Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 14:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7eb5404402d507e3ab70182391c2ce63662e358a4a99b8b3c0cd688110208920_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
7eb5404402d507e3ab70182391c2ce63662e358a4a99b8b3c0cd688110208920_NeikiAnalytics.exe
-
Size
78KB
-
MD5
25826b5e7e09848461d611c793e42460
-
SHA1
7dc4b8fddcb4075313c5df46f716392ba58172ef
-
SHA256
7eb5404402d507e3ab70182391c2ce63662e358a4a99b8b3c0cd688110208920
-
SHA512
3431018c24f3672782470900acd6219273b04abe48f5079ee9c7ae8f1217bde3638f1c6dd1c95e675dcae408617bee438825b95429821e97c4d628aca0bea28a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgygQwKjiawEmBg9t:ymb3NkkiQ3mdBjFo73thgQ/wEk2t
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/1992-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-30-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2032-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2032-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-95-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1504-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1236-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1088-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1408-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/900-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2032 1pdpd.exe 2016 lrxllrx.exe 2648 5tthnt.exe 2712 3bnthh.exe 2408 dvddv.exe 2388 ttbbbn.exe 2552 9nbnbn.exe 2804 jjdpj.exe 1712 pjpvd.exe 1504 ffflffx.exe 1584 nhnthn.exe 2188 thnbbh.exe 1636 pjvdj.exe 1840 rrrxlxl.exe 2200 flxlffr.exe 3016 nhntnh.exe 1508 ppdjp.exe 1236 jjvjv.exe 2236 lfrfrxr.exe 1088 9rxlrxf.exe 540 bththh.exe 1408 1vppd.exe 1708 dvdpj.exe 1252 llrflrf.exe 2824 tthhtt.exe 1884 hbtttt.exe 1668 ddvvd.exe 2084 fxrlxfx.exe 2240 xfxxxfl.exe 1744 btnntb.exe 900 ppjvj.exe 2020 jjvdd.exe 2788 lxlxllx.exe 2524 hnbbbt.exe 1528 5tbttn.exe 1640 nhttbb.exe 2588 1ddjj.exe 2652 7rrrffl.exe 2412 llxfxfr.exe 2572 btnhnh.exe 2396 bbtnbb.exe 2380 jjjjp.exe 2668 dpdvd.exe 1656 frxxxxf.exe 1772 3llxlrx.exe 1616 7bbbbt.exe 2680 bttttb.exe 764 jvjjd.exe 2304 pdjdj.exe 2288 xrfrxxl.exe 1748 3xrxfff.exe 1840 bbtbhn.exe 1888 hbnhbb.exe 2424 jjvdj.exe 1448 rrxlrrr.exe 2112 lfrlxfr.exe 2204 1lfrlfl.exe 2364 bbntbh.exe 1192 bttbtb.exe 780 dddjd.exe 676 jdvjv.exe 868 frffrrf.exe 2220 fxlxfll.exe 2144 hthntb.exe -
