Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 08:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6e550c40c14154a48efd409fdf4ffef0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
6e550c40c14154a48efd409fdf4ffef0_NeikiAnalytics.exe
-
Size
247KB
-
MD5
6e550c40c14154a48efd409fdf4ffef0
-
SHA1
403c3a0bf7130a5db09afc5b8b93848017962e3c
-
SHA256
b2338a3c77f6caa6ee825778a4fe3fef41c68f96297383ffdf2e852d8bd1562e
-
SHA512
8e9081f2071db8adb0aea339030b7cea9891a6eec176adf1a61d916638e3472f7fb1fb20025bfb0ba99500f9bb37c44741f937d54b87259536d8a8a31fb93787
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4MAWvGjR1+:n3C9BRo7MlrWKo+lxtvGt1+
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2100-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-59-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1852-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1900-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/672-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-1224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2128 nbtthn.exe 3032 ppjvj.exe 2600 ffxflrf.exe 2860 tnbhbh.exe 2744 pjdjd.exe 2532 llxflfl.exe 2408 tnbhnt.exe 2560 7pdjv.exe 1808 xxlrffr.exe 1996 hhthtb.exe 2672 vvddj.exe 2936 5flxlrf.exe 1852 1tnntb.exe 2024 7bnbht.exe 1244 xxllxxr.exe 2300 5rrxlrf.exe 768 9nttbt.exe 108 dvjpd.exe 1648 lfffffr.exe 1596 9hbthh.exe 1900 vpjjv.exe 2876 lfrxflr.exe 672 5nbbht.exe 1616 9hhhbh.exe 1788 9jjjv.exe 1932 rlrrxxl.exe 1936 pjvdp.exe 1392 fflrffr.exe 2576 nnbnbn.exe 1804 ppdjd.exe 2032 dvjdv.exe 1740 btnntt.exe 3024 nhthnt.exe 1576 dvjdv.exe 2344 xrxxfrl.exe 2080 llxrffx.exe 3028 9tntht.exe 2720 nnhntb.exe 2712 3vjpp.exe 2844 lfxxlrf.exe 2816 xrrrxll.exe 2608 3httbh.exe 2516 vvpvd.exe 2572 rxrrflf.exe 2944 nhthtt.exe 2320 hbhnnn.exe 2748 ppdvd.exe 2932 dvjpv.exe 328 xrxrxxl.exe 2412 htbhnn.exe 1984 nhbthn.exe 1980 7dpjp.exe 1244 dvdjv.exe 1092 ffffrxf.exe 316 7bbntb.exe 2416 bbthth.exe 1396 vpdvj.exe 1648 3xxfrrr.exe 2800 5lxllrx.exe 2676 nhtntt.exe 2264 bbthbb.exe 2876 ppvvj.exe 1000 xrffrxx.exe 2444 rrfxffr.exe -
resource yara_rule behavioral1/memory/2100-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1852-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1900-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/672-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-1224-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2128 2100 6e550c40c14154a48efd409fdf4ffef0_NeikiAnalytics.exe 28 PID 2100 wrote to memory of 2128 2100 6e550c40c14154a48efd409fdf4ffef0_NeikiAnalytics.exe 28 PID 2100 wrote to memory of 2128 2100 6e550c40c14154a48efd409fdf4ffef0_NeikiAnalytics.exe 