Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 08:27
Behavioral task
behavioral1
Sample
df4a2f0950fd5fd0232ebafb11bc79f0_NeikiAnalytics.exe
Resource
win7-20240220-en
General
-
Target
df4a2f0950fd5fd0232ebafb11bc79f0_NeikiAnalytics.exe
-
Size
190KB
-
MD5
df4a2f0950fd5fd0232ebafb11bc79f0
-
SHA1
c7d9216b255bf48a667a7ffe05134b7954527a70
-
SHA256
296aba48d67da8c2fd5637e13c8636a0c56acfaa8e899e4ed9ea2f75ccbe1369
-
SHA512
3af1ee0096c24f07239bccb54fc2bd37de1ebf6594f52b3c2e75b75701c705b8249a43efc92bf1174923e4c222b61a57cdf2c56b7073f1359b45a175cedc6e73
-
SSDEEP
3072:YhOmTsF93UYfwC6GIoutLmxHxae5yLpcgDE4JBuItR8pTsgnKbQFe3+k:Ycm4FmowdHoSLEaTBftapTsyFeOk
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2784-8-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/3052-18-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2576-27-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2508-36-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2392-48-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2588-63-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2400-66-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2796-81-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1572-84-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2676-100-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1468-117-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1588-134-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1284-167-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2352-184-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/404-195-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/404-194-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/3068-204-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1208-214-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/3008-223-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1716-240-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1560-244-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/292-259-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2856-269-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1988-278-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2072-286-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/292-304-0x00000000002B0000-0x00000000002E0000-memory.dmp family_blackmoon behavioral1/memory/2724-321-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2424-364-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2804-395-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1612-408-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1736-422-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/1872-423-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2968-529-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1696-543-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2608-625-0x0000000000230000-0x0000000000260000-memory.dmp family_blackmoon behavioral1/memory/2600-639-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1972-749-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/284-798-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1696-878-0x00000000002C0000-0x00000000002F0000-memory.dmp family_blackmoon behavioral1/memory/1720-1189-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000b00000001472f-5.dat family_berbew behavioral1/files/0x0030000000014f57-16.dat family_berbew