Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 09:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d6fd7035ae058b0e0731719f6510b240_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
d6fd7035ae058b0e0731719f6510b240_NeikiAnalytics.exe
-
Size
266KB
-
MD5
d6fd7035ae058b0e0731719f6510b240
-
SHA1
04286631bb983423b61886cc384d9c21d47702dc
-
SHA256
48beca7421cf915b3a04d14b7f0a5ba4a39913304e5754579fb9f5a91154c767
-
SHA512
e54bc2a2bbb50770cc1438be8c1bab64f933083567b8085f09d70bdf53f9d906d9224bc64b23d4a534b071c01578e2f218e7dc86b19393ed9c0efa789f6ca810
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmPzTkV2y/QTa9RBZydZbf83pnzgmmIMS:n3C9BRIG0asYFm71mPfkVB8dKwaWC
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2400-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1880-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1900-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1184-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/992-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/852-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2568 jpdpd.exe 2680 jdvpp.exe 2600 hnnnnh.exe 2736 9ppdd.exe 2640 xrfrllf.exe 2496 nbbtnn.exe 2152 dvpvd.exe 1880 rlxfxrf.exe 2564 bnnhht.exe 2800 vjvvp.exe 2180 bntnnn.exe 2212 dpjpp.exe 1900 xrrrxfr.exe 1628 tnbthb.exe 536 rxxxlfx.exe 1164 nnhttn.exe 856 vpdjv.exe 2932 3xrfrfl.exe 1184 vvpvj.exe 2460 lfxlxfx.exe 2424 1pvdj.exe 3052 rlrlxrf.exe 3000 vvdjj.exe 1936 1rlrfxr.exe 1960 hnntnb.exe 992 vvpjd.exe 852 bbhnth.exe 2164 jjjdj.exe 2156 bhthhb.exe 2408 djdpd.exe 2972 xflrrlf.exe 1980 tbhtbb.exe 2760 flxrxxx.exe 2828 ntthhn.exe 2580 tbtnnn.exe 2704 vjdjp.exe 2484 rffxxxx.exe 2608 nnbtnt.exe 2748 ppjpv.exe 2736 dppdj.exe 2492 xxxlxll.exe 2368 btnnhn.exe 2644 vppdp.exe 2004 pjdjp.exe 2464 9ffrlxl.exe 2784 nhhnhn.exe 1732 ppjvd.exe 2800 xflflfr.exe 860 5lrxlrl.exe 1884 5nttht.exe 1888 jjdjd.exe 756 3xxfrxr.exe 480 rfxrxlr.exe 1840 htthbh.exe 624 dppjp.exe 3040 5lxxfff.exe 2900 rxlrflf.exe 2976 7tnthn.exe 2248 jvddv.exe 2232 ffrlrll.exe 908 ntnbnn.exe 404 7btthn.exe 2128 jjjpv.exe 1720 lrrrflr.exe -
resource yara_rule behavioral1/memory/2400-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1900-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1184-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/992-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/852-266-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2568 2400 d6fd7035ae058b0e0731719f6510b240_NeikiAnalytics.exe 28 PID 2400 wrote to memory of 2568 2400 d6fd7035ae058b0e0731719f6510b240_NeikiAnalytics.exe 28 PID 2400 wrote to memory of 2568 2400 