Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 15:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ed5d0cae4083465925ba0602c82fc9c0_NEIKI.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
ed5d0cae4083465925ba0602c82fc9c0_NEIKI.exe
-
Size
95KB
-
MD5
ed5d0cae4083465925ba0602c82fc9c0
-
SHA1
4971b37abd9b9a064b1ba4dcc2db759b16d7d5bc
-
SHA256
49d3f219d99cc969cab53cade411d4d5d1f67d46305d6b73cf08b22f6307b9a0
-
SHA512
bd68118213fb1b206cbdc94f1afed17130dd49e2e148ead9237090b5d8d5f2d9ff0c867f98feb93b0e7158fdd8c8d4d481db6e28747976272fe2505b19a87aa6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/2CC:ymb3NkkiQ3mdBjFo73PYP1lri3K8GwyV
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2232-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1548-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1056-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1232-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1164-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/324-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1224-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/856-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2036 xllllll.exe 2868 tbttbn.exe 2680 3jdjj.exe 2604 3jvpd.exe 2508 rlxxffx.exe 2644 rllflfr.exe 2492 nbntbb.exe 2984 hbnthn.exe 3000 btbbtn.exe 2712 pdvpp.exe 856 9dvvv.exe 1716 1jpvv.exe 2192 7flffxf.exe 2792 rlxrxxf.exe 876 hhntbt.exe 1548 nbnnnh.exe 2016 vjvjj.exe 1224 djvvd.exe 2456 xrfxffr.exe 324 bthtnh.exe 1164 hbbbhn.exe 1520 nhbhhh.exe 844 pjvdj.exe 1056 djppp.exe 840 xrfxxxf.exe 112 xlrxxff.exe 1800 bntnhb.exe 2120 7tnthh.exe 1232 1dpvj.exe 1280 jvdvv.exe 2256 rrlrllf.exe 2956 9xllxxl.exe 1704 thtntt.exe 1624 nhhhtt.exe 1320 bnnnnn.exe 2720 dvdvj.exe 1156 1vpdj.exe 2812 xlllrll.exe 2516 1xxxxrr.exe 2576 btbhnn.exe 2768 nbbbtt.exe 2996 7htbhb.exe 2616 3pjpj.exe 1900 pdjjd.exe 1644 5rffxxf.exe 2772 3xlxxll.exe 1912 lfllrll.exe 2700 htttnn.exe 2820 nhnnnt.exe 2088 nhnnbb.exe 2404 vjjjj.exe 1768 pvdpj.exe 2876 jdvvd.exe 1220 xlfflff.exe 2276 rlxrlll.exe 784 fxrxlrr.exe 1604 tbnhnh.exe 2752 7ntttn.exe 560 lfrlfxx.exe 2972 3flflfl.exe 648 7tbbtt.exe 1060 bntntt.exe 1080 tnbttb.exe 1208 9djjp.exe -
resource yara_rule behavioral1/memory/2232-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1232-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1164-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/324-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1224-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/856-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-43-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2036 2232 