Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 00:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6c1381517c4540ec3eea864fefd62100_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
6c1381517c4540ec3eea864fefd62100_NeikiAnalytics.exe
-
Size
67KB
-
MD5
6c1381517c4540ec3eea864fefd62100
-
SHA1
a7fc3cd1ddc597df3425f06e82896a93b136e57b
-
SHA256
9110b671c34043162139d93d7954e811e3fc4e2ae41dd07b29591e750af8d6c8
-
SHA512
ce9fb1b26cd64381a9f45ff1bbf888ac082cad631143fac8384ef709f19159ca02a56e2a56a0b56cf57fea484500ad90532f2196441ce590713f9a301d841570
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUPqrDZF:ymb3NkkiQ3mdBjF0yUmr
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/1412-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1412-3-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2152-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1076-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2152 jtrtpf.exe 2832 ttjlhp.exe 2652 btntt.exe 3024 phhbfbx.exe 1800 bfnlphr.exe 2532 fxvprhh.exe 2536 njhvnjx.exe 2668 rjnprnf.exe 2436 rjdtbvn.exe 2444 vdfpvj.exe 2448 xjfnxj.exe 1020 nvttj.exe 2312 pfvvxfp.exe 1892 tdbhr.exe 2000 hhhpff.exe 2336 rxxjxhn.exe 2140 tfdnbj.exe 764 xrtnhtv.exe 2368 bjhdl.exe 2684 hnrxhx.exe 2560 tdbhrx.exe 2484 hhhpfff.exe 1504 jxhlpj.exe 568 jbnnv.exe 1920 ljdpr.exe 1500 bljbbt.exe 1056 dtflrtp.exe 1764 vhnbtv.exe 1076 drvtb.exe 2156 rjxtx.exe 1048 jnbhld.exe 860 xjpjxhj.exe 1588 tdffvn.exe 2116 xfxrrxn.exe 1412 htpvbt.exe 2040 bfnfb.exe 2044 nnfdh.exe 1560 npvddxl.exe 2468 jrhbbrj.exe 3016 nxxflxt.exe 2920 bbjfvln.exe 2524 pjhtnb.exe 2596 lrplfd.exe 2784 bbhrn.exe 1428 rfvdbxv.exe 2416 tdvjdhb.exe 2668 lpxlf.exe 2456 rrjvdv.exe 2076 vblfnt.exe 1576 vnfltp.exe 2360 hvbnxnh.exe 1944 vflpd.exe 1340 jlppp.exe 1196 lxnhnh.exe 1292 vftnjhr.exe 1812 bntxld.exe 2208 ffrrr.exe 2132 njphxfr.exe 2676 ddhvdrp.exe 336 ldxlp.exe 3068 dljbf.exe 2084 ntvvrpj.exe 2692 tlrfr.exe 2484 lnhdd.exe -
resource yara_rule behavioral1/memory/1412-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2368-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1076-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-299-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1412 wrote to memory of 2152 1412 6c1381517c4540ec3eea864fefd62100_NeikiAnalytics.exe 28 PID 1412 wrote to memory of 2152 1412 6c1381517c4540ec3eea864fefd62100_NeikiAnalytics.exe 28 PID 1412 wrote to memory of 2152 1412 6c1381517c4540ec3eea864fefd62100_NeikiAnalytics.exe 28 PID 1412 wrote to memory of 2152 1412 6c1381517c4540ec3eea864fefd62100_NeikiAnalytics.exe 28 PID 2152 wrote to memory of 2832 2152 jtrtpf.exe 29 PID 2152 wrote to memory of 2832 2152 jtrtpf.exe 29 PID 2152 wrote to memory of 2832 2152 jtrtpf.exe 29 PID 2152 wrote to memory of 2832 2152 jtrtpf.exe 29 PID 2832 wrote to memory of 2652 2832 ttjlhp.exe 30 PID 2832 wrote to memory of 2652 2832 ttjlhp.exe 30 PID 2832 wrote to memory of 2652 2832 ttjlhp.exe 30 PID 2832 wrote to memory of 2652 2832 ttjlhp.exe 30 PID 2652 wrote to memory of 3024 2652 btntt.exe 31 PID 2652 wrote to memory of 3024 2652 btntt.exe 31 PID 2652 wrote to memory of 3024 2652 btntt.exe 31 PID 2652 wrote to memory of 3024 2652 btntt.exe 31 PID 3024 wrote to memory of 1800 3024 phhbfbx.exe 32 PID 3024 wrote to