Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 17:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06f88265a733f75cedcaeb50850c8d90_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
06f88265a733f75cedcaeb50850c8d90_NeikiAnalytics.exe
-
Size
146KB
-
MD5
06f88265a733f75cedcaeb50850c8d90
-
SHA1
13f968519506945875652a3de8a4faaf0d3bb3e3
-
SHA256
6ceeee70db37f7108b06b1065dbd0d99fd4120d1972f50654c2486f8cf148f27
-
SHA512
bf83b9e2c34a0df32c97a5f66b41b3523c8cf9209a5b2ad0924112413aeb8820b0a0083251c8eed5afd2afe1ca933cb59c815a6e523a65b4fd6b7e6bbec90d08
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9gFbctg0IyAyhZvjDUOy/nmPmT9seH:n3C9BRo7tvnJ9oH0IRgZvjDhy+PmxseH
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/1112-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1416-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1832-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1104-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/876-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1692 tnbnhn.exe 2660 bthtbh.exe 2492 dvdvv.exe 2776 bbtbnn.exe 2768 jvjpv.exe 2736 dvvpv.exe 2636 rlxffrr.exe 2448 htnthb.exe 2024 dpvdd.exe 1416 flflrrf.exe 2676 lxfrflx.exe 2472 bbnntt.exe 2728 tnhtnh.exe 1904 jdjvj.exe 1832 lfxlffr.exe 2316 rllrffl.exe 2300 hbnntt.exe 1516 hbnbnn.exe 2248 3pvdp.exe 2240 fllxlxf.exe 2568 tthtbn.exe 324 1hbbnt.exe 1376 vjvvv.exe 944 ppdvj.exe 1104 frfxllx.exe 2724 ntnnbb.exe 304 djdvp.exe 2912 lfrrxlx.exe 772 lrrfrrr.exe 1736 9nbbbb.exe 876 tnhntb.exe 2180 ddjdd.exe 2028 lrlflll.exe 2744 7nhntb.exe 2068 tnhnbb.exe 2592 jdjpp.exe 2632 jdvpv.exe 2512 7llfrrx.exe 2612 rrrfffx.exe 2228 lllrflx.exe 2524 ttthnt.exe 2580 1btthb.exe 2852 vvpdj.exe 2896 pddvd.exe 1420 fxlfrrf.exe 2644 7llrxfl.exe 2708 btbhnn.exe 1948 nnhhnn.exe 1244 7jvdj.exe 1900 ppddj.exe 1892 xxlxlll.exe 1044 tnbnnh.exe 1620 nhtbnn.exe 1672 1jdpv.exe 500 dvjjv.exe 1124 rlrxffr.exe 3056 rrfxffx.exe 1716 ttbntn.exe 2368 nhtbnn.exe 2784 ppppp.exe 1492 rllrrrr.exe 1376 9rxfrrx.exe 1480 nthhhn.exe 1756 bbntbb.exe -
resource yara_rule behavioral1/memory/1112-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1416-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1832-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1104-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/876-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1112 wrote to memory of 1692 1112 06f88265a733f75cedcaeb50850c8d90_NeikiAnalytics.exe 28 PID 1112 wrote to memory of 1692 1112 06f88265a733f75cedcaeb50850c8d90_NeikiAnalytics.exe 28 PID 1112 wrote to memory of 1692 1112 