ed5d0cae4083465925ba0602c82fc9c0_NEIKI.exe 28 PID 2232 wrote to memory of 2036 2232 ed5d0cae4083465925ba0602c82fc9c0_NEIKI.exe 28 PID 2232 wrote to memory of 2036 2232 ed5d0cae4083465925ba0602c82fc9c0_NEIKI.exe 28 PID 2232 wrote to memory of 2036 2232 ed5d0cae4083465925ba0602c82fc9c0_NEIKI.exe 28 PID 2036 wrote to memory of 2868 2036 xllllll.exe 29 PID 2036 wrote to memory of 2868 2036 xllllll.exe 29 PID 2036 wrote to memory of 2868 2036 xllllll.exe 29 PID 2036 wrote to memory of 2868 2036 xllllll.exe 29 PID 2868 wrote to memory of 2680 2868 tbttbn.exe 30 PID 2868 wrote to memory of 2680 2868 tbttbn.exe 30 PID 2868 wrote to memory of 2680 2868 tbttbn.exe 30 PID 2868 wrote to memory of 2680 2868 tbttbn.exe 30 PID 2680 wrote to memory of 2604 2680 3jdjj.exe 31 PID 2680 wrote to memory of 2604 2680 3jdjj.exe 31 PID 2680 wrote to memory of 2604 2680 3jdjj.exe 31 PID 2680 wrote to memory of 2604 2680 3jdjj.exe 31 PID 2604 wrote to memory of 2508 2604 3jvpd.exe 32 PID 2604 wrote to memory of 2508 2604 3jvpd.exe 32 PID 2604 wrote to memory of 2508 2604 3jvpd.exe 32 PID 2604 wrote to memory of 2508 2604 3jvpd.exe 32 PID 2508 wrote to memory of 2644 2508 rlxxffx.exe 33 PID 2508 wrote to memory of 2644 2508 rlxxffx.exe 33 PID 2508 wrote to memory of 2644 2508 rlxxffx.exe 33 PID 2508 wrote to memory of 2644 2508 rlxxffx.exe 33 PID 2644 wrote to memory of 2492 2644 rllflfr.exe 34 PID 2644 wrote to memory of 2492 2644 rllflfr.exe 34 PID 2644 wrote to memory of 2492 2644 rllflfr.exe 34 PID 2644 wrote to memory of 2492 2644 rllflfr.exe 34 PID 2492 wrote to memory of 2984 2492 nbntbb.exe 35 PID 2492 wrote to memory of 2984 2492 nbntbb.exe 35 PID 2492 wrote to memory of 2984 2492 nbntbb.exe 35 PID 2492 wrote to memory of 2984 2492 nbntbb.exe 35 PID 2984 wrote to memory of 3000 2984 hbnthn.exe 36 PID 2984 wrote to memory of 3000 2984 hbnthn.exe 36 PID 2984 wrote to memory of 3000 2984 hbnthn.exe 36 PID 2984 wrote to memory of 3000 2984 hbnthn.exe 36 PID 3000 wrote to memory of 2712 3000 btbbtn.exe 37 PID 3000 wrote to memory of 2712 3000 btbbtn.exe 37 PID 3000 wrote to memory of 2712 3000 btbbtn.exe 37 PID 3000 wrote to memory of 2712 3000 btbbtn.exe 37 PID 2712 wrote to memory of 856 2712 pdvpp.exe 38 PID 2712 wrote to memory of 856 2712 pdvpp.exe 38 PID 2712 wrote to memory of 856 2712 pdvpp.exe 38 PID 2712 wrote to memory of 856 2712 pdvpp.exe 38 PID 856 wrote to memory of 1716 856 9dvvv.exe 39 PID 856 wrote to memory of 1716 856 9dvvv.exe 39 PID 856 wrote to memory of 1716 856 9dvvv.exe 39 PID 856 wrote to memory of 1716 856 9dvvv.exe 39 PID 1716 wrote to memory of 2192 1716 1jpvv.exe 40 PID 1716 wrote to