Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 02:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9896cd1b796bafac8faaa7a66aef4a70_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
9896cd1b796bafac8faaa7a66aef4a70_NeikiAnalytics.exe
-
Size
92KB
-
MD5
9896cd1b796bafac8faaa7a66aef4a70
-
SHA1
7dc75f7e4a7168ce99a0f13435ad9a1eb065523c
-
SHA256
02e6da3b50bad1d34e88cfebd404318e698e3868a0da6b37502cd52489857f72
-
SHA512
0f518e2271bfa2d52c9cae295cdeb9ac91f4989f609991ffa7bca1ff988ce777cd3e22a1f557421bc73fba20181f64d78e038a3a567f597a1890f7b0fdcf85d8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/21+:ymb3NkkiQ3mdBjFo73PYP1lri3K8GN4f
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1740-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/864-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/816-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/904-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/684-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2864 frfrrxx.exe 2492 rrfflxl.exe 2612 dvjjp.exe 2480 vpvdj.exe 2664 fxllxlr.exe 2412 rlxfxxx.exe 2436 pdpjp.exe 2000 1ppjv.exe 1376 rrxxllx.exe 2588 fxlrfrf.exe 2256 tnbtbh.exe 888 hnnbtb.exe 1824 dvjpd.exe 2296 llrlrfr.exe 1648 rfxxrrl.exe 1596 hntbhb.exe 864 hhbthn.exe 2008 5nhntb.exe 1252 vvvjv.exe 2744 llffxff.exe 2208 9hbnbb.exe 816 btntht.exe 936 vvjpj.exe 1744 ddjjj.exe 1468 xrlrxlx.exe 1836 5frrlfl.exe 904 tbttbh.exe 684 ntbtth.exe 2032 lxrrxxf.exe 2264 tbhttn.exe 1432 nbthbn.exe 2016 ddjvj.exe 2212 xxrrffr.exe 2456 lrxxffl.exe 2704 nhbtht.exe 2504 hthntb.exe 2516 dvddj.exe 2616 jdppj.exe 2716 xflfxff.exe 2400 9rlllrr.exe 2628 httttt.exe 2412 ttntbt.exe 2880 pjvjv.exe 2832 pjjdj.exe 2000 1fxrxfl.exe 1380 7rxrffr.exe 2544 nhhhhn.exe 2684 bhbnnb.exe 1816 ppjpj.exe 1628 vjddd.exe 1684 9xlllff.exe 2084 7bbbhn.exe 1516 tnttbh.exe 1184 ppdvj.exe 1344 1dvdp.exe 2024 xxfrxll.exe 1884 xrflxxf.exe 2740 bhtbhh.exe 2732 bbtbnh.exe 812 ppvpp.exe 1404 jjdpj.exe 816 lflflxf.exe 1564 lfllrxl.exe 2792 vvpvj.exe -
resource yara_rule behavioral1/memory/1740-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/864-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/816-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/904-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/684-272-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2864 1740 9896cd1b796bafac8faaa7a66aef4a70_NeikiAnalytics.exe 28 PID 1740 wrote to memory of 2864 1740 9896cd1b796bafac8faaa7a66aef4a70_NeikiAnalytics.exe 28 PID 1740 wrote to memory of 2864 1740 9896cd1b796bafac8faaa7a66aef4a70_NeikiAnalytics.exe 28 PID 1740 wrote