behavioral1/files/0x00080000000153ee-25.dat family_berbew behavioral1/files/0x000700000001565a-35.dat family_berbew behavioral1/files/0x0007000000015662-45.dat family_berbew behavioral1/files/0x00070000000158d9-54.dat family_berbew behavioral1/files/0x0007000000015ae3-61.dat family_berbew behavioral1/files/0x0009000000015b85-72.dat family_berbew behavioral1/files/0x0007000000015d85-80.dat family_berbew behavioral1/files/0x0006000000015d9c-90.dat family_berbew behavioral1/files/0x0006000000015f23-101.dat family_berbew behavioral1/files/0x0006000000015fa6-107.dat family_berbew behavioral1/files/0x0006000000016013-115.dat family_berbew behavioral1/files/0x0006000000016122-125.dat family_berbew behavioral1/files/0x00060000000161ee-132.dat family_berbew behavioral1/files/0x00060000000163eb-141.dat family_berbew behavioral1/files/0x00060000000164ec-149.dat family_berbew behavioral1/files/0x0006000000016575-158.dat family_berbew behavioral1/files/0x00060000000167bf-165.dat family_berbew behavioral1/files/0x0006000000016a28-175.dat family_berbew behavioral1/files/0x0006000000016c1f-185.dat family_berbew behavioral1/files/0x0006000000016c30-196.dat family_berbew behavioral1/files/0x003000000001507a-205.dat family_berbew behavioral1/files/0x0006000000016c38-213.dat family_berbew behavioral1/files/0x0006000000016c84-224.dat family_berbew behavioral1/files/0x0006000000016cb5-232.dat family_berbew behavioral1/files/0x0006000000016ce0-241.dat family_berbew behavioral1/files/0x0006000000016ced-250.dat family_berbew behavioral1/files/0x0006000000016cf3-260.dat family_berbew behavioral1/files/0x0006000000016cfd-268.dat family_berbew behavioral1/files/0x0006000000016d06-277.dat family_berbew behavioral1/files/0x0006000000016d10-287.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 3052 lllrrff.exe 2576 nhtnhh.exe 2508 xrlrllx.exe 2484 nnnbnh.exe 2392 pvppd.exe 2588 djpdj.exe 2400 bbhttt.exe 2796 pppjv.exe 1572 7flxlrx.exe 2676 rlflrxx.exe 2820 vpppd.exe 1468 1pjjv.exe 1568 ffrlrrl.exe 1588 hnbttb.exe 780 vvpjd.exe 644 rrxfxxr.exe 2268 tbttth.exe 1284 dvjdd.exe 2204 rfrxrxf.exe 2352 fxrlrxr.exe 404 hnbhnt.exe 3068 xxflfxx.exe 1208 hbnbhh.exe 3008 jdppd.exe 1212 xxlllrr.exe 1716 thbnbb.exe 1560 pjjpp.exe 292 xfxffff.exe 2856 hntbnt.exe 1988 ddvjv.exe 2072 rflrlfx.exe 356 nhnttn.exe 2300 9pjjj.exe 2160 rlxxflf.exe 2784 tnhnbt.exe 2556 pdpvj.exe 2724 jdppj.exe 2376 fffrrlx.exe 2616 1nbntn.exe 2468 jdpdj.exe 2396 pvjdj.exe 2364 rrflxxx.exe 2424 rxrfffl.exe 2880 nnnhht.exe 2800 vvvpp.exe 1800 fllfxlr.exe 2692 lxlrxlx.exe 2804 hnbnbt.exe 2780 jvvpv.exe 1612 ddjdd.exe 1532 flllfxf.exe 1736 bhbbnn.exe 1872 djdvd.exe 1368 pvpjp.exe 2344 xfrfrfl.exe 1252 hnnnht.exe 1084 hhthtb.exe 2040 vvjdv.exe 2164 5pvvj.exe 2312 llrflxl.exe 1420 3lxrrrr.exe 352 nhhnnh.exe 956 dpddp.exe 2108 ppdpd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2784 wrote to memory of 3052 2784 df4a2f0950fd5fd0232ebafb11bc79f0_NeikiAnalytics.exe 28 PID 2784 wrote to memory of 3052 2784 df4a2f0950fd5fd0232ebafb11bc79f0_NeikiAnalytics.exe 28 PID 2784 wrote to memory of 3052 2784 df4a2f0950fd5fd0232ebafb11bc79f0_NeikiAnalytics.exe 28 PID 2784 wrote to memory of 3052 2784 df4a2f0950fd5fd0232ebafb11bc79f0_NeikiAnalytics.exe 28 PID 3052 wrote to memory of 2576 3052 lllrrff.exe 29 PID 3052 wrote to memory of 2576 3052 lllrrff.exe 29 PID 3052 wrote to memory of 2576 3052 lllrrff.exe 29 PID 3052 