Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 02:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5cb0d450d7fd92027c25253ab302a620_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
5cb0d450d7fd92027c25253ab302a620_NeikiAnalytics.exe
-
Size
81KB
-
MD5
5cb0d450d7fd92027c25253ab302a620
-
SHA1
4ad4fb3741a00afd67f522bf7b52843c068ba3e9
-
SHA256
06435a78e67131cb48c0ed5383459395b4ac498d49b45995edebe32b6c2eeb15
-
SHA512
47d9a8352453c467bebf78d28e7fa74f26c22f49e89e3c12413250f39bb8366291bba406da1837e55bffd72faa35d54394b5eaf07972300fc8e70c3a76118533
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JkZPsvX:ymb3NkkiQ3mdBjFIWeFGyA9Pc
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral1/memory/2804-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-79-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1612-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1476-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1436-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2212 nhhhbn.exe 3024 1djjd.exe 2700 thbtbb.exe 3032 nnhbnb.exe 2812 jvjjd.exe 2516 vjvjj.exe 2420 xlxxxfl.exe 2320 bnbhtn.exe 1612 djdjd.exe 2676 vvjvj.exe 2764 xlflxfl.exe 1476 bttbbh.exe 2224 hbnnbt.exe 2372 vppvv.exe 1436 5xlxflx.exe 1372 bbhhhn.exe 2944 ttbhnt.exe 3052 1jjpd.exe 2956 7lxllxr.exe 2380 hbttbh.exe 2072 nhbhhn.exe 488 vpppd.exe 1076 dpvvv.exe 2932 flxfxff.exe 1484 tnhnnn.exe 1816 hthnnn.exe 772 pdvpj.exe 2240 pppjp.exe 332 rrrlflf.exe 1060 ttbnnn.exe 2368 vvppd.exe 1528 jdvvp.exe 2584 llfrrrf.exe 1540 7xrxffr.exe 2544 3htbhh.exe 3000 ntntbh.exe 2608 jpvvv.exe 2700 1lflxfl.exe 2268 5xxrflx.exe 2540 3nbhnt.exe 2576 tnhnbb.exe 2448 pdjpv.exe 2432 ppdjp.exe 908 fxxflxf.exe 2964 fflfrxl.exe 2752 hbhthn.exe 2644 9bbtbn.exe 2892 7btbnb.exe 1620 vjjvd.exe 1668 3rfxlff.exe 288 fxfxllf.exe 876 bbthth.exe 1644 tttttt.exe 1284 jddpj.exe 1372 ppjpp.exe 2928 rlrxfrl.exe 2440 nhbnnt.exe 2956 hbnbbh.exe 2044 dvvdv.exe 2052 dvppp.exe 596 lxxxlfr.exe 488 fxlflrx.exe 1076 3hnnnn.exe 472 jdppv.exe -
resource yara_rule behavioral1/memory/2804-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2420-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1612-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1476-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1436-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-241-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2804 wrote to memory of 2212 2804 5cb0d450d7fd92027c25253ab302a620_NeikiAnalytics.exe 28 PID 2804 wrote to memory of 2212 2804 5cb0d450d7fd92027c25253ab302a620_NeikiAnalytics.exe 28 PID 2804 wrote to memory of 2212 2804 