Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 07:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4af78181393af80dc69cb4ba28d031b0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
4af78181393af80dc69cb4ba28d031b0_NeikiAnalytics.exe
-
Size
100KB
-
MD5
4af78181393af80dc69cb4ba28d031b0
-
SHA1
dec68afa5f0d11be47295fdb513d2827f8b87408
-
SHA256
a2e6013fe104ddbbdb1604be27741c72a9e1c23af1f9bf8d46a06656e1bc86ad
-
SHA512
cbe7e238773f15dedbb75376f057d0549311b433d05c206284d1a02656b251360cb8830438cf8b00564e3ce95e4396ba20d48595f873c9ecdc3c299e4667848b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDodtzn6zDaE0R5J:ymb3NkkiQ3mdBjFodt2zE3J
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2188-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1352-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/748-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1036-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1008-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/444-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1472-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2300 5lflfxl.exe 2620 7nhntb.exe 2616 rfllllf.exe 2764 ntnntb.exe 2772 vpjjd.exe 2480 9pjjj.exe 1572 xlxflrl.exe 2152 9hthnn.exe 1252 jvpdv.exe 1352 pjdjv.exe 748 rflrfxf.exe 620 bhhbnt.exe 1704 ddvjv.exe 2372 rxlrrrx.exe 1036 3hbntb.exe 2032 nnbhth.exe 2796 jddpj.exe 2740 fffrxxl.exe 1212 bbbbth.exe 2308 9nnbbb.exe 776 5vpvj.exe 1404 xflffxx.exe 1720 hhhtth.exe 1008 5tnhbh.exe 444 jpppd.exe 3060 lfrrxfl.exe 1708 bhthhb.exe 628 5nbbhn.exe 1664 ddvdv.exe 1472 xrlxlxf.exe 1944 bhtnnn.exe 1532 pjvpv.exe 2580 rrrlfxf.exe 2688 ttntnh.exe 2700 vppdd.exe 2588 ddvjp.exe 2768 9rflxfr.exe 2660 nnnhbb.exe 2692 hbthht.exe 2548 jjdpj.exe 2528 fffxxrx.exe 2940 7rfxrfx.exe 1144 tnnnbb.exe 2280 bhtnnb.exe 2532 7jpvd.exe 1032 9jjjp.exe 1648 rlxlxff.exe 2124 7nhbnb.exe 2172 hbbbtt.exe 688 7jdpp.exe 2372 ddjdv.exe 1884 3llxrfx.exe 2012 3xrfxff.exe 2720 nhthtt.exe 2920 bbbthh.exe 1832 pjvdv.exe 2568 dvvvd.exe 784 rrlxrxl.exe 1408 flxllll.exe 1668 tbtbhb.exe 1140 btntnt.exe 1720 ppjpv.exe 1116 7djpv.exe 236 llxrrfr.exe -
resource yara_rule behavioral1/memory/2188-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1352-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/748-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1036-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1008-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/444-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1472-291-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2300 2188 4af78181393af80dc69cb4ba28d031b0_NeikiAnalytics.exe 28 PID 2188 wrote