28 PID 2100 wrote to memory of 2128 2100 6e550c40c14154a48efd409fdf4ffef0_NeikiAnalytics.exe 28 PID 2128 wrote to memory of 3032 2128 nbtthn.exe 29 PID 2128 wrote to memory of 3032 2128 nbtthn.exe 29 PID 2128 wrote to memory of 3032 2128 nbtthn.exe 29 PID 2128 wrote to memory of 3032 2128 nbtthn.exe 29 PID 3032 wrote to memory of 2600 3032 ppjvj.exe 30 PID 3032 wrote to memory of 2600 3032 ppjvj.exe 30 PID 3032 wrote to memory of 2600 3032 ppjvj.exe 30 PID 3032 wrote to memory of 2600 3032 ppjvj.exe 30 PID 2600 wrote to memory of 2860 2600 ffxflrf.exe 31 PID 2600 wrote to memory of 2860 2600 ffxflrf.exe 31 PID 2600 wrote to memory of 2860 2600 ffxflrf.exe 31 PID 2600 wrote to memory of 2860 2600 ffxflrf.exe 31 PID 2860 wrote to memory of 2744 2860 tnbhbh.exe 32 PID 2860 wrote to memory of 2744 2860 tnbhbh.exe 32 PID 2860 wrote to memory of 2744 2860 tnbhbh.exe 32 PID 2860 wrote to memory of 2744 2860 tnbhbh.exe 32 PID 2744 wrote to memory of 2532 2744 pjdjd.exe 33 PID 2744 wrote to memory of 2532 2744 pjdjd.exe 33 PID 2744 wrote to memory of 2532 2744 pjdjd.exe 33 PID 2744 wrote to memory of 2532 2744 pjdjd.exe 33 PID 2532 wrote to memory of 2408 2532 llxflfl.exe 34 PID 2532 wrote to memory of 2408 2532 llxflfl.exe 34 PID 2532 wrote to memory of 2408 2532 llxflfl.exe 34 PID 2532 wrote to memory of 2408 2532 llxflfl.exe 34 PID 2408 wrote to memory of 2560 2408 tnbhnt.exe 35 PID 2408 wrote to memory of 2560 2408 tnbhnt.exe 35 PID 2408 wrote to memory of 2560 2408 tnbhnt.exe 35 PID 2408 wrote to memory of 2560 2408 tnbhnt.exe 35 PID 2560 wrote to memory of 1808 2560 7pdjv.exe 36 PID 2560 wrote to memory of 1808 2560 7pdjv.exe 36 PID 2560 wrote to memory of 1808 2560 7pdjv.exe 36 PID 2560 wrote to memory of 1808 2560 7pdjv.exe 36 PID 1808 wrote to memory of 1996 1808 xxlrffr.exe 37 PID 1808 wrote to memory of 1996 1808 xxlrffr.exe 37 PID 1808 wrote to memory of 1996 1808 xxlrffr.exe 37 PID 1808 wrote to memory of 1996 1808 xxlrffr.exe 37 PID 1996 wrote to memory of 2672 1996 hhthtb.exe 38 PID 1996 wrote to memory of 2672 1996 hhthtb.exe 38 PID 1996 wrote to memory of 2672 1996 hhthtb.exe 38 PID 1996 wrote to memory of 2672 1996 hhthtb.exe 38 PID 2672 wrote to memory of 2936 2672 vvddj.exe 39 PID 2672 wrote to memory of 2936 2672 vvddj.exe 39 PID 2672 wrote to memory of 2936 2672 vvddj.exe 39 PID 2672 wrote to memory of 2936 2672 vvddj.exe 39 PID 2936 wrote to memory of 1852 2936 5flxlrf.exe 40 PID 2936 wrote to memory of 1852 2936 5flxlrf.exe 40 PID 2936 wrote to memory of 1852 2936 5flxlrf.exe 40 PID 2936 wrote to memory of 1852 2936 5flxlrf.exe 40 PID 1852 wrote