Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 19:53 UTC
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1962c2d255ddda41f20c413cdcbe4110_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
1962c2d255ddda41f20c413cdcbe4110_NeikiAnalytics.exe
-
Size
55KB
-
MD5
1962c2d255ddda41f20c413cdcbe4110
-
SHA1
b23ff4331c1051ce6405cac6df102bf41b5f80e3
-
SHA256
ef9db928876eb3d34dd614934c87cebb26b0302bcf332ed21c34fe6a68be0764
-
SHA512
45c1477e07f8bf56f0c72ae38bb590d125e435e660e1dc6d15c485e124309cbbb4a14bfbfd3e8ac26cfddc1492a326e12634277ad1005ff0016c2d1d697398d1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFes:ymb3NkkiQ3mdBjFIFes
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1712-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1476-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1496-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1240-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2316 xfxllrx.exe 2988 ttnntb.exe 1732 jjddj.exe 3012 5pddd.exe 2648 9xrlxxr.exe 2572 9xrfxfx.exe 1780 ntbhnn.exe 2484 bbttbb.exe 2504 jvpjd.exe 3020 pdpjp.exe 1588 rxlfrff.exe 1240 rlfxrfl.exe 1040 ttbhnb.exe 2184 bbbhtt.exe 1912 jjddv.exe 2692 pvdpv.exe 1664 vvpvj.exe 1656 llfrrlr.exe 2816 rlxfllx.exe 2296 htntnn.exe 2276 htnhtn.exe 776 jjdjp.exe 1476 7jjpv.exe 2952 ddvdv.exe 1496 ffxlxfx.exe 1612 lrxrxrr.exe 1096 btnthh.exe 568 dpdpv.exe 2904 pddjv.exe 2256 7rxlfrf.exe 2128 xxxlfrl.exe 2092 hhnnhn.exe 1700 bhtbhh.exe 2396 jvpdj.exe 2216 9vddd.exe 320 fxfxffl.exe 1732 7lffffl.exe 3012 5bbhhn.exe 2252 5bnntb.exe 2476 5tbbhb.exe 2552 jjpvp.exe 2456 3pjdj.exe 2824 7xlllxf.exe 2512 xffllff.exe 1224 rflrxrr.exe 2604 nhtbhn.exe 2332 tnhhnh.exe 1888 1vjpp.exe 2452 djvvv.exe 2428 dppjj.exe 1948 5rrxfrf.exe 2772 frrxxfr.exe 2600 fxxlxfl.exe 1920 tbnhnh.exe 2416 3hhnbh.exe 2052 jdjpd.exe 1076 fxxlxxr.exe 556 thtthh.exe 584 tnbbhh.exe 832 9tnthh.exe 1476 jdpvp.exe 2956 vvpvp.exe 1496 fffxlrf.exe 2300 frflfxf.exe -
resource yara_rule behavioral1/memory/1712-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1476-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1240-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-21-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2316 1712 1962c2d255ddda41f20c413cdcbe4110_NeikiAnalytics.exe 28 PID 1712 wrote to memory of 2316 1712 1962c2d255ddda41f20c413cdcbe4110_NeikiAnalytics.exe 28 PID 1712 wrote to memory of 2316 1712 1962c2d255ddda41f20c413cdcbe4110_NeikiAnalytics.exe 28 PID 1712 wrote to memory of 2316 1712 1962c2d255ddda41f20c413cdcbe4110_NeikiAnalytics.exe 28 PID 2316 wrote to memory of 