d6fd7035ae058b0e0731719f6510b240_NeikiAnalytics.exe 28 PID 2400 wrote to memory of 2568 2400 d6fd7035ae058b0e0731719f6510b240_NeikiAnalytics.exe 28 PID 2568 wrote to memory of 2680 2568 jpdpd.exe 29 PID 2568 wrote to memory of 2680 2568 jpdpd.exe 29 PID 2568 wrote to memory of 2680 2568 jpdpd.exe 29 PID 2568 wrote to memory of 2680 2568 jpdpd.exe 29 PID 2680 wrote to memory of 2600 2680 jdvpp.exe 30 PID 2680 wrote to memory of 2600 2680 jdvpp.exe 30 PID 2680 wrote to memory of 2600 2680 jdvpp.exe 30 PID 2680 wrote to memory of 2600 2680 jdvpp.exe 30 PID 2600 wrote to memory of 2736 2600 hnnnnh.exe 31 PID 2600 wrote to memory of 2736 2600 hnnnnh.exe 31 PID 2600 wrote to memory of 2736 2600 hnnnnh.exe 31 PID 2600 wrote to memory of 2736 2600 hnnnnh.exe 31 PID 2736 wrote to memory of 2640 2736 9ppdd.exe 32 PID 2736 wrote to memory of 2640 2736 9ppdd.exe 32 PID 2736 wrote to memory of 2640 2736 9ppdd.exe 32 PID 2736 wrote to memory of 2640 2736 9ppdd.exe 32 PID 2640 wrote to memory of 2496 2640 xrfrllf.exe 33 PID 2640 wrote to memory of 2496 2640 xrfrllf.exe 33 PID 2640 wrote to memory of 2496 2640 xrfrllf.exe 33 PID 2640 wrote to memory of 2496 2640 xrfrllf.exe 33 PID 2496 wrote to memory of 2152 2496 nbbtnn.exe 34 PID 2496 wrote to memory of 2152 2496 nbbtnn.exe 34 PID 2496 wrote to memory of 2152 2496 nbbtnn.exe 34 PID 2496 wrote to memory of 2152 2496 nbbtnn.exe 34 PID 2152 wrote to memory of 1880 2152 dvpvd.exe 35 PID 2152 wrote to memory of 1880 2152 dvpvd.exe 35 PID 2152 wrote to memory of 1880 2152 dvpvd.exe 35 PID 2152 wrote to memory of 1880 2152 dvpvd.exe 35 PID 1880 wrote to memory of 2564 1880 rlxfxrf.exe 36 PID 1880 wrote to memory of 2564 1880 rlxfxrf.exe 36 PID 1880 wrote to memory of 2564 1880 rlxfxrf.exe 36 PID 1880 wrote to memory of 2564 1880 rlxfxrf.exe 36 PID 2564 wrote to memory of 2800 2564 bnnhht.exe 37 PID 2564 wrote to memory of 2800 2564 bnnhht.exe 37 PID 2564 wrote to memory of 2800 2564 bnnhht.exe 37 PID 2564 wrote to memory of 2800 2564 bnnhht.exe 37 PID 2800 wrote to memory of 2180 2800 vjvvp.exe 38 PID 2800 wrote to memory of 2180 2800 vjvvp.exe 38 PID 2800 wrote to memory of 2180 2800 vjvvp.exe 38 PID 2800 wrote to memory of 2180 2800 vjvvp.exe 38 PID 2180 wrote to memory of 2212 2180 bntnnn.exe 39 PID 2180 wrote to memory of 2212 2180 bntnnn.exe 39 PID 2180 wrote to memory of 2212 2180 bntnnn.exe 39 PID 2180 wrote to memory of 2212 2180 bntnnn.exe 39 PID 2212 wrote to memory of 1900 2212 dpjpp.exe 40 PID 2212 wrote to memory of 1900 2212 dpjpp.exe 40 PID 2212 wrote to memory of 1900 2212 dpjpp.exe 40 PID 2212 wrote to memory of 1900 2212 dpjpp.exe 40 PID 1900 