to memory of 2024 1852 1tnntb.exe 41 PID 1852 wrote to memory of 2024 1852 1tnntb.exe 41 PID 1852 wrote to memory of 2024 1852 1tnntb.exe 41 PID 1852 wrote to memory of 2024 1852 1tnntb.exe 41 PID 2024 wrote to memory of 1244 2024 7bnbht.exe 42 PID 2024 wrote to memory of 1244 2024 7bnbht.exe 42 PID 2024 wrote to memory of 1244 2024 7bnbht.exe 42 PID 2024 wrote to memory of 1244 2024 7bnbht.exe 42 PID 1244 wrote to memory of 2300 1244 xxllxxr.exe 43 PID 1244 wrote to memory of 2300 1244 xxllxxr.exe 43 PID 1244 wrote to memory of 2300 1244 xxllxxr.exe 43 PID 1244 wrote to memory of 2300 1244 xxllxxr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e550c40c14154a48efd409fdf4ffef0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6e550c40c14154a48efd409fdf4ffef0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\nbtthn.exec:\nbtthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\ppjvj.exec:\ppjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\ffxflrf.exec:\ffxflrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\tnbhbh.exec:\tnbhbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\pjdjd.exec:\pjdjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\llxflfl.exec:\llxflfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\tnbhnt.exec:\tnbhnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\7pdjv.exec:\7pdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\xxlrffr.exec:\xxlrffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\hhthtb.exec:\hhthtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\vvddj.exec:\vvddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\5flxlrf.exec:\5flxlrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\1tnntb.exec:\1tnntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\7bnbht.exec:\7bnbht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\xxllxxr.exec:\xxllxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\5rrxlrf.exec:\5rrxlrf.exe17⤵
- Executes dropped EXE
PID:2300 -
\??\c:\9nttbt.exec:\9nttbt.exe18⤵
- Executes dropped EXE
PID:768 -
\??\c:\dvjpd.exec:\dvjpd.exe19⤵
- Executes dropped EXE
PID:108 -
\??\c:\lfffffr.exec:\lfffffr.exe20⤵
- Executes dropped EXE
PID:1648 -
\??\c:\9hbthh.exec:\9hbthh.exe21⤵
- Executes dropped EXE
PID:1596 -
\??\c:\vpjjv.exec:\vpjjv.exe22⤵
- Executes dropped EXE
PID:1900 -
\??\c:\lfrxflr.exec:\lfrxflr.exe23⤵
- Executes dropped EXE
PID:2876 -
\??\c:\5nbbht.exec:\5nbbht.exe24⤵
- Executes dropped EXE
PID:672 -
\??\c:\9hhhbh.exec:\9hhhbh.exe25⤵
- Executes dropped EXE
PID:1616 -
\??\c:\9jjjv.exec:\9jjjv.exe26⤵
- Executes dropped EXE
PID:1788 -
\??\c:\rlrrxxl.exec:\rlrrxxl.exe27⤵
