Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 13:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a507f89791b8abffaded4a48717c9f60_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
a507f89791b8abffaded4a48717c9f60_NeikiAnalytics.exe
-
Size
95KB
-
MD5
a507f89791b8abffaded4a48717c9f60
-
SHA1
17cb54deab18d8d8fea5826ebdcf00c1faa78910
-
SHA256
b5be4639db0733d12076a36e0ffb68f0469bd13c328bde89f832d40ab2c32b55
-
SHA512
1e194f7e28d9e949c336ce330b15d827d1e836f256e304d61dfca791548551ad7c37ed06c45f6d3d1e193babc4730f7ad46c28afba8a3cb9a954614283e0cbd3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxEPOfPrAB:ymb3NkkiQ3mdBjFo73PYP1lri3KuOnrE
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2360-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-41-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/940-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1504-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/980-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1572-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2988 thtbhh.exe 1644 jjjvp.exe 1972 jdvdp.exe 2652 lffrrxl.exe 2580 nnhtht.exe 2744 5dvvd.exe 2592 xrfflxl.exe 2452 lfflflx.exe 3020 bntbhb.exe 2064 tnbhbb.exe 2860 7jvdp.exe 2504 fxlrxlx.exe 2780 3xxrffl.exe 940 nhnhnb.exe 852 5jjjp.exe 2868 pjvjp.exe 1636 9rfflrx.exe 2056 tnbhnt.exe 3004 hthhbt.exe 1960 3jvvv.exe 1728 5rfffrx.exe 2440 tnbtnn.exe 1504 htnhnh.exe 1804 jdpvj.exe 1672 lfxfxfr.exe 980 rfrxffl.exe 1856 5dddj.exe 240 3jjjp.exe 1612 ffxxrlf.exe 2256 ttnthn.exe 1572 bhhhtn.exe 1732 ddpdp.exe 1568 5frxxrx.exe 3016 fxlfxfr.exe 2540 hbbhhh.exe 3064 dppdd.exe 2596 dvddv.exe 2712 xlxfxxl.exe 2720 xlxxxxf.exe 2748 nhntbn.exe 2608 pdddd.exe 2732 vpjdd.exe 2740 rfxffxf.exe 2624 lrxrlrl.exe 3024 tnnnnh.exe 3032 btbhtt.exe 2876 7pppj.exe 1392 bbnnbt.exe 2756 bnbtbh.exe 2856 dvjvv.exe 2788 9jvpp.exe 940 lfrlrrl.exe 1176 rflrrrl.exe 2844 xrxlrrx.exe 1272 9thhnn.exe 1636 7nhtbh.exe 1300 5vvvd.exe 2108 pjvjd.exe 1748 jvdvp.exe 1752 fffrfxx.exe 1168 xxlflrl.exe 112 tbnhbn.exe 1904 nhhhnh.exe 344 vvpjp.exe -
resource yara_rule behavioral1/memory/2360-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/940-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/980-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1572-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2988 2360 a507f89791b8abffaded4a48717c9f60_NeikiAnalytics.exe 28 PID 2360 wrote to memory of 2988 2360 a507f89791b8abffaded4a48717c9f60_NeikiAnalytics.exe 28 PID 2360 wrote to memory of 2988 2360 a507f89791b8abffaded4a48717c9f60_NeikiAnalytics.exe 28 PID 2360 