to memory of 2300 2188 4af78181393af80dc69cb4ba28d031b0_NeikiAnalytics.exe 28 PID 2188 wrote to memory of 2300 2188 4af78181393af80dc69cb4ba28d031b0_NeikiAnalytics.exe 28 PID 2188 wrote to memory of 2300 2188 4af78181393af80dc69cb4ba28d031b0_NeikiAnalytics.exe 28 PID 2300 wrote to memory of 2620 2300 5lflfxl.exe 29 PID 2300 wrote to memory of 2620 2300 5lflfxl.exe 29 PID 2300 wrote to memory of 2620 2300 5lflfxl.exe 29 PID 2300 wrote to memory of 2620 2300 5lflfxl.exe 29 PID 2620 wrote to memory of 2616 2620 7nhntb.exe 30 PID 2620 wrote to memory of 2616 2620 7nhntb.exe 30 PID 2620 wrote to memory of 2616 2620 7nhntb.exe 30 PID 2620 wrote to memory of 2616 2620 7nhntb.exe 30 PID 2616 wrote to memory of 2764 2616 rfllllf.exe 31 PID 2616 wrote to memory of 2764 2616 rfllllf.exe 31 PID 2616 wrote to memory of 2764 2616 rfllllf.exe 31 PID 2616 wrote to memory of 2764 2616 rfllllf.exe 31 PID 2764 wrote to memory of 2772 2764 ntnntb.exe 32 PID 2764 wrote to memory of 2772 2764 ntnntb.exe 32 PID 2764 wrote to memory of 2772 2764 ntnntb.exe 32 PID 2764 wrote to memory of 2772 2764 ntnntb.exe 32 PID 2772 wrote to memory of 2480 2772 vpjjd.exe 33 PID 2772 wrote to memory of 2480 2772 vpjjd.exe 33 PID 2772 wrote to memory of 2480 2772 vpjjd.exe 33 PID 2772 wrote to memory of 2480 2772 vpjjd.exe 33 PID 2480 wrote to memory of 1572 2480 9pjjj.exe 34 PID 2480 wrote to memory of 1572 2480 9pjjj.exe 34 PID 2480 wrote to memory of 1572 2480 9pjjj.exe 34 PID 2480 wrote to memory of 1572 2480 9pjjj.exe 34 PID 1572 wrote to memory of 2152 1572 xlxflrl.exe 35 PID 1572 wrote to memory of 2152 1572 xlxflrl.exe 35 PID 1572 wrote to memory of 2152 1572 xlxflrl.exe 35 PID 1572 wrote to memory of 2152 1572 xlxflrl.exe 35 PID 2152 wrote to memory of 1252 2152 9hthnn.exe 36 PID 2152 wrote to memory of 1252 2152 9hthnn.exe 36 PID 2152 wrote to memory of 1252 2152 9hthnn.exe 36 PID 2152 wrote to memory of 1252 2152 9hthnn.exe 36 PID 1252 wrote to memory of 1352 1252 jvpdv.exe 37 PID 1252 wrote to memory of 1352 1252 jvpdv.exe 37 PID 1252 wrote to memory of 1352 1252 jvpdv.exe 37 PID 1252 wrote to memory of 1352 1252 jvpdv.exe 37 PID 1352 wrote to memory of 748 1352 pjdjv.exe 38 PID 1352 wrote to memory of 748 1352 pjdjv.exe 38 PID 1352 wrote to memory of 748 1352 pjdjv.exe 38 PID 1352 wrote to memory of 748 1352 pjdjv.exe 38 PID 748 wrote to memory of 620 748 rflrfxf.exe 39 PID 748 wrote to memory of 620 748 rflrfxf.exe 39 PID 748 wrote to memory of 620 748 rflrfxf.exe 39 PID 748 wrote to memory of 620 748 rflrfxf.exe 39 PID 620 wrote to memory of 1704 620 bhhbnt.exe 40 PID 620 wrote to memory of 1704 620 bhhbnt.exe 40 PID 620 wrote to