Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 08:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3c493674068d0af156602861c20661c0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
3c493674068d0af156602861c20661c0_NeikiAnalytics.exe
-
Size
153KB
-
MD5
3c493674068d0af156602861c20661c0
-
SHA1
f3ba9f6a2d77f52bc69a40b531f4b473583d3c69
-
SHA256
e04a147d4176fb7637c7ffd8b5c260818b4f65b0cc3b75a4b1e5bddb3e3d51c1
-
SHA512
5e5bcf9018f67caf96d044a29a4a24997ac414dc25af9631172805ae4a37230ba0a192f50d8e76a44853337e3859d985eac45d3815ef23007865d02a48b878dd
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmX5k2LrCimBaH8UH303g:n3C9BRIG0asYFm71mJkzpaH8m37
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2752-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-28-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1260-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1188-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/356-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1900-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/768-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/960-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1160-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/880-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2752 rlflrrf.exe 2596 9bbhnt.exe 2720 jvddp.exe 2672 vpdjp.exe 2484 lffrfrf.exe 1736 nnttnh.exe 1716 9btthh.exe 2916 lfrrllx.exe 1260 1nntnn.exe 844 dvdpj.exe 2680 9rxxffr.exe 756 5hthnn.exe 2368 hbtntb.exe 1188 flfrxxx.exe 356 9rrlrlr.exe 1900 jvjvj.exe 1100 ppvpj.exe 2800 llxflxl.exe 2776 bbbbnn.exe 2248 pjdjd.exe 2332 rlffllx.exe 768 1hhnnt.exe 960 hbnbhh.exe 2732 vpvvd.exe 3000 1xlxffl.exe 1228 thttbh.exe 2288 hbbbnb.exe 1632 9pjpv.exe 1160 1rrrxxl.exe 1660 xxrxrxf.exe 880 ddpvd.exe 1740 rlxlxxf.exe 2548 hhhnbb.exe 1548 5ppdp.exe 1536 xrllxxf.exe 2564 9frffxr.exe 2616 3hhhtt.exe 2820 jjppp.exe 2724 jddpv.exe 2480 lfxlffl.exe 2520 xxrxffx.exe 2912 tttthn.exe 2924 7ttbhn.exe 1372 7vppp.exe 1360 pdpvd.exe 2524 rlxxrrx.exe 2760 btnthn.exe 996 3bbbhh.exe 1720 jvjjp.exe 1520 9jvpp.exe 288 lfxlxlx.exe 1920 xrfrllf.exe 796 3tnnbh.exe 2020 vpddj.exe 2808 jdvvj.exe 2792 xffxffl.exe 396 7lffllf.exe 1960 7hbtbn.exe 664 1htthn.exe 572 djjpd.exe 1936 7xffrxr.exe 960 rlrxrxl.exe 1784 nhtbhn.exe 1792 pjvjp.exe -
resource yara_rule behavioral1/memory/2752-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1260-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1188-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/356-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1900-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2776-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/960-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1160-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/880-294-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1904 