06f88265a733f75cedcaeb50850c8d90_NeikiAnalytics.exe 28 PID 1112 wrote to memory of 1692 1112 06f88265a733f75cedcaeb50850c8d90_NeikiAnalytics.exe 28 PID 1692 wrote to memory of 2660 1692 tnbnhn.exe 29 PID 1692 wrote to memory of 2660 1692 tnbnhn.exe 29 PID 1692 wrote to memory of 2660 1692 tnbnhn.exe 29 PID 1692 wrote to memory of 2660 1692 tnbnhn.exe 29 PID 2660 wrote to memory of 2492 2660 bthtbh.exe 30 PID 2660 wrote to memory of 2492 2660 bthtbh.exe 30 PID 2660 wrote to memory of 2492 2660 bthtbh.exe 30 PID 2660 wrote to memory of 2492 2660 bthtbh.exe 30 PID 2492 wrote to memory of 2776 2492 dvdvv.exe 31 PID 2492 wrote to memory of 2776 2492 dvdvv.exe 31 PID 2492 wrote to memory of 2776 2492 dvdvv.exe 31 PID 2492 wrote to memory of 2776 2492 dvdvv.exe 31 PID 2776 wrote to memory of 2768 2776 bbtbnn.exe 32 PID 2776 wrote to memory of 2768 2776 bbtbnn.exe 32 PID 2776 wrote to memory of 2768 2776 bbtbnn.exe 32 PID 2776 wrote to memory of 2768 2776 bbtbnn.exe 32 PID 2768 wrote to memory of 2736 2768 jvjpv.exe 33 PID 2768 wrote to memory of 2736 2768 jvjpv.exe 33 PID 2768 wrote to memory of 2736 2768 jvjpv.exe 33 PID 2768 wrote to memory of 2736 2768 jvjpv.exe 33 PID 2736 wrote to memory of 2636 2736 dvvpv.exe 34 PID 2736 wrote to memory of 2636 2736 dvvpv.exe 34 PID 2736 wrote to memory of 2636 2736 dvvpv.exe 34 PID 2736 wrote to memory of 2636 2736 dvvpv.exe 34 PID 2636 wrote to memory of 2448 2636 rlxffrr.exe 35 PID 2636 wrote to memory of 2448 2636 rlxffrr.exe 35 PID 2636 wrote to memory of 2448 2636 rlxffrr.exe 35 PID 2636 wrote to memory of 2448 2636 rlxffrr.exe 35 PID 2448 wrote to memory of 2024 2448 htnthb.exe 36 PID 2448 wrote to memory of 2024 2448 htnthb.exe 36 PID 2448 wrote to memory of 2024 2448 htnthb.exe 36 PID 2448 wrote to memory of 2024 2448 htnthb.exe 36 PID 2024 wrote to memory of 1416 2024 dpvdd.exe 37 PID 2024 wrote to memory of 1416 2024 dpvdd.exe 37 PID 2024 wrote to memory of 1416 2024 dpvdd.exe 37 PID 2024 wrote to memory of 1416 2024 dpvdd.exe 37 PID 1416 wrote to memory of 2676 1416 flflrrf.exe 38 PID 1416 wrote to memory of 2676 1416 flflrrf.exe 38 PID 1416 wrote to memory of 2676 1416 flflrrf.exe 38 PID 1416 wrote to memory of 2676 1416 flflrrf.exe 38 PID 2676 wrote to memory of 2472 2676 lxfrflx.exe 39 PID 2676 wrote to memory of 2472 2676 lxfrflx.exe 39 PID 2676 wrote to memory of 2472 2676 lxfrflx.exe 39 PID 2676 wrote to memory of 2472 2676 lxfrflx.exe 39 PID 2472 wrote to memory of 2728 2472 bbnntt.exe 40 PID 2472 wrote to memory of 2728 2472 bbnntt.exe 40 PID 2472 wrote to memory of 2728 2472 bbnntt.exe 40 PID 2472 wrote to memory of 2728 2472 bbnntt.exe 40 