Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 21:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
38d95353709f8b18cebd1657f425eb10_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
38d95353709f8b18cebd1657f425eb10_NeikiAnalytics.exe
-
Size
119KB
-
MD5
38d95353709f8b18cebd1657f425eb10
-
SHA1
3fc9d074a3b22c3f2bffb7211fc6b78cb549923f
-
SHA256
5068c6eea3b268cdef54771b5b2049b8a49b003b07c7870861eec7d239fc01d8
-
SHA512
35bfbd2afab02816d0bbe4a348355e8fe449a8e1e33642bb711588435e6a25966b722ceb4e743f41b8dd99d4a5f53e4678e9ec519852f518d0c6e6c843727328
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDomRGApSuLAR2yPBCQ1nDFu1Q8so:ymb3NkkiQ3mdBjFomR7UsyJC+n0Gsgcl
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2936-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1680-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1072-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/604-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/796-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1100-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1680 5jvvj.exe 2624 3frrllr.exe 3004 bthhtt.exe 2668 vpddj.exe 2708 rlxxflx.exe 2732 1bbnbh.exe 2512 jvpjv.exe 2520 vjvdd.exe 776 rrffrfl.exe 2500 fxllflf.exe 2748 bbnthh.exe 2808 dvvdp.exe 2240 flrlxrr.exe 1976 lfxflrl.exe 2180 1nntht.exe 1864 1dpvp.exe 1072 3vddp.exe 1048 7lxxfxf.exe 2132 bnttbb.exe 2800 hbnnbb.exe 2856 vjpvj.exe 604 xrlxllx.exe 592 fxffflx.exe 3016 btbhhn.exe 1096 vpjpv.exe 796 rrfrrlf.exe 1100 hbhnhn.exe 2836 pvvpj.exe 1316 jvjpd.exe 2316 3lflrxl.exe 1728 hhbbtt.exe 2528 hhbnhb.exe 3036 jdvjd.exe 2768 3jdvv.exe 2168 rxxrxrf.exe 2284 tntthn.exe 2648 nthtbh.exe 2596 pjpvd.exe 2668 llxxfxl.exe 2472 lllrxfr.exe 2264 tnbtbh.exe 2448 9htbnt.exe 2568 vpdjp.exe 2524 lrlrflx.exe 640 xrxxffr.exe 2628 tnhnbh.exe 2500 nhbhhn.exe 2748 1jvpd.exe 2700 jpdvp.exe 2888 5rflxlf.exe 1196 rxrxrfl.exe 2328 ntnhnt.exe 2180 jpvjp.exe 1436 jjjpd.exe 1664 rrfxffx.exe 2244 rllrfrl.exe 2104 thhhht.exe 1536 bbnthh.exe 2428 jpppj.exe 536 pdjjd.exe 2268 lxlxrlx.exe 604 lfxxlrx.exe 992 thtntt.exe 1800 jdjjv.exe -
resource yara_rule behavioral1/memory/2936-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1680-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1680-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1072-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/604-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/796-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1100-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 1680 2936 38d95353709f8b18cebd1657f425eb10_NeikiAnalytics.exe 28 PID 2936 wrote to memory of 1680 2936 