Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 11:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a145b1276f3541b939527b9302ad4a80_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
a145b1276f3541b939527b9302ad4a80_NeikiAnalytics.exe
-
Size
55KB
-
MD5
a145b1276f3541b939527b9302ad4a80
-
SHA1
52caae4b4f57b0f3b934d556e3456e4720847c61
-
SHA256
23b91e7ecf1ab852ec8e7daa9f295d5fb74ab963a95d92a6987b0e5e967b0823
-
SHA512
f90fd737eaf869124aeffa007bbe6c6229b090f1f4cd554281998a3ab33cb35029acf01080a1fcd9990cf9ec1c863aca85f6e42a60a88f4c8f2fd252efb931d9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFyPYt:ymb3NkkiQ3mdBjFIFZt
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/1196-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-64-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1000-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1564-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/532-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1168-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1512-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1420-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2076-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1364-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1196 ffllrlx.exe 2688 bhtbnn.exe 2728 xxlrffl.exe 3032 tnhbnb.exe 2616 tnnntn.exe 2684 dvjpp.exe 2612 9xllrxf.exe 2564 1rfllxl.exe 1716 1nnhnt.exe 1912 dvjdj.exe 2812 9lffrxl.exe 1000 7flrlxr.exe 1564 3hbtbb.exe 1948 nbnhbb.exe 1860 jpvvv.exe 532 lflllrr.exe 1168 bbbbbn.exe 1512 nhntnt.exe 1480 jdpvd.exe 1420 lxlrrxf.exe 2292 7rxxrrx.exe 2284 hbhthh.exe 2256 dvdpd.exe 2076 vjjjv.exe 1856 rrflxxx.exe 2400 xrlxfxx.exe 1060 ttnthh.exe 908 pjdvj.exe 1364 vvpdp.exe 1628 1rlfllr.exe 2320 btnbht.exe 1984 nbhbbb.exe 2080 jjdvp.exe 1584 fxrxffl.exe 1756 xxrrxrx.exe 1196 htbbnn.exe 2716 thtbhn.exe 2656 jddpj.exe 2624 jdpvj.exe 2536 lxfrllf.exe 2524 fxffrrx.exe 2752 nbthtt.exe 2504 7thnbh.exe 2228 5pjjp.exe 2344 vpjpd.exe 1644 xrlrxfl.exe 2960 7tnttt.exe 1912 nhbbhn.exe 2932 jjjjp.exe 2948 jjjpd.exe 1748 rlfxffr.exe 1072 ttnhtn.exe 1944 httnnt.exe 1936 9pvpj.exe 348 dvddj.exe 316 9lflrxx.exe 352 9lffllr.exe 1660 bnttbh.exe 632 dvjpv.exe 2304 7ppvj.exe 2384 xfrffrl.exe 1972 xxllrxf.exe 2880 tbnhbh.exe 592 5vdjv.exe -
resource yara_rule behavioral1/memory/1264-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1196-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1264-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1912-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1000-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1564-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/532-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1168-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1512-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1420-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2076-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1364-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1264 