memory of 2192 1716 1jpvv.exe 40 PID 1716 wrote to memory of 2192 1716 1jpvv.exe 40 PID 1716 wrote to memory of 2192 1716 1jpvv.exe 40 PID 2192 wrote to memory of 2792 2192 7flffxf.exe 41 PID 2192 wrote to memory of 2792 2192 7flffxf.exe 41 PID 2192 wrote to memory of 2792 2192 7flffxf.exe 41 PID 2192 wrote to memory of 2792 2192 7flffxf.exe 41 PID 2792 wrote to memory of 876 2792 rlxrxxf.exe 42 PID 2792 wrote to memory of 876 2792 rlxrxxf.exe 42 PID 2792 wrote to memory of 876 2792 rlxrxxf.exe 42 PID 2792 wrote to memory of 876 2792 rlxrxxf.exe 42 PID 876 wrote to memory of 1548 876 hhntbt.exe 43 PID 876 wrote to memory of 1548 876 hhntbt.exe 43 PID 876 wrote to memory of 1548 876 hhntbt.exe 43 PID 876 wrote to memory of 1548 876 hhntbt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed5d0cae4083465925ba0602c82fc9c0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\ed5d0cae4083465925ba0602c82fc9c0_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\xllllll.exec:\xllllll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\tbttbn.exec:\tbttbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\3jdjj.exec:\3jdjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\3jvpd.exec:\3jvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\rlxxffx.exec:\rlxxffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\rllflfr.exec:\rllflfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\nbntbb.exec:\nbntbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\hbnthn.exec:\hbnthn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\btbbtn.exec:\btbbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\pdvpp.exec:\pdvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\9dvvv.exec:\9dvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\1jpvv.exec:\1jpvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\7flffxf.exec:\7flffxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\hhntbt.exec:\hhntbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\nbnnnh.exec:\nbnnnh.exe17⤵
- Executes dropped EXE
PID:1548 -
\??\c:\vjvjj.exec:\vjvjj.exe18⤵
- Executes dropped EXE
PID:2016 -
\??\c:\djvvd.exec:\djvvd.exe19⤵
- Executes dropped EXE
PID:1224 -
\??\c:\xrfxffr.exec:\xrfxffr.exe20⤵
- Executes dropped EXE
PID:2456 -
\??\c:\bthtnh.exec:\bthtnh.exe21⤵
- Executes dropped EXE
PID:324 -
\??\c:\hbbbhn.exec:\hbbbhn.exe22⤵
- Executes dropped EXE
PID:1164 -
\??\c:\nhbhhh.exec:\nhbhhh.exe23⤵
- Executes dropped EXE
PID:1520 -
\??\c:\pjvdj.exec:\pjvdj.exe24⤵
- Executes dropped EXE
PID:844 -
\??\c:\djppp.exec:\djppp.exe25⤵
- Executes dropped EXE
PID:1056 -
\??\c:\xrfxxxf.exec:\xrfxxxf.exe26⤵
- Executes dropped EXE
PID:840 -