memory of 1704 620 bhhbnt.exe 40 PID 620 wrote to memory of 1704 620 bhhbnt.exe 40 PID 1704 wrote to memory of 2372 1704 ddvjv.exe 41 PID 1704 wrote to memory of 2372 1704 ddvjv.exe 41 PID 1704 wrote to memory of 2372 1704 ddvjv.exe 41 PID 1704 wrote to memory of 2372 1704 ddvjv.exe 41 PID 2372 wrote to memory of 1036 2372 rxlrrrx.exe 42 PID 2372 wrote to memory of 1036 2372 rxlrrrx.exe 42 PID 2372 wrote to memory of 1036 2372 rxlrrrx.exe 42 PID 2372 wrote to memory of 1036 2372 rxlrrrx.exe 42 PID 1036 wrote to memory of 2032 1036 3hbntb.exe 43 PID 1036 wrote to memory of 2032 1036 3hbntb.exe 43 PID 1036 wrote to memory of 2032 1036 3hbntb.exe 43 PID 1036 wrote to memory of 2032 1036 3hbntb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\4af78181393af80dc69cb4ba28d031b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4af78181393af80dc69cb4ba28d031b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\5lflfxl.exec:\5lflfxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\7nhntb.exec:\7nhntb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\rfllllf.exec:\rfllllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\ntnntb.exec:\ntnntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\vpjjd.exec:\vpjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\9pjjj.exec:\9pjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\xlxflrl.exec:\xlxflrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\9hthnn.exec:\9hthnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\jvpdv.exec:\jvpdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\pjdjv.exec:\pjdjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\rflrfxf.exec:\rflrfxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\bhhbnt.exec:\bhhbnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\ddvjv.exec:\ddvjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\rxlrrrx.exec:\rxlrrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\3hbntb.exec:\3hbntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\nnbhth.exec:\nnbhth.exe17⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jddpj.exec:\jddpj.exe18⤵
- Executes dropped EXE
PID:2796 -
\??\c:\fffrxxl.exec:\fffrxxl.exe19⤵
- Executes dropped EXE
PID:2740 -
\??\c:\bbbbth.exec:\bbbbth.exe20⤵
- Executes dropped EXE
PID:1212 -
\??\c:\9nnbbb.exec:\9nnbbb.exe21⤵
- Executes dropped EXE
PID:2308 -
\??\c:\5vpvj.exec:\5vpvj.exe22⤵
- Executes dropped EXE
PID:776 -
\??\c:\xflffxx.exec:\xflffxx.exe23⤵
- Executes dropped EXE
PID:1404 -
\??\c:\hhhtth.exec:\hhhtth.exe24⤵
- Executes dropped EXE
PID:1720 -
\??\c:\5tnhbh.exec:\5tnhbh.exe25⤵
- Executes dropped EXE
PID:1008 -
\??\c:\jpppd.exec:\jpppd.exe26⤵
- Executes dropped EXE
