Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 10:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6fdb54431bd0213071e72f9c5d879b90_NEIKI.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
6fdb54431bd0213071e72f9c5d879b90_NEIKI.exe
-
Size
70KB
-
MD5
6fdb54431bd0213071e72f9c5d879b90
-
SHA1
033914eb0fcab854ac9798acc33066af65133cf5
-
SHA256
bd6d2a318f19b6e573bd5ff7597ba7b1abc991da1819c12b24d2a64ee7372687
-
SHA512
b52ed78bf0ba0b93da7acbbc1e70ad91ca9083cfda438d43fcbc25069c2c647b401ba544d3e7db6da35f8e650c6853b8294e20c4ef6c92035c246fe561652d39
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgUVyiAn7:ymb3NkkiQ3mdBjFIgUE5
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2220-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2864-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/344-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/540-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/832-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1200-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2220 bbhhth.exe 2700 vdpvj.exe 2680 xrlfllx.exe 2536 9hbhbn.exe 2732 vvvvp.exe 1620 ffffrxl.exe 2696 hbnbnb.exe 2576 ttbbbn.exe 2440 jvddv.exe 2864 pjddj.exe 1832 llrxfxf.exe 1636 5ttbnb.exe 344 btthtn.exe 1812 1pjdj.exe 1916 pjdvj.exe 2344 xlxxlxx.exe 1756 nnhnbh.exe 1032 7nhbnn.exe 2968 jdpvp.exe 1628 fxxxlxf.exe 540 hhhnth.exe 832 tbbhtn.exe 2116 vpjvv.exe 1200 7rfxllx.exe 2348 1rrxlrf.exe 1564 bhbntn.exe 1864 pppvj.exe 3016 rrlfxxl.exe 2308 ffrfrxl.exe 3004 tttbth.exe 2940 dddjv.exe 2364 jdjvd.exe 2244 rrlxlrl.exe 2844 ffxflrf.exe 2056 nhbhhn.exe 2624 bbbbnb.exe 2500 vpdjj.exe 2548 9ffrfrl.exe 2856 xfxlffx.exe 2532 ttnbtb.exe 2596 nnhnbh.exe 2416 jjpdp.exe 2716 1dpvd.exe 2408 3fxllrx.exe 2484 xxrlrfx.exe 2456 btnnnb.exe 2840 bbthbh.exe 1800 ppjpv.exe 1600 jdvvv.exe 2340 jddpd.exe 2372 xrfrrfl.exe 2032 btbhth.exe 2004 bnhttt.exe 1264 jdvvj.exe 2344 vvvjv.exe 1372 fffxffr.exe 2300 xfllrll.exe 2504 1nnnhb.exe 2396 bbbbht.exe 716 5vpdd.exe 684 dvjdj.exe 1432 ffllrrf.exe 2116 rlxxxrx.exe 2848 nhhthb.exe -
resource yara_rule behavioral1/memory/2220-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2864-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/344-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/540-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/832-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-287-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2220 2824 6fdb54431bd0213071e72f9c5d879b90_NEIKI.exe 28 PID 2824 wrote to memory of 2220 2824 6fdb54431bd0213071e72f9c5d879b90_NEIKI.exe 28 PID 2824 wrote to memory of 2220 2824 