Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 03:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
86220463e884eb87c5f637949a578440_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
86220463e884eb87c5f637949a578440_NeikiAnalytics.exe
-
Size
480KB
-
MD5
86220463e884eb87c5f637949a578440
-
SHA1
bebd8f2833d5e6db55aad169699c7ff76bbdfa0b
-
SHA256
afa3e5aec89718cebdb5e7408a005433dd4355a667f5b6dc1ae3aa2228aea1fd
-
SHA512
dcdbe275534a23d9c9dd3d47b3e5d5ad2a67da8977d3a044259631362e7d3b4069737b0c35748cfbb8a3affbdb36bdf5f340356e31533401eab362f6626f1fea
-
SSDEEP
12288:n3C9uDVw6326pKZ9asZqoZHz+evcn0Meh2Fezu:Su326p0aroZt0su
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/2312-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/568-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1328-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2072 tnttbh.exe 2380 pjjpv.exe 2772 9dpjj.exe 2896 frfxfxf.exe 2712 3bnthn.exe 2648 ppdjv.exe 2588 lxllrrr.exe 2388 jdvpv.exe 608 tnttbb.exe 2848 vjvvv.exe 3000 nnbnth.exe 1804 5bbhnn.exe 2172 rlrlrrx.exe 1664 jjjpv.exe 2220 lxrrrxl.exe 1668 nnhnth.exe 1736 3frrxrx.exe 2112 xrrxflr.exe 2924 1vdvv.exe 744 flxfllr.exe 2144 5jjdj.exe 568 3lxrrrx.exe 448 pjvdj.exe 1152 frrllxf.exe 1372 nhbbhh.exe 1328 xrflxxl.exe 2936 bbbhbh.exe 1520 lfxxflr.exe 2484 thbbhh.exe 3016 jdpvv.exe 3024 3thtnt.exe 2960 jdvdj.exe 2132 xrflxxf.exe 2724 7bnntt.exe 2840 9pjvd.exe 2684 rlflxxx.exe 2380 5bhntb.exe 2652 bbnhnn.exe 2820 jvpjp.exe 2396 rfllxrx.exe 2592 7thnnh.exe 2568 thttbt.exe 2452 dvppd.exe 1060 rfrrfxf.exe 348 lfrxfll.exe 2788 nhhhhh.exe 2808 pdppv.exe 2996 5fllrrx.exe 3000 xlxxxxf.exe 1796 9btbhh.exe 1864 5dpjd.exe 304 3vpvj.exe 1764 xlxrxrl.exe 2220 hhttbh.exe 1632 bnhhhh.exe 2632 dvjjp.exe 1720 fxrrrrf.exe 2520 frxllrr.exe 1320 tnbbhh.exe 1104 vjpjv.exe 1940 5jdvp.exe 904 3rxlrrx.exe 1136 bthnnn.exe 1156 1htnbh.exe -
resource yara_rule behavioral1/memory/2312-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2172-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1328-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2072 2312 86220463e884eb87c5f637949a578440_NeikiAnalytics.exe 28 PID 2312 wrote to memory of 2072 2312 86220463e884eb87c5f637949a578440_NeikiAnalytics.exe 28 PID 2312 wrote to memory of 2072 2312 86220463e884eb87c5f637949a578440_NeikiAnalytics.exe 28 PID 2312 wrote to memory of 2072 2312 86220463e884eb87c5f637949a578440_NeikiAnalytics.exe 28 PID 2072 wrote to memory of 2380 2072 tnttbh.exe 29 PID 2072 wrote to memory of 2380 2072 tnttbh.exe 29 