Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 07:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d38573a15be7abde854f49ac976ad280_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
d38573a15be7abde854f49ac976ad280_NeikiAnalytics.exe
-
Size
64KB
-
MD5
d38573a15be7abde854f49ac976ad280
-
SHA1
957cf4f1f928e4fecd75b4b73e35a031930d55bf
-
SHA256
b8f821774c575f933a31879f6489a0ab71680c162248bbdd8b02b9f708041c6e
-
SHA512
0373dc23ff8278cf935abbc1104293befb6a3270e1f02f8514b49ff84bd8396f47d5de82a5707d020b0ae69259b038dec2e18a9a88c54e53b2be5251aefb6d3d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+Luvf:ymb3NkkiQ3mdBjF0yMlc
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2944-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/540-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/560-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1308-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2956 rrlrlxr.exe 1632 tnhnht.exe 2584 lrxlrrl.exe 2668 xrffxfl.exe 2728 bnnnbb.exe 2744 pvjvv.exe 1952 llfxxxf.exe 2512 tbhbtn.exe 1944 vdvpj.exe 2700 lfxflff.exe 2864 ntbttn.exe 2772 btbhtb.exe 2496 pvpvd.exe 1872 rlxllxr.exe 2788 bhbnht.exe 2832 pjvdj.exe 2060 djpdv.exe 1332 xrfxrxl.exe 2028 9hnhbh.exe 2192 djjdj.exe 2420 vpdpv.exe 540 rxfrlfr.exe 1604 tbhbnt.exe 1744 hthbbh.exe 1576 9jjjp.exe 1956 vpjdd.exe 560 nbtbtn.exe 1308 hbttbh.exe 2280 7pjpd.exe 872 ppdvd.exe 1628 7fxxffr.exe 3064 bthhtt.exe 2096 tntthn.exe 2208 ppjjv.exe 284 vvvdp.exe 2032 5nnnbh.exe 2288 thttnn.exe 2640 pdvpp.exe 2556 pjddp.exe 2812 9xrffrr.exe 2852 rrllrxl.exe 2468 tnnnth.exe 2492 bbnnhn.exe 2088 djjdp.exe 1636 5lfllxr.exe 2976 bbhthh.exe 2700 bbbtnn.exe 2676 7pdjp.exe 2024 9jvjp.exe 2324 lxlffxf.exe 3028 xlllfxl.exe 2680 nhtbhn.exe 2788 ddjjj.exe 2808 jjdvj.exe 1512 lfrrrxl.exe 2304 3fxlrxr.exe 2008 nntnnb.exe 1132 ttnttb.exe 2912 vppdv.exe 324 jdjjp.exe 1128 9lfxlll.exe 1856 xxlxxxf.exe 900 hbnntn.exe 2052 3nhthn.exe -
resource yara_rule behavioral1/memory/2944-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/540-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/560-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1308-276-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2944 wrote to memory of 2956 2944 d38573a15be7abde854f49ac976ad280_NeikiAnalytics.exe 28 PID 2944 wrote to memory of 2956 2944 d38573a15be7abde854f49ac976ad280_NeikiAnalytics.exe 28 PID 2944 wrote to memory of 2956 2944 d38573a15be7abde854f49ac976ad280_NeikiAnalytics.exe 28 PID 2944 wrote to memory of 2956 2944 d38573a15be7abde854f49ac976ad280_NeikiAnalytics.exe 28 PID 2956 wrote to memory of 1632 2956 rrlrlxr.exe 29 PID 2956 wrote to memory of 1632 2956 rrlrlxr.exe 29 PID 2956 wrote to memory of 1632 2956 rrlrlxr.exe 29 PID 2956 wrote to memory of 1632 2956 rrlrlxr.exe 29 PID 1632 wrote to memory of 2584 1632 tnhnht.exe 30 PID 1632 wrote to memory of 2584 1632 tnhnht.exe 30 PID 1632 wrote to memory of 2584 1632 tnhnht.exe 30 PID 1632 wrote to memory of 2584 1632 tnhnht.exe 30 PID 2584 wrote to memory of 2668 2584 lrxlrrl.exe 31 PID 2584 wrote to memory of 2668 2584 lrxlrrl.exe 31 PID 2584 wrote to memory of 2668 2584 lrxlrrl.exe 31 PID 2584 wrote to memory of 2668 2584 lrxlrrl.exe 31 PID 2668 wrote to memory of 2728 2668 