Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 07:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
91ff6c48df9c11d80cf91dd37b3b1a10_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
91ff6c48df9c11d80cf91dd37b3b1a10_NeikiAnalytics.exe
-
Size
103KB
-
MD5
91ff6c48df9c11d80cf91dd37b3b1a10
-
SHA1
c3ae48eb15c61b918b6a02a3366621534229bc4a
-
SHA256
c0396674dc1f3bd16806afe2fb51c53358126b51b28290139cce6bacf316a505
-
SHA512
06b54e9c84d4e938217eebbfdc4dd5ac11a4c02996b272734fbee0ba3c78c490d33d2c70524caa0be7a1c2ff63f8e54893500bf006bf2155b0e008ebfc4ee454
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoTNKDeS98hPUdHV7RNzfnLnN3oT:ymb3NkkiQ3mdBjFo5KDe88g1fR8R
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral1/memory/384-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-71-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-90-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1592-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1504-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/480-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2196 9rxfrfl.exe 1716 btbthh.exe 2580 jvjvj.exe 2876 5rlxfrf.exe 2568 7bthtb.exe 2800 jjpvp.exe 2620 dddjj.exe 2484 xrfflrx.exe 2960 9hbnhh.exe 2792 dpjdj.exe 2920 xxfrrlx.exe 2764 lfxxflr.exe 1592 3nhtnb.exe 2760 jdppv.exe 1792 9vpvd.exe 2788 rxxfxrl.exe 1504 3thntt.exe 2140 pdvvj.exe 2292 7vpvj.exe 2276 lxlfxxx.exe 2088 rlxrllx.exe 480 5bbnbb.exe 1484 7dvdv.exe 988 1vjjp.exe 812 xxlxllr.exe 280 nbttnb.exe 1748 jdppp.exe 2032 pppjv.exe 2256 xfrflff.exe 1712 frffxfr.exe 1508 5hhhnb.exe 2164 jdjdd.exe 1604 9hhnnt.exe 1664 hbbbnh.exe 2372 ddpvd.exe 1708 rllrxll.exe 2580 fxxfrrx.exe 2876 ntttnh.exe 2324 tnhhtb.exe 2808 vpvdj.exe 2508 rxfflfx.exe 2456 lrfrlfx.exe 2468 nhhbtb.exe 2124 5bnthn.exe 3004 ddvdp.exe 2980 jvjjp.exe 1640 1jpdv.exe 1636 1fxxlxr.exe 2412 rrxlfrf.exe 1548 bbthbh.exe 1532 tttthh.exe 2840 jdvjd.exe 1296 jjvjd.exe 2272 rrxrfrl.exe 1304 rlfrllf.exe 2000 fxlrflf.exe 2816 bnhhnn.exe 2276 hnnbnt.exe 2432 jdvjv.exe 984 lfrxrfr.exe 1480 lxrrllf.exe 2640 hbtnbt.exe 1864 bhhthh.exe 1972 vvdjv.exe -
resource yara_rule behavioral1/memory/384-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/384-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2196-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1592-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/480-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-288-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 384 wrote to memory of 2196 384 91ff6c48df9c11d80cf91dd37b3b1a10_NeikiAnalytics.exe 28 PID 384 wrote to memory of 2196 384 91ff6c48df9c11d80cf91dd37b3b1a10_NeikiAnalytics.exe 