Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 17:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06b32bde5b260c24fa49ee30b9eae520_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
06b32bde5b260c24fa49ee30b9eae520_NeikiAnalytics.exe
-
Size
63KB
-
MD5
06b32bde5b260c24fa49ee30b9eae520
-
SHA1
db18fa1d3ea1dd87cca7e34e01d522580d443278
-
SHA256
bb7961612d580ad3338b2aa4739faa5782bd9c1f7929eea36efcfa7d3aab4a32
-
SHA512
ff8026089c715cb9d1bc9c161ac13a9cd0ac3bad612b2d55475b8d844970ed9134b237d47c3889b1340b616b8760bc18ab34d608b2e7ef647238a666035a1534
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIhJm/w+d:ymb3NkkiQ3mdBjFILmPd
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral1/memory/1632-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1216-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-82-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1680-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/676-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/288-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/816-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2204 bbtthh.exe 1216 ddpjv.exe 2148 ttnnth.exe 2580 bbbthn.exe 2672 pvppv.exe 2740 9ppvj.exe 2476 rlxflxf.exe 2612 nnhthn.exe 2460 tnbtnb.exe 2940 9vjvd.exe 2964 9jjjp.exe 2768 ffxflrf.exe 1976 tnhhtb.exe 1680 btnbth.exe 2416 dddjj.exe 2684 rxllllx.exe 1800 rxfxffl.exe 1608 9hbtnn.exe 2832 bbhhnh.exe 1748 5dpvp.exe 768 fxrrffl.exe 676 9xxfxrf.exe 288 ntbbtt.exe 1692 vvdpv.exe 2412 lxllffl.exe 1612 xrllrfl.exe 2072 nhbhtt.exe 1892 vppvj.exe 2112 fllxflf.exe 816 9frxfrf.exe 1756 9hhnhn.exe 2092 jjpdj.exe 1600 jpdpv.exe 1696 xlrllxr.exe 2848 9fxfllf.exe 1732 nnhbbh.exe 376 hnhthn.exe 2164 3vpjv.exe 2996 vvpdp.exe 2648 xlfllfr.exe 2600 xrflrfr.exe 2724 tbhhtb.exe 2656 9tbnnb.exe 2492 ppjvj.exe 1220 flxxxfr.exe 2156 fxrfrfr.exe 2948 ttthhh.exe 1224 ntbtnh.exe 2332 pjddp.exe 1968 fffllxr.exe 2508 llxrxxf.exe 1680 7hbntt.exe 2416 5bnhbb.exe 1664 jvdjj.exe 1916 dvdvj.exe 1816 xrfflxr.exe 2680 fxrllrf.exe 2296 nhnbbt.exe 952 7bnnnt.exe 2052 vdjdv.exe 696 7jdjv.exe 704 lfrlrlr.exe 2936 nthhhh.exe 1692 nhhthh.exe -
resource yara_rule behavioral1/memory/1632-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1216-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1680-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/676-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/288-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/816-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1632 wrote to memory of 2204 1632 06b32bde5b260c24fa49ee30b9eae520_NeikiAnalytics.exe 28 PID 1632 wrote to memory of 2204 1632 