2988 2316 xfxllrx.exe 29 PID 2316 wrote to memory of 2988 2316 xfxllrx.exe 29 PID 2316 wrote to memory of 2988 2316 xfxllrx.exe 29 PID 2316 wrote to memory of 2988 2316 xfxllrx.exe 29 PID 2988 wrote to memory of 1732 2988 ttnntb.exe 30 PID 2988 wrote to memory of 1732 2988 ttnntb.exe 30 PID 2988 wrote to memory of 1732 2988 ttnntb.exe 30 PID 2988 wrote to memory of 1732 2988 ttnntb.exe 30 PID 1732 wrote to memory of 3012 1732 jjddj.exe 65 PID 1732 wrote to memory of 3012 1732 jjddj.exe 65 PID 1732 wrote to memory of 3012 1732 jjddj.exe 65 PID 1732 wrote to memory of 3012 1732 jjddj.exe 65 PID 3012 wrote to memory of 2648 3012 5pddd.exe 32 PID 3012 wrote to memory of 2648 3012 5pddd.exe 32 PID 3012 wrote to memory of 2648 3012 5pddd.exe 32 PID 3012 wrote to memory of 2648 3012 5pddd.exe 32 PID 2648 wrote to memory of 2572 2648 9xrlxxr.exe 33 PID 2648 wrote to memory of 2572 2648 9xrlxxr.exe 33 PID 2648 wrote to memory of 2572 2648 9xrlxxr.exe 33 PID 2648 wrote to memory of 2572 2648 9xrlxxr.exe 33 PID 2572 wrote to memory of 1780 2572 9xrfxfx.exe 34 PID 2572 wrote to memory of 1780 2572 9xrfxfx.exe 34 PID 2572 wrote to memory of 1780 2572 9xrfxfx.exe 34 PID 2572 wrote to memory of 1780 2572 9xrfxfx.exe 34 PID 1780 wrote to memory of 2484 1780 ntbhnn.exe 35 PID 1780 wrote to memory of 2484 1780 ntbhnn.exe 35 PID 1780 wrote to memory of 2484 1780 ntbhnn.exe 35 PID 1780 wrote to memory of 2484 1780 ntbhnn.exe 35 PID 2484 wrote to memory of 2504 2484 bbttbb.exe 36 PID 2484 wrote to memory of 2504 2484 bbttbb.exe 36 PID 2484 wrote to memory of 2504 2484 bbttbb.exe 36 PID 2484 wrote to memory of 2504 2484 bbttbb.exe 36 PID 2504 wrote to memory of 3020 2504 jvpjd.exe 37 PID 2504 wrote to memory of 3020 2504 jvpjd.exe 37 PID 2504 wrote to memory of 3020 2504 jvpjd.exe 37 PID 2504 wrote to memory of 3020 2504 jvpjd.exe 37 PID 3020 wrote to memory of 1588 3020 pdpjp.exe 38 PID 3020 wrote to memory of 1588 3020 pdpjp.exe 38 PID 3020 wrote to memory of 1588 3020 pdpjp.exe 38 PID 3020 wrote to memory of 1588 3020 pdpjp.exe 38 PID 1588 wrote to memory of 1240 1588 rxlfrff.exe 39 PID 1588 wrote to memory of 1240 1588 rxlfrff.exe 39 PID 1588 wrote to memory of 1240 1588 rxlfrff.exe 39 PID 1588 wrote to memory of 1240 1588 rxlfrff.exe 39 PID 1240 wrote to memory of 1040 1240 rlfxrfl.exe 40 PID 1240 wrote to memory of 1040 1240 rlfxrfl.exe 40 PID 1240 wrote to memory of 1040 1240 rlfxrfl.exe 40 PID 1240 wrote to memory of 1040 1240 rlfxrfl.exe 40 PID 1040 wrote to memory of 2184 1040 ttbhnb.exe 41 PID 1040 wrote to memory of 2184 1040 ttbhnb.exe 41 PID 1040 wrote to memory of 2184 1040 ttbhnb.exe 41 PID 1040 wrote to memory of 2184 1040 ttbhnb.exe 41 PID 2184 wrote to memory of 1912 2184 bbbhtt.exe 42 PID 2184 wrote to memory of 1912 2184 bbbhtt.exe 42 PID 2184 wrote to memory of 1912 2184 bbbhtt.exe 42 PID 2184 wrote to memory of 1912 2184 bbbhtt.exe 42 PID 1912 wrote to memory of 2692 1912 jjddv.exe 43 PID 1912 wrote to memory of 2692 1912 jjddv.exe 43 PID 1912 wrote to memory of 2692 1912 jjddv.exe 43 PID 1912 wrote to memory of 2692 1912 jjddv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1962c2d255ddda41f20c413cdcbe4110_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1962c2d255ddda41f20c413cdcbe4110_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\xfxllrx.exec:\xfxllrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\ttnntb.exec:\ttnntb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\jjddj.exec:\jjddj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\5pddd.exec:\5pddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\9xrlxxr.exec:\9xrlxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\9xrfxfx.exec:\9xrfxfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\ntbhnn.exec:\ntbhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\bbttbb.exec:\bbttbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\jvpjd.exec:\jvpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\pdpjp.exec:\pdpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\rxlfrff.exec:\rxlfrff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\rlfxrfl.exec:\rlfxrfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\ttbhnb.exec:\ttbhnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\bbbhtt.exec:\bbbhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\jjddv.exec:\jjddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\pvdpv.exec:\pvdpv.exe17⤵
- Executes dropped EXE
PID:2692 -
\??\c:\vvpvj.exec:\vvpvj.exe18⤵
- Executes dropped EXE
PID:1664 -
\??\c:\llfrrlr.exec:\llfrrlr.exe19⤵
- Executes dropped EXE
PID:1656 -
\??\c:\rlxfllx.exec:\rlxfllx.exe20⤵
- Executes dropped EXE
PID:2816 -
\??\c:\htntnn.exec:\htntnn.exe21⤵
- Executes dropped EXE
PID:2296 -
\??\c:\htnhtn.exec:\htnhtn.exe22⤵
- Executes dropped EXE
PID:2276 -
\??\c:\jjdjp.exec:\jjdjp.exe23⤵
- Executes dropped EXE
PID:776 -
\??\c:\7jjpv.exec:\7jjpv.exe24⤵
- Executes dropped EXE
PID:1476 -
\??\c:\ddvdv.exec:\ddvdv.exe25⤵
- Executes dropped EXE
PID:2952 -
\??\c:\ffxlxfx.exec:\ffxlxfx.exe26⤵
- Executes dropped EXE
PID:1496 -
\??\c:\lrxrxrr.exec:\lrxrxrr.exe27⤵
- Executes dropped EXE
PID:1612 -
\??\c:\btnthh.exec:\btnthh.exe28⤵
- Executes dropped EXE
