Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 21:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1ae80551df6570005b4b063d8de75df0NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
1ae80551df6570005b4b063d8de75df0NeikiAnalytics.exe
-
Size
65KB
-
MD5
1ae80551df6570005b4b063d8de75df0
-
SHA1
fbc31232b6dda1f9152c5037a9e57227b1be6c1b
-
SHA256
07ce7578dafd7e47a7eb1b62b1e9be888f02ce4e37bad463dd87ff04e57272b5
-
SHA512
826e328310feb3a40ec4a84dc66cee3a9eaf16f1ab0bef2e137aef99de20b7a17af62c30555d4560df3652b2a38640d8c7c7d6f584bab42e11699d7ad98e76d6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfMTu:ymb3NkkiQ3mdBjFI4V4Tu
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral1/memory/2360-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1216-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1216-19-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-82-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2448-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1776-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/488-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1144-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1216 jvpdv.exe 2212 lfrlllr.exe 3012 tbhbth.exe 2580 ppvvp.exe 2876 7dvdj.exe 2864 rllfxlx.exe 2488 nhbhtb.exe 2448 dvjpd.exe 2572 vvpvd.exe 2188 llxflrx.exe 2788 hhntbh.exe 2348 9bthtt.exe 1480 1ppvj.exe 1208 jjddj.exe 2688 rxlflrl.exe 2796 fxfrflx.exe 1580 tbtbnn.exe 2128 hbntbh.exe 1776 jdvvd.exe 2052 lllrxrl.exe 2252 fxlrflx.exe 488 1nbbnt.exe 1444 hhbtbn.exe 1800 jdpvp.exe 788 1rfflxr.exe 1144 frflrrx.exe 1732 pvdjj.exe 1112 jvpjd.exe 2140 lxlxlrf.exe 2908 fxrxlxf.exe 1092 bntbtt.exe 1736 9pddp.exe 804 1jjdj.exe 2336 5xrrlrx.exe 2012 llxlrxl.exe 2532 9hntnt.exe 2772 nbnttb.exe 2644 5jjdv.exe 2580 3dvjp.exe 3032 rllrxfr.exe 2728 xrlxlrf.exe 2864 hbhhnt.exe 2512 tnhbnn.exe 2516 ppjvd.exe 2492 jvddv.exe 2572 vjjjv.exe 2176 9xxlrlx.exe 2520 bbhtbh.exe 2412 9dvdp.exe 1668 jddjv.exe 944 1flrrrx.exe 548 9rxflfx.exe 2636 tnnhbh.exe 1512 3btnhh.exe 1528 vpjdd.exe 1624 dvjjd.exe 2232 3llrlrl.exe 2844 nhnhtn.exe 1684 hhnbbt.exe 1956 7tnnnt.exe 564 vvvjp.exe 2552 1frlxrx.exe 1636 xlfrffr.exe 2160 3tnttn.exe -
resource yara_rule behavioral1/memory/2360-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1216-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1776-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/488-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1144-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-281-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 1216 2360 1ae80551df6570005b4b063d8de75df0NeikiAnalytics.exe 28 PID 2360 wrote