Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 13:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c7941ddb367c6d18dfeda0aa2f38e3b0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
c7941ddb367c6d18dfeda0aa2f38e3b0_NeikiAnalytics.exe
-
Size
66KB
-
MD5
c7941ddb367c6d18dfeda0aa2f38e3b0
-
SHA1
cfec0f7d77e4660f041b49f1b4bcf8d594f6c1b0
-
SHA256
b85cf426b273c087d5da9ed474d7aea16b546d5f42fab4a199f63a6240b0a50d
-
SHA512
60ccbba71070f5e053cbe20343fefe343ba17b6c87139e5f2cf04ca4f758cf593b7c0f2d318a65f83ecfa010087d4c2983db5ac2d6608ba4aeab3d3c7097f710
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUPqrDZh:ymb3NkkiQ3mdBjF0yUm/
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2892-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-54-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/240-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/956-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1816-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1328-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1844-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/612-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2224 hbtvd.exe 3032 pnplr.exe 2664 ttnrfd.exe 2292 ndjdj.exe 2604 lltnt.exe 2360 plrbtf.exe 2868 pxrrlrh.exe 240 vfbpp.exe 1644 lrrlx.exe 1068 vpnvjpn.exe 2588 dllbdl.exe 2704 thrhht.exe 1092 lbbvn.exe 1924 rfrbnlh.exe 1224 lxlrvf.exe 1692 drnbxp.exe 2352 rpxnp.exe 956 pbjhvf.exe 940 lpdvtl.exe 2304 prpxvxn.exe 2820 fpbvfpf.exe 3004 xhbpn.exe 2156 dbtbrvj.exe 1724 nlxxv.exe 1816 ntvnl.exe 1328 hpptxd.exe 1844 tbtxj.exe 1988 rxvbfv.exe 612 xnvxrh.exe 2076 ltjbp.exe 1772 trdrb.exe 3000 tnnjd.exe 1752 nrjhtb.exe 2192 nvhfxxx.exe 2948 lpjvvrd.exe 2944 jjtxx.exe 2456 tnprxpf.exe 3020 ftvnl.exe 2616 ljbjptf.exe 2668 txhvlt.exe 2632 drxrf.exe 2404 htxrnph.exe 2604 hpnlv.exe 3040 tlvfhx.exe 2872 jplrxx.exe 592 xlrnr.exe 1372 lbhphb.exe 1916 rxhdjl.exe 1068 hjxjf.exe 2696 fhbhp.exe 2768 flnvrht.exe 1936 ffnnnl.exe 1948 ffxfrth.exe 1976 ntddfj.exe 1920 fxhjv.exe 1088 ndhjtx.exe 2544 jvjtl.exe 2908 plbnvj.exe 800 rbrtrhx.exe 324 rhtnvj.exe 2276 nbdvxp.exe 776 xhrtj.exe 540 xhbtd.exe 2152 pfjrhbv.exe -
resource yara_rule behavioral1/memory/2892-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/240-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/956-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1328-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1844-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/612-283-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2892 wrote to memory of 2224 2892 c7941ddb367c6d18dfeda0aa2f38e3b0_NeikiAnalytics.exe 28 PID 2892 wrote