PID 2072 wrote to memory of 2380 2072 tnttbh.exe 29 PID 2072 wrote to memory of 2380 2072 tnttbh.exe 29 PID 2380 wrote to memory of 2772 2380 pjjpv.exe 30 PID 2380 wrote to memory of 2772 2380 pjjpv.exe 30 PID 2380 wrote to memory of 2772 2380 pjjpv.exe 30 PID 2380 wrote to memory of 2772 2380 pjjpv.exe 30 PID 2772 wrote to memory of 2896 2772 9dpjj.exe 31 PID 2772 wrote to memory of 2896 2772 9dpjj.exe 31 PID 2772 wrote to memory of 2896 2772 9dpjj.exe 31 PID 2772 wrote to memory of 2896 2772 9dpjj.exe 31 PID 2896 wrote to memory of 2712 2896 frfxfxf.exe 32 PID 2896 wrote to memory of 2712 2896 frfxfxf.exe 32 PID 2896 wrote to memory of 2712 2896 frfxfxf.exe 32 PID 2896 wrote to memory of 2712 2896 frfxfxf.exe 32 PID 2712 wrote to memory of 2648 2712 3bnthn.exe 33 PID 2712 wrote to memory of 2648 2712 3bnthn.exe 33 PID 2712 wrote to memory of 2648 2712 3bnthn.exe 33 PID 2712 wrote to memory of 2648 2712 3bnthn.exe 33 PID 2648 wrote to memory of 2588 2648 ppdjv.exe 34 PID 2648 wrote to memory of 2588 2648 ppdjv.exe 34 PID 2648 wrote to memory of 2588 2648 ppdjv.exe 34 PID 2648 wrote to memory of 2588 2648 ppdjv.exe 34 PID 2588 wrote to memory of 2388 2588 lxllrrr.exe 35 PID 2588 wrote to memory of 2388 2588 lxllrrr.exe 35 PID 2588 wrote to memory of 2388 2588 lxllrrr.exe 35 PID 2588 wrote to memory of 2388 2588 lxllrrr.exe 35 PID 2388 wrote to memory of 608 2388 jdvpv.exe 36 PID 2388 wrote to memory of 608 2388 jdvpv.exe 36 PID 2388 wrote to memory of 608 2388 jdvpv.exe 36 PID 2388 wrote to memory of 608 2388 jdvpv.exe 36 PID 608 wrote to memory of 2848 608 tnttbb.exe 37 PID 608 wrote to memory of 2848 608 tnttbb.exe 37 PID 608 wrote to memory of 2848 608 tnttbb.exe 37 PID 608 wrote to memory of 2848 608 tnttbb.exe 37 PID 2848 wrote to memory of 3000 2848 vjvvv.exe 38 PID 2848 wrote to memory of 3000 2848 vjvvv.exe 38 PID 2848 wrote to memory of 3000 2848 vjvvv.exe 38 PID 2848 wrote to memory of 3000 2848 vjvvv.exe 38 PID 3000 wrote to memory of 1804 3000 nnbnth.exe 39 PID 3000 wrote to memory of 1804 3000 nnbnth.exe 39 PID 3000 wrote to memory of 1804 3000 nnbnth.exe 39 PID 3000 wrote to memory of 1804 3000 nnbnth.exe 39 PID 1804 wrote to memory of 2172 1804 5bbhnn.exe 40 PID 1804 wrote to memory of 2172 1804 5bbhnn.exe 40 PID 1804 wrote to memory of 2172 1804 5bbhnn.exe 40 PID 1804 wrote to memory of 2172 1804 5bbhnn.exe 40 PID 2172 wrote to memory of 1664 2172 rlrlrrx.exe 41 PID 2172 wrote to memory of 1664 2172 rlrlrrx.exe 41 PID 2172 wrote to memory of 1664 2172 rlrlrrx.exe 41 PID 2172 wrote