Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 11:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dd15ef43c26b6c0e658631e4be968ab0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
dd15ef43c26b6c0e658631e4be968ab0_NeikiAnalytics.exe
-
Size
80KB
-
MD5
dd15ef43c26b6c0e658631e4be968ab0
-
SHA1
41fcd6bb63dccca9bb394f4abb56f73f00c60911
-
SHA256
4b689434af9e52fd367b995d8866290e413b9c5efb1f3ce911a01d8237393ec4
-
SHA512
fe5b0122220bb85860232fc4ed878e5c72d2bf77fe2cc54a181d1f8aa2469971f1c8f565935916c53857bc5ac2e28d997c51206b2108fe9b63f2ad3ad4c0a932
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLU1gxm1S3PQ7CnPRKiir5Qw:ymb3NkkiQ3mdBjFoLkmx/g8ZKzQw
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1488-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/812-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/784-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/304-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/416-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2008 9lxxrlr.exe 2744 vpjjv.exe 2660 lrrlflf.exe 3028 nhbbnn.exe 2624 djddj.exe 2504 fxrfxfr.exe 2468 bttnnh.exe 2632 pjvdp.exe 2932 5frrflx.exe 812 xlxfrfl.exe 2752 5hhnht.exe 2824 9jvdv.exe 784 lxlrxrr.exe 1668 9xxxllx.exe 1960 bnthht.exe 304 vvvvj.exe 2108 lfrxffl.exe 1620 lflxlff.exe 2044 bbnthn.exe 1684 tthnbn.exe 2868 vpjjv.exe 584 rrlrfrf.exe 1896 lffffrl.exe 416 dpdvj.exe 2092 3pjjp.exe 1768 rlrfxfr.exe 864 7htbhh.exe 1648 ddpjp.exe 660 xrllrxx.exe 2968 xfrfxfr.exe 3060 hhnnnn.exe 2296 dpdjj.exe 1816 ppjvj.exe 2896 lfxxlrf.exe 1252 7bthnt.exe 2832 5nnttb.exe 2008 dvpvp.exe 1804 5vjpj.exe 2688 fxflxrf.exe 2568 ffrxxxl.exe 2580 nnhnbh.exe 2764 hbnntb.exe 2512 jdvdp.exe 2480 lrxlrxx.exe 2536 rfrxlrf.exe 2924 tnhtnb.exe 760 5tbntb.exe 284 ppjjv.exe 2760 ddvdv.exe 372 ffxlflx.exe 2152 rlrxlxf.exe 1840 bbbhbh.exe 2144 jdjdv.exe 2128 5pdjj.exe 1740 fxflxfx.exe 1968 rlxlxfl.exe 1624 bnnthh.exe 1180 bbhhnt.exe 1620 jdvdp.exe 2304 fxfllxx.exe 2872 lxlrffx.exe 536 bntthh.exe 584 bbtbht.exe 648 vpvvd.exe -
resource yara_rule behavioral1/memory/1488-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/812-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/784-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/304-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/416-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1768-253-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1488 wrote to memory of 2008 1488 dd15ef43c26b6c0e658631e4be968ab0_NeikiAnalytics.exe 28 PID 1488 wrote to memory of 2008 1488 dd15ef43c26b6c0e658631e4be968ab0_NeikiAnalytics.exe 28 PID 1488 wrote to memory of 2008 