resource yara_rule behavioral1/memory/1992-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2032-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1504-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1236-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1088-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1408-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/900-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2032 1992 7eb5404402d507e3ab70182391c2ce63662e358a4a99b8b3c0cd688110208920_NeikiAnalytics.exe 28 PID 1992 wrote to memory of 2032 1992 7eb5404402d507e3ab70182391c2ce63662e358a4a99b8b3c0cd688110208920_NeikiAnalytics.exe 28 PID 1992 wrote to memory of 2032 1992 7eb5404402d507e3ab70182391c2ce63662e358a4a99b8b3c0cd688110208920_NeikiAnalytics.exe 28 PID 1992 wrote to memory of 2032 1992 7eb5404402d507e3ab70182391c2ce63662e358a4a99b8b3c0cd688110208920_NeikiAnalytics.exe 28 PID 2032 wrote to memory of 2016 2032 1pdpd.exe 29 PID 2032 wrote to memory of 2016 2032 1pdpd.exe 29 PID 2032 wrote to memory of 2016 2032 1pdpd.exe 29 PID 2032 wrote to memory of 2016 2032 1pdpd.exe 29 PID 2016 wrote to memory of 2648 2016 lrxllrx.exe 30 PID 2016 wrote to memory of 2648 2016 lrxllrx.exe 30 PID 2016 wrote to memory of 2648 2016 lrxllrx.exe 30 PID 2016 wrote to memory of 2648 2016 lrxllrx.exe 30 PID 2648 wrote to memory of 2712 2648 5tthnt.exe 31 PID 2648 wrote to memory of 2712 2648 5tthnt.exe 31 PID 2648 wrote to memory of 2712 2648 5tthnt.exe 31 PID 2648 wrote to memory of 2712 2648 5tthnt.exe 31 PID 2712 wrote to memory of 2408 2712 3bnthh.exe 32 PID 2712 wrote to memory of 2408 2712 3bnthh.exe 32 PID 2712 wrote to memory of 2408 2712 3bnthh.exe 32 PID 2712 wrote to memory of 2408 2712 3bnthh.exe 32 PID 2408 wrote to memory of 2388 2408 dvddv.exe 33 PID 2408 wrote to memory of 2388 2408 dvddv.exe 33 PID 2408 wrote to memory of 2388 2408 dvddv.exe 33 PID 2408 wrote to memory of 2388 2408 dvddv.exe 33 PID 2388 wrote to memory of 2552 2388 ttbbbn.exe 34 PID 2388 wrote to memory of 2552 2388 ttbbbn.exe 34 PID 2388 wrote to memory of 2552 2388 ttbbbn.exe 34 PID 2388 wrote to memory of 2552 2388 ttbbbn.exe 34 PID 2552 wrote to memory of 2804 2552 9nbnbn.exe 35 PID 2552 wrote to memory of 2804 2552 9nbnbn.exe 35 PID 2552 wrote to memory of 2804 2552 9nbnbn.exe 35 PID 2552 wrote to memory of 2804 2552 9nbnbn.exe 35 PID 2804 wrote to memory of 1712 2804 jjdpj.exe 36 PID 2804 wrote to memory of 1712 2804 jjdpj.exe 36 PID 2804 wrote to memory of 1712 2804 jjdpj.exe 36 PID 2804 wrote to memory of 1712 2804 jjdpj.exe 36 PID 1712 wrote to memory of 1504 1712 pjpvd.exe 37 PID 1712 wrote to memory of 1504 1712 pjpvd.exe 37 PID 1712 wrote to memory of 1504 1712 pjpvd.exe 37 PID 1712 wrote to memory of 1504 1712 pjpvd.exe 37 PID 1504 wrote to memory of 1584 1504 ffflffx.exe 38 PID 1504 wrote to memory of 1584 1504 ffflffx.exe 38 PID 1504 wrote to memory of 1584 1504 ffflffx.exe 38 PID 1504 wrote to memory of 1584 1504 ffflffx.exe 38 PID 1584 wrote to memory of 2188 1584 nhnthn.exe 39 PID 1584 wrote to memory of 2188 1584 nhnthn.exe 39 PID 1584 