Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 05:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
afae590fee0f526a31fff02dd6ddfb80_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
afae590fee0f526a31fff02dd6ddfb80_NeikiAnalytics.exe
-
Size
74KB
-
MD5
afae590fee0f526a31fff02dd6ddfb80
-
SHA1
d6d5b7165f94e65e41526f890f7375f36527c946
-
SHA256
4d3c1495196558a78676b376ac9a4dde2dc92c685170b4bade09206d8bf24f65
-
SHA512
2c68b79a803cd76ff366257520df50ee8192326e87d07177b34f28c9893e7342dc006e911942ebc2076d90a2d56e61723c8845a1b050aa60fb87e7ff403110e0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5TEom:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCqJ
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2276-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-60-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/852-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1424-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1328-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1876-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2912 7dppd.exe 2552 xlxfllr.exe 2768 thtthb.exe 2540 bthhnn.exe 2436 jdddv.exe 2456 jdpvd.exe 2460 9bnbnt.exe 3060 9tntht.exe 1620 jdvdj.exe 852 jdppd.exe 2692 xrxfllr.exe 2704 7tnntt.exe 1596 tnhhhn.exe 1572 1vjjp.exe 2116 jvddp.exe 2304 7xlrrxf.exe 2032 rlfrxfr.exe 2844 5btbnt.exe 1212 jjpdp.exe 1972 vpppv.exe 672 xfrfxxr.exe 1424 nhtbhn.exe 2356 nhttbn.exe 304 nbtnbh.exe 1656 dddvj.exe 1328 xfxxflr.exe 376 7lffllr.exe 3052 lfrxlfl.exe 1876 tnbhnt.exe 1032 jjddj.exe 3020 lffrxxl.exe 2204 fxfxffl.exe 2892 3lrrffl.exe 2616 hnntth.exe 2592 dpppv.exe 2628 pjvpp.exe 2588 ffrrxxl.exe 2524 lxlflff.exe 2652 hbbhth.exe 2544 5hhhtt.exe 2412 vvppj.exe 2440 dvjjp.exe 1240 3frrrrf.exe 2160 fxrxfxf.exe 628 nnhthn.exe 2384 hbnhnt.exe 1364 pjvdj.exe 1588 jdvdj.exe 2340 rlrrffl.exe 1288 9lxrxfl.exe 2132 nhtbbb.exe 1780 hbbnnt.exe 616 vvjvv.exe 2712 dvjjj.exe 1192 rflrxff.exe 1660 fxlfrrf.exe 2008 fxrflxf.exe 1952 nhnttt.exe 2244 hbtbht.exe 872 9pjpv.exe 1060 7ppvd.exe 840 1fxlllr.exe 1168 5xxxffr.exe 948 bbbbbt.exe -
resource yara_rule behavioral1/memory/2276-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/852-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1424-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1328-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1876-279-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2912 2276 afae590fee0f526a31fff02dd6ddfb80_NeikiAnalytics.exe 28 PID 2276 wrote to memory of 2912 2276 afae590fee0f526a31fff02dd6ddfb80_NeikiAnalytics.exe 28 PID 2276 wrote to memory of 