xrffxfl.exe 32 PID 2668 wrote to memory of 2728 2668 xrffxfl.exe 32 PID 2668 wrote to memory of 2728 2668 xrffxfl.exe 32 PID 2668 wrote to memory of 2728 2668 xrffxfl.exe 32 PID 2728 wrote to memory of 2744 2728 bnnnbb.exe 33 PID 2728 wrote to memory of 2744 2728 bnnnbb.exe 33 PID 2728 wrote to memory of 2744 2728 bnnnbb.exe 33 PID 2728 wrote to memory of 2744 2728 bnnnbb.exe 33 PID 2744 wrote to memory of 1952 2744 pvjvv.exe 34 PID 2744 wrote to memory of 1952 2744 pvjvv.exe 34 PID 2744 wrote to memory of 1952 2744 pvjvv.exe 34 PID 2744 wrote to memory of 1952 2744 pvjvv.exe 34 PID 1952 wrote to memory of 2512 1952 llfxxxf.exe 35 PID 1952 wrote to memory of 2512 1952 llfxxxf.exe 35 PID 1952 wrote to memory of 2512 1952 llfxxxf.exe 35 PID 1952 wrote to memory of 2512 1952 llfxxxf.exe 35 PID 2512 wrote to memory of 1944 2512 tbhbtn.exe 36 PID 2512 wrote to memory of 1944 2512 tbhbtn.exe 36 PID 2512 wrote to memory of 1944 2512 tbhbtn.exe 36 PID 2512 wrote to memory of 1944 2512 tbhbtn.exe 36 PID 1944 wrote to memory of 2700 1944 vdvpj.exe 37 PID 1944 wrote to memory of 2700 1944 vdvpj.exe 37 PID 1944 wrote to memory of 2700 1944 vdvpj.exe 37 PID 1944 wrote to memory of 2700 1944 vdvpj.exe 37 PID 2700 wrote to memory of 2864 2700 lfxflff.exe 38 PID 2700 wrote to memory of 2864 2700 lfxflff.exe 38 PID 2700 wrote to memory of 2864 2700 lfxflff.exe 38 PID 2700 wrote to memory of 2864 2700 lfxflff.exe 38 PID 2864 wrote to memory of 2772 2864 ntbttn.exe 39 PID 2864 wrote to memory of 2772 2864 ntbttn.exe 39 PID 2864 wrote to memory of 2772 2864 ntbttn.exe 39 PID 2864 wrote to memory of 2772 2864 ntbttn.exe 39 PID 2772 wrote to memory of 2496 2772 btbhtb.exe 40 PID 2772 wrote to memory of 2496 2772 btbhtb.exe 40 PID 2772 wrote to memory of 2496 2772 btbhtb.exe 40 PID 2772 wrote to memory of 2496 2772 btbhtb.exe 40 PID 2496 wrote to memory of 1872 2496 pvpvd.exe 41 PID 2496 wrote to memory of 1872 2496 pvpvd.exe 41 PID 2496 wrote to memory of 1872 2496 pvpvd.exe 41 PID 2496 wrote to memory of 1872 2496 pvpvd.exe 41 PID 1872 wrote to memory of 2788 1872 rlxllxr.exe 42 PID 1872 wrote to memory of 2788 1872 rlxllxr.exe 42 PID 1872 wrote to memory of 2788 1872 rlxllxr.exe 42 PID 1872 wrote to memory of 2788 1872 rlxllxr.exe 42 PID 2788 wrote to memory of 2832 2788 bhbnht.exe 43 PID 2788 wrote to memory of 2832 2788 bhbnht.exe 43 PID 2788 wrote to memory of 2832 2788 bhbnht.exe 43 PID 2788 wrote to memory of 2832 2788 bhbnht.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\d38573a15be7abde854f49ac976ad280_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d38573a15be7abde854f49ac976ad280_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\rrlrlxr.exec:\rrlrlxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\tnhnht.exec:\tnhnht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\lrxlrrl.exec:\lrxlrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\xrffxfl.exec:\xrffxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\bnnnbb.exec:\bnnnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\pvjvv.exec:\pvjvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\llfxxxf.exec:\llfxxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\tbhbtn.exec:\tbhbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\vdvpj.exec:\vdvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\lfxflff.exec:\lfxflff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\ntbttn.exec:\ntbttn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\btbhtb.exec:\btbhtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\pvpvd.exec:\pvpvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\rlxllxr.exec:\rlxllxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\bhbnht.exec:\bhbnht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\pjvdj.exec:\pjvdj.exe17⤵
- Executes dropped EXE
PID:2832 -
\??\c:\djpdv.exec:\djpdv.exe18⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xrfxrxl.exec:\xrfxrxl.exe19⤵
- Executes dropped EXE
PID:1332 -
\??\c:\9hnhbh.exec:\9hnhbh.exe20⤵
- Executes dropped EXE
PID:2028 -
\??\c:\djjdj.exec:\djjdj.exe21⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vpdpv.exec:\vpdpv.exe22⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rxfrlfr.exec:\rxfrlfr.exe23⤵
- Executes dropped EXE
PID:540 -
\??\c:\tbhbnt.exec:\tbhbnt.exe24⤵
- Executes dropped EXE
PID:1604 -
\??\c:\hthbbh.exec:\hthbbh.exe25⤵
- Executes dropped EXE
PID:1744 -
\??\c:\9jjjp.exec:\9jjjp.exe26⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vpjdd.exec:\vpjdd.exe27⤵
- Executes dropped EXE
PID:1956 -
\??\c:\nbtbtn.exec:\nbtbtn.exe28⤵
- Executes dropped EXE
PID:560 -
\??\c:\hbttbh.exec:\hbttbh.exe29⤵
- Executes dropped EXE
PID:1308 -
\??\c:\7pjpd.exec:\7pjpd.exe30⤵
- Executes dropped EXE
PID:2280 -
\??\c:\ppdvd.exec:\ppdvd.exe31⤵
- Executes dropped EXE
PID:872 -
\??\c:\7fxxffr.exec:\7fxxffr.exe32⤵
- Executes dropped EXE
PID:1628 -
\??\c:\bthhtt.exec:\bthhtt.exe33⤵
- Executes dropped EXE
PID:3064 -
\??\c:\tntthn.exec:\tntthn.exe34⤵
- Executes dropped EXE
PID:2096 -
\??\c:\ppjjv.exec:\ppjjv.exe35⤵
- Executes dropped EXE
PID:2208 -
\??\c:\vvvdp.exec:\vvvdp.exe36⤵
- Executes dropped EXE
PID:284 -
\??\c:\5nnnbh.exec:\5nnnbh.exe37⤵
- Executes dropped EXE
PID:2032 -
\??\c:\thttnn.exec:\thttnn.exe38⤵
- Executes dropped EXE
PID:2288 -
\??\c:\pdvpp.exec:\pdvpp.exe39⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pjddp.exec:\pjddp.exe40⤵
- Executes dropped EXE
PID:2556 -
\??\c:\9xrffrr.exec:\9xrffrr.exe41⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rrllrxl.exec:\rrllrxl.exe42⤵
- Executes dropped EXE
PID:2852 -
\??\c:\tnnnth.exec:\tnnnth.exe43⤵
- Executes dropped EXE
PID:2468 -
\??\c:\bbnnhn.exec:\bbnnhn.exe44⤵
- Executes dropped EXE
PID:2492 -
\??\c:\djjdp.exec:\djjdp.exe45⤵
- Executes dropped EXE
PID:2088 -
\??\c:\5lfllxr.exec:\5lfllxr.exe46⤵
- Executes dropped EXE
PID:1636 -
\??\c:\bbhthh.exec:\bbhthh.exe47⤵
- Executes dropped EXE
PID:2976 -
\??\c:\bbbtnn.exec:\bbbtnn.exe48⤵
- Executes dropped EXE
PID:2700 -
\??\c:\7pdjp.exec:\7pdjp.exe49⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9jvjp.exec:\9jvjp.exe50⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lxlffxf.exec:\lxlffxf.exe51⤵
- Executes dropped EXE
PID:2324 -
\??\c:\xlllfxl.exec:\xlllfxl.exe52⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nhtbhn.exec:\nhtbhn.exe53⤵
- Executes dropped EXE
PID:2680 -
\??\c:\ddjjj.exec:\ddjjj.exe54⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jjdvj.exec:\jjdvj.exe55⤵
- Executes dropped EXE
PID:2808 -
\??\c:\lfrrrxl.exec:\lfrrrxl.exe56⤵
- Executes dropped EXE
PID:1512 -
\??\c:\3fxlrxr.exec:\3fxlrxr.exe57⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nntnnb.exec:\nntnnb.exe58⤵
- Executes dropped EXE
PID:2008 -
\??\c:\ttnttb.exec:\ttnttb.exe59⤵
- Executes dropped EXE
PID:1132 -
\??\c:\vppdv.exec:\vppdv.exe60⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jdjjp.exec:\jdjjp.exe61⤵
- Executes dropped EXE
PID:324 -
\??\c:\9lfxlll.exec:\9lfxlll.exe62⤵
- Executes dropped EXE
PID:1128 -
\??\c:\xxlxxxf.exec:\xxlxxxf.exe63⤵
- Executes dropped EXE
PID:1856 -
\??\c:\hbnntn.exec:\hbnntn.exe64⤵
- Executes dropped EXE
PID:900 -
\??\c:\3nhthn.exec:\3nhthn.exe65⤵
- Executes dropped EXE
PID:2052 -
\??\c:\djvvj.exec:\djvvj.exe66⤵PID:1788
-
\??\c:\5jdjv.exec:\5jdjv.exe67⤵PID:1736
-
\??\c:\fxlrrrl.exec:\fxlrrrl.exe68⤵PID:952
-
\??\c:\xrlxrrx.exec:\xrlxrrx.exe69⤵PID:1036
-
\??\c:\bthhnt.exec:\bthhnt.exe70⤵PID:2924
-
\??\c:\bbtbnh.exec:\bbtbnh.exe71⤵PID:2212
-
\??\c:\vdpjp.exec:\vdpjp.exe72⤵PID:864
-
\??\c:\1rrrxxx.exec:\1rrrxxx.exe73⤵PID:1948
-
\??\c:\rrfrllx.exec:\rrfrllx.exe74⤵PID:1600
-
\??\c:\hntnbb.exec:\hntnbb.exe75⤵PID:2176
-
\??\c:\pjjjv.exec:\pjjjv.exe76⤵PID:2956
-
\??\c:\dppjp.exec:\dppjp.exe77⤵PID:300
-
\??\c:\ddjpj.exec:\ddjpj.exe78⤵PID:2628
-
\??\c:\flxxrlx.exec:\flxxrlx.exe79⤵PID:2308
-
\??\c:\btbhtt.exec:\btbhtt.exe80⤵PID:2732
-
\??\c:\hbnntb.exec:\hbnntb.exe81⤵PID:2904
-
\??\c:\vjjvj.exec:\vjjvj.exe82⤵PID:2464
-
\??\c:\5fxfrrr.exec:\5fxfrrr.exe83⤵PID:2660
-
\??\c:\flxrllr.exec:\flxrllr.exe84⤵PID:2552
-
\??\c:\bntbbt.exec:\bntbbt.exe85⤵PID:1940
-
\??\c:\djvdj.exec:\djvdj.exe86⤵PID:1952
-
\??\c:\vjvdj.exec:\vjvdj.exe87⤵PID:2296
-
\??\c:\lfffrrr.exec:\lfffrrr.exe88⤵PID:1432
-
\??\c:\xlxxffl.exec:\xlxxffl.exe89⤵PID:2980
-
\??\c:\5nnbhh.exec:\5nnbhh.exe90⤵PID:2972
-
\??\c:\jvvvj.exec:\jvvvj.exe91⤵PID:1840
-
\??\c:\djvvd.exec:\djvvd.exe92⤵PID:1524
-
\??\c:\xfffllf.exec:\xfffllf.exe93⤵PID:2692
-
\??\c:\lrlxlxf.exec:\lrlxlxf.exe94⤵PID:1872
-
\??\c:\hnhbbt.exec:\hnhbbt.exe95⤵PID:2824
-
\??\c:\tbnthh.exec:\tbnthh.exe96⤵PID:2800
-
\??\c:\vpjpv.exec:\vpjpv.exe97⤵PID:1440
-
\??\c:\9jdjv.exec:\9jdjv.exe98⤵PID:1396
-
\??\c:\fxxlrff.exec:\fxxlrff.exe99⤵PID:2084
-
\??\c:\nnbhtt.exec:\nnbhtt.exe100⤵PID:2100
-
\??\c:\htttnn.exec:\htttnn.exe101⤵PID:2192
-
\??\c:\vdpjd.exec:\vdpjd.exe102⤵PID:2416
-
\??\c:\fxffrrx.exec:\fxffrrx.exe103⤵PID:1648
-
\??\c:\rlflrfl.exec:\rlflrfl.exe104⤵PID:1488
-
\??\c:\bnntht.exec:\bnntht.exe105⤵PID:816
-
\??\c:\tnnnnb.exec:\tnnnnb.exe106⤵PID:808
-
\??\c:\jpjdp.exec:\jpjdp.exe107⤵PID:2144
-
\??\c:\xrlrfrl.exec:\xrlrfrl.exe108⤵PID:1816
-
\??\c:\rlflxlf.exec:\rlflxlf.exe109⤵PID:1936
-
\??\c:\bttbht.exec:\bttbht.exe110⤵PID:764
-
\??\c:\jpdjv.exec:\jpdjv.exe111⤵PID:1308
-
\??\c:\pjvdp.exec:\pjvdp.exe112⤵PID:768
-
\??\c:\lxlffrl.exec:\lxlffrl.exe113⤵PID:1880
-
\??\c:\ntbbnt.exec:\ntbbnt.exe114⤵PID:1496
-
\??\c:\btntnh.exec:\btntnh.exe115⤵PID:1712
-
\??\c:\ppvvj.exec:\ppvvj.exe116⤵PID:2352
-
\??\c:\jpdpv.exec:\jpdpv.exe117⤵PID:2096
-
\??\c:\ffrflrf.exec:\ffrflrf.exe118⤵PID:2208
-
\??\c:\nntbbh.exec:\nntbbh.exe119⤵PID:2648
-
\??\c:\rxrlxfr.exec:\rxrlxfr.exe120⤵PID:2032
-
\??\c:\xfrxrxf.exec:\xfrxrxf.exe121⤵PID:2092
-
\??\c:\thntbt.exec:\thntbt.exe122⤵PID:2640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-