memory of 1800 3024 phhbfbx.exe 32 PID 3024 wrote to memory of 1800 3024 phhbfbx.exe 32 PID 3024 wrote to memory of 1800 3024 phhbfbx.exe 32 PID 1800 wrote to memory of 2532 1800 bfnlphr.exe 33 PID 1800 wrote to memory of 2532 1800 bfnlphr.exe 33 PID 1800 wrote to memory of 2532 1800 bfnlphr.exe 33 PID 1800 wrote to memory of 2532 1800 bfnlphr.exe 33 PID 2532 wrote to memory of 2536 2532 fxvprhh.exe 34 PID 2532 wrote to memory of 2536 2532 fxvprhh.exe 34 PID 2532 wrote to memory of 2536 2532 fxvprhh.exe 34 PID 2532 wrote to memory of 2536 2532 fxvprhh.exe 34 PID 2536 wrote to memory of 2668 2536 njhvnjx.exe 35 PID 2536 wrote to memory of 2668 2536 njhvnjx.exe 35 PID 2536 wrote to memory of 2668 2536 njhvnjx.exe 35 PID 2536 wrote to memory of 2668 2536 njhvnjx.exe 35 PID 2668 wrote to memory of 2436 2668 rjnprnf.exe 36 PID 2668 wrote to memory of 2436 2668 rjnprnf.exe 36 PID 2668 wrote to memory of 2436 2668 rjnprnf.exe 36 PID 2668 wrote to memory of 2436 2668 rjnprnf.exe 36 PID 2436 wrote to memory of 2444 2436 rjdtbvn.exe 37 PID 2436 wrote to memory of 2444 2436 rjdtbvn.exe 37 PID 2436 wrote to memory of 2444 2436 rjdtbvn.exe 37 PID 2436 wrote to memory of 2444 2436 rjdtbvn.exe 37 PID 2444 wrote to memory of 2448 2444 vdfpvj.exe 38 PID 2444 wrote to memory of 2448 2444 vdfpvj.exe 38 PID 2444 wrote to memory of 2448 2444 vdfpvj.exe 38 PID 2444 wrote to memory of 2448 2444 vdfpvj.exe 38 PID 2448 wrote to memory of 1020 2448 xjfnxj.exe 39 PID 2448 wrote to memory of 1020 2448 xjfnxj.exe 39 PID 2448 wrote to memory of 1020 2448 xjfnxj.exe 39 PID 2448 wrote to memory of 1020 2448 xjfnxj.exe 39 PID 1020 wrote to memory of 2312 1020 nvttj.exe 40 PID 1020 wrote to memory of 2312 1020 nvttj.exe 40 PID 1020 wrote to memory of 2312 1020 nvttj.exe 40 PID 1020 wrote to memory of 2312 1020 nvttj.exe 40 PID 2312 wrote to memory of 1892 2312 pfvvxfp.exe 41 PID 2312 wrote to memory of 1892 2312 pfvvxfp.exe 41 PID 2312 wrote to memory of 1892 2312 pfvvxfp.exe 41 PID 2312 wrote to memory of 1892 2312 pfvvxfp.exe 41 PID 1892 wrote to memory of 2000 1892 tdbhr.exe 42 PID 1892 wrote to memory of 2000 1892 tdbhr.exe 42 PID 1892 wrote to memory of 2000 1892 tdbhr.exe 42 PID 1892 wrote to memory of 2000 1892 tdbhr.exe 42 PID 2000 wrote to memory of 2336 2000 hhhpff.exe 43 PID 2000 wrote to memory of 2336 2000 hhhpff.exe 43 PID 2000 wrote to memory of 2336 2000 hhhpff.exe 43 PID 2000 wrote to memory of 2336 2000 hhhpff.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c1381517c4540ec3eea864fefd62100_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6c1381517c4540ec3eea864fefd62100_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\jtrtpf.exec:\jtrtpf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\ttjlhp.exec:\ttjlhp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\btntt.exec:\btntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\phhbfbx.exec:\phhbfbx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\bfnlphr.exec:\bfnlphr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\fxvprhh.exec:\fxvprhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\njhvnjx.exec:\njhvnjx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\rjnprnf.exec:\rjnprnf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\rjdtbvn.exec:\rjdtbvn