to memory of 2864 1740 9896cd1b796bafac8faaa7a66aef4a70_NeikiAnalytics.exe 28 PID 2864 wrote to memory of 2492 2864 frfrrxx.exe 29 PID 2864 wrote to memory of 2492 2864 frfrrxx.exe 29 PID 2864 wrote to memory of 2492 2864 frfrrxx.exe 29 PID 2864 wrote to memory of 2492 2864 frfrrxx.exe 29 PID 2492 wrote to memory of 2612 2492 rrfflxl.exe 30 PID 2492 wrote to memory of 2612 2492 rrfflxl.exe 30 PID 2492 wrote to memory of 2612 2492 rrfflxl.exe 30 PID 2492 wrote to memory of 2612 2492 rrfflxl.exe 30 PID 2612 wrote to memory of 2480 2612 dvjjp.exe 31 PID 2612 wrote to memory of 2480 2612 dvjjp.exe 31 PID 2612 wrote to memory of 2480 2612 dvjjp.exe 31 PID 2612 wrote to memory of 2480 2612 dvjjp.exe 31 PID 2480 wrote to memory of 2664 2480 vpvdj.exe 32 PID 2480 wrote to memory of 2664 2480 vpvdj.exe 32 PID 2480 wrote to memory of 2664 2480 vpvdj.exe 32 PID 2480 wrote to memory of 2664 2480 vpvdj.exe 32 PID 2664 wrote to memory of 2412 2664 fxllxlr.exe 33 PID 2664 wrote to memory of 2412 2664 fxllxlr.exe 33 PID 2664 wrote to memory of 2412 2664 fxllxlr.exe 33 PID 2664 wrote to memory of 2412 2664 fxllxlr.exe 33 PID 2412 wrote to memory of 2436 2412 rlxfxxx.exe 34 PID 2412 wrote to memory of 2436 2412 rlxfxxx.exe 34 PID 2412 wrote to memory of 2436 2412 rlxfxxx.exe 34 PID 2412 wrote to memory of 2436 2412 rlxfxxx.exe 34 PID 2436 wrote to memory of 2000 2436 pdpjp.exe 35 PID 2436 wrote to memory of 2000 2436 pdpjp.exe 35 PID 2436 wrote to memory of 2000 2436 pdpjp.exe 35 PID 2436 wrote to memory of 2000 2436 pdpjp.exe 35 PID 2000 wrote to memory of 1376 2000 1ppjv.exe 36 PID 2000 wrote to memory of 1376 2000 1ppjv.exe 36 PID 2000 wrote to memory of 1376 2000 1ppjv.exe 36 PID 2000 wrote to memory of 1376 2000 1ppjv.exe 36 PID 1376 wrote to memory of 2588 1376 rrxxllx.exe 37 PID 1376 wrote to memory of 2588 1376 rrxxllx.exe 37 PID 1376 wrote to memory of 2588 1376 rrxxllx.exe 37 PID 1376 wrote to memory of 2588 1376 rrxxllx.exe 37 PID 2588 wrote to memory of 2256 2588 fxlrfrf.exe 38 PID 2588 wrote to memory of 2256 2588 fxlrfrf.exe 38 PID 2588 wrote to memory of 2256 2588 fxlrfrf.exe 38 PID 2588 wrote to memory of 2256 2588 fxlrfrf.exe 38 PID 2256 wrote to memory of 888 2256 tnbtbh.exe 39 PID 2256 wrote to memory of 888 2256 tnbtbh.exe 39 PID 2256 wrote to memory of 888 2256 tnbtbh.exe 39 PID 2256 wrote to memory of 888 2256 tnbtbh.exe 39 PID 888 wrote to memory of 1824 888 hnnbtb.exe 40 PID 888 wrote to memory of 1824 888 hnnbtb.exe 40 PID 888 wrote to memory of 1824 888 hnnbtb.exe 40 PID 888 wrote to memory of 1824 888 hnnbtb.exe 40 PID 1824 wrote to memory of 2296 1824 dvjpd.exe 41 PID 1824 wrote to memory of 2296 1824 dvjpd.exe 41 PID 1824 wrote to memory of 2296 1824 dvjpd.exe 41 PID 1824 wrote to memory of 2296 1824 dvjpd.exe 41 PID 2296 wrote to memory of 1648 2296 llrlrfr.exe 42 PID 2296 wrote to memory of 1648 2296 llrlrfr.exe 42 PID 2296 wrote to memory of 1648 2296 llrlrfr.exe 42 PID 2296 wrote to memory of 1648 2296 llrlrfr.exe 42 PID 1648 wrote to memory of 1596 1648 rfxxrrl.exe 43 PID 1648 wrote to memory of 1596 1648 rfxxrrl.exe 43 PID 1648 wrote to memory of 1596 1648 rfxxrrl.exe 43 PID 1648 wrote to memory of 1596 1648 rfxxrrl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\9896cd1b796bafac8faaa7a66aef4a70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9896cd1b796bafac8faaa7a66aef4a70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\frfrrxx.exec:\frfrrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\rrfflxl.exec:\rrfflxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\dvjjp.exec:\dvjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\vpvdj.exec:\vpvdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\fxllxlr.exec:\fxllxlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\rlxfxxx.exec:\rlxfxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\pdpjp.exec:\pdpjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\1ppjv.exec:\1ppjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\rrxxllx.exec:\rrxxllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\fxlrfrf.exec:\fxlrfrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\tnbtbh.exec:\tnbtbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\hnnbtb.exec:\hnnbtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\dvjpd.exec:\dvjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\llrlrfr.exec:\llrlrfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\rfxxrrl.exec:\rfxxrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\hntbhb.exec:\hntbhb.exe17⤵
- Executes dropped EXE
PID:1596 -
\??\c:\hhbthn.exec:\hhbthn.exe18⤵
- Executes dropped EXE
PID:864 -
\??\c:\5nhntb.exec:\5nhntb.exe19⤵
- Executes dropped EXE
PID:2008 -
\??\c:\vvvjv.exec:\vvvjv.exe20⤵
- Executes dropped EXE
PID:1252 -
\??\c:\llffxff.exec:\llffxff.exe21⤵
- Executes dropped EXE
PID:2744 -
\??\c:\9hbnbb.exec:\9hbnbb.exe22⤵
- Executes dropped EXE
PID:2208 -
\??\c:\btntht.exec:\btntht.exe23⤵
- Executes dropped EXE
PID:816 -
\??\c:\vvjpj.exec:\vvjpj.exe24⤵
- Executes dropped EXE
PID:936 -
\??\c:\ddjjj.exec:\ddjjj.exe25⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xrlrxlx.exec:\xrlrxlx.exe26⤵
- Executes dropped EXE
PID:1468 -
\??\c:\5frrlfl.exec:\5frrlfl.exe27⤵
- Executes dropped EXE
