Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 10:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6486a92d436cc53a45104816a7b6c04fa0393388f7a4da7dd0f6a037469ec477_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
6486a92d436cc53a45104816a7b6c04fa0393388f7a4da7dd0f6a037469ec477_NeikiAnalytics.exe
-
Size
88KB
-
MD5
572122dab9f2e7efcd30988c09151880
-
SHA1
1a7deadb2c3252f1908880b0b9024ef1e27e5926
-
SHA256
6486a92d436cc53a45104816a7b6c04fa0393388f7a4da7dd0f6a037469ec477
-
SHA512
446360475286a693edbc4d0938d2deb6ecf3f8a371c09494190fcf07da5da2c0d694d786600c57be3eb7db3182d7b15057f50588a5f0cb4802b54a3cea7259ed
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2iJvRirE0DmoLZsO4EUe:ymb3NkkiQ3mdBjF+3TU2iBRioSnZsTEZ
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral1/memory/1312-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1992-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1396-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/868-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/912-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/704-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1992 hhntbb.exe 3040 pdvpp.exe 2684 vvpdp.exe 2572 xxlfllr.exe 2564 pjddv.exe 2916 pjppv.exe 2452 rfrrxrf.exe 2344 flflxrf.exe 1920 nbhbnb.exe 2676 1jvvv.exe 2880 lfrxfxx.exe 1396 fxlrflx.exe 2188 7nbhnn.exe 2020 jvjdp.exe 868 1dvjp.exe 772 rxxxffr.exe 912 hbntht.exe 2136 nhbhtt.exe 2096 pdpjp.exe 2304 vpddd.exe 1760 ffxlrrx.exe 784 tththn.exe 704 bbthtb.exe 2192 jvpdv.exe 796 1jjvj.exe 3020 7llxxlf.exe 1936 hhtbnt.exe 2992 1pdvj.exe 1868 jpdvd.exe 1640 rrllxxl.exe 3028 7flllrx.exe 2776 nnhbbt.exe 2884 9ddvj.exe 3040 pdvpv.exe 1592 7fxlrxf.exe 2576 5bbbtt.exe 2720 5hbbbb.exe 2740 3dpvj.exe 2572 pppjd.exe 2584 1rfflrr.exe 2248 rllrfrr.exe 2492 hthnnt.exe 2452 7nntbh.exe 1656 7vddd.exe 1444 dpddd.exe 2752 lxlrrrx.exe 1128 5lffrrx.exe 820 nhbnbn.exe 2360 nbnnbt.exe 1888 7jjjp.exe 1812 1pvdv.exe 1240 rrlxrfx.exe 1336 rlllrrx.exe 292 bthbnn.exe 1600 bthhnt.exe 2144 pdjjj.exe 2808 5pvjd.exe 1448 9rffffl.exe 2548 rrrxrfr.exe 560 thhnnn.exe 1320 thnbbt.exe 656 vjjjj.exe 296 jdddv.exe 1604 xxffxfx.exe -
resource yara_rule behavioral1/memory/1312-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1312-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/868-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/912-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/704-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-297-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1312 wrote to memory of 1992 1312 6486a92d436cc53a45104816a7b6c04fa0393388f7a4da7dd0f6a037469ec477_NeikiAnalytics.exe 28 PID 1312 wrote to