Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 10:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
15007bca6d2449388e9898c1626216d0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
15007bca6d2449388e9898c1626216d0_NeikiAnalytics.exe
-
Size
87KB
-
MD5
15007bca6d2449388e9898c1626216d0
-
SHA1
9dbce738c331433febbccb80e045ec0dbd158657
-
SHA256
2a212aff3225e17884ead79dc2236a9d3fe510b91dcfb1e93f9625b6a94602f0
-
SHA512
f83dd73e9e646d9e689e7a22a008796ea18bca4eba70cf8156401b1c7261739c56b41d0370423d13384d4bd5415633f652dc4a9c8ee949fad1e1e63ef48f62a9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73yqKH/KjveD:ymb3NkkiQ3mdBjFo73yX+vQ
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2128-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1552-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-86-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1284-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1744-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/352-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1472-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/304-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2128 ddjpj.exe 1552 9dpdj.exe 2728 1nbbbh.exe 2800 dvjpd.exe 2684 rlffffr.exe 2688 tnnbhb.exe 2540 pjppp.exe 3068 xlrlxrr.exe 1284 7xrlllf.exe 2892 bnnttt.exe 2896 9jvpd.exe 3008 lxlfxrr.exe 1744 thbnbb.exe 1256 hbnhtt.exe 352 pjvjj.exe 2712 1flxxrf.exe 1640 hbntbh.exe 1752 hbhnbb.exe 2256 jvpjp.exe 2820 5dvpv.exe 1872 xrfxflx.exe 728 tnbhtb.exe 1472 7pdjv.exe 892 fxfflfl.exe 348 7hhhnb.exe 304 7ntbnn.exe 1916 vvjpd.exe 1648 9rfflrx.exe 1248 3nntnn.exe 1748 hbnhhn.exe 2216 dvjjd.exe 2992 3rflrxf.exe 3044 fflrlrr.exe 2136 3thntt.exe 1608 dpdpp.exe 2668 3lxlrfl.exe 2664 1fxlrlr.exe 2756 tnthht.exe 2628 hhbbnt.exe 2796 1jdjp.exe 2852 rfrrrxf.exe 2660 fflxlrx.exe 2536 hhbtnb.exe 1884 tthhtt.exe 3036 pjddd.exe 2576 xrxlxlx.exe 2884 rlfxfrf.exe 2872 5xffllr.exe 540 9tnbbt.exe 468 1ppvd.exe 3008 lfrrrxl.exe 1268 rrrxrxf.exe 796 bbthnh.exe 2760 nhhthh.exe 1656 ppjvv.exe 2044 9jddp.exe 1640 fxxxlrf.exe 2268 9fxxffl.exe 2968 3nhttb.exe 2392 hhhthh.exe 2364 vvvjp.exe 568 jdvdv.exe 1728 lfrxfxf.exe 2132 ntbtbt.exe -
resource yara_rule behavioral1/memory/3016-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1744-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1256-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2256-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1472-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/304-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-278-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2128 3016 15007bca6d2449388e9898c1626216d0_NeikiAnalytics.exe 28 PID 3016 wrote to memory of 2128 3016 15007bca6d2449388e9898c1626216d0_NeikiAnalytics.exe 28 PID 3016 wrote to memory of 2128 3016 15007bca6d2449388e9898c1626216d0_NeikiAnalytics.exe 28 PID 3016 wrote to memory of 2128 3016 15007bca6d2449388e9898c1626216d0_NeikiAnalytics.exe 28 PID 2128 wrote to memory of 1552 2128 ddjpj.exe 29 PID 2128 wrote to memory of 1552 2128 ddjpj.exe 29 PID 2128 wrote to memory of 1552 2128 ddjpj.exe 29 PID 2128 wrote to memory of 1552 2128 ddjpj.exe 29 PID 1552 wrote to memory of 2728 1552 9dpdj.exe 30 PID 1552 wrote to memory of 2728 1552 9dpdj.exe 30 PID 1552 wrote to memory of 2728 1552 9dpdj.exe 30 PID 1552 wrote to memory of 2728 1552 9dpdj.exe 30 PID 2728 wrote to memory of 2800 2728 1nbbbh.exe 31 PID 2728 wrote to memory of 2800 2728 1nbbbh.exe 31 PID 2728 wrote to memory of 2800 2728 1nbbbh.exe 31 PID 2728 wrote to memory of 2800 2728 1nbbbh.exe 31 PID 2800 wrote to memory of 2684 2800 dvjpd.exe 32 PID 2800 wrote to memory of 2684 2800 dvjpd.exe 32 PID 2800 wrote to memory of 2684 2800 dvjpd.exe 32 PID 2800 wrote to memory of 2684 2800 dvjpd.exe 32 PID 2684 wrote to memory of 2688 2684 rlffffr.exe 33 PID 2684 wrote to memory of 2688 2684 rlffffr.exe 33 PID 2684 wrote to memory of 2688 2684 rlffffr.exe 33 PID 2684 wrote to memory of 2688 2684 rlffffr.exe 33 PID 2688 wrote to memory of 2540 2688 tnnbhb.exe 34 PID 2688 wrote to memory of 2540 2688 tnnbhb.exe 34 PID 2688 wrote to memory of 2540 2688 tnnbhb.exe 34 PID 2688 wrote to memory of 2540 2688 tnnbhb.exe 34 PID 2540 wrote to memory of 3068 2540 pjppp.exe 35 PID 2540 wrote to memory of 3068 2540 pjppp.exe 35 PID 2540 wrote to memory of 3068 2540 pjppp.exe 35 PID 2540 wrote to memory of 3068 2540 pjppp.exe 35 PID 3068 wrote to memory of 1284 3068 xlrlxrr.exe 36 PID 3068 wrote to memory of 1284 3068 xlrlxrr.exe 36 PID 3068 wrote to memory of 1284 3068 xlrlxrr.exe 36 PID 3068 wrote to memory of 1284 3068 xlrlxrr.exe 36 PID 1284 wrote to memory of 2892 1284 7xrlllf.exe 37 PID 1284 wrote to memory of 2892 1284 7xrlllf.exe 37 PID 1284 wrote to memory of 2892 1284 7xrlllf.exe 37 PID 1284 wrote to memory of 2892 1284 7xrlllf.exe 37 PID 2892 wrote to memory of 2896 2892 bnnttt.exe 38 PID 2892 wrote to memory of 2896 2892 bnnttt.exe 38 PID 2892 wrote to memory of 2896 2892 bnnttt.exe 38 PID 2892 wrote to memory of 2896 2892 bnnttt.exe 38 PID 2896 wrote to memory of 3008 2896 9jvpd.exe 39 PID 2896 wrote to memory of 3008 2896 9jvpd.exe 39 PID 2896 wrote to memory of 3008 2896 9jvpd.exe 39 PID 2896 wrote to memory of 3008 2896 9jvpd.exe 39 PID 3008 wrote to memory of 1744 3008 lxlfxrr.exe 40 PID 3008 wrote to memory of 