Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 01:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6b0285e52aed5874b68f0e3f1b6385d0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
6b0285e52aed5874b68f0e3f1b6385d0_NeikiAnalytics.exe
-
Size
54KB
-
MD5
6b0285e52aed5874b68f0e3f1b6385d0
-
SHA1
3f146da5132d476f644518ca0a45380e712e4608
-
SHA256
2fbdf44a3ee3ff8d9c2367e2e09fe797283bc7f5531b40c15467b45615bb9b28
-
SHA512
a219e3d1c7aa81692170556ea5b1f15e61571b6124b1bb29c67a2d03a27d7d64c72ce21f27253df620e21eab7e1847467c76ecd551824157623c1f5592037a41
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI57Bd:ymb3NkkiQ3mdBjFIVBd
Malware Config
Signatures
-
Detect Blackmoon payload 16 IoCs
resource yara_rule behavioral1/memory/1300-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/300-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/560-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1356-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1016-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2448 llflxfl.exe 2100 xrrlrrf.exe 2320 bthhtn.exe 2764 jvjpv.exe 2776 rlxxffr.exe 2816 btnbnn.exe 2696 tthtnn.exe 2544 lxffflx.exe 3064 rllrlxl.exe 300 djpjp.exe 2596 ddpvd.exe 2860 5xrxfrf.exe 1572 frrffll.exe 1784 bthhnn.exe 1556 jdpvj.exe 2240 3jpvj.exe 560 fllxrfr.exe 1384 3bnthh.exe 1636 3tnbnn.exe 632 jpvpp.exe 1748 rlfrflx.exe 1996 frllrrf.exe 2308 nhtbnn.exe 2060 jpdvd.exe 1788 jvpvd.exe 1356 rlrrflr.exe 1016 nbtbhh.exe 904 xrxfxxl.exe 1756 ntntbt.exe 848 hhbhth.exe 2252 1pjpd.exe 1504 jppvd.exe 3008 fxllrxf.exe 2208 lllxfrr.exe 2204 nnhtth.exe 2100 3nntbt.exe 2736 jdpdp.exe 2724 vvvpd.exe 2684 xxrflrx.exe 2708 fllfrxf.exe 2564 ntbntt.exe 2076 dvvjv.exe 2748 1dddv.exe 2592 xrrlfxl.exe 2584 9lxfxxl.exe 2412 bttnhn.exe 2580 nhbbht.exe 2716 dvvvd.exe 2856 xfrffff.exe 2868 lflrllr.exe 1952 hbttbh.exe 1916 nhhhtt.exe 316 vpjpd.exe 2176 7vjdp.exe 700 lxlxllx.exe 2876 5xflrxf.exe 1624 tnnnbb.exe 1408 9nbbnt.exe 1524 3dpvj.exe 3060 ddvdp.exe 1988 rlflflx.exe 1296 7rxllfl.exe 2328 nhnhbh.exe 832 vvvjj.exe -
resource yara_rule behavioral1/memory/1300-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/300-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/560-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1356-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-296-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1300 wrote to memory of 2448 1300 6b0285e52aed5874b68f0e3f1b6385d0_NeikiAnalytics.exe 28 PID 1300 wrote to memory of 2448 1300 6b0285e52aed5874b68f0e3f1b6385d0_NeikiAnalytics.exe 28 PID 1300 wrote to memory of 2448 1300 6b0285e52aed5874b68f0e3f1b6385d0_NeikiAnalytics.exe 