PID:444 -
\??\c:\lfrrxfl.exec:\lfrrxfl.exe27⤵
- Executes dropped EXE
PID:3060 -
\??\c:\bhthhb.exec:\bhthhb.exe28⤵
- Executes dropped EXE
PID:1708 -
\??\c:\5nbbhn.exec:\5nbbhn.exe29⤵
- Executes dropped EXE
PID:628 -
\??\c:\ddvdv.exec:\ddvdv.exe30⤵
- Executes dropped EXE
PID:1664 -
\??\c:\xrlxlxf.exec:\xrlxlxf.exe31⤵
- Executes dropped EXE
PID:1472 -
\??\c:\bhtnnn.exec:\bhtnnn.exe32⤵
- Executes dropped EXE
PID:1944 -
\??\c:\pjvpv.exec:\pjvpv.exe33⤵
- Executes dropped EXE
PID:1532 -
\??\c:\rrrlfxf.exec:\rrrlfxf.exe34⤵
- Executes dropped EXE
PID:2580 -
\??\c:\ttntnh.exec:\ttntnh.exe35⤵
- Executes dropped EXE
PID:2688 -
\??\c:\vppdd.exec:\vppdd.exe36⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ddvjp.exec:\ddvjp.exe37⤵
- Executes dropped EXE
PID:2588 -
\??\c:\9rflxfr.exec:\9rflxfr.exe38⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nnnhbb.exec:\nnnhbb.exe39⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hbthht.exec:\hbthht.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jjdpj.exec:\jjdpj.exe41⤵
- Executes dropped EXE
PID:2548 -
\??\c:\fffxxrx.exec:\fffxxrx.exe42⤵
- Executes dropped EXE
PID:2528 -
\??\c:\7rfxrfx.exec:\7rfxrfx.exe43⤵
- Executes dropped EXE
PID:2940 -
\??\c:\tnnnbb.exec:\tnnnbb.exe44⤵
- Executes dropped EXE
PID:1144 -
\??\c:\bhtnnb.exec:\bhtnnb.exe45⤵
- Executes dropped EXE
PID:2280 -
\??\c:\7jpvd.exec:\7jpvd.exe46⤵
- Executes dropped EXE
PID:2532 -
\??\c:\9jjjp.exec:\9jjjp.exe47⤵
- Executes dropped EXE
PID:1032 -
\??\c:\rlxlxff.exec:\rlxlxff.exe48⤵
- Executes dropped EXE
PID:1648 -
\??\c:\7nhbnb.exec:\7nhbnb.exe49⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hbbbtt.exec:\hbbbtt.exe50⤵
- Executes dropped EXE
PID:2172 -
\??\c:\7jdpp.exec:\7jdpp.exe51⤵
- Executes dropped EXE
PID:688 -
\??\c:\ddjdv.exec:\ddjdv.exe52⤵
- Executes dropped EXE
PID:2372 -
\??\c:\3llxrfx.exec:\3llxrfx.exe53⤵
- Executes dropped EXE
PID:1884 -
\??\c:\3xrfxff.exec:\3xrfxff.exe54⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nhthtt.exec:\nhthtt.exe55⤵
- Executes dropped EXE
PID:2720 -
\??\c:\bbbthh.exec:\bbbthh.exe56⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pjvdv.exec:\pjvdv.exe57⤵
- Executes dropped EXE
PID:1832 -
\??\c:\dvvvd.exec:\dvvvd.exe58⤵
- Executes dropped EXE
PID:2568 -
\??\c:\rrlxrxl.exec:\rrlxrxl.exe59⤵
- Executes dropped EXE
PID:784 -
\??\c:\flxllll.exec:\flxllll.exe60⤵
- Executes dropped EXE
PID:1408 -
\??\c:\tbtbhb.exec:\tbtbhb.exe61⤵
- Executes dropped EXE
PID:1668 -
\??\c:\btntnt.exec:\btntnt.exe62⤵
- Executes dropped EXE
PID:1140 -
\??\c:\ppjpv.exec:\ppjpv.exe63⤵
- Executes dropped EXE
PID:1720 -
\??\c:\7djpv.exec:\7djpv.exe64⤵
- Executes dropped EXE