2912 2276 afae590fee0f526a31fff02dd6ddfb80_NeikiAnalytics.exe 28 PID 2276 wrote to memory of 2912 2276 afae590fee0f526a31fff02dd6ddfb80_NeikiAnalytics.exe 28 PID 2912 wrote to memory of 2552 2912 7dppd.exe 29 PID 2912 wrote to memory of 2552 2912 7dppd.exe 29 PID 2912 wrote to memory of 2552 2912 7dppd.exe 29 PID 2912 wrote to memory of 2552 2912 7dppd.exe 29 PID 2552 wrote to memory of 2768 2552 xlxfllr.exe 30 PID 2552 wrote to memory of 2768 2552 xlxfllr.exe 30 PID 2552 wrote to memory of 2768 2552 xlxfllr.exe 30 PID 2552 wrote to memory of 2768 2552 xlxfllr.exe 30 PID 2768 wrote to memory of 2540 2768 thtthb.exe 31 PID 2768 wrote to memory of 2540 2768 thtthb.exe 31 PID 2768 wrote to memory of 2540 2768 thtthb.exe 31 PID 2768 wrote to memory of 2540 2768 thtthb.exe 31 PID 2540 wrote to memory of 2436 2540 bthhnn.exe 32 PID 2540 wrote to memory of 2436 2540 bthhnn.exe 32 PID 2540 wrote to memory of 2436 2540 bthhnn.exe 32 PID 2540 wrote to memory of 2436 2540 bthhnn.exe 32 PID 2436 wrote to memory of 2456 2436 jdddv.exe 33 PID 2436 wrote to memory of 2456 2436 jdddv.exe 33 PID 2436 wrote to memory of 2456 2436 jdddv.exe 33 PID 2436 wrote to memory of 2456 2436 jdddv.exe 33 PID 2456 wrote to memory of 2460 2456 jdpvd.exe 34 PID 2456 wrote to memory of 2460 2456 jdpvd.exe 34 PID 2456 wrote to memory of 2460 2456 jdpvd.exe 34 PID 2456 wrote to memory of 2460 2456 jdpvd.exe 34 PID 2460 wrote to memory of 3060 2460 9bnbnt.exe 35 PID 2460 wrote to memory of 3060 2460 9bnbnt.exe 35 PID 2460 wrote to memory of 3060 2460 9bnbnt.exe 35 PID 2460 wrote to memory of 3060 2460 9bnbnt.exe 35 PID 3060 wrote to memory of 1620 3060 9tntht.exe 36 PID 3060 wrote to memory of 1620 3060 9tntht.exe 36 PID 3060 wrote to memory of 1620 3060 9tntht.exe 36 PID 3060 wrote to memory of 1620 3060 9tntht.exe 36 PID 1620 wrote to memory of 852 1620 jdvdj.exe 37 PID 1620 wrote to memory of 852 1620 jdvdj.exe 37 PID 1620 wrote to memory of 852 1620 jdvdj.exe 37 PID 1620 wrote to memory of 852 1620 jdvdj.exe 37 PID 852 wrote to memory of 2692 852 jdppd.exe 38 PID 852 wrote to memory of 2692 852 jdppd.exe 38 PID 852 wrote to memory of 2692 852 jdppd.exe 38 PID 852 wrote to memory of 2692 852 jdppd.exe 38 PID 2692 wrote to memory of 2704 2692 xrxfllr.exe 39 PID 2692 wrote to memory of 2704 2692 xrxfllr.exe 39 PID 2692 wrote to memory of 2704 2692 xrxfllr.exe 39 PID 2692 wrote to memory of 2704 2692 xrxfllr.exe 39 PID 2704 wrote to memory of 1596 2704 7tnntt.exe 40 PID 2704 wrote to memory of 1596 2704 7tnntt.exe 40 PID 2704 wrote to memory of 1596 2704 7tnntt.exe 40 PID 2704 wrote to memory of 1596 2704 