Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 19:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe
-
Size
74KB
-
MD5
062fbc89edfabbe4d40646eaaa1df6f0
-
SHA1
deb31373d58cbe019bc3df1758aee381151444e3
-
SHA256
006eca97dc6bb8d62ffd77d69cd7a8977a8b8ba321f21a9825c673a08764a80a
-
SHA512
ef116305234975e178c54d8f8d412f2c3e908e3904ebfdc4127c1f71729c6d95c71c85ad7ddb42bc01f4763eba13413ef4588deb165cb069787c63c6e4e9893f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJSsD+cGUFzJI:ymb3NkkiQ3mdBjFIwsDhbN6
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral1/memory/2112-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-86-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1396-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/772-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/332-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2112 hhbhnn.exe 2824 pjjdj.exe 2240 frffffr.exe 2776 5nbbhn.exe 2624 xrffrrl.exe 2812 5rxxrrl.exe 2520 5jvdd.exe 3000 vppvv.exe 2016 rrlrlfr.exe 2744 nnhhnt.exe 2864 1ppvp.exe 1032 9vvpp.exe 1256 llrrrrl.exe 1396 nhthbh.exe 1444 hbthnt.exe 2576 vpvvj.exe 772 xrfrflx.exe 804 lxfrxxf.exe 2280 btnbnb.exe 1896 7hhhnb.exe 2940 dvpdp.exe 332 xrffxxx.exe 1480 ttnhtt.exe 3016 9hhhtt.exe 636 djvpd.exe 1960 9xxllrx.exe 1716 fxlxfrx.exe 1788 tbhhhn.exe 2468 htntth.exe 2448 9ddjp.exe 2416 fxrxrrf.exe 2144 tnbbbb.exe 2824 3vppj.exe 2356 5pjdj.exe 2616 5xlrflx.exe 2660 ffxlrfr.exe 1648 bhnnbn.exe 2544 vpddp.exe 2672 vvvdd.exe 1964 3xlrffl.exe 2572 rlrxxxl.exe 2388 btbthn.exe 2556 btbbbh.exe 2712 9jdjp.exe 2876 jdjdj.exe 2696 rrrflrl.exe 2992 lfrrxfr.exe 1248 tththh.exe 1932 3hnnnh.exe 1928 pjvvd.exe 1052 vvjdp.exe 2568 fxfxlll.exe 1280 rlxlxxl.exe 768 thnnnt.exe 1796 5btnbh.exe 2604 nhtntb.exe 2040 ddvpp.exe 1612 pjvpv.exe 700 xrflrxl.exe 1164 fxllrfl.exe 716 7hbtnn.exe 1784 dvjpd.exe 3012 lrlrflx.exe 1324 lxxlrfl.exe -
resource yara_rule behavioral1/memory/2112-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/772-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/332-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2112 2416 062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe 28 PID 2416 wrote to memory of 2112 2416 062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe 28 PID 2416 wrote to memory of 2112 2416 062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe 28 PID 2416 wrote to memory of 2112 2416 062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe 28 PID 2112 wrote to memory of 2824 2112 hhbhnn.exe 29 PID 2112 wrote to memory