wrote to memory of 2576 3052 lllrrff.exe 29 PID 2576 wrote to memory of 2508 2576 nhtnhh.exe 30 PID 2576 wrote to memory of 2508 2576 nhtnhh.exe 30 PID 2576 wrote to memory of 2508 2576 nhtnhh.exe 30 PID 2576 wrote to memory of 2508 2576 nhtnhh.exe 30 PID 2508 wrote to memory of 2484 2508 xrlrllx.exe 31 PID 2508 wrote to memory of 2484 2508 xrlrllx.exe 31 PID 2508 wrote to memory of 2484 2508 xrlrllx.exe 31 PID 2508 wrote to memory of 2484 2508 xrlrllx.exe 31 PID 2484 wrote to memory of 2392 2484 nnnbnh.exe 32 PID 2484 wrote to memory of 2392 2484 nnnbnh.exe 32 PID 2484 wrote to memory of 2392 2484 nnnbnh.exe 32 PID 2484 wrote to memory of 2392 2484 nnnbnh.exe 32 PID 2392 wrote to memory of 2588 2392 pvppd.exe 33 PID 2392 wrote to memory of 2588 2392 pvppd.exe 33 PID 2392 wrote to memory of 2588 2392 pvppd.exe 33 PID 2392 wrote to memory of 2588 2392 pvppd.exe 33 PID 2588 wrote to memory of 2400 2588 djpdj.exe 34 PID 2588 wrote to memory of 2400 2588 djpdj.exe 34 PID 2588 wrote to memory of 2400 2588 djpdj.exe 34 PID 2588 wrote to memory of 2400 2588 djpdj.exe 34 PID 2400 wrote to memory of 2796 2400 bbhttt.exe 35 PID 2400 wrote to memory of 2796 2400 bbhttt.exe 35 PID 2400 wrote to memory of 2796 2400 bbhttt.exe 35 PID 2400 wrote to memory of 2796 2400 bbhttt.exe 35 PID 2796 wrote to memory of 1572 2796 pppjv.exe 36 PID 2796 wrote to memory of 1572 2796 pppjv.exe 36 PID 2796 wrote to memory of 1572 2796 pppjv.exe 36 PID 2796 wrote to memory of 1572 2796 pppjv.exe 36 PID 1572 wrote to memory of 2676 1572 7flxlrx.exe 37 PID 1572 wrote to memory of 2676 1572 7flxlrx.exe 37 PID 1572 wrote to memory of 2676 1572 7flxlrx.exe 37 PID 1572 wrote to memory of 2676 1572 7flxlrx.exe 37 PID 2676 wrote to memory of 2820 2676 rlflrxx.exe 38 PID 2676 wrote to memory of 2820 2676 rlflrxx.exe 38 PID 2676 wrote to memory of 2820 2676 rlflrxx.exe 38 PID 2676 wrote to memory of 2820 2676 rlflrxx.exe 38 PID 2820 wrote to memory of 1468 2820 vpppd.exe 39 PID 2820 wrote to memory of 1468 2820 vpppd.exe 39 PID 2820 wrote to memory of 1468 2820 vpppd.exe 39 PID 2820 wrote to memory of 1468 2820 vpppd.exe 39 PID 1468 wrote to memory of 1568 1468 1pjjv.exe 40 PID 1468 wrote to memory of 1568 1468 1pjjv.exe 40 PID 1468 wrote to memory of 1568 1468 1pjjv.exe 40 PID 1468 wrote to memory of 1568 1468 1pjjv.exe 40 PID 1568 wrote to memory of 1588 1568 ffrlrrl.exe 41 PID 1568 wrote to memory of 1588 1568 ffrlrrl.exe 41 PID 1568 wrote to memory of 1588 1568 ffrlrrl.exe 41 PID 1568 wrote to memory of 1588 1568 ffrlrrl.exe 41 PID 1588 wrote to memory of 780 1588 hnbttb.exe 42 PID 1588 wrote to memory of 780 1588 hnbttb.exe 42 PID 1588 wrote to memory of 780 1588 hnbttb.exe 42 PID 1588 wrote to memory of 780 1588 hnbttb.exe 42 PID 780 wrote to memory of 644 780 vvpjd.exe 43 PID 780 wrote to memory of 644 780 vvpjd.exe 43 PID 780 wrote to memory of 644 780 vvpjd.exe 43 PID 780 wrote to memory of 644 780 