to memory of 2224 2892 c7941ddb367c6d18dfeda0aa2f38e3b0_NeikiAnalytics.exe 28 PID 2892 wrote to memory of 2224 2892 c7941ddb367c6d18dfeda0aa2f38e3b0_NeikiAnalytics.exe 28 PID 2892 wrote to memory of 2224 2892 c7941ddb367c6d18dfeda0aa2f38e3b0_NeikiAnalytics.exe 28 PID 2224 wrote to memory of 3032 2224 hbtvd.exe 29 PID 2224 wrote to memory of 3032 2224 hbtvd.exe 29 PID 2224 wrote to memory of 3032 2224 hbtvd.exe 29 PID 2224 wrote to memory of 3032 2224 hbtvd.exe 29 PID 3032 wrote to memory of 2664 3032 pnplr.exe 30 PID 3032 wrote to memory of 2664 3032 pnplr.exe 30 PID 3032 wrote to memory of 2664 3032 pnplr.exe 30 PID 3032 wrote to memory of 2664 3032 pnplr.exe 30 PID 2664 wrote to memory of 2292 2664 ttnrfd.exe 31 PID 2664 wrote to memory of 2292 2664 ttnrfd.exe 31 PID 2664 wrote to memory of 2292 2664 ttnrfd.exe 31 PID 2664 wrote to memory of 2292 2664 ttnrfd.exe 31 PID 2292 wrote to memory of 2604 2292 ndjdj.exe 32 PID 2292 wrote to memory of 2604 2292 ndjdj.exe 32 PID 2292 wrote to memory of 2604 2292 ndjdj.exe 32 PID 2292 wrote to memory of 2604 2292 ndjdj.exe 32 PID 2604 wrote to memory of 2360 2604 lltnt.exe 33 PID 2604 wrote to memory of 2360 2604 lltnt.exe 33 PID 2604 wrote to memory of 2360 2604 lltnt.exe 33 PID 2604 wrote to memory of 2360 2604 lltnt.exe 33 PID 2360 wrote to memory of 2868 2360 plrbtf.exe 34 PID 2360 wrote to memory of 2868 2360 plrbtf.exe 34 PID 2360 wrote to memory of 2868 2360 plrbtf.exe 34 PID 2360 wrote to memory of 2868 2360 plrbtf.exe 34 PID 2868 wrote to memory of 240 2868 pxrrlrh.exe 35 PID 2868 wrote to memory of 240 2868 pxrrlrh.exe 35 PID 2868 wrote to memory of 240 2868 pxrrlrh.exe 35 PID 2868 wrote to memory of 240 2868 pxrrlrh.exe 35 PID 240 wrote to memory of 1644 240 vfbpp.exe 36 PID 240 wrote to memory of 1644 240 vfbpp.exe 36 PID 240 wrote to memory of 1644 240 vfbpp.exe 36 PID 240 wrote to memory of 1644 240 vfbpp.exe 36 PID 1644 wrote to memory of 1068 1644 lrrlx.exe 37 PID 1644 wrote to memory of 1068 1644 lrrlx.exe 37 PID 1644 wrote to memory of 1068 1644 lrrlx.exe 37 PID 1644 wrote to memory of 1068 1644 lrrlx.exe 37 PID 1068 wrote to memory of 2588 1068 vpnvjpn.exe 38 PID 1068 wrote to memory of 2588 1068 vpnvjpn.exe 38 PID 1068 wrote to memory of 2588 1068 vpnvjpn.exe 38 PID 1068 wrote to memory of 2588 1068 vpnvjpn.exe 38 PID 2588 wrote to memory of 2704 2588 dllbdl.exe 39 PID 2588 wrote to memory of 2704 2588 dllbdl.exe 39 PID 2588 wrote to memory of 2704 2588 dllbdl.exe 39 PID 2588 wrote to memory of 2704 2588 dllbdl.exe 39 PID 2704 wrote to memory of 1092 2704 thrhht.exe 40 PID 2704 wrote to memory of 1092 2704 thrhht.exe 40 PID 2704 wrote to memory of 