6fdb54431bd0213071e72f9c5d879b90_NEIKI.exe 28 PID 2824 wrote to memory of 2220 2824 6fdb54431bd0213071e72f9c5d879b90_NEIKI.exe 28 PID 2220 wrote to memory of 2700 2220 bbhhth.exe 29 PID 2220 wrote to memory of 2700 2220 bbhhth.exe 29 PID 2220 wrote to memory of 2700 2220 bbhhth.exe 29 PID 2220 wrote to memory of 2700 2220 bbhhth.exe 29 PID 2700 wrote to memory of 2680 2700 vdpvj.exe 30 PID 2700 wrote to memory of 2680 2700 vdpvj.exe 30 PID 2700 wrote to memory of 2680 2700 vdpvj.exe 30 PID 2700 wrote to memory of 2680 2700 vdpvj.exe 30 PID 2680 wrote to memory of 2536 2680 xrlfllx.exe 31 PID 2680 wrote to memory of 2536 2680 xrlfllx.exe 31 PID 2680 wrote to memory of 2536 2680 xrlfllx.exe 31 PID 2680 wrote to memory of 2536 2680 xrlfllx.exe 31 PID 2536 wrote to memory of 2732 2536 9hbhbn.exe 32 PID 2536 wrote to memory of 2732 2536 9hbhbn.exe 32 PID 2536 wrote to memory of 2732 2536 9hbhbn.exe 32 PID 2536 wrote to memory of 2732 2536 9hbhbn.exe 32 PID 2732 wrote to memory of 1620 2732 vvvvp.exe 33 PID 2732 wrote to memory of 1620 2732 vvvvp.exe 33 PID 2732 wrote to memory of 1620 2732 vvvvp.exe 33 PID 2732 wrote to memory of 1620 2732 vvvvp.exe 33 PID 1620 wrote to memory of 2696 1620 ffffrxl.exe 34 PID 1620 wrote to memory of 2696 1620 ffffrxl.exe 34 PID 1620 wrote to memory of 2696 1620 ffffrxl.exe 34 PID 1620 wrote to memory of 2696 1620 ffffrxl.exe 34 PID 2696 wrote to memory of 2576 2696 hbnbnb.exe 35 PID 2696 wrote to memory of 2576 2696 hbnbnb.exe 35 PID 2696 wrote to memory of 2576 2696 hbnbnb.exe 35 PID 2696 wrote to memory of 2576 2696 hbnbnb.exe 35 PID 2576 wrote to memory of 2440 2576 ttbbbn.exe 36 PID 2576 wrote to memory of 2440 2576 ttbbbn.exe 36 PID 2576 wrote to memory of 2440 2576 ttbbbn.exe 36 PID 2576 wrote to memory of 2440 2576 ttbbbn.exe 36 PID 2440 wrote to memory of 2864 2440 jvddv.exe 37 PID 2440 wrote to memory of 2864 2440 jvddv.exe 37 PID 2440 wrote to memory of 2864 2440 jvddv.exe 37 PID 2440 wrote to memory of 2864 2440 jvddv.exe 37 PID 2864 wrote to memory of 1832 2864 pjddj.exe 38 PID 2864 wrote to memory of 1832 2864 pjddj.exe 38 PID 2864 wrote to memory of 1832 2864 pjddj.exe 38 PID 2864 wrote to memory of 1832 2864 pjddj.exe 38 PID 1832 wrote to memory of 1636 1832 llrxfxf.exe 39 PID 1832 wrote to memory of 1636 1832 llrxfxf.exe 39 PID 1832 wrote to memory of 1636 1832 llrxfxf.exe 39 PID 1832 wrote to memory of 1636 1832 llrxfxf.exe 39 PID 1636 wrote to memory of 344 1636 5ttbnb.exe 40 PID 1636 wrote to memory of 344 1636 5ttbnb.exe 40 PID 1636 wrote to memory of 344 1636 5ttbnb.exe 40 PID 1636 wrote to memory of 344 1636 5ttbnb.exe 40 PID 344 wrote to memory of 1812 344 btthtn.exe 41 PID 344 wrote to memory of 1812 344 btthtn.exe 41 PID 344 wrote to memory of 1812 344 btthtn.exe 41 PID 344 wrote to memory of 1812 344 btthtn.exe 41 PID 1812 wrote to memory of 1916 1812 1pjdj.exe 42 PID 1812 wrote to memory of 1916 1812 1pjdj.exe 42 PID 1812 wrote to memory of 1916 1812 1pjdj.exe 42 PID 1812 wrote to memory of 1916 1812 1pjdj.exe 42 PID 1916 wrote to memory of 2344 1916 pjdvj.exe 43 PID 1916 wrote to memory of 2344 1916 pjdvj.exe 43 PID 1916 wrote to memory of 2344 1916 pjdvj.exe 43 PID 1916 wrote to memory of 2344 1916 pjdvj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fdb54431bd0213071e72f9c5d879b90_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\6fdb54431bd0213071e72f9c5d879b90_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\bbhhth.exec:\bbhhth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\vdpvj.exec:\vdpvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\xrlfllx.exec:\xrlfllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\9hbhbn.exec:\9hbhbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\vvvvp.exec:\vvvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\ffffrxl.exec:\ffffrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\hbnbnb.exec:\hbnbnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\ttbbbn.exec:\ttbbbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\jvddv.exec:\jvddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\pjddj.exec:\pjddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\llrxfxf.exec:\llrxfxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\5ttbnb.exec:\5ttbnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\btthtn.exec:\btthtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\1pjdj.exec:\1pjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\pjdvj.exec:\pjdvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\xlxxlxx.exec:\xlxxlxx.exe17⤵
- Executes dropped EXE
PID:2344 -
\??\c:\nnhnbh.exec:\nnhnbh.exe18⤵
- Executes dropped EXE
PID:1756 -
\??\c:\7nhbnn.exec:\7nhbnn.exe19⤵
- Executes dropped EXE
PID:1032 -
\??\c:\jdpvp.exec:\jdpvp.exe20⤵
- Executes dropped EXE
PID:2968 -
\??\c:\fxxxlxf.exec:\fxxxlxf.exe21⤵
- Executes dropped EXE
PID:1628 -
\??\c:\hhhnth.exec:\hhhnth.exe22⤵
- Executes dropped EXE
PID:540 -
\??\c:\tbbhtn.exec:\tbbhtn.exe23⤵
- Executes dropped EXE
PID:832 -
\??\c:\vpjvv.exec:\vpjvv.exe24⤵
- Executes dropped EXE
PID:2116 -
\??\c:\7rfxllx.exec:\7rfxllx.exe25⤵
- Executes dropped EXE
PID:1200 -
\??\c:\1rrxlrf.exec:\1rrxlrf.exe26⤵
- Executes dropped EXE
PID:2348 -
\??\c:\bhbntn.exec:\bhbntn.exe27⤵
- Executes dropped EXE