38d95353709f8b18cebd1657f425eb10_NeikiAnalytics.exe 28 PID 2936 wrote to memory of 1680 2936 38d95353709f8b18cebd1657f425eb10_NeikiAnalytics.exe 28 PID 2936 wrote to memory of 1680 2936 38d95353709f8b18cebd1657f425eb10_NeikiAnalytics.exe 28 PID 1680 wrote to memory of 2624 1680 5jvvj.exe 29 PID 1680 wrote to memory of 2624 1680 5jvvj.exe 29 PID 1680 wrote to memory of 2624 1680 5jvvj.exe 29 PID 1680 wrote to memory of 2624 1680 5jvvj.exe 29 PID 2624 wrote to memory of 3004 2624 3frrllr.exe 30 PID 2624 wrote to memory of 3004 2624 3frrllr.exe 30 PID 2624 wrote to memory of 3004 2624 3frrllr.exe 30 PID 2624 wrote to memory of 3004 2624 3frrllr.exe 30 PID 3004 wrote to memory of 2668 3004 bthhtt.exe 31 PID 3004 wrote to memory of 2668 3004 bthhtt.exe 31 PID 3004 wrote to memory of 2668 3004 bthhtt.exe 31 PID 3004 wrote to memory of 2668 3004 bthhtt.exe 31 PID 2668 wrote to memory of 2708 2668 vpddj.exe 32 PID 2668 wrote to memory of 2708 2668 vpddj.exe 32 PID 2668 wrote to memory of 2708 2668 vpddj.exe 32 PID 2668 wrote to memory of 2708 2668 vpddj.exe 32 PID 2708 wrote to memory of 2732 2708 rlxxflx.exe 33 PID 2708 wrote to memory of 2732 2708 rlxxflx.exe 33 PID 2708 wrote to memory of 2732 2708 rlxxflx.exe 33 PID 2708 wrote to memory of 2732 2708 rlxxflx.exe 33 PID 2732 wrote to memory of 2512 2732 1bbnbh.exe 34 PID 2732 wrote to memory of 2512 2732 1bbnbh.exe 34 PID 2732 wrote to memory of 2512 2732 1bbnbh.exe 34 PID 2732 wrote to memory of 2512 2732 1bbnbh.exe 34 PID 2512 wrote to memory of 2520 2512 jvpjv.exe 35 PID 2512 wrote to memory of 2520 2512 jvpjv.exe 35 PID 2512 wrote to memory of 2520 2512 jvpjv.exe 35 PID 2512 wrote to memory of 2520 2512 jvpjv.exe 35 PID 2520 wrote to memory of 776 2520 vjvdd.exe 36 PID 2520 wrote to memory of 776 2520 vjvdd.exe 36 PID 2520 wrote to memory of 776 2520 vjvdd.exe 36 PID 2520 wrote to memory of 776 2520 vjvdd.exe 36 PID 776 wrote to memory of 2500 776 rrffrfl.exe 37 PID 776 wrote to memory of 2500 776 rrffrfl.exe 37 PID 776 wrote to memory of 2500 776 rrffrfl.exe 37 PID 776 wrote to memory of 2500 776 rrffrfl.exe 37 PID 2500 wrote to memory of 2748 2500 fxllflf.exe 38 PID 2500 wrote to memory of 2748 2500 fxllflf.exe 38 PID 2500 wrote to memory of 2748 2500 fxllflf.exe 38 PID 2500 wrote to memory of 2748 2500 fxllflf.exe 38 PID 2748 wrote to memory of 2808 2748 bbnthh.exe 39 PID 2748 wrote to memory of 2808 2748 bbnthh.exe 39 PID 2748 wrote to memory of 2808 2748 bbnthh.exe 39 PID 2748 wrote to memory of 2808 2748 bbnthh.exe 39 PID 2808 wrote to memory of 2240 2808 dvvdp.exe 40 PID 2808 wrote to memory of 2240 2808 dvvdp.exe 40 PID 2808 wrote to memory of 2240 