Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 17:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bfcc09368ed99958968933ed3065fa40_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
bfcc09368ed99958968933ed3065fa40_NeikiAnalytics.exe
-
Size
94KB
-
MD5
bfcc09368ed99958968933ed3065fa40
-
SHA1
c3ea9a6c8ba17149e1ee83e4f6fdae6c46ef03b1
-
SHA256
79c73d8395a231a586d5e6b8c144a021443d4ef1a4e8335a1eceb1d1dc982021
-
SHA512
691ebdda08f6d48bbe0dcc77f260bd7864690f98c33dfff251e487cf15566094e93bca8c5c12d7f0ad1607ef3878336fc880267014c4cad38b6ec1bce310f152
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxEPOfPrA2:ymb3NkkiQ3mdBjFo73PYP1lri3KuOnrL
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2244-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-42-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-31-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2844-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/824-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/632-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1836-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/596-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/960-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/564-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2984-1516-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2116 bnjttd.exe 2984 lttflrp.exe 2636 xphvh.exe 2548 pxpxvl.exe 2540 thdrdvb.exe 2592 frttv.exe 2428 drnppxr.exe 2844 fbbjtt.exe 520 lbhbt.exe 824 ntdrfvn.exe 2668 prlvnb.exe 632 rblrvdh.exe 2032 xvxjnlr.exe 2232 plxrbt.exe 1176 xtjjvhd.exe 1772 fntbpdr.exe 1696 nxdxrf.exe 1836 dvxhr.exe 2152 jfljhnp.exe 596 fldprvh.exe 2064 hfnhln.exe 2948 bhbblb.exe 1688 lpxdv.exe 1540 bhffv.exe 960 rfhdhx.exe 1028 vlbtpvf.exe 1972 xnfhnrj.exe 564 rjhnht.exe 3020 jblvnnp.exe 1536 phxttpt.exe 2200 blvllt.exe 2364 pxddtxl.exe 1408 brvtvp.exe 2552 xbnfdlf.exe 2636 bnlrjdl.exe 2572 ndffvv.exe 2576 xpnhh.exe 2584 rrhhxnh.exe 2600 djllv.exe 2460 pjrdl.exe 2440 rbdrjjb.exe 2828 thnntx.exe 2428 rvpbr.exe 2404 pprpdf.exe 1324 nhdhd.exe 1748 jxtxvn.exe 1740 vpftdhh.exe 2816 pfhxb.exe 1796 djbbr.exe 1964 pdbtld.exe 2024 lhtvdh.exe 2028 bddlllb.exe 876 xbpljhv.exe 1656 hlhfnj.exe 1756 dphvhj.exe 2280 rlpjf.exe 324 rrfnn.exe 2080 nrlbpjp.exe 2924 nblrpr.exe 2188 hxvnjbl.exe 2312 ppltj.exe 2964 jrhfhr.exe 1852 vxltp.exe 1808 pbbptt.exe -
