Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 06:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
92a7813d62b1b883fb69e15e3619fe40_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
92a7813d62b1b883fb69e15e3619fe40_NeikiAnalytics.exe
-
Size
61KB
-
MD5
92a7813d62b1b883fb69e15e3619fe40
-
SHA1
61b081f9184888585ca6d2c458e1112ce4d0a6da
-
SHA256
dd529a92b52bc5717e6ea2dbdc41631c8d676555a4ef5bb95b6a626d3e7f1233
-
SHA512
cb4463b2cfeb2eb1386c21be95913167de3bc9181321d69a4768fb1fac4e4e7a77088d7ac24cc1e1553baa0f15742964a84718f404692c3c8286969bc9bbd412
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDII9ZvHKEG:ymb3NkkiQ3mdBjFII9ZvHKEG
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2360-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1620-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1324-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2004-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1816-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1328-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/560-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/948-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1620 djdpv.exe 1696 rrrrxlx.exe 3032 xrxfrxf.exe 1324 tnhbhn.exe 2596 5dpdp.exe 2592 vjjdp.exe 2556 fxrrxxr.exe 2480 9thhtt.exe 2444 dvdvv.exe 2560 rxxrlfx.exe 2196 ffrrllr.exe 2004 ttnbnb.exe 1576 1dvjp.exe 1972 3dvdp.exe 2528 xlrrxrr.exe 2428 bnhntb.exe 2696 nntbhh.exe 1816 jdvpv.exe 2808 pjddp.exe 1328 xfrxxfl.exe 1648 hhbtth.exe 2536 hbhtbn.exe 560 7jjvd.exe 1468 1jjvv.exe 948 xrlxflr.exe 1136 bnhhhh.exe 864 bbtbhn.exe 800 ppdjd.exe 2120 rrrxffl.exe 1072 lflxxlx.exe 2376 ntntbn.exe 2092 vjdvj.exe 1700 vpddj.exe 1620 rrllxxf.exe 3000 xfxrrlf.exe 2216 btnbhb.exe 2520 3jjdd.exe 2996 1pjjv.exe 2548 9llxlrx.exe 2584 1rfxxxx.exe 2712 btntbn.exe 1780 ntbttb.exe 2556 llxflrl.exe 2464 tttbnt.exe 2504 jdddj.exe 2824 pdvdv.exe 2560 lfrrxfx.exe 2388 xxxrxff.exe 1212 7hbhtt.exe 1936 3bhnhh.exe 2012 jpjvp.exe 1204 lfxfxxr.exe 2756 9rfffxf.exe 2676 htbbnh.exe 1824 bbtnth.exe 1652 vvjdj.exe 1816 pjjjp.exe 1200 fxrlrll.exe 2300 rlrfxrr.exe 952 thnhnh.exe 268 bbntbn.exe 1304 jvjpd.exe 2312 pdpvv.exe 1468 xrfxffl.exe -
resource yara_rule behavioral1/memory/2360-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1324-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2004-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1328-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/560-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/948-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-280-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 1620 2360 92a7813d62b1b883fb69e15e3619fe40_NeikiAnalytics.exe 