to memory of 1216 2360 1ae80551df6570005b4b063d8de75df0NeikiAnalytics.exe 28 PID 2360 wrote to memory of 1216 2360 1ae80551df6570005b4b063d8de75df0NeikiAnalytics.exe 28 PID 2360 wrote to memory of 1216 2360 1ae80551df6570005b4b063d8de75df0NeikiAnalytics.exe 28 PID 1216 wrote to memory of 2212 1216 jvpdv.exe 29 PID 1216 wrote to memory of 2212 1216 jvpdv.exe 29 PID 1216 wrote to memory of 2212 1216 jvpdv.exe 29 PID 1216 wrote to memory of 2212 1216 jvpdv.exe 29 PID 2212 wrote to memory of 3012 2212 lfrlllr.exe 30 PID 2212 wrote to memory of 3012 2212 lfrlllr.exe 30 PID 2212 wrote to memory of 3012 2212 lfrlllr.exe 30 PID 2212 wrote to memory of 3012 2212 lfrlllr.exe 30 PID 3012 wrote to memory of 2580 3012 tbhbth.exe 31 PID 3012 wrote to memory of 2580 3012 tbhbth.exe 31 PID 3012 wrote to memory of 2580 3012 tbhbth.exe 31 PID 3012 wrote to memory of 2580 3012 tbhbth.exe 31 PID 2580 wrote to memory of 2876 2580 ppvvp.exe 32 PID 2580 wrote to memory of 2876 2580 ppvvp.exe 32 PID 2580 wrote to memory of 2876 2580 ppvvp.exe 32 PID 2580 wrote to memory of 2876 2580 ppvvp.exe 32 PID 2876 wrote to memory of 2864 2876 7dvdj.exe 33 PID 2876 wrote to memory of 2864 2876 7dvdj.exe 33 PID 2876 wrote to memory of 2864 2876 7dvdj.exe 33 PID 2876 wrote to memory of 2864 2876 7dvdj.exe 33 PID 2864 wrote to memory of 2488 2864 rllfxlx.exe 34 PID 2864 wrote to memory of 2488 2864 rllfxlx.exe 34 PID 2864 wrote to memory of 2488 2864 rllfxlx.exe 34 PID 2864 wrote to memory of 2488 2864 rllfxlx.exe 34 PID 2488 wrote to memory of 2448 2488 nhbhtb.exe 35 PID 2488 wrote to memory of 2448 2488 nhbhtb.exe 35 PID 2488 wrote to memory of 2448 2488 nhbhtb.exe 35 PID 2488 wrote to memory of 2448 2488 nhbhtb.exe 35 PID 2448 wrote to memory of 2572 2448 dvjpd.exe 36 PID 2448 wrote to memory of 2572 2448 dvjpd.exe 36 PID 2448 wrote to memory of 2572 2448 dvjpd.exe 36 PID 2448 wrote to memory of 2572 2448 dvjpd.exe 36 PID 2572 wrote to memory of 2188 2572 vvpvd.exe 37 PID 2572 wrote to memory of 2188 2572 vvpvd.exe 37 PID 2572 wrote to memory of 2188 2572 vvpvd.exe 37 PID 2572 wrote to memory of 2188 2572 vvpvd.exe 37 PID 2188 wrote to memory of 2788 2188 llxflrx.exe 38 PID 2188 wrote to memory of 2788 2188 llxflrx.exe 38 PID 2188 wrote to memory of 2788 2188 llxflrx.exe 38 PID 2188 wrote to memory of 2788 2188 llxflrx.exe 38 PID 2788 wrote to memory of 2348 2788 hhntbh.exe 39 PID 2788 wrote to memory of 2348 2788 hhntbh.exe 39 PID 2788 wrote to memory of 2348 2788 hhntbh.exe 39 PID 2788 wrote to memory of 2348 2788 hhntbh.exe 39 PID 2348 wrote to memory of 1480 2348 9bthtt.exe 40 PID 2348 wrote to memory of 1480 2348 9bthtt.exe 40 PID 2348 