wrote to memory of 2752 1904 3c493674068d0af156602861c20661c0_NeikiAnalytics.exe 28 PID 1904 wrote to memory of 2752 1904 3c493674068d0af156602861c20661c0_NeikiAnalytics.exe 28 PID 1904 wrote to memory of 2752 1904 3c493674068d0af156602861c20661c0_NeikiAnalytics.exe 28 PID 1904 wrote to memory of 2752 1904 3c493674068d0af156602861c20661c0_NeikiAnalytics.exe 28 PID 2752 wrote to memory of 2596 2752 rlflrrf.exe 29 PID 2752 wrote to memory of 2596 2752 rlflrrf.exe 29 PID 2752 wrote to memory of 2596 2752 rlflrrf.exe 29 PID 2752 wrote to memory of 2596 2752 rlflrrf.exe 29 PID 2596 wrote to memory of 2720 2596 9bbhnt.exe 30 PID 2596 wrote to memory of 2720 2596 9bbhnt.exe 30 PID 2596 wrote to memory of 2720 2596 9bbhnt.exe 30 PID 2596 wrote to memory of 2720 2596 9bbhnt.exe 30 PID 2720 wrote to memory of 2672 2720 jvddp.exe 31 PID 2720 wrote to memory of 2672 2720 jvddp.exe 31 PID 2720 wrote to memory of 2672 2720 jvddp.exe 31 PID 2720 wrote to memory of 2672 2720 jvddp.exe 31 PID 2672 wrote to memory of 2484 2672 vpdjp.exe 32 PID 2672 wrote to memory of 2484 2672 vpdjp.exe 32 PID 2672 wrote to memory of 2484 2672 vpdjp.exe 32 PID 2672 wrote to memory of 2484 2672 vpdjp.exe 32 PID 2484 wrote to memory of 1736 2484 lffrfrf.exe 33 PID 2484 wrote to memory of 1736 2484 lffrfrf.exe 33 PID 2484 wrote to memory of 1736 2484 lffrfrf.exe 33 PID 2484 wrote to memory of 1736 2484 lffrfrf.exe 33 PID 1736 wrote to memory of 1716 1736 nnttnh.exe 34 PID 1736 wrote to memory of 1716 1736 nnttnh.exe 34 PID 1736 wrote to memory of 1716 1736 nnttnh.exe 34 PID 1736 wrote to memory of 1716 1736 nnttnh.exe 34 PID 1716 wrote to memory of 2916 1716 9btthh.exe 35 PID 1716 wrote to memory of 2916 1716 9btthh.exe 35 PID 1716 wrote to memory of 2916 1716 9btthh.exe 35 PID 1716 wrote to memory of 2916 1716 9btthh.exe 35 PID 2916 wrote to memory of 1260 2916 lfrrllx.exe 36 PID 2916 wrote to memory of 1260 2916 lfrrllx.exe 36 PID 2916 wrote to memory of 1260 2916 lfrrllx.exe 36 PID 2916 wrote to memory of 1260 2916 lfrrllx.exe 36 PID 1260 wrote to memory of 844 1260 1nntnn.exe 37 PID 1260 wrote to memory of 844 1260 1nntnn.exe 37 PID 1260 wrote to memory of 844 1260 1nntnn.exe 37 PID 1260 wrote to memory of 844 1260 1nntnn.exe 37 PID 844 wrote to memory of 2680 844 dvdpj.exe 38 PID 844 wrote to memory of 2680 844 dvdpj.exe 38 PID 844 wrote to memory of 2680 844 dvdpj.exe 38 PID 844 wrote to memory of 2680 844 dvdpj.exe 38 PID 2680 wrote to memory of 756 2680 9rxxffr.exe 39 PID 2680 wrote to memory of 756 2680 9rxxffr.exe 39 PID 2680 wrote to memory of 