PID 2728 wrote to memory of 1904 2728 tnhtnh.exe 41 PID 2728 wrote to memory of 1904 2728 tnhtnh.exe 41 PID 2728 wrote to memory of 1904 2728 tnhtnh.exe 41 PID 2728 wrote to memory of 1904 2728 tnhtnh.exe 41 PID 1904 wrote to memory of 1832 1904 jdjvj.exe 42 PID 1904 wrote to memory of 1832 1904 jdjvj.exe 42 PID 1904 wrote to memory of 1832 1904 jdjvj.exe 42 PID 1904 wrote to memory of 1832 1904 jdjvj.exe 42 PID 1832 wrote to memory of 2316 1832 lfxlffr.exe 43 PID 1832 wrote to memory of 2316 1832 lfxlffr.exe 43 PID 1832 wrote to memory of 2316 1832 lfxlffr.exe 43 PID 1832 wrote to memory of 2316 1832 lfxlffr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\06f88265a733f75cedcaeb50850c8d90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\06f88265a733f75cedcaeb50850c8d90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\tnbnhn.exec:\tnbnhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\bthtbh.exec:\bthtbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\dvdvv.exec:\dvdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\bbtbnn.exec:\bbtbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\jvjpv.exec:\jvjpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\dvvpv.exec:\dvvpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\rlxffrr.exec:\rlxffrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\htnthb.exec:\htnthb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\dpvdd.exec:\dpvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\flflrrf.exec:\flflrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\lxfrflx.exec:\lxfrflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\bbnntt.exec:\bbnntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\tnhtnh.exec:\tnhtnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\jdjvj.exec:\jdjvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\lfxlffr.exec:\lfxlffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\rllrffl.exec:\rllrffl.exe17⤵
- Executes dropped EXE
PID:2316 -
\??\c:\hbnntt.exec:\hbnntt.exe18⤵
- Executes dropped EXE
PID:2300 -
\??\c:\hbnbnn.exec:\hbnbnn.exe19⤵
- Executes dropped EXE
PID:1516 -
\??\c:\3pvdp.exec:\3pvdp.exe20⤵
- Executes dropped EXE
PID:2248 -
\??\c:\fllxlxf.exec:\fllxlxf.exe21⤵
- Executes dropped EXE
PID:2240 -
\??\c:\tthtbn.exec:\tthtbn.exe22⤵
- Executes dropped EXE
PID:2568 -
\??\c:\1hbbnt.exec:\1hbbnt.exe23⤵
- Executes dropped EXE
PID:324 -
\??\c:\vjvvv.exec:\vjvvv.exe24⤵
- Executes dropped EXE
PID:1376 -
\??\c:\ppdvj.exec:\ppdvj.exe25⤵
- Executes dropped EXE
PID:944 -
\??\c:\frfxllx.exec:\frfxllx.exe26⤵
- Executes dropped EXE
PID:1104 -
\??\c:\ntnnbb.exec:\ntnnbb.exe27⤵