memory of 1992 1312 6486a92d436cc53a45104816a7b6c04fa0393388f7a4da7dd0f6a037469ec477_NeikiAnalytics.exe 28 PID 1312 wrote to memory of 1992 1312 6486a92d436cc53a45104816a7b6c04fa0393388f7a4da7dd0f6a037469ec477_NeikiAnalytics.exe 28 PID 1312 wrote to memory of 1992 1312 6486a92d436cc53a45104816a7b6c04fa0393388f7a4da7dd0f6a037469ec477_NeikiAnalytics.exe 28 PID 1992 wrote to memory of 3040 1992 hhntbb.exe 29 PID 1992 wrote to memory of 3040 1992 hhntbb.exe 29 PID 1992 wrote to memory of 3040 1992 hhntbb.exe 29 PID 1992 wrote to memory of 3040 1992 hhntbb.exe 29 PID 3040 wrote to memory of 2684 3040 pdvpp.exe 30 PID 3040 wrote to memory of 2684 3040 pdvpp.exe 30 PID 3040 wrote to memory of 2684 3040 pdvpp.exe 30 PID 3040 wrote to memory of 2684 3040 pdvpp.exe 30 PID 2684 wrote to memory of 2572 2684 vvpdp.exe 31 PID 2684 wrote to memory of 2572 2684 vvpdp.exe 31 PID 2684 wrote to memory of 2572 2684 vvpdp.exe 31 PID 2684 wrote to memory of 2572 2684 vvpdp.exe 31 PID 2572 wrote to memory of 2564 2572 xxlfllr.exe 32 PID 2572 wrote to memory of 2564 2572 xxlfllr.exe 32 PID 2572 wrote to memory of 2564 2572 xxlfllr.exe 32 PID 2572 wrote to memory of 2564 2572 xxlfllr.exe 32 PID 2564 wrote to memory of 2916 2564 pjddv.exe 33 PID 2564 wrote to memory of 2916 2564 pjddv.exe 33 PID 2564 wrote to memory of 2916 2564 pjddv.exe 33 PID 2564 wrote to memory of 2916 2564 pjddv.exe 33 PID 2916 wrote to memory of 2452 2916 pjppv.exe 34 PID 2916 wrote to memory of 2452 2916 pjppv.exe 34 PID 2916 wrote to memory of 2452 2916 pjppv.exe 34 PID 2916 wrote to memory of 2452 2916 pjppv.exe 34 PID 2452 wrote to memory of 2344 2452 rfrrxrf.exe 35 PID 2452 wrote to memory of 2344 2452 rfrrxrf.exe 35 PID 2452 wrote to memory of 2344 2452 rfrrxrf.exe 35 PID 2452 wrote to memory of 2344 2452 rfrrxrf.exe 35 PID 2344 wrote to memory of 1920 2344 flflxrf.exe 36 PID 2344 wrote to memory of 1920 2344 flflxrf.exe 36 PID 2344 wrote to memory of 1920 2344 flflxrf.exe 36 PID 2344 wrote to memory of 1920 2344 flflxrf.exe 36 PID 1920 wrote to memory of 2676 1920 nbhbnb.exe 37 PID 1920 wrote to memory of 2676 1920 nbhbnb.exe 37 PID 1920 wrote to memory of 2676 1920 nbhbnb.exe 37 PID 1920 wrote to memory of 2676 1920 nbhbnb.exe 37 PID 2676 wrote to memory of 2880 2676 1jvvv.exe 38 PID 2676 wrote to memory of 2880 2676 1jvvv.exe 38 PID 2676 wrote to memory of 2880 2676 1jvvv.exe 38 PID 2676 wrote to memory of 2880 2676 1jvvv.exe 38 PID 2880 wrote to memory of 1396 2880 lfrxfxx.exe 39 PID 2880 wrote to memory of 1396 2880 lfrxfxx.exe 39 PID 2880 wrote to memory of 1396 2880 lfrxfxx.exe 39 PID 2880 wrote to memory of 1396 2880 lfrxfxx.exe 39 PID 1396 wrote to memory of 2188 1396 