28 PID 2360 wrote to memory of 1620 2360 92a7813d62b1b883fb69e15e3619fe40_NeikiAnalytics.exe 28 PID 2360 wrote to memory of 1620 2360 92a7813d62b1b883fb69e15e3619fe40_NeikiAnalytics.exe 28 PID 2360 wrote to memory of 1620 2360 92a7813d62b1b883fb69e15e3619fe40_NeikiAnalytics.exe 28 PID 1620 wrote to memory of 1696 1620 djdpv.exe 29 PID 1620 wrote to memory of 1696 1620 djdpv.exe 29 PID 1620 wrote to memory of 1696 1620 djdpv.exe 29 PID 1620 wrote to memory of 1696 1620 djdpv.exe 29 PID 1696 wrote to memory of 3032 1696 rrrrxlx.exe 30 PID 1696 wrote to memory of 3032 1696 rrrrxlx.exe 30 PID 1696 wrote to memory of 3032 1696 rrrrxlx.exe 30 PID 1696 wrote to memory of 3032 1696 rrrrxlx.exe 30 PID 3032 wrote to memory of 1324 3032 xrxfrxf.exe 31 PID 3032 wrote to memory of 1324 3032 xrxfrxf.exe 31 PID 3032 wrote to memory of 1324 3032 xrxfrxf.exe 31 PID 3032 wrote to memory of 1324 3032 xrxfrxf.exe 31 PID 1324 wrote to memory of 2596 1324 tnhbhn.exe 32 PID 1324 wrote to memory of 2596 1324 tnhbhn.exe 32 PID 1324 wrote to memory of 2596 1324 tnhbhn.exe 32 PID 1324 wrote to memory of 2596 1324 tnhbhn.exe 32 PID 2596 wrote to memory of 2592 2596 5dpdp.exe 33 PID 2596 wrote to memory of 2592 2596 5dpdp.exe 33 PID 2596 wrote to memory of 2592 2596 5dpdp.exe 33 PID 2596 wrote to memory of 2592 2596 5dpdp.exe 33 PID 2592 wrote to memory of 2556 2592 vjjdp.exe 34 PID 2592 wrote to memory of 2556 2592 vjjdp.exe 34 PID 2592 wrote to memory of 2556 2592 vjjdp.exe 34 PID 2592 wrote to memory of 2556 2592 vjjdp.exe 34 PID 2556 wrote to memory of 2480 2556 fxrrxxr.exe 35 PID 2556 wrote to memory of 2480 2556 fxrrxxr.exe 35 PID 2556 wrote to memory of 2480 2556 fxrrxxr.exe 35 PID 2556 wrote to memory of 2480 2556 fxrrxxr.exe 35 PID 2480 wrote to memory of 2444 2480 9thhtt.exe 36 PID 2480 wrote to memory of 2444 2480 9thhtt.exe 36 PID 2480 wrote to memory of 2444 2480 9thhtt.exe 36 PID 2480 wrote to memory of 2444 2480 9thhtt.exe 36 PID 2444 wrote to memory of 2560 2444 dvdvv.exe 37 PID 2444 wrote to memory of 2560 2444 dvdvv.exe 37 PID 2444 wrote to memory of 2560 2444 dvdvv.exe 37 PID 2444 wrote to memory of 2560 2444 dvdvv.exe 37 PID 2560 wrote to memory of 2196 2560 rxxrlfx.exe 38 PID 2560 wrote to memory of 2196 2560 rxxrlfx.exe 38 PID 2560 wrote to memory of 2196 2560 rxxrlfx.exe 38 PID 2560 wrote to memory of 2196 2560 rxxrlfx.exe 38 PID 2196 wrote to memory of 2004 2196 ffrrllr.exe 39 PID 2196 wrote to memory of 2004 2196 ffrrllr.exe 39 PID 2196 wrote to memory of 2004 2196 ffrrllr.exe 39 PID 2196 wrote to memory of 2004 2196 ffrrllr.exe 39 PID 2004 wrote to memory of 1576 2004 ttnbnb.exe 40 PID 2004 wrote to memory