resource yara_rule behavioral1/memory/2244-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2116-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/824-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/632-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1836-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/596-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/960-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/564-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-837-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-1516-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2116 2244 bfcc09368ed99958968933ed3065fa40_NeikiAnalytics.exe 28 PID 2244 wrote to memory of 2116 2244 bfcc09368ed99958968933ed3065fa40_NeikiAnalytics.exe 28 PID 2244 wrote to memory of 2116 2244 bfcc09368ed99958968933ed3065fa40_NeikiAnalytics.exe 28 PID 2244 wrote to memory of 2116 2244 bfcc09368ed99958968933ed3065fa40_NeikiAnalytics.exe 28 PID 2116 wrote to memory of 2984 2116 bnjttd.exe 29 PID 2116 wrote to memory of 2984 2116 bnjttd.exe 29 PID 2116 wrote to memory of 2984 2116 bnjttd.exe 29 PID 2116 wrote to memory of 2984 2116 bnjttd.exe 29 PID 2984 wrote to memory of 2636 2984 lttflrp.exe 30 PID 2984 wrote to memory of 2636 2984 lttflrp.exe 30 PID 2984 wrote to memory of 2636 2984 lttflrp.exe 30 PID 2984 wrote to memory of 2636 2984 lttflrp.exe 30 PID 2636 wrote to memory of 2548 2636 xphvh.exe 31 PID 2636 wrote to memory of 2548 2636 xphvh.exe 31 PID 2636 wrote to memory of 2548 2636 xphvh.exe 31 PID 2636 wrote to memory of 2548 2636 xphvh.exe 31 PID 2548 wrote to memory of 2540 2548 pxpxvl.exe 32 PID 2548 wrote to memory of 2540 2548 pxpxvl.exe 32 PID 2548 wrote to memory of 2540 2548 pxpxvl.exe 32 PID 2548 wrote to memory of 2540 2548 pxpxvl.exe 32 PID 2540 wrote to memory of 2592 2540 thdrdvb.exe 33 PID 2540 wrote to memory of 2592 2540 thdrdvb.exe 33 PID 2540 wrote to memory of 2592 2540 thdrdvb.exe 33 PID 2540 wrote to memory of 2592 2540 thdrdvb.exe 33 PID 2592 wrote to memory of 2428 2592 frttv.exe 34 PID 2592 wrote to memory of 2428 2592 frttv.exe 34 PID 2592 wrote to memory of 2428 2592 frttv.exe 34 PID 2592 wrote to memory of 2428 2592 frttv.exe 34 PID 2428 wrote to memory of 2844 2428 drnppxr.exe 35 PID 2428 wrote to memory of 2844 2428 drnppxr.exe 35 PID 2428 wrote to memory of 2844 2428 drnppxr.exe 35 PID 2428 wrote to memory of 2844 2428 drnppxr.exe 35 PID 2844 wrote to memory of 520 2844 fbbjtt.exe 36 PID 2844 wrote to memory of 520 2844 fbbjtt.exe 36 PID 2844 wrote to memory of 520 2844 fbbjtt.exe 36 PID 2844 wrote to memory of 520 2844 fbbjtt.exe 36 PID 520 wrote to memory of 824 520 lbhbt.exe 37 PID 520 wrote to memory of 824 520 lbhbt.exe 37 PID 520 wrote to memory of 824 520 lbhbt.exe 37 PID 520 wrote to memory of 824 520 lbhbt.exe 37 PID 824 wrote to memory of 2668 824 ntdrfvn.exe 38 PID 824 wrote to memory of 2668 824 ntdrfvn.exe 38 PID 824 wrote to memory of 2668 824 ntdrfvn.exe 38 PID 824 wrote to memory of 2668 824 ntdrfvn.exe 38 PID 2668 wrote to memory of 632 2668 prlvnb.exe 39 PID 2668 wrote to memory of 632 2668 prlvnb.exe 39 PID 2668 wrote to memory of 632 2668 prlvnb.exe 39 PID 2668 wrote to memory of 632 2668 prlvnb.exe 39 PID 632 wrote to memory of 2032 632 rblrvdh.exe 40 PID 632 wrote to memory of 2032 632 rblrvdh.exe 40 PID 632 wrote to memory of 2032 632 rblrvdh.exe 40 PID 632 wrote to memory of 2032 632 rblrvdh.exe 40 PID 2032 wrote to memory of 2232 2032 xvxjnlr.exe 41 PID 2032 wrote to memory of 2232 2032 xvxjnlr.exe 41 PID 2032 wrote to memory of 2232 2032 xvxjnlr.exe 41 PID 2032 wrote to memory of 2232 2032 xvxjnlr.exe 41 PID 2232 wrote to memory of 1176 2232 plxrbt.exe 42 PID 2232 wrote to memory of 1176 2232 plxrbt.exe 42 PID 2232 wrote to memory of 1176 2232 plxrbt.exe 42 PID 2232 wrote to memory of 1176 2232 plxrbt.exe 42 PID 1176 wrote to memory of 1772 1176 xtjjvhd.exe 43 PID 1176 wrote to memory of 1772 1176 xtjjvhd.exe 43 PID 1176 wrote to memory of 1772 1176 xtjjvhd.exe 43 PID 1176 wrote to memory of 1772 1176 xtjjvhd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfcc09368ed99958968933ed3065fa40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bfcc09368ed99958968933ed3065fa40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\bnjttd.exec:\bnjttd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\lttflrp.exec:\lttflrp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\xphvh.exec:\xphvh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\pxpxvl.exec:\pxpxvl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\thdrdvb.exec:\thdrdvb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\frttv.exec:\frttv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\drnppxr.exec:\drnppxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\fbbjtt.exec:\fbbjtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\lbhbt.exec:\lbhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
\??\c:\ntdrfvn.exec:\ntdrfvn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\prlvnb.exec:\prlvnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\rblrvdh.exec:\rblrvdh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\xvxjnlr.exec:\xvxjnlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\plxrbt.exec:\plxrbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\xtjjvhd.exec:\xtjjvhd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\fntbpdr.exec:\fntbpdr.exe17⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nxdxrf.exec:\nxdxrf.exe18⤵
- Executes dropped EXE
PID:1696 -
\??\c:\dvxhr.exec:\dvxhr.exe19⤵
- Executes dropped EXE
PID:1836 -
\??\c:\jfljhnp.exec:\jfljhnp.exe20⤵
- Executes dropped EXE
PID:2152 -
\??\c:\fldprvh.exec:\fldprvh.exe21⤵
- Executes dropped EXE
PID:596 -
\??\c:\hfnhln.exec:\hfnhln.exe22⤵
- Executes dropped EXE
PID:2064 -
\??\c:\bhbblb.exec:\bhbblb.exe23⤵
- Executes dropped EXE
PID:2948 -