wrote to memory of 1480 2348 9bthtt.exe 40 PID 2348 wrote to memory of 1480 2348 9bthtt.exe 40 PID 1480 wrote to memory of 1208 1480 1ppvj.exe 41 PID 1480 wrote to memory of 1208 1480 1ppvj.exe 41 PID 1480 wrote to memory of 1208 1480 1ppvj.exe 41 PID 1480 wrote to memory of 1208 1480 1ppvj.exe 41 PID 1208 wrote to memory of 2688 1208 jjddj.exe 42 PID 1208 wrote to memory of 2688 1208 jjddj.exe 42 PID 1208 wrote to memory of 2688 1208 jjddj.exe 42 PID 1208 wrote to memory of 2688 1208 jjddj.exe 42 PID 2688 wrote to memory of 2796 2688 rxlflrl.exe 43 PID 2688 wrote to memory of 2796 2688 rxlflrl.exe 43 PID 2688 wrote to memory of 2796 2688 rxlflrl.exe 43 PID 2688 wrote to memory of 2796 2688 rxlflrl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ae80551df6570005b4b063d8de75df0NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1ae80551df6570005b4b063d8de75df0NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\jvpdv.exec:\jvpdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\lfrlllr.exec:\lfrlllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\tbhbth.exec:\tbhbth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\ppvvp.exec:\ppvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\7dvdj.exec:\7dvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\rllfxlx.exec:\rllfxlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\nhbhtb.exec:\nhbhtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\dvjpd.exec:\dvjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\vvpvd.exec:\vvpvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\llxflrx.exec:\llxflrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\hhntbh.exec:\hhntbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\9bthtt.exec:\9bthtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\1ppvj.exec:\1ppvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\jjddj.exec:\jjddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\rxlflrl.exec:\rxlflrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\fxfrflx.exec:\fxfrflx.exe17⤵
- Executes dropped EXE
PID:2796 -
\??\c:\tbtbnn.exec:\tbtbnn.exe18⤵
- Executes dropped EXE
PID:1580 -
\??\c:\hbntbh.exec:\hbntbh.exe19⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jdvvd.exec:\jdvvd.exe20⤵
- Executes dropped EXE
PID:1776 -
\??\c:\lllrxrl.exec:\lllrxrl.exe21⤵
- Executes dropped EXE
PID:2052 -
\??\c:\fxlrflx.exec:\fxlrflx.exe22⤵
- Executes dropped EXE
PID:2252 -
\??\c:\1nbbnt.exec:\1nbbnt.exe23⤵
- Executes dropped EXE
PID:488 -
\??\c:\hhbtbn.exec:\hhbtbn.exe24⤵
- Executes dropped EXE
PID:1444 -
\??\c:\jdpvp.exec:\jdpvp.exe25⤵
- Executes dropped EXE
PID:1800 -
\??\c:\1rfflxr.exec:\1rfflxr.exe26⤵