PID:1564 -
\??\c:\pppvj.exec:\pppvj.exe28⤵
- Executes dropped EXE
PID:1864 -
\??\c:\rrlfxxl.exec:\rrlfxxl.exe29⤵
- Executes dropped EXE
PID:3016 -
\??\c:\ffrfrxl.exec:\ffrfrxl.exe30⤵
- Executes dropped EXE
PID:2308 -
\??\c:\tttbth.exec:\tttbth.exe31⤵
- Executes dropped EXE
PID:3004 -
\??\c:\dddjv.exec:\dddjv.exe32⤵
- Executes dropped EXE
PID:2940 -
\??\c:\jdjvd.exec:\jdjvd.exe33⤵
- Executes dropped EXE
PID:2364 -
\??\c:\rrlxlrl.exec:\rrlxlrl.exe34⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ffxflrf.exec:\ffxflrf.exe35⤵
- Executes dropped EXE
PID:2844 -
\??\c:\nhbhhn.exec:\nhbhhn.exe36⤵
- Executes dropped EXE
PID:2056 -
\??\c:\bbbbnb.exec:\bbbbnb.exe37⤵
- Executes dropped EXE
PID:2624 -
\??\c:\vpdjj.exec:\vpdjj.exe38⤵
- Executes dropped EXE
PID:2500 -
\??\c:\9ffrfrl.exec:\9ffrfrl.exe39⤵
- Executes dropped EXE
PID:2548 -
\??\c:\xfxlffx.exec:\xfxlffx.exe40⤵
- Executes dropped EXE
PID:2856 -
\??\c:\ttnbtb.exec:\ttnbtb.exe41⤵
- Executes dropped EXE
PID:2532 -
\??\c:\nnhnbh.exec:\nnhnbh.exe42⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jjpdp.exec:\jjpdp.exe43⤵
- Executes dropped EXE
PID:2416 -
\??\c:\1dpvd.exec:\1dpvd.exe44⤵
- Executes dropped EXE
PID:2716 -
\??\c:\3fxllrx.exec:\3fxllrx.exe45⤵
- Executes dropped EXE
PID:2408 -
\??\c:\xxrlrfx.exec:\xxrlrfx.exe46⤵
- Executes dropped EXE
PID:2484 -
\??\c:\btnnnb.exec:\btnnnb.exe47⤵
- Executes dropped EXE
PID:2456 -
\??\c:\bbthbh.exec:\bbthbh.exe48⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ppjpv.exec:\ppjpv.exe49⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jdvvv.exec:\jdvvv.exe50⤵
- Executes dropped EXE
PID:1600 -
\??\c:\jddpd.exec:\jddpd.exe51⤵
- Executes dropped EXE
PID:2340 -
\??\c:\xrfrrfl.exec:\xrfrrfl.exe52⤵
- Executes dropped EXE
PID:2372 -
\??\c:\btbhth.exec:\btbhth.exe53⤵
- Executes dropped EXE
PID:2032 -
\??\c:\bnhttt.exec:\bnhttt.exe54⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jdvvj.exec:\jdvvj.exe55⤵
- Executes dropped EXE
PID:1264 -
\??\c:\vvvjv.exec:\vvvjv.exe56⤵
- Executes dropped EXE
PID:2344 -
\??\c:\fffxffr.exec:\fffxffr.exe57⤵
- Executes dropped EXE
PID:1372 -
\??\c:\xfllrll.exec:\xfllrll.exe58⤵
- Executes dropped EXE
PID:2300 -
\??\c:\1nnnhb.exec:\1nnnhb.exe59⤵
- Executes dropped EXE
PID:2504 -
\??\c:\bbbbht.exec:\bbbbht.exe60⤵
- Executes dropped EXE
PID:2396 -
\??\c:\5vpdd.exec:\5vpdd.exe61⤵
- Executes dropped EXE
PID:716 -
\??\c:\dvjdj.exec:\dvjdj.exe62⤵
- Executes dropped EXE
PID:684 -
\??\c:\ffllrrf.exec:\ffllrrf.exe63⤵
- Executes dropped EXE
PID:1432 -
\??\c:\rlxxxrx.exec:\rlxxxrx.exe64⤵
- Executes dropped EXE
PID:2116 -
\??\c:\nhhthb.exec:\nhhthb.exe65⤵