PID:1836 -
\??\c:\tbttbh.exec:\tbttbh.exe28⤵
- Executes dropped EXE
PID:904 -
\??\c:\ntbtth.exec:\ntbtth.exe29⤵
- Executes dropped EXE
PID:684 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe30⤵
- Executes dropped EXE
PID:2032 -
\??\c:\tbhttn.exec:\tbhttn.exe31⤵
- Executes dropped EXE
PID:2264 -
\??\c:\nbthbn.exec:\nbthbn.exe32⤵
- Executes dropped EXE
PID:1432 -
\??\c:\ddjvj.exec:\ddjvj.exe33⤵
- Executes dropped EXE
PID:2016 -
\??\c:\xxrrffr.exec:\xxrrffr.exe34⤵
- Executes dropped EXE
PID:2212 -
\??\c:\lrxxffl.exec:\lrxxffl.exe35⤵
- Executes dropped EXE
PID:2456 -
\??\c:\nhbtht.exec:\nhbtht.exe36⤵
- Executes dropped EXE
PID:2704 -
\??\c:\hthntb.exec:\hthntb.exe37⤵
- Executes dropped EXE
PID:2504 -
\??\c:\dvddj.exec:\dvddj.exe38⤵
- Executes dropped EXE
PID:2516 -
\??\c:\jdppj.exec:\jdppj.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xflfxff.exec:\xflfxff.exe40⤵
- Executes dropped EXE
PID:2716 -
\??\c:\9rlllrr.exec:\9rlllrr.exe41⤵
- Executes dropped EXE
PID:2400 -
\??\c:\httttt.exec:\httttt.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\ttntbt.exec:\ttntbt.exe43⤵
- Executes dropped EXE
PID:2412 -
\??\c:\pjvjv.exec:\pjvjv.exe44⤵
- Executes dropped EXE
PID:2880 -
\??\c:\pjjdj.exec:\pjjdj.exe45⤵
- Executes dropped EXE
PID:2832 -
\??\c:\1fxrxfl.exec:\1fxrxfl.exe46⤵
- Executes dropped EXE
PID:2000 -
\??\c:\7rxrffr.exec:\7rxrffr.exe47⤵
- Executes dropped EXE
PID:1380 -
\??\c:\nhhhhn.exec:\nhhhhn.exe48⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bhbnnb.exec:\bhbnnb.exe49⤵
- Executes dropped EXE
PID:2684 -
\??\c:\ppjpj.exec:\ppjpj.exe50⤵
- Executes dropped EXE
PID:1816 -
\??\c:\vjddd.exec:\vjddd.exe51⤵
- Executes dropped EXE
PID:1628 -
\??\c:\9xlllff.exec:\9xlllff.exe52⤵
- Executes dropped EXE
PID:1684 -
\??\c:\7bbbhn.exec:\7bbbhn.exe53⤵
- Executes dropped EXE
PID:2084 -
\??\c:\tnttbh.exec:\tnttbh.exe54⤵
- Executes dropped EXE
PID:1516 -
\??\c:\ppdvj.exec:\ppdvj.exe55⤵
- Executes dropped EXE
PID:1184 -
\??\c:\1dvdp.exec:\1dvdp.exe56⤵
- Executes dropped EXE
PID:1344 -
\??\c:\xxfrxll.exec:\xxfrxll.exe57⤵
- Executes dropped EXE
PID:2024 -
\??\c:\xrflxxf.exec:\xrflxxf.exe58⤵
- Executes dropped EXE
PID:1884 -
\??\c:\bhtbhh.exec:\bhtbhh.exe59⤵
- Executes dropped EXE
PID:2740 -
\??\c:\bbtbnh.exec:\bbtbnh.exe60⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ppvpp.exec:\ppvpp.exe61⤵
- Executes dropped EXE
PID:812 -
\??\c:\jjdpj.exec:\jjdpj.exe62⤵
- Executes dropped EXE
PID:1404 -
\??\c:\lflflxf.exec:\lflflxf.exe63⤵
- Executes dropped EXE
PID:816 -
\??\c:\lfllrxl.exec:\lfllrxl.exe64⤵
- Executes dropped EXE
PID:1564 -
\??\c:\vvpvj.exec:\vvpvj.exe65⤵