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\vdfpvj.exec:\vdfpvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\xjfnxj.exec:\xjfnxj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\nvttj.exec:\nvttj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\pfvvxfp.exec:\pfvvxfp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\tdbhr.exec:\tdbhr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\hhhpff.exec:\hhhpff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\rxxjxhn.exec:\rxxjxhn.exe17⤵
- Executes dropped EXE
PID:2336 -
\??\c:\tfdnbj.exec:\tfdnbj.exe18⤵
- Executes dropped EXE
PID:2140 -
\??\c:\xrtnhtv.exec:\xrtnhtv.exe19⤵
- Executes dropped EXE
PID:764 -
\??\c:\bjhdl.exec:\bjhdl.exe20⤵
- Executes dropped EXE
PID:2368 -
\??\c:\hnrxhx.exec:\hnrxhx.exe21⤵
- Executes dropped EXE
PID:2684 -
\??\c:\tdbhrx.exec:\tdbhrx.exe22⤵
- Executes dropped EXE
PID:2560 -
\??\c:\hhhpfff.exec:\hhhpfff.exe23⤵
- Executes dropped EXE
PID:2484 -
\??\c:\jxhlpj.exec:\jxhlpj.exe24⤵
- Executes dropped EXE
PID:1504 -
\??\c:\jbnnv.exec:\jbnnv.exe25⤵
- Executes dropped EXE
PID:568 -
\??\c:\ljdpr.exec:\ljdpr.exe26⤵
- Executes dropped EXE
PID:1920 -
\??\c:\bljbbt.exec:\bljbbt.exe27⤵
- Executes dropped EXE
PID:1500 -
\??\c:\dtflrtp.exec:\dtflrtp.exe28⤵
- Executes dropped EXE
PID:1056 -
\??\c:\vhnbtv.exec:\vhnbtv.exe29⤵
- Executes dropped EXE
PID:1764 -
\??\c:\drvtb.exec:\drvtb.exe30⤵
- Executes dropped EXE
PID:1076 -
\??\c:\rjxtx.exec:\rjxtx.exe31⤵
- Executes dropped EXE
PID:2156 -
\??\c:\jnbhld.exec:\jnbhld.exe32⤵
- Executes dropped EXE
PID:1048 -
\??\c:\xjpjxhj.exec:\xjpjxhj.exe33⤵
- Executes dropped EXE
PID:860 -
\??\c:\tdffvn.exec:\tdffvn.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\xfxrrxn.exec:\xfxrrxn.exe35⤵
- Executes dropped EXE
PID:2116 -
\??\c:\htpvbt.exec:\htpvbt.exe36⤵
- Executes dropped EXE
PID:1412 -
\??\c:\bfnfb.exec:\bfnfb.exe37⤵
- Executes dropped EXE
PID:2040 -
\??\c:\nnfdh.exec:\nnfdh.exe38⤵
- Executes dropped EXE
PID:2044 -
\??\c:\npvddxl.exec:\npvddxl.exe39⤵
- Executes dropped EXE
PID:1560 -
\??\c:\jrhbbrj.exec:\jrhbbrj.exe40⤵
- Executes dropped EXE
PID:2468 -
\??\c:\nxxflxt.exec:\nxxflxt.exe41⤵
- Executes dropped EXE
PID:3016 -
\??\c:\bbjfvln.exec:\bbjfvln.exe42⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pjhtnb.exec:\pjhtnb.exe43⤵
- Executes dropped EXE
PID:2524 -
\??\c:\lrplfd.exec:\lrplfd.exe44⤵
- Executes dropped EXE
PID:2596 -
\??\c:\bbhrn.exec:\bbhrn.exe45⤵
- Executes dropped EXE
PID:2784 -
\??\c:\rfvdbxv.exec:\rfvdbxv.exe46⤵
- Executes dropped EXE
PID:1428 -
\??\c:\tdvjdhb.exec:\tdvjdhb.exe47⤵
- Executes dropped EXE
PID:2416 -
\??\c:\lpxlf.exec:\lpxlf.exe48⤵
- Executes dropped EXE
PID:2668 -
\??\c:\rrjvdv.exec:\rrjvdv.exe49⤵
- Executes dropped EXE
PID:2456 -
\??\c:\vblfnt.exec:\vblfnt.exe50⤵
- Executes dropped EXE
PID:2076 -
\??\c:\vnfltp.exec:\vnfltp.exe51⤵
- Executes dropped EXE
PID:1576 -
\??\c:\hvbnxnh.exec:\hvbnxnh.exe52⤵
- Executes dropped EXE
PID:2360 -
\??\c:\vflpd.exec:\vflpd.exe53⤵
- Executes dropped EXE
PID:1944 -
\??\c:\jlppp.exec:\jlppp.exe54⤵
- Executes dropped EXE
PID:1340 -
\??\c:\lxnhnh.exec:\lxnhnh.exe55⤵
- Executes dropped EXE
PID:1196 -
\??\c:\vftnjhr.exec:\vftnjhr.exe56⤵
- Executes dropped EXE
PID:1292 -
\??\c:\bntxld.exec:\bntxld.exe57⤵
- Executes dropped EXE
PID:1812 -
\??\c:\ffrrