Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 19:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2159b259021c83fd27bbf30c54074750_NEIKI.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
2159b259021c83fd27bbf30c54074750_NEIKI.exe
-
Size
447KB
-
MD5
2159b259021c83fd27bbf30c54074750
-
SHA1
2d94d80a50bb0ed9db2f3a49ee851b27b2dbad62
-
SHA256
8b05b4fa81c06919fb40133cdbe4f65c2062af87814f382a1b0647b697e891cb
-
SHA512
6cd4a3c47b2ee61630283d7f6856073bfb80362cf90d41bdac841381f20c308ad8051599de38a9f6fe8ddf56e81b36c55dc3c5313018c2ab81feca67133b87fc
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq78yoyfx93sEqkeGLk:n3C9yMo+S0L9xRnoq7H9xqYLk
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2768-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3056-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/908-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/940-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/580-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/900-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1356-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2632 tvlxvt.exe 3056 ddbbdxn.exe 2504 hxbfvlr.exe 2516 bljbv.exe 2628 bbfpt.exe 2664 nxndphn.exe 2360 thxxlx.exe 2780 hbrlxh.exe 2340 xdptlhl.exe 2180 pdtbv.exe 2428 lvtnt.exe 2684 xtrjjx.exe 1724 tvfxldn.exe 2228 ltjnhxh.exe 908 djtddf.exe 1740 nxndx.exe 940 rjppp.exe 1512 hfdjvrt.exe 1756 prvjpv.exe 580 phxjxr.exe 2224 tlfrl.exe 1244 jrbtdb.exe 476 xbnxtfb.exe 2116 hhtxdbd.exe 1088 lfvvdt.exe 1316 tthhjr.exe 1792 prfjbx.exe 900 bhrdtn.exe 1356 pxvxnf.exe 2284 hfpdftn.exe 2316 bvdjt.exe 1508 xxxjl.exe 2740 nhplh.exe 2636 xtvtjn.exe 2240 lxbfnnl.exe 1572 bdrth.exe 2844 hfrrhn.exe 3056 fxrbnpb.exe 2564 pdrdprv.exe 2504 flrxb.exe 2520 prbvv.exe 2596 bjbrnht.exe 1252 fxbnf.exe 2772 hlrhd.exe 2972 vnxlvf.exe 2544 hhvnjn.exe 1884 jdxhvrn.exe 2160 nxxftjx.exe 2592 lxbdv.exe 1460 tdrlptb.exe 2684 hlppj.exe 2088 xhnltdn.exe 1772 nxvvxh.exe 2004 rnxvf.exe 1028 xbdjpd.exe 1400 ntdtl.exe 1468 bvxnttv.exe 528 rnjpv.exe 336 vdvrbx.exe 812 dhnxv.exe 788 txftnlx.exe 2224 dbdldbd.exe 1596 xtplpll.exe 2996 lxdrdx.exe -
resource yara_rule behavioral1/memory/2768-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3056-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/908-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/940-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/900-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1356-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2768 wrote to memory of 2632 2768 2159b259021c83fd27bbf30c54074750_NEIKI.exe 28 PID 2768 wrote to memory of 2632 2768 2159b259021c83fd27bbf30c54074750_NEIKI.exe 28 PID 2768 wrote to memory of 2632 2768 2159b259021c83fd27bbf30c54074750_NEIKI.exe 28 PID 2768 wrote to memory of 2632 2768 2159b259021c83fd27bbf30c54074750_NEIKI.exe 28 PID 2632 wrote to memory of 3056 2632 tvlxvt.exe 29 PID 2632 wrote to memory of 3056 2632 tvlxvt.exe 29 PID 2632 wrote to memory of 3056 2632 tvlxvt.exe 29 PID 2632 wrote to memory of 3056 2632 tvlxvt.exe 29 PID 3056 wrote to memory of 2504 3056 ddbbdxn.exe 30 PID 3056 wrote to memory of 2504 3056 ddbbdxn.exe 30 PID 3056 wrote to memory of 2504 3056 ddbbdxn.exe 30 PID 3056 wrote to memory of 2504 3056 ddbbdxn.exe 30 PID 2504 wrote to memory of 2516 2504 hxbfvlr.exe 31 PID 2504 wrote to memory of 2516 2504 hxbfvlr.exe 31 PID 2504 wrote to memory of 2516 2504 hxbfvlr.exe 31 PID 2504 wrote to memory of 2516 2504 hxbfvlr.exe 31 PID 2516 wrote to memory of 2628 2516 bljbv.exe 32 PID 2516 wrote to memory of 2628 2516 bljbv.exe 32 PID 2516 wrote to memory of 2628 2516 bljbv.exe 32 PID 2516 wrote to memory of 2628 2516 bljbv.exe 32 PID 2628 wrote to memory of 2664 2628 bbfpt.exe 33 PID 2628 wrote to memory of 2664 2628 bbfpt.exe 33 PID 2628 wrote to memory of 2664 2628 bbfpt.exe 33 PID 2628 wrote to memory of 2664 2628 bbfpt.exe 33 PID 2664 wrote to memory of 2360 2664 nxndphn.exe 34 PID 2664 wrote to memory of 2360 2664 nxndphn.exe 34 PID 2664 wrote to memory of 2360 2664 nxndphn.exe 34 PID 2664 wrote to memory of 2360 2664 nxndphn.exe 34 PID 2360 wrote to memory of 2780 2360 thxxlx.exe 35 PID 2360 wrote to memory of 2780 2360 thxxlx.exe 35 PID 2360 wrote to memory of 2780 2360 thxxlx.exe 35 PID 2360 wrote to memory of 2780 2360 thxxlx.exe 35 PID 2780 wrote to memory of 2340 2780 hbrlxh.exe 36 PID 2780 wrote to memory of 2340 2780 hbrlxh.exe 36 PID 2780 wrote to memory of 2340 2780 hbrlxh.exe 36 PID 2780 wrote to memory of 2340 2780 hbrlxh.exe 36 PID 2340 wrote to memory of 2180 2340 xdptlhl.exe 37 PID 2340 wrote to memory of 2180 2340 xdptlhl.exe 37 PID 2340 wrote to memory of 2180 2340 xdptlhl.exe 37 PID 2340 wrote to memory of 2180 2340 xdptlhl.exe 37 PID 2180 wrote to memory of 2428 2180 pdtbv.exe 38 PID 2180 wrote to memory of 2428 2180 pdtbv.exe 38 PID 2180 wrote to memory of 2428 2180 pdtbv.exe 38 PID 2180 wrote to memory of 2428 2180 pdtbv.exe 38 PID 2428 wrote to memory of 2684 2428 lvtnt.exe 39 PID 2428 wrote to memory of 2684 2428 lvtnt.exe 39 PID 2428 wrote to memory of 2684 2428 lvtnt.exe 39 PID 2428 wrote to memory of 2684 2428 lvtnt.exe 39 PID 2684 wrote to memory of 1724 2684 xtrjjx.exe 40 PID 2684 wrote to memory of 1724 2684 xtrjjx.exe 40 PID 2684 wrote to memory of 1724 2684 xtrjjx.exe 40 