Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 02:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f434b431e89b8ecac1176379a78abd0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
7f434b431e89b8ecac1176379a78abd0_NeikiAnalytics.exe
-
Size
145KB
-
MD5
7f434b431e89b8ecac1176379a78abd0
-
SHA1
1df15181f3de4979f9ac54682d3f88583dc8a078
-
SHA256
6a05593454675174bf1868f1cd715305f47d3ad77af307b6f007240132f73f4a
-
SHA512
ba21a2dd9e6c4b2893631dd113fe5bc73be2d4c0d4c8e7af15ce968e6dac773442731240c3a0d03e63503fbe11d08ed7a219e2fd8a87dbb76b4ea27ca2029634
-
SSDEEP
3072:ymb3NkkiQ3mdBjFosxXGPXbXQMFHLgDWSmklgQI:n3C9BRosxW8MFHLMW7QI
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1968-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-62-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2596-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/708-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/496-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1076-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1244-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/412-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1312-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2688 3pjdj.exe 2624 fllxxrl.exe 2560 3thhhn.exe 2680 jvddd.exe 2696 3jdvv.exe 2520 xrlrxrx.exe 2528 htbtnn.exe 1516 9vjdd.exe 2596 xrfflxf.exe 2860 3rxrxfr.exe 1172 hbhhnt.exe 856 1hntbt.exe 1872 jvvpj.exe 868 xrflrlr.exe 2476 rrfxfff.exe 708 hhhtnb.exe 2044 7pjjp.exe 2504 9xfxlxr.exe 496 lfrxrrl.exe 1376 5hhnbb.exe 2220 djjpv.exe 1076 lxrlxxr.exe 1792 bnhhbb.exe 1244 bbhhbb.exe 412 5pdvv.exe 320 fflrrlf.exe 1448 tnbbnt.exe 1628 pdpdd.exe 1644 xrxflrf.exe 1312 9fxflrr.exe 900 hbnnnn.exe 2820 pdjvv.exe 1980 lxfflfx.exe 2648 bnnntt.exe 2672 tnnhnn.exe 2540 jdvdj.exe 2988 pdpvv.exe 2604 7nbttt.exe 2660 nbthht.exe 2424 1jppv.exe 2520 frrfrlf.exe 2992 3xrxlrf.exe 2228 1tnthn.exe 1216 9nntht.exe 2596 1jpvd.exe 2384 jdppv.exe 556 lxllrll.exe 1576 nhtttb.exe 856 5hbbnn.exe 2140 5dpjj.exe 1680 1vjdj.exe 1292 lrxllxl.exe 860 7hhnbb.exe 2032 bbntnb.exe 1028 jvdvj.exe 2040 jppdv.exe 2052 xrxfllr.exe 2236 tbhtbt.exe 2240 hbttbh.exe 624 dpdjj.exe 1400 vppjp.exe 852 fxxxffr.exe 652 7xrfrxx.exe 3012 bnthhh.exe -
resource yara_rule behavioral1/memory/1968-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/708-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/496-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1076-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1244-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/412-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1312-293-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2688 1968 7f434b431e89b8ecac1176379a78abd0_NeikiAnalytics.exe 28 PID 1968 wrote to memory of 2688 1968 7f434b431e89b8ecac1176379a78abd0_NeikiAnalytics.exe 28 PID 1968 wrote to memory of 2688 1968 7f434b431e89b8ecac1176379a78abd0_NeikiAnalytics.exe 28 PID 1968 wrote to memory of 2688 1968 7f434b431e89b8ecac1176379a78abd0_NeikiAnalytics.exe 28 PID 2688 wrote to memory of 2624 2688 3pjdj.exe 29 PID 2688 wrote to memory of 2624 2688 3pjdj.exe 29 PID 2688 wrote to memory of 2624 2688 3pjdj.exe 29 PID 2688 wrote to memory of 2624 2688 3pjdj.exe 29 PID 2624 wrote to memory of 2560 2624 fllxxrl.exe 30 PID 2624 wrote to memory of 2560 2624 fllxxrl.exe 30 PID 2624 wrote to memory of 2560 2624 fllxxrl.exe 30 PID 2624 wrote to memory of 2560 2624 fllxxrl.exe 30 PID 2560 wrote to memory of 2680 2560 3thhhn.exe 31 PID 2560 wrote to memory of 2680 2560 3thhhn.exe 31 PID 2560 wrote to memory of 2680 2560 3thhhn.exe 31 PID 2560 wrote to memory of 2680 2560 3thhhn.exe 31 PID 2680 wrote to memory of 2696 2680 jvddd.exe 32 PID 2680 wrote to memory of 2696 2680 jvddd.exe 32 PID 2680 wrote to memory of 2696 2680 jvddd.exe 32 PID 2680 wrote to memory of 2696 2680 jvddd.exe 32 PID 2696 wrote to memory of 2520 2696 3jdvv.exe 33 PID 2696 wrote to memory of 2520 2696 3jdvv.exe 33 PID 2696 wrote to memory of 2520 2696 3jdvv.exe 33 PID 2696 wrote to memory of 2520 2696 3jdvv.exe 33 PID 2520 wrote to memory of 2528 2520 xrlrxrx.exe 34 PID 2520 wrote to memory of 2528 2520 xrlrxrx.exe 34 PID 2520 wrote to memory of 2528 2520 xrlrxrx.exe 34 PID 2520 wrote to memory of 2528 2520 xrlrxrx.exe 34 PID 2528 wrote to memory of 1516 2528 htbtnn.exe 35 PID 2528 wrote to memory of 1516 2528 htbtnn.exe 35 PID 2528 wrote to memory of 1516 2528 htbtnn.exe 35 PID 2528 wrote to memory of 1516 2528 htbtnn.exe 35 PID 1516 wrote to memory of 2596 1516 9vjdd.exe 36 PID 1516 wrote to memory of 2596 1516 9vjdd.exe 36 PID 1516 wrote to memory of 2596 1516 9vjdd.exe 36 PID 1516 wrote to memory of 2596 1516 9vjdd.exe 36 PID 2596 wrote to memory of 2860 2596 xrfflxf.exe 37 PID 2596 wrote to memory of 2860 2596 xrfflxf.exe 37 PID 2596 wrote to memory of 2860 2596 xrfflxf.exe 37 PID 2596 wrote to memory of 2860 2596 xrfflxf.exe 37 PID 2860 wrote to memory of 1172 2860 3rxrxfr.exe 38 PID 2860 wrote to memory of 1172 2860 3rxrxfr.exe 38 PID 2860 wrote to memory of 1172 2860 3rxrxfr.exe 38 PID 2860 wrote to memory of 1172 2860 3rxrxfr.exe 38 PID 1172 wrote to memory of 856 1172 hbhhnt.exe 39 PID 1172 wrote to memory of 856 1172 hbhhnt.exe 39 PID 1172 wrote to memory of 856 1172 hbhhnt.exe 39 PID 1172 wrote to memory of 856 1172 hbhhnt.exe 39 PID 856 wrote to memory of 1872 856 1hntbt.exe 40 PID 856 wrote to memory of 1872 856 1hntbt.exe 40 PID 856 wrote to memory of 1872 856 1hntbt.exe 40 PID 856 wrote to memory of 1872 856 1hntbt.exe 40 PID 1872 wrote to memory of 868 1872 jvvpj.exe 41 PID 1872 wrote to memory of 868 1872 jvvpj.exe 41 PID 1872 wrote to memory of 868 1872 jvvpj.exe 41 PID 1872 wrote to memory of 868 1872 jvvpj.exe 41 PID 868 wrote to memory of 2476 868 xrflrlr.exe 42 PID 868 wrote to memory of 2476 868 xrflrlr.exe 42 PID 868 wrote to memory of 2476 868 xrflrlr.exe 42 PID 868 wrote to memory of 2476 868 xrflrlr.exe 42 PID 2476 wrote to memory of 708 2476 rrfxfff.exe 43 PID 2476 wrote to memory of 708 2476 rrfxfff.exe 43 PID 2476 wrote to memory of 708 2476 rrfxfff.exe 43 PID 2476 wrote to memory of 708 2476 rrfxfff.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f434b431e89b8ecac1176379a78abd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7f434b431e89b8ecac1176379a78abd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\3pjdj.exec:\3pjdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\fllxxrl.exec:\fllxxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\3thhhn.exec:\3thhhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\jvddd.exec:\jvddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\3jdvv.exec:\3jdvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\xrlrxrx.exec:\xrlrxrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\htbtnn.exec:\htbtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\9vjdd.exec:\9vjdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\xrfflxf.exec:\xrfflxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\3rxrxfr.exec:\3rxrxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\hbhhnt.exec:\hbhhnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\1hntbt.exec:\1hntbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\jvvpj.exec:\jvvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\xrflrlr.exec:\xrflrlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\rrfxfff.exec:\rrfxfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\hhhtnb.exec:\hhhtnb.exe17⤵
- Executes dropped EXE
PID:708 -
\??\c:\7pjjp.exec:\7pjjp.exe18⤵
- Executes dropped EXE
PID:2044 -
\??\c:\9xfxlxr.exec:\9xfxlxr.exe19⤵
- Executes dropped EXE
PID:2504 -
\??\c:\lfrxrrl.exec:\lfrxrrl.exe20⤵
- Executes dropped EXE
PID:496 -
\??\c:\5hhnbb.exec:\5hhnbb.exe21⤵
- Executes dropped EXE
PID:1376 -
\??\c:\djjpv.exec:\djjpv.exe22⤵
- Executes dropped EXE
PID:2220 -
\??\c:\lxrlxxr.exec:\lxrlxxr.exe23⤵
- Executes dropped EXE
PID:1076 -
\??\c:\bnhhbb.exec:\bnhhbb.exe24⤵
- Executes dropped EXE
PID:1792 -
\??\c:\bbhhbb.exec:\bbhhbb.exe25⤵
- Executes dropped EXE
PID:1244 -
\??\c:\5pdvv.exec:\5pdvv.exe26⤵