wrote to memory of 2988 2360 a507f89791b8abffaded4a48717c9f60_NeikiAnalytics.exe 28 PID 2988 wrote to memory of 1644 2988 thtbhh.exe 29 PID 2988 wrote to memory of 1644 2988 thtbhh.exe 29 PID 2988 wrote to memory of 1644 2988 thtbhh.exe 29 PID 2988 wrote to memory of 1644 2988 thtbhh.exe 29 PID 1644 wrote to memory of 1972 1644 jjjvp.exe 30 PID 1644 wrote to memory of 1972 1644 jjjvp.exe 30 PID 1644 wrote to memory of 1972 1644 jjjvp.exe 30 PID 1644 wrote to memory of 1972 1644 jjjvp.exe 30 PID 1972 wrote to memory of 2652 1972 jdvdp.exe 31 PID 1972 wrote to memory of 2652 1972 jdvdp.exe 31 PID 1972 wrote to memory of 2652 1972 jdvdp.exe 31 PID 1972 wrote to memory of 2652 1972 jdvdp.exe 31 PID 2652 wrote to memory of 2580 2652 lffrrxl.exe 32 PID 2652 wrote to memory of 2580 2652 lffrrxl.exe 32 PID 2652 wrote to memory of 2580 2652 lffrrxl.exe 32 PID 2652 wrote to memory of 2580 2652 lffrrxl.exe 32 PID 2580 wrote to memory of 2744 2580 nnhtht.exe 33 PID 2580 wrote to memory of 2744 2580 nnhtht.exe 33 PID 2580 wrote to memory of 2744 2580 nnhtht.exe 33 PID 2580 wrote to memory of 2744 2580 nnhtht.exe 33 PID 2744 wrote to memory of 2592 2744 5dvvd.exe 34 PID 2744 wrote to memory of 2592 2744 5dvvd.exe 34 PID 2744 wrote to memory of 2592 2744 5dvvd.exe 34 PID 2744 wrote to memory of 2592 2744 5dvvd.exe 34 PID 2592 wrote to memory of 2452 2592 xrfflxl.exe 35 PID 2592 wrote to memory of 2452 2592 xrfflxl.exe 35 PID 2592 wrote to memory of 2452 2592 xrfflxl.exe 35 PID 2592 wrote to memory of 2452 2592 xrfflxl.exe 35 PID 2452 wrote to memory of 3020 2452 lfflflx.exe 36 PID 2452 wrote to memory of 3020 2452 lfflflx.exe 36 PID 2452 wrote to memory of 3020 2452 lfflflx.exe 36 PID 2452 wrote to memory of 3020 2452 lfflflx.exe 36 PID 3020 wrote to memory of 2064 3020 bntbhb.exe 37 PID 3020 wrote to memory of 2064 3020 bntbhb.exe 37 PID 3020 wrote to memory of 2064 3020 bntbhb.exe 37 PID 3020 wrote to memory of 2064 3020 bntbhb.exe 37 PID 2064 wrote to memory of 2860 2064 tnbhbb.exe 38 PID 2064 wrote to memory of 2860 2064 tnbhbb.exe 38 PID 2064 wrote to memory of 2860 2064 tnbhbb.exe 38 PID 2064 wrote to memory of 2860 2064 tnbhbb.exe 38 PID 2860 wrote to memory of 2504 2860 7jvdp.exe 39 PID 2860 wrote to memory of 2504 2860 7jvdp.exe 39 PID 2860 wrote to memory of 2504 2860 7jvdp.exe 39 PID 2860 wrote to memory of 2504 2860 7jvdp.exe 39 PID 2504 wrote to memory of 2780 2504 fxlrxlx.exe 40 PID 2504 wrote to memory of 2780 2504 fxlrxlx.exe 40 PID 2504 wrote to memory of 2780 2504 fxlrxlx.exe 40 PID 2504 wrote to memory of 2780 2504 fxlrxlx.exe 40 PID 2780 wrote to memory of 