fxlrflx.exe 40 PID 1396 wrote to memory of 2188 1396 fxlrflx.exe 40 PID 1396 wrote to memory of 2188 1396 fxlrflx.exe 40 PID 1396 wrote to memory of 2188 1396 fxlrflx.exe 40 PID 2188 wrote to memory of 2020 2188 7nbhnn.exe 41 PID 2188 wrote to memory of 2020 2188 7nbhnn.exe 41 PID 2188 wrote to memory of 2020 2188 7nbhnn.exe 41 PID 2188 wrote to memory of 2020 2188 7nbhnn.exe 41 PID 2020 wrote to memory of 868 2020 jvjdp.exe 42 PID 2020 wrote to memory of 868 2020 jvjdp.exe 42 PID 2020 wrote to memory of 868 2020 jvjdp.exe 42 PID 2020 wrote to memory of 868 2020 jvjdp.exe 42 PID 868 wrote to memory of 772 868 1dvjp.exe 43 PID 868 wrote to memory of 772 868 1dvjp.exe 43 PID 868 wrote to memory of 772 868 1dvjp.exe 43 PID 868 wrote to memory of 772 868 1dvjp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\6486a92d436cc53a45104816a7b6c04fa0393388f7a4da7dd0f6a037469ec477_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6486a92d436cc53a45104816a7b6c04fa0393388f7a4da7dd0f6a037469ec477_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\hhntbb.exec:\hhntbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\pdvpp.exec:\pdvpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\vvpdp.exec:\vvpdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\xxlfllr.exec:\xxlfllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\pjddv.exec:\pjddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\pjppv.exec:\pjppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\rfrrxrf.exec:\rfrrxrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\flflxrf.exec:\flflxrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\nbhbnb.exec:\nbhbnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\1jvvv.exec:\1jvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\lfrxfxx.exec:\lfrxfxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\fxlrflx.exec:\fxlrflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\7nbhnn.exec:\7nbhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\jvjdp.exec:\jvjdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\1dvjp.exec:\1dvjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\rxxxffr.exec:\rxxxffr.exe17⤵
- Executes dropped EXE
PID:772 -
\??\c:\hbntht.exec:\hbntht.exe18⤵
- Executes dropped EXE
PID:912 -
\??\c:\nhbhtt.exec:\nhbhtt.exe19⤵
- Executes dropped EXE
PID:2136 -
\??\c:\pdpjp.exec:\pdpjp.exe20⤵
- Executes dropped EXE
PID:2096 -
\??\c:\vpddd.exec:\vpddd.exe21⤵
- Executes dropped EXE
PID:2304 -
\??\c:\ffxlrrx.exec:\ffxlrrx.exe22⤵
- Executes dropped EXE
PID:1760 -
\??\c:\tththn.exec:\tththn.exe23⤵
- Executes dropped EXE
PID:784 -
\??\c:\bbthtb.exec:\bbthtb.exe24⤵
- Executes dropped EXE
PID:704 -
\??\c:\jvpdv.exec:\jvpdv.exe25⤵
- Executes dropped EXE
PID:2192 -
\??\c:\1jjvj.exec:\1jjvj.exe26⤵
- Executes dropped EXE
PID:796 -
\??\c:\7llxxlf.exec:\7llxxlf.exe27⤵
- Executes dropped EXE
PID:3020 -
\??\c:\hhtbnt.exec:\hhtbnt.exe28⤵
- Executes dropped EXE
PID:1936 -
\??\c:\1pdvj.exec:\1pdvj.exe29⤵
- Executes dropped EXE
PID:2992 -
\??\c:\jpdvd.exec:\jpdvd.exe30⤵
- Executes dropped EXE
PID:1868 -
\??\c:\rrllxxl.exec:\rrllxxl.exe31⤵
- Executes dropped EXE
PID:1640 -
\??\c:\7flllrx.exec:\7flllrx.exe32⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nnhbbt.exec:\nnhbbt.exe33⤵
- Executes dropped EXE
PID:2776 -
\??\c:\9ddvj.exec:\9ddvj.exe34⤵
- Executes dropped EXE
PID:2884 -
\??\c:\pdvpv.exec:\pdvpv.exe35⤵
- Executes dropped EXE
PID:3040 -
\??\c:\7fxlrxf.exec:\7fxlrxf.exe36⤵
- Executes dropped EXE
PID:1592 -
\??\c:\5bbbtt.exec:\5bbbtt.exe37⤵
- Executes dropped EXE
PID:2576 -
\??\c:\5hbbbb.exec:\5hbbbb.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3dpvj.exec:\3dpvj.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\pppjd.exec:\pppjd.exe40⤵
- Executes dropped EXE
PID:2572 -
\??\c:\1rfflrr.exec:\1rfflrr.exe41⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rllrfrr.exec:\rllrfrr.exe42⤵
- Executes dropped EXE
PID:2248 -
\??\c:\hthnnt.exec:\hthnnt.exe43⤵
- Executes dropped EXE
PID:2492 -
\??\c:\7nntbh.exec:\7nntbh.exe44⤵
- Executes dropped EXE
PID:2452 -
\??\c:\7vddd.exec:\7vddd.exe45⤵
- Executes dropped EXE
PID:1656 -
\??\c:\dpddd.exec:\dpddd.exe46⤵
- Executes dropped EXE
PID:1444 -
\??\c:\lxlrrrx.exec:\lxlrrrx.exe47⤵
- Executes dropped EXE
PID:2752 -
\??\c:\5lffrrx.exec:\5lffrrx.exe48⤵
- Executes dropped EXE
PID:1128 -
\??\c:\nhbnbn.exec:\nhbnbn.exe49⤵
- Executes dropped EXE
PID:820 -
\??\c:\nbnnbt.exec:\nbnnbt.exe50⤵
- Executes dropped EXE
PID:2360 -
\??\c:\7jjjp.exec:\7jjjp.exe51⤵
- Executes dropped EXE
PID:1888 -
\??\c:\1pvdv.exec:\1pvdv.exe52⤵
- Executes dropped EXE
PID:1812 -
\??\c:\rrlxrfx.exec:\rrlxrfx.exe53⤵
- Executes dropped EXE
PID:1240 -
\??\c:\rlllrrx.exec:\rlllrrx.exe54⤵
- Executes dropped EXE
PID:1336 -
\??\c:\bthbnn.exec:\bthbnn.exe55⤵
- Executes dropped EXE
PID:292 -
\??\c:\bthhnt.exec:\bthhnt.exe56⤵
- Executes dropped EXE
PID:1600 -
\??\c:\pdjjj.exec:\pdjjj.exe57⤵
- Executes dropped EXE
PID:2144 -
\??\c:\5pvjd.exec:\5pvjd.exe58⤵
- Executes dropped EXE
PID:2808 -
\??\c:\9rffffl.exec:\9rffffl.exe59⤵
- Executes dropped EXE
PID:1448 -
\??\c:\rrrxrfr.exec:\rrrxrfr.exe60⤵
- Executes dropped EXE
PID:2548 -
\??\c:\thhnnn.exec:\thhnnn.exe61⤵
- Executes dropped EXE
PID:560 -
\??\c:\thnbbt.exec:\thnbbt.exe62⤵
- Executes dropped EXE
PID:1320 -
\??\c:\vjjjj.exec:\vjjjj.exe63⤵
- Executes dropped EXE
PID:656 -
\??\c:\jdddv.exec:\jdddv.exe64⤵
- Executes dropped EXE
PID:296 -
\??\c:\xxffxfx.exec:\xxffxfx.exe65⤵
- Executes dropped EXE
PID:1604 -
\??\c:\xlxflll.exec:\xlxflll.exe66⤵PID:1836
-
\??\c:\tbnbtn.exec:\tbnbtn.exe67⤵PID:1632
-
\??\c:\btnntt.exec:\btnntt.exe68⤵PID:944
-
\??\c:\jppdd.exec:\jppdd.exe69⤵PID:2416
-
\??\c:\vpddp.exec:\vpddp.exe70⤵PID:2996
-
\??\c:\fxfrxxx.exec:\fxfrxxx.exe71⤵PID:3008
-
\??\c:\xrxfxff.exec:\xrxfxff.exe72⤵PID:900
-
\??\c:\3ntbbt.exec:\3ntbbt.exe73⤵PID:2780
-
\??\c:\3vdjj.exec:\3vdjj.exe74⤵PID:1264
-
\??\c:\djpjp.exec:\djpjp.exe75⤵PID:2944
-
\??\c:\pdpjv.exec:\pdpjv.exe76⤵PID:2716
-
\??\c:\9lxrxfr.exec:\9lxrxfr.exe77⤵PID:1620
-
\??\c:\rrffllr.exec:\rrffllr.exe78⤵PID:2640
-
\??\c:\7htttn.exec:\7htttn.exe79⤵PID:2700
-
\??\c:\3hbbbt.exec:\3hbbbt.exe80⤵PID:2644
-
\??\c:\djvdd.exec:\djvdd.exe81⤵PID:2756
-
\??\c:\ddjvv.exec:\ddjvv.exe82⤵PID:2564
-
\??\c:\lfxxlrx.exec:\lfxxlrx.exe83⤵PID:2468
-
\??\c:\7fxxlfr.exec:\7fxxlfr.exe84⤵PID:2500
-
\??\c:\nhtnnn.exec:\nhtnnn.exe85⤵PID:3052
-
\??\c:\htbnnt.exec:\htbnnt.exe86⤵PID:2344
-
\??\c:\vjppd.exec:\vjppd.exe87⤵PID:1656
-
\??\c:\7dvvp.exec:\7dvvp.exe88⤵PID:2844
-
\??\c:\7rxrrrr.exec:\7rxrrrr.exe89⤵PID:1808
-
\??\c:\lfrxlfl.exec:\lfrxlfl.exe90⤵PID:2356
-
\??\c:\bntbhh.exec:\bntbhh.exe91⤵PID:2364
-
\??\c:\nnhnhb.exec:\nnhnhb.exe92⤵PID:1684
-
\??\c:\dvjjv.exec:\dvjjv.exe93⤵PID:1508
-
\??\c:\7vpdv.exec:\7vpdv.exe94⤵PID:1804
-
\??\c:\jvvdd.exec:\jvvdd.exe95⤵PID:1240
-
\??\c:\frlxlfl.exec:\frlxlfl.exe96⤵PID:2256
-
\??\c:\lfxfrlf.exec:\lfxfrlf.exe97⤵PID:2280
-
\??\c:\3tbbbb.exec:\3tbbbb.exe98⤵PID:2320
-
\??\c:\nttntn.exec:\nttntn.exe99⤵PID:2428
-
\??\c:\5dddp.exec:\5dddp.exe100⤵PID:2816
-
\??\c:\dvjdj.exec:\dvjdj.exe101⤵PID:2324
-
\??\c:\vdppp.exec:\vdppp.exe102⤵PID:396
-
\??\c:\lxrlflr.exec:\lxrlflr.exe103⤵PID:556
-
\??\c:\lxxxxfl.exec:\lxxxxfl.exe104⤵PID:700
-
\??\c:\htbhtt.exec:\htbhtt.exe105⤵PID:1852
-
\??\c:\bnnhhh.exec:\bnnhhh.exe106⤵PID:2164
-
\??\c:\vjjjd.exec:\vjjjd.exe107⤵PID:2288
-
\??\c:\vvvjv.exec:\vvvjv.exe108⤵PID:928
-
\??\c:\5fxxfxf.exec:\5fxxfxf.exe109⤵PID:1936
-
\??\c:\rflllrr.exec:\rflllrr.exe110⤵PID:1036
-
\??\c:\lxlflxr.exec:\lxlflxr.exe111⤵PID:2924
-
\??\c:\nhtbbb.exec:\nhtbbb.exe112⤵PID:2160
-
\??\c:\jvddd.exec:\jvddd.exe113⤵PID:1660
-
\??\c:\dpddj.exec:\dpddj.exe114⤵PID:376
-
\??\c:\dvvpd.exec:\dvvpd.exe115⤵PID:2052
-
\??\c:\xlxxxxl.exec:\xlxxxxl.exe116⤵PID:2592
-
\??\c:\9xrxxxf.exec:\9xrxxxf.exe117⤵PID:1616
-
\??\c:\nhnnnt.exec:\nhnnnt.exe118⤵PID:1624
-
\??\c:\nhhbht.exec:\nhhbht.exe119⤵PID:2552
-
\??\c:\pdpjp.exec:\pdpjp.exe120⤵PID:2580
-
\??\c:\7pppv.exec:\7pppv.exe121⤵PID:2788
-
\??\c:\xlxflrf.exec:\xlxflrf.exe122⤵PID:2476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-