06b32bde5b260c24fa49ee30b9eae520_NeikiAnalytics.exe 28 PID 1632 wrote to memory of 2204 1632 06b32bde5b260c24fa49ee30b9eae520_NeikiAnalytics.exe 28 PID 1632 wrote to memory of 2204 1632 06b32bde5b260c24fa49ee30b9eae520_NeikiAnalytics.exe 28 PID 2204 wrote to memory of 1216 2204 bbtthh.exe 29 PID 2204 wrote to memory of 1216 2204 bbtthh.exe 29 PID 2204 wrote to memory of 1216 2204 bbtthh.exe 29 PID 2204 wrote to memory of 1216 2204 bbtthh.exe 29 PID 1216 wrote to memory of 2148 1216 ddpjv.exe 30 PID 1216 wrote to memory of 2148 1216 ddpjv.exe 30 PID 1216 wrote to memory of 2148 1216 ddpjv.exe 30 PID 1216 wrote to memory of 2148 1216 ddpjv.exe 30 PID 2148 wrote to memory of 2580 2148 ttnnth.exe 31 PID 2148 wrote to memory of 2580 2148 ttnnth.exe 31 PID 2148 wrote to memory of 2580 2148 ttnnth.exe 31 PID 2148 wrote to memory of 2580 2148 ttnnth.exe 31 PID 2580 wrote to memory of 2672 2580 bbbthn.exe 32 PID 2580 wrote to memory of 2672 2580 bbbthn.exe 32 PID 2580 wrote to memory of 2672 2580 bbbthn.exe 32 PID 2580 wrote to memory of 2672 2580 bbbthn.exe 32 PID 2672 wrote to memory of 2740 2672 pvppv.exe 33 PID 2672 wrote to memory of 2740 2672 pvppv.exe 33 PID 2672 wrote to memory of 2740 2672 pvppv.exe 33 PID 2672 wrote to memory of 2740 2672 pvppv.exe 33 PID 2740 wrote to memory of 2476 2740 9ppvj.exe 34 PID 2740 wrote to memory of 2476 2740 9ppvj.exe 34 PID 2740 wrote to memory of 2476 2740 9ppvj.exe 34 PID 2740 wrote to memory of 2476 2740 9ppvj.exe 34 PID 2476 wrote to memory of 2612 2476 rlxflxf.exe 35 PID 2476 wrote to memory of 2612 2476 rlxflxf.exe 35 PID 2476 wrote to memory of 2612 2476 rlxflxf.exe 35 PID 2476 wrote to memory of 2612 2476 rlxflxf.exe 35 PID 2612 wrote to memory of 2460 2612 nnhthn.exe 36 PID 2612 wrote to memory of 2460 2612 nnhthn.exe 36 PID 2612 wrote to memory of 2460 2612 nnhthn.exe 36 PID 2612 wrote to memory of 2460 2612 nnhthn.exe 36 PID 2460 wrote to memory of 2940 2460 tnbtnb.exe 37 PID 2460 wrote to memory of 2940 2460 tnbtnb.exe 37 PID 2460 wrote to memory of 2940 2460 tnbtnb.exe 37 PID 2460 wrote to memory of 2940 2460 tnbtnb.exe 37 PID 2940 wrote to memory of 2964 2940 9vjvd.exe 38 PID 2940 wrote to memory of 2964 2940 9vjvd.exe 38 PID 2940 wrote to memory of 2964 2940 9vjvd.exe 38 PID 2940 wrote to memory of 2964 2940 9vjvd.exe 38 PID 2964 wrote to memory of 2768 2964 9jjjp.exe 39 PID 2964 wrote to memory of 2768 2964 9jjjp.exe 39 PID 2964 wrote to memory of 2768 2964 9jjjp.exe 39 PID 2964 wrote to memory of 2768 2964 9jjjp.exe 39 PID 2768 wrote to memory of 1976 2768 ffxflrf.exe 40 PID 2768 wrote to memory of 1976 2768 ffxflrf.exe 40 PID 2768 wrote to memory of 1976 2768 