940 2780 3xxrffl.exe 41 PID 2780 wrote to memory of 940 2780 3xxrffl.exe 41 PID 2780 wrote to memory of 940 2780 3xxrffl.exe 41 PID 2780 wrote to memory of 940 2780 3xxrffl.exe 41 PID 940 wrote to memory of 852 940 nhnhnb.exe 42 PID 940 wrote to memory of 852 940 nhnhnb.exe 42 PID 940 wrote to memory of 852 940 nhnhnb.exe 42 PID 940 wrote to memory of 852 940 nhnhnb.exe 42 PID 852 wrote to memory of 2868 852 5jjjp.exe 43 PID 852 wrote to memory of 2868 852 5jjjp.exe 43 PID 852 wrote to memory of 2868 852 5jjjp.exe 43 PID 852 wrote to memory of 2868 852 5jjjp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\a507f89791b8abffaded4a48717c9f60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a507f89791b8abffaded4a48717c9f60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\thtbhh.exec:\thtbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\jjjvp.exec:\jjjvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\jdvdp.exec:\jdvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\lffrrxl.exec:\lffrrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\nnhtht.exec:\nnhtht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\5dvvd.exec:\5dvvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\xrfflxl.exec:\xrfflxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\lfflflx.exec:\lfflflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\bntbhb.exec:\bntbhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\tnbhbb.exec:\tnbhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\7jvdp.exec:\7jvdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\fxlrxlx.exec:\fxlrxlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\3xxrffl.exec:\3xxrffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nhnhnb.exec:\nhnhnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\5jjjp.exec:\5jjjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\pjvjp.exec:\pjvjp.exe17⤵
- Executes dropped EXE
PID:2868 -
\??\c:\9rfflrx.exec:\9rfflrx.exe18⤵
- Executes dropped EXE
PID:1636 -
\??\c:\tnbhnt.exec:\tnbhnt.exe19⤵
- Executes dropped EXE
PID:2056 -
\??\c:\hthhbt.exec:\hthhbt.exe20⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3jvvv.exec:\3jvvv.exe21⤵
- Executes dropped EXE
PID:1960 -
\??\c:\5rfffrx.exec:\5rfffrx.exe22⤵
- Executes dropped EXE
PID:1728 -
\??\c:\tnbtnn.exec:\tnbtnn.exe23⤵
- Executes dropped EXE
PID:2440 -
\??\c:\htnhnh.exec:\htnhnh.exe24⤵
- Executes dropped EXE
PID:1504 -
\??\c:\jdpvj.exec:\jdpvj.exe25⤵
- Executes dropped EXE
PID:1804 -
\??\c:\lfxfxfr.exec:\lfxfxfr.exe26⤵
- Executes dropped EXE
PID:1672 -
\??\c:\rfrxffl.exec:\rfrxffl.exe27⤵
- Executes dropped EXE
