:\hrvbrp.exe35⤵
- Executes dropped EXE
PID:1408 -
\??\c:\tfjrdx.exec:\tfjrdx.exe36⤵PID:2116
-
\??\c:\rlnblx.exec:\rlnblx.exe37⤵
- Executes dropped EXE
PID:1672 -
\??\c:\hpfvr.exec:\hpfvr.exe38⤵
- Executes dropped EXE
PID:1640 -
\??\c:\tjvjld.exec:\tjvjld.exe39⤵
- Executes dropped EXE
PID:2916 -
\??\c:\prvpdnx.exec:\prvpdnx.exe40⤵
- Executes dropped EXE
PID:2632 -
\??\c:\pxtdhjf.exec:\pxtdhjf.exe41⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xpxnn.exec:\xpxnn.exe42⤵
- Executes dropped EXE
PID:2576 -
\??\c:\ttjvh.exec:\ttjvh.exe43⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xpnbbl.exec:\xpnbbl.exe44⤵
- Executes dropped EXE
PID:2828 -
\??\c:\hrnnjph.exec:\hrnnjph.exe45⤵
- Executes dropped EXE
PID:2424 -
\??\c:\bfffdtn.exec:\bfffdtn.exe46⤵
- Executes dropped EXE
PID:2420 -
\??\c:\pfjxv.exec:\pfjxv.exe47⤵
- Executes dropped EXE
PID:2836 -
\??\c:\prfhn.exec:\prfhn.exe48⤵
- Executes dropped EXE
PID:2012 -
\??\c:\jbdjppf.exec:\jbdjppf.exe49⤵
- Executes dropped EXE
PID:572 -
\??\c:\rrndl.exec:\rrndl.exe50⤵
- Executes dropped EXE
PID:1748 -
\??\c:\btjrhnl.exec:\btjrhnl.exe51⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pdfpb.exec:\pdfpb.exe52⤵
- Executes dropped EXE
PID:2712 -
\??\c:\nnrpjp.exec:\nnrpjp.exe53⤵
- Executes dropped EXE
PID:2236 -
\??\c:\htfpdbd.exec:\htfpdbd.exe54⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tpvftrv.exec:\tpvftrv.exe55⤵
- Executes dropped EXE
PID:1372 -
\??\c:\bjvrxvn.exec:\bjvrxvn.exe56⤵
- Executes dropped EXE
PID:2232 -
\??\c:\nthnl.exec:\nthnl.exe57⤵
- Executes dropped EXE
PID:2256 -
\??\c:\llpjrhj.exec:\llpjrhj.exe58⤵
- Executes dropped EXE
PID:768 -
\??\c:\xpntbtx.exec:\xpntbtx.exe59⤵
- Executes dropped EXE
PID:2184 -
\??\c:\jbjvvvv.exec:\jbjvvvv.exe60⤵
- Executes dropped EXE
PID:1620 -
\??\c:\xfdbfvn.exec:\xfdbfvn.exe61⤵
- Executes dropped EXE
PID:2304 -
\??\c:\tphffnp.exec:\tphffnp.exe62⤵
- Executes dropped EXE
PID:2108 -
\??\c:\fvbpj.exec:\fvbpj.exe63⤵
- Executes dropped EXE
PID:336 -
\??\c:\vddvxr.exec:\vddvxr.exe64⤵
- Executes dropped EXE
PID:2292 -
\??\c:\hxfxfhv.exec:\hxfxfhv.exe65⤵
- Executes dropped EXE
PID:2772 -
\??\c:\tjnjrd.exec:\tjnjrd.exe66⤵
- Executes dropped EXE
PID:2316 -
\??\c:\blphrt.exec:\blphrt.exe67⤵PID:276
-
\??\c:\nbrff.exec:\nbrff.exe68⤵PID:1540
-
\??\c:\llhxvrp.exec:\llhxvrp.exe69⤵PID:1764
-
\??\c:\vxdlrx.exec:\vxdlrx.exe70⤵PID:1360