5cb0d450d7fd92027c25253ab302a620_NeikiAnalytics.exe 28 PID 2804 wrote to memory of 2212 2804 5cb0d450d7fd92027c25253ab302a620_NeikiAnalytics.exe 28 PID 2212 wrote to memory of 3024 2212 nhhhbn.exe 29 PID 2212 wrote to memory of 3024 2212 nhhhbn.exe 29 PID 2212 wrote to memory of 3024 2212 nhhhbn.exe 29 PID 2212 wrote to memory of 3024 2212 nhhhbn.exe 29 PID 3024 wrote to memory of 2700 3024 1djjd.exe 30 PID 3024 wrote to memory of 2700 3024 1djjd.exe 30 PID 3024 wrote to memory of 2700 3024 1djjd.exe 30 PID 3024 wrote to memory of 2700 3024 1djjd.exe 30 PID 2700 wrote to memory of 3032 2700 thbtbb.exe 31 PID 2700 wrote to memory of 3032 2700 thbtbb.exe 31 PID 2700 wrote to memory of 3032 2700 thbtbb.exe 31 PID 2700 wrote to memory of 3032 2700 thbtbb.exe 31 PID 3032 wrote to memory of 2812 3032 nnhbnb.exe 32 PID 3032 wrote to memory of 2812 3032 nnhbnb.exe 32 PID 3032 wrote to memory of 2812 3032 nnhbnb.exe 32 PID 3032 wrote to memory of 2812 3032 nnhbnb.exe 32 PID 2812 wrote to memory of 2516 2812 jvjjd.exe 33 PID 2812 wrote to memory of 2516 2812 jvjjd.exe 33 PID 2812 wrote to memory of 2516 2812 jvjjd.exe 33 PID 2812 wrote to memory of 2516 2812 jvjjd.exe 33 PID 2516 wrote to memory of 2420 2516 vjvjj.exe 34 PID 2516 wrote to memory of 2420 2516 vjvjj.exe 34 PID 2516 wrote to memory of 2420 2516 vjvjj.exe 34 PID 2516 wrote to memory of 2420 2516 vjvjj.exe 34 PID 2420 wrote to memory of 2320 2420 xlxxxfl.exe 35 PID 2420 wrote to memory of 2320 2420 xlxxxfl.exe 35 PID 2420 wrote to memory of 2320 2420 xlxxxfl.exe 35 PID 2420 wrote to memory of 2320 2420 xlxxxfl.exe 35 PID 2320 wrote to memory of 1612 2320 bnbhtn.exe 36 PID 2320 wrote to memory of 1612 2320 bnbhtn.exe 36 PID 2320 wrote to memory of 1612 2320 bnbhtn.exe 36 PID 2320 wrote to memory of 1612 2320 bnbhtn.exe 36 PID 1612 wrote to memory of 2676 1612 djdjd.exe 37 PID 1612 wrote to memory of 2676 1612 djdjd.exe 37 PID 1612 wrote to memory of 2676 1612 djdjd.exe 37 PID 1612 wrote to memory of 2676 1612 djdjd.exe 37 PID 2676 wrote to memory of 2764 2676 vvjvj.exe 38 PID 2676 wrote to memory of 2764 2676 vvjvj.exe 38 PID 2676 wrote to memory of 2764 2676 vvjvj.exe 38 PID 2676 wrote to memory of 2764 2676 vvjvj.exe 38 PID 2764 wrote to memory of 1476 2764 xlflxfl.exe 39 PID 2764 wrote to memory of 1476 2764 xlflxfl.exe 39 PID 2764 wrote to memory of 1476 2764 xlflxfl.exe 39 PID 2764 wrote to memory of 1476 2764 xlflxfl.exe 39 PID 1476 wrote to memory of 2224 1476 bttbbh.exe 40 PID 1476 wrote to memory of 2224 1476 bttbbh.exe 40 PID 1476 wrote to memory of 2224 1476 bttbbh.exe 40 PID 1476 wrote to memory of 2224 