PID:980 -
\??\c:\5dddj.exec:\5dddj.exe28⤵
- Executes dropped EXE
PID:1856 -
\??\c:\3jjjp.exec:\3jjjp.exe29⤵
- Executes dropped EXE
PID:240 -
\??\c:\ffxxrlf.exec:\ffxxrlf.exe30⤵
- Executes dropped EXE
PID:1612 -
\??\c:\ttnthn.exec:\ttnthn.exe31⤵
- Executes dropped EXE
PID:2256 -
\??\c:\bhhhtn.exec:\bhhhtn.exe32⤵
- Executes dropped EXE
PID:1572 -
\??\c:\ddpdp.exec:\ddpdp.exe33⤵
- Executes dropped EXE
PID:1732 -
\??\c:\5frxxrx.exec:\5frxxrx.exe34⤵
- Executes dropped EXE
PID:1568 -
\??\c:\fxlfxfr.exec:\fxlfxfr.exe35⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hbbhhh.exec:\hbbhhh.exe36⤵
- Executes dropped EXE
PID:2540 -
\??\c:\dppdd.exec:\dppdd.exe37⤵
- Executes dropped EXE
PID:3064 -
\??\c:\dvddv.exec:\dvddv.exe38⤵
- Executes dropped EXE
PID:2596 -
\??\c:\xlxfxxl.exec:\xlxfxxl.exe39⤵
- Executes dropped EXE
PID:2712 -
\??\c:\xlxxxxf.exec:\xlxxxxf.exe40⤵
- Executes dropped EXE
PID:2720 -
\??\c:\nhntbn.exec:\nhntbn.exe41⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pdddd.exec:\pdddd.exe42⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vpjdd.exec:\vpjdd.exe43⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rfxffxf.exec:\rfxffxf.exe44⤵
- Executes dropped EXE
PID:2740 -
\??\c:\lrxrlrl.exec:\lrxrlrl.exe45⤵
- Executes dropped EXE
PID:2624 -
\??\c:\tnnnnh.exec:\tnnnnh.exe46⤵
- Executes dropped EXE
PID:3024 -
\??\c:\btbhtt.exec:\btbhtt.exe47⤵
- Executes dropped EXE
PID:3032 -
\??\c:\7pppj.exec:\7pppj.exe48⤵
- Executes dropped EXE
PID:2876 -
\??\c:\bbnnbt.exec:\bbnnbt.exe49⤵
- Executes dropped EXE
PID:1392 -
\??\c:\bnbtbh.exec:\bnbtbh.exe50⤵
- Executes dropped EXE
PID:2756 -
\??\c:\dvjvv.exec:\dvjvv.exe51⤵
- Executes dropped EXE
PID:2856 -
\??\c:\9jvpp.exec:\9jvpp.exe52⤵
- Executes dropped EXE
PID:2788 -
\??\c:\lfrlrrl.exec:\lfrlrrl.exe53⤵
- Executes dropped EXE
PID:940 -
\??\c:\rflrrrl.exec:\rflrrrl.exe54⤵
- Executes dropped EXE
PID:1176 -
\??\c:\xrxlrrx.exec:\xrxlrrx.exe55⤵
- Executes dropped EXE
PID:2844 -
\??\c:\9thhnn.exec:\9thhnn.exe56⤵
- Executes dropped EXE
PID:1272 -
\??\c:\7nhtbh.exec:\7nhtbh.exe57⤵
- Executes dropped EXE
PID:1636 -
\??\c:\5vvvd.exec:\5vvvd.exe58⤵
- Executes dropped EXE
PID:1300 -
\??\c:\pjvjd.exec:\pjvjd.exe59⤵
- Executes dropped EXE
PID:2108 -
\??\c:\jvdvp.exec:\jvdvp.exe60⤵
- Executes dropped EXE
PID:1748 -
\??\c:\fffrfxx.exec:\fffrfxx.exe61⤵
- Executes dropped EXE
PID:1752 -
\??\c:\xxlflrl.exec:\xxlflrl.exe62⤵
- Executes dropped EXE
PID:1168 -
\??\c:\tbnhbn.exec:\tbnhbn.exe63⤵
- Executes dropped EXE
PID:112 -
\??\c:\nhhhnh.exec:\nhhhnh.exe64⤵
- Executes dropped EXE
PID:1904 -
\??\c:\vvpjp.exec:\vvpjp.exe65⤵