of 1576 2004 ttnbnb.exe 40 PID 2004 wrote to memory of 1576 2004 ttnbnb.exe 40 PID 2004 wrote to memory of 1576 2004 ttnbnb.exe 40 PID 1576 wrote to memory of 1972 1576 1dvjp.exe 41 PID 1576 wrote to memory of 1972 1576 1dvjp.exe 41 PID 1576 wrote to memory of 1972 1576 1dvjp.exe 41 PID 1576 wrote to memory of 1972 1576 1dvjp.exe 41 PID 1972 wrote to memory of 2528 1972 3dvdp.exe 42 PID 1972 wrote to memory of 2528 1972 3dvdp.exe 42 PID 1972 wrote to memory of 2528 1972 3dvdp.exe 42 PID 1972 wrote to memory of 2528 1972 3dvdp.exe 42 PID 2528 wrote to memory of 2428 2528 xlrrxrr.exe 43 PID 2528 wrote to memory of 2428 2528 xlrrxrr.exe 43 PID 2528 wrote to memory of 2428 2528 xlrrxrr.exe 43 PID 2528 wrote to memory of 2428 2528 xlrrxrr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\92a7813d62b1b883fb69e15e3619fe40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\92a7813d62b1b883fb69e15e3619fe40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\djdpv.exec:\djdpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\rrrrxlx.exec:\rrrrxlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\xrxfrxf.exec:\xrxfrxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\tnhbhn.exec:\tnhbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\5dpdp.exec:\5dpdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\vjjdp.exec:\vjjdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\fxrrxxr.exec:\fxrrxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\9thhtt.exec:\9thhtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\dvdvv.exec:\dvdvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\rxxrlfx.exec:\rxxrlfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\ffrrllr.exec:\ffrrllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\ttnbnb.exec:\ttnbnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\1dvjp.exec:\1dvjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\3dvdp.exec:\3dvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\xlrrxrr.exec:\xlrrxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\bnhntb.exec:\bnhntb.exe17⤵
- Executes dropped EXE
PID:2428 -
\??\c:\nntbhh.exec:\nntbhh.exe18⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jdvpv.exec:\jdvpv.exe19⤵
- Executes dropped EXE
PID:1816 -
\??\c:\pjddp.exec:\pjddp.exe20⤵
- Executes dropped EXE
PID:2808 -
\??\c:\xfrxxfl.exec:\xfrxxfl.exe21⤵
- Executes dropped EXE
PID:1328 -
\??\c:\hhbtth.exec:\hhbtth.exe22⤵
- Executes dropped EXE
PID:1648 -
\??\c:\hbhtbn.exec:\hbhtbn.exe23⤵
- Executes dropped EXE
PID:2536 -
\??\c:\7jjvd.exec:\7jjvd.exe24⤵
- Executes dropped EXE
PID:560 -
\??\c:\1jjvv.exec:\1jjvv.exe25⤵
- Executes dropped EXE
PID:1468 -