wrote to memory of 2188 1584 nhnthn.exe 39 PID 1584 wrote to memory of 2188 1584 nhnthn.exe 39 PID 2188 wrote to memory of 1636 2188 thnbbh.exe 40 PID 2188 wrote to memory of 1636 2188 thnbbh.exe 40 PID 2188 wrote to memory of 1636 2188 thnbbh.exe 40 PID 2188 wrote to memory of 1636 2188 thnbbh.exe 40 PID 1636 wrote to memory of 1840 1636 pjvdj.exe 41 PID 1636 wrote to memory of 1840 1636 pjvdj.exe 41 PID 1636 wrote to memory of 1840 1636 pjvdj.exe 41 PID 1636 wrote to memory of 1840 1636 pjvdj.exe 41 PID 1840 wrote to memory of 2200 1840 rrrxlxl.exe 42 PID 1840 wrote to memory of 2200 1840 rrrxlxl.exe 42 PID 1840 wrote to memory of 2200 1840 rrrxlxl.exe 42 PID 1840 wrote to memory of 2200 1840 rrrxlxl.exe 42 PID 2200 wrote to memory of 3016 2200 flxlffr.exe 43 PID 2200 wrote to memory of 3016 2200 flxlffr.exe 43 PID 2200 wrote to memory of 3016 2200 flxlffr.exe 43 PID 2200 wrote to memory of 3016 2200 flxlffr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\7eb5404402d507e3ab70182391c2ce63662e358a4a99b8b3c0cd688110208920_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7eb5404402d507e3ab70182391c2ce63662e358a4a99b8b3c0cd688110208920_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\1pdpd.exec:\1pdpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\lrxllrx.exec:\lrxllrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\5tthnt.exec:\5tthnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\3bnthh.exec:\3bnthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\dvddv.exec:\dvddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\ttbbbn.exec:\ttbbbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\9nbnbn.exec:\9nbnbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\jjdpj.exec:\jjdpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\pjpvd.exec:\pjpvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\ffflffx.exec:\ffflffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\nhnthn.exec:\nhnthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\thnbbh.exec:\thnbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\pjvdj.exec:\pjvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\rrrxlxl.exec:\rrrxlxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\flxlffr.exec:\flxlffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\nhntnh.exec:\nhntnh.exe17⤵
- Executes dropped EXE
PID:3016 -
\??\c:\ppdjp.exec:\ppdjp.exe18⤵
- Executes dropped EXE
PID:1508 -
\??\c:\jjvjv.exec:\jjvjv.exe19⤵
- Executes dropped EXE
PID:1236 -
\??\c:\lfrfrxr.exec:\lfrfrxr.exe20⤵
- Executes dropped EXE
PID:2236 -
\??\c:\9rxlrxf.exec:\9rxlrxf.exe21⤵
- Executes dropped EXE
PID:1088 -
\??\c:\bththh.exec:\bththh.exe22⤵
- Executes dropped EXE
PID:540 -
\??\c:\1vppd.exec:\1vppd.exe23⤵
- Executes dropped EXE