of 2824 2112 hhbhnn.exe 29 PID 2112 wrote to memory of 2824 2112 hhbhnn.exe 29 PID 2112 wrote to memory of 2824 2112 hhbhnn.exe 29 PID 2824 wrote to memory of 2240 2824 pjjdj.exe 30 PID 2824 wrote to memory of 2240 2824 pjjdj.exe 30 PID 2824 wrote to memory of 2240 2824 pjjdj.exe 30 PID 2824 wrote to memory of 2240 2824 pjjdj.exe 30 PID 2240 wrote to memory of 2776 2240 frffffr.exe 31 PID 2240 wrote to memory of 2776 2240 frffffr.exe 31 PID 2240 wrote to memory of 2776 2240 frffffr.exe 31 PID 2240 wrote to memory of 2776 2240 frffffr.exe 31 PID 2776 wrote to memory of 2624 2776 5nbbhn.exe 32 PID 2776 wrote to memory of 2624 2776 5nbbhn.exe 32 PID 2776 wrote to memory of 2624 2776 5nbbhn.exe 32 PID 2776 wrote to memory of 2624 2776 5nbbhn.exe 32 PID 2624 wrote to memory of 2812 2624 xrffrrl.exe 33 PID 2624 wrote to memory of 2812 2624 xrffrrl.exe 33 PID 2624 wrote to memory of 2812 2624 xrffrrl.exe 33 PID 2624 wrote to memory of 2812 2624 xrffrrl.exe 33 PID 2812 wrote to memory of 2520 2812 5rxxrrl.exe 34 PID 2812 wrote to memory of 2520 2812 5rxxrrl.exe 34 PID 2812 wrote to memory of 2520 2812 5rxxrrl.exe 34 PID 2812 wrote to memory of 2520 2812 5rxxrrl.exe 34 PID 2520 wrote to memory of 3000 2520 5jvdd.exe 35 PID 2520 wrote to memory of 3000 2520 5jvdd.exe 35 PID 2520 wrote to memory of 3000 2520 5jvdd.exe 35 PID 2520 wrote to memory of 3000 2520 5jvdd.exe 35 PID 3000 wrote to memory of 2016 3000 vppvv.exe 36 PID 3000 wrote to memory of 2016 3000 vppvv.exe 36 PID 3000 wrote to memory of 2016 3000 vppvv.exe 36 PID 3000 wrote to memory of 2016 3000 vppvv.exe 36 PID 2016 wrote to memory of 2744 2016 rrlrlfr.exe 37 PID 2016 wrote to memory of 2744 2016 rrlrlfr.exe 37 PID 2016 wrote to memory of 2744 2016 rrlrlfr.exe 37 PID 2016 wrote to memory of 2744 2016 rrlrlfr.exe 37 PID 2744 wrote to memory of 2864 2744 nnhhnt.exe 38 PID 2744 wrote to memory of 2864 2744 nnhhnt.exe 38 PID 2744 wrote to memory of 2864 2744 nnhhnt.exe 38 PID 2744 wrote to memory of 2864 2744 nnhhnt.exe 38 PID 2864 wrote to memory of 1032 2864 1ppvp.exe 39 PID 2864 wrote to memory of 1032 2864 1ppvp.exe 39 PID 2864 wrote to memory of 1032 2864 1ppvp.exe 39 PID 2864 wrote to memory of 1032 2864 1ppvp.exe 39 PID 1032 wrote to memory of 1256 1032 9vvpp.exe 40 PID 1032 wrote to memory of 1256 1032 9vvpp.exe 40 PID 1032 wrote to memory of 1256 1032 9vvpp.exe 40 PID 1032 wrote to memory of 1256 1032 9vvpp.exe 40 PID 1256 wrote to memory of 1396 1256 llrrrrl.exe 41 PID 1256 wrote to memory of 1396 1256 llrrrrl.exe 41 PID 1256 wrote to memory of 1396 1256 llrrrrl.exe 41 PID 1256 wrote to memory of 1396 1256 llrrrrl.exe 41 PID 1396 wrote to memory of 1444 1396 nhthbh.exe 42 PID 1396 wrote to memory of 1444 1396 nhthbh.exe 42 PID 1396 wrote to memory of 1444 1396 nhthbh.exe 42 PID 1396 wrote to memory of 1444 1396 nhthbh.exe 42 PID 1444 wrote to memory of 2576 1444 hbthnt.exe 43 PID 1444 wrote to memory of 2576 1444 hbthnt.exe 43 PID 1444 wrote to memory of 2576 1444 hbthnt.exe 43 PID 1444 wrote to memory of 2576 1444 hbthnt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\062fbc89edfabbe4d40646eaaa1df6f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\hhbhnn.exec:\hhbhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\pjjdj.exec:\pjjdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\frffffr.exec:\frffffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\5nbbhn.exec:\5nbbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\xrffrrl.exec:\xrffrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\5rxxrrl.exec:\5rxxrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\5jvdd.exec:\5jvdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\vppvv.exec:\vppvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\rrlrlfr.exec:\rrlrlfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\nnhhnt.exec:\nnhhnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\1ppvp.exec:\1ppvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\9vvpp.exec:\9vvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\llrrrrl.exec:\llrrrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\nhthbh.exec:\nhthbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\hbthnt.exec:\hbthnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\vpvvj.exec:\vpvvj.exe17⤵
- Executes dropped EXE
PID:2576 -
\??\c:\xrfrflx.exec:\xrfrflx.exe18⤵
- Executes dropped EXE
PID:772 -
\??\c:\lxfrxxf.exec:\lxfrxxf.exe19⤵
- Executes dropped EXE
PID:804 -
\??\c:\btnbnb.exec:\btnbnb.exe20⤵
- Executes dropped EXE
PID:2280 -
\??\c:\7hhhnb.exec:\7hhhnb.exe21⤵
- Executes dropped EXE
PID:1896 -
\??\c:\dvpdp.exec:\dvpdp.exe22⤵
- Executes dropped EXE
PID:2940 -
\??\c:\xrffxxx.exec:\xrffxxx.exe23⤵
- Executes dropped EXE
PID:332 -
\??\c:\ttnhtt.exec:\ttnhtt.exe24⤵
- Executes dropped EXE
PID:1480 -
\??\c:\9hhhtt.exec:\9hhhtt.exe25⤵
- Executes dropped EXE
PID:3016 -
\??\c:\djvpd.exec:\djvpd.exe26⤵
- Executes dropped EXE
PID:636 -
\??\c:\9xxllrx.exec:\9xxllrx.exe27⤵
- Executes dropped EXE
PID:1960 -
\??\c:\fxlxfrx.exec:\fxlxfrx.exe28⤵
- Executes dropped EXE
PID:1716 -
\??\c:\tbhhhn.exec:\tbhhhn.exe29⤵