7tnntt.exe 40 PID 1596 wrote to memory of 1572 1596 tnhhhn.exe 41 PID 1596 wrote to memory of 1572 1596 tnhhhn.exe 41 PID 1596 wrote to memory of 1572 1596 tnhhhn.exe 41 PID 1596 wrote to memory of 1572 1596 tnhhhn.exe 41 PID 1572 wrote to memory of 2116 1572 1vjjp.exe 42 PID 1572 wrote to memory of 2116 1572 1vjjp.exe 42 PID 1572 wrote to memory of 2116 1572 1vjjp.exe 42 PID 1572 wrote to memory of 2116 1572 1vjjp.exe 42 PID 2116 wrote to memory of 2304 2116 jvddp.exe 43 PID 2116 wrote to memory of 2304 2116 jvddp.exe 43 PID 2116 wrote to memory of 2304 2116 jvddp.exe 43 PID 2116 wrote to memory of 2304 2116 jvddp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\afae590fee0f526a31fff02dd6ddfb80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\afae590fee0f526a31fff02dd6ddfb80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\7dppd.exec:\7dppd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\xlxfllr.exec:\xlxfllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\thtthb.exec:\thtthb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\bthhnn.exec:\bthhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\jdddv.exec:\jdddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\jdpvd.exec:\jdpvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\9bnbnt.exec:\9bnbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\9tntht.exec:\9tntht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\jdvdj.exec:\jdvdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\jdppd.exec:\jdppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\xrxfllr.exec:\xrxfllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\7tnntt.exec:\7tnntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\tnhhhn.exec:\tnhhhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\1vjjp.exec:\1vjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\jvddp.exec:\jvddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\7xlrrxf.exec:\7xlrrxf.exe17⤵
- Executes dropped EXE
PID:2304 -
\??\c:\rlfrxfr.exec:\rlfrxfr.exe18⤵
- Executes dropped EXE
PID:2032 -
\??\c:\5btbnt.exec:\5btbnt.exe19⤵
- Executes dropped EXE
PID:2844 -
\??\c:\jjpdp.exec:\jjpdp.exe20⤵
- Executes dropped EXE
PID:1212 -
\??\c:\vpppv.exec:\vpppv.exe21⤵
- Executes dropped EXE
PID:1972 -
\??\c:\xfrfxxr.exec:\xfrfxxr.exe22⤵
- Executes dropped EXE
PID:672 -
\??\c:\nhtbhn.exec:\nhtbhn.exe23⤵
- Executes dropped EXE
PID:1424 -
\??\c:\nhttbn.exec:\nhttbn.exe24⤵
- Executes dropped EXE
PID:2356 -
\??\c:\nbtnbh.exec:\nbtnbh.exe25⤵
- Executes dropped EXE
PID:304 -
\??\c:\dddvj.exec:\dddvj.exe26⤵
- Executes dropped EXE
PID:1656 -
\??\c:\xfxxflr.exec:\xfxxflr.exe27⤵