ffxflrf.exe 40 PID 2768 wrote to memory of 1976 2768 ffxflrf.exe 40 PID 1976 wrote to memory of 1680 1976 tnhhtb.exe 41 PID 1976 wrote to memory of 1680 1976 tnhhtb.exe 41 PID 1976 wrote to memory of 1680 1976 tnhhtb.exe 41 PID 1976 wrote to memory of 1680 1976 tnhhtb.exe 41 PID 1680 wrote to memory of 2416 1680 btnbth.exe 42 PID 1680 wrote to memory of 2416 1680 btnbth.exe 42 PID 1680 wrote to memory of 2416 1680 btnbth.exe 42 PID 1680 wrote to memory of 2416 1680 btnbth.exe 42 PID 2416 wrote to memory of 2684 2416 dddjj.exe 43 PID 2416 wrote to memory of 2684 2416 dddjj.exe 43 PID 2416 wrote to memory of 2684 2416 dddjj.exe 43 PID 2416 wrote to memory of 2684 2416 dddjj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\06b32bde5b260c24fa49ee30b9eae520_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\06b32bde5b260c24fa49ee30b9eae520_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\bbtthh.exec:\bbtthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\ddpjv.exec:\ddpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\ttnnth.exec:\ttnnth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\bbbthn.exec:\bbbthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\pvppv.exec:\pvppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\9ppvj.exec:\9ppvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\rlxflxf.exec:\rlxflxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\nnhthn.exec:\nnhthn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\tnbtnb.exec:\tnbtnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\9vjvd.exec:\9vjvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\9jjjp.exec:\9jjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\ffxflrf.exec:\ffxflrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\tnhhtb.exec:\tnhhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\btnbth.exec:\btnbth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\dddjj.exec:\dddjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\rxllllx.exec:\rxllllx.exe17⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rxfxffl.exec:\rxfxffl.exe18⤵
- Executes dropped EXE
PID:1800 -
\??\c:\9hbtnn.exec:\9hbtnn.exe19⤵
- Executes dropped EXE
PID:1608 -
\??\c:\bbhhnh.exec:\bbhhnh.exe20⤵
- Executes dropped EXE
PID:2832 -
\??\c:\5dpvp.exec:\5dpvp.exe21⤵
- Executes dropped EXE
PID:1748 -
\??\c:\fxrrffl.exec:\fxrrffl.exe22⤵
- Executes dropped EXE
PID:768 -
\??\c:\9xxfxrf.exec:\9xxfxrf.exe23⤵
- Executes dropped EXE
PID:676 -
\??\c:\ntbbtt.exec:\ntbbtt.exe24⤵
- Executes dropped EXE
PID:288 -
\??\c:\vvdpv.exec:\vvdpv.exe25⤵
- Executes dropped EXE
PID:1692 -