1488 dd15ef43c26b6c0e658631e4be968ab0_NeikiAnalytics.exe 28 PID 1488 wrote to memory of 2008 1488 dd15ef43c26b6c0e658631e4be968ab0_NeikiAnalytics.exe 28 PID 2008 wrote to memory of 2744 2008 9lxxrlr.exe 29 PID 2008 wrote to memory of 2744 2008 9lxxrlr.exe 29 PID 2008 wrote to memory of 2744 2008 9lxxrlr.exe 29 PID 2008 wrote to memory of 2744 2008 9lxxrlr.exe 29 PID 2744 wrote to memory of 2660 2744 vpjjv.exe 30 PID 2744 wrote to memory of 2660 2744 vpjjv.exe 30 PID 2744 wrote to memory of 2660 2744 vpjjv.exe 30 PID 2744 wrote to memory of 2660 2744 vpjjv.exe 30 PID 2660 wrote to memory of 3028 2660 lrrlflf.exe 31 PID 2660 wrote to memory of 3028 2660 lrrlflf.exe 31 PID 2660 wrote to memory of 3028 2660 lrrlflf.exe 31 PID 2660 wrote to memory of 3028 2660 lrrlflf.exe 31 PID 3028 wrote to memory of 2624 3028 nhbbnn.exe 32 PID 3028 wrote to memory of 2624 3028 nhbbnn.exe 32 PID 3028 wrote to memory of 2624 3028 nhbbnn.exe 32 PID 3028 wrote to memory of 2624 3028 nhbbnn.exe 32 PID 2624 wrote to memory of 2504 2624 djddj.exe 33 PID 2624 wrote to memory of 2504 2624 djddj.exe 33 PID 2624 wrote to memory of 2504 2624 djddj.exe 33 PID 2624 wrote to memory of 2504 2624 djddj.exe 33 PID 2504 wrote to memory of 2468 2504 fxrfxfr.exe 34 PID 2504 wrote to memory of 2468 2504 fxrfxfr.exe 34 PID 2504 wrote to memory of 2468 2504 fxrfxfr.exe 34 PID 2504 wrote to memory of 2468 2504 fxrfxfr.exe 34 PID 2468 wrote to memory of 2632 2468 bttnnh.exe 35 PID 2468 wrote to memory of 2632 2468 bttnnh.exe 35 PID 2468 wrote to memory of 2632 2468 bttnnh.exe 35 PID 2468 wrote to memory of 2632 2468 bttnnh.exe 35 PID 2632 wrote to memory of 2932 2632 pjvdp.exe 36 PID 2632 wrote to memory of 2932 2632 pjvdp.exe 36 PID 2632 wrote to memory of 2932 2632 pjvdp.exe 36 PID 2632 wrote to memory of 2932 2632 pjvdp.exe 36 PID 2932 wrote to memory of 812 2932 5frrflx.exe 37 PID 2932 wrote to memory of 812 2932 5frrflx.exe 37 PID 2932 wrote to memory of 812 2932 5frrflx.exe 37 PID 2932 wrote to memory of 812 2932 5frrflx.exe 37 PID 812 wrote to memory of 2752 812 xlxfrfl.exe 38 PID 812 wrote to memory of 2752 812 xlxfrfl.exe 38 PID 812 wrote to memory of 2752 812 xlxfrfl.exe 38 PID 812 wrote to memory of 2752 812 xlxfrfl.exe 38 PID 2752 wrote to memory of 2824 2752 5hhnht.exe 39 PID 2752 wrote to memory of 2824 2752 5hhnht.exe 39 PID 2752 wrote to memory of 2824 2752 5hhnht.exe 39 PID 2752 wrote to memory of 2824 2752 5hhnht.exe 39 PID 2824 wrote to memory of 784 2824 9jvdv.exe 40 PID 2824 wrote to memory of 784 2824 9jvdv.exe 40 PID 2824 wrote to memory of 784 2824 9jvdv.exe 40 PID 2824 wrote to memory of 784 2824 