28 PID 1300 wrote to memory of 2448 1300 6b0285e52aed5874b68f0e3f1b6385d0_NeikiAnalytics.exe 28 PID 2448 wrote to memory of 2100 2448 llflxfl.exe 29 PID 2448 wrote to memory of 2100 2448 llflxfl.exe 29 PID 2448 wrote to memory of 2100 2448 llflxfl.exe 29 PID 2448 wrote to memory of 2100 2448 llflxfl.exe 29 PID 2100 wrote to memory of 2320 2100 xrrlrrf.exe 30 PID 2100 wrote to memory of 2320 2100 xrrlrrf.exe 30 PID 2100 wrote to memory of 2320 2100 xrrlrrf.exe 30 PID 2100 wrote to memory of 2320 2100 xrrlrrf.exe 30 PID 2320 wrote to memory of 2764 2320 bthhtn.exe 31 PID 2320 wrote to memory of 2764 2320 bthhtn.exe 31 PID 2320 wrote to memory of 2764 2320 bthhtn.exe 31 PID 2320 wrote to memory of 2764 2320 bthhtn.exe 31 PID 2764 wrote to memory of 2776 2764 jvjpv.exe 32 PID 2764 wrote to memory of 2776 2764 jvjpv.exe 32 PID 2764 wrote to memory of 2776 2764 jvjpv.exe 32 PID 2764 wrote to memory of 2776 2764 jvjpv.exe 32 PID 2776 wrote to memory of 2816 2776 rlxxffr.exe 33 PID 2776 wrote to memory of 2816 2776 rlxxffr.exe 33 PID 2776 wrote to memory of 2816 2776 rlxxffr.exe 33 PID 2776 wrote to memory of 2816 2776 rlxxffr.exe 33 PID 2816 wrote to memory of 2696 2816 btnbnn.exe 34 PID 2816 wrote to memory of 2696 2816 btnbnn.exe 34 PID 2816 wrote to memory of 2696 2816 btnbnn.exe 34 PID 2816 wrote to memory of 2696 2816 btnbnn.exe 34 PID 2696 wrote to memory of 2544 2696 tthtnn.exe 35 PID 2696 wrote to memory of 2544 2696 tthtnn.exe 35 PID 2696 wrote to memory of 2544 2696 tthtnn.exe 35 PID 2696 wrote to memory of 2544 2696 tthtnn.exe 35 PID 2544 wrote to memory of 3064 2544 lxffflx.exe 36 PID 2544 wrote to memory of 3064 2544 lxffflx.exe 36 PID 2544 wrote to memory of 3064 2544 lxffflx.exe 36 PID 2544 wrote to memory of 3064 2544 lxffflx.exe 36 PID 3064 wrote to memory of 300 3064 rllrlxl.exe 37 PID 3064 wrote to memory of 300 3064 rllrlxl.exe 37 PID 3064 wrote to memory of 300 3064 rllrlxl.exe 37 PID 3064 wrote to memory of 300 3064 rllrlxl.exe 37 PID 300 wrote to memory of 2596 300 djpjp.exe 38 PID 300 wrote to memory of 2596 300 djpjp.exe 38 PID 300 wrote to memory of 2596 300 djpjp.exe 38 PID 300 wrote to memory of 2596 300 djpjp.exe 38 PID 2596 wrote to memory of 2860 2596 ddpvd.exe 39 PID 2596 wrote to memory of 2860 2596 ddpvd.exe 39 PID 2596 wrote to memory of 2860 2596 ddpvd.exe 39 PID 2596 wrote to memory of 2860 2596 ddpvd.exe 39 PID 2860 wrote to memory of 1572 2860 5xrxfrf.exe 40 PID 2860 wrote to memory of 1572 2860 5xrxfrf.exe 40 PID 2860 wrote to memory of 1572 2860 5xrxfrf.exe 40 PID 2860 wrote to memory of 1572 2860 5xrxfrf.exe 40 PID 1572 wrote