-
\??\c:\bpxjj.exec:\bpxjj.exe71⤵PID:1584
-
\??\c:\dhdlrpn.exec:\dhdlrpn.exe72⤵PID:1892
-
\??\c:\ftblx.exec:\ftblx.exe73⤵PID:968
-
\??\c:\lbrvxf.exec:\lbrvxf.exe74⤵PID:2384
-
\??\c:\xftbl.exec:\xftbl.exe75⤵PID:3020
-
\??\c:\xnddlvn.exec:\xnddlvn.exe76⤵PID:1608
-
\??\c:\flhnb.exec:\flhnb.exe77⤵PID:2324
-
\??\c:\fjfjdrd.exec:\fjfjdrd.exe78⤵PID:1244
-
\??\c:\pttnjhr.exec:\pttnjhr.exe79⤵PID:2368
-
\??\c:\jjpfbp.exec:\jjpfbp.exe80⤵PID:1684
-
\??\c:\llpxfnh.exec:\llpxfnh.exe81⤵PID:2352
-
\??\c:\dbnrlp.exec:\dbnrlp.exe82⤵PID:2940
-
\??\c:\jpbfbr.exec:\jpbfbr.exe83⤵PID:2640
-
\??\c:\ntnrvt.exec:\ntnrvt.exe84⤵PID:2624
-
\??\c:\jfnxbd.exec:\jfnxbd.exe85⤵PID:2688
-
\??\c:\xpfnh.exec:\xpfnh.exe86⤵PID:2556
-
\??\c:\fdnvjfn.exec:\fdnvjfn.exe87⤵PID:2692
-
\??\c:\vjxldl.exec:\vjxldl.exe88⤵PID:2680
-
\??\c:\rhbjht.exec:\rhbjht.exe89⤵PID:1440
-
\??\c:\nxvthd.exec:\nxvthd.exe90⤵PID:2468
-
\??\c:\vrfvlh.exec:\vrfvlh.exe91⤵PID:580
-
\??\c:\nxvhj.exec:\nxvhj.exe92⤵PID:1380
-
\??\c:\dpbjlb.exec:\dpbjlb.exe93⤵PID:2172
-
\??\c:\dbxrp.exec:\dbxrp.exe94⤵PID:1876
-
\??\c:\nhxhvpr.exec:\nhxhvpr.exe95⤵PID:2412
-
\??\c:\ndjnfx.exec:\ndjnfx.exe96⤵PID:2036
-
\??\c:\vdbfjl.exec:\vdbfjl.exe97⤵PID:1068
-
\??\c:\vlbjrd.exec:\vlbjrd.exe98⤵PID:1796
-
\??\c:\jnxxnj.exec:\jnxxnj.exe99⤵PID:1232
-
\??\c:\hvrlf.exec:\hvrlf.exe100⤵PID:1648
-
\??\c:\bnjfjv.exec:\bnjfjv.exe101⤵PID:1368
-
\??\c:\fdbhp.exec:\fdbhp.exe102⤵PID:948
-
\??\c:\djvjhjb.exec:\djvjhjb.exe103⤵PID:1692
-
\??\c:\pnjjbv.exec:\pnjjbv.exe104⤵PID:2220
-
\??\c:\ljbpj.exec:\ljbpj.exe105⤵PID:1620
-
\??\c:\drndjrd.exec:\drndjrd.exe106⤵PID:2280
-
\??\c:\xbnhf.exec:\xbnhf.exe107⤵PID:596
-
\??\c:\vtjbp.exec:\vtjbp.exe108⤵PID:3004
-
\??\c:\hvlrln.exec:\hvlrln.exe109⤵PID:528
-
\??\c:\rttlx.exec:\rttlx.exe110⤵PID:1712
-
\??\c:\fdpltn.exec:\fdpltn.exe111⤵PID:840
-
\??\c:\nhjhnft.exec:\nhjhnft.exe112⤵PID:1812
-
\??\c:\nrvvbv.exec:\nrvvbv.exe113⤵PID:1828
-
\??\c:\jfpjnjp.exec:\jfpjnjp.exe114⤵PID:792
-
\??\c:\ldnlhpv.exec:\ldnlhpv.exe115⤵PID:1816
-
\??\c:\tfpfrjd.exec:\tfpfrjd.exe116⤵PID:1972
-
\??\c:\rxtdb.exec:\rxtdb.exe117⤵PID:1548
-
\??\c:\fjtlv.exec:\fjtlv.exe118⤵PID:1304
-
\??\c:\vnjpl.exec:\vnjpl.exe119⤵PID:1544
-
\??\c:\vhvtxt.exec:\vhvtxt.exe120⤵PID:2956
-
\??\c:\rfjnfh.exec:\rfjnfh.exe121⤵PID:2988
-
\??\c:\hrttbdf.exec:\hrttbdf.exe122⤵PID:2336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-