wrote to memory of 1196 1264 a145b1276f3541b939527b9302ad4a80_NeikiAnalytics.exe 28 PID 1264 wrote to memory of 1196 1264 a145b1276f3541b939527b9302ad4a80_NeikiAnalytics.exe 28 PID 1264 wrote to memory of 1196 1264 a145b1276f3541b939527b9302ad4a80_NeikiAnalytics.exe 28 PID 1264 wrote to memory of 1196 1264 a145b1276f3541b939527b9302ad4a80_NeikiAnalytics.exe 28 PID 1196 wrote to memory of 2688 1196 ffllrlx.exe 29 PID 1196 wrote to memory of 2688 1196 ffllrlx.exe 29 PID 1196 wrote to memory of 2688 1196 ffllrlx.exe 29 PID 1196 wrote to memory of 2688 1196 ffllrlx.exe 29 PID 2688 wrote to memory of 2728 2688 bhtbnn.exe 30 PID 2688 wrote to memory of 2728 2688 bhtbnn.exe 30 PID 2688 wrote to memory of 2728 2688 bhtbnn.exe 30 PID 2688 wrote to memory of 2728 2688 bhtbnn.exe 30 PID 2728 wrote to memory of 3032 2728 xxlrffl.exe 31 PID 2728 wrote to memory of 3032 2728 xxlrffl.exe 31 PID 2728 wrote to memory of 3032 2728 xxlrffl.exe 31 PID 2728 wrote to memory of 3032 2728 xxlrffl.exe 31 PID 3032 wrote to memory of 2616 3032 tnhbnb.exe 32 PID 3032 wrote to memory of 2616 3032 tnhbnb.exe 32 PID 3032 wrote to memory of 2616 3032 tnhbnb.exe 32 PID 3032 wrote to memory of 2616 3032 tnhbnb.exe 32 PID 2616 wrote to memory of 2684 2616 tnnntn.exe 33 PID 2616 wrote to memory of 2684 2616 tnnntn.exe 33 PID 2616 wrote to memory of 2684 2616 tnnntn.exe 33 PID 2616 wrote to memory of 2684 2616 tnnntn.exe 33 PID 2684 wrote to memory of 2612 2684 dvjpp.exe 34 PID 2684 wrote to memory of 2612 2684 dvjpp.exe 34 PID 2684 wrote to memory of 2612 2684 dvjpp.exe 34 PID 2684 wrote to memory of 2612 2684 dvjpp.exe 34 PID 2612 wrote to memory of 2564 2612 9xllrxf.exe 35 PID 2612 wrote to memory of 2564 2612 9xllrxf.exe 35 PID 2612 wrote to memory of 2564 2612 9xllrxf.exe 35 PID 2612 wrote to memory of 2564 2612 9xllrxf.exe 35 PID 2564 wrote to memory of 1716 2564 1rfllxl.exe 36 PID 2564 wrote to memory of 1716 2564 1rfllxl.exe 36 PID 2564 wrote to memory of 1716 2564 1rfllxl.exe 36 PID 2564 wrote to memory of 1716 2564 1rfllxl.exe 36 PID 1716 wrote to memory of 1912 1716 1nnhnt.exe 37 PID 1716 wrote to memory of 1912 1716 1nnhnt.exe 37 PID 1716 wrote to memory of 1912 1716 1nnhnt.exe 37 PID 1716 wrote to memory of 1912 1716 1nnhnt.exe 37 PID 1912 wrote to memory of 2812 1912 dvjdj.exe 38 PID 1912 wrote to memory of 2812 1912 dvjdj.exe 38 PID 1912 wrote to memory of 2812 1912 dvjdj.exe 38 PID 1912 wrote to memory of 2812 1912 dvjdj.exe 38 PID 2812 wrote to memory of 1000 2812 