2808 dvvdp.exe 40 PID 2808 wrote to memory of 2240 2808 dvvdp.exe 40 PID 2240 wrote to memory of 1976 2240 flrlxrr.exe 41 PID 2240 wrote to memory of 1976 2240 flrlxrr.exe 41 PID 2240 wrote to memory of 1976 2240 flrlxrr.exe 41 PID 2240 wrote to memory of 1976 2240 flrlxrr.exe 41 PID 1976 wrote to memory of 2180 1976 lfxflrl.exe 42 PID 1976 wrote to memory of 2180 1976 lfxflrl.exe 42 PID 1976 wrote to memory of 2180 1976 lfxflrl.exe 42 PID 1976 wrote to memory of 2180 1976 lfxflrl.exe 42 PID 2180 wrote to memory of 1864 2180 1nntht.exe 43 PID 2180 wrote to memory of 1864 2180 1nntht.exe 43 PID 2180 wrote to memory of 1864 2180 1nntht.exe 43 PID 2180 wrote to memory of 1864 2180 1nntht.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\38d95353709f8b18cebd1657f425eb10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\38d95353709f8b18cebd1657f425eb10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\5jvvj.exec:\5jvvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\3frrllr.exec:\3frrllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\bthhtt.exec:\bthhtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\vpddj.exec:\vpddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\rlxxflx.exec:\rlxxflx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\1bbnbh.exec:\1bbnbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\jvpjv.exec:\jvpjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\vjvdd.exec:\vjvdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\rrffrfl.exec:\rrffrfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\fxllflf.exec:\fxllflf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\bbnthh.exec:\bbnthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\dvvdp.exec:\dvvdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\flrlxrr.exec:\flrlxrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\lfxflrl.exec:\lfxflrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\1nntht.exec:\1nntht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\1dpvp.exec:\1dpvp.exe17⤵
- Executes dropped EXE
PID:1864 -
\??\c:\3vddp.exec:\3vddp.exe18⤵
- Executes dropped EXE
PID:1072 -
\??\c:\7lxxfxf.exec:\7lxxfxf.exe19⤵
- Executes dropped EXE
PID:1048 -
\??\c:\bnttbb.exec:\bnttbb.exe20⤵
- Executes dropped EXE
PID:2132 -
\??\c:\hbnnbb.exec:\hbnnbb.exe21⤵
- Executes dropped EXE
PID:2800 -
\??\c:\vjpvj.exec:\vjpvj.exe22⤵
- Executes dropped EXE
PID:2856 -
\??\c:\xrlxllx.exec:\xrlxllx.exe23⤵
- Executes dropped EXE
PID:604 -
\??\c:\fxffflx.exec:\fxffflx.exe24⤵
- Executes dropped EXE
PID:592 -
\??\c:\btbhhn.exec:\btbhhn.exe25⤵
- Executes dropped EXE
PID:3016 -
\??\c:\vpjpv.exec:\vpjpv.exe26⤵
- Executes dropped EXE
PID:1096 -
\??\c:\rrfrrlf.exec:\rrfrrlf.exe27⤵
- Executes dropped EXE
PID:796 -
\??\c:\hbhnhn.exec:\hbhnhn.exe28⤵
- Executes dropped EXE
PID:1100 -
\??\c:\pvvpj.exec:\pvvpj.exe29⤵
- Executes dropped EXE
PID:2836 -
\??\c:\jvjpd.exec:\jvjpd.exe30⤵
- Executes dropped EXE
PID:1316 -
\??\c:\3lflrxl.exec:\3lflrxl.exe31⤵
- Executes dropped EXE
PID:2316 -
\??\c:\hhbbtt.exec:\hhbbtt.exe32⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hhbnhb.exec:\hhbnhb.exe33⤵
- Executes dropped EXE
PID:2528 -
\??\c:\jdvjd.exec:\jdvjd.exe34⤵
- Executes dropped EXE
PID:3036 -
\??\c:\3jdvv.exec:\3jdvv.exe35⤵
- Executes dropped EXE
PID:2768 -
\??\c:\rxxrxrf.exec:\rxxrxrf.exe36⤵
- Executes dropped EXE
PID:2168 -
\??\c:\tntthn.exec:\tntthn.exe37⤵
- Executes dropped EXE
PID:2284 -
\??\c:\nthtbh.exec:\nthtbh.exe38⤵
- Executes dropped EXE
PID:2648 -
\??\c:\pjpvd.exec:\pjpvd.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\llxxfxl.exec:\llxxfxl.exe40⤵
- Executes dropped EXE
PID:2668 -
\??\c:\lllrxfr.exec:\lllrxfr.exe41⤵
- Executes dropped EXE
PID:2472 -
\??\c:\tnbtbh.exec:\tnbtbh.exe42⤵
- Executes dropped EXE
PID:2264 -
\??\c:\9htbnt.exec:\9htbnt.exe43⤵
- Executes dropped EXE
PID:2448 -
\??\c:\vpdjp.exec:\vpdjp.exe44⤵
- Executes dropped EXE
PID:2568 -
\??\c:\lrlrflx.exec:\lrlrflx.exe45⤵
- Executes dropped EXE
PID:2524 -
\??\c:\xrxxffr.exec:\xrxxffr.exe46⤵
- Executes dropped EXE
PID:640 -
\??\c:\tnhnbh.exec:\tnhnbh.exe47⤵
- Executes dropped EXE
PID:2628 -
\??\c:\nhbhhn.exec:\nhbhhn.exe48⤵
- Executes dropped EXE
PID:2500 -
\??\c:\1jvpd.exec:\1jvpd.exe49⤵
- Executes dropped EXE
PID:2748 -
\??\c:\jpdvp.exec:\jpdvp.exe50⤵
- Executes dropped EXE
PID:2700 -
\??\c:\5rflxlf.exec:\5rflxlf.exe51⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rxrxrfl.exec:\rxrxrfl.exe52⤵
- Executes dropped EXE
PID:1196 -
\??\c:\ntnhnt.exec:\ntnhnt.exe53⤵
- Executes dropped EXE
PID:2328 -
\??\c:\jpvjp.exec:\jpvjp.exe54⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jjjpd.exec:\jjjpd.exe55⤵
- Executes dropped EXE
PID:1436 -
\??\c:\rrfxffx.exec:\rrfxffx.exe56⤵
- Executes dropped EXE
PID:1664 -
\??\c:\rllrfrl.exec:\rllrfrl.exe57⤵
- Executes dropped EXE
PID:2244 -
\??\c:\thhhht.exec:\thhhht.exe58⤵
- Executes dropped EXE
PID:2104 -
\??\c:\bbnthh.exec:\bbnthh.exe59⤵
- Executes dropped EXE
PID:1536 -
\??\c:\jpppj.exec:\jpppj.exe60⤵
- Executes dropped EXE
PID:2428 -
\??\c:\pdjjd.exec:\pdjjd.exe61⤵
- Executes dropped EXE
PID:536 -
\??\c:\lxlxrlx.exec:\lxlxrlx.exe62⤵
- Executes dropped EXE
PID:2268 -
\??\c:\lfxxlrx.exec:\lfxxlrx.exe63⤵
- Executes dropped EXE
PID:604 -
\??\c:\thtntt.exec:\thtntt.exe64⤵
- Executes dropped EXE
PID:992 -