756 2680 9rxxffr.exe 39 PID 2680 wrote to memory of 756 2680 9rxxffr.exe 39 PID 756 wrote to memory of 2368 756 5hthnn.exe 40 PID 756 wrote to memory of 2368 756 5hthnn.exe 40 PID 756 wrote to memory of 2368 756 5hthnn.exe 40 PID 756 wrote to memory of 2368 756 5hthnn.exe 40 PID 2368 wrote to memory of 1188 2368 hbtntb.exe 41 PID 2368 wrote to memory of 1188 2368 hbtntb.exe 41 PID 2368 wrote to memory of 1188 2368 hbtntb.exe 41 PID 2368 wrote to memory of 1188 2368 hbtntb.exe 41 PID 1188 wrote to memory of 356 1188 flfrxxx.exe 42 PID 1188 wrote to memory of 356 1188 flfrxxx.exe 42 PID 1188 wrote to memory of 356 1188 flfrxxx.exe 42 PID 1188 wrote to memory of 356 1188 flfrxxx.exe 42 PID 356 wrote to memory of 1900 356 9rrlrlr.exe 43 PID 356 wrote to memory of 1900 356 9rrlrlr.exe 43 PID 356 wrote to memory of 1900 356 9rrlrlr.exe 43 PID 356 wrote to memory of 1900 356 9rrlrlr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c493674068d0af156602861c20661c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3c493674068d0af156602861c20661c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\rlflrrf.exec:\rlflrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\9bbhnt.exec:\9bbhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\jvddp.exec:\jvddp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\vpdjp.exec:\vpdjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\lffrfrf.exec:\lffrfrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\nnttnh.exec:\nnttnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\9btthh.exec:\9btthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\lfrrllx.exec:\lfrrllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\1nntnn.exec:\1nntnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\dvdpj.exec:\dvdpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\9rxxffr.exec:\9rxxffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\5hthnn.exec:\5hthnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\hbtntb.exec:\hbtntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\flfrxxx.exec:\flfrxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\9rrlrlr.exec:\9rrlrlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:356 -
\??\c:\jvjvj.exec:\jvjvj.exe17⤵
- Executes dropped EXE
PID:1900 -
\??\c:\ppvpj.exec:\ppvpj.exe18⤵
- Executes dropped EXE
PID:1100 -
\??\c:\llxflxl.exec:\llxflxl.exe19⤵
- Executes dropped EXE
PID:2800 -
\??\c:\bbbbnn.exec:\bbbbnn.exe20⤵
- Executes dropped EXE
PID:2776 -
\??\c:\pjdjd.exec:\pjdjd.exe21⤵
- Executes dropped EXE
PID:2248 -
\??\c:\rlffllx.exec:\rlffllx.exe22⤵
- Executes dropped EXE
PID:2332 -
\??\c:\1hhnnt.exec:\1hhnnt.exe23⤵
- Executes dropped EXE
PID:768 -
\??\c:\hbnbhh.exec:\hbnbhh.exe24⤵
- Executes dropped EXE