to memory of 1664 2172 rlrlrrx.exe 41 PID 1664 wrote to memory of 2220 1664 jjjpv.exe 42 PID 1664 wrote to memory of 2220 1664 jjjpv.exe 42 PID 1664 wrote to memory of 2220 1664 jjjpv.exe 42 PID 1664 wrote to memory of 2220 1664 jjjpv.exe 42 PID 2220 wrote to memory of 1668 2220 lxrrrxl.exe 43 PID 2220 wrote to memory of 1668 2220 lxrrrxl.exe 43 PID 2220 wrote to memory of 1668 2220 lxrrrxl.exe 43 PID 2220 wrote to memory of 1668 2220 lxrrrxl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\86220463e884eb87c5f637949a578440_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\86220463e884eb87c5f637949a578440_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\tnttbh.exec:\tnttbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\pjjpv.exec:\pjjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\9dpjj.exec:\9dpjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\frfxfxf.exec:\frfxfxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\3bnthn.exec:\3bnthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\ppdjv.exec:\ppdjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\lxllrrr.exec:\lxllrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\jdvpv.exec:\jdvpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\tnttbb.exec:\tnttbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
\??\c:\vjvvv.exec:\vjvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\nnbnth.exec:\nnbnth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\5bbhnn.exec:\5bbhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\jjjpv.exec:\jjjpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\lxrrrxl.exec:\lxrrrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\nnhnth.exec:\nnhnth.exe17⤵
- Executes dropped EXE
PID:1668 -
\??\c:\3frrxrx.exec:\3frrxrx.exe18⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xrrxflr.exec:\xrrxflr.exe19⤵
- Executes dropped EXE
PID:2112 -
\??\c:\1vdvv.exec:\1vdvv.exe20⤵
- Executes dropped EXE
PID:2924 -
\??\c:\flxfllr.exec:\flxfllr.exe21⤵
- Executes dropped EXE
PID:744 -
\??\c:\5jjdj.exec:\5jjdj.exe22⤵
- Executes dropped EXE
PID:2144 -
\??\c:\3lxrrrx.exec:\3lxrrrx.exe23⤵
- Executes dropped EXE
PID:568 -
\??\c:\pjvdj.exec:\pjvdj.exe24⤵
- Executes dropped EXE
PID:448 -
\??\c:\frrllxf.exec:\frrllxf.exe25⤵
- Executes dropped EXE
PID:1152 -
\??\c:\nhbbhh.exec:\nhbbhh.exe26⤵
- Executes dropped EXE
PID:1372 -
\??\c:\xrflxxl.exec:\xrflxxl.exe27⤵
- Executes dropped EXE
PID:1328 -
\??\c:\bbbhbh.exec:\bbbhbh.exe28⤵
- Executes dropped EXE
PID:2936 -
\??\c:\lfxxflr.exec:\lfxxflr.exe29⤵