1744 3008 lxlfxrr.exe 40 PID 3008 wrote to memory of 1744 3008 lxlfxrr.exe 40 PID 3008 wrote to memory of 1744 3008 lxlfxrr.exe 40 PID 1744 wrote to memory of 1256 1744 thbnbb.exe 41 PID 1744 wrote to memory of 1256 1744 thbnbb.exe 41 PID 1744 wrote to memory of 1256 1744 thbnbb.exe 41 PID 1744 wrote to memory of 1256 1744 thbnbb.exe 41 PID 1256 wrote to memory of 352 1256 hbnhtt.exe 42 PID 1256 wrote to memory of 352 1256 hbnhtt.exe 42 PID 1256 wrote to memory of 352 1256 hbnhtt.exe 42 PID 1256 wrote to memory of 352 1256 hbnhtt.exe 42 PID 352 wrote to memory of 2712 352 pjvjj.exe 43 PID 352 wrote to memory of 2712 352 pjvjj.exe 43 PID 352 wrote to memory of 2712 352 pjvjj.exe 43 PID 352 wrote to memory of 2712 352 pjvjj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\15007bca6d2449388e9898c1626216d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\15007bca6d2449388e9898c1626216d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\ddjpj.exec:\ddjpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\9dpdj.exec:\9dpdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\1nbbbh.exec:\1nbbbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\dvjpd.exec:\dvjpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\rlffffr.exec:\rlffffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\tnnbhb.exec:\tnnbhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\pjppp.exec:\pjppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\xlrlxrr.exec:\xlrlxrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\7xrlllf.exec:\7xrlllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\bnnttt.exec:\bnnttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\9jvpd.exec:\9jvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\lxlfxrr.exec:\lxlfxrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\thbnbb.exec:\thbnbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\hbnhtt.exec:\hbnhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\pjvjj.exec:\pjvjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\1flxxrf.exec:\1flxxrf.exe17⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hbntbh.exec:\hbntbh.exe18⤵
- Executes dropped EXE
PID:1640 -
\??\c:\hbhnbb.exec:\hbhnbb.exe19⤵
- Executes dropped EXE
PID:1752 -
\??\c:\jvpjp.exec:\jvpjp.exe20⤵
- Executes dropped EXE
PID:2256 -
\??\c:\5dvpv.exec:\5dvpv.exe21⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xrfxflx.exec:\xrfxflx.exe22⤵
- Executes dropped EXE
PID:1872 -
\??\c:\tnbhtb.exec:\tnbhtb.exe23⤵
- Executes dropped EXE
PID:728 -
\??\c:\7pdjv.exec:\7pdjv.exe24⤵
- Executes dropped EXE
PID:1472 -
\??\c:\fxfflfl.exec:\fxfflfl.exe25⤵
- Executes dropped EXE
PID:892 -