\??\c:\jdjjv.exec:\jdjjv.exe65⤵
- Executes dropped EXE
PID:1800 -
\??\c:\1vvdv.exec:\1vvdv.exe66⤵PID:2416
-
\??\c:\lxlxxff.exec:\lxlxxff.exe67⤵PID:404
-
\??\c:\rlrrxrf.exec:\rlrrxrf.exe68⤵PID:912
-
\??\c:\bntbnn.exec:\bntbnn.exe69⤵PID:2068
-
\??\c:\tnhntt.exec:\tnhntt.exe70⤵PID:1824
-
\??\c:\ddvvj.exec:\ddvvj.exe71⤵PID:2348
-
\??\c:\lrfrfrr.exec:\lrfrfrr.exe72⤵PID:3060
-
\??\c:\xlxffxx.exec:\xlxffxx.exe73⤵PID:2020
-
\??\c:\1htnnn.exec:\1htnnn.exe74⤵PID:2936
-
\??\c:\nhthnn.exec:\nhthnn.exe75⤵PID:2056
-
\??\c:\dvppv.exec:\dvppv.exe76⤵PID:2148
-
\??\c:\dddpp.exec:\dddpp.exe77⤵PID:1804
-
\??\c:\lffrrxx.exec:\lffrrxx.exe78⤵PID:1708
-
\??\c:\3flffrr.exec:\3flffrr.exe79⤵PID:2624
-
\??\c:\nhbbnt.exec:\nhbbnt.exe80⤵PID:2652
-
\??\c:\ppjvp.exec:\ppjvp.exe81⤵PID:2456
-
\??\c:\dpvdd.exec:\dpvdd.exe82⤵PID:2484
-
\??\c:\5lrlrlr.exec:\5lrlrlr.exe83⤵PID:2948
-
\??\c:\tnhntb.exec:\tnhntb.exe84⤵PID:2212
-
\??\c:\nbhbhn.exec:\nbhbhn.exe85⤵PID:2468
-
\??\c:\jjpjj.exec:\jjpjj.exe86⤵PID:2444
-
\??\c:\pddvd.exec:\pddvd.exe87⤵PID:2924
-
\??\c:\lxllrxx.exec:\lxllrxx.exe88⤵PID:1432
-
\??\c:\3flrrfx.exec:\3flrrfx.exe89⤵PID:1696
-
\??\c:\tnntth.exec:\tnntth.exe90⤵PID:2744
-
\??\c:\nbttbn.exec:\nbttbn.exe91⤵PID:2548
-
\??\c:\pjvvp.exec:\pjvvp.exe92⤵PID:2808
-
\??\c:\rflfxxx.exec:\rflfxxx.exe93⤵PID:1296
-
\??\c:\frrxxfl.exec:\frrxxfl.exe94⤵PID:1704
-
\??\c:\hbtbnh.exec:\hbtbnh.exe95⤵PID:1584
-
\??\c:\tbhtbb.exec:\tbhtbb.exe96⤵PID:2228
-
\??\c:\vpvvp.exec:\vpvvp.exe97⤵PID:1056
-
\??\c:\frlllrf.exec:\frlllrf.exe98⤵PID:1072
-
\??\c:\xrrrfff.exec:\xrrrfff.exe99⤵PID:2252
-
\??\c:\thnthb.exec:\thnthb.exe100⤵PID:2432
-
\??\c:\nbhhnn.exec:\nbhhnn.exe101⤵PID:2128
-
\??\c:\vpdpd.exec:\vpdpd.exe102⤵PID:2080
-
\??\c:\1jdjd.exec:\1jdjd.exe103⤵PID:2856
-
\??\c:\ffrlrfr.exec:\ffrlrfr.exe104⤵PID:1112
-
\??\c:\9lxxflr.exec:\9lxxflr.exe105⤵PID:1300
-
\??\c:\htbbhn.exec:\htbbhn.exe106⤵PID:1480
-
\??\c:\hhthnb.exec:\hhthnb.exe107⤵PID:2028
-
\??\c:\dvjjv.exec:\dvjjv.exe108⤵PID:1380
-
\??\c:\3vvdp.exec:\3vvdp.exe109⤵PID:1192
-
\??\c:\1rllflx.exec:\1rllflx.exe110⤵PID:1568
-
\??\c:\xrllrlx.exec:\xrllrlx.exe111⤵PID:568
-
\??\c:\3hnhhh.exec:\3hnhhh.exe112⤵PID:996
-
\??\c:\tnbbnb.exec:\tnbbnb.exe113⤵PID:1316
-
\??\c:\dvdpj.exec:\dvdpj.exe114⤵PID:1808
-
\??\c:\fffxflf.exec:\fffxflf.exe115⤵PID:1508
-
\??\c:\lxllxxf.exec:\lxllxxf.exe116⤵PID:1744
-
\??\c:\bttbth.exec:\bttbth.exe117⤵PID:1612
-
\??\c:\nnbnbn.exec:\nnbnbn.exe118⤵PID:1732
-
\??\c:\pdpvj.exec:\pdpvj.exe119⤵PID:1252
-
\??\c:\frflxfr.exec:\frflxfr.exe120⤵PID:2632
-
\??\c:\rrfxlrf.exec:\rrfxlrf.exe121⤵PID:2588
-
\??\c:\bntbnh.exec:\bntbnh.exe122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-