- Executes dropped EXE
PID:2792 -
\??\c:\5vppv.exec:\5vppv.exe66⤵PID:2280
-
\??\c:\lxlxlrf.exec:\lxlxlrf.exe67⤵PID:2952
-
\??\c:\5lxffxf.exec:\5lxffxf.exe68⤵PID:3056
-
\??\c:\nhbnhn.exec:\nhbnhn.exe69⤵PID:2944
-
\??\c:\pdppv.exec:\pdppv.exe70⤵PID:572
-
\??\c:\1pdjv.exec:\1pdjv.exe71⤵PID:2300
-
\??\c:\rfrrrlx.exec:\rfrrrlx.exe72⤵PID:576
-
\??\c:\5lxxfxr.exec:\5lxxfxr.exe73⤵PID:892
-
\??\c:\nnbbnb.exec:\nnbbnb.exe74⤵PID:1432
-
\??\c:\hhthtb.exec:\hhthtb.exe75⤵PID:1908
-
\??\c:\9djpd.exec:\9djpd.exe76⤵PID:2864
-
\??\c:\dvdpj.exec:\dvdpj.exe77⤵PID:1524
-
\??\c:\lfrlrrf.exec:\lfrlrrf.exe78⤵PID:2572
-
\??\c:\3xffrxl.exec:\3xffrxl.exe79⤵PID:2564
-
\??\c:\5nnnhn.exec:\5nnnhn.exe80⤵PID:2920
-
\??\c:\tthbnt.exec:\tthbnt.exe81⤵PID:2060
-
\??\c:\9bbbnt.exec:\9bbbnt.exe82⤵PID:2480
-
\??\c:\3vppv.exec:\3vppv.exe83⤵PID:2664
-
\??\c:\pjdpd.exec:\pjdpd.exe84⤵PID:2428
-
\??\c:\rlflfxl.exec:\rlflfxl.exe85⤵PID:2628
-
\??\c:\rrfxffr.exec:\rrfxffr.exe86⤵PID:1552
-
\??\c:\tnbhtt.exec:\tnbhtt.exe87⤵PID:2408
-
\??\c:\1tbhnb.exec:\1tbhnb.exe88⤵PID:2424
-
\??\c:\ppjvd.exec:\ppjvd.exe89⤵PID:2676
-
\??\c:\5jdvp.exec:\5jdvp.exe90⤵PID:1840
-
\??\c:\dvjjp.exec:\dvjjp.exe91⤵PID:2256
-
\??\c:\fxlflxr.exec:\fxlflxr.exe92⤵PID:1832
-
\??\c:\1rllrxr.exec:\1rllrxr.exe93⤵PID:1556
-
\??\c:\5nttbh.exec:\5nttbh.exe94⤵PID:1828
-
\??\c:\5pvjv.exec:\5pvjv.exe95⤵PID:300
-
\??\c:\vpddj.exec:\vpddj.exe96⤵PID:2116
-
\??\c:\jvppv.exec:\jvppv.exe97⤵PID:2288
-
\??\c:\lfllrrx.exec:\lfllrrx.exe98⤵PID:2184
-
\??\c:\hbhtbb.exec:\hbhtbb.exe99⤵PID:1652
-
\??\c:\nhnnhh.exec:\nhnnhh.exe100⤵PID:2020
-
\??\c:\hbbtnn.exec:\hbbtnn.exe101⤵PID:2452
-
\??\c:\vpjvd.exec:\vpjvd.exe102⤵PID:540
-
\??\c:\9pjdp.exec:\9pjdp.exe103⤵PID:2696
-
\??\c:\xlxxxfr.exec:\xlxxxfr.exe104⤵PID:672
-
\??\c:\lxfxfxx.exec:\lxfxfxx.exe105⤵PID:608
-
\??\c:\hbbbnt.exec:\hbbbnt.exe106⤵PID:816
-
\??\c:\thbbtt.exec:\thbbtt.exe107⤵PID:1076
-
\??\c:\djdjd.exec:\djdjd.exe108⤵PID:960
-
\??\c:\vjpjv.exec:\vjpjv.exe109⤵PID:320
-
\??\c:\flffrlx.exec:\flffrlx.exe110⤵PID:1048
-
\??\c:\3xflxfr.exec:\3xflxfr.exe111⤵PID:752
-
\??\c:\nhhtbb.exec:\nhhtbb.exe112⤵PID:2192
-
\??\c:\tnttbb.exec:\tnttbb.exe113⤵PID:872
-
\??\c:\3jvvd.exec:\3jvvd.exe114⤵PID:2752
-
\??\c:\ddjpd.exec:\ddjpd.exe115⤵PID:2140
-
\??\c:\fxrxllx.exec:\fxrxllx.exe116⤵PID:1996
-
\??\c:\lfflxfr.exec:\lfflxfr.exe117⤵PID:2268
-
\??\c:\ntbbhn.exec:\ntbbhn.exe118⤵PID:1908
-
\??\c:\tbttht.exec:\tbttht.exe119⤵PID:1528
-
\??\c:\dvpvd.exec:\dvpvd.exe120⤵PID:1524
-
\??\c:\fxxfxxx.exec:\fxxfxxx.exe121⤵PID:2492
-
\??\c:\lllrflx.exec:\lllrflx.exe122⤵PID:2636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-