wrote to memory of 1628 1900 xrrrxfr.exe 41 PID 1900 wrote to memory of 1628 1900 xrrrxfr.exe 41 PID 1900 wrote to memory of 1628 1900 xrrrxfr.exe 41 PID 1900 wrote to memory of 1628 1900 xrrrxfr.exe 41 PID 1628 wrote to memory of 536 1628 tnbthb.exe 42 PID 1628 wrote to memory of 536 1628 tnbthb.exe 42 PID 1628 wrote to memory of 536 1628 tnbthb.exe 42 PID 1628 wrote to memory of 536 1628 tnbthb.exe 42 PID 536 wrote to memory of 1164 536 rxxxlfx.exe 43 PID 536 wrote to memory of 1164 536 rxxxlfx.exe 43 PID 536 wrote to memory of 1164 536 rxxxlfx.exe 43 PID 536 wrote to memory of 1164 536 rxxxlfx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6fd7035ae058b0e0731719f6510b240_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d6fd7035ae058b0e0731719f6510b240_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\jpdpd.exec:\jpdpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\jdvpp.exec:\jdvpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\hnnnnh.exec:\hnnnnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\9ppdd.exec:\9ppdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\xrfrllf.exec:\xrfrllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\nbbtnn.exec:\nbbtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\dvpvd.exec:\dvpvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\rlxfxrf.exec:\rlxfxrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\bnnhht.exec:\bnnhht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\vjvvp.exec:\vjvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\bntnnn.exec:\bntnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\dpjpp.exec:\dpjpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\xrrrxfr.exec:\xrrrxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\tnbthb.exec:\tnbthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\rxxxlfx.exec:\rxxxlfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\nnhttn.exec:\nnhttn.exe17⤵
- Executes dropped EXE
PID:1164 -
\??\c:\vpdjv.exec:\vpdjv.exe18⤵
- Executes dropped EXE
PID:856 -
\??\c:\3xrfrfl.exec:\3xrfrfl.exe19⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vvpvj.exec:\vvpvj.exe20⤵
- Executes dropped EXE
PID:1184 -
\??\c:\lfxlxfx.exec:\lfxlxfx.exe21⤵
- Executes dropped EXE
PID:2460 -
\??\c:\1pvdj.exec:\1pvdj.exe22⤵
- Executes dropped EXE
PID:2424 -
\??\c:\rlrlxrf.exec:\rlrlxrf.exe23⤵
- Executes dropped EXE
PID:3052 -
\??\c:\vvdjj.exec:\vvdjj.exe24⤵
- Executes dropped EXE
PID:3000 -
\??\c:\1rlrfxr.exec:\1rlrfxr.exe25⤵
- Executes dropped EXE
PID:1936 -
\??\c:\hnntnb.exec:\hnntnb.exe26⤵
- Executes dropped EXE
PID:1960 -
\??\c:\vvpjd.exec:\vvpjd.exe27⤵
- Executes dropped EXE