9jvdv.exe 40 PID 784 wrote to memory of 1668 784 lxlrxrr.exe 41 PID 784 wrote to memory of 1668 784 lxlrxrr.exe 41 PID 784 wrote to memory of 1668 784 lxlrxrr.exe 41 PID 784 wrote to memory of 1668 784 lxlrxrr.exe 41 PID 1668 wrote to memory of 1960 1668 9xxxllx.exe 42 PID 1668 wrote to memory of 1960 1668 9xxxllx.exe 42 PID 1668 wrote to memory of 1960 1668 9xxxllx.exe 42 PID 1668 wrote to memory of 1960 1668 9xxxllx.exe 42 PID 1960 wrote to memory of 304 1960 bnthht.exe 43 PID 1960 wrote to memory of 304 1960 bnthht.exe 43 PID 1960 wrote to memory of 304 1960 bnthht.exe 43 PID 1960 wrote to memory of 304 1960 bnthht.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd15ef43c26b6c0e658631e4be968ab0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dd15ef43c26b6c0e658631e4be968ab0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\9lxxrlr.exec:\9lxxrlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\vpjjv.exec:\vpjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\lrrlflf.exec:\lrrlflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\nhbbnn.exec:\nhbbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\djddj.exec:\djddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\fxrfxfr.exec:\fxrfxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\bttnnh.exec:\bttnnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\pjvdp.exec:\pjvdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\5frrflx.exec:\5frrflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\xlxfrfl.exec:\xlxfrfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\5hhnht.exec:\5hhnht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\9jvdv.exec:\9jvdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\lxlrxrr.exec:\lxlrxrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\9xxxllx.exec:\9xxxllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\bnthht.exec:\bnthht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\vvvvj.exec:\vvvvj.exe17⤵
- Executes dropped EXE
PID:304 -
\??\c:\lfrxffl.exec:\lfrxffl.exe18⤵
- Executes dropped EXE
PID:2108 -
\??\c:\lflxlff.exec:\lflxlff.exe19⤵
- Executes dropped EXE
PID:1620 -
\??\c:\bbnthn.exec:\bbnthn.exe20⤵
- Executes dropped EXE
PID:2044 -
\??\c:\tthnbn.exec:\tthnbn.exe21⤵
- Executes dropped EXE
PID:1684 -
\??\c:\vpjjv.exec:\vpjjv.exe22⤵
- Executes dropped EXE
PID:2868 -
\??\c:\rrlrfrf.exec:\rrlrfrf.exe23⤵
- Executes dropped EXE
PID:584 -
\??\c:\lffffrl.exec:\lffffrl.exe24⤵
- Executes dropped EXE
PID:1896 -
\??\c:\dpdvj.exec:\dpdvj.exe25⤵
- Executes dropped EXE
PID:416 -
\??\c:\3pjjp.exec:\3pjjp.exe26⤵
- Executes dropped EXE
PID:2092 -
\??\c:\rlrfxfr.exec:\rlrfxfr.exe27⤵