to memory of 1784 1572 frrffll.exe 41 PID 1572 wrote to memory of 1784 1572 frrffll.exe 41 PID 1572 wrote to memory of 1784 1572 frrffll.exe 41 PID 1572 wrote to memory of 1784 1572 frrffll.exe 41 PID 1784 wrote to memory of 1556 1784 bthhnn.exe 42 PID 1784 wrote to memory of 1556 1784 bthhnn.exe 42 PID 1784 wrote to memory of 1556 1784 bthhnn.exe 42 PID 1784 wrote to memory of 1556 1784 bthhnn.exe 42 PID 1556 wrote to memory of 2240 1556 jdpvj.exe 43 PID 1556 wrote to memory of 2240 1556 jdpvj.exe 43 PID 1556 wrote to memory of 2240 1556 jdpvj.exe 43 PID 1556 wrote to memory of 2240 1556 jdpvj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b0285e52aed5874b68f0e3f1b6385d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6b0285e52aed5874b68f0e3f1b6385d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\llflxfl.exec:\llflxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\xrrlrrf.exec:\xrrlrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\bthhtn.exec:\bthhtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\jvjpv.exec:\jvjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\rlxxffr.exec:\rlxxffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\btnbnn.exec:\btnbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\tthtnn.exec:\tthtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\lxffflx.exec:\lxffflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\rllrlxl.exec:\rllrlxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\djpjp.exec:\djpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
\??\c:\ddpvd.exec:\ddpvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\5xrxfrf.exec:\5xrxfrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\frrffll.exec:\frrffll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\bthhnn.exec:\bthhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\jdpvj.exec:\jdpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\3jpvj.exec:\3jpvj.exe17⤵
- Executes dropped EXE
PID:2240 -
\??\c:\fllxrfr.exec:\fllxrfr.exe18⤵
- Executes dropped EXE
PID:560 -
\??\c:\3bnthh.exec:\3bnthh.exe19⤵
- Executes dropped EXE
PID:1384 -
\??\c:\3tnbnn.exec:\3tnbnn.exe20⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jpvpp.exec:\jpvpp.exe21⤵
- Executes dropped EXE
PID:632 -
\??\c:\rlfrflx.exec:\rlfrflx.exe22⤵
- Executes dropped EXE
PID:1748 -
\??\c:\frllrrf.exec:\frllrrf.exe23⤵
- Executes dropped EXE
PID:1996 -
\??\c:\nhtbnn.exec:\nhtbnn.exe24⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jpdvd.exec:\jpdvd.exe25⤵
- Executes dropped EXE
PID:2060 -
\??\c:\jvpvd.exec:\jvpvd.exe26⤵
- Executes dropped EXE
PID:1788 -
\??\c:\rlrrflr.exec:\rlrrflr.exe27⤵