- Executes dropped EXE
PID:788 -
\??\c:\frflrrx.exec:\frflrrx.exe27⤵
- Executes dropped EXE
PID:1144 -
\??\c:\pvdjj.exec:\pvdjj.exe28⤵
- Executes dropped EXE
PID:1732 -
\??\c:\jvpjd.exec:\jvpjd.exe29⤵
- Executes dropped EXE
PID:1112 -
\??\c:\lxlxlrf.exec:\lxlxlrf.exe30⤵
- Executes dropped EXE
PID:2140 -
\??\c:\fxrxlxf.exec:\fxrxlxf.exe31⤵
- Executes dropped EXE
PID:2908 -
\??\c:\bntbtt.exec:\bntbtt.exe32⤵
- Executes dropped EXE
PID:1092 -
\??\c:\9pddp.exec:\9pddp.exe33⤵
- Executes dropped EXE
PID:1736 -
\??\c:\1jjdj.exec:\1jjdj.exe34⤵
- Executes dropped EXE
PID:804 -
\??\c:\5xrrlrx.exec:\5xrrlrx.exe35⤵
- Executes dropped EXE
PID:2336 -
\??\c:\llxlrxl.exec:\llxlrxl.exe36⤵
- Executes dropped EXE
PID:2012 -
\??\c:\9hntnt.exec:\9hntnt.exe37⤵
- Executes dropped EXE
PID:2532 -
\??\c:\nbnttb.exec:\nbnttb.exe38⤵
- Executes dropped EXE
PID:2772 -
\??\c:\5jjdv.exec:\5jjdv.exe39⤵
- Executes dropped EXE
PID:2644 -
\??\c:\3dvjp.exec:\3dvjp.exe40⤵
- Executes dropped EXE
PID:2580 -
\??\c:\rllrxfr.exec:\rllrxfr.exe41⤵
- Executes dropped EXE
PID:3032 -
\??\c:\xrlxlrf.exec:\xrlxlrf.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\hbhhnt.exec:\hbhhnt.exe43⤵
- Executes dropped EXE
PID:2864 -
\??\c:\tnhbnn.exec:\tnhbnn.exe44⤵
- Executes dropped EXE
PID:2512 -
\??\c:\ppjvd.exec:\ppjvd.exe45⤵
- Executes dropped EXE
PID:2516 -
\??\c:\jvddv.exec:\jvddv.exe46⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vjjjv.exec:\vjjjv.exe47⤵
- Executes dropped EXE
PID:2572 -
\??\c:\9xxlrlx.exec:\9xxlrlx.exe48⤵
- Executes dropped EXE
PID:2176 -
\??\c:\bbhtbh.exec:\bbhtbh.exe49⤵
- Executes dropped EXE
PID:2520 -
\??\c:\9dvdp.exec:\9dvdp.exe50⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jddjv.exec:\jddjv.exe51⤵
- Executes dropped EXE
PID:1668 -
\??\c:\1flrrrx.exec:\1flrrrx.exe52⤵
- Executes dropped EXE
PID:944 -
\??\c:\9rxflfx.exec:\9rxflfx.exe53⤵
- Executes dropped EXE
PID:548 -
\??\c:\tnnhbh.exec:\tnnhbh.exe54⤵
- Executes dropped EXE
PID:2636 -
\??\c:\3btnhh.exec:\3btnhh.exe55⤵
- Executes dropped EXE
PID:1512 -
\??\c:\vpjdd.exec:\vpjdd.exe56⤵
- Executes dropped EXE
PID:1528 -
\??\c:\dvjjd.exec:\dvjjd.exe57⤵
- Executes dropped EXE
PID:1624 -
\??\c:\3llrlrl.exec:\3llrlrl.exe58⤵
- Executes dropped EXE
PID:2232 -
\??\c:\nhnhtn.exec:\nhnhtn.exe59⤵
- Executes dropped EXE
PID:2844 -
\??\c:\hhnbbt.exec:\hhnbbt.exe60⤵
- Executes dropped EXE
PID:1684 -
\??\c:\7tnnnt.exec:\7tnnnt.exe61⤵
- Executes dropped EXE
PID:1956 -
\??\c:\vvvjp.exec:\vvvjp.exe62⤵
- Executes dropped EXE
PID:564 -
\??\c:\1frlxrx.exec:\1frlxrx.exe63⤵
- Executes dropped EXE
PID:2552 -
\??\c:\xlfrffr.exec:\xlfrffr.exe64⤵
- Executes dropped EXE
PID:1636 -