9lffrxl.exe 39 PID 2812 wrote to memory of 1000 2812 9lffrxl.exe 39 PID 2812 wrote to memory of 1000 2812 9lffrxl.exe 39 PID 2812 wrote to memory of 1000 2812 9lffrxl.exe 39 PID 1000 wrote to memory of 1564 1000 7flrlxr.exe 40 PID 1000 wrote to memory of 1564 1000 7flrlxr.exe 40 PID 1000 wrote to memory of 1564 1000 7flrlxr.exe 40 PID 1000 wrote to memory of 1564 1000 7flrlxr.exe 40 PID 1564 wrote to memory of 1948 1564 3hbtbb.exe 41 PID 1564 wrote to memory of 1948 1564 3hbtbb.exe 41 PID 1564 wrote to memory of 1948 1564 3hbtbb.exe 41 PID 1564 wrote to memory of 1948 1564 3hbtbb.exe 41 PID 1948 wrote to memory of 1860 1948 nbnhbb.exe 42 PID 1948 wrote to memory of 1860 1948 nbnhbb.exe 42 PID 1948 wrote to memory of 1860 1948 nbnhbb.exe 42 PID 1948 wrote to memory of 1860 1948 nbnhbb.exe 42 PID 1860 wrote to memory of 532 1860 jpvvv.exe 43 PID 1860 wrote to memory of 532 1860 jpvvv.exe 43 PID 1860 wrote to memory of 532 1860 jpvvv.exe 43 PID 1860 wrote to memory of 532 1860 jpvvv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\a145b1276f3541b939527b9302ad4a80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a145b1276f3541b939527b9302ad4a80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\ffllrlx.exec:\ffllrlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\bhtbnn.exec:\bhtbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\xxlrffl.exec:\xxlrffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\tnhbnb.exec:\tnhbnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\tnnntn.exec:\tnnntn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\dvjpp.exec:\dvjpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\9xllrxf.exec:\9xllrxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\1rfllxl.exec:\1rfllxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\1nnhnt.exec:\1nnhnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\dvjdj.exec:\dvjdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\9lffrxl.exec:\9lffrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\7flrlxr.exec:\7flrlxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\3hbtbb.exec:\3hbtbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\nbnhbb.exec:\nbnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\jpvvv.exec:\jpvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\lflllrr.exec:\lflllrr.exe17⤵
- Executes dropped EXE
PID:532 -
\??\c:\bbbbbn.exec:\bbbbbn.exe18⤵
- Executes dropped EXE
PID:1168 -
\??\c:\nhntnt.exec:\nhntnt.exe19⤵
- Executes dropped EXE
PID:1512 -
\??\c:\jdpvd.exec:\jdpvd.exe20⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lxlrrxf.exec:\lxlrrxf.exe21⤵
- Executes dropped EXE
PID:1420 -
\??\c:\7rxxrrx.exec:\7rxxrrx.exe22⤵
- Executes dropped EXE
PID:2292 -
\??\c:\hbhthh.exec:\hbhthh.exe23⤵