- Executes dropped EXE
PID:1520 -
\??\c:\thbbhh.exec:\thbbhh.exe30⤵
- Executes dropped EXE
PID:2484 -
\??\c:\jdpvv.exec:\jdpvv.exe31⤵
- Executes dropped EXE
PID:3016 -
\??\c:\3thtnt.exec:\3thtnt.exe32⤵
- Executes dropped EXE
PID:3024 -
\??\c:\jdvdj.exec:\jdvdj.exe33⤵
- Executes dropped EXE
PID:2960 -
\??\c:\xrflxxf.exec:\xrflxxf.exe34⤵
- Executes dropped EXE
PID:2132 -
\??\c:\7bnntt.exec:\7bnntt.exe35⤵
- Executes dropped EXE
PID:2724 -
\??\c:\9pjvd.exec:\9pjvd.exe36⤵
- Executes dropped EXE
PID:2840 -
\??\c:\rlflxxx.exec:\rlflxxx.exe37⤵
- Executes dropped EXE
PID:2684 -
\??\c:\5bhntb.exec:\5bhntb.exe38⤵
- Executes dropped EXE
PID:2380 -
\??\c:\bbnhnn.exec:\bbnhnn.exe39⤵
- Executes dropped EXE
PID:2652 -
\??\c:\jvpjp.exec:\jvpjp.exe40⤵
- Executes dropped EXE
PID:2820 -
\??\c:\rfllxrx.exec:\rfllxrx.exe41⤵
- Executes dropped EXE
PID:2396 -
\??\c:\7thnnh.exec:\7thnnh.exe42⤵
- Executes dropped EXE
PID:2592 -
\??\c:\thttbt.exec:\thttbt.exe43⤵
- Executes dropped EXE
PID:2568 -
\??\c:\dvppd.exec:\dvppd.exe44⤵
- Executes dropped EXE
PID:2452 -
\??\c:\rfrrfxf.exec:\rfrrfxf.exe45⤵
- Executes dropped EXE
PID:1060 -
\??\c:\lfrxfll.exec:\lfrxfll.exe46⤵
- Executes dropped EXE
PID:348 -
\??\c:\nhhhhh.exec:\nhhhhh.exe47⤵
- Executes dropped EXE
PID:2788 -
\??\c:\pdppv.exec:\pdppv.exe48⤵
- Executes dropped EXE
PID:2808 -
\??\c:\5fllrrx.exec:\5fllrrx.exe49⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xlxxxxf.exec:\xlxxxxf.exe50⤵
- Executes dropped EXE
PID:3000 -
\??\c:\9btbhh.exec:\9btbhh.exe51⤵
- Executes dropped EXE
PID:1796 -
\??\c:\5dpjd.exec:\5dpjd.exe52⤵
- Executes dropped EXE
PID:1864 -
\??\c:\3vpvj.exec:\3vpvj.exe53⤵
- Executes dropped EXE
PID:304 -
\??\c:\xlxrxrl.exec:\xlxrxrl.exe54⤵
- Executes dropped EXE
PID:1764 -
\??\c:\hhttbh.exec:\hhttbh.exe55⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bnhhhh.exec:\bnhhhh.exe56⤵
- Executes dropped EXE
PID:1632 -
\??\c:\dvjjp.exec:\dvjjp.exe57⤵
- Executes dropped EXE
PID:2632 -
\??\c:\fxrrrrf.exec:\fxrrrrf.exe58⤵
- Executes dropped EXE
PID:1720 -
\??\c:\frxllrr.exec:\frxllrr.exe59⤵
- Executes dropped EXE
PID:2520 -
\??\c:\tnbbhh.exec:\tnbbhh.exe60⤵
- Executes dropped EXE
PID:1320 -
\??\c:\vjpjv.exec:\vjpjv.exe61⤵
- Executes dropped EXE
PID:1104 -
\??\c:\5jdvp.exec:\5jdvp.exe62⤵
- Executes dropped EXE
PID:1940 -
\??\c:\3rxlrrx.exec:\3rxlrrx.exe63⤵
- Executes dropped EXE
PID:904 -
\??\c:\bthnnn.exec:\bthnnn.exe64⤵
- Executes dropped EXE
PID:1136 -
\??\c:\1htnbh.exec:\1htnbh.exe65⤵
- Executes dropped EXE
PID:1156 -
\??\c:\pvvjv.exec:\pvvjv.exe66⤵PID:2400