PID:1096 -
\??\c:\dpdpv.exec:\dpdpv.exe29⤵
- Executes dropped EXE
PID:568 -
\??\c:\pddjv.exec:\pddjv.exe30⤵
- Executes dropped EXE
PID:2904 -
\??\c:\7rxlfrf.exec:\7rxlfrf.exe31⤵
- Executes dropped EXE
PID:2256 -
\??\c:\xxxlfrl.exec:\xxxlfrl.exe32⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hhnnhn.exec:\hhnnhn.exe33⤵
- Executes dropped EXE
PID:2092 -
\??\c:\bhtbhh.exec:\bhtbhh.exe34⤵
- Executes dropped EXE
PID:1700 -
\??\c:\jvpdj.exec:\jvpdj.exe35⤵
- Executes dropped EXE
PID:2396 -
\??\c:\9vddd.exec:\9vddd.exe36⤵
- Executes dropped EXE
PID:2216 -
\??\c:\fxfxffl.exec:\fxfxffl.exe37⤵
- Executes dropped EXE
PID:320 -
\??\c:\7lffffl.exec:\7lffffl.exe38⤵
- Executes dropped EXE
PID:1732 -
\??\c:\5bbhhn.exec:\5bbhhn.exe39⤵
- Executes dropped EXE
PID:3012 -
\??\c:\5bnntb.exec:\5bnntb.exe40⤵
- Executes dropped EXE
PID:2252 -
\??\c:\5tbbhb.exec:\5tbbhb.exe41⤵
- Executes dropped EXE
PID:2476 -
\??\c:\jjpvp.exec:\jjpvp.exe42⤵
- Executes dropped EXE
PID:2552 -
\??\c:\3pjdj.exec:\3pjdj.exe43⤵
- Executes dropped EXE
PID:2456 -
\??\c:\7xlllxf.exec:\7xlllxf.exe44⤵
- Executes dropped EXE
PID:2824 -
\??\c:\xffllff.exec:\xffllff.exe45⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rflrxrr.exec:\rflrxrr.exe46⤵
- Executes dropped EXE
PID:1224 -
\??\c:\nhtbhn.exec:\nhtbhn.exe47⤵
- Executes dropped EXE
PID:2604 -
\??\c:\tnhhnh.exec:\tnhhnh.exe48⤵
- Executes dropped EXE
PID:2332 -
\??\c:\1vjpp.exec:\1vjpp.exe49⤵
- Executes dropped EXE
PID:1888 -
\??\c:\djvvv.exec:\djvvv.exe50⤵
- Executes dropped EXE
PID:2452 -
\??\c:\dppjj.exec:\dppjj.exe51⤵
- Executes dropped EXE
PID:2428 -
\??\c:\5rrxfrf.exec:\5rrxfrf.exe52⤵
- Executes dropped EXE
PID:1948 -
\??\c:\frrxxfr.exec:\frrxxfr.exe53⤵
- Executes dropped EXE
PID:2772 -
\??\c:\fxxlxfl.exec:\fxxlxfl.exe54⤵
- Executes dropped EXE
PID:2600 -
\??\c:\tbnhnh.exec:\tbnhnh.exe55⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3hhnbh.exec:\3hhnbh.exe56⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jdjpd.exec:\jdjpd.exe57⤵
- Executes dropped EXE
PID:2052 -
\??\c:\fxxlxxr.exec:\fxxlxxr.exe58⤵
- Executes dropped EXE
PID:1076 -
\??\c:\thtthh.exec:\thtthh.exe59⤵
- Executes dropped EXE
PID:556 -
\??\c:\tnbbhh.exec:\tnbbhh.exe60⤵
- Executes dropped EXE
PID:584 -
\??\c:\9tnthh.exec:\9tnthh.exe61⤵
- Executes dropped EXE
PID:832 -
\??\c:\jdpvp.exec:\jdpvp.exe62⤵
- Executes dropped EXE
PID:1476 -
\??\c:\vvpvp.exec:\vvpvp.exe63⤵
- Executes dropped EXE
PID:2956 -
\??\c:\fffxlrf.exec:\fffxlrf.exe64⤵
- Executes dropped EXE
PID:1496 -
\??\c:\frflfxf.exec:\frflfxf.exe65⤵
- Executes dropped EXE
PID:2300 -