\??\c:\lxllffl.exec:\lxllffl.exe26⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xrllrfl.exec:\xrllrfl.exe27⤵
- Executes dropped EXE
PID:1612 -
\??\c:\nhbhtt.exec:\nhbhtt.exe28⤵
- Executes dropped EXE
PID:2072 -
\??\c:\vppvj.exec:\vppvj.exe29⤵
- Executes dropped EXE
PID:1892 -
\??\c:\fllxflf.exec:\fllxflf.exe30⤵
- Executes dropped EXE
PID:2112 -
\??\c:\9frxfrf.exec:\9frxfrf.exe31⤵
- Executes dropped EXE
PID:816 -
\??\c:\9hhnhn.exec:\9hhnhn.exe32⤵
- Executes dropped EXE
PID:1756 -
\??\c:\jjpdj.exec:\jjpdj.exe33⤵
- Executes dropped EXE
PID:2092 -
\??\c:\jpdpv.exec:\jpdpv.exe34⤵
- Executes dropped EXE
PID:1600 -
\??\c:\xlrllxr.exec:\xlrllxr.exe35⤵
- Executes dropped EXE
PID:1696 -
\??\c:\9fxfllf.exec:\9fxfllf.exe36⤵
- Executes dropped EXE
PID:2848 -
\??\c:\nnhbbh.exec:\nnhbbh.exe37⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hnhthn.exec:\hnhthn.exe38⤵
- Executes dropped EXE
PID:376 -
\??\c:\3vpjv.exec:\3vpjv.exe39⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vvpdp.exec:\vvpdp.exe40⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xlfllfr.exec:\xlfllfr.exe41⤵
- Executes dropped EXE
PID:2648 -
\??\c:\xrflrfr.exec:\xrflrfr.exe42⤵
- Executes dropped EXE
PID:2600 -
\??\c:\tbhhtb.exec:\tbhhtb.exe43⤵
- Executes dropped EXE
PID:2724 -
\??\c:\9tbnnb.exec:\9tbnnb.exe44⤵
- Executes dropped EXE
PID:2656 -
\??\c:\ppjvj.exec:\ppjvj.exe45⤵
- Executes dropped EXE
PID:2492 -
\??\c:\flxxxfr.exec:\flxxxfr.exe46⤵
- Executes dropped EXE
PID:1220 -
\??\c:\fxrfrfr.exec:\fxrfrfr.exe47⤵
- Executes dropped EXE
PID:2156 -
\??\c:\ttthhh.exec:\ttthhh.exe48⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ntbtnh.exec:\ntbtnh.exe49⤵
- Executes dropped EXE
PID:1224 -
\??\c:\pjddp.exec:\pjddp.exe50⤵
- Executes dropped EXE
PID:2332 -
\??\c:\fffllxr.exec:\fffllxr.exe51⤵
- Executes dropped EXE
PID:1968 -
\??\c:\llxrxxf.exec:\llxrxxf.exe52⤵
- Executes dropped EXE
PID:2508 -
\??\c:\7hbntt.exec:\7hbntt.exe53⤵
- Executes dropped EXE
PID:1680 -
\??\c:\5bnhbb.exec:\5bnhbb.exe54⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jvdjj.exec:\jvdjj.exe55⤵
- Executes dropped EXE
PID:1664 -
\??\c:\dvdvj.exec:\dvdvj.exe56⤵
- Executes dropped EXE
PID:1916 -
\??\c:\xrfflxr.exec:\xrfflxr.exe57⤵
- Executes dropped EXE
PID:1816 -
\??\c:\fxrllrf.exec:\fxrllrf.exe58⤵
- Executes dropped EXE
PID:2680 -
\??\c:\nhnbbt.exec:\nhnbbt.exe59⤵
- Executes dropped EXE
PID:2296 -
\??\c:\7bnnnt.exec:\7bnnnt.exe60⤵
- Executes dropped EXE
PID:952 -
\??\c:\vdjdv.exec:\vdjdv.exe61⤵
- Executes dropped EXE
PID:2052 -
\??\c:\7jdjv.exec:\7jdjv.exe62⤵
- Executes dropped EXE
PID:696 -
\??\c:\lfrlrlr.exec:\lfrlrlr.exe63⤵
- Executes dropped EXE
PID:704 -
\??\c:\nthhhh.exec:\nthhhh.exe64⤵
- Executes dropped EXE