\??\c:\xlrxxff.exec:\xlrxxff.exe27⤵
- Executes dropped EXE
PID:112 -
\??\c:\bntnhb.exec:\bntnhb.exe28⤵
- Executes dropped EXE
PID:1800 -
\??\c:\7tnthh.exec:\7tnthh.exe29⤵
- Executes dropped EXE
PID:2120 -
\??\c:\1dpvj.exec:\1dpvj.exe30⤵
- Executes dropped EXE
PID:1232 -
\??\c:\jvdvv.exec:\jvdvv.exe31⤵
- Executes dropped EXE
PID:1280 -
\??\c:\rrlrllf.exec:\rrlrllf.exe32⤵
- Executes dropped EXE
PID:2256 -
\??\c:\9xllxxl.exec:\9xllxxl.exe33⤵
- Executes dropped EXE
PID:2956 -
\??\c:\thtntt.exec:\thtntt.exe34⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nhhhtt.exec:\nhhhtt.exe35⤵
- Executes dropped EXE
PID:1624 -
\??\c:\bnnnnn.exec:\bnnnnn.exe36⤵
- Executes dropped EXE
PID:1320 -
\??\c:\dvdvj.exec:\dvdvj.exe37⤵
- Executes dropped EXE
PID:2720 -
\??\c:\1vpdj.exec:\1vpdj.exe38⤵
- Executes dropped EXE
PID:1156 -
\??\c:\xlllrll.exec:\xlllrll.exe39⤵
- Executes dropped EXE
PID:2812 -
\??\c:\1xxxxrr.exec:\1xxxxrr.exe40⤵
- Executes dropped EXE
PID:2516 -
\??\c:\btbhnn.exec:\btbhnn.exe41⤵
- Executes dropped EXE
PID:2576 -
\??\c:\nbbbtt.exec:\nbbbtt.exe42⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7htbhb.exec:\7htbhb.exe43⤵
- Executes dropped EXE
PID:2996 -
\??\c:\3pjpj.exec:\3pjpj.exe44⤵
- Executes dropped EXE
PID:2616 -
\??\c:\pdjjd.exec:\pdjjd.exe45⤵
- Executes dropped EXE
PID:1900 -
\??\c:\5rffxxf.exec:\5rffxxf.exe46⤵
- Executes dropped EXE
PID:1644 -
\??\c:\3xlxxll.exec:\3xlxxll.exe47⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lfllrll.exec:\lfllrll.exe48⤵
- Executes dropped EXE
PID:1912 -
\??\c:\htttnn.exec:\htttnn.exe49⤵
- Executes dropped EXE
PID:2700 -
\??\c:\nhnnnt.exec:\nhnnnt.exe50⤵
- Executes dropped EXE
PID:2820 -
\??\c:\nhnnbb.exec:\nhnnbb.exe51⤵
- Executes dropped EXE
PID:2088 -
\??\c:\vjjjj.exec:\vjjjj.exe52⤵
- Executes dropped EXE
PID:2404 -
\??\c:\pvdpj.exec:\pvdpj.exe53⤵
- Executes dropped EXE
PID:1768 -
\??\c:\jdvvd.exec:\jdvvd.exe54⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xlfflff.exec:\xlfflff.exe55⤵
- Executes dropped EXE
PID:1220 -
\??\c:\rlxrlll.exec:\rlxrlll.exe56⤵
- Executes dropped EXE
PID:2276 -
\??\c:\fxrxlrr.exec:\fxrxlrr.exe57⤵
- Executes dropped EXE
PID:784 -
\??\c:\tbnhnh.exec:\tbnhnh.exe58⤵
- Executes dropped EXE
PID:1604 -
\??\c:\7ntttn.exec:\7ntttn.exe59⤵
- Executes dropped EXE
PID:2752 -
\??\c:\lfrlfxx.exec:\lfrlfxx.exe60⤵
- Executes dropped EXE
PID:560 -
\??\c:\3flflfl.exec:\3flflfl.exe61⤵
- Executes dropped EXE
PID:2972 -
\??\c:\7tbbtt.exec:\7tbbtt.exe62⤵
- Executes dropped EXE
PID:648 -
\??\c:\bntntt.exec:\bntntt.exe63⤵
- Executes dropped EXE
PID:1060 -
\??\c:\tnbttb.exec:\tnbttb.exe64⤵
- Executes dropped EXE
PID:1080 -