PID:992 -
\??\c:\bbhnth.exec:\bbhnth.exe28⤵
- Executes dropped EXE
PID:852 -
\??\c:\jjjdj.exec:\jjjdj.exe29⤵
- Executes dropped EXE
PID:2164 -
\??\c:\bhthhb.exec:\bhthhb.exe30⤵
- Executes dropped EXE
PID:2156 -
\??\c:\djdpd.exec:\djdpd.exe31⤵
- Executes dropped EXE
PID:2408 -
\??\c:\xflrrlf.exec:\xflrrlf.exe32⤵
- Executes dropped EXE
PID:2972 -
\??\c:\tbhtbb.exec:\tbhtbb.exe33⤵
- Executes dropped EXE
PID:1980 -
\??\c:\flxrxxx.exec:\flxrxxx.exe34⤵
- Executes dropped EXE
PID:2760 -
\??\c:\ntthhn.exec:\ntthhn.exe35⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tbtnnn.exec:\tbtnnn.exe36⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vjdjp.exec:\vjdjp.exe37⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rffxxxx.exec:\rffxxxx.exe38⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nnbtnt.exec:\nnbtnt.exe39⤵
- Executes dropped EXE
PID:2608 -
\??\c:\ppjpv.exec:\ppjpv.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\dppdj.exec:\dppdj.exe41⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xxxlxll.exec:\xxxlxll.exe42⤵
- Executes dropped EXE
PID:2492 -
\??\c:\btnnhn.exec:\btnnhn.exe43⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vppdp.exec:\vppdp.exe44⤵
- Executes dropped EXE
PID:2644 -
\??\c:\pjdjp.exec:\pjdjp.exe45⤵
- Executes dropped EXE
PID:2004 -
\??\c:\9ffrlxl.exec:\9ffrlxl.exe46⤵
- Executes dropped EXE
PID:2464 -
\??\c:\nhhnhn.exec:\nhhnhn.exe47⤵
- Executes dropped EXE
PID:2784 -
\??\c:\ppjvd.exec:\ppjvd.exe48⤵
- Executes dropped EXE
PID:1732 -
\??\c:\xflflfr.exec:\xflflfr.exe49⤵
- Executes dropped EXE
PID:2800 -
\??\c:\5lrxlrl.exec:\5lrxlrl.exe50⤵
- Executes dropped EXE
PID:860 -
\??\c:\5nttht.exec:\5nttht.exe51⤵
- Executes dropped EXE
PID:1884 -
\??\c:\jjdjd.exec:\jjdjd.exe52⤵
- Executes dropped EXE
PID:1888 -
\??\c:\3xxfrxr.exec:\3xxfrxr.exe53⤵
- Executes dropped EXE
PID:756 -
\??\c:\rfxrxlr.exec:\rfxrxlr.exe54⤵
- Executes dropped EXE
PID:480 -
\??\c:\htthbh.exec:\htthbh.exe55⤵
- Executes dropped EXE
PID:1840 -
\??\c:\dppjp.exec:\dppjp.exe56⤵
- Executes dropped EXE
PID:624 -
\??\c:\5lxxfff.exec:\5lxxfff.exe57⤵
- Executes dropped EXE
PID:3040 -
\??\c:\rxlrflf.exec:\rxlrflf.exe58⤵
- Executes dropped EXE
PID:2900 -
\??\c:\7tnthn.exec:\7tnthn.exe59⤵
- Executes dropped EXE
PID:2976 -
\??\c:\jvddv.exec:\jvddv.exe60⤵
- Executes dropped EXE
PID:2248 -
\??\c:\ffrlrll.exec:\ffrlrll.exe61⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ntnbnn.exec:\ntnbnn.exe62⤵
- Executes dropped EXE
PID:908 -
\??\c:\7btthn.exec:\7btthn.exe63⤵
- Executes dropped EXE
PID:404 -
\??\c:\jjjpv.exec:\jjjpv.exe64⤵
- Executes dropped EXE
PID:2128 -