\??\c:\xrlxflr.exec:\xrlxflr.exe26⤵
- Executes dropped EXE
PID:948 -
\??\c:\bnhhhh.exec:\bnhhhh.exe27⤵
- Executes dropped EXE
PID:1136 -
\??\c:\bbtbhn.exec:\bbtbhn.exe28⤵
- Executes dropped EXE
PID:864 -
\??\c:\ppdjd.exec:\ppdjd.exe29⤵
- Executes dropped EXE
PID:800 -
\??\c:\rrrxffl.exec:\rrrxffl.exe30⤵
- Executes dropped EXE
PID:2120 -
\??\c:\lflxxlx.exec:\lflxxlx.exe31⤵
- Executes dropped EXE
PID:1072 -
\??\c:\ntntbn.exec:\ntntbn.exe32⤵
- Executes dropped EXE
PID:2376 -
\??\c:\vjdvj.exec:\vjdvj.exe33⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vpddj.exec:\vpddj.exe34⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rrllxxf.exec:\rrllxxf.exe35⤵
- Executes dropped EXE
PID:1620 -
\??\c:\xfxrrlf.exec:\xfxrrlf.exe36⤵
- Executes dropped EXE
PID:3000 -
\??\c:\btnbhb.exec:\btnbhb.exe37⤵
- Executes dropped EXE
PID:2216 -
\??\c:\3jjdd.exec:\3jjdd.exe38⤵
- Executes dropped EXE
PID:2520 -
\??\c:\1pjjv.exec:\1pjjv.exe39⤵
- Executes dropped EXE
PID:2996 -
\??\c:\9llxlrx.exec:\9llxlrx.exe40⤵
- Executes dropped EXE
PID:2548 -
\??\c:\1rfxxxx.exec:\1rfxxxx.exe41⤵
- Executes dropped EXE
PID:2584 -
\??\c:\btntbn.exec:\btntbn.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\ntbttb.exec:\ntbttb.exe43⤵
- Executes dropped EXE
PID:1780 -
\??\c:\llxflrl.exec:\llxflrl.exe44⤵
- Executes dropped EXE
PID:2556 -
\??\c:\tttbnt.exec:\tttbnt.exe45⤵
- Executes dropped EXE
PID:2464 -
\??\c:\jdddj.exec:\jdddj.exe46⤵
- Executes dropped EXE
PID:2504 -
\??\c:\pdvdv.exec:\pdvdv.exe47⤵
- Executes dropped EXE
PID:2824 -
\??\c:\lfrrxfx.exec:\lfrrxfx.exe48⤵
- Executes dropped EXE
PID:2560 -
\??\c:\xxxrxff.exec:\xxxrxff.exe49⤵
- Executes dropped EXE
PID:2388 -
\??\c:\7hbhtt.exec:\7hbhtt.exe50⤵
- Executes dropped EXE
PID:1212 -
\??\c:\3bhnhh.exec:\3bhnhh.exe51⤵
- Executes dropped EXE
PID:1936 -
\??\c:\jpjvp.exec:\jpjvp.exe52⤵
- Executes dropped EXE
PID:2012 -
\??\c:\lfxfxxr.exec:\lfxfxxr.exe53⤵
- Executes dropped EXE
PID:1204 -
\??\c:\9rfffxf.exec:\9rfffxf.exe54⤵
- Executes dropped EXE
PID:2756 -
\??\c:\htbbnh.exec:\htbbnh.exe55⤵
- Executes dropped EXE
PID:2676 -
\??\c:\bbtnth.exec:\bbtnth.exe56⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vvjdj.exec:\vvjdj.exe57⤵
- Executes dropped EXE
PID:1652 -
\??\c:\pjjjp.exec:\pjjjp.exe58⤵
- Executes dropped EXE
PID:1816 -
\??\c:\fxrlrll.exec:\fxrlrll.exe59⤵
- Executes dropped EXE
PID:1200 -
\??\c:\rlrfxrr.exec:\rlrfxrr.exe60⤵
- Executes dropped EXE
PID:2300 -
\??\c:\thnhnh.exec:\thnhnh.exe61⤵
- Executes dropped EXE
PID:952 -
\??\c:\bbntbn.exec:\bbntbn.exe62⤵
- Executes dropped EXE
PID:268 -
\??\c:\jvjpd.exec:\jvjpd.exe63⤵
- Executes dropped EXE
PID:1304 -
\??\c:\pdpvv.exec:\pdpvv.exe64⤵
- Executes dropped EXE
PID:2312 -