- Executes dropped EXE
PID:1932 -
\??\c:\pjvdp.exec:\pjvdp.exe28⤵
- Executes dropped EXE
PID:1936 -
\??\c:\fflrffr.exec:\fflrffr.exe29⤵
- Executes dropped EXE
PID:1392 -
\??\c:\nnbnbn.exec:\nnbnbn.exe30⤵
- Executes dropped EXE
PID:2576 -
\??\c:\ppdjd.exec:\ppdjd.exe31⤵
- Executes dropped EXE
PID:1804 -
\??\c:\dvjdv.exec:\dvjdv.exe32⤵
- Executes dropped EXE
PID:2032 -
\??\c:\btnntt.exec:\btnntt.exe33⤵
- Executes dropped EXE
PID:1740 -
\??\c:\nhthnt.exec:\nhthnt.exe34⤵
- Executes dropped EXE
PID:3024 -
\??\c:\dvjdv.exec:\dvjdv.exe35⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xrxxfrl.exec:\xrxxfrl.exe36⤵
- Executes dropped EXE
PID:2344 -
\??\c:\llxrffx.exec:\llxrffx.exe37⤵
- Executes dropped EXE
PID:2080 -
\??\c:\9tntht.exec:\9tntht.exe38⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nnhntb.exec:\nnhntb.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3vjpp.exec:\3vjpp.exe40⤵
- Executes dropped EXE
PID:2712 -
\??\c:\lfxxlrf.exec:\lfxxlrf.exe41⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xrrrxll.exec:\xrrrxll.exe42⤵
- Executes dropped EXE
PID:2816 -
\??\c:\3httbh.exec:\3httbh.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vvpvd.exec:\vvpvd.exe44⤵
- Executes dropped EXE
PID:2516 -
\??\c:\rxrrflf.exec:\rxrrflf.exe45⤵
- Executes dropped EXE
PID:2572 -
\??\c:\nhthtt.exec:\nhthtt.exe46⤵
- Executes dropped EXE
PID:2944 -
\??\c:\hbhnnn.exec:\hbhnnn.exe47⤵
- Executes dropped EXE
PID:2320 -
\??\c:\ppdvd.exec:\ppdvd.exe48⤵
- Executes dropped EXE
PID:2748 -
\??\c:\dvjpv.exec:\dvjpv.exe49⤵
- Executes dropped EXE
PID:2932 -
\??\c:\xrxrxxl.exec:\xrxrxxl.exe50⤵
- Executes dropped EXE
PID:328 -
\??\c:\htbhnn.exec:\htbhnn.exe51⤵
- Executes dropped EXE
PID:2412 -
\??\c:\nhbthn.exec:\nhbthn.exe52⤵
- Executes dropped EXE
PID:1984 -
\??\c:\7dpjp.exec:\7dpjp.exe53⤵
- Executes dropped EXE
PID:1980 -
\??\c:\dvdjv.exec:\dvdjv.exe54⤵
- Executes dropped EXE
PID:1244 -
\??\c:\ffffrxf.exec:\ffffrxf.exe55⤵
- Executes dropped EXE
PID:1092 -
\??\c:\7bbntb.exec:\7bbntb.exe56⤵
- Executes dropped EXE
PID:316 -
\??\c:\bbthth.exec:\bbthth.exe57⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vpdvj.exec:\vpdvj.exe58⤵
- Executes dropped EXE
PID:1396 -
\??\c:\3xxfrrr.exec:\3xxfrrr.exe59⤵
- Executes dropped EXE
PID:1648 -
\??\c:\5lxllrx.exec:\5lxllrx.exe60⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nhtntt.exec:\nhtntt.exe61⤵
- Executes dropped EXE
PID:2676 -
\??\c:\bbthbb.exec:\bbthbb.exe62⤵
- Executes dropped EXE
PID:2264 -
\??\c:\ppvvj.exec:\ppvvj.exe63⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xrffrxx.exec:\xrffrxx.exe64⤵
- Executes dropped EXE
PID:1000 -