\??\c:\lrrrflr.exec:\lrrrflr.exe65⤵
- Executes dropped EXE
PID:1720 -
\??\c:\nhthbn.exec:\nhthbn.exe66⤵PID:1588
-
\??\c:\tnhhhh.exec:\tnhhhh.exe67⤵PID:612
-
\??\c:\jddvj.exec:\jddvj.exe68⤵PID:1008
-
\??\c:\3pjjv.exec:\3pjjv.exe69⤵PID:632
-
\??\c:\rrlrlxr.exec:\rrlrlxr.exe70⤵PID:852
-
\??\c:\tbbtbt.exec:\tbbtbt.exe71⤵PID:1856
-
\??\c:\hhtnbh.exec:\hhtnbh.exe72⤵PID:1952
-
\??\c:\ppjdv.exec:\ppjdv.exe73⤵PID:1808
-
\??\c:\lxxrrlf.exec:\lxxrrlf.exe74⤵PID:1220
-
\??\c:\hhhthn.exec:\hhhthn.exe75⤵PID:2072
-
\??\c:\3vjpd.exec:\3vjpd.exe76⤵PID:1624
-
\??\c:\ffllrrx.exec:\ffllrrx.exe77⤵PID:2760
-
\??\c:\fflrlrf.exec:\fflrlrf.exe78⤵PID:1640
-
\??\c:\tbhnnt.exec:\tbhnnt.exe79⤵PID:2624
-
\??\c:\tnbbbh.exec:\tnbbbh.exe80⤵PID:2708
-
\??\c:\vvppj.exec:\vvppj.exe81⤵PID:2484
-
\??\c:\lrlfffl.exec:\lrlfffl.exe82⤵PID:2600
-
\??\c:\nbttnh.exec:\nbttnh.exe83⤵PID:2516
-
\??\c:\nnhthb.exec:\nnhthb.exe84⤵PID:2736
-
\??\c:\ddpvj.exec:\ddpvj.exe85⤵PID:2472
-
\??\c:\rxlrllx.exec:\rxlrllx.exe86⤵PID:2912
-
\??\c:\7xrlxxf.exec:\7xrlxxf.exe87⤵PID:2928
-
\??\c:\nnbhtn.exec:\nnbhtn.exe88⤵PID:2152
-
\??\c:\pvpjj.exec:\pvpjj.exe89⤵PID:2564
-
\??\c:\jvvpj.exec:\jvvpj.exe90⤵PID:2796
-
\??\c:\fxxrflx.exec:\fxxrflx.exe91⤵PID:1732
-
\??\c:\bntttn.exec:\bntttn.exe92⤵PID:2204
-
\??\c:\7ntthn.exec:\7ntthn.exe93⤵PID:860
-
\??\c:\vdjvv.exec:\vdjvv.exe94⤵PID:1872
-
\??\c:\rxxxlrx.exec:\rxxxlrx.exe95⤵PID:1888
-
\??\c:\1fflxfr.exec:\1fflxfr.exe96⤵PID:2448
-
\??\c:\tnntnt.exec:\tnntnt.exe97⤵PID:2824
-
\??\c:\jpjvd.exec:\jpjvd.exe98⤵PID:1456
-
\??\c:\djdvp.exec:\djdvp.exe99⤵PID:1348
-
\??\c:\llrfxlr.exec:\llrfxlr.exe100⤵PID:2120
-
\??\c:\bhhbbn.exec:\bhhbbn.exe101⤵PID:2900
-
\??\c:\7vjvp.exec:\7vjvp.exe102⤵PID:2976
-
\??\c:\jpppd.exec:\jpppd.exe103⤵PID:2460
-
\??\c:\fxrfxxx.exec:\fxrfxxx.exe104⤵PID:1076
-
\??\c:\ntbbnt.exec:\ntbbnt.exe105⤵PID:908
-
\??\c:\1nntbh.exec:\1nntbh.exe106⤵PID:680
-
\??\c:\vdjdd.exec:\vdjdd.exe107⤵PID:3064
-
\??\c:\xrlxfxl.exec:\xrlxfxl.exe108⤵PID:3000
-
\??\c:\nhtbth.exec:\nhtbth.exe109⤵PID:1588
-
\??\c:\vpvpp.exec:\vpvpp.exe110⤵PID:612
-
\??\c:\rxrlrff.exec:\rxrlrff.exe111⤵PID:1008
-
\??\c:\nbnntt.exec:\nbnntt.exe112⤵PID:2336
-
\??\c:\nntnnh.exec:\nntnnh.exe113⤵PID:852
-
\??\c:\djvvv.exec:\djvvv.exe114⤵PID:1920
-
\??\c:\xrlfxxl.exec:\xrlfxxl.exe115⤵PID:2000
-
\??\c:\tbnhnh.exec:\tbnhnh.exe116⤵PID:2344
-
\??\c:\nthhnt.exec:\nthhnt.exe117⤵PID:1220
-
\??\c:\9frfrlf.exec:\9frfrlf.exe118⤵PID:2884
-
\??\c:\hhnnnb.exec:\hhnnnb.exe119⤵PID:1980
-
\??\c:\nnhtht.exec:\nnhtht.exe120⤵PID:1500
-
\??\c:\vvvdp.exec:\vvvdp.exe121⤵PID:2676
-
\??\c:\ffrfrfr.exec:\ffrfrfr.exe122⤵PID:2624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-