- Executes dropped EXE
PID:1768 -
\??\c:\7htbhh.exec:\7htbhh.exe28⤵
- Executes dropped EXE
PID:864 -
\??\c:\ddpjp.exec:\ddpjp.exe29⤵
- Executes dropped EXE
PID:1648 -
\??\c:\xrllrxx.exec:\xrllrxx.exe30⤵
- Executes dropped EXE
PID:660 -
\??\c:\xfrfxfr.exec:\xfrfxfr.exe31⤵
- Executes dropped EXE
PID:2968 -
\??\c:\hhnnnn.exec:\hhnnnn.exe32⤵
- Executes dropped EXE
PID:3060 -
\??\c:\dpdjj.exec:\dpdjj.exe33⤵
- Executes dropped EXE
PID:2296 -
\??\c:\ppjvj.exec:\ppjvj.exe34⤵
- Executes dropped EXE
PID:1816 -
\??\c:\lfxxlrf.exec:\lfxxlrf.exe35⤵
- Executes dropped EXE
PID:2896 -
\??\c:\7bthnt.exec:\7bthnt.exe36⤵
- Executes dropped EXE
PID:1252 -
\??\c:\5nnttb.exec:\5nnttb.exe37⤵
- Executes dropped EXE
PID:2832 -
\??\c:\dvpvp.exec:\dvpvp.exe38⤵
- Executes dropped EXE
PID:2008 -
\??\c:\5vjpj.exec:\5vjpj.exe39⤵
- Executes dropped EXE
PID:1804 -
\??\c:\fxflxrf.exec:\fxflxrf.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\ffrxxxl.exec:\ffrxxxl.exe41⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nnhnbh.exec:\nnhnbh.exe42⤵
- Executes dropped EXE
PID:2580 -
\??\c:\hbnntb.exec:\hbnntb.exe43⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jdvdp.exec:\jdvdp.exe44⤵
- Executes dropped EXE
PID:2512 -
\??\c:\lrxlrxx.exec:\lrxlrxx.exe45⤵
- Executes dropped EXE
PID:2480 -
\??\c:\rfrxlrf.exec:\rfrxlrf.exe46⤵
- Executes dropped EXE
PID:2536 -
\??\c:\tnhtnb.exec:\tnhtnb.exe47⤵
- Executes dropped EXE
PID:2924 -
\??\c:\5tbntb.exec:\5tbntb.exe48⤵
- Executes dropped EXE
PID:760 -
\??\c:\ppjjv.exec:\ppjjv.exe49⤵
- Executes dropped EXE
PID:284 -
\??\c:\ddvdv.exec:\ddvdv.exe50⤵
- Executes dropped EXE
PID:2760 -
\??\c:\ffxlflx.exec:\ffxlflx.exe51⤵
- Executes dropped EXE
PID:372 -
\??\c:\rlrxlxf.exec:\rlrxlxf.exe52⤵
- Executes dropped EXE
PID:2152 -
\??\c:\bbbhbh.exec:\bbbhbh.exe53⤵
- Executes dropped EXE
PID:1840 -
\??\c:\jdjdv.exec:\jdjdv.exe54⤵
- Executes dropped EXE
PID:2144 -
\??\c:\5pdjj.exec:\5pdjj.exe55⤵
- Executes dropped EXE
PID:2128 -
\??\c:\fxflxfx.exec:\fxflxfx.exe56⤵
- Executes dropped EXE
PID:1740 -
\??\c:\rlxlxfl.exec:\rlxlxfl.exe57⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bnnthh.exec:\bnnthh.exe58⤵
- Executes dropped EXE
PID:1624 -
\??\c:\bbhhnt.exec:\bbhhnt.exe59⤵
- Executes dropped EXE
PID:1180 -
\??\c:\jdvdp.exec:\jdvdp.exe60⤵
- Executes dropped EXE
PID:1620 -
\??\c:\fxfllxx.exec:\fxfllxx.exe61⤵
- Executes dropped EXE
PID:2304 -
\??\c:\lxlrffx.exec:\lxlrffx.exe62⤵
- Executes dropped EXE
PID:2872 -
\??\c:\bntthh.exec:\bntthh.exe63⤵
- Executes dropped EXE
PID:536 -
\??\c:\bbtbht.exec:\bbtbht.exe64⤵
- Executes dropped EXE
PID:584 -
\??\c:\vpvvd.exec:\vpvvd.exe65⤵