-
\??\c:\xlxxlfl.exec:\xlxxlfl.exe67⤵PID:1332
-
\??\c:\lfxfllx.exec:\lfxfllx.exe68⤵PID:1904
-
\??\c:\nhthhh.exec:\nhthhh.exe69⤵PID:1880
-
\??\c:\jvjjj.exec:\jvjjj.exe70⤵PID:3040
-
\??\c:\1vdvd.exec:\1vdvd.exe71⤵PID:1520
-
\??\c:\frfflfr.exec:\frfflfr.exe72⤵PID:3020
-
\??\c:\nbtthb.exec:\nbtthb.exe73⤵PID:816
-
\??\c:\nnttbt.exec:\nnttbt.exe74⤵PID:2084
-
\??\c:\3pddj.exec:\3pddj.exe75⤵PID:1256
-
\??\c:\7lxfrlr.exec:\7lxfrlr.exe76⤵PID:2964
-
\??\c:\nhnnnn.exec:\nhnnnn.exe77⤵PID:1620
-
\??\c:\3nnhhh.exec:\3nnhhh.exe78⤵PID:2164
-
\??\c:\vjjvv.exec:\vjjvv.exe79⤵PID:876
-
\??\c:\xlllfxf.exec:\xlllfxf.exe80⤵PID:2688
-
\??\c:\lxrlxxf.exec:\lxrlxxf.exe81⤵PID:2736
-
\??\c:\tnbtbh.exec:\tnbtbh.exe82⤵PID:2776
-
\??\c:\pjvpv.exec:\pjvpv.exe83⤵PID:2572
-
\??\c:\ddppp.exec:\ddppp.exe84⤵PID:2536
-
\??\c:\1xrxllr.exec:\1xrxllr.exe85⤵PID:2812
-
\??\c:\frffrrx.exec:\frffrrx.exe86⤵PID:2764
-
\??\c:\9thbbb.exec:\9thbbb.exe87⤵PID:2260
-
\??\c:\dvpjp.exec:\dvpjp.exe88⤵PID:2392
-
\??\c:\lfrlrlr.exec:\lfrlrlr.exe89⤵PID:2524
-
\??\c:\rfllfff.exec:\rfllfff.exe90⤵PID:2880
-
\??\c:\5hnbbb.exec:\5hnbbb.exe91⤵PID:2876
-
\??\c:\vjvpv.exec:\vjvpv.exe92⤵PID:2012
-
\??\c:\dvvvd.exec:\dvvvd.exe93⤵PID:2208
-
\??\c:\1frrrxx.exec:\1frrrxx.exe94⤵PID:2004
-
\??\c:\thtttt.exec:\thtttt.exe95⤵PID:1036
-
\??\c:\thttbb.exec:\thttbb.exe96⤵PID:2216
-
\??\c:\vjpjv.exec:\vjpjv.exe97⤵PID:828
-
\??\c:\xlxxxxl.exec:\xlxxxxl.exe98⤵PID:1668
-
\??\c:\fxlllfx.exec:\fxlllfx.exe99⤵PID:2212
-
\??\c:\bnbbbb.exec:\bnbbbb.exe100⤵PID:2308
-
\??\c:\1djjj.exec:\1djjj.exe101⤵PID:1192
-
\??\c:\1ppjv.exec:\1ppjv.exe102⤵PID:2868
-
\??\c:\lxllxrr.exec:\lxllxrr.exe103⤵PID:1500
-
\??\c:\thttbb.exec:\thttbb.exe104⤵PID:1696
-
\??\c:\tnhtbb.exec:\tnhtbb.exe105⤵PID:1928
-
\??\c:\vvppv.exec:\vvppv.exe106⤵PID:2508
-
\??\c:\5rfxxxf.exec:\5rfxxxf.exe107⤵PID:1852
-
\??\c:\tntbhn.exec:\tntbhn.exe108⤵PID:2276
-
\??\c:\htntbb.exec:\htntbb.exe109⤵PID:1152
-
\??\c:\ddpvp.exec:\ddpvp.exe110⤵PID:628
-
\??\c:\9rfxxfl.exec:\9rfxxfl.exe111⤵PID:1896
-
\??\c:\fxllxfr.exec:\fxllxfr.exe112⤵PID:1884
-
\??\c:\3httbh.exec:\3httbh.exe113⤵PID:684
-
\??\c:\9vjpp.exec:\9vjpp.exe114⤵PID:2076
-
\??\c:\3pjjd.exec:\3pjjd.exe115⤵PID:2484
-
\??\c:\xxllrlr.exec:\xxllrlr.exe116⤵PID:3024
-
\??\c:\hthnbb.exec:\hthnbb.exe117⤵PID:1608
-
\??\c:\9hbbtt.exec:\9hbbtt.exe118⤵PID:2184
-
\??\c:\jdvdd.exec:\jdvdd.exe119⤵PID:2312
-
\??\c:\lxrxflx.exec:\lxrxflx.exe120⤵PID:2188
-
\??\c:\3tbttb.exec:\3tbttb.exe121⤵PID:2744
-
\??\c:\9bhhhn.exec:\9bhhhn.exe122⤵PID:2740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-