Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 04:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a34a36fc7e0a2bd3df136ee6e67c94a0_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
a34a36fc7e0a2bd3df136ee6e67c94a0_NeikiAnalytics.exe
-
Size
68KB
-
MD5
a34a36fc7e0a2bd3df136ee6e67c94a0
-
SHA1
6c941d9bac0cd3291d64e6f6a5184fa93ab9e541
-
SHA256
c1a82bc7e1e449a93dc2e6837317c9edce4fc54cbb4ee913cf13e3bcdd0e913f
-
SHA512
f2034273173b37ff85371915dd5995be0034a59290165a5734e448724221e03958514320c469ea365dc7245b2ed068fbb10cdd2bb64b131fea756422c6c812b4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUwcsbY/v:ymb3NkkiQ3mdBjF0yjcsM3
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1660-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1956-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1428-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1428-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1076-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1168-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1956 3xrllrl.exe 2712 btnthh.exe 1428 9pddv.exe 2580 xxflrrl.exe 2592 nnhnbb.exe 2856 hhbttb.exe 2572 dpjvp.exe 2456 ffrxflr.exe 2948 9lflxfr.exe 2944 7btbtb.exe 1936 nnhnbh.exe 2040 pjdjj.exe 2732 rfxlxlf.exe 2812 lxflflx.exe 2956 3bthth.exe 1656 nbntbb.exe 1076 5ppdv.exe 1700 lflrflx.exe 1736 lxlrflr.exe 2272 thbhht.exe 580 hbhbhh.exe 1168 pjddp.exe 584 7pdjp.exe 1628 xlfllrr.exe 844 hbnhtn.exe 1324 nhbnbh.exe 984 jdpvp.exe 2896 7ddjp.exe 2064 xlxflxl.exe 1760 1ntbht.exe 2892 hntnbt.exe 2520 ppvvp.exe 1712 rrrrflx.exe 3036 rlxfxrf.exe 3044 9nbhhh.exe 2072 nhnhnn.exe 2640 jddvv.exe 2628 pjjvd.exe 2692 pjddj.exe 2472 7xffrrx.exe 2548 7rffxxl.exe 2440 nhnnhh.exe 2512 nhhhhh.exe 1928 7tthtb.exe 2964 jdppd.exe 2736 vpjpj.exe 2496 xlrxllr.exe 1080 ffxfrxl.exe 2040 3tnntb.exe 2832 vjjvj.exe 2160 vdjvd.exe 2844 rfxfrlf.exe 2288 xrflfrf.exe 1084 5rxlxxf.exe 672 ttnnbn.exe 1740 ttnnth.exe 1528 3jdvd.exe 2056 jvjpv.exe 784 rrfxlll.exe 588 bbtbnt.exe 1496 hhttnt.exe 1600 jdjpv.exe 820 jdddj.exe 2180 jdppp.exe -
resource yara_rule behavioral1/memory/1660-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1428-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1076-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1168-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-293-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1660 wrote to memory of 1956 1660 a34a36fc7e0a2bd3df136ee6e67c94a0_NeikiAnalytics.exe 28 PID 1660 wrote to memory of 1956 1660 a34a36fc7e0a2bd3df136ee6e67c94a0_NeikiAnalytics.exe 28 PID 1660 wrote to memory of 1956 1660 a34a36fc7e0a2bd3df136ee6e67c94a0_NeikiAnalytics.exe 