- Executes dropped EXE
PID:1356 -
\??\c:\nbtbhh.exec:\nbtbhh.exe28⤵
- Executes dropped EXE
PID:1016 -
\??\c:\xrxfxxl.exec:\xrxfxxl.exe29⤵
- Executes dropped EXE
PID:904 -
\??\c:\ntntbt.exec:\ntntbt.exe30⤵
- Executes dropped EXE
PID:1756 -
\??\c:\hhbhth.exec:\hhbhth.exe31⤵
- Executes dropped EXE
PID:848 -
\??\c:\1pjpd.exec:\1pjpd.exe32⤵
- Executes dropped EXE
PID:2252 -
\??\c:\jppvd.exec:\jppvd.exe33⤵
- Executes dropped EXE
PID:1504 -
\??\c:\fxllrxf.exec:\fxllrxf.exe34⤵
- Executes dropped EXE
PID:3008 -
\??\c:\lllxfrr.exec:\lllxfrr.exe35⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nnhtth.exec:\nnhtth.exe36⤵
- Executes dropped EXE
PID:2204 -
\??\c:\3nntbt.exec:\3nntbt.exe37⤵
- Executes dropped EXE
PID:2100 -
\??\c:\jdpdp.exec:\jdpdp.exe38⤵
- Executes dropped EXE
PID:2736 -
\??\c:\vvvpd.exec:\vvvpd.exe39⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xxrflrx.exec:\xxrflrx.exe40⤵
- Executes dropped EXE
PID:2684 -
\??\c:\fllfrxf.exec:\fllfrxf.exe41⤵
- Executes dropped EXE
PID:2708 -
\??\c:\ntbntt.exec:\ntbntt.exe42⤵
- Executes dropped EXE
PID:2564 -
\??\c:\dvvjv.exec:\dvvjv.exe43⤵
- Executes dropped EXE
PID:2076 -
\??\c:\1dddv.exec:\1dddv.exe44⤵
- Executes dropped EXE
PID:2748 -
\??\c:\xrrlfxl.exec:\xrrlfxl.exe45⤵
- Executes dropped EXE
PID:2592 -
\??\c:\9lxfxxl.exec:\9lxfxxl.exe46⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bttnhn.exec:\bttnhn.exe47⤵
- Executes dropped EXE
PID:2412 -
\??\c:\nhbbht.exec:\nhbbht.exe48⤵
- Executes dropped EXE
PID:2580 -
\??\c:\dvvvd.exec:\dvvvd.exe49⤵
- Executes dropped EXE
PID:2716 -
\??\c:\xfrffff.exec:\xfrffff.exe50⤵
- Executes dropped EXE
PID:2856 -
\??\c:\lflrllr.exec:\lflrllr.exe51⤵
- Executes dropped EXE
PID:2868 -
\??\c:\hbttbh.exec:\hbttbh.exe52⤵
- Executes dropped EXE
PID:1952 -
\??\c:\nhhhtt.exec:\nhhhtt.exe53⤵
- Executes dropped EXE
PID:1916 -
\??\c:\vpjpd.exec:\vpjpd.exe54⤵
- Executes dropped EXE
PID:316 -
\??\c:\7vjdp.exec:\7vjdp.exe55⤵
- Executes dropped EXE
PID:2176 -
\??\c:\lxlxllx.exec:\lxlxllx.exe56⤵
- Executes dropped EXE
PID:700 -
\??\c:\5xflrxf.exec:\5xflrxf.exe57⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tnnnbb.exec:\tnnnbb.exe58⤵
- Executes dropped EXE
PID:1624 -
\??\c:\9nbbnt.exec:\9nbbnt.exe59⤵
- Executes dropped EXE
PID:1408 -
\??\c:\3dpvj.exec:\3dpvj.exe60⤵
- Executes dropped EXE
PID:1524 -
\??\c:\ddvdp.exec:\ddvdp.exe61⤵
- Executes dropped EXE
PID:3060 -
\??\c:\rlflflx.exec:\rlflflx.exe62⤵
- Executes dropped EXE
PID:1988 -
\??\c:\7rxllfl.exec:\7rxllfl.exe63⤵
- Executes dropped EXE
PID:1296 -
\??\c:\nhnhbh.exec:\nhnhbh.exe64⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vvvjj.exec:\vvvjj.exe65⤵