- Executes dropped EXE
PID:2848 -
\??\c:\ttntbb.exec:\ttntbb.exe66⤵PID:1204
-
\??\c:\dvdjd.exec:\dvdjd.exe67⤵PID:1084
-
\??\c:\jjdjj.exec:\jjdjj.exe68⤵PID:288
-
\??\c:\5rfxflr.exec:\5rfxflr.exe69⤵PID:2740
-
\??\c:\xlfrrxl.exec:\xlfrrxl.exe70⤵PID:3016
-
\??\c:\nbbhbn.exec:\nbbhbn.exe71⤵PID:3056
-
\??\c:\hbnnbb.exec:\hbnnbb.exe72⤵PID:2280
-
\??\c:\ppdjp.exec:\ppdjp.exe73⤵PID:2756
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe74⤵PID:2852
-
\??\c:\rxlrxfl.exec:\rxlrxfl.exe75⤵PID:1448
-
\??\c:\9rfxlfr.exec:\9rfxlfr.exe76⤵PID:1336
-
\??\c:\9btbnb.exec:\9btbnb.exe77⤵PID:1524
-
\??\c:\nthbnb.exec:\nthbnb.exe78⤵PID:1548
-
\??\c:\ddvjj.exec:\ddvjj.exe79⤵PID:1504
-
\??\c:\vpddj.exec:\vpddj.exe80⤵PID:2828
-
\??\c:\xxrrrxf.exec:\xxrrrxf.exe81⤵PID:2600
-
\??\c:\rrrxlxl.exec:\rrrxlxl.exe82⤵PID:2612
-
\??\c:\lfxlxrf.exec:\lfxlxrf.exe83⤵PID:2644
-
\??\c:\nnhtnh.exec:\nnhtnh.exe84⤵PID:2568
-
\??\c:\nbhbnn.exec:\nbhbnn.exe85⤵PID:2652
-
\??\c:\ddvpd.exec:\ddvpd.exe86⤵PID:2432
-
\??\c:\ppvdp.exec:\ppvdp.exe87⤵PID:2428
-
\??\c:\1xlxflr.exec:\1xlxflr.exe88⤵PID:2420
-
\??\c:\lllxllx.exec:\lllxllx.exe89⤵PID:2804
-
\??\c:\nthbnb.exec:\nthbnb.exe90⤵PID:2012
-
\??\c:\9btbhn.exec:\9btbhn.exe91⤵PID:1832
-
\??\c:\3hbnth.exec:\3hbnth.exe92⤵PID:2304
-
\??\c:\ppdpv.exec:\ppdpv.exe93⤵PID:1848
-
\??\c:\pppdp.exec:\pppdp.exe94⤵PID:2164
-
\??\c:\5flxrfr.exec:\5flxrfr.exe95⤵PID:2040
-
\??\c:\lrfrlrx.exec:\lrfrlrx.exe96⤵PID:380
-
\??\c:\hbbhbh.exec:\hbbhbh.exe97⤵PID:308
-
\??\c:\hhnbnb.exec:\hhnbnb.exe98⤵PID:1592
-
\??\c:\hhtbbb.exec:\hhtbbb.exe99⤵PID:2128
-
\??\c:\jjjvd.exec:\jjjvd.exe100⤵PID:2476
-
\??\c:\dpdvj.exec:\dpdvj.exe101⤵PID:2468
-
\??\c:\3fffxrl.exec:\3fffxrl.exe102⤵PID:1628
-
\??\c:\lxfrfrf.exec:\lxfrfrf.exe103⤵PID:1424
-
\??\c:\bhbbtt.exec:\bhbbtt.exe104⤵PID:1900
-
\??\c:\hbttbb.exec:\hbttbb.exe105⤵PID:328
-
\??\c:\nhtntb.exec:\nhtntb.exe106⤵PID:272
-
\??\c:\dddjv.exec:\dddjv.exe107⤵PID:2972
-
\??\c:\vppdj.exec:\vppdj.exe108⤵PID:2248
-
\??\c:\lllfrxl.exec:\lllfrxl.exe109⤵PID:1556
-
\??\c:\7rrxlxl.exec:\7rrxlxl.exe110⤵PID:1976
-
\??\c:\fxxlxfx.exec:\fxxlxfx.exe111⤵PID:720
-
\??\c:\5bbntb.exec:\5bbntb.exe112⤵PID:1612
-
\??\c:\htntnn.exec:\htntnn.exe113⤵PID:2712
-
\??\c:\pjdjp.exec:\pjdjp.exe114⤵PID:1020
-
\??\c:\3vdvv.exec:\3vdvv.exe115⤵PID:1668
-
\??\c:\fxrrxfx.exec:\fxrrxfx.exe116⤵PID:2224
-
\??\c:\lllfllx.exec:\lllfllx.exe117⤵PID:2824
-
\??\c:\btnhhh.exec:\btnhhh.exe118⤵PID:2220
-
\??\c:\bbhtth.exec:\bbhtth.exe119⤵PID:2064
-
\??\c:\7jpdd.exec:\7jpdd.exe120⤵PID:2216
-
\??\c:\jvddd.exec:\jvddd.exe121⤵PID:2700
-
\??\c:\ffxfllr.exec:\ffxfllr.exe122⤵PID:2800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-