28 PID 1660 wrote to memory of 1956 1660 a34a36fc7e0a2bd3df136ee6e67c94a0_NeikiAnalytics.exe 28 PID 1956 wrote to memory of 2712 1956 3xrllrl.exe 29 PID 1956 wrote to memory of 2712 1956 3xrllrl.exe 29 PID 1956 wrote to memory of 2712 1956 3xrllrl.exe 29 PID 1956 wrote to memory of 2712 1956 3xrllrl.exe 29 PID 2712 wrote to memory of 1428 2712 btnthh.exe 30 PID 2712 wrote to memory of 1428 2712 btnthh.exe 30 PID 2712 wrote to memory of 1428 2712 btnthh.exe 30 PID 2712 wrote to memory of 1428 2712 btnthh.exe 30 PID 1428 wrote to memory of 2580 1428 9pddv.exe 31 PID 1428 wrote to memory of 2580 1428 9pddv.exe 31 PID 1428 wrote to memory of 2580 1428 9pddv.exe 31 PID 1428 wrote to memory of 2580 1428 9pddv.exe 31 PID 2580 wrote to memory of 2592 2580 xxflrrl.exe 32 PID 2580 wrote to memory of 2592 2580 xxflrrl.exe 32 PID 2580 wrote to memory of 2592 2580 xxflrrl.exe 32 PID 2580 wrote to memory of 2592 2580 xxflrrl.exe 32 PID 2592 wrote to memory of 2856 2592 nnhnbb.exe 33 PID 2592 wrote to memory of 2856 2592 nnhnbb.exe 33 PID 2592 wrote to memory of 2856 2592 nnhnbb.exe 33 PID 2592 wrote to memory of 2856 2592 nnhnbb.exe 33 PID 2856 wrote to memory of 2572 2856 hhbttb.exe 34 PID 2856 wrote to memory of 2572 2856 hhbttb.exe 34 PID 2856 wrote to memory of 2572 2856 hhbttb.exe 34 PID 2856 wrote to memory of 2572 2856 hhbttb.exe 34 PID 2572 wrote to memory of 2456 2572 dpjvp.exe 35 PID 2572 wrote to memory of 2456 2572 dpjvp.exe 35 PID 2572 wrote to memory of 2456 2572 dpjvp.exe 35 PID 2572 wrote to memory of 2456 2572 dpjvp.exe 35 PID 2456 wrote to memory of 2948 2456 ffrxflr.exe 36 PID 2456 wrote to memory of 2948 2456 ffrxflr.exe 36 PID 2456 wrote to memory of 2948 2456 ffrxflr.exe 36 PID 2456 wrote to memory of 2948 2456 ffrxflr.exe 36 PID 2948 wrote to memory of 2944 2948 9lflxfr.exe 37 PID 2948 wrote to memory of 2944 2948 9lflxfr.exe 37 PID 2948 wrote to memory of 2944 2948 9lflxfr.exe 37 PID 2948 wrote to memory of 2944 2948 9lflxfr.exe 37 PID 2944 wrote to memory of 1936 2944 7btbtb.exe 38 PID 2944 wrote to memory of 1936 2944 7btbtb.exe 38 PID 2944 wrote to memory of 1936 2944 7btbtb.exe 38 PID 2944 wrote to memory of 1936 2944 7btbtb.exe 38 PID 1936 wrote to memory of 2040 1936 nnhnbh.exe 39 PID 1936 wrote to memory of 2040 1936 nnhnbh.exe 39 PID 1936 wrote to memory of 2040 1936 nnhnbh.exe 39 PID 1936 wrote to memory of 2040 1936 nnhnbh.exe 39 PID 2040 wrote to memory of 2732 2040 pjdjj.exe 40 PID 2040 wrote to memory of 2732 2040 pjdjj.exe 40 PID 2040 wrote to memory of 2732 2040 pjdjj.exe 40 PID 2040 wrote to memory of 2732 2040 pjdjj.exe 40 PID 2732 wrote