- Executes dropped EXE
PID:832 -
\??\c:\rlxxffl.exec:\rlxxffl.exe66⤵PID:2212
-
\??\c:\5fflxxl.exec:\5fflxxl.exe67⤵PID:1584
-
\??\c:\htnttb.exec:\htnttb.exe68⤵PID:1052
-
\??\c:\9pdjp.exec:\9pdjp.exe69⤵PID:1032
-
\??\c:\jddpp.exec:\jddpp.exe70⤵PID:1028
-
\??\c:\pdvdj.exec:\pdvdj.exe71⤵PID:2056
-
\??\c:\lflrffr.exec:\lflrffr.exe72⤵PID:2184
-
\??\c:\btnbhn.exec:\btnbhn.exe73⤵PID:836
-
\??\c:\3nhntt.exec:\3nhntt.exe74⤵PID:884
-
\??\c:\btbntb.exec:\btbntb.exe75⤵PID:1116
-
\??\c:\5jdjp.exec:\5jdjp.exe76⤵PID:2032
-
\??\c:\7vpvp.exec:\7vpvp.exe77⤵PID:1044
-
\??\c:\rfxxffl.exec:\rfxxffl.exe78⤵PID:1972
-
\??\c:\fxxlxfx.exec:\fxxlxfx.exe79⤵PID:2656
-
\??\c:\btnbnt.exec:\btnbnt.exe80⤵PID:1596
-
\??\c:\1jjdp.exec:\1jjdp.exe81⤵PID:2320
-
\??\c:\vpdjp.exec:\vpdjp.exe82⤵PID:2764
-
\??\c:\lxrxflx.exec:\lxrxflx.exe83⤵PID:2948
-
\??\c:\xlxlxff.exec:\xlxlxff.exe84⤵PID:2552
-
\??\c:\hbthhn.exec:\hbthhn.exe85⤵PID:2572
-
\??\c:\hbnbtt.exec:\hbnbtt.exe86⤵PID:2524
-
\??\c:\jjppv.exec:\jjppv.exe87⤵PID:2604
-
\??\c:\9pjjp.exec:\9pjjp.exe88⤵PID:2348
-
\??\c:\pjddp.exec:\pjddp.exe89⤵PID:3036
-
\??\c:\vpvjd.exec:\vpvjd.exe90⤵PID:1228
-
\??\c:\rllrfrf.exec:\rllrfrf.exe91⤵PID:2852
-
\??\c:\hhbhtb.exec:\hhbhtb.exe92⤵PID:2884
-
\??\c:\nhtthh.exec:\nhtthh.exe93⤵PID:1932
-
\??\c:\nbbhbh.exec:\nbbhbh.exe94⤵PID:1244
-
\??\c:\1pjjp.exec:\1pjjp.exe95⤵PID:1908
-
\??\c:\vpdjv.exec:\vpdjv.exe96⤵PID:1796
-
\??\c:\9rrflll.exec:\9rrflll.exe97⤵PID:316
-
\??\c:\fxlfrxl.exec:\fxlfrxl.exe98⤵PID:588
-
\??\c:\nhbnbt.exec:\nhbnbt.exe99⤵PID:1628
-
\??\c:\bbbbnt.exec:\bbbbnt.exe100⤵PID:2452
-
\??\c:\ddvdv.exec:\ddvdv.exe101⤵PID:2616
-
\??\c:\vpdpp.exec:\vpdpp.exe102⤵PID:1256
-
\??\c:\xrrrxxl.exec:\xrrrxxl.exe103⤵PID:3000
-
\??\c:\lxlxffr.exec:\lxlxffr.exe104⤵PID:1996
-
\??\c:\7hbnth.exec:\7hbnth.exe105⤵PID:2024
-
\??\c:\nhnthn.exec:\nhnthn.exe106⤵PID:2396
-
\??\c:\hbhtth.exec:\hbhtth.exe107⤵PID:2060
-
\??\c:\dvjpd.exec:\dvjpd.exe108⤵PID:912
-
\??\c:\7xrrxxr.exec:\7xrrxxr.exe109⤵PID:2212
-
\??\c:\lfxlrfl.exec:\lfxlrfl.exe110⤵PID:1584
-
\??\c:\bhtntn.exec:\bhtntn.exe111⤵PID:1016
-
\??\c:\htbntb.exec:\htbntb.exe112⤵PID:2256
-
\??\c:\xrlrrrf.exec:\xrlrrrf.exe113⤵PID:2108
-
\??\c:\frxlxrx.exec:\frxlxrx.exe114⤵PID:1724
-
\??\c:\3rlrlfl.exec:\3rlrlfl.exe115⤵PID:2444
-
\??\c:\ntbttb.exec:\ntbttb.exe116⤵PID:2116
-
\??\c:\bnbbtt.exec:\bnbbtt.exe117⤵PID:2012
-
\??\c:\pdjdj.exec:\pdjdj.exe118⤵PID:2096
-
\??\c:\jddjv.exec:\jddjv.exe119⤵PID:2036
-
\??\c:\xxlrxfx.exec:\xxlrxfx.exe120⤵PID:3068
-
\??\c:\fxrlxxl.exec:\fxrlxxl.exe121⤵PID:2000
-
\??\c:\bthtnt.exec:\bthtnt.exe122⤵PID:2960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-