\??\c:\7hhhnb.exec:\7hhhnb.exe26⤵
- Executes dropped EXE
PID:348 -
\??\c:\7ntbnn.exec:\7ntbnn.exe27⤵
- Executes dropped EXE
PID:304 -
\??\c:\vvjpd.exec:\vvjpd.exe28⤵
- Executes dropped EXE
PID:1916 -
\??\c:\9rfflrx.exec:\9rfflrx.exe29⤵
- Executes dropped EXE
PID:1648 -
\??\c:\3nntnn.exec:\3nntnn.exe30⤵
- Executes dropped EXE
PID:1248 -
\??\c:\hbnhhn.exec:\hbnhhn.exe31⤵
- Executes dropped EXE
PID:1748 -
\??\c:\dvjjd.exec:\dvjjd.exe32⤵
- Executes dropped EXE
PID:2216 -
\??\c:\3rflrxf.exec:\3rflrxf.exe33⤵
- Executes dropped EXE
PID:2992 -
\??\c:\fflrlrr.exec:\fflrlrr.exe34⤵
- Executes dropped EXE
PID:3044 -
\??\c:\3thntt.exec:\3thntt.exe35⤵
- Executes dropped EXE
PID:2136 -
\??\c:\dpdpp.exec:\dpdpp.exe36⤵
- Executes dropped EXE
PID:1608 -
\??\c:\3lxlrfl.exec:\3lxlrfl.exe37⤵
- Executes dropped EXE
PID:2668 -
\??\c:\1fxlrlr.exec:\1fxlrlr.exe38⤵
- Executes dropped EXE
PID:2664 -
\??\c:\tnthht.exec:\tnthht.exe39⤵
- Executes dropped EXE
PID:2756 -
\??\c:\hhbbnt.exec:\hhbbnt.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\1jdjp.exec:\1jdjp.exe41⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rfrrrxf.exec:\rfrrrxf.exe42⤵
- Executes dropped EXE
PID:2852 -
\??\c:\fflxlrx.exec:\fflxlrx.exe43⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hhbtnb.exec:\hhbtnb.exe44⤵
- Executes dropped EXE
PID:2536 -
\??\c:\tthhtt.exec:\tthhtt.exe45⤵
- Executes dropped EXE
PID:1884 -
\??\c:\pjddd.exec:\pjddd.exe46⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xrxlxlx.exec:\xrxlxlx.exe47⤵
- Executes dropped EXE
PID:2576 -
\??\c:\rlfxfrf.exec:\rlfxfrf.exe48⤵
- Executes dropped EXE
PID:2884 -
\??\c:\5xffllr.exec:\5xffllr.exe49⤵
- Executes dropped EXE
PID:2872 -
\??\c:\9tnbbt.exec:\9tnbbt.exe50⤵
- Executes dropped EXE
PID:540 -
\??\c:\1ppvd.exec:\1ppvd.exe51⤵
- Executes dropped EXE
PID:468 -
\??\c:\lfrrrxl.exec:\lfrrrxl.exe52⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rrrxrxf.exec:\rrrxrxf.exe53⤵
- Executes dropped EXE
PID:1268 -
\??\c:\bbthnh.exec:\bbthnh.exe54⤵
- Executes dropped EXE
PID:796 -
\??\c:\nhhthh.exec:\nhhthh.exe55⤵
- Executes dropped EXE
PID:2760 -
\??\c:\ppjvv.exec:\ppjvv.exe56⤵
- Executes dropped EXE
PID:1656 -
\??\c:\9jddp.exec:\9jddp.exe57⤵
- Executes dropped EXE
PID:2044 -
\??\c:\fxxxlrf.exec:\fxxxlrf.exe58⤵
- Executes dropped EXE
PID:1640 -
\??\c:\9fxxffl.exec:\9fxxffl.exe59⤵
- Executes dropped EXE
PID:2268 -
\??\c:\3nhttb.exec:\3nhttb.exe60⤵
- Executes dropped EXE
PID:2968 -
\??\c:\hhhthh.exec:\hhhthh.exe61⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vvvjp.exec:\vvvjp.exe62⤵
- Executes dropped EXE
PID:2364 -
\??\c:\jdvdv.exec:\jdvdv.exe63⤵
- Executes dropped EXE
PID:568 -
\??\c:\lfrxfxf.exec:\lfrxfxf.exe64⤵