to memory of 2812 2732 rfxlxlf.exe 41 PID 2732 wrote to memory of 2812 2732 rfxlxlf.exe 41 PID 2732 wrote to memory of 2812 2732 rfxlxlf.exe 41 PID 2732 wrote to memory of 2812 2732 rfxlxlf.exe 41 PID 2812 wrote to memory of 2956 2812 lxflflx.exe 42 PID 2812 wrote to memory of 2956 2812 lxflflx.exe 42 PID 2812 wrote to memory of 2956 2812 lxflflx.exe 42 PID 2812 wrote to memory of 2956 2812 lxflflx.exe 42 PID 2956 wrote to memory of 1656 2956 3bthth.exe 43 PID 2956 wrote to memory of 1656 2956 3bthth.exe 43 PID 2956 wrote to memory of 1656 2956 3bthth.exe 43 PID 2956 wrote to memory of 1656 2956 3bthth.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\a34a36fc7e0a2bd3df136ee6e67c94a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a34a36fc7e0a2bd3df136ee6e67c94a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\3xrllrl.exec:\3xrllrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\btnthh.exec:\btnthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\9pddv.exec:\9pddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\xxflrrl.exec:\xxflrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\nnhnbb.exec:\nnhnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\hhbttb.exec:\hhbttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\dpjvp.exec:\dpjvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\ffrxflr.exec:\ffrxflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\9lflxfr.exec:\9lflxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\7btbtb.exec:\7btbtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\nnhnbh.exec:\nnhnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\pjdjj.exec:\pjdjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\rfxlxlf.exec:\rfxlxlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\lxflflx.exec:\lxflflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\3bthth.exec:\3bthth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\nbntbb.exec:\nbntbb.exe17⤵
- Executes dropped EXE
PID:1656 -
\??\c:\5ppdv.exec:\5ppdv.exe18⤵
- Executes dropped EXE
PID:1076 -
\??\c:\lflrflx.exec:\lflrflx.exe19⤵
- Executes dropped EXE
PID:1700 -
\??\c:\lxlrflr.exec:\lxlrflr.exe20⤵
- Executes dropped EXE
PID:1736 -
\??\c:\thbhht.exec:\thbhht.exe21⤵
- Executes dropped EXE
PID:2272 -
\??\c:\hbhbhh.exec:\hbhbhh.exe22⤵
- Executes dropped EXE
PID:580 -
\??\c:\pjddp.exec:\pjddp.exe23⤵
- Executes dropped EXE
PID:1168 -
\??\c:\7pdjp.exec:\7pdjp.exe24⤵
- Executes dropped EXE
PID:584 -
\??\c:\xlfllrr.exec:\xlfllrr.exe25⤵
- Executes dropped EXE
PID:1628 -
\??\c:\hbnhtn.exec:\hbnhtn.exe26⤵
- Executes dropped EXE
PID:844 -
\??\c:\nhbnbh.exec:\nhbnbh.exe27⤵
- Executes dropped EXE