- Executes dropped EXE
PID:2724 -
\??\c:\djdvp.exec:\djdvp.exe28⤵
- Executes dropped EXE
PID:304 -
\??\c:\lfrrxlx.exec:\lfrrxlx.exe29⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lrrfrrr.exec:\lrrfrrr.exe30⤵
- Executes dropped EXE
PID:772 -
\??\c:\9nbbbb.exec:\9nbbbb.exe31⤵
- Executes dropped EXE
PID:1736 -
\??\c:\tnhntb.exec:\tnhntb.exe32⤵
- Executes dropped EXE
PID:876 -
\??\c:\ddjdd.exec:\ddjdd.exe33⤵
- Executes dropped EXE
PID:2180 -
\??\c:\lrlflll.exec:\lrlflll.exe34⤵
- Executes dropped EXE
PID:2028 -
\??\c:\7nhntb.exec:\7nhntb.exe35⤵
- Executes dropped EXE
PID:2744 -
\??\c:\tnhnbb.exec:\tnhnbb.exe36⤵
- Executes dropped EXE
PID:2068 -
\??\c:\jdjpp.exec:\jdjpp.exe37⤵
- Executes dropped EXE
PID:2592 -
\??\c:\jdvpv.exec:\jdvpv.exe38⤵
- Executes dropped EXE
PID:2632 -
\??\c:\7llfrrx.exec:\7llfrrx.exe39⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rrrfffx.exec:\rrrfffx.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\lllrflx.exec:\lllrflx.exe41⤵
- Executes dropped EXE
PID:2228 -
\??\c:\ttthnt.exec:\ttthnt.exe42⤵
- Executes dropped EXE
PID:2524 -
\??\c:\1btthb.exec:\1btthb.exe43⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vvpdj.exec:\vvpdj.exe44⤵
- Executes dropped EXE
PID:2852 -
\??\c:\pddvd.exec:\pddvd.exe45⤵
- Executes dropped EXE
PID:2896 -
\??\c:\fxlfrrf.exec:\fxlfrrf.exe46⤵
- Executes dropped EXE
PID:1420 -
\??\c:\7llrxfl.exec:\7llrxfl.exe47⤵
- Executes dropped EXE
PID:2644 -
\??\c:\btbhnn.exec:\btbhnn.exe48⤵
- Executes dropped EXE
PID:2708 -
\??\c:\nnhhnn.exec:\nnhhnn.exe49⤵
- Executes dropped EXE
PID:1948 -
\??\c:\7jvdj.exec:\7jvdj.exe50⤵
- Executes dropped EXE
PID:1244 -
\??\c:\ppddj.exec:\ppddj.exe51⤵
- Executes dropped EXE
PID:1900 -
\??\c:\xxlxlll.exec:\xxlxlll.exe52⤵
- Executes dropped EXE
PID:1892 -
\??\c:\tnbnnh.exec:\tnbnnh.exe53⤵
- Executes dropped EXE
PID:1044 -
\??\c:\nhtbnn.exec:\nhtbnn.exe54⤵
- Executes dropped EXE
PID:1620 -
\??\c:\1jdpv.exec:\1jdpv.exe55⤵
- Executes dropped EXE
PID:1672 -
\??\c:\dvjjv.exec:\dvjjv.exe56⤵
- Executes dropped EXE
PID:500 -
\??\c:\rlrxffr.exec:\rlrxffr.exe57⤵
- Executes dropped EXE
PID:1124 -
\??\c:\rrfxffx.exec:\rrfxffx.exe58⤵
- Executes dropped EXE
PID:3056 -
\??\c:\ttbntn.exec:\ttbntn.exe59⤵
- Executes dropped EXE
PID:1716 -
\??\c:\nhtbnn.exec:\nhtbnn.exe60⤵
- Executes dropped EXE
PID:2368 -
\??\c:\ppppp.exec:\ppppp.exe61⤵
- Executes dropped EXE
PID:2784 -
\??\c:\rllrrrr.exec:\rllrrrr.exe62⤵
- Executes dropped EXE
PID:1492 -
\??\c:\9rxfrrx.exec:\9rxfrrx.exe63⤵
- Executes dropped EXE
PID:1376 -
\??\c:\nthhhn.exec:\nthhhn.exe64⤵
- Executes dropped EXE
PID:1480 -
\??\c:\bbntbb.exec:\bbntbb.exe65⤵