- Executes dropped EXE
PID:648 -
\??\c:\lffflrx.exec:\lffflrx.exe66⤵PID:632
-
\??\c:\9xrxrrl.exec:\9xrxrrl.exe67⤵PID:2080
-
\??\c:\bbnbhh.exec:\bbnbhh.exe68⤵PID:2856
-
\??\c:\hhbtbh.exec:\hhbtbh.exe69⤵PID:1332
-
\??\c:\pjvvd.exec:\pjvvd.exe70⤵PID:1768
-
\??\c:\vdvpv.exec:\vdvpv.exe71⤵PID:2184
-
\??\c:\rfxxrrr.exec:\rfxxrrr.exe72⤵PID:1032
-
\??\c:\rfflxfx.exec:\rfflxfx.exe73⤵PID:1244
-
\??\c:\1hhntb.exec:\1hhntb.exe74⤵PID:1124
-
\??\c:\hnnntn.exec:\hnnntn.exe75⤵PID:1884
-
\??\c:\vpppd.exec:\vpppd.exe76⤵PID:3060
-
\??\c:\ppdvp.exec:\ppdvp.exe77⤵PID:2544
-
\??\c:\fxlrrrx.exec:\fxlrrrx.exe78⤵PID:1232
-
\??\c:\frrllfr.exec:\frrllfr.exe79⤵PID:1680
-
\??\c:\bnhthn.exec:\bnhthn.exe80⤵PID:2988
-
\??\c:\9httbb.exec:\9httbb.exe81⤵PID:2160
-
\??\c:\vdvpp.exec:\vdvpp.exe82⤵PID:844
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe83⤵PID:2680
-
\??\c:\fxrfrrf.exec:\fxrfrrf.exe84⤵PID:2852
-
\??\c:\hbtbhn.exec:\hbtbhn.exe85⤵PID:2736
-
\??\c:\1bthbn.exec:\1bthbn.exe86⤵PID:2748
-
\??\c:\vpddp.exec:\vpddp.exe87⤵PID:2636
-
\??\c:\7djvj.exec:\7djvj.exe88⤵PID:2476
-
\??\c:\lfrrxxx.exec:\lfrrxxx.exe89⤵PID:2528
-
\??\c:\hbttbh.exec:\hbttbh.exe90⤵PID:2628
-
\??\c:\nbhntt.exec:\nbhntt.exe91⤵PID:2632
-
\??\c:\pjdjp.exec:\pjdjp.exe92⤵PID:2932
-
\??\c:\jjdpd.exec:\jjdpd.exe93⤵PID:2700
-
\??\c:\xxrrrxl.exec:\xxrrrxl.exe94⤵PID:2768
-
\??\c:\rxrlrfl.exec:\rxrlrfl.exe95⤵PID:2104
-
\??\c:\7tbhtb.exec:\7tbhtb.exe96⤵PID:2824
-
\??\c:\nntbnn.exec:\nntbnn.exe97⤵PID:2156
-
\??\c:\jdpvj.exec:\jdpvj.exe98⤵PID:1996
-
\??\c:\jdpdp.exec:\jdpdp.exe99⤵PID:2272
-
\??\c:\rxlrxfl.exec:\rxlrxfl.exe100⤵PID:1744
-
\??\c:\lxlrllr.exec:\lxlrllr.exe101⤵PID:1528
-
\??\c:\3hnnbb.exec:\3hnnbb.exe102⤵PID:1512
-
\??\c:\9dvvj.exec:\9dvvj.exe103⤵PID:1504
-
\??\c:\djpjv.exec:\djpjv.exe104⤵PID:1676
-
\??\c:\xrffrfl.exec:\xrffrfl.exe105⤵PID:2864
-
\??\c:\9rlrflr.exec:\9rlrflr.exe106⤵PID:2036
-
\??\c:\nhbthn.exec:\nhbthn.exe107⤵PID:1484
-
\??\c:\jjdpv.exec:\jjdpv.exe108⤵PID:836
-
\??\c:\dpdjd.exec:\dpdjd.exe109⤵PID:1036
-
\??\c:\lxxrrxf.exec:\lxxrrxf.exe110⤵PID:1896
-
\??\c:\hnthhn.exec:\hnthhn.exe111⤵PID:976
-
\??\c:\nbhtth.exec:\nbhtth.exe112⤵PID:1532
-
\??\c:\3vdjv.exec:\3vdjv.exe113⤵PID:1336
-
\??\c:\ppvpj.exec:\ppvpj.exe114⤵PID:2384
-
\??\c:\1ffffrf.exec:\1ffffrf.exe115⤵PID:340
-
\??\c:\rfrxxxf.exec:\rfrxxxf.exe116⤵PID:2992
-
\??\c:\hbnhth.exec:\hbnhth.exe117⤵PID:2972
-
\??\c:\ppjpv.exec:\ppjpv.exe118⤵PID:2968
-
\??\c:\dpvpj.exec:\dpvpj.exe119⤵PID:1292
-
\??\c:\rlfxlrx.exec:\rlfxlrx.exe120⤵PID:876
-
\??\c:\1rrfllr.exec:\1rrfllr.exe121⤵PID:2892
-
\??\c:\ttntnn.exec:\ttntnn.exe122⤵PID:1728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-