\??\c:\9djjp.exec:\9djjp.exe65⤵
- Executes dropped EXE
PID:1208 -
\??\c:\pjpvj.exec:\pjpvj.exe66⤵PID:2024
-
\??\c:\3jpjv.exec:\3jpjv.exe67⤵PID:2556
-
\??\c:\frlrrrr.exec:\frlrrrr.exe68⤵PID:1732
-
\??\c:\rfxfxxx.exec:\rfxfxxx.exe69⤵PID:1992
-
\??\c:\9lflrfr.exec:\9lflrfr.exe70⤵PID:2228
-
\??\c:\3nbbhh.exec:\3nbbhh.exe71⤵PID:2244
-
\??\c:\hbthtt.exec:\hbthtt.exe72⤵PID:3024
-
\??\c:\nhnthn.exec:\nhnthn.exe73⤵PID:1720
-
\??\c:\pdvdp.exec:\pdvdp.exe74⤵PID:2612
-
\??\c:\5dvjj.exec:\5dvjj.exe75⤵PID:2692
-
\??\c:\dvdvj.exec:\dvdvj.exe76⤵PID:2896
-
\??\c:\pjdpv.exec:\pjdpv.exe77⤵PID:2892
-
\??\c:\frrlrrr.exec:\frrlrrr.exe78⤵PID:2572
-
\??\c:\xrxflrx.exec:\xrxflrx.exe79⤵PID:2764
-
\??\c:\3xllrxl.exec:\3xllrxl.exe80⤵PID:2080
-
\??\c:\nbnnnh.exec:\nbnnnh.exe81⤵PID:3056
-
\??\c:\hbtbtn.exec:\hbtbtn.exe82⤵PID:2232
-
\??\c:\7htttt.exec:\7htttt.exe83⤵PID:2800
-
\??\c:\jvdpv.exec:\jvdpv.exe84⤵PID:2832
-
\??\c:\pjdvd.exec:\pjdvd.exe85⤵PID:1416
-
\??\c:\5pvvd.exec:\5pvvd.exe86⤵PID:2200
-
\??\c:\dvjpv.exec:\dvjpv.exe87⤵PID:1700
-
\??\c:\rlrxxxf.exec:\rlrxxxf.exe88⤵PID:2528
-
\??\c:\xxfxrxf.exec:\xxfxrxf.exe89⤵PID:2816
-
\??\c:\9rfflxx.exec:\9rfflxx.exe90⤵PID:2700
-
\??\c:\bnttbh.exec:\bnttbh.exe91⤵PID:2820
-
\??\c:\1htnnt.exec:\1htnnt.exe92⤵PID:2088
-
\??\c:\nbnthb.exec:\nbnthb.exe93⤵PID:2404
-
\??\c:\dppdd.exec:\dppdd.exe94⤵PID:1768
-
\??\c:\9dppp.exec:\9dppp.exe95⤵PID:2876
-
\??\c:\jvpjj.exec:\jvpjj.exe96⤵PID:1220
-
\??\c:\jdpjj.exec:\jdpjj.exe97⤵PID:536
-
\??\c:\5lxlfrl.exec:\5lxlfrl.exe98⤵PID:2656
-
\??\c:\7lxxxxf.exec:\7lxxxxf.exe99⤵PID:1980
-
\??\c:\rffxxxf.exec:\rffxxxf.exe100⤵PID:2560
-
\??\c:\bnbbhn.exec:\bnbbhn.exe101⤵PID:2852
-
\??\c:\9bnhhb.exec:\9bnhhb.exe102⤵PID:2856
-
\??\c:\nhhhtn.exec:\nhhhtn.exe103⤵PID:1112
-
\??\c:\5nbhbh.exec:\5nbhbh.exe104⤵PID:2128
-
\??\c:\ppvvd.exec:\ppvvd.exe105⤵PID:2292
-
\??\c:\vdppp.exec:\vdppp.exe106⤵PID:1504
-
\??\c:\3jvpp.exec:\3jvpp.exe107⤵PID:1168
-
\??\c:\flxxxff.exec:\flxxxff.exe108⤵PID:572
-
\??\c:\7rllrlr.exec:\7rllrlr.exe109⤵PID:2008
-
\??\c:\lflfrxx.exec:\lflfrxx.exe110⤵PID:1136
-
\??\c:\5bhntt.exec:\5bhntt.exe111⤵PID:2392
-
\??\c:\btbbtb.exec:\btbbtb.exe112⤵PID:2408
-
\??\c:\7nhbbn.exec:\7nhbbn.exe113⤵PID:1612
-
\??\c:\7pvvv.exec:\7pvvv.exe114⤵PID:3024
-
\??\c:\jvppv.exec:\jvppv.exe115⤵PID:2672
-
\??\c:\pdjjv.exec:\pdjjv.exe116⤵PID:2724
-
\??\c:\fxffrlr.exec:\fxffrlr.exe117⤵PID:2380
-
\??\c:\rlrrrlr.exec:\rlrrrlr.exe118⤵PID:2604
-
\??\c:\nhbbbb.exec:\nhbbbb.exe119⤵PID:2512
-
\??\c:\btbnnt.exec:\btbnnt.exe120⤵PID:2472
-
\??\c:\nhhnnn.exec:\nhhnnn.exe121⤵PID:2644
-
\??\c:\pjddj.exec:\pjddj.exe122⤵PID:2492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-