PID:2936 -
\??\c:\nhhthh.exec:\nhhthh.exe65⤵
- Executes dropped EXE
PID:1692 -
\??\c:\3jvpv.exec:\3jvpv.exe66⤵PID:1628
-
\??\c:\dddjv.exec:\dddjv.exe67⤵PID:1336
-
\??\c:\vjvvv.exec:\vjvvv.exe68⤵PID:1132
-
\??\c:\ffrxlxf.exec:\ffrxlxf.exe69⤵PID:1128
-
\??\c:\bthtbh.exec:\bthtbh.exe70⤵PID:2056
-
\??\c:\9nhnnn.exec:\9nhnnn.exe71⤵PID:2116
-
\??\c:\jdvpd.exec:\jdvpd.exe72⤵PID:892
-
\??\c:\jdvpd.exec:\jdvpd.exe73⤵PID:1624
-
\??\c:\dddvv.exec:\dddvv.exe74⤵PID:1760
-
\??\c:\xrlllfl.exec:\xrlllfl.exe75⤵PID:2208
-
\??\c:\hbhnhh.exec:\hbhnhh.exe76⤵PID:2244
-
\??\c:\hhthnt.exec:\hhthnt.exe77⤵PID:2188
-
\??\c:\vpjdv.exec:\vpjdv.exe78⤵PID:2748
-
\??\c:\ppppv.exec:\ppppv.exe79⤵PID:2168
-
\??\c:\ffflxlx.exec:\ffflxlx.exe80⤵PID:2548
-
\??\c:\xrxxlll.exec:\xrxxlll.exe81⤵PID:2628
-
\??\c:\nhhnbh.exec:\nhhnbh.exe82⤵PID:2868
-
\??\c:\jdppj.exec:\jdppj.exe83⤵PID:2448
-
\??\c:\jddjp.exec:\jddjp.exe84⤵PID:2736
-
\??\c:\vpjpv.exec:\vpjpv.exe85⤵PID:2480
-
\??\c:\rrlrlxl.exec:\rrlrlxl.exe86⤵PID:2464
-
\??\c:\hthhhh.exec:\hthhhh.exe87⤵PID:2800
-
\??\c:\bbbbbh.exec:\bbbbbh.exe88⤵PID:3020
-
\??\c:\7ppvd.exec:\7ppvd.exe89⤵PID:2560
-
\??\c:\9jdjp.exec:\9jdjp.exe90⤵PID:1676
-
\??\c:\rlfllxl.exec:\rlfllxl.exe91⤵PID:1212
-
\??\c:\xrxfxlx.exec:\xrxfxlx.exe92⤵PID:2008
-
\??\c:\nhhhbt.exec:\nhhhbt.exe93⤵PID:1888
-
\??\c:\bbnnhb.exec:\bbnnhb.exe94⤵PID:1972
-
\??\c:\7pjpp.exec:\7pjpp.exe95⤵PID:2624
-
\??\c:\dpdjv.exec:\dpdjv.exe96⤵PID:2676
-
\??\c:\fxlllfx.exec:\fxlllfx.exe97⤵PID:2700
-
\??\c:\ffrxfrf.exec:\ffrxfrf.exe98⤵PID:1932
-
\??\c:\nnbntb.exec:\nnbntb.exe99⤵PID:2776
-
\??\c:\nnhbnn.exec:\nnhbnn.exe100⤵PID:808
-
\??\c:\7bbhhn.exec:\7bbhhn.exe101⤵PID:616
-
\??\c:\dvppv.exec:\dvppv.exe102⤵PID:1748
-
\??\c:\pdpjd.exec:\pdpjd.exe103⤵PID:2280
-
\??\c:\7rxrrxr.exec:\7rxrrxr.exe104⤵PID:484
-
\??\c:\lfxxffr.exec:\lfxxffr.exe105⤵PID:576
-
\??\c:\xxlxlfl.exec:\xxlxlfl.exe106⤵PID:580
-
\??\c:\hbtnbb.exec:\hbtnbb.exe107⤵PID:1112
-
\??\c:\nbnthb.exec:\nbnthb.exe108⤵PID:2136
-
\??\c:\1ddpj.exec:\1ddpj.exe109⤵PID:1232
-
\??\c:\vjjdj.exec:\vjjdj.exe110⤵PID:1248
-
\??\c:\1frxflr.exec:\1frxflr.exe111⤵PID:2900
-
\??\c:\rlffrlf.exec:\rlffrlf.exe112⤵PID:2124
-
\??\c:\hbnnhn.exec:\hbnnhn.exe113⤵PID:2904
-
\??\c:\nthhtb.exec:\nthhtb.exe114⤵PID:2128
-
\??\c:\jjdpd.exec:\jjdpd.exe115⤵PID:2104
-
\??\c:\pdvpp.exec:\pdvpp.exe116⤵PID:1188
-
\??\c:\rflfrxx.exec:\rflfrxx.exe117⤵PID:1572
-
\??\c:\ffxlrrr.exec:\ffxlrrr.exe118⤵PID:3056
-
\??\c:\9xlxxfl.exec:\9xlxxfl.exe119⤵PID:1696
-
\??\c:\hhhbth.exec:\hhhbth.exe120⤵PID:3044
-
\??\c:\nnhntn.exec:\nnhntn.exe121⤵PID:1732
-
\??\c:\jjjdj.exec:\jjjdj.exe122⤵PID:2532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-