- Executes dropped EXE
PID:1328 -
\??\c:\7lffllr.exec:\7lffllr.exe28⤵
- Executes dropped EXE
PID:376 -
\??\c:\lfrxlfl.exec:\lfrxlfl.exe29⤵
- Executes dropped EXE
PID:3052 -
\??\c:\tnbhnt.exec:\tnbhnt.exe30⤵
- Executes dropped EXE
PID:1876 -
\??\c:\jjddj.exec:\jjddj.exe31⤵
- Executes dropped EXE
PID:1032 -
\??\c:\lffrxxl.exec:\lffrxxl.exe32⤵
- Executes dropped EXE
PID:3020 -
\??\c:\fxfxffl.exec:\fxfxffl.exe33⤵
- Executes dropped EXE
PID:2204 -
\??\c:\3lrrffl.exec:\3lrrffl.exe34⤵
- Executes dropped EXE
PID:2892 -
\??\c:\hnntth.exec:\hnntth.exe35⤵
- Executes dropped EXE
PID:2616 -
\??\c:\dpppv.exec:\dpppv.exe36⤵
- Executes dropped EXE
PID:2592 -
\??\c:\pjvpp.exec:\pjvpp.exe37⤵
- Executes dropped EXE
PID:2628 -
\??\c:\ffrrxxl.exec:\ffrrxxl.exe38⤵
- Executes dropped EXE
PID:2588 -
\??\c:\lxlflff.exec:\lxlflff.exe39⤵
- Executes dropped EXE
PID:2524 -
\??\c:\hbbhth.exec:\hbbhth.exe40⤵
- Executes dropped EXE
PID:2652 -
\??\c:\5hhhtt.exec:\5hhhtt.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\vvppj.exec:\vvppj.exe42⤵
- Executes dropped EXE
PID:2412 -
\??\c:\dvjjp.exec:\dvjjp.exe43⤵
- Executes dropped EXE
PID:2440 -
\??\c:\3frrrrf.exec:\3frrrrf.exe44⤵
- Executes dropped EXE
PID:1240 -
\??\c:\fxrxfxf.exec:\fxrxfxf.exe45⤵
- Executes dropped EXE
PID:2160 -
\??\c:\nnhthn.exec:\nnhthn.exe46⤵
- Executes dropped EXE
PID:628 -
\??\c:\hbnhnt.exec:\hbnhnt.exe47⤵
- Executes dropped EXE
PID:2384 -
\??\c:\pjvdj.exec:\pjvdj.exe48⤵
- Executes dropped EXE
PID:1364 -
\??\c:\jdvdj.exec:\jdvdj.exe49⤵
- Executes dropped EXE
PID:1588 -
\??\c:\rlrrffl.exec:\rlrrffl.exe50⤵
- Executes dropped EXE
PID:2340 -
\??\c:\9lxrxfl.exec:\9lxrxfl.exe51⤵
- Executes dropped EXE
PID:1288 -
\??\c:\nhtbbb.exec:\nhtbbb.exe52⤵
- Executes dropped EXE
PID:2132 -
\??\c:\hbbnnt.exec:\hbbnnt.exe53⤵
- Executes dropped EXE
PID:1780 -
\??\c:\vvjvv.exec:\vvjvv.exe54⤵
- Executes dropped EXE
PID:616 -
\??\c:\dvjjj.exec:\dvjjj.exe55⤵
- Executes dropped EXE
PID:2712 -
\??\c:\rflrxff.exec:\rflrxff.exe56⤵
- Executes dropped EXE
PID:1192 -
\??\c:\fxlfrrf.exec:\fxlfrrf.exe57⤵
- Executes dropped EXE
PID:1660 -
\??\c:\fxrflxf.exec:\fxrflxf.exe58⤵
- Executes dropped EXE
PID:2008 -
\??\c:\nhnttt.exec:\nhnttt.exe59⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hbtbht.exec:\hbtbht.exe60⤵
- Executes dropped EXE
PID:2244 -
\??\c:\9pjpv.exec:\9pjpv.exe61⤵
- Executes dropped EXE
PID:872 -
\??\c:\7ppvd.exec:\7ppvd.exe62⤵
- Executes dropped EXE
PID:1060 -
\??\c:\1fxlllr.exec:\1fxlllr.exe63⤵
- Executes dropped EXE
PID:840 -
\??\c:\5xxxffr.exec:\5xxxffr.exe64⤵
- Executes dropped EXE
PID:1168 -
\??\c:\bbbbbt.exec:\bbbbbt.exe65⤵