1476 bttbbh.exe 40 PID 2224 wrote to memory of 2372 2224 hbnnbt.exe 41 PID 2224 wrote to memory of 2372 2224 hbnnbt.exe 41 PID 2224 wrote to memory of 2372 2224 hbnnbt.exe 41 PID 2224 wrote to memory of 2372 2224 hbnnbt.exe 41 PID 2372 wrote to memory of 1436 2372 vppvv.exe 42 PID 2372 wrote to memory of 1436 2372 vppvv.exe 42 PID 2372 wrote to memory of 1436 2372 vppvv.exe 42 PID 2372 wrote to memory of 1436 2372 vppvv.exe 42 PID 1436 wrote to memory of 1372 1436 5xlxflx.exe 43 PID 1436 wrote to memory of 1372 1436 5xlxflx.exe 43 PID 1436 wrote to memory of 1372 1436 5xlxflx.exe 43 PID 1436 wrote to memory of 1372 1436 5xlxflx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cb0d450d7fd92027c25253ab302a620_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5cb0d450d7fd92027c25253ab302a620_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\nhhhbn.exec:\nhhhbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\1djjd.exec:\1djjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\thbtbb.exec:\thbtbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\nnhbnb.exec:\nnhbnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\jvjjd.exec:\jvjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\vjvjj.exec:\vjvjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\xlxxxfl.exec:\xlxxxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\bnbhtn.exec:\bnbhtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\djdjd.exec:\djdjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\vvjvj.exec:\vvjvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\xlflxfl.exec:\xlflxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\bttbbh.exec:\bttbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\hbnnbt.exec:\hbnnbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\vppvv.exec:\vppvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\5xlxflx.exec:\5xlxflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\bbhhhn.exec:\bbhhhn.exe17⤵
- Executes dropped EXE
PID:1372 -
\??\c:\ttbhnt.exec:\ttbhnt.exe18⤵
- Executes dropped EXE
PID:2944 -
\??\c:\1jjpd.exec:\1jjpd.exe19⤵
- Executes dropped EXE
PID:3052 -
\??\c:\7lxllxr.exec:\7lxllxr.exe20⤵
- Executes dropped EXE
PID:2956 -
\??\c:\hbttbh.exec:\hbttbh.exe21⤵
- Executes dropped EXE
PID:2380 -
\??\c:\nhbhhn.exec:\nhbhhn.exe22⤵
- Executes dropped EXE
PID:2072 -
\??\c:\vpppd.exec:\vpppd.exe23⤵
- Executes dropped EXE
PID:488 -
\??\c:\dpvvv.exec:\dpvvv.exe24⤵
- Executes dropped EXE
PID:1076 -
\??\c:\flxfxff.exec:\flxfxff.exe25⤵
- Executes dropped EXE
PID:2932 -
\??\c:\tnhnnn.exec:\tnhnnn.exe26⤵
- Executes dropped EXE
PID:1484 -
\??\c:\hthnnn.exec:\hthnnn.exe27⤵