vvpjd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\df4a2f0950fd5fd0232ebafb11bc79f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\df4a2f0950fd5fd0232ebafb11bc79f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\lllrrff.exec:\lllrrff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\nhtnhh.exec:\nhtnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\xrlrllx.exec:\xrlrllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\nnnbnh.exec:\nnnbnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\pvppd.exec:\pvppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\djpdj.exec:\djpdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\bbhttt.exec:\bbhttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\pppjv.exec:\pppjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\7flxlrx.exec:\7flxlrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\rlflrxx.exec:\rlflrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\vpppd.exec:\vpppd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\1pjjv.exec:\1pjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\ffrlrrl.exec:\ffrlrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\hnbttb.exec:\hnbttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\vvpjd.exec:\vvpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\rrxfxxr.exec:\rrxfxxr.exe17⤵
- Executes dropped EXE
PID:644 -
\??\c:\tbttth.exec:\tbttth.exe18⤵
- Executes dropped EXE
PID:2268 -
\??\c:\dvjdd.exec:\dvjdd.exe19⤵
- Executes dropped EXE
PID:1284 -
\??\c:\rfrxrxf.exec:\rfrxrxf.exe20⤵
- Executes dropped EXE
PID:2204 -
\??\c:\fxrlrxr.exec:\fxrlrxr.exe21⤵
- Executes dropped EXE
PID:2352 -
\??\c:\hnbhnt.exec:\hnbhnt.exe22⤵
- Executes dropped EXE
PID:404 -
\??\c:\xxflfxx.exec:\xxflfxx.exe23⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hbnbhh.exec:\hbnbhh.exe24⤵
- Executes dropped EXE
PID:1208 -
\??\c:\jdppd.exec:\jdppd.exe25⤵
- Executes dropped EXE
PID:3008 -
\??\c:\xxlllrr.exec:\xxlllrr.exe26⤵
- Executes dropped EXE
PID:1212 -
\??\c:\thbnbb.exec:\thbnbb.exe27⤵
- Executes dropped EXE
PID:1716 -
\??\c:\pjjpp.exec:\pjjpp.exe28⤵
- Executes dropped EXE
PID:1560 -
\??\c:\xfxffff.exec:\xfxffff.exe29⤵
- Executes dropped EXE
PID:292 -
\??\c:\hntbnt.exec:\hntbnt.exe30⤵
- Executes dropped EXE
PID:2856 -
\??\c:\ddvjv.exec:\ddvjv.exe31⤵
- Executes dropped EXE
PID:1988 -
\??\c:\rflrlfx.exec:\rflrlfx.exe32⤵
- Executes dropped EXE
PID:2072 -
\??\c:\nhnttn.exec:\nhnttn.exe33⤵
- Executes dropped EXE
PID:356 -
\??\c:\9pjjj.exec:\9pjjj.exe34⤵
- Executes dropped EXE
PID:2300 -
\??\c:\rlxxflf.exec:\rlxxflf.exe35⤵
- Executes dropped EXE
PID:2160 -
\??\c:\tnhnbt.exec:\tnhnbt.exe36⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pdpvj.exec:\pdpvj.exe37⤵
- Executes dropped EXE
PID:2556 -
\??\c:\jdppj.exec:\jdppj.exe38⤵
- Executes dropped EXE
PID:2724 -
\??\c:\fffrrlx.exec:\fffrrlx.exe39⤵
- Executes dropped EXE
PID:2376 -
\??\c:\1nbntn.exec:\1nbntn.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jdpdj.exec:\jdpdj.exe41⤵
- Executes dropped EXE
PID:2468 -
\??\c:\pvjdj.exec:\pvjdj.exe42⤵
- Executes dropped EXE
PID:2396 -
\??\c:\rrflxxx.exec:\rrflxxx.exe43⤵
- Executes dropped EXE
PID:2364 -
\??\c:\rxrfffl.exec:\rxrfffl.exe44⤵
- Executes dropped EXE
PID:2424 -
\??\c:\nnnhht.exec:\nnnhht.exe45⤵
- Executes dropped EXE
PID:2880 -
\??\c:\vvvpp.exec:\vvvpp.exe46⤵
- Executes dropped EXE
PID:2800 -
\??\c:\fllfxlr.exec:\fllfxlr.exe47⤵
- Executes dropped EXE
PID:1800 -
\??\c:\lxlrxlx.exec:\lxlrxlx.exe48⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hnbnbt.exec:\hnbnbt.exe49⤵
- Executes dropped EXE
PID:2804 -
\??\c:\jvvpv.exec:\jvvpv.exe50⤵
- Executes dropped EXE
PID:2780 -
\??\c:\ddjdd.exec:\ddjdd.exe51⤵
- Executes dropped EXE
PID:1612 -
\??\c:\flllfxf.exec:\flllfxf.exe52⤵
- Executes dropped EXE
PID:1532 -
\??\c:\bhbbnn.exec:\bhbbnn.exe53⤵
- Executes dropped EXE
PID:1736 -