PID:1408 -
\??\c:\dvdpj.exec:\dvdpj.exe24⤵
- Executes dropped EXE
PID:1708 -
\??\c:\llrflrf.exec:\llrflrf.exe25⤵
- Executes dropped EXE
PID:1252 -
\??\c:\tthhtt.exec:\tthhtt.exe26⤵
- Executes dropped EXE
PID:2824 -
\??\c:\hbtttt.exec:\hbtttt.exe27⤵
- Executes dropped EXE
PID:1884 -
\??\c:\ddvvd.exec:\ddvvd.exe28⤵
- Executes dropped EXE
PID:1668 -
\??\c:\fxrlxfx.exec:\fxrlxfx.exe29⤵
- Executes dropped EXE
PID:2084 -
\??\c:\xfxxxfl.exec:\xfxxxfl.exe30⤵
- Executes dropped EXE
PID:2240 -
\??\c:\btnntb.exec:\btnntb.exe31⤵
- Executes dropped EXE
PID:1744 -
\??\c:\ppjvj.exec:\ppjvj.exe32⤵
- Executes dropped EXE
PID:900 -
\??\c:\jjvdd.exec:\jjvdd.exe33⤵
- Executes dropped EXE
PID:2020 -
\??\c:\lxlxllx.exec:\lxlxllx.exe34⤵
- Executes dropped EXE
PID:2788 -
\??\c:\hnbbbt.exec:\hnbbbt.exe35⤵
- Executes dropped EXE
PID:2524 -
\??\c:\5tbttn.exec:\5tbttn.exe36⤵
- Executes dropped EXE
PID:1528 -
\??\c:\nhttbb.exec:\nhttbb.exe37⤵
- Executes dropped EXE
PID:1640 -
\??\c:\1ddjj.exec:\1ddjj.exe38⤵
- Executes dropped EXE
PID:2588 -
\??\c:\7rrrffl.exec:\7rrrffl.exe39⤵
- Executes dropped EXE
PID:2652 -
\??\c:\llxfxfr.exec:\llxfxfr.exe40⤵
- Executes dropped EXE
PID:2412 -
\??\c:\btnhnh.exec:\btnhnh.exe41⤵
- Executes dropped EXE
PID:2572 -
\??\c:\bbtnbb.exec:\bbtnbb.exe42⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jjjjp.exec:\jjjjp.exe43⤵
- Executes dropped EXE
PID:2380 -
\??\c:\dpdvd.exec:\dpdvd.exe44⤵
- Executes dropped EXE
PID:2668 -
\??\c:\frxxxxf.exec:\frxxxxf.exe45⤵
- Executes dropped EXE
PID:1656 -
\??\c:\3llxlrx.exec:\3llxlrx.exe46⤵
- Executes dropped EXE
PID:1772 -
\??\c:\7bbbbt.exec:\7bbbbt.exe47⤵
- Executes dropped EXE
PID:1616 -
\??\c:\bttttb.exec:\bttttb.exe48⤵
- Executes dropped EXE
PID:2680 -
\??\c:\jvjjd.exec:\jvjjd.exe49⤵
- Executes dropped EXE
PID:764 -
\??\c:\pdjdj.exec:\pdjdj.exe50⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xrfrxxl.exec:\xrfrxxl.exe51⤵
- Executes dropped EXE
PID:2288 -
\??\c:\3xrxfff.exec:\3xrxfff.exe52⤵
- Executes dropped EXE
PID:1748 -
\??\c:\bbtbhn.exec:\bbtbhn.exe53⤵
- Executes dropped EXE
PID:1840 -
\??\c:\hbnhbb.exec:\hbnhbb.exe54⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jjvdj.exec:\jjvdj.exe55⤵
- Executes dropped EXE
PID:2424 -
\??\c:\rrxlrrr.exec:\rrxlrrr.exe56⤵
- Executes dropped EXE
PID:1448 -
\??\c:\lfrlxfr.exec:\lfrlxfr.exe57⤵
- Executes dropped EXE
PID:2112 -
\??\c:\1lfrlfl.exec:\1lfrlfl.exe58⤵
- Executes dropped EXE
PID:2204 -
\??\c:\bbntbh.exec:\bbntbh.exe59⤵
- Executes dropped EXE
PID:2364 -
\??\c:\bttbtb.exec:\bttbtb.exe60⤵
- Executes dropped EXE
PID:1192 -
\??\c:\dddjd.exec:\dddjd.exe61⤵
- Executes dropped EXE
PID:780 -
\??\c:\jdvjv.exec:\jdvjv.exe62⤵
- Executes dropped EXE
PID:676 -
\??\c:\frffrrf.exec:\frffrrf.exe63⤵