- Executes dropped EXE
PID:2284 -
\??\c:\dvdpd.exec:\dvdpd.exe24⤵
- Executes dropped EXE
PID:2256 -
\??\c:\vjjjv.exec:\vjjjv.exe25⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rrflxxx.exec:\rrflxxx.exe26⤵
- Executes dropped EXE
PID:1856 -
\??\c:\xrlxfxx.exec:\xrlxfxx.exe27⤵
- Executes dropped EXE
PID:2400 -
\??\c:\ttnthh.exec:\ttnthh.exe28⤵
- Executes dropped EXE
PID:1060 -
\??\c:\pjdvj.exec:\pjdvj.exe29⤵
- Executes dropped EXE
PID:908 -
\??\c:\vvpdp.exec:\vvpdp.exe30⤵
- Executes dropped EXE
PID:1364 -
\??\c:\1rlfllr.exec:\1rlfllr.exe31⤵
- Executes dropped EXE
PID:1628 -
\??\c:\btnbht.exec:\btnbht.exe32⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nbhbbb.exec:\nbhbbb.exe33⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jjdvp.exec:\jjdvp.exe34⤵
- Executes dropped EXE
PID:2080 -
\??\c:\fxrxffl.exec:\fxrxffl.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\xxrrxrx.exec:\xxrrxrx.exe36⤵
- Executes dropped EXE
PID:1756 -
\??\c:\htbbnn.exec:\htbbnn.exe37⤵
- Executes dropped EXE
PID:1196 -
\??\c:\thtbhn.exec:\thtbhn.exe38⤵
- Executes dropped EXE
PID:2716 -
\??\c:\jddpj.exec:\jddpj.exe39⤵
- Executes dropped EXE
PID:2656 -
\??\c:\jdpvj.exec:\jdpvj.exe40⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lxfrllf.exec:\lxfrllf.exe41⤵
- Executes dropped EXE
PID:2536 -
\??\c:\fxffrrx.exec:\fxffrrx.exe42⤵
- Executes dropped EXE
PID:2524 -
\??\c:\nbthtt.exec:\nbthtt.exe43⤵
- Executes dropped EXE
PID:2752 -
\??\c:\7thnbh.exec:\7thnbh.exe44⤵
- Executes dropped EXE
PID:2504 -
\??\c:\5pjjp.exec:\5pjjp.exe45⤵
- Executes dropped EXE
PID:2228 -
\??\c:\vpjpd.exec:\vpjpd.exe46⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe47⤵
- Executes dropped EXE
PID:1644 -
\??\c:\7tnttt.exec:\7tnttt.exe48⤵
- Executes dropped EXE
PID:2960 -
\??\c:\nhbbhn.exec:\nhbbhn.exe49⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jjjjp.exec:\jjjjp.exe50⤵
- Executes dropped EXE
PID:2932 -
\??\c:\jjjpd.exec:\jjjpd.exe51⤵
- Executes dropped EXE
PID:2948 -
\??\c:\rlfxffr.exec:\rlfxffr.exe52⤵
- Executes dropped EXE
PID:1748 -
\??\c:\ttnhtn.exec:\ttnhtn.exe53⤵
- Executes dropped EXE
PID:1072 -
\??\c:\httnnt.exec:\httnnt.exe54⤵
- Executes dropped EXE
PID:1944 -
\??\c:\9pvpj.exec:\9pvpj.exe55⤵
- Executes dropped EXE
PID:1936 -
\??\c:\dvddj.exec:\dvddj.exe56⤵
- Executes dropped EXE
PID:348 -
\??\c:\9lflrxx.exec:\9lflrxx.exe57⤵
- Executes dropped EXE
PID:316 -
\??\c:\9lffllr.exec:\9lffllr.exe58⤵
- Executes dropped EXE
PID:352 -
\??\c:\bnttbh.exec:\bnttbh.exe59⤵
- Executes dropped EXE
PID:1660 -
\??\c:\dvjpv.exec:\dvjpv.exe60⤵
- Executes dropped EXE
PID:632 -
\??\c:\7ppvj.exec:\7ppvj.exe61⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xfrffrl.exec:\xfrffrl.exe62⤵
- Executes dropped EXE
PID:2384 -
\??\c:\xxllrxf.exec:\xxllrxf.exe63⤵
- Executes dropped EXE
PID:1972 -
\??\c:\tbnhbh.exec:\tbnhbh.exe64⤵
- Executes dropped EXE
PID:2880 -
\??\c:\5vdjv.exec:\5vdjv.exe65⤵
- Executes dropped EXE
PID:592 -
\??\c:\vvppd.exec:\vvppd.exe66⤵PID:2916
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe67⤵PID:1536
-
\??\c:\xxllrxx.exec:\xxllrxx.exe68⤵PID:1864
-
\??\c:\hnbbnh.exec:\hnbbnh.exe69⤵PID:400
-
\??\c:\tnhhnn.exec:\tnhhnn.exe70⤵PID:952
-
\??\c:\1pdpp.exec:\1pdpp.exe71⤵PID:920
-
\??\c:\pdppp.exec:\pdppp.exe72⤵PID:1068
-
\??\c:\xrfxrrf.exec:\xrfxrrf.exe73⤵PID:1736
-
\??\c:\1llxffl.exec:\1llxffl.exe74⤵PID:900
-
\??\c:\hbhbhn.exec:\hbhbhn.exe75⤵PID:2100
-
\??\c:\nbbbht.exec:\nbbbht.exe76⤵PID:2448
-
\??\c:\1vppv.exec:\1vppv.exe77⤵PID:2080
-
\??\c:\ddvvj.exec:\ddvvj.exe78⤵PID:1588
-
\??\c:\lfrxflx.exec:\lfrxflx.exe79⤵PID:2956
-
\??\c:\lxflxfr.exec:\lxflxfr.exe80⤵PID:2112
-
\??\c:\bnthbn.exec:\bnthbn.exe81⤵PID:2868
-
\??\c:\dvpdp.exec:\dvpdp.exe82⤵PID:2392
-
\??\c:\vvjpv.exec:\vvjpv.exe83⤵PID:2856
-
\??\c:\dvdjj.exec:\dvdjj.exe84⤵PID:2760
-
\??\c:\7lxxfxr.exec:\7lxxfxr.exe85⤵PID:2524
-
\??\c:\rxxxlff.exec:\rxxxlff.exe86⤵PID:2736
-
\??\c:\1tntbn.exec:\1tntbn.exe87⤵PID:2936
-
\??\c:\dddvp.exec:\dddvp.exe88⤵PID:2964
-
\??\c:\3jvjv.exec:\3jvjv.exe89⤵PID:1296
-
\??\c:\rxlflxl.exec:\rxlflxl.exe90⤵PID:1808
-
\??\c:\rxxrxxx.exec:\rxxrxxx.exe91⤵PID:1716
-
\??\c:\hnhnnb.exec:\hnhnnb.exe92⤵PID:2816
-
\??\c:\tththh.exec:\tththh.exe93⤵PID:1968
-
\??\c:\9jpvd.exec:\9jpvd.exe94⤵PID:2220
-
\??\c:\pjddd.exec:\pjddd.exe95⤵PID:1748
-
\??\c:\xflfrxf.exec:\xflfrxf.exe96⤵PID:272
-
\??\c:\1flxrff.exec:\1flxrff.exe97⤵PID:1944
-
\??\c:\hbthbh.exec:\hbthbh.exe98⤵PID:1860
-
\??\c:\3hhtnh.exec:\3hhtnh.exe99⤵PID:656
-
\??\c:\jjjdj.exec:\jjjdj.exe100⤵PID:1528
-
\??\c:\vvpvj.exec:\vvpvj.exe101⤵PID:1344
-
\??\c:\rrflfxx.exec:\rrflfxx.exe102⤵PID:856
-
\??\c:\llrfxll.exec:\llrfxll.exe103⤵PID:1420
-
\??\c:\nthttt.exec:\nthttt.exe104⤵PID:2316
-
\??\c:\1tbnht.exec:\1tbnht.exe105⤵PID:2116
-
\??\c:\pjddp.exec:\pjddp.exe106⤵PID:2740
-
\??\c:\djdpp.exec:\djdpp.exe107⤵PID:1852
-
\??\c:\frffrxf.exec:\frffrxf.exe108⤵PID:2144
-
\??\c:\3rxfrxf.exec:\3rxfrxf.exe109⤵PID:2916
-
\??\c:\nnbnht.exec:\nnbnht.exe110⤵PID:1776
-
\??\c:\hthbtb.exec:\hthbtb.exe111⤵PID:1064
-
\??\c:\vpvvj.exec:\vpvvj.exe112⤵PID:1448
-
\??\c:\7ddpj.exec:\7ddpj.exe113⤵PID:952
-
\??\c:\rlrlrrr.exec:\rlrlrrr.exe114⤵PID:1796
-
\??\c:\ffxxflr.exec:\ffxxflr.exe115⤵PID:2068
-
\??\c:\bbtbht.exec:\bbtbht.exe116⤵PID:2892
-
\??\c:\hthbtn.exec:\hthbtn.exe117⤵PID:1980
-
\??\c:\1dpvj.exec:\1dpvj.exe118⤵PID:2100
-
\??\c:\1dpdp.exec:\1dpdp.exe119⤵PID:1984
-
\??\c:\rrlrxfl.exec:\rrlrxfl.exe120⤵PID:2080
-
\??\c:\9rffrxf.exec:\9rffrxf.exe121⤵PID:1584
-
\??\c:\tbbbnt.exec:\tbbbnt.exe122⤵PID:1756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-