28 PID 384 wrote to memory of 2196 384 91ff6c48df9c11d80cf91dd37b3b1a10_NeikiAnalytics.exe 28 PID 384 wrote to memory of 2196 384 91ff6c48df9c11d80cf91dd37b3b1a10_NeikiAnalytics.exe 28 PID 2196 wrote to memory of 1716 2196 9rxfrfl.exe 29 PID 2196 wrote to memory of 1716 2196 9rxfrfl.exe 29 PID 2196 wrote to memory of 1716 2196 9rxfrfl.exe 29 PID 2196 wrote to memory of 1716 2196 9rxfrfl.exe 29 PID 1716 wrote to memory of 2580 1716 btbthh.exe 30 PID 1716 wrote to memory of 2580 1716 btbthh.exe 30 PID 1716 wrote to memory of 2580 1716 btbthh.exe 30 PID 1716 wrote to memory of 2580 1716 btbthh.exe 30 PID 2580 wrote to memory of 2876 2580 jvjvj.exe 31 PID 2580 wrote to memory of 2876 2580 jvjvj.exe 31 PID 2580 wrote to memory of 2876 2580 jvjvj.exe 31 PID 2580 wrote to memory of 2876 2580 jvjvj.exe 31 PID 2876 wrote to memory of 2568 2876 5rlxfrf.exe 32 PID 2876 wrote to memory of 2568 2876 5rlxfrf.exe 32 PID 2876 wrote to memory of 2568 2876 5rlxfrf.exe 32 PID 2876 wrote to memory of 2568 2876 5rlxfrf.exe 32 PID 2568 wrote to memory of 2800 2568 7bthtb.exe 33 PID 2568 wrote to memory of 2800 2568 7bthtb.exe 33 PID 2568 wrote to memory of 2800 2568 7bthtb.exe 33 PID 2568 wrote to memory of 2800 2568 7bthtb.exe 33 PID 2800 wrote to memory of 2620 2800 jjpvp.exe 34 PID 2800 wrote to memory of 2620 2800 jjpvp.exe 34 PID 2800 wrote to memory of 2620 2800 jjpvp.exe 34 PID 2800 wrote to memory of 2620 2800 jjpvp.exe 34 PID 2620 wrote to memory of 2484 2620 dddjj.exe 35 PID 2620 wrote to memory of 2484 2620 dddjj.exe 35 PID 2620 wrote to memory of 2484 2620 dddjj.exe 35 PID 2620 wrote to memory of 2484 2620 dddjj.exe 35 PID 2484 wrote to memory of 2960 2484 xrfflrx.exe 36 PID 2484 wrote to memory of 2960 2484 xrfflrx.exe 36 PID 2484 wrote to memory of 2960 2484 xrfflrx.exe 36 PID 2484 wrote to memory of 2960 2484 xrfflrx.exe 36 PID 2960 wrote to memory of 2792 2960 9hbnhh.exe 37 PID 2960 wrote to memory of 2792 2960 9hbnhh.exe 37 PID 2960 wrote to memory of 2792 2960 9hbnhh.exe 37 PID 2960 wrote to memory of 2792 2960 9hbnhh.exe 37 PID 2792 wrote to memory of 2920 2792 dpjdj.exe 38 PID 2792 wrote to memory of 2920 2792 dpjdj.exe 38 PID 2792 wrote to memory of 2920 2792 dpjdj.exe 38 PID 2792 wrote to memory of 2920 2792 dpjdj.exe 38 PID 2920 wrote to memory of 2764 2920 xxfrrlx.exe 39 PID 2920 wrote to memory of 2764 2920 xxfrrlx.exe 39 PID 2920 wrote to memory of 2764 2920 xxfrrlx.exe 39 PID 2920 wrote to memory of 2764 2920 xxfrrlx.exe 39 PID 2764 wrote to memory of 1592 2764 lfxxflr.exe 40 PID 2764 wrote to memory of 1592 2764 lfxxflr.exe 40 PID 2764 wrote to memory of 1592 2764 lfxxflr.exe 40 PID 2764 