PID:960 -
\??\c:\vpvvd.exec:\vpvvd.exe25⤵
- Executes dropped EXE
PID:2732 -
\??\c:\1xlxffl.exec:\1xlxffl.exe26⤵
- Executes dropped EXE
PID:3000 -
\??\c:\thttbh.exec:\thttbh.exe27⤵
- Executes dropped EXE
PID:1228 -
\??\c:\hbbbnb.exec:\hbbbnb.exe28⤵
- Executes dropped EXE
PID:2288 -
\??\c:\9pjpv.exec:\9pjpv.exe29⤵
- Executes dropped EXE
PID:1632 -
\??\c:\1rrrxxl.exec:\1rrrxxl.exe30⤵
- Executes dropped EXE
PID:1160 -
\??\c:\xxrxrxf.exec:\xxrxrxf.exe31⤵
- Executes dropped EXE
PID:1660 -
\??\c:\ddpvd.exec:\ddpvd.exe32⤵
- Executes dropped EXE
PID:880 -
\??\c:\rlxlxxf.exec:\rlxlxxf.exe33⤵
- Executes dropped EXE
PID:1740 -
\??\c:\hhhnbb.exec:\hhhnbb.exe34⤵
- Executes dropped EXE
PID:2548 -
\??\c:\5ppdp.exec:\5ppdp.exe35⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xrllxxf.exec:\xrllxxf.exe36⤵
- Executes dropped EXE
PID:1536 -
\??\c:\9frffxr.exec:\9frffxr.exe37⤵
- Executes dropped EXE
PID:2564 -
\??\c:\3hhhtt.exec:\3hhhtt.exe38⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jjppp.exec:\jjppp.exe39⤵
- Executes dropped EXE
PID:2820 -
\??\c:\jddpv.exec:\jddpv.exe40⤵
- Executes dropped EXE
PID:2724 -
\??\c:\lfxlffl.exec:\lfxlffl.exe41⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xxrxffx.exec:\xxrxffx.exe42⤵
- Executes dropped EXE
PID:2520 -
\??\c:\tttthn.exec:\tttthn.exe43⤵
- Executes dropped EXE
PID:2912 -
\??\c:\7ttbhn.exec:\7ttbhn.exe44⤵
- Executes dropped EXE
PID:2924 -
\??\c:\7vppp.exec:\7vppp.exe45⤵
- Executes dropped EXE
PID:1372 -
\??\c:\pdpvd.exec:\pdpvd.exe46⤵
- Executes dropped EXE
PID:1360 -
\??\c:\rlxxrrx.exec:\rlxxrrx.exe47⤵
- Executes dropped EXE
PID:2524 -
\??\c:\btnthn.exec:\btnthn.exe48⤵
- Executes dropped EXE
PID:2760 -
\??\c:\3bbbhh.exec:\3bbbhh.exe49⤵
- Executes dropped EXE
PID:996 -
\??\c:\jvjjp.exec:\jvjjp.exe50⤵
- Executes dropped EXE
PID:1720 -
\??\c:\9jvpp.exec:\9jvpp.exe51⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lfxlxlx.exec:\lfxlxlx.exe52⤵
- Executes dropped EXE
PID:288 -
\??\c:\xrfrllf.exec:\xrfrllf.exe53⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3tnnbh.exec:\3tnnbh.exe54⤵
- Executes dropped EXE
PID:796 -
\??\c:\vpddj.exec:\vpddj.exe55⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jdvvj.exec:\jdvvj.exe56⤵
- Executes dropped EXE
PID:2808 -
\??\c:\xffxffl.exec:\xffxffl.exe57⤵
- Executes dropped EXE
PID:2792 -
\??\c:\7lffllf.exec:\7lffllf.exe58⤵
- Executes dropped EXE
PID:396 -
\??\c:\7hbtbn.exec:\7hbtbn.exe59⤵
- Executes dropped EXE
PID:1960 -
\??\c:\1htthn.exec:\1htthn.exe60⤵
- Executes dropped EXE
PID:664 -
\??\c:\djjpd.exec:\djjpd.exe61⤵
- Executes dropped EXE
PID:572 -
\??\c:\7xffrxr.exec:\7xffrxr.exe62⤵
- Executes dropped EXE
PID:1936 -
\??\c:\rlrxrxl.exec:\rlrxrxl.exe63⤵
- Executes dropped EXE