PID 2684 wrote to memory of 1724 2684 xtrjjx.exe 40 PID 1724 wrote to memory of 2228 1724 tvfxldn.exe 41 PID 1724 wrote to memory of 2228 1724 tvfxldn.exe 41 PID 1724 wrote to memory of 2228 1724 tvfxldn.exe 41 PID 1724 wrote to memory of 2228 1724 tvfxldn.exe 41 PID 2228 wrote to memory of 908 2228 ltjnhxh.exe 42 PID 2228 wrote to memory of 908 2228 ltjnhxh.exe 42 PID 2228 wrote to memory of 908 2228 ltjnhxh.exe 42 PID 2228 wrote to memory of 908 2228 ltjnhxh.exe 42 PID 908 wrote to memory of 1740 908 djtddf.exe 43 PID 908 wrote to memory of 1740 908 djtddf.exe 43 PID 908 wrote to memory of 1740 908 djtddf.exe 43 PID 908 wrote to memory of 1740 908 djtddf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2159b259021c83fd27bbf30c54074750_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\2159b259021c83fd27bbf30c54074750_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\tvlxvt.exec:\tvlxvt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\ddbbdxn.exec:\ddbbdxn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\hxbfvlr.exec:\hxbfvlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\bljbv.exec:\bljbv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\bbfpt.exec:\bbfpt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\nxndphn.exec:\nxndphn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\thxxlx.exec:\thxxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\hbrlxh.exec:\hbrlxh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\xdptlhl.exec:\xdptlhl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\pdtbv.exec:\pdtbv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\lvtnt.exec:\lvtnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\xtrjjx.exec:\xtrjjx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\tvfxldn.exec:\tvfxldn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\ltjnhxh.exec:\ltjnhxh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\djtddf.exec:\djtddf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\nxndx.exec:\nxndx.exe17⤵
- Executes dropped EXE
PID:1740 -
\??\c:\rjppp.exec:\rjppp.exe18⤵
- Executes dropped EXE
PID:940 -
\??\c:\hfdjvrt.exec:\hfdjvrt.exe19⤵
- Executes dropped EXE
PID:1512 -
\??\c:\prvjpv.exec:\prvjpv.exe20⤵
- Executes dropped EXE
PID:1756 -
\??\c:\phxjxr.exec:\phxjxr.exe21⤵
- Executes dropped EXE
PID:580 -
\??\c:\tlfrl.exec:\tlfrl.exe22⤵
- Executes dropped EXE
PID:2224 -
\??\c:\jrbtdb.exec:\jrbtdb.exe23⤵
- Executes dropped EXE
PID:1244 -
\??\c:\xbnxtfb.exec:\xbnxtfb.exe24⤵
- Executes dropped EXE
PID:476 -
\??\c:\hhtxdbd.exec:\hhtxdbd.exe25⤵
- Executes dropped EXE
PID:2116 -
\??\c:\lfvvdt.exec:\lfvvdt.exe26⤵
- Executes dropped EXE