PID:1116 -
\??\c:\llxrrfr.exec:\llxrrfr.exe65⤵
- Executes dropped EXE
PID:236 -
\??\c:\lxrrxfr.exec:\lxrrxfr.exe66⤵PID:2064
-
\??\c:\thtbnn.exec:\thtbnn.exe67⤵PID:1912
-
\??\c:\dvvdp.exec:\dvvdp.exe68⤵PID:2340
-
\??\c:\vddvd.exec:\vddvd.exe69⤵PID:2244
-
\??\c:\xrflxxl.exec:\xrflxxl.exe70⤵PID:1424
-
\??\c:\llrxxxr.exec:\llrxxxr.exe71⤵PID:2148
-
\??\c:\tntthn.exec:\tntthn.exe72⤵PID:2252
-
\??\c:\nhtbnn.exec:\nhtbnn.exe73⤵PID:2964
-
\??\c:\vdddj.exec:\vdddj.exe74⤵PID:3000
-
\??\c:\vvvdv.exec:\vvvdv.exe75⤵PID:2600
-
\??\c:\lfxfxfr.exec:\lfxfxfr.exe76⤵PID:2628
-
\??\c:\7xrlxrl.exec:\7xrlxrl.exe77⤵PID:2844
-
\??\c:\tnntbh.exec:\tnntbh.exe78⤵PID:2616
-
\??\c:\bbthht.exec:\bbthht.exe79⤵PID:2608
-
\??\c:\pjjdp.exec:\pjjdp.exe80⤵PID:2772
-
\??\c:\pdddp.exec:\pdddp.exe81⤵PID:2644
-
\??\c:\lffxfrl.exec:\lffxfrl.exe82⤵PID:2548
-
\??\c:\lfflrxx.exec:\lfflrxx.exe83⤵PID:2488
-
\??\c:\5tttnn.exec:\5tttnn.exe84⤵PID:2132
-
\??\c:\ddvjp.exec:\ddvjp.exe85⤵PID:896
-
\??\c:\jjddv.exec:\jjddv.exe86⤵PID:2540
-
\??\c:\3xrlfrf.exec:\3xrlfrf.exe87⤵PID:2456
-
\??\c:\xrfrrxl.exec:\xrfrrxl.exe88⤵PID:748
-
\??\c:\hbtnnb.exec:\hbtnnb.exe89⤵PID:1220
-
\??\c:\bhnhhh.exec:\bhnhhh.exe90⤵PID:2184
-
\??\c:\vpdpv.exec:\vpdpv.exe91⤵PID:276
-
\??\c:\vdvjp.exec:\vdvjp.exe92⤵PID:2404
-
\??\c:\flfxxxf.exec:\flfxxxf.exe93⤵PID:2724
-
\??\c:\hbnnbh.exec:\hbnnbh.exe94⤵PID:2824
-
\??\c:\hbnbtn.exec:\hbnbtn.exe95⤵PID:2004
-
\??\c:\9jvpv.exec:\9jvpv.exe96⤵PID:2212
-
\??\c:\jvjdj.exec:\jvjdj.exe97⤵PID:2236
-
\??\c:\xrfflfr.exec:\xrfflfr.exe98⤵PID:2288
-
\??\c:\tttnhn.exec:\tttnhn.exe99⤵PID:1212
-
\??\c:\5nhtbn.exec:\5nhtbn.exe100⤵PID:1068
-
\??\c:\dvjvj.exec:\dvjvj.exe101⤵PID:2560
-
\??\c:\vpdpp.exec:\vpdpp.exe102⤵PID:2436
-
\??\c:\3flrrxl.exec:\3flrrxl.exe103⤵PID:2284
-
\??\c:\llfllrf.exec:\llfllrf.exe104⤵PID:2316
-
\??\c:\3thhnb.exec:\3thhnb.exe105⤵PID:832
-
\??\c:\hnbbbh.exec:\hnbbbh.exe106⤵PID:1852
-
\??\c:\vjvvd.exec:\vjvvd.exe107⤵PID:1920
-
\??\c:\rxfxrrf.exec:\rxfxrrf.exe108⤵PID:2736
-
\??\c:\lrxrffl.exec:\lrxrffl.exe109⤵PID:2452
-
\??\c:\ntnbtn.exec:\ntnbtn.exe110⤵PID:2180
-
\??\c:\1nhttb.exec:\1nhttb.exe111⤵PID:884
-
\??\c:\vvvdp.exec:\vvvdp.exe112⤵PID:2792
-
\??\c:\9vdjd.exec:\9vdjd.exe113⤵PID:1620
-
\??\c:\rlxfllr.exec:\rlxfllr.exe114⤵PID:1532
-
\??\c:\hhthnt.exec:\hhthnt.exe115⤵PID:2708
-
\??\c:\1nhtbb.exec:\1nhtbb.exe116⤵PID:2688
-
\??\c:\pdvdj.exec:\pdvdj.exe117⤵PID:2700
-
\??\c:\ppjvj.exec:\ppjvj.exe118⤵PID:2588
-
\??\c:\lxrfrrx.exec:\lxrfrrx.exe119⤵PID:2768
-
\??\c:\9rlxllf.exec:\9rlxllf.exe120⤵PID:2660
-
\??\c:\ntthbt.exec:\ntthbt.exe121⤵PID:2544
-
\??\c:\pjvvd.exec:\pjvvd.exe122⤵PID:2480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-