PID:1324 -
\??\c:\jdpvp.exec:\jdpvp.exe28⤵
- Executes dropped EXE
PID:984 -
\??\c:\7ddjp.exec:\7ddjp.exe29⤵
- Executes dropped EXE
PID:2896 -
\??\c:\xlxflxl.exec:\xlxflxl.exe30⤵
- Executes dropped EXE
PID:2064 -
\??\c:\1ntbht.exec:\1ntbht.exe31⤵
- Executes dropped EXE
PID:1760 -
\??\c:\hntnbt.exec:\hntnbt.exe32⤵
- Executes dropped EXE
PID:2892 -
\??\c:\ppvvp.exec:\ppvvp.exe33⤵
- Executes dropped EXE
PID:2520 -
\??\c:\rrrrflx.exec:\rrrrflx.exe34⤵
- Executes dropped EXE
PID:1712 -
\??\c:\rlxfxrf.exec:\rlxfxrf.exe35⤵
- Executes dropped EXE
PID:3036 -
\??\c:\9nbhhh.exec:\9nbhhh.exe36⤵
- Executes dropped EXE
PID:3044 -
\??\c:\nhnhnn.exec:\nhnhnn.exe37⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jddvv.exec:\jddvv.exe38⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pjjvd.exec:\pjjvd.exe39⤵
- Executes dropped EXE
PID:2628 -
\??\c:\pjddj.exec:\pjddj.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\7xffrrx.exec:\7xffrrx.exe41⤵
- Executes dropped EXE
PID:2472 -
\??\c:\7rffxxl.exec:\7rffxxl.exe42⤵
- Executes dropped EXE
PID:2548 -
\??\c:\nhnnhh.exec:\nhnnhh.exe43⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nhhhhh.exec:\nhhhhh.exe44⤵
- Executes dropped EXE
PID:2512 -
\??\c:\7tthtb.exec:\7tthtb.exe45⤵
- Executes dropped EXE
PID:1928 -
\??\c:\jdppd.exec:\jdppd.exe46⤵
- Executes dropped EXE
PID:2964 -
\??\c:\vpjpj.exec:\vpjpj.exe47⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xlrxllr.exec:\xlrxllr.exe48⤵
- Executes dropped EXE
PID:2496 -
\??\c:\ffxfrxl.exec:\ffxfrxl.exe49⤵
- Executes dropped EXE
PID:1080 -
\??\c:\3tnntb.exec:\3tnntb.exe50⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vjjvj.exec:\vjjvj.exe51⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vdjvd.exec:\vdjvd.exe52⤵
- Executes dropped EXE
PID:2160 -
\??\c:\rfxfrlf.exec:\rfxfrlf.exe53⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xrflfrf.exec:\xrflfrf.exe54⤵
- Executes dropped EXE
PID:2288 -
\??\c:\5rxlxxf.exec:\5rxlxxf.exe55⤵
- Executes dropped EXE
PID:1084 -
\??\c:\ttnnbn.exec:\ttnnbn.exe56⤵
- Executes dropped EXE
PID:672 -
\??\c:\ttnnth.exec:\ttnnth.exe57⤵
- Executes dropped EXE
PID:1740 -
\??\c:\3jdvd.exec:\3jdvd.exe58⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jvjpv.exec:\jvjpv.exe59⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rrfxlll.exec:\rrfxlll.exe60⤵
- Executes dropped EXE
PID:784 -
\??\c:\bbtbnt.exec:\bbtbnt.exe61⤵
- Executes dropped EXE
PID:588 -
\??\c:\hhttnt.exec:\hhttnt.exe62⤵
- Executes dropped EXE
PID:1496 -
\??\c:\jdjpv.exec:\jdjpv.exe63⤵
- Executes dropped EXE
PID:1600 -
\??\c:\jdddj.exec:\jdddj.exe64⤵
- Executes dropped EXE
PID:820 -