- Executes dropped EXE
PID:1816 -
\??\c:\pdvpj.exec:\pdvpj.exe28⤵
- Executes dropped EXE
PID:772 -
\??\c:\pppjp.exec:\pppjp.exe29⤵
- Executes dropped EXE
PID:2240 -
\??\c:\rrrlflf.exec:\rrrlflf.exe30⤵
- Executes dropped EXE
PID:332 -
\??\c:\ttbnnn.exec:\ttbnnn.exe31⤵
- Executes dropped EXE
PID:1060 -
\??\c:\vvppd.exec:\vvppd.exe32⤵
- Executes dropped EXE
PID:2368 -
\??\c:\jdvvp.exec:\jdvvp.exe33⤵
- Executes dropped EXE
PID:1528 -
\??\c:\llfrrrf.exec:\llfrrrf.exe34⤵
- Executes dropped EXE
PID:2584 -
\??\c:\7xrxffr.exec:\7xrxffr.exe35⤵
- Executes dropped EXE
PID:1540 -
\??\c:\3htbhh.exec:\3htbhh.exe36⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ntntbh.exec:\ntntbh.exe37⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jpvvv.exec:\jpvvv.exe38⤵
- Executes dropped EXE
PID:2608 -
\??\c:\1lflxfl.exec:\1lflxfl.exe39⤵
- Executes dropped EXE
PID:2700 -
\??\c:\5xxrflx.exec:\5xxrflx.exe40⤵
- Executes dropped EXE
PID:2268 -
\??\c:\3nbhnt.exec:\3nbhnt.exe41⤵
- Executes dropped EXE
PID:2540 -
\??\c:\tnhnbb.exec:\tnhnbb.exe42⤵
- Executes dropped EXE
PID:2576 -
\??\c:\pdjpv.exec:\pdjpv.exe43⤵
- Executes dropped EXE
PID:2448 -
\??\c:\ppdjp.exec:\ppdjp.exe44⤵
- Executes dropped EXE
PID:2432 -
\??\c:\fxxflxf.exec:\fxxflxf.exe45⤵
- Executes dropped EXE
PID:908 -
\??\c:\fflfrxl.exec:\fflfrxl.exe46⤵
- Executes dropped EXE
PID:2964 -
\??\c:\hbhthn.exec:\hbhthn.exe47⤵
- Executes dropped EXE
PID:2752 -
\??\c:\9bbtbn.exec:\9bbtbn.exe48⤵
- Executes dropped EXE
PID:2644 -
\??\c:\7btbnb.exec:\7btbnb.exe49⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vjjvd.exec:\vjjvd.exe50⤵
- Executes dropped EXE
PID:1620 -
\??\c:\3rfxlff.exec:\3rfxlff.exe51⤵
- Executes dropped EXE
PID:1668 -
\??\c:\fxfxllf.exec:\fxfxllf.exe52⤵
- Executes dropped EXE
PID:288 -
\??\c:\bbthth.exec:\bbthth.exe53⤵
- Executes dropped EXE
PID:876 -
\??\c:\tttttt.exec:\tttttt.exe54⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jddpj.exec:\jddpj.exe55⤵
- Executes dropped EXE
PID:1284 -
\??\c:\ppjpp.exec:\ppjpp.exe56⤵
- Executes dropped EXE
PID:1372 -
\??\c:\rlrxfrl.exec:\rlrxfrl.exe57⤵
- Executes dropped EXE
PID:2928 -
\??\c:\nhbnnt.exec:\nhbnnt.exe58⤵
- Executes dropped EXE
PID:2440 -
\??\c:\hbnbbh.exec:\hbnbbh.exe59⤵
- Executes dropped EXE
PID:2956 -
\??\c:\dvvdv.exec:\dvvdv.exe60⤵
- Executes dropped EXE
PID:2044 -
\??\c:\dvppp.exec:\dvppp.exe61⤵
- Executes dropped EXE
PID:2052 -
\??\c:\lxxxlfr.exec:\lxxxlfr.exe62⤵
- Executes dropped EXE
PID:596 -
\??\c:\fxlflrx.exec:\fxlflrx.exe63⤵
- Executes dropped EXE
PID:488 -
\??\c:\3hnnnn.exec:\3hnnnn.exe64⤵
- Executes dropped EXE
PID:1076 -