- Executes dropped EXE
PID:412 -
\??\c:\fflrrlf.exec:\fflrrlf.exe27⤵
- Executes dropped EXE
PID:320 -
\??\c:\tnbbnt.exec:\tnbbnt.exe28⤵
- Executes dropped EXE
PID:1448 -
\??\c:\pdpdd.exec:\pdpdd.exe29⤵
- Executes dropped EXE
PID:1628 -
\??\c:\xrxflrf.exec:\xrxflrf.exe30⤵
- Executes dropped EXE
PID:1644 -
\??\c:\9fxflrr.exec:\9fxflrr.exe31⤵
- Executes dropped EXE
PID:1312 -
\??\c:\hbnnnn.exec:\hbnnnn.exe32⤵
- Executes dropped EXE
PID:900 -
\??\c:\pdjvv.exec:\pdjvv.exe33⤵
- Executes dropped EXE
PID:2820 -
\??\c:\1lxfflr.exec:\1lxfflr.exe34⤵PID:1532
-
\??\c:\lxfflfx.exec:\lxfflfx.exe35⤵
- Executes dropped EXE
PID:1980 -
\??\c:\bnnntt.exec:\bnnntt.exe36⤵
- Executes dropped EXE
PID:2648 -
\??\c:\tnnhnn.exec:\tnnhnn.exe37⤵
- Executes dropped EXE
PID:2672 -
\??\c:\jdvdj.exec:\jdvdj.exe38⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pdpvv.exec:\pdpvv.exe39⤵
- Executes dropped EXE
PID:2988 -
\??\c:\7nbttt.exec:\7nbttt.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\nbthht.exec:\nbthht.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\1jppv.exec:\1jppv.exe42⤵
- Executes dropped EXE
PID:2424 -
\??\c:\frrfrlf.exec:\frrfrlf.exe43⤵
- Executes dropped EXE
PID:2520 -
\??\c:\3xrxlrf.exec:\3xrxlrf.exe44⤵
- Executes dropped EXE
PID:2992 -
\??\c:\1tnthn.exec:\1tnthn.exe45⤵
- Executes dropped EXE
PID:2228 -
\??\c:\9nntht.exec:\9nntht.exe46⤵
- Executes dropped EXE
PID:1216 -
\??\c:\1jpvd.exec:\1jpvd.exe47⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jdppv.exec:\jdppv.exe48⤵
- Executes dropped EXE
PID:2384 -
\??\c:\lxllrll.exec:\lxllrll.exe49⤵
- Executes dropped EXE
PID:556 -
\??\c:\nhtttb.exec:\nhtttb.exe50⤵
- Executes dropped EXE
PID:1576 -
\??\c:\5hbbnn.exec:\5hbbnn.exe51⤵
- Executes dropped EXE
PID:856 -
\??\c:\5dpjj.exec:\5dpjj.exe52⤵
- Executes dropped EXE
PID:2140 -
\??\c:\1vjdj.exec:\1vjdj.exe53⤵
- Executes dropped EXE
PID:1680 -
\??\c:\lrxllxl.exec:\lrxllxl.exe54⤵
- Executes dropped EXE
PID:1292 -
\??\c:\7hhnbb.exec:\7hhnbb.exe55⤵
- Executes dropped EXE
PID:860 -
\??\c:\bbntnb.exec:\bbntnb.exe56⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jvdvj.exec:\jvdvj.exe57⤵
- Executes dropped EXE
PID:1028 -
\??\c:\jppdv.exec:\jppdv.exe58⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xrxfllr.exec:\xrxfllr.exe59⤵
- Executes dropped EXE
PID:2052 -
\??\c:\tbhtbt.exec:\tbhtbt.exe60⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hbttbh.exec:\hbttbh.exe61⤵
- Executes dropped EXE
PID:2240 -
\??\c:\dpdjj.exec:\dpdjj.exe62⤵
- Executes dropped EXE
PID:624 -
\??\c:\vppjp.exec:\vppjp.exe63⤵
- Executes dropped EXE
PID:1400 -
\??\c:\fxxxffr.exec:\fxxxffr.exe64⤵
- Executes dropped EXE
PID:852 -
\??\c:\7xrfrxx.exec:\7xrfrxx.exe65⤵