wrote to memory of 1592 2764 lfxxflr.exe 40 PID 1592 wrote to memory of 2760 1592 3nhtnb.exe 41 PID 1592 wrote to memory of 2760 1592 3nhtnb.exe 41 PID 1592 wrote to memory of 2760 1592 3nhtnb.exe 41 PID 1592 wrote to memory of 2760 1592 3nhtnb.exe 41 PID 2760 wrote to memory of 1792 2760 jdppv.exe 42 PID 2760 wrote to memory of 1792 2760 jdppv.exe 42 PID 2760 wrote to memory of 1792 2760 jdppv.exe 42 PID 2760 wrote to memory of 1792 2760 jdppv.exe 42 PID 1792 wrote to memory of 2788 1792 9vpvd.exe 43 PID 1792 wrote to memory of 2788 1792 9vpvd.exe 43 PID 1792 wrote to memory of 2788 1792 9vpvd.exe 43 PID 1792 wrote to memory of 2788 1792 9vpvd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\91ff6c48df9c11d80cf91dd37b3b1a10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\91ff6c48df9c11d80cf91dd37b3b1a10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\9rxfrfl.exec:\9rxfrfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\btbthh.exec:\btbthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\jvjvj.exec:\jvjvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\5rlxfrf.exec:\5rlxfrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\7bthtb.exec:\7bthtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\jjpvp.exec:\jjpvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\dddjj.exec:\dddjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xrfflrx.exec:\xrfflrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\9hbnhh.exec:\9hbnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\dpjdj.exec:\dpjdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\xxfrrlx.exec:\xxfrrlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\lfxxflr.exec:\lfxxflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\3nhtnb.exec:\3nhtnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\jdppv.exec:\jdppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\9vpvd.exec:\9vpvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\rxxfxrl.exec:\rxxfxrl.exe17⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3thntt.exec:\3thntt.exe18⤵
- Executes dropped EXE
PID:1504 -
\??\c:\pdvvj.exec:\pdvvj.exe19⤵
- Executes dropped EXE
PID:2140 -
\??\c:\7vpvj.exec:\7vpvj.exe20⤵
- Executes dropped EXE
PID:2292 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe21⤵
- Executes dropped EXE
PID:2276 -
\??\c:\rlxrllx.exec:\rlxrllx.exe22⤵
- Executes dropped EXE
PID:2088 -
\??\c:\5bbnbb.exec:\5bbnbb.exe23⤵
- Executes dropped EXE
PID:480 -
\??\c:\7dvdv.exec:\7dvdv.exe24⤵
- Executes dropped EXE
PID:1484 -
\??\c:\1vjjp.exec:\1vjjp.exe25⤵
- Executes dropped EXE
PID:988 -
\??\c:\xxlxllr.exec:\xxlxllr.exe26⤵
- Executes dropped EXE
PID:812 -