- Executes dropped EXE
PID:344 -
\??\c:\rrllxff.exec:\rrllxff.exe66⤵PID:1640
-
\??\c:\1lxlxxl.exec:\1lxlxxl.exe67⤵PID:1116
-
\??\c:\htnnhh.exec:\htnnhh.exe68⤵PID:980
-
\??\c:\hbnhth.exec:\hbnhth.exe69⤵PID:1856
-
\??\c:\1pjjp.exec:\1pjjp.exe70⤵PID:2192
-
\??\c:\dvpdp.exec:\dvpdp.exe71⤵PID:1680
-
\??\c:\rrrrxfl.exec:\rrrrxfl.exe72⤵PID:2380
-
\??\c:\9frrfff.exec:\9frrfff.exe73⤵PID:896
-
\??\c:\xfrfrxl.exec:\xfrfrxl.exe74⤵PID:2376
-
\??\c:\3tnbnn.exec:\3tnbnn.exe75⤵PID:1604
-
\??\c:\3dppp.exec:\3dppp.exe76⤵PID:2992
-
\??\c:\vdvdp.exec:\vdvdp.exe77⤵PID:2668
-
\??\c:\xrlrxxr.exec:\xrlrxxr.exe78⤵PID:1032
-
\??\c:\7rlrrff.exec:\7rlrrff.exe79⤵PID:1644
-
\??\c:\xxxlffr.exec:\xxxlffr.exe80⤵PID:2804
-
\??\c:\nhtbht.exec:\nhtbht.exe81⤵PID:2612
-
\??\c:\bthnnt.exec:\bthnnt.exe82⤵PID:2464
-
\??\c:\1jppd.exec:\1jppd.exe83⤵PID:2920
-
\??\c:\7pjjv.exec:\7pjjv.exe84⤵PID:2336
-
\??\c:\3fflllr.exec:\3fflllr.exe85⤵PID:2700
-
\??\c:\xlflrrf.exec:\xlflrrf.exe86⤵PID:2508
-
\??\c:\1rlxxrf.exec:\1rlxxrf.exe87⤵PID:2904
-
\??\c:\hbtbtt.exec:\hbtbtt.exe88⤵PID:2068
-
\??\c:\nbtttt.exec:\nbtttt.exe89⤵PID:2680
-
\??\c:\jddjj.exec:\jddjj.exe90⤵PID:2872
-
\??\c:\ppdjv.exec:\ppdjv.exe91⤵PID:2640
-
\??\c:\rllllrf.exec:\rllllrf.exe92⤵PID:2696
-
\??\c:\lffrxfl.exec:\lffrxfl.exe93⤵PID:2752
-
\??\c:\ttnbhh.exec:\ttnbhh.exe94⤵PID:2020
-
\??\c:\nbtbbb.exec:\nbtbbb.exe95⤵PID:2760
-
\??\c:\vvdjd.exec:\vvdjd.exe96⤵PID:2828
-
\??\c:\vjjjp.exec:\vjjjp.exe97⤵PID:1820
-
\??\c:\xrfflxl.exec:\xrfflxl.exe98⤵PID:1716
-
\??\c:\3lfrxff.exec:\3lfrxff.exe99⤵PID:3044
-
\??\c:\btntht.exec:\btntht.exe100⤵PID:2300
-
\??\c:\7hbbbb.exec:\7hbbbb.exe101⤵PID:2328
-
\??\c:\7pjvp.exec:\7pjvp.exe102⤵PID:268
-
\??\c:\vjdjp.exec:\vjdjp.exe103⤵PID:1728
-
\??\c:\rrllxfx.exec:\rrllxfx.exe104⤵PID:640
-
\??\c:\3rflllr.exec:\3rflllr.exe105⤵PID:548
-
\??\c:\bthbnt.exec:\bthbnt.exe106⤵PID:2948
-
\??\c:\htttbh.exec:\htttbh.exe107⤵PID:1460
-
\??\c:\nhtbhh.exec:\nhtbhh.exe108⤵PID:448
-
\??\c:\vpdjj.exec:\vpdjj.exe109⤵PID:2384
-
\??\c:\7jvjv.exec:\7jvjv.exe110⤵PID:908
-
\??\c:\fxlrxrl.exec:\fxlrxrl.exe111⤵PID:2216
-
\??\c:\fxlrxxr.exec:\fxlrxxr.exe112⤵PID:2976
-
\??\c:\hbtbbh.exec:\hbtbbh.exe113⤵PID:1344
-
\??\c:\tnhtbb.exec:\tnhtbb.exe114⤵PID:900
-
\??\c:\dddjj.exec:\dddjj.exe115⤵PID:2080
-
\??\c:\9jdjp.exec:\9jdjp.exe116⤵PID:1692
-
\??\c:\5vpdd.exec:\5vpdd.exe117⤵PID:1720
-
\??\c:\1rflxll.exec:\1rflxll.exe118⤵PID:3000
-
\??\c:\xlxrxxf.exec:\xlxrxxf.exe119⤵PID:2800
-
\??\c:\bbhhtt.exec:\bbhhtt.exe120⤵PID:3068
-
\??\c:\7pddd.exec:\7pddd.exe121⤵PID:1972
-
\??\c:\ppddv.exec:\ppddv.exe122⤵PID:2596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-