PID:1088 -
\??\c:\tthhjr.exec:\tthhjr.exe27⤵
- Executes dropped EXE
PID:1316 -
\??\c:\prfjbx.exec:\prfjbx.exe28⤵
- Executes dropped EXE
PID:1792 -
\??\c:\bhrdtn.exec:\bhrdtn.exe29⤵
- Executes dropped EXE
PID:900 -
\??\c:\pxvxnf.exec:\pxvxnf.exe30⤵
- Executes dropped EXE
PID:1356 -
\??\c:\hfpdftn.exec:\hfpdftn.exe31⤵
- Executes dropped EXE
PID:2284 -
\??\c:\bvdjt.exec:\bvdjt.exe32⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xxxjl.exec:\xxxjl.exe33⤵
- Executes dropped EXE
PID:1508 -
\??\c:\nhplh.exec:\nhplh.exe34⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xtvtjn.exec:\xtvtjn.exe35⤵
- Executes dropped EXE
PID:2636 -
\??\c:\lxbfnnl.exec:\lxbfnnl.exe36⤵
- Executes dropped EXE
PID:2240 -
\??\c:\bdrth.exec:\bdrth.exe37⤵
- Executes dropped EXE
PID:1572 -
\??\c:\hfrrhn.exec:\hfrrhn.exe38⤵
- Executes dropped EXE
PID:2844 -
\??\c:\fxrbnpb.exec:\fxrbnpb.exe39⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pdrdprv.exec:\pdrdprv.exe40⤵
- Executes dropped EXE
PID:2564 -
\??\c:\flrxb.exec:\flrxb.exe41⤵
- Executes dropped EXE
PID:2504 -
\??\c:\prbvv.exec:\prbvv.exe42⤵
- Executes dropped EXE
PID:2520 -
\??\c:\bjbrnht.exec:\bjbrnht.exe43⤵
- Executes dropped EXE
PID:2596 -
\??\c:\fxbnf.exec:\fxbnf.exe44⤵
- Executes dropped EXE
PID:1252 -
\??\c:\hlrhd.exec:\hlrhd.exe45⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vnxlvf.exec:\vnxlvf.exe46⤵
- Executes dropped EXE
PID:2972 -
\??\c:\hhvnjn.exec:\hhvnjn.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jdxhvrn.exec:\jdxhvrn.exe48⤵
- Executes dropped EXE
PID:1884 -
\??\c:\nxxftjx.exec:\nxxftjx.exe49⤵
- Executes dropped EXE
PID:2160 -
\??\c:\lxbdv.exec:\lxbdv.exe50⤵
- Executes dropped EXE
PID:2592 -
\??\c:\tdrlptb.exec:\tdrlptb.exe51⤵
- Executes dropped EXE
PID:1460 -
\??\c:\hlppj.exec:\hlppj.exe52⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xhnltdn.exec:\xhnltdn.exe53⤵
- Executes dropped EXE
PID:2088 -
\??\c:\nxvvxh.exec:\nxvvxh.exe54⤵
- Executes dropped EXE
PID:1772 -
\??\c:\rnxvf.exec:\rnxvf.exe55⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xbdjpd.exec:\xbdjpd.exe56⤵
- Executes dropped EXE
PID:1028 -
\??\c:\ntdtl.exec:\ntdtl.exe57⤵
- Executes dropped EXE
PID:1400 -
\??\c:\bvxnttv.exec:\bvxnttv.exe58⤵
- Executes dropped EXE
PID:1468 -
\??\c:\rnjpv.exec:\rnjpv.exe59⤵
- Executes dropped EXE
PID:528 -
\??\c:\vdvrbx.exec:\vdvrbx.exe60⤵
- Executes dropped EXE
PID:336 -
\??\c:\dhnxv.exec:\dhnxv.exe61⤵
- Executes dropped EXE
PID:812 -
\??\c:\txftnlx.exec:\txftnlx.exe62⤵
- Executes dropped EXE
PID:788 -
\??\c:\dbdldbd.exec:\dbdldbd.exe63⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xtplpll.exec:\xtplpll.exe64⤵
- Executes dropped EXE