- Executes dropped EXE
PID:1728 -
\??\c:\ntbtbt.exec:\ntbtbt.exe65⤵
- Executes dropped EXE
PID:2132 -
\??\c:\hhhtbh.exec:\hhhtbh.exe66⤵PID:1136
-
\??\c:\5jvdp.exec:\5jvdp.exe67⤵PID:684
-
\??\c:\jdvvj.exec:\jdvvj.exe68⤵PID:1856
-
\??\c:\rrfrffl.exec:\rrfrffl.exe69⤵PID:604
-
\??\c:\lfflrfr.exec:\lfflrfr.exe70⤵PID:1708
-
\??\c:\bnbbhn.exec:\bnbbhn.exe71⤵PID:956
-
\??\c:\dvppd.exec:\dvppd.exe72⤵PID:1152
-
\??\c:\dvjvp.exec:\dvjvp.exe73⤵PID:988
-
\??\c:\fxrrxff.exec:\fxrrxff.exe74⤵PID:1976
-
\??\c:\1xxlxxl.exec:\1xxlxxl.exe75⤵PID:868
-
\??\c:\hbthtb.exec:\hbthtb.exe76⤵PID:1800
-
\??\c:\3tthtt.exec:\3tthtt.exe77⤵PID:2940
-
\??\c:\vpvpv.exec:\vpvpv.exe78⤵PID:1596
-
\??\c:\vdjjv.exec:\vdjjv.exe79⤵PID:2984
-
\??\c:\xxrfxxl.exec:\xxrfxxl.exe80⤵PID:3032
-
\??\c:\rrrflrx.exec:\rrrflrx.exe81⤵PID:2744
-
\??\c:\7bbhnn.exec:\7bbhnn.exe82⤵PID:2648
-
\??\c:\bbnhbh.exec:\bbnhbh.exe83⤵PID:2792
-
\??\c:\dvjvj.exec:\dvjvj.exe84⤵PID:2788
-
\??\c:\5jpvd.exec:\5jpvd.exe85⤵PID:2692
-
\??\c:\dpvpv.exec:\dpvpv.exe86⤵PID:2580
-
\??\c:\rlxffxf.exec:\rlxffxf.exe87⤵PID:2568
-
\??\c:\1btbnn.exec:\1btbnn.exe88⤵PID:2780
-
\??\c:\htbhnn.exec:\htbhnn.exe89⤵PID:2000
-
\??\c:\1vjpv.exec:\1vjpv.exe90⤵PID:2860
-
\??\c:\pddpj.exec:\pddpj.exe91⤵PID:2932
-
\??\c:\7rlfrfl.exec:\7rlfrfl.exe92⤵PID:2892
-
\??\c:\1xllrxl.exec:\1xllrxl.exe93⤵PID:2904
-
\??\c:\nhtthh.exec:\nhtthh.exe94⤵PID:1040
-
\??\c:\btnbnb.exec:\btnbnb.exe95⤵PID:1808
-
\??\c:\jjdjv.exec:\jjdjv.exe96⤵PID:2012
-
\??\c:\5vjjj.exec:\5vjjj.exe97⤵PID:1820
-
\??\c:\frllxrx.exec:\frllxrx.exe98⤵PID:2764
-
\??\c:\7xllxfl.exec:\7xllxfl.exe99⤵PID:1668
-
\??\c:\hhnbtt.exec:\hhnbtt.exe100⤵PID:1540
-
\??\c:\hthnhh.exec:\hthnhh.exe101⤵PID:1296
-
\??\c:\dvddv.exec:\dvddv.exe102⤵PID:2976
-
\??\c:\7vpvj.exec:\7vpvj.exe103⤵PID:1148
-
\??\c:\9flxffr.exec:\9flxffr.exe104⤵PID:2980
-
\??\c:\1xrrxfr.exec:\1xrrxfr.exe105⤵PID:668
-
\??\c:\btbhtt.exec:\btbhtt.exe106⤵PID:580
-
\??\c:\9thbth.exec:\9thbth.exe107⤵PID:1784
-
\??\c:\vjvdj.exec:\vjvdj.exe108⤵PID:1100
-
\??\c:\xfrlxlf.exec:\xfrlxlf.exe109⤵PID:892
-
\??\c:\frxlxfr.exec:\frxlxfr.exe110⤵PID:2332
-
\??\c:\hbbhtt.exec:\hbbhtt.exe111⤵PID:1352
-
\??\c:\nhbhht.exec:\nhbhht.exe112⤵PID:1612
-
\??\c:\tntbhn.exec:\tntbhn.exe113⤵PID:2448
-
\??\c:\vvddj.exec:\vvddj.exe114⤵PID:844
-
\??\c:\pjpvj.exec:\pjpvj.exe115⤵PID:1496
-
\??\c:\5fllrrx.exec:\5fllrrx.exe116⤵PID:2204
-
\??\c:\rlrrflr.exec:\rlrrflr.exe117⤵PID:2252
-
\??\c:\3tnnht.exec:\3tnnht.exe118⤵PID:2216
-
\??\c:\3hhhnt.exec:\3hhhnt.exe119⤵PID:868
-
\??\c:\vjpdj.exec:\vjpdj.exe120⤵PID:3044
-
\??\c:\ddvdp.exec:\ddvdp.exe121⤵PID:2704
-
\??\c:\xrlxrxr.exec:\xrlxrxr.exe122⤵PID:1608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-