- Executes dropped EXE
PID:1788 -
\??\c:\htntth.exec:\htntth.exe30⤵
- Executes dropped EXE
PID:2468 -
\??\c:\9ddjp.exec:\9ddjp.exe31⤵
- Executes dropped EXE
PID:2448 -
\??\c:\fxrxrrf.exec:\fxrxrrf.exe32⤵
- Executes dropped EXE
PID:2416 -
\??\c:\tnbbbb.exec:\tnbbbb.exe33⤵
- Executes dropped EXE
PID:2144 -
\??\c:\3vppj.exec:\3vppj.exe34⤵
- Executes dropped EXE
PID:2824 -
\??\c:\5pjdj.exec:\5pjdj.exe35⤵
- Executes dropped EXE
PID:2356 -
\??\c:\5xlrflx.exec:\5xlrflx.exe36⤵
- Executes dropped EXE
PID:2616 -
\??\c:\ffxlrfr.exec:\ffxlrfr.exe37⤵
- Executes dropped EXE
PID:2660 -
\??\c:\bhnnbn.exec:\bhnnbn.exe38⤵
- Executes dropped EXE
PID:1648 -
\??\c:\vpddp.exec:\vpddp.exe39⤵
- Executes dropped EXE
PID:2544 -
\??\c:\vvvdd.exec:\vvvdd.exe40⤵
- Executes dropped EXE
PID:2672 -
\??\c:\3xlrffl.exec:\3xlrffl.exe41⤵
- Executes dropped EXE
PID:1964 -
\??\c:\rlrxxxl.exec:\rlrxxxl.exe42⤵
- Executes dropped EXE
PID:2572 -
\??\c:\btbthn.exec:\btbthn.exe43⤵
- Executes dropped EXE
PID:2388 -
\??\c:\btbbbh.exec:\btbbbh.exe44⤵
- Executes dropped EXE
PID:2556 -
\??\c:\9jdjp.exec:\9jdjp.exe45⤵
- Executes dropped EXE
PID:2712 -
\??\c:\jdjdj.exec:\jdjdj.exe46⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rrrflrl.exec:\rrrflrl.exe47⤵
- Executes dropped EXE
PID:2696 -
\??\c:\lfrrxfr.exec:\lfrrxfr.exe48⤵
- Executes dropped EXE
PID:2992 -
\??\c:\tththh.exec:\tththh.exe49⤵
- Executes dropped EXE
PID:1248 -
\??\c:\3hnnnh.exec:\3hnnnh.exe50⤵
- Executes dropped EXE
PID:1932 -
\??\c:\pjvvd.exec:\pjvvd.exe51⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vvjdp.exec:\vvjdp.exe52⤵
- Executes dropped EXE
PID:1052 -
\??\c:\fxfxlll.exec:\fxfxlll.exe53⤵
- Executes dropped EXE
PID:2568 -
\??\c:\rlxlxxl.exec:\rlxlxxl.exe54⤵
- Executes dropped EXE
PID:1280 -
\??\c:\thnnnt.exec:\thnnnt.exe55⤵
- Executes dropped EXE
PID:768 -
\??\c:\5btnbh.exec:\5btnbh.exe56⤵
- Executes dropped EXE
PID:1796 -
\??\c:\nhtntb.exec:\nhtntb.exe57⤵
- Executes dropped EXE
PID:2604 -
\??\c:\ddvpp.exec:\ddvpp.exe58⤵
- Executes dropped EXE
PID:2040 -
\??\c:\pjvpv.exec:\pjvpv.exe59⤵
- Executes dropped EXE
PID:1612 -
\??\c:\xrflrxl.exec:\xrflrxl.exe60⤵
- Executes dropped EXE
PID:700 -
\??\c:\fxllrfl.exec:\fxllrfl.exe61⤵
- Executes dropped EXE
PID:1164 -
\??\c:\7hbtnn.exec:\7hbtnn.exe62⤵
- Executes dropped EXE
PID:716 -
\??\c:\dvjpd.exec:\dvjpd.exe63⤵
- Executes dropped EXE
PID:1784 -
\??\c:\lrlrflx.exec:\lrlrflx.exe64⤵
- Executes dropped EXE
PID:3012 -
\??\c:\lxxlrfl.exec:\lxxlrfl.exe65⤵
- Executes dropped EXE
PID:1324 -
\??\c:\hbhnnb.exec:\hbhnnb.exe66⤵PID:2440