PID:960 -
\??\c:\nhtbhn.exec:\nhtbhn.exe64⤵
- Executes dropped EXE
PID:1784 -
\??\c:\pjvjp.exec:\pjvjp.exe65⤵
- Executes dropped EXE
PID:1792 -
\??\c:\jdvvd.exec:\jdvvd.exe66⤵PID:2284
-
\??\c:\rfrxxrr.exec:\rfrxxrr.exe67⤵PID:2272
-
\??\c:\lfrfrxx.exec:\lfrfrxx.exe68⤵PID:2296
-
\??\c:\1ffxllr.exec:\1ffxllr.exe69⤵PID:1672
-
\??\c:\hbttbb.exec:\hbttbb.exe70⤵PID:2200
-
\??\c:\pppvp.exec:\pppvp.exe71⤵PID:1652
-
\??\c:\vvjpd.exec:\vvjpd.exe72⤵PID:2884
-
\??\c:\3rfrfrf.exec:\3rfrfrf.exe73⤵PID:1928
-
\??\c:\1fxflrf.exec:\1fxflrf.exe74⤵PID:1944
-
\??\c:\nbtthb.exec:\nbtthb.exe75⤵PID:1640
-
\??\c:\9nbhnb.exec:\9nbhnb.exe76⤵PID:1540
-
\??\c:\jjdvj.exec:\jjdvj.exe77⤵PID:2992
-
\??\c:\3dvpv.exec:\3dvpv.exe78⤵PID:2668
-
\??\c:\llxxlrf.exec:\llxxlrf.exe79⤵PID:2624
-
\??\c:\xrxxffr.exec:\xrxxffr.exe80⤵PID:2484
-
\??\c:\7tnntb.exec:\7tnntb.exe81⤵PID:2628
-
\??\c:\hbnbhh.exec:\hbnbhh.exe82⤵PID:2936
-
\??\c:\pjddv.exec:\pjddv.exe83⤵PID:3004
-
\??\c:\xxfxrxl.exec:\xxfxrxl.exe84⤵PID:2964
-
\??\c:\fxxlrrf.exec:\fxxlrrf.exe85⤵PID:2176
-
\??\c:\1tnthh.exec:\1tnthh.exe86⤵PID:1424
-
\??\c:\5htbnt.exec:\5htbnt.exe87⤵PID:2556
-
\??\c:\3pdpv.exec:\3pdpv.exe88⤵PID:2652
-
\??\c:\vvpdv.exec:\vvpdv.exe89⤵PID:756
-
\??\c:\rlrrffr.exec:\rlrrffr.exe90⤵PID:1456
-
\??\c:\nhnbnt.exec:\nhnbnt.exe91⤵PID:2152
-
\??\c:\3nbhtt.exec:\3nbhtt.exe92⤵PID:1476
-
\??\c:\5ppdv.exec:\5ppdv.exe93⤵PID:1752
-
\??\c:\jjjjv.exec:\jjjjv.exe94⤵PID:1588
-
\??\c:\rllxrfr.exec:\rllxrfr.exe95⤵PID:2032
-
\??\c:\rfxrlrf.exec:\rfxrlrf.exe96⤵PID:2020
-
\??\c:\bbnntb.exec:\bbnntb.exe97⤵PID:2276
-
\??\c:\7bhntt.exec:\7bhntt.exe98⤵PID:2220
-
\??\c:\9ddpv.exec:\9ddpv.exe99⤵PID:2632
-
\??\c:\jdppj.exec:\jdppj.exe100⤵PID:1960
-
\??\c:\lxxfflf.exec:\lxxfflf.exe101⤵PID:604
-
\??\c:\fxrrffl.exec:\fxrrffl.exe102⤵PID:584
-
\??\c:\hbnnbb.exec:\hbnnbb.exe103⤵PID:1164
-
\??\c:\nthtbb.exec:\nthtbb.exe104⤵PID:1108
-
\??\c:\jdvpv.exec:\jdvpv.exe105⤵PID:1496
-
\??\c:\vpvdj.exec:\vpvdj.exe106⤵PID:1688
-
\??\c:\5rrrlrf.exec:\5rrrlrf.exe107⤵PID:888
-
\??\c:\5lfrxrx.exec:\5lfrxrx.exe108⤵PID:836
-
\??\c:\hhbnhn.exec:\hhbnhn.exe109⤵PID:1884
-
\??\c:\nhtbnh.exec:\nhtbnh.exe110⤵PID:608
-
\??\c:\dvjpd.exec:\dvjpd.exe111⤵PID:2000
-
\??\c:\vpjjp.exec:\vpjjp.exe112⤵PID:2060
-
\??\c:\rllrrrf.exec:\rllrrrf.exe113⤵PID:1852
-
\??\c:\7bntbh.exec:\7bntbh.exe114⤵PID:880
-
\??\c:\thtnbh.exec:\thtnbh.exe115⤵PID:2548
-
\??\c:\jdjpp.exec:\jdjpp.exe116⤵PID:2268
-
\??\c:\jddvd.exec:\jddvd.exe117⤵PID:1536
-
\??\c:\pddvj.exec:\pddvj.exe118⤵PID:2984
-
\??\c:\rlxrffl.exec:\rlxrffl.exe119⤵PID:2616
-
\??\c:\bthnbt.exec:\bthnbt.exe120⤵PID:2512
-
\??\c:\nhnntb.exec:\nhnntb.exe121⤵PID:2592
-
\??\c:\bttbhn.exec:\bttbhn.exe122⤵PID:2476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-