\??\c:\nbttnb.exec:\nbttnb.exe27⤵
- Executes dropped EXE
PID:280 -
\??\c:\jdppp.exec:\jdppp.exe28⤵
- Executes dropped EXE
PID:1748 -
\??\c:\pppjv.exec:\pppjv.exe29⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xfrflff.exec:\xfrflff.exe30⤵
- Executes dropped EXE
PID:2256 -
\??\c:\frffxfr.exec:\frffxfr.exe31⤵
- Executes dropped EXE
PID:1712 -
\??\c:\5hhhnb.exec:\5hhhnb.exe32⤵
- Executes dropped EXE
PID:1508 -
\??\c:\jdjdd.exec:\jdjdd.exe33⤵
- Executes dropped EXE
PID:2164 -
\??\c:\lxflllr.exec:\lxflllr.exe34⤵PID:2376
-
\??\c:\9hhnnt.exec:\9hhnnt.exe35⤵
- Executes dropped EXE
PID:1604 -
\??\c:\hbbbnh.exec:\hbbbnh.exe36⤵
- Executes dropped EXE
PID:1664 -
\??\c:\ddpvd.exec:\ddpvd.exe37⤵
- Executes dropped EXE
PID:2372 -
\??\c:\rllrxll.exec:\rllrxll.exe38⤵
- Executes dropped EXE
PID:1708 -
\??\c:\fxxfrrx.exec:\fxxfrrx.exe39⤵
- Executes dropped EXE
PID:2580 -
\??\c:\ntttnh.exec:\ntttnh.exe40⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tnhhtb.exec:\tnhhtb.exe41⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vpvdj.exec:\vpvdj.exe42⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rxfflfx.exec:\rxfflfx.exe43⤵
- Executes dropped EXE
PID:2508 -
\??\c:\lrfrlfx.exec:\lrfrlfx.exe44⤵
- Executes dropped EXE
PID:2456 -
\??\c:\nhhbtb.exec:\nhhbtb.exe45⤵
- Executes dropped EXE
PID:2468 -
\??\c:\5bnthn.exec:\5bnthn.exe46⤵
- Executes dropped EXE
PID:2124 -
\??\c:\ddvdp.exec:\ddvdp.exe47⤵
- Executes dropped EXE
PID:3004 -
\??\c:\jvjjp.exec:\jvjjp.exe48⤵
- Executes dropped EXE
PID:2980 -
\??\c:\1jpdv.exec:\1jpdv.exe49⤵
- Executes dropped EXE
PID:1640 -
\??\c:\1fxxlxr.exec:\1fxxlxr.exe50⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rrxlfrf.exec:\rrxlfrf.exe51⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bbthbh.exec:\bbthbh.exe52⤵
- Executes dropped EXE
PID:1548 -
\??\c:\tttthh.exec:\tttthh.exe53⤵
- Executes dropped EXE
PID:1532 -
\??\c:\jdvjd.exec:\jdvjd.exe54⤵
- Executes dropped EXE
PID:2840 -
\??\c:\jjvjd.exec:\jjvjd.exe55⤵
- Executes dropped EXE
PID:1296 -
\??\c:\rrxrfrl.exec:\rrxrfrl.exe56⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rlfrllf.exec:\rlfrllf.exe57⤵
- Executes dropped EXE
PID:1304 -
\??\c:\fxlrflf.exec:\fxlrflf.exe58⤵
- Executes dropped EXE
PID:2000 -
\??\c:\bnhhnn.exec:\bnhhnn.exe59⤵
- Executes dropped EXE
PID:2816 -
\??\c:\hnnbnt.exec:\hnnbnt.exe60⤵
- Executes dropped EXE
PID:2276 -
\??\c:\jdvjv.exec:\jdvjv.exe61⤵
- Executes dropped EXE
PID:2432 -
\??\c:\lfrxrfr.exec:\lfrxrfr.exe62⤵
- Executes dropped EXE
PID:984 -
\??\c:\lxrrllf.exec:\lxrrllf.exe63⤵
- Executes dropped EXE
PID:1480 -
\??\c:\hbtnbt.exec:\hbtnbt.exe64⤵
- Executes dropped EXE
PID:2640 -