\??\c:\djdvd.exec:\djdvd.exe54⤵
- Executes dropped EXE
PID:1872 -
\??\c:\pvpjp.exec:\pvpjp.exe55⤵
- Executes dropped EXE
PID:1368 -
\??\c:\xfrfrfl.exec:\xfrfrfl.exe56⤵
- Executes dropped EXE
PID:2344 -
\??\c:\hnnnht.exec:\hnnnht.exe57⤵
- Executes dropped EXE
PID:1252 -
\??\c:\hhthtb.exec:\hhthtb.exe58⤵
- Executes dropped EXE
PID:1084 -
\??\c:\vvjdv.exec:\vvjdv.exe59⤵
- Executes dropped EXE
PID:2040 -
\??\c:\5pvvj.exec:\5pvvj.exe60⤵
- Executes dropped EXE
PID:2164 -
\??\c:\llrflxl.exec:\llrflxl.exe61⤵
- Executes dropped EXE
PID:2312 -
\??\c:\3lxrrrr.exec:\3lxrrrr.exe62⤵
- Executes dropped EXE
PID:1420 -
\??\c:\nhhnnh.exec:\nhhnnh.exe63⤵
- Executes dropped EXE
PID:352 -
\??\c:\dpddp.exec:\dpddp.exe64⤵
- Executes dropped EXE
PID:956 -
\??\c:\ppdpd.exec:\ppdpd.exe65⤵
- Executes dropped EXE
PID:2108 -
\??\c:\flfxrfx.exec:\flfxrfx.exe66⤵PID:2884
-
\??\c:\1nhthn.exec:\1nhthn.exe67⤵PID:284
-
\??\c:\nnntth.exec:\nnntth.exe68⤵PID:3008
-
\??\c:\jpvvp.exec:\jpvvp.exe69⤵PID:1212
-
\??\c:\fflxlxx.exec:\fflxlxx.exe70⤵PID:2968
-
\??\c:\fxllxxf.exec:\fxllxxf.exe71⤵PID:472
-
\??\c:\3pddj.exec:\3pddj.exe72⤵PID:1580
-
\??\c:\3vvjd.exec:\3vvjd.exe73⤵PID:1696
-
\??\c:\rxfrffx.exec:\rxfrffx.exe74⤵PID:1224
-
\??\c:\5xrxffr.exec:\5xrxffr.exe75⤵PID:2936
-
\??\c:\ntthtb.exec:\ntthtb.exe76⤵PID:2124
-
\??\c:\bbttnb.exec:\bbttnb.exe77⤵PID:896
-
\??\c:\fxlllrr.exec:\fxlllrr.exe78⤵PID:1852
-
\??\c:\xrflxxf.exec:\xrflxxf.exe79⤵PID:1536
-
\??\c:\htnnnn.exec:\htnnnn.exe80⤵PID:2460
-
\??\c:\ppdjv.exec:\ppdjv.exe81⤵PID:2476
-
\??\c:\jdjjv.exec:\jdjjv.exe82⤵PID:2620
-
\??\c:\xrlfxfr.exec:\xrlfxfr.exe83⤵PID:2572
-
\??\c:\bbbhth.exec:\bbbhth.exe84⤵PID:2656
-
\??\c:\ddvjp.exec:\ddvjp.exe85⤵PID:2608
-
\??\c:\5pvdp.exec:\5pvdp.exe86⤵PID:2408
-
\??\c:\5llrxlr.exec:\5llrxlr.exe87⤵PID:2480
-
\??\c:\9bbbnt.exec:\9bbbnt.exe88⤵PID:2600
-
\??\c:\ppvpj.exec:\ppvpj.exe89⤵PID:2980
-
\??\c:\7pvdd.exec:\7pvdd.exe90⤵PID:2792
-
\??\c:\fxxrxlf.exec:\fxxrxlf.exe91⤵PID:2536
-
\??\c:\tbhbnb.exec:\tbhbnb.exe92⤵PID:2680
-
\??\c:\bbbnbb.exec:\bbbnbb.exe93⤵PID:2648
-
\??\c:\jjjvp.exec:\jjjvp.exe94⤵PID:2788
-
\??\c:\lfffflr.exec:\lfffflr.exe95⤵PID:2820
-
\??\c:\fxlllfr.exec:\fxlllfr.exe96⤵PID:2912
-
\??\c:\nhntht.exec:\nhntht.exe97⤵PID:1628
-
\??\c:\pdpjd.exec:\pdpjd.exe98⤵PID:1380
-
\??\c:\djvvj.exec:\djvvj.exe99⤵PID:1088
-
\??\c:\rlxflxr.exec:\rlxflxr.exe100⤵PID:2428
-
\??\c:\bnhbhb.exec:\bnhbhb.exe101⤵PID:1372
-
\??\c:\1bhhnt.exec:\1bhhnt.exe102⤵PID:2208
-
\??\c:\dvvjv.exec:\dvvjv.exe103⤵PID:1856
-
\??\c:\vpvpv.exec:\vpvpv.exe104⤵PID:1968
-
\??\c:\lxlfllr.exec:\lxlfllr.exe105⤵PID:2040
-
\??\c:\3nbtnh.exec:\3nbtnh.exe106⤵PID:1972
-
\??\c:\tttbbb.exec:\tttbbb.exe107⤵PID:2312
-
\??\c:\3djjd.exec:\3djjd.exe108⤵PID:1420
-
\??\c:\xrrxxxf.exec:\xrrxxxf.exe109⤵PID:1164
-
\??\c:\lxxrrlf.exec:\lxxrrlf.exe110⤵PID:1160
-
\??\c:\bbnhtn.exec:\bbnhtn.exe111⤵PID:1028
-
\??\c:\tthtth.exec:\tthtth.exe112⤵PID:448
-
\??\c:\vdvpp.exec:\vdvpp.exe113⤵PID:284
-
\??\c:\lrfrflr.exec:\lrfrflr.exe114⤵PID:2896
-
\??\c:\nthbbb.exec:\nthbbb.exe115⤵PID:1716
-
\??\c:\nthntn.exec:\nthntn.exe116⤵PID:272
-
\??\c:\vjvjp.exec:\vjvjp.exe117⤵PID:2252
-
\??\c:\lrrfxrr.exec:\lrrfxrr.exe118⤵PID:632
-
\??\c:\rrlxrrf.exec:\rrlxrrf.exe119⤵PID:1696
-
\??\c:\btntnn.exec:\btntnn.exe120⤵PID:1892
-
\??\c:\5nbbhh.exec:\5nbbhh.exe121⤵PID:2320
-
\??\c:\vjvvd.exec:\vjvvd.exe122⤵PID:916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-