\??\c:\xxrxrxl.exec:\xxrxrxl.exe66⤵PID:1232
-
\??\c:\tnbhnh.exec:\tnbhnh.exe67⤵PID:1096
-
\??\c:\thnttn.exec:\thnttn.exe68⤵PID:2044
-
\??\c:\nttbhh.exec:\nttbhh.exe69⤵PID:1072
-
\??\c:\7vppv.exec:\7vppv.exe70⤵PID:1016
-
\??\c:\pdddj.exec:\pdddj.exe71⤵PID:1624
-
\??\c:\3pvdv.exec:\3pvdv.exe72⤵PID:1632
-
\??\c:\fxfxxxl.exec:\fxfxxxl.exe73⤵PID:1132
-
\??\c:\lxxrrll.exec:\lxxrrll.exe74⤵PID:2520
-
\??\c:\7nbtnn.exec:\7nbtnn.exe75⤵PID:3000
-
\??\c:\hbnnnh.exec:\hbnnnh.exe76⤵PID:2236
-
\??\c:\btnnnn.exec:\btnnnn.exe77⤵PID:2848
-
\??\c:\jdppv.exec:\jdppv.exe78⤵PID:1592
-
\??\c:\1dppv.exec:\1dppv.exe79⤵PID:2640
-
\??\c:\dpddv.exec:\dpddv.exe80⤵PID:2544
-
\??\c:\rrxflxr.exec:\rrxflxr.exe81⤵PID:2664
-
\??\c:\3frfxxx.exec:\3frfxxx.exe82⤵PID:2252
-
\??\c:\fffffxf.exec:\fffffxf.exe83⤵PID:2812
-
\??\c:\1bhhhh.exec:\1bhhhh.exe84⤵PID:2656
-
\??\c:\tntbnh.exec:\tntbnh.exe85⤵PID:2532
-
\??\c:\thttbh.exec:\thttbh.exe86⤵PID:2644
-
\??\c:\jvdpp.exec:\jvdpp.exe87⤵PID:3020
-
\??\c:\jpvpj.exec:\jpvpj.exe88⤵PID:2464
-
\??\c:\vpvpv.exec:\vpvpv.exe89⤵PID:1588
-
\??\c:\xffrlfr.exec:\xffrlfr.exe90⤵PID:1972
-
\??\c:\7rxlfxx.exec:\7rxlfxx.exe91⤵PID:940
-
\??\c:\rfllrrl.exec:\rfllrrl.exe92⤵PID:2500
-
\??\c:\ttnbnn.exec:\ttnbnn.exe93⤵PID:2696
-
\??\c:\nbnnbh.exec:\nbnnbh.exe94⤵PID:1640
-
\??\c:\tnhhnh.exec:\tnhhnh.exe95⤵PID:2808
-
\??\c:\dvdvv.exec:\dvdvv.exe96⤵PID:2836
-
\??\c:\vdjjj.exec:\vdjjj.exe97⤵PID:2260
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe98⤵PID:2816
-
\??\c:\1llllrr.exec:\1llllrr.exe99⤵PID:1436
-
\??\c:\3fxxflx.exec:\3fxxflx.exe100⤵PID:704
-
\??\c:\nhbnnb.exec:\nhbnnb.exe101⤵PID:1332
-
\??\c:\thtbtt.exec:\thtbtt.exe102⤵PID:956
-
\??\c:\nbhhnn.exec:\nbhhnn.exe103⤵PID:788
-
\??\c:\pdpvd.exec:\pdpvd.exe104⤵PID:2952
-
\??\c:\djppj.exec:\djppj.exe105⤵PID:1032
-
\??\c:\frffflr.exec:\frffflr.exe106⤵PID:1440
-
\??\c:\5xlrrlr.exec:\5xlrrlr.exe107⤵PID:1116
-
\??\c:\rffllrx.exec:\rffllrx.exe108⤵PID:2264
-
\??\c:\hthnbt.exec:\hthnbt.exe109⤵PID:2056
-
\??\c:\9bhbnn.exec:\9bhbnn.exe110⤵PID:636
-
\??\c:\bthhnn.exec:\bthhnn.exe111⤵PID:2028
-
\??\c:\pvpjp.exec:\pvpjp.exe112⤵PID:2256
-
\??\c:\ddvjd.exec:\ddvjd.exe113⤵PID:1172
-
\??\c:\lrfxrfx.exec:\lrfxrfx.exe114⤵PID:1620
-
\??\c:\1fflrlf.exec:\1fflrlf.exe115⤵PID:1248
-
\??\c:\llflflx.exec:\llflflx.exe116⤵PID:1316
-
\??\c:\lflllrx.exec:\lflllrx.exe117⤵PID:1216
-
\??\c:\bthnbn.exec:\bthnbn.exe118⤵PID:2168
-
\??\c:\ntthbn.exec:\ntthbn.exe119⤵PID:2216
-
\??\c:\nnhthh.exec:\nnhthh.exe120⤵PID:320
-
\??\c:\dvdjp.exec:\dvdjp.exe121⤵PID:2580
-
\??\c:\jdvdp.exec:\jdvdp.exe122⤵PID:2724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-