-
\??\c:\9btbhn.exec:\9btbhn.exe67⤵PID:1508
-
\??\c:\pjdpv.exec:\pjdpv.exe68⤵PID:1680
-
\??\c:\ddppd.exec:\ddppd.exe69⤵PID:1788
-
\??\c:\xxxxxfr.exec:\xxxxxfr.exe70⤵PID:1092
-
\??\c:\rlffrrf.exec:\rlffrrf.exe71⤵PID:2400
-
\??\c:\1hthbh.exec:\1hthbh.exe72⤵PID:2448
-
\??\c:\tnbhtb.exec:\tnbhtb.exe73⤵PID:2348
-
\??\c:\pjjvv.exec:\pjjvv.exe74⤵PID:2364
-
\??\c:\pjjdv.exec:\pjjdv.exe75⤵PID:2284
-
\??\c:\ffrxlff.exec:\ffrxlff.exe76⤵PID:2356
-
\??\c:\rllxrrf.exec:\rllxrrf.exe77⤵PID:2616
-
\??\c:\bththn.exec:\bththn.exe78⤵PID:2660
-
\??\c:\hbtnbh.exec:\hbtnbh.exe79⤵PID:2624
-
\??\c:\7dvjj.exec:\7dvjj.exe80⤵PID:2544
-
\??\c:\xxfrlxr.exec:\xxfrlxr.exe81⤵PID:2512
-
\??\c:\xxrxrxl.exec:\xxrxrxl.exe82⤵PID:1964
-
\??\c:\bttttt.exec:\bttttt.exe83⤵PID:2208
-
\??\c:\nhttnh.exec:\nhttnh.exe84⤵PID:2388
-
\??\c:\jvvdj.exec:\jvvdj.exe85⤵PID:2016
-
\??\c:\jjdpd.exec:\jjdpd.exe86⤵PID:2712
-
\??\c:\rfrflfl.exec:\rfrflfl.exe87⤵PID:2744
-
\??\c:\fxflrrl.exec:\fxflrrl.exe88⤵PID:1968
-
\??\c:\hhbtht.exec:\hhbtht.exe89⤵PID:2992
-
\??\c:\btbhnn.exec:\btbhnn.exe90⤵PID:1248
-
\??\c:\pjdjd.exec:\pjdjd.exe91⤵PID:1724
-
\??\c:\1dvdd.exec:\1dvdd.exe92⤵PID:1928
-
\??\c:\lfxfflx.exec:\lfxfflx.exe93⤵PID:1444
-
\??\c:\fxllfxl.exec:\fxllfxl.exe94⤵PID:2568
-
\??\c:\hhbhnb.exec:\hhbhnb.exe95⤵PID:1752
-
\??\c:\bbbnnt.exec:\bbbnnt.exe96⤵PID:1740
-
\??\c:\3vvdj.exec:\3vvdj.exe97⤵PID:1476
-
\??\c:\jdjvp.exec:\jdjvp.exe98⤵PID:2604
-
\??\c:\lffrxff.exec:\lffrxff.exe99⤵PID:2380
-
\??\c:\bhtbhh.exec:\bhtbhh.exe100⤵PID:784
-
\??\c:\3tnnnn.exec:\3tnnnn.exe101⤵PID:1484
-
\??\c:\jdvvd.exec:\jdvvd.exe102⤵PID:1164
-
\??\c:\jdvvd.exec:\jdvvd.exe103⤵PID:324
-
\??\c:\9llxffl.exec:\9llxffl.exe104⤵PID:2480
-
\??\c:\rfrrrfr.exec:\rfrrrfr.exe105⤵PID:1152
-
\??\c:\1bthnb.exec:\1bthnb.exe106⤵PID:932
-
\??\c:\1bntbb.exec:\1bntbb.exe107⤵PID:1708
-
\??\c:\pjvjj.exec:\pjvjj.exe108⤵PID:608
-
\??\c:\3dvvd.exec:\3dvvd.exe109⤵PID:1688
-
\??\c:\lxrxfxl.exec:\lxrxfxl.exe110⤵PID:1616
-
\??\c:\rlxlxfr.exec:\rlxlxfr.exe111⤵PID:2828
-
\??\c:\btntbh.exec:\btntbh.exe112⤵PID:1584
-
\??\c:\7tnbnt.exec:\7tnbnt.exe113⤵PID:1560
-
\??\c:\jdddj.exec:\jdddj.exe114⤵PID:1684
-
\??\c:\dvjpd.exec:\dvjpd.exe115⤵PID:2656
-
\??\c:\rxxlflr.exec:\rxxlflr.exe116⤵PID:2908
-
\??\c:\lfllrfl.exec:\lfllrfl.exe117⤵PID:2752
-
\??\c:\5btbbh.exec:\5btbbh.exe118⤵PID:2292
-
\??\c:\tnnnth.exec:\tnnnth.exe119⤵PID:2080
-
\??\c:\jjddd.exec:\jjddd.exe120⤵PID:2460
-
\??\c:\vvjjd.exec:\vvjjd.exe121⤵PID:2508
-
\??\c:\fxxxlrf.exec:\fxxxlrf.exe122⤵PID:2796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-