\??\c:\rrfxffr.exec:\rrfxffr.exe65⤵
- Executes dropped EXE
PID:2444 -
\??\c:\bnbhnt.exec:\bnbhnt.exe66⤵PID:1088
-
\??\c:\3jjpd.exec:\3jjpd.exe67⤵PID:952
-
\??\c:\jjvdj.exec:\jjvdj.exe68⤵PID:1028
-
\??\c:\1rxrlfl.exec:\1rxrlfl.exe69⤵PID:912
-
\??\c:\llxlrfr.exec:\llxlrfr.exe70⤵PID:1240
-
\??\c:\3nhbnn.exec:\3nhbnn.exe71⤵PID:2836
-
\??\c:\nbnthn.exec:\nbnthn.exe72⤵PID:2888
-
\??\c:\1vdvd.exec:\1vdvd.exe73⤵PID:1804
-
\??\c:\llflxfr.exec:\llflxfr.exe74⤵PID:2156
-
\??\c:\1fxxxfl.exec:\1fxxxfl.exe75⤵PID:3040
-
\??\c:\tnbthh.exec:\tnbthh.exe76⤵PID:1572
-
\??\c:\ddddp.exec:\ddddp.exe77⤵PID:2364
-
\??\c:\9jjpp.exec:\9jjpp.exe78⤵PID:2588
-
\??\c:\9rllrrx.exec:\9rllrrx.exe79⤵PID:2636
-
\??\c:\7rfllrf.exec:\7rfllrf.exe80⤵PID:2732
-
\??\c:\5htttt.exec:\5htttt.exe81⤵PID:2736
-
\??\c:\dddvd.exec:\dddvd.exe82⤵PID:2696
-
\??\c:\dvjdp.exec:\dvjdp.exe83⤵PID:2812
-
\??\c:\xxrlxxf.exec:\xxrlxxf.exe84⤵PID:2660
-
\??\c:\rrxxfff.exec:\rrxxfff.exe85⤵PID:2508
-
\??\c:\7bbbnn.exec:\7bbbnn.exe86⤵PID:2204
-
\??\c:\vpddj.exec:\vpddj.exe87⤵PID:1676
-
\??\c:\ppdjv.exec:\ppdjv.exe88⤵PID:1924
-
\??\c:\3fffrlx.exec:\3fffrlx.exe89⤵PID:2808
-
\??\c:\3btbbb.exec:\3btbbb.exe90⤵PID:2924
-
\??\c:\5nbnhb.exec:\5nbnhb.exe91⤵PID:2672
-
\??\c:\vvpvp.exec:\vvpvp.exe92⤵PID:2308
-
\??\c:\9vvdv.exec:\9vvdv.exe93⤵PID:2388
-
\??\c:\7xrlrxf.exec:\7xrlrxf.exe94⤵PID:2040
-
\??\c:\rlfxlrf.exec:\rlfxlrf.exe95⤵PID:1608
-
\??\c:\bttnbt.exec:\bttnbt.exe96⤵PID:2160
-
\??\c:\dvjdv.exec:\dvjdv.exe97⤵PID:1912
-
\??\c:\vpdpj.exec:\vpdpj.exe98⤵PID:768
-
\??\c:\lfxfllx.exec:\lfxfllx.exe99⤵PID:236
-
\??\c:\xrfrxfr.exec:\xrfrxfr.exe100⤵PID:2284
-
\??\c:\5bthtb.exec:\5bthtb.exe101⤵PID:2268
-
\??\c:\5hhbtb.exec:\5hhbtb.exe102⤵PID:1596
-
\??\c:\ppjjv.exec:\ppjjv.exe103⤵PID:2476
-
\??\c:\xxlxlrx.exec:\xxlxlrx.exe104⤵PID:792
-
\??\c:\llfrxxl.exec:\llfrxxl.exe105⤵PID:692
-
\??\c:\nnhhnt.exec:\nnhhnt.exe106⤵PID:1772
-
\??\c:\nnntht.exec:\nnntht.exe107⤵PID:1848
-
\??\c:\dvpdv.exec:\dvpdv.exe108⤵PID:1364
-
\??\c:\3pjpv.exec:\3pjpv.exe109⤵PID:2896
-
\??\c:\fxffrrx.exec:\fxffrrx.exe110⤵PID:892
-
\??\c:\bnbhtn.exec:\bnbhtn.exe111⤵PID:704
-
\??\c:\7jvvd.exec:\7jvvd.exe112⤵PID:1664
-
\??\c:\jdvdp.exec:\jdvdp.exe113⤵PID:1800
-
\??\c:\rlxxffr.exec:\rlxxffr.exe114⤵PID:2404
-
\??\c:\fxrfxlr.exec:\fxrfxlr.exe115⤵PID:1620
-
\??\c:\nbtnbh.exec:\nbtnbh.exe116⤵PID:2984
-
\??\c:\ddvdp.exec:\ddvdp.exe117⤵PID:2376
-
\??\c:\1jddp.exec:\1jddp.exe118⤵PID:2084
-
\??\c:\xrfflrf.exec:\xrfflrf.exe119⤵PID:1576
-
\??\c:\llxlxxl.exec:\llxlxxl.exe120⤵PID:3020
-
\??\c:\hhbnbh.exec:\hhbnbh.exe121⤵PID:2588
-
\??\c:\vvvpj.exec:\vvvpj.exe122⤵PID:2620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-