\??\c:\3tnttn.exec:\3tnttn.exe65⤵
- Executes dropped EXE
PID:2160 -
\??\c:\nhhhbh.exec:\nhhhbh.exe66⤵PID:1148
-
\??\c:\3vjdd.exec:\3vjdd.exe67⤵PID:644
-
\??\c:\9vjvp.exec:\9vjvp.exe68⤵PID:1180
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe69⤵PID:2984
-
\??\c:\hbhtnn.exec:\hbhtnn.exe70⤵PID:636
-
\??\c:\hnnnhh.exec:\hnnnhh.exe71⤵PID:1084
-
\??\c:\nhbnth.exec:\nhbnth.exe72⤵PID:2932
-
\??\c:\3pvvd.exec:\3pvvd.exe73⤵PID:892
-
\??\c:\xrfxffr.exec:\xrfxffr.exe74⤵PID:1164
-
\??\c:\lfxxfxf.exec:\lfxxfxf.exe75⤵PID:848
-
\??\c:\3bhhtn.exec:\3bhhtn.exe76⤵PID:1728
-
\??\c:\hthnnn.exec:\hthnnn.exe77⤵PID:3016
-
\??\c:\vjvpj.exec:\vjvpj.exe78⤵PID:2256
-
\??\c:\pjvvv.exec:\pjvvv.exe79⤵PID:1588
-
\??\c:\frxlllr.exec:\frxlllr.exe80⤵PID:2288
-
\??\c:\lxrfllr.exec:\lxrfllr.exe81⤵PID:2772
-
\??\c:\btbtbb.exec:\btbtbb.exe82⤵PID:2596
-
\??\c:\9tbntb.exec:\9tbntb.exe83⤵PID:2580
-
\??\c:\5vddv.exec:\5vddv.exe84⤵PID:2568
-
\??\c:\5ddpv.exec:\5ddpv.exe85⤵PID:1192
-
\??\c:\rrlxfff.exec:\rrlxfff.exe86⤵PID:2732
-
\??\c:\llllllf.exec:\llllllf.exe87⤵PID:2452
-
\??\c:\tnntbh.exec:\tnntbh.exe88⤵PID:2948
-
\??\c:\bthbbh.exec:\bthbbh.exe89⤵PID:2956
-
\??\c:\dvpdd.exec:\dvpdd.exe90⤵PID:1672
-
\??\c:\xlxxxrx.exec:\xlxxxrx.exe91⤵PID:1608
-
\??\c:\rxrllll.exec:\rxrllll.exe92⤵PID:2500
-
\??\c:\rrlxrxl.exec:\rrlxrxl.exe93⤵PID:1280
-
\??\c:\ttbhbn.exec:\ttbhbn.exe94⤵PID:2436
-
\??\c:\1ttnnt.exec:\1ttnnt.exe95⤵PID:2780
-
\??\c:\jpjjp.exec:\jpjjp.exe96⤵PID:2680
-
\??\c:\9dvvv.exec:\9dvvv.exe97⤵PID:2784
-
\??\c:\rrrxrfx.exec:\rrrxrfx.exe98⤵PID:1524
-
\??\c:\thttbb.exec:\thttbb.exe99⤵PID:2968
-
\??\c:\thhbbh.exec:\thhbbh.exe100⤵PID:2292
-
\??\c:\5vpjv.exec:\5vpjv.exe101⤵PID:1104
-
\??\c:\7dppd.exec:\7dppd.exe102⤵PID:1960
-
\??\c:\rlfrxrx.exec:\rlfrxrx.exe103⤵PID:784
-
\??\c:\lxlfxrl.exec:\lxlfxrl.exe104⤵PID:600
-
\??\c:\9ttbnt.exec:\9ttbnt.exe105⤵PID:584
-
\??\c:\1ttbnt.exec:\1ttbnt.exe106⤵PID:1424
-
\??\c:\jjpvd.exec:\jjpvd.exe107⤵PID:1788
-
\??\c:\pjdpv.exec:\pjdpv.exe108⤵PID:1872
-
\??\c:\rlrrllr.exec:\rlrrllr.exe109⤵PID:1148
-
\??\c:\fflxfxx.exec:\fflxfxx.exe110⤵PID:2976
-
\??\c:\bbnnbh.exec:\bbnnbh.exe111⤵PID:2132
-
\??\c:\7hbnnt.exec:\7hbnnt.exe112⤵PID:2152
-
\??\c:\nbhhbb.exec:\nbhhbb.exe113⤵PID:2140
-
\??\c:\jdjjp.exec:\jdjjp.exe114⤵PID:2180
-
\??\c:\vjdvd.exec:\vjdvd.exe115⤵PID:1752
-
\??\c:\7rlrxrl.exec:\7rlrxrl.exe116⤵PID:3036
-
\??\c:\1rrrfxl.exec:\1rrrfxl.exe117⤵PID:2228
-
\??\c:\tnnnbh.exec:\tnnnbh.exe118⤵PID:2380
-
\??\c:\nhbtbb.exec:\nhbtbb.exe119⤵PID:2212
-
\??\c:\dpdpp.exec:\dpdpp.exe120⤵PID:2012
-
\??\c:\dvvvv.exec:\dvvvv.exe121⤵PID:2560
-
\??\c:\rlxfxxl.exec:\rlxfxxl.exe122⤵PID:2660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-