\??\c:\lpxdv.exec:\lpxdv.exe24⤵
- Executes dropped EXE
PID:1688 -
\??\c:\bhffv.exec:\bhffv.exe25⤵
- Executes dropped EXE
PID:1540 -
\??\c:\rfhdhx.exec:\rfhdhx.exe26⤵
- Executes dropped EXE
PID:960 -
\??\c:\vlbtpvf.exec:\vlbtpvf.exe27⤵
- Executes dropped EXE
PID:1028 -
\??\c:\xnfhnrj.exec:\xnfhnrj.exe28⤵
- Executes dropped EXE
PID:1972 -
\??\c:\rjhnht.exec:\rjhnht.exe29⤵
- Executes dropped EXE
PID:564 -
\??\c:\jblvnnp.exec:\jblvnnp.exe30⤵
- Executes dropped EXE
PID:3020 -
\??\c:\phxttpt.exec:\phxttpt.exe31⤵
- Executes dropped EXE
PID:1536 -
\??\c:\blvllt.exec:\blvllt.exe32⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pxddtxl.exec:\pxddtxl.exe33⤵
- Executes dropped EXE
PID:2364 -
\??\c:\brvtvp.exec:\brvtvp.exe34⤵
- Executes dropped EXE
PID:1408 -
\??\c:\ltphn.exec:\ltphn.exe35⤵PID:2116
-
\??\c:\xbnfdlf.exec:\xbnfdlf.exe36⤵
- Executes dropped EXE
PID:2552 -
\??\c:\bnlrjdl.exec:\bnlrjdl.exe37⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ndffvv.exec:\ndffvv.exe38⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xpnhh.exec:\xpnhh.exe39⤵
- Executes dropped EXE
PID:2576 -
\??\c:\rrhhxnh.exec:\rrhhxnh.exe40⤵
- Executes dropped EXE
PID:2584 -
\??\c:\djllv.exec:\djllv.exe41⤵
- Executes dropped EXE
PID:2600 -
\??\c:\pjrdl.exec:\pjrdl.exe42⤵
- Executes dropped EXE
PID:2460 -
\??\c:\rbdrjjb.exec:\rbdrjjb.exe43⤵
- Executes dropped EXE
PID:2440 -
\??\c:\thnntx.exec:\thnntx.exe44⤵
- Executes dropped EXE
PID:2828 -
\??\c:\rvpbr.exec:\rvpbr.exe45⤵
- Executes dropped EXE
PID:2428 -
\??\c:\pprpdf.exec:\pprpdf.exe46⤵
- Executes dropped EXE
PID:2404 -
\??\c:\nhdhd.exec:\nhdhd.exe47⤵
- Executes dropped EXE
PID:1324 -
\??\c:\jxtxvn.exec:\jxtxvn.exe48⤵
- Executes dropped EXE
PID:1748 -
\??\c:\vpftdhh.exec:\vpftdhh.exe49⤵
- Executes dropped EXE
PID:1740 -
\??\c:\pfhxb.exec:\pfhxb.exe50⤵
- Executes dropped EXE
PID:2816 -
\??\c:\djbbr.exec:\djbbr.exe51⤵
- Executes dropped EXE
PID:1796 -
\??\c:\pdbtld.exec:\pdbtld.exe52⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lhtvdh.exec:\lhtvdh.exe53⤵
- Executes dropped EXE
PID:2024 -
\??\c:\bddlllb.exec:\bddlllb.exe54⤵
- Executes dropped EXE
PID:2028 -
\??\c:\xbpljhv.exec:\xbpljhv.exe55⤵
- Executes dropped EXE
PID:876 -
\??\c:\hlhfnj.exec:\hlhfnj.exe56⤵
- Executes dropped EXE
PID:1656 -
\??\c:\dphvhj.exec:\dphvhj.exe57⤵
- Executes dropped EXE
PID:1756 -
\??\c:\rlpjf.exec:\rlpjf.exe58⤵
- Executes dropped EXE
PID:2280 -
\??\c:\rrfnn.exec:\rrfnn.exe59⤵
- Executes dropped EXE
PID:324 -
\??\c:\nrlbpjp.exec:\nrlbpjp.exe60⤵
- Executes dropped EXE
PID:2080 -
\??\c:\nblrpr.exec:\nblrpr.exe61⤵
- Executes dropped EXE
PID:2924 -
\??\c:\hxvnjbl.exec:\hxvnjbl.exe62⤵
- Executes dropped EXE
PID:2188 -
\??\c:\ppltj.exec:\ppltj.exe63⤵
- Executes dropped EXE
PID:2312 -
\??\c:\jrhfhr.exec:\jrhfhr.exe64⤵
- Executes dropped EXE
PID:2964 -
\??\c:\vxltp.exec:\vxltp.exe65⤵
- Executes dropped EXE
PID:1852 -
\??\c:\pbbptt.exec:\pbbptt.exe66⤵
- Executes dropped EXE
PID:1808 -
\??\c:\vdjbpdp.exec:\vdjbpdp.exe67⤵PID:1348
-
\??\c:\drhxrpd.exec:\drhxrpd.exe68⤵PID:1288
-
\??\c:\fxtndr.exec:\fxtndr.exe69⤵PID:1824
-
\??\c:\xpxtx.exec:\xpxtx.exe70⤵PID:2100
-
\??\c:\lltphb.exec:\lltphb.exe71⤵PID:2820
-
\??\c:\ptlhth.exec:\ptlhth.exe72⤵PID:2148
-
\??\c:\vrtrffp.exec:\vrtrffp.exe73⤵PID:2324
-
\??\c:\ptfdt.exec:\ptfdt.exe74⤵PID:2400
-
\??\c:\bprxdh.exec:\bprxdh.exe75⤵PID:2508
-
\??\c:\ptpnff.exec:\ptpnff.exe76⤵PID:1224
-
\??\c:\vhtxphn.exec:\vhtxphn.exe77⤵PID:3012
-
\??\c:\ndlrn.exec:\ndlrn.exe78⤵PID:2696
-
\??\c:\tpdfrh.exec:\tpdfrh.exe79⤵PID:2760
-
\??\c:\jlvbjd.exec:\jlvbjd.exe80⤵PID:2704
-
\??\c:\lpjpfv.exec:\lpjpfv.exe81⤵PID:1592
-
\??\c:\ndjhbtv.exec:\ndjhbtv.exe82⤵PID:2156
-
\??\c:\fvldhdt.exec:\fvldhdt.exe83⤵PID:1244
-
\??\c:\nrhnrp.exec:\nrhnrp.exe84⤵PID:2540
-
\??\c:\lxpftbh.exec:\lxpftbh.exe85⤵PID:2600
-
\??\c:\rvpndv.exec:\rvpndv.exe86⤵PID:2460
-
\??\c:\bjflt.exec:\bjflt.exe87⤵PID:2448
-
\??\c:\bfvtj.exec:\bfvtj.exe88⤵PID:2828
-
\??\c:\blrft.exec:\blrft.exe89⤵PID:2172
-
\??\c:\fjtvl.exec:\fjtvl.exe90⤵PID:1524
-
\??\c:\rbnnlx.exec:\rbnnlx.exe91⤵PID:1732
-
\??\c:\bjntltd.exec:\bjntltd.exe92⤵PID:2512
-
\??\c:\drtfrrr.exec:\drtfrrr.exe93⤵PID:1956
-
\??\c:\xjtxt.exec:\xjtxt.exe94⤵PID:1820
-
\??\c:\ppnpj.exec:\ppnpj.exe95⤵PID:2248
-
\??\c:\tfpfdfl.exec:\tfpfdfl.exe96⤵PID:1048
-
\??\c:\hprjl.exec:\hprjl.exe97⤵PID:1624
-
\??\c:\hrndvx.exec:\hrndvx.exe98⤵PID:2256
-
\??\c:\lfdhtxn.exec:\lfdhtxn.exe99⤵PID:1700
-
\??\c:\ljfllp.exec:\ljfllp.exe100⤵PID:1620
-
\??\c:\hrbrjt.exec:\hrbrjt.exe101⤵PID:1756
-
\??\c:\nfvtrbv.exec:\nfvtrbv.exe102⤵PID:2780
-
\??\c:\lfhflf.exec:\lfhflf.exe103⤵PID:592
-
\??\c:\hthpd.exec:\hthpd.exe104⤵PID:2080
-
\??\c:\xdllv.exec:\xdllv.exe105⤵PID:2300
-
\??\c:\dfbnfv.exec:\dfbnfv.exe106⤵PID:2188
-
\??\c:\xhfbrpl.exec:\xhfbrpl.exe107⤵PID:436
-
\??\c:\nxhfft.exec:\nxhfft.exe108⤵PID:2964
-
\??\c:\rnbvbx.exec:\rnbvbx.exe109⤵PID:1764
-
\??\c:\tllxplx.exec:\tllxplx.exe110⤵PID:960
-
\??\c:\blfdnd.exec:\blfdnd.exe111⤵PID:1816
-
\??\c:\tlhptn.exec:\tlhptn.exe112⤵PID:612
-
\??\c:\xlvfflf.exec:\xlvfflf.exe113⤵PID:2164
-
\??\c:\nxrvdj.exec:\nxrvdj.exe114⤵PID:2968
-
\??\c:\jddhxtj.exec:\jddhxtj.exe115⤵PID:3020
-
\??\c:\ttxhfjt.exec:\ttxhfjt.exe116⤵PID:3028
-
\??\c:\rxnhxph.exec:\rxnhxph.exe117⤵PID:2356
-
\??\c:\drfjrxj.exec:\drfjrxj.exe118⤵PID:2272
-
\??\c:\lhthfn.exec:\lhthfn.exe119⤵PID:2112
-
\??\c:\bxnvxpl.exec:\bxnvxpl.exe120⤵PID:2516
-
\??\c:\pjphrt.exec:\pjphrt.exe121⤵PID:1640
-
\??\c:\vpxftp.exec:\vpxftp.exe122⤵PID:2620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-