1092 2704 thrhht.exe 40 PID 2704 wrote to memory of 1092 2704 thrhht.exe 40 PID 1092 wrote to memory of 1924 1092 lbbvn.exe 41 PID 1092 wrote to memory of 1924 1092 lbbvn.exe 41 PID 1092 wrote to memory of 1924 1092 lbbvn.exe 41 PID 1092 wrote to memory of 1924 1092 lbbvn.exe 41 PID 1924 wrote to memory of 1224 1924 rfrbnlh.exe 42 PID 1924 wrote to memory of 1224 1924 rfrbnlh.exe 42 PID 1924 wrote to memory of 1224 1924 rfrbnlh.exe 42 PID 1924 wrote to memory of 1224 1924 rfrbnlh.exe 42 PID 1224 wrote to memory of 1692 1224 lxlrvf.exe 43 PID 1224 wrote to memory of 1692 1224 lxlrvf.exe 43 PID 1224 wrote to memory of 1692 1224 lxlrvf.exe 43 PID 1224 wrote to memory of 1692 1224 lxlrvf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7941ddb367c6d18dfeda0aa2f38e3b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c7941ddb367c6d18dfeda0aa2f38e3b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\hbtvd.exec:\hbtvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\pnplr.exec:\pnplr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\ttnrfd.exec:\ttnrfd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\ndjdj.exec:\ndjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\lltnt.exec:\lltnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\plrbtf.exec:\plrbtf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\pxrrlrh.exec:\pxrrlrh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\vfbpp.exec:\vfbpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
\??\c:\lrrlx.exec:\lrrlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\vpnvjpn.exec:\vpnvjpn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\dllbdl.exec:\dllbdl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\thrhht.exec:\thrhht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\lbbvn.exec:\lbbvn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\rfrbnlh.exec:\rfrbnlh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\lxlrvf.exec:\lxlrvf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\drnbxp.exec:\drnbxp.exe17⤵
- Executes dropped EXE
PID:1692 -
\??\c:\rpxnp.exec:\rpxnp.exe18⤵
- Executes dropped EXE
PID:2352 -
\??\c:\pbjhvf.exec:\pbjhvf.exe19⤵
- Executes dropped EXE
PID:956 -
\??\c:\lpdvtl.exec:\lpdvtl.exe20⤵
- Executes dropped EXE
PID:940 -
\??\c:\prpxvxn.exec:\prpxvxn.exe21⤵
- Executes dropped EXE
PID:2304 -
\??\c:\fpbvfpf.exec:\fpbvfpf.exe22⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xhbpn.exec:\xhbpn.exe23⤵
- Executes dropped EXE
PID:3004 -
\??\c:\dbtbrvj.exec:\dbtbrvj.exe24⤵
- Executes dropped EXE
PID:2156 -
\??\c:\nlxxv.exec:\nlxxv.exe25⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ntvnl.exec:\ntvnl.exe26⤵
- Executes dropped EXE
PID:1816 -
\??\c:\hpptxd.exec:\hpptxd.exe27⤵
- Executes dropped EXE
PID:1328 -
\??\c:\tbtxj.exec:\tbtxj.exe28⤵
- Executes dropped EXE
PID:1844 -
\??\c:\rxvbfv.exec:\rxvbfv.exe29⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xnvxrh.exec:\xnvxrh.exe30⤵
- Executes dropped EXE
PID:612 -
\??\c:\ltjbp.exec:\ltjbp.exe31⤵
- Executes dropped EXE
PID:2076 -
\??\c:\trdrb.exec:\trdrb.exe32⤵
- Executes dropped EXE
PID:1772 -
\??\c:\tnnjd.exec:\tnnjd.exe33⤵
- Executes dropped EXE
PID:3000 -
\??\c:\nrjhtb.exec:\nrjhtb.exe34⤵
- Executes dropped EXE
PID:1752 -
\??\c:\nvhfxxx.exec:\nvhfxxx.exe35⤵
- Executes dropped EXE
PID:2192 -
\??\c:\lpjvvrd.exec:\lpjvvrd.exe36⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jjtxx.exec:\jjtxx.exe37⤵
- Executes dropped EXE
PID:2944 -
\??\c:\tnprxpf.exec:\tnprxpf.exe38⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ftvnl.exec:\ftvnl.exe39⤵
- Executes dropped EXE
PID:3020 -
\??\c:\ljbjptf.exec:\ljbjptf.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\txhvlt.exec:\txhvlt.exe41⤵
- Executes dropped EXE
PID:2668 -
\??\c:\drxrf.exec:\drxrf.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\htxrnph.exec:\htxrnph.exe43⤵
- Executes dropped EXE
PID:2404 -
\??\c:\hpnlv.exec:\hpnlv.exe44⤵
- Executes dropped EXE
PID:2604 -
\??\c:\tlvfhx.exec:\tlvfhx.exe45⤵
- Executes dropped EXE
PID:3040 -
\??\c:\jplrxx.exec:\jplrxx.exe46⤵
- Executes dropped EXE
PID:2872 -
\??\c:\xlrnr.exec:\xlrnr.exe47⤵
- Executes dropped EXE
PID:592 -
\??\c:\lbhphb.exec:\lbhphb.exe48⤵
- Executes dropped EXE
PID:1372 -
\??\c:\rxhdjl.exec:\rxhdjl.exe49⤵
- Executes dropped EXE
PID:1916 -
\??\c:\hjxjf.exec:\hjxjf.exe50⤵
- Executes dropped EXE
PID:1068 -
\??\c:\fhbhp.exec:\fhbhp.exe51⤵
- Executes dropped EXE
PID:2696 -
\??\c:\flnvrht.exec:\flnvrht.exe52⤵
- Executes dropped EXE
PID:2768 -
\??\c:\ffnnnl.exec:\ffnnnl.exe53⤵
- Executes dropped EXE
PID:1936 -
\??\c:\ffxfrth.exec:\ffxfrth.exe54⤵
- Executes dropped EXE
PID:1948 -
\??\c:\ntddfj.exec:\ntddfj.exe55⤵
- Executes dropped EXE
PID:1976 -
\??\c:\fxhjv.exec:\fxhjv.exe56⤵
- Executes dropped EXE
PID:1920 -
\??\c:\ndhjtx.exec:\ndhjtx.exe57⤵
- Executes dropped EXE
PID:1088 -
\??\c:\jvjtl.exec:\jvjtl.exe58⤵
- Executes dropped EXE
PID:2544 -
\??\c:\plbnvj.exec:\plbnvj.exe59⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rbrtrhx.exec:\rbrtrhx.exe60⤵
- Executes dropped EXE
PID:800 -
\??\c:\rhtnvj.exec:\rhtnvj.exe61⤵
- Executes dropped EXE
PID:324 -
\??\c:\nbdvxp.exec:\nbdvxp.exe62⤵
- Executes dropped EXE
PID:2276 -
\??\c:\xhrtj.exec:\xhrtj.exe63⤵
- Executes dropped EXE
PID:776 -
\??\c:\xhbtd.exec:\xhbtd.exe64⤵
- Executes dropped EXE
PID:540 -
\??\c:\pfjrhbv.exec:\pfjrhbv.exe65⤵
- Executes dropped EXE
PID:2152 -
\??\c:\hvxhp.exec:\hvxhp.exe66⤵PID:2316
-
\??\c:\dtnjrpv.exec:\dtnjrpv.exe67⤵PID:1112
-
\??\c:\jrjhx.exec:\jrjhx.exe68⤵PID:1732
-
\??\c:\bjhfbl.exec:\bjhfbl.exe69⤵PID:2708
-
\??\c:\pbjdtpv.exec:\pbjdtpv.exe70⤵PID:1756
-
\??\c:\blxhbf.exec:\blxhbf.exe71⤵PID:2016
-
\??\c:\pxpdlnx.exec:\pxpdlnx.exe72⤵PID:1988
-
\??\c:\hrvdlht.exec:\hrvdlht.exe73⤵PID:696
-
\??\c:\xhphv.exec:\xhphv.exe74⤵PID:612
-
\??\c:\xrpfxb.exec:\xrpfxb.exe75⤵PID:368
-
\??\c:\xxndj.exec:\xxndj.exe76⤵PID:2132
-
\??\c:\blrtbjl.exec:\blrtbjl.exe77⤵PID:1940
-
\??\c:\pxhjrx.exec:\pxhjrx.exe78⤵PID:1728
-
\??\c:\rxprhdx.exec:\rxprhdx.exe79⤵PID:2552
-
\??\c:\dhvdr.exec:\dhvdr.exe80⤵PID:1744
-
\??\c:\bbvrlfl.exec:\bbvrlfl.exe81⤵PID:2900
-
\??\c:\bvpdff.exec:\bvpdff.exe82⤵PID:2640
-
\??\c:\njxhjx.exec:\njxhjx.exe83⤵PID:2492
-
\??\c:\pfhvtfl.exec:\pfhvtfl.exe84⤵PID:2524
-
\??\c:\xnlplv.exec:\xnlplv.exe85⤵PID:2144
-
\??\c:\ftljh.exec:\ftljh.exe86⤵PID:2636
-
\??\c:\rvhvh.exec:\rvhvh.exe87⤵PID:2748
-
\??\c:\tdbhvxx.exec:\tdbhvxx.exe88⤵PID:2360
-
\??\c:\lvrlnxt.exec:\lvrlnxt.exe89⤵PID:2884
-
\??\c:\vhhdt.exec:\vhhdt.exe90⤵PID:580
-
\??\c:\xhtbvtd.exec:\xhtbvtd.exe91⤵PID:1264
-
\??\c:\ltrdhb.exec:\ltrdhb.exe92⤵PID:2344
-
\??\c:\pjtlfr.exec:\pjtlfr.exe93⤵PID:2584
-
\??\c:\hrjrfb.exec:\hrjrfb.exe94⤵PID:2700
-
\??\c:\fbpxn.exec:\fbpxn.exe95⤵PID:2720
-
\??\c:\xrvpd.exec:\xrvpd.exe96⤵PID:2732
-
\??\c:\llbvj.exec:\llbvj.exe97⤵PID:1664
-
\??\c:\rttrxl.exec:\rttrxl.exe98⤵PID:1980
-
\??\c:\ftvtnt.exec:\ftvtnt.exe99⤵PID:1156
-
\??\c:\rbxppfx.exec:\rbxppfx.exe100⤵PID:2576
-
\??\c:\brlbf.exec:\brlbf.exe101⤵PID:1100
-
\??\c:\vtbhltd.exec:\vtbhltd.exe102⤵PID:2352
-
\??\c:\jxjttl.exec:\jxjttl.exe103⤵PID:2908
-
\??\c:\jbpdxfd.exec:\jbpdxfd.exe104⤵PID:2136
-
\??\c:\dhjbdrd.exec:\dhjbdrd.exe105⤵PID:844
-
\??\c:\rbrxd.exec:\rbrxd.exe106⤵PID:2816
-
\??\c:\xjddjjn.exec:\xjddjjn.exe107⤵PID:584
-
\??\c:\dbdxn.exec:\dbdxn.exe108⤵PID:436
-
\??\c:\vdbnhjb.exec:\vdbnhjb.exe109⤵PID:1888
-
\??\c:\hfrxrxp.exec:\hfrxrxp.exe110⤵PID:840
-
\??\c:\bdnbhlr.exec:\bdnbhlr.exe111⤵PID:1808
-
\??\c:\ddxvfjh.exec:\ddxvfjh.exe112⤵PID:1816
-
\??\c:\rrhbn.exec:\rrhbn.exe113⤵PID:1824
-
\??\c:\drflntl.exec:\drflntl.exe114⤵PID:1328
-
\??\c:\lbbhxdx.exec:\lbbhxdx.exe115⤵PID:1624
-
\??\c:\httdb.exec:\httdb.exe116⤵PID:364
-
\??\c:\hnxjdtr.exec:\hnxjdtr.exe117⤵PID:1084
-
\??\c:\tjrxvn.exec:\tjrxvn.exe118⤵PID:2556
-
\??\c:\vpvvrf.exec:\vpvvrf.exe119⤵PID:1648
-
\??\c:\hfvrpp.exec:\hfvrpp.exe120⤵PID:2188
-
\??\c:\xllbd.exec:\xllbd.exe121⤵PID:892
-
\??\c:\pvbdhf.exec:\pvbdhf.exe122⤵PID:1792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-