- Executes dropped EXE
PID:948 -
\??\c:\htnnhn.exec:\htnnhn.exe66⤵PID:2940
-
\??\c:\9htbhh.exec:\9htbhh.exe67⤵PID:980
-
\??\c:\7jvdd.exec:\7jvdd.exe68⤵PID:288
-
\??\c:\dvvvj.exec:\dvvvj.exe69⤵PID:1984
-
\??\c:\frfrxxf.exec:\frfrxxf.exe70⤵PID:1860
-
\??\c:\rlxxflr.exec:\rlxxflr.exe71⤵PID:2208
-
\??\c:\bbthbt.exec:\bbthbt.exe72⤵PID:1752
-
\??\c:\hbbhnt.exec:\hbbhnt.exe73⤵PID:2988
-
\??\c:\pjvvj.exec:\pjvvj.exe74⤵PID:3036
-
\??\c:\dpjdd.exec:\dpjdd.exe75⤵PID:1436
-
\??\c:\9frrxlf.exec:\9frrxlf.exe76⤵PID:2740
-
\??\c:\rrffrrl.exec:\rrffrrl.exe77⤵PID:2608
-
\??\c:\hbbnth.exec:\hbbnth.exe78⤵PID:1644
-
\??\c:\tnbhbh.exec:\tnbhbh.exe79⤵PID:2564
-
\??\c:\pjddd.exec:\pjddd.exe80⤵PID:1916
-
\??\c:\5dvpp.exec:\5dvpp.exe81⤵PID:2676
-
\??\c:\1pdvv.exec:\1pdvv.exe82⤵PID:2508
-
\??\c:\5lxflfl.exec:\5lxflfl.exe83⤵PID:2636
-
\??\c:\rrflxxf.exec:\rrflxxf.exe84⤵PID:2424
-
\??\c:\3hhntt.exec:\3hhntt.exe85⤵PID:2528
-
\??\c:\nnnntt.exec:\nnnntt.exe86⤵PID:2472
-
\??\c:\7jdvj.exec:\7jdvj.exe87⤵PID:1552
-
\??\c:\vvjpj.exec:\vvjpj.exe88⤵PID:1608
-
\??\c:\xrflxrf.exec:\xrflxrf.exe89⤵PID:2468
-
\??\c:\rllrffl.exec:\rllrffl.exe90⤵PID:112
-
\??\c:\tnbbhh.exec:\tnbbhh.exe91⤵PID:2336
-
\??\c:\hhnnnh.exec:\hhnnnh.exe92⤵PID:2328
-
\??\c:\pjvdp.exec:\pjvdp.exe93⤵PID:320
-
\??\c:\7vjdd.exec:\7vjdd.exe94⤵PID:1560
-
\??\c:\vjddd.exec:\vjddd.exe95⤵PID:1584
-
\??\c:\xrflrrx.exec:\xrflrrx.exe96⤵PID:2700
-
\??\c:\5flrrrf.exec:\5flrrrf.exe97⤵PID:2304
-
\??\c:\5bthtt.exec:\5bthtt.exe98⤵PID:2024
-
\??\c:\pppvd.exec:\pppvd.exe99⤵PID:2212
-
\??\c:\dvpjv.exec:\dvpjv.exe100⤵PID:2392
-
\??\c:\lllxrlx.exec:\lllxrlx.exe101⤵PID:1112
-
\??\c:\rllrfrl.exec:\rllrfrl.exe102⤵PID:1972
-
\??\c:\9bhhtt.exec:\9bhhtt.exe103⤵PID:268
-
\??\c:\tnbhnn.exec:\tnbhnn.exe104⤵PID:1408
-
\??\c:\ddvpp.exec:\ddvpp.exe105⤵PID:1412
-
\??\c:\5ppjp.exec:\5ppjp.exe106⤵PID:1732
-
\??\c:\vpppd.exec:\vpppd.exe107⤵PID:1072
-
\??\c:\frlrrfl.exec:\frlrrfl.exe108⤵PID:800
-
\??\c:\9lflrxx.exec:\9lflrxx.exe109⤵PID:780
-
\??\c:\btnttb.exec:\btnttb.exe110⤵PID:2788
-
\??\c:\7vppd.exec:\7vppd.exe111⤵PID:964
-
\??\c:\7jvdp.exec:\7jvdp.exe112⤵PID:3052
-
\??\c:\xxfxxxf.exec:\xxfxxxf.exe113⤵PID:1876
-
\??\c:\fflfxrx.exec:\fflfxrx.exe114⤵PID:2624
-
\??\c:\lfllrrx.exec:\lfllrrx.exe115⤵PID:2256
-
\??\c:\bttnnt.exec:\bttnnt.exe116⤵PID:2812
-
\??\c:\pjvvv.exec:\pjvvv.exe117⤵PID:1616
-
\??\c:\pdjvp.exec:\pdjvp.exe118⤵PID:2892
-
\??\c:\xxlllrf.exec:\xxlllrf.exe119⤵PID:1536
-
\??\c:\9fxlxfx.exec:\9fxlxfx.exe120⤵PID:2592
-
\??\c:\llxlrrx.exec:\llxlrrx.exe121⤵PID:2628
-
\??\c:\nhtbhb.exec:\nhtbhb.exe122⤵PID:2588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-