- Executes dropped EXE
PID:1756 -
\??\c:\pdjdd.exec:\pdjdd.exe66⤵PID:1104
-
\??\c:\3fflxxl.exec:\3fflxxl.exe67⤵PID:1036
-
\??\c:\rlxfrlr.exec:\rlxfrlr.exe68⤵PID:2948
-
\??\c:\9httbh.exec:\9httbh.exe69⤵PID:2128
-
\??\c:\bbtbnn.exec:\bbtbnn.exe70⤵PID:2952
-
\??\c:\pjvjv.exec:\pjvjv.exe71⤵PID:2988
-
\??\c:\xrffffl.exec:\xrffffl.exe72⤵PID:312
-
\??\c:\frffllr.exec:\frffllr.exe73⤵PID:880
-
\??\c:\nhttbb.exec:\nhttbb.exe74⤵PID:2572
-
\??\c:\7jddj.exec:\7jddj.exe75⤵PID:2920
-
\??\c:\ddpvd.exec:\ddpvd.exe76⤵PID:2660
-
\??\c:\rxxlfxl.exec:\rxxlfxl.exe77⤵PID:2744
-
\??\c:\xlrlrrf.exec:\xlrlrrf.exe78⤵PID:2588
-
\??\c:\1bntbn.exec:\1bntbn.exe79⤵PID:2592
-
\??\c:\3djjp.exec:\3djjp.exe80⤵PID:2548
-
\??\c:\pjddj.exec:\pjddj.exe81⤵PID:2512
-
\??\c:\lfxfrfr.exec:\lfxfrfr.exe82⤵PID:2640
-
\??\c:\hhtbhh.exec:\hhtbhh.exe83⤵PID:2228
-
\??\c:\7nbbbt.exec:\7nbbbt.exe84⤵PID:2524
-
\??\c:\jjdpj.exec:\jjdpj.exe85⤵PID:3052
-
\??\c:\5vjdj.exec:\5vjdj.exe86⤵PID:1584
-
\??\c:\rrrxfxl.exec:\rrrxfxl.exe87⤵PID:2868
-
\??\c:\lllxffx.exec:\lllxffx.exe88⤵PID:1420
-
\??\c:\ntthhh.exec:\ntthhh.exe89⤵PID:2644
-
\??\c:\pjvdd.exec:\pjvdd.exe90⤵PID:2708
-
\??\c:\dpvpv.exec:\dpvpv.exe91⤵PID:1948
-
\??\c:\1llxfrl.exec:\1llxfrl.exe92⤵PID:2728
-
\??\c:\xlrrffx.exec:\xlrrffx.exe93⤵PID:1900
-
\??\c:\hhhntb.exec:\hhhntb.exe94⤵PID:2312
-
\??\c:\pdpjp.exec:\pdpjp.exe95⤵PID:1044
-
\??\c:\vdjjj.exec:\vdjjj.exe96⤵PID:1328
-
\??\c:\xlxxxxl.exec:\xlxxxxl.exe97⤵PID:1672
-
\??\c:\7xrflxf.exec:\7xrflxf.exe98⤵PID:500
-
\??\c:\nhnnbb.exec:\nhnnbb.exe99⤵PID:1124
-
\??\c:\nhbntb.exec:\nhbntb.exe100⤵PID:1272
-
\??\c:\pdpvj.exec:\pdpvj.exe101⤵PID:1716
-
\??\c:\lfllxrf.exec:\lfllxrf.exe102⤵PID:2792
-
\??\c:\llxlrfl.exec:\llxlrfl.exe103⤵PID:2784
-
\??\c:\9nbbhn.exec:\9nbbhn.exe104⤵PID:488
-
\??\c:\tnbttn.exec:\tnbttn.exe105⤵PID:1376
-
\??\c:\9jvdd.exec:\9jvdd.exe106⤵PID:452
-
\??\c:\dvdpd.exec:\dvdpd.exe107⤵PID:1756
-
\??\c:\9rllrxf.exec:\9rllrxf.exe108⤵PID:2724
-
\??\c:\hbbhhh.exec:\hbbhhh.exe109⤵PID:1036
-
\??\c:\tnnhhn.exec:\tnnhhn.exe110⤵PID:1984
-
\??\c:\pjvjv.exec:\pjvjv.exe111⤵PID:3020
-
\??\c:\dvddj.exec:\dvddj.exe112⤵PID:348
-
\??\c:\rlffxfl.exec:\rlffxfl.exe113⤵PID:2988
-
\??\c:\nbbhnn.exec:\nbbhnn.exe114⤵PID:876
-
\??\c:\jjvdj.exec:\jjvdj.exe115⤵PID:2008
-
\??\c:\pjppp.exec:\pjppp.exe116⤵PID:2076
-
\??\c:\fffxlxl.exec:\fffxlxl.exe117⤵PID:2920
-
\??\c:\btbtnt.exec:\btbtnt.exe118⤵PID:1608
-
\??\c:\hhhnbb.exec:\hhhnbb.exe119⤵PID:2744
-
\??\c:\jjppv.exec:\jjppv.exe120⤵PID:2544
-
\??\c:\pjvdd.exec:\pjvdd.exe121⤵PID:2592
-
\??\c:\xrfxfxf.exec:\xrfxfxf.exe122⤵PID:2768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-