\??\c:\jdppp.exec:\jdppp.exe65⤵
- Executes dropped EXE
PID:2180 -
\??\c:\3lfxfff.exec:\3lfxfff.exe66⤵PID:2396
-
\??\c:\xrflllx.exec:\xrflllx.exe67⤵PID:108
-
\??\c:\tnhthn.exec:\tnhthn.exe68⤵PID:2328
-
\??\c:\bnnnbb.exec:\bnnnbb.exe69⤵PID:2984
-
\??\c:\vjvdv.exec:\vjvdv.exe70⤵PID:1236
-
\??\c:\pvdvd.exec:\pvdvd.exe71⤵PID:2064
-
\??\c:\bthhnn.exec:\bthhnn.exe72⤵PID:1524
-
\??\c:\nbnhhn.exec:\nbnhhn.exe73⤵PID:1940
-
\??\c:\dvdjd.exec:\dvdjd.exe74⤵PID:1580
-
\??\c:\vpvvd.exec:\vpvvd.exe75⤵PID:3004
-
\??\c:\frxlxxf.exec:\frxlxxf.exe76⤵PID:1388
-
\??\c:\5xlrxxx.exec:\5xlrxxx.exe77⤵PID:3036
-
\??\c:\tntbhb.exec:\tntbhb.exe78⤵PID:2784
-
\??\c:\tbnhtn.exec:\tbnhtn.exe79⤵PID:2644
-
\??\c:\vjvdd.exec:\vjvdd.exe80⤵PID:2564
-
\??\c:\vpddj.exec:\vpddj.exe81⤵PID:2628
-
\??\c:\fxffllr.exec:\fxffllr.exe82⤵PID:2672
-
\??\c:\lfrrfxl.exec:\lfrrfxl.exe83⤵PID:2472
-
\??\c:\nhtbnn.exec:\nhtbnn.exe84⤵PID:2044
-
\??\c:\ntbbht.exec:\ntbbht.exe85⤵PID:2440
-
\??\c:\htbhhh.exec:\htbhhh.exe86⤵PID:2512
-
\??\c:\vjvdd.exec:\vjvdd.exe87⤵PID:1928
-
\??\c:\vjpvd.exec:\vjpvd.exe88⤵PID:2964
-
\??\c:\xlxxflr.exec:\xlxxflr.exe89⤵PID:3040
-
\??\c:\rfrrlxf.exec:\rfrrlxf.exe90⤵PID:2496
-
\??\c:\btttbt.exec:\btttbt.exe91⤵PID:1080
-
\??\c:\bthhnn.exec:\bthhnn.exe92⤵PID:1632
-
\??\c:\dpvpj.exec:\dpvpj.exe93⤵PID:2832
-
\??\c:\jdvvj.exec:\jdvvj.exe94⤵PID:2836
-
\??\c:\lfrxfrx.exec:\lfrxfrx.exe95⤵PID:2844
-
\??\c:\ffxxlrf.exec:\ffxxlrf.exe96⤵PID:2288
-
\??\c:\lxffffl.exec:\lxffffl.exe97⤵PID:2284
-
\??\c:\btnthh.exec:\btnthh.exe98⤵PID:2264
-
\??\c:\hhntnh.exec:\hhntnh.exe99⤵PID:1740
-
\??\c:\vvddp.exec:\vvddp.exe100⤵PID:1876
-
\??\c:\pjvdp.exec:\pjvdp.exe101⤵PID:2056
-
\??\c:\rfrrrrf.exec:\rfrrrrf.exe102⤵PID:784
-
\??\c:\1fxflff.exec:\1fxflff.exe103⤵PID:588
-
\??\c:\hbbhnt.exec:\hbbhnt.exe104⤵PID:1152
-
\??\c:\btntnn.exec:\btntnn.exe105⤵PID:1812
-
\??\c:\7jdvj.exec:\7jdvj.exe106⤵PID:2404
-
\??\c:\pjvvd.exec:\pjvvd.exe107⤵PID:2180
-
\??\c:\pjddd.exec:\pjddd.exe108⤵PID:2000
-
\??\c:\rrllxxl.exec:\rrllxxl.exe109⤵PID:108
-
\??\c:\rlxxffr.exec:\rlxxffr.exe110⤵PID:1916
-
\??\c:\bnhhhb.exec:\bnhhhb.exe111⤵PID:2984
-
\??\c:\nbnthn.exec:\nbnthn.exe112⤵PID:2300
-
\??\c:\pjvpd.exec:\pjvpd.exe113⤵PID:2360
-
\??\c:\pjjjp.exec:\pjjjp.exe114⤵PID:2220
-
\??\c:\lrxrrlr.exec:\lrxrrlr.exe115⤵PID:1940
-
\??\c:\llxflfr.exec:\llxflfr.exe116⤵PID:3028
-
\??\c:\xxrflrr.exec:\xxrflrr.exe117⤵PID:3004
-
\??\c:\7nntbb.exec:\7nntbb.exe118⤵PID:1208
-
\??\c:\ppddj.exec:\ppddj.exe119⤵PID:3036
-
\??\c:\pdddp.exec:\pdddp.exe120⤵PID:2072
-
\??\c:\rrrxrfx.exec:\rrrxrfx.exe121⤵PID:2380
-
\??\c:\1xfrrxf.exec:\1xfrrxf.exe122⤵PID:2560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-