\??\c:\jdppv.exec:\jdppv.exe65⤵
- Executes dropped EXE
PID:472 -
\??\c:\pvjpp.exec:\pvjpp.exe66⤵PID:1928
-
\??\c:\rfflfrr.exec:\rfflfrr.exe67⤵PID:1228
-
\??\c:\xlrrxxl.exec:\xlrrxxl.exe68⤵PID:240
-
\??\c:\tbthbn.exec:\tbthbn.exe69⤵PID:712
-
\??\c:\tnbbhh.exec:\tnbbhh.exe70⤵PID:2100
-
\??\c:\5dvjj.exec:\5dvjj.exe71⤵PID:2136
-
\??\c:\3pdjv.exec:\3pdjv.exe72⤵PID:852
-
\??\c:\3lfrxlx.exec:\3lfrxlx.exe73⤵PID:912
-
\??\c:\lfxxxxx.exec:\lfxxxxx.exe74⤵PID:1200
-
\??\c:\thtttb.exec:\thtttb.exe75⤵PID:2080
-
\??\c:\thhnbb.exec:\thhnbb.exe76⤵PID:2728
-
\??\c:\djdjp.exec:\djdjp.exe77⤵PID:1548
-
\??\c:\vjjpj.exec:\vjjpj.exe78⤵PID:2508
-
\??\c:\7rxrrxr.exec:\7rxrrxr.exe79⤵PID:1964
-
\??\c:\lllxrff.exec:\lllxrff.exe80⤵PID:2520
-
\??\c:\tnhnbh.exec:\tnhnbh.exe81⤵PID:2536
-
\??\c:\tnhnbn.exec:\tnhnbn.exe82⤵PID:2968
-
\??\c:\dvpvj.exec:\dvpvj.exe83⤵PID:2428
-
\??\c:\vjvvp.exec:\vjvvp.exe84⤵PID:2456
-
\??\c:\lllffxr.exec:\lllffxr.exe85⤵PID:2412
-
\??\c:\frfxfxf.exec:\frfxfxf.exe86⤵PID:2180
-
\??\c:\1nbnnb.exec:\1nbnnb.exe87⤵PID:2916
-
\??\c:\hhbnbn.exec:\hhbnbn.exe88⤵PID:1612
-
\??\c:\hhbtbb.exec:\hhbtbb.exe89⤵PID:2680
-
\??\c:\pppvj.exec:\pppvj.exe90⤵PID:1128
-
\??\c:\jdpjv.exec:\jdpjv.exe91⤵PID:2884
-
\??\c:\1llxflr.exec:\1llxflr.exe92⤵PID:1812
-
\??\c:\lffrrxf.exec:\lffrrxf.exe93⤵PID:2224
-
\??\c:\hhbhtb.exec:\hhbhtb.exe94⤵PID:1572
-
\??\c:\hbbhhn.exec:\hbbhhn.exe95⤵PID:2388
-
\??\c:\dvjpv.exec:\dvjpv.exe96⤵PID:2948
-
\??\c:\pjdpd.exec:\pjdpd.exe97⤵PID:2032
-
\??\c:\pjvpv.exec:\pjvpv.exe98⤵PID:1280
-
\??\c:\lffrllx.exec:\lffrllx.exe99⤵PID:1700
-
\??\c:\1rlrxfr.exec:\1rlrxfr.exe100⤵PID:2284
-
\??\c:\thtbnt.exec:\thtbnt.exe101⤵PID:2076
-
\??\c:\nnntbh.exec:\nnntbh.exe102⤵PID:588
-
\??\c:\7jdjp.exec:\7jdjp.exe103⤵PID:2500
-
\??\c:\ddpjv.exec:\ddpjv.exe104⤵PID:972
-
\??\c:\rfflfff.exec:\rfflfff.exe105⤵PID:1720
-
\??\c:\9xrlrxl.exec:\9xrlrxl.exe106⤵PID:2356
-
\??\c:\lfrfflx.exec:\lfrfflx.exe107⤵PID:2360
-
\??\c:\5nnbhn.exec:\5nnbhn.exe108⤵PID:764
-
\??\c:\9bthnt.exec:\9bthnt.exe109⤵PID:968
-
\??\c:\pjjvj.exec:\pjjvj.exe110⤵PID:2160
-
\??\c:\ppjvj.exec:\ppjvj.exe111⤵PID:1224
-
\??\c:\xlrxrxl.exec:\xlrxrxl.exe112⤵PID:1900
-
\??\c:\xllllrx.exec:\xllllrx.exe113⤵PID:2120
-
\??\c:\3ttttt.exec:\3ttttt.exe114⤵PID:2264
-
\??\c:\ttttbh.exec:\ttttbh.exe115⤵PID:2056
-
\??\c:\9dpvv.exec:\9dpvv.exe116⤵PID:2124
-
\??\c:\dvddd.exec:\dvddd.exe117⤵PID:2496
-
\??\c:\dvpvp.exec:\dvpvp.exe118⤵PID:1544
-
\??\c:\rfrlxrf.exec:\rfrlxrf.exe119⤵PID:2512
-
\??\c:\5tnnnt.exec:\5tnnnt.exe120⤵PID:2828
-
\??\c:\1dddj.exec:\1dddj.exe121⤵PID:2692
-
\??\c:\jpjdj.exec:\jpjdj.exe122⤵PID:2556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-