PID:1596 -
\??\c:\lxdrdx.exec:\lxdrdx.exe65⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jpvpp.exec:\jpvpp.exe66⤵PID:476
-
\??\c:\rjnhvxj.exec:\rjnhvxj.exe67⤵PID:1692
-
\??\c:\dhhjvr.exec:\dhhjvr.exe68⤵PID:1812
-
\??\c:\hxvhnnd.exec:\hxvhnnd.exe69⤵PID:2732
-
\??\c:\tnhpb.exec:\tnhpb.exe70⤵PID:1864
-
\??\c:\jpndj.exec:\jpndj.exe71⤵PID:652
-
\??\c:\jnxfnf.exec:\jnxfnf.exe72⤵PID:900
-
\??\c:\rfpvdfx.exec:\rfpvdfx.exe73⤵PID:1200
-
\??\c:\bvxjpb.exec:\bvxjpb.exe74⤵PID:804
-
\??\c:\lphbltr.exec:\lphbltr.exe75⤵PID:2460
-
\??\c:\rbpvt.exec:\rbpvt.exe76⤵PID:2316
-
\??\c:\xfppp.exec:\xfppp.exe77⤵PID:2044
-
\??\c:\ppnrfh.exec:\ppnrfh.exe78⤵PID:2736
-
\??\c:\ldtfj.exec:\ldtfj.exe79⤵PID:2852
-
\??\c:\ljdjv.exec:\ljdjv.exe80⤵PID:3068
-
\??\c:\hdpph.exec:\hdpph.exe81⤵PID:2812
-
\??\c:\ddhbvbf.exec:\ddhbvbf.exe82⤵PID:3048
-
\??\c:\pbdvlb.exec:\pbdvlb.exe83⤵PID:2576
-
\??\c:\lxxvn.exec:\lxxvn.exe84⤵PID:2580
-
\??\c:\rrhndpl.exec:\rrhndpl.exe85⤵PID:2072
-
\??\c:\tfdjxfv.exec:\tfdjxfv.exe86⤵PID:2476
-
\??\c:\hxrft.exec:\hxrft.exe87⤵PID:2628
-
\??\c:\fnlhl.exec:\fnlhl.exe88⤵PID:2404
-
\??\c:\vdblf.exec:\vdblf.exe89⤵PID:2364
-
\??\c:\tjpxjpl.exec:\tjpxjpl.exe90⤵PID:2792
-
\??\c:\jlpltb.exec:\jlpltb.exe91⤵PID:2780
-
\??\c:\fdbfxb.exec:\fdbfxb.exe92⤵PID:1856
-
\??\c:\ldhnjh.exec:\ldhnjh.exe93⤵PID:1808
-
\??\c:\hxdphjd.exec:\hxdphjd.exe94⤵PID:2060
-
\??\c:\pdnnbb.exec:\pdnnbb.exe95⤵PID:588
-
\??\c:\nhtpp.exec:\nhtpp.exe96⤵PID:2760
-
\??\c:\hfpfp.exec:\hfpfp.exe97⤵PID:1720
-
\??\c:\jphhl.exec:\jphhl.exe98⤵PID:1232
-
\??\c:\tblrpdt.exec:\tblrpdt.exe99⤵PID:1964
-
\??\c:\rpndnrp.exec:\rpndnrp.exe100⤵PID:2096
-
\??\c:\frvbp.exec:\frvbp.exe101⤵PID:1736
-
\??\c:\dnlbpd.exec:\dnlbpd.exe102⤵PID:936
-
\??\c:\fhplthx.exec:\fhplthx.exe103⤵PID:1576
-
\??\c:\pjtffj.exec:\pjtffj.exe104⤵PID:1216
-
\??\c:\fxdxv.exec:\fxdxv.exe105⤵PID:1016
-
\??\c:\bnvxxp.exec:\bnvxxp.exe106⤵PID:1528
-
\??\c:\fnxxrpr.exec:\fnxxrpr.exe107⤵PID:2456
-
\??\c:\fpbnn.exec:\fpbnn.exe108⤵PID:596
-
\??\c:\rtjrjv.exec:\rtjrjv.exe109⤵PID:2904
-
\??\c:\vhnnf.exec:\vhnnf.exe110⤵PID:980
-
\??\c:\ddtdhd.exec:\ddtdhd.exe111⤵PID:1348
-
\??\c:\tddrvl.exec:\tddrvl.exe112⤵PID:864
-
\??\c:\tpvnh.exec:\tpvnh.exe113⤵PID:1656
-
\??\c:\fxfjrb.exec:\fxfjrb.exe114⤵PID:1820
-
\??\c:\fnhln.exec:\fnhln.exe115⤵PID:1560
-
\??\c:\bnbvf.exec:\bnbvf.exe116⤵PID:320
-
\??\c:\xfxxf.exec:\xfxxf.exe117⤵PID:832
-
\??\c:\bjrxdth.exec:\bjrxdth.exe118⤵PID:2304
-
\??\c:\fxvrd.exec:\fxvrd.exe119⤵PID:2204
-
\??\c:\rxthr.exec:\rxthr.exe120⤵PID:3000
-
\??\c:\dxdbbt.exec:\dxdbbt.exe121⤵PID:2696
-
\??\c:\xlpnf.exec:\xlpnf.exe122⤵PID:760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-