\??\c:\bhhthh.exec:\bhhthh.exe65⤵
- Executes dropped EXE
PID:1864 -
\??\c:\vvdjv.exec:\vvdjv.exe66⤵
- Executes dropped EXE
PID:1972 -
\??\c:\jjjvv.exec:\jjjvv.exe67⤵PID:2856
-
\??\c:\ppjpv.exec:\ppjpv.exe68⤵PID:1252
-
\??\c:\llxfrrf.exec:\llxfrrf.exe69⤵PID:1748
-
\??\c:\fffxflr.exec:\fffxflr.exe70⤵PID:2388
-
\??\c:\hbhhth.exec:\hbhhth.exe71⤵PID:572
-
\??\c:\9nhthh.exec:\9nhthh.exe72⤵PID:2108
-
\??\c:\vvddp.exec:\vvddp.exe73⤵PID:2184
-
\??\c:\jdpvp.exec:\jdpvp.exe74⤵PID:1512
-
\??\c:\fxlrflf.exec:\fxlrflf.exe75⤵PID:2204
-
\??\c:\lrlxrxl.exec:\lrlxrxl.exe76⤵PID:2376
-
\??\c:\lllflxf.exec:\lllflxf.exe77⤵PID:2852
-
\??\c:\bbtthn.exec:\bbtthn.exe78⤵PID:2196
-
\??\c:\nnbnbh.exec:\nnbnbh.exe79⤵PID:2372
-
\??\c:\pjpdd.exec:\pjpdd.exe80⤵PID:2056
-
\??\c:\xrlxlxf.exec:\xrlxlxf.exe81⤵PID:2580
-
\??\c:\rrlrffx.exec:\rrlrffx.exe82⤵PID:2060
-
\??\c:\rrfllrf.exec:\rrfllrf.exe83⤵PID:2860
-
\??\c:\7ttnbh.exec:\7ttnbh.exe84⤵PID:320
-
\??\c:\hnhhnt.exec:\hnhhnt.exe85⤵PID:2508
-
\??\c:\pjvvd.exec:\pjvvd.exe86⤵PID:2516
-
\??\c:\3jvdp.exec:\3jvdp.exe87⤵PID:2268
-
\??\c:\lrfrlxr.exec:\lrfrlxr.exe88⤵PID:2364
-
\??\c:\fxxfxrf.exec:\fxxfxrf.exe89⤵PID:2960
-
\??\c:\hbbbtt.exec:\hbbbtt.exe90⤵PID:2988
-
\??\c:\vvjpp.exec:\vvjpp.exe91⤵PID:1824
-
\??\c:\9jvdp.exec:\9jvdp.exe92⤵PID:1624
-
\??\c:\xxlxlrf.exec:\xxlxlrf.exe93⤵PID:2412
-
\??\c:\7flrllf.exec:\7flrllf.exe94⤵PID:1592
-
\??\c:\bhnnbt.exec:\bhnnbt.exe95⤵PID:1532
-
\??\c:\dvjvv.exec:\dvjvv.exe96⤵PID:2832
-
\??\c:\vpjjp.exec:\vpjjp.exe97⤵PID:1296
-
\??\c:\9dvdj.exec:\9dvdj.exe98⤵PID:2992
-
\??\c:\llflllx.exec:\llflllx.exe99⤵PID:1272
-
\??\c:\xxfllxl.exec:\xxfllxl.exe100⤵PID:1924
-
\??\c:\bthnbb.exec:\bthnbb.exe101⤵PID:2044
-
\??\c:\jjppv.exec:\jjppv.exe102⤵PID:1996
-
\??\c:\pvdpp.exec:\pvdpp.exe103⤵PID:780
-
\??\c:\3rfllrl.exec:\3rfllrl.exe104⤵PID:588
-
\??\c:\5fxfxfr.exec:\5fxfxfr.exe105⤵PID:1480
-
\??\c:\5bhbnb.exec:\5bhbnb.exe106⤵PID:1484
-
\??\c:\5httbh.exec:\5httbh.exe107⤵PID:1864
-
\??\c:\jdjjp.exec:\jdjjp.exe108⤵PID:2420
-
\??\c:\3pvdp.exec:\3pvdp.exe109⤵PID:1324
-
\??\c:\5lflrrf.exec:\5lflrrf.exe110⤵PID:908
-
\??\c:\7fxfrxf.exec:\7fxfrxf.exe111⤵PID:2344
-
\??\c:\hhnhnb.exec:\hhnhnb.exe112⤵PID:688
-
\??\c:\3bnntt.exec:\3bnntt.exe113⤵PID:572
-
\??\c:\vjpjp.exec:\vjpjp.exe114⤵PID:880
-
\??\c:\pdvdj.exec:\pdvdj.exe115⤵PID:2184
-
\??\c:\1xlrffx.exec:\1xlrffx.exe116⤵PID:1508
-
\??\c:\3rxfrxr.exec:\3rxfrxr.exe117⤵PID:1600
-
\??\c:\7htbhh.exec:\7htbhh.exe118⤵PID:2136
-
\??\c:\tnnntt.exec:\tnnntt.exe119⤵PID:2852
-
\??\c:\vpppd.exec:\vpppd.exe120⤵PID:1664
-
\??\c:\vjvvj.exec:\vjvvj.exe121⤵PID:2372
-
\??\c:\1frflfr.exec:\1frflfr.exe122⤵PID:1708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-