- Executes dropped EXE
PID:652 -
\??\c:\bnthhh.exec:\bnthhh.exe66⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1djdj.exec:\1djdj.exe67⤵PID:820
-
\??\c:\5pjdv.exec:\5pjdv.exe68⤵PID:2996
-
\??\c:\rflflfl.exec:\rflflfl.exe69⤵PID:1992
-
\??\c:\1lflxff.exec:\1lflxff.exe70⤵PID:1688
-
\??\c:\bthhnb.exec:\bthhnb.exe71⤵PID:2840
-
\??\c:\bbthnn.exec:\bbthnn.exe72⤵PID:2148
-
\??\c:\vpvpd.exec:\vpvpd.exe73⤵PID:1756
-
\??\c:\9jdpp.exec:\9jdpp.exe74⤵PID:288
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe75⤵PID:2304
-
\??\c:\xfxllxf.exec:\xfxllxf.exe76⤵PID:1512
-
\??\c:\nhthnn.exec:\nhthnn.exe77⤵PID:2640
-
\??\c:\1nnbbt.exec:\1nnbbt.exe78⤵PID:2548
-
\??\c:\dpvdj.exec:\dpvdj.exe79⤵PID:2416
-
\??\c:\1pppp.exec:\1pppp.exe80⤵PID:2564
-
\??\c:\rlxfffl.exec:\rlxfffl.exe81⤵PID:2736
-
\??\c:\xfffrrr.exec:\xfffrrr.exe82⤵PID:2444
-
\??\c:\thtntt.exec:\thtntt.exe83⤵PID:2404
-
\??\c:\nbbtbt.exec:\nbbtbt.exe84⤵PID:2440
-
\??\c:\jvpvv.exec:\jvpvv.exe85⤵PID:2168
-
\??\c:\jvppp.exec:\jvppp.exe86⤵PID:2452
-
\??\c:\fffllrr.exec:\fffllrr.exe87⤵PID:2692
-
\??\c:\3bthnb.exec:\3bthnb.exe88⤵PID:2852
-
\??\c:\bntttt.exec:\bntttt.exe89⤵PID:640
-
\??\c:\1ddjp.exec:\1ddjp.exe90⤵PID:2908
-
\??\c:\9xrrxfl.exec:\9xrrxfl.exe91⤵PID:876
-
\??\c:\xrffrxr.exec:\xrffrxr.exe92⤵PID:2144
-
\??\c:\7hnntb.exec:\7hnntb.exe93⤵PID:1808
-
\??\c:\btbhtb.exec:\btbhtb.exe94⤵PID:552
-
\??\c:\pdpvj.exec:\pdpvj.exe95⤵PID:868
-
\??\c:\pjvvd.exec:\pjvvd.exe96⤵PID:2212
-
\??\c:\rfxxffl.exec:\rfxxffl.exe97⤵PID:2928
-
\??\c:\7frrflx.exec:\7frrflx.exe98⤵PID:1916
-
\??\c:\nhbhnt.exec:\nhbhnt.exe99⤵PID:2124
-
\??\c:\hthhtn.exec:\hthhtn.exe100⤵PID:1852
-
\??\c:\vpvpp.exec:\vpvpp.exe101⤵PID:1632
-
\??\c:\7vppv.exec:\7vppv.exe102⤵PID:1976
-
\??\c:\7lfflfl.exec:\7lfflfl.exe103⤵PID:2220
-
\??\c:\lfrxllr.exec:\lfrxllr.exe104⤵PID:1416
-
\??\c:\tnbbnn.exec:\tnbbnn.exe105⤵PID:1136
-
\??\c:\nhntnb.exec:\nhntnb.exe106⤵PID:1220
-
\??\c:\vvjjv.exec:\vvjjv.exe107⤵PID:1244
-
\??\c:\pjvvv.exec:\pjvvv.exe108⤵PID:3028
-
\??\c:\xrxfrxr.exec:\xrxfrxr.exe109⤵PID:560
-
\??\c:\lffflrx.exec:\lffflrx.exe110⤵PID:1700
-
\??\c:\hntnnt.exec:\hntnnt.exe111⤵PID:2968
-
\??\c:\hbnntt.exec:\hbnntt.exe112⤵PID:1628
-
\??\c:\vpddv.exec:\vpddv.exe113⤵PID:1644
-
\??\c:\pdjjp.exec:\pdjjp.exe114⤵PID:2152
-
\??\c:\rrlfllf.exec:\rrlfllf.exe115⤵PID:1908
-
\??\c:\7rlfxrl.exec:\7rlfxrl.exe116⤵PID:2120
-
\??\c:\bbbbtb.exec:\bbbbtb.exe117⤵PID:1536
-
\??\c:\9nbhnn.exec:\9nbhnn.exe118⤵PID:2688
-
\??\c:\pdvpv.exec:\pdvpv.exe119⤵PID:2516
-
\??\c:\frlrxxf.exec:\frlrxxf.exe120⤵PID:2668
-
\??\c:\1fxlllx.exec:\1fxlllx.exe121⤵PID:2524
-
\??\c:\hbhtbh.exec:\hbhtbh.exe122⤵PID:2532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-