\??\c:\xrfxffl.exec:\xrfxffl.exe65⤵
- Executes dropped EXE
PID:1468 -
\??\c:\xllrlll.exec:\xllrlll.exe66⤵PID:356
-
\??\c:\bnbhth.exec:\bnbhth.exe67⤵PID:1736
-
\??\c:\hbnnnn.exec:\hbnnnn.exe68⤵PID:1136
-
\??\c:\dvppv.exec:\dvppv.exe69⤵PID:864
-
\??\c:\1vvjd.exec:\1vvjd.exe70⤵PID:2900
-
\??\c:\fxxxfxf.exec:\fxxxfxf.exe71⤵PID:284
-
\??\c:\xrffrxl.exec:\xrffrxl.exe72⤵PID:2240
-
\??\c:\7hbthh.exec:\7hbthh.exe73⤵PID:892
-
\??\c:\bthntt.exec:\bthntt.exe74⤵PID:2212
-
\??\c:\5dpvd.exec:\5dpvd.exe75⤵PID:2092
-
\??\c:\rlrxrxl.exec:\rlrxrxl.exe76⤵PID:1700
-
\??\c:\5lrxllr.exec:\5lrxllr.exe77⤵PID:2744
-
\??\c:\hbnthn.exec:\hbnthn.exe78⤵PID:2188
-
\??\c:\5nhntb.exec:\5nhntb.exe79⤵PID:3032
-
\??\c:\vpddj.exec:\vpddj.exe80⤵PID:1556
-
\??\c:\9jppp.exec:\9jppp.exe81⤵PID:2160
-
\??\c:\xrxxfxf.exec:\xrxxfxf.exe82⤵PID:2544
-
\??\c:\1xrxxfl.exec:\1xrxxfl.exe83⤵PID:2724
-
\??\c:\nhnttt.exec:\nhnttt.exe84⤵PID:2592
-
\??\c:\bnnnbt.exec:\bnnnbt.exe85⤵PID:2600
-
\??\c:\dppdj.exec:\dppdj.exe86⤵PID:2540
-
\??\c:\vjdjv.exec:\vjdjv.exe87⤵PID:2472
-
\??\c:\llxxfxf.exec:\llxxfxf.exe88⤵PID:2488
-
\??\c:\rfxflrf.exec:\rfxflrf.exe89⤵PID:1220
-
\??\c:\nhhhtt.exec:\nhhhtt.exe90⤵PID:2328
-
\??\c:\1btbbh.exec:\1btbbh.exe91⤵PID:1716
-
\??\c:\vvpdj.exec:\vvpdj.exe92⤵PID:1976
-
\??\c:\dvjdj.exec:\dvjdj.exe93⤵PID:1416
-
\??\c:\fffrxlf.exec:\fffrxlf.exe94⤵PID:2012
-
\??\c:\rlrffff.exec:\rlrffff.exe95⤵PID:2528
-
\??\c:\tthnbh.exec:\tthnbh.exe96⤵PID:2500
-
\??\c:\thnttt.exec:\thnttt.exe97⤵PID:1932
-
\??\c:\7pvvj.exec:\7pvvj.exe98⤵PID:1608
-
\??\c:\dvjvd.exec:\dvjvd.exe99⤵PID:2792
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe100⤵PID:808
-
\??\c:\lxfrfll.exec:\lxfrfll.exe101⤵PID:616
-
\??\c:\httbbb.exec:\httbbb.exe102⤵PID:2280
-
\??\c:\nnbnbn.exec:\nnbnbn.exe103⤵PID:2276
-
\??\c:\7pdjp.exec:\7pdjp.exe104⤵PID:704
-
\??\c:\jvjdd.exec:\jvjdd.exe105⤵PID:580
-
\??\c:\xrllllr.exec:\xrllllr.exe106⤵PID:1060
-
\??\c:\flxrxll.exec:\flxrxll.exe107⤵PID:1904
-
\??\c:\lxxxfxx.exec:\lxxxfxx.exe108⤵PID:1172
-
\??\c:\nbnthh.exec:\nbnthh.exe109⤵PID:1612
-
\??\c:\nhthbb.exec:\nhthbb.exe110⤵PID:1096
-
\??\c:\jdvvv.exec:\jdvvv.exe111⤵PID:2284
-
\??\c:\jjdjj.exec:\jjdjj.exe112⤵PID:2128
-
\??\c:\jvddd.exec:\jvddd.exe113⤵PID:636
-
\??\c:\rrfxflx.exec:\rrfxflx.exe114⤵PID:2892
-
\??\c:\xrxxrlx.exec:\xrxxrlx.exe115⤵PID:2360
-
\??\c:\nhbtnn.exec:\nhbtnn.exe116⤵PID:2912
-
\??\c:\bthnhb.exec:\bthnhb.exe117⤵PID:1596
-
\??\c:\pjpvd.exec:\pjpvd.exe118⤵PID:2036
-
\??\c:\ddvjv.exec:\ddvjv.exe119⤵PID:1732
-
\??\c:\lllrxxf.exec:\lllrxxf.exe120⤵PID:3036
-
\??\c:\lflrlll.exec:\lflrlll.exe121⤵PID:3012
-
\??\c:\rrlxrfr.exec:\rrlxrfr.exe122⤵PID:2640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-