- Executes dropped EXE
PID:868 -
\??\c:\fxlxfll.exec:\fxlxfll.exe64⤵
- Executes dropped EXE
PID:2220 -
\??\c:\hthntb.exec:\hthntb.exe65⤵
- Executes dropped EXE
PID:2144 -
\??\c:\7nhnbb.exec:\7nhnbb.exe66⤵PID:1252
-
\??\c:\pjppd.exec:\pjppd.exe67⤵PID:1676
-
\??\c:\1vdvd.exec:\1vdvd.exe68⤵PID:2360
-
\??\c:\9ddjj.exec:\9ddjj.exe69⤵PID:2848
-
\??\c:\rlfrxfr.exec:\rlfrxfr.exe70⤵PID:2940
-
\??\c:\rlxffrf.exec:\rlxffrf.exe71⤵PID:2932
-
\??\c:\1tnbbn.exec:\1tnbbn.exe72⤵PID:2240
-
\??\c:\nhhttt.exec:\nhhttt.exe73⤵PID:3008
-
\??\c:\ddppp.exec:\ddppp.exe74⤵PID:2464
-
\??\c:\vpdjd.exec:\vpdjd.exe75⤵PID:2068
-
\??\c:\ffrxllr.exec:\ffrxllr.exe76⤵PID:2032
-
\??\c:\5xrfllx.exec:\5xrfllx.exe77⤵PID:2576
-
\??\c:\7frlrfr.exec:\7frlrfr.exe78⤵PID:2644
-
\??\c:\5thhnt.exec:\5thhnt.exe79⤵PID:2716
-
\??\c:\9hhtht.exec:\9hhtht.exe80⤵PID:2512
-
\??\c:\pdvpj.exec:\pdvpj.exe81⤵PID:2516
-
\??\c:\jjvjv.exec:\jjvjv.exe82⤵PID:2648
-
\??\c:\9dppv.exec:\9dppv.exe83⤵PID:2656
-
\??\c:\lxrffll.exec:\lxrffll.exe84⤵PID:2572
-
\??\c:\xfrxfrf.exec:\xfrxfrf.exe85⤵PID:2808
-
\??\c:\bbnbhh.exec:\bbnbhh.exe86⤵PID:2380
-
\??\c:\tnbhnn.exec:\tnbhnn.exe87⤵PID:2800
-
\??\c:\jdpvp.exec:\jdpvp.exe88⤵PID:2140
-
\??\c:\vjddd.exec:\vjddd.exe89⤵PID:2804
-
\??\c:\9frxffr.exec:\9frxffr.exe90⤵PID:1360
-
\??\c:\frrrllf.exec:\frrrllf.exe91⤵PID:2308
-
\??\c:\hbtbhh.exec:\hbtbhh.exe92⤵PID:764
-
\??\c:\nntbtt.exec:\nntbtt.exe93⤵PID:1632
-
\??\c:\dvdvd.exec:\dvdvd.exe94⤵PID:1212
-
\??\c:\jdjpd.exec:\jdjpd.exe95⤵PID:2768
-
\??\c:\1rlxffr.exec:\1rlxffr.exe96⤵PID:1832
-
\??\c:\rfrxllx.exec:\rfrxllx.exe97⤵PID:1580
-
\??\c:\5nhthn.exec:\5nhthn.exe98⤵PID:2424
-
\??\c:\flrrrll.exec:\flrrrll.exe99⤵PID:1444
-
\??\c:\hbtntt.exec:\hbtntt.exe100⤵PID:2112
-
\??\c:\dpddv.exec:\dpddv.exe101⤵PID:1968
-
\??\c:\dvddj.exec:\dvddj.exe102⤵PID:2076
-
\??\c:\rllxrxr.exec:\rllxrxr.exe103⤵PID:1192
-
\??\c:\9fxlxxf.exec:\9fxlxxf.exe104⤵PID:780
-
\??\c:\btnbhh.exec:\btnbhh.exe105⤵PID:540
-
\??\c:\hbnntb.exec:\hbnntb.exe106⤵PID:868
-
\??\c:\ppvdp.exec:\ppvdp.exe107⤵PID:2452
-
\??\c:\9vvjd.exec:\9vvjd.exe108⤵PID:2144
-
\??\c:\7jvvv.exec:\7jvvv.exe109⤵PID:412
-
\??\c:\lfxxllf.exec:\lfxxllf.exe110⤵PID:1676
-
\??\c:\frrrxff.exec:\frrrxff.exe111⤵PID:2992
-
\??\c:\btthnn.exec:\btthnn.exe112⤵PID:1476
-
\??\c:\nhntbn.exec:\nhntbn.exe113⤵PID:572
-
\??\c:\vdjjd.exec:\vdjjd.exe114⤵PID:2932
-
\??\c:\dpvdv.exec:\dpvdv.exe115⤵PID:896
-
\??\c:\frrlrfl.exec:\frrlrfl.exe116⤵PID:1744
-
\??\c:\fxllxfl.exec:\fxllxfl.exe117⤵PID:2216
-
\??\c:\9fllrlr.exec:\9fllrlr.exe118⤵PID:2492
-
\??\c:\1nthnn.exec:\1nthnn.exe119⤵PID:1520
-
\??\c:\vjddd.exec:\vjddd.exe120⤵PID:2856
-
\??\c:\7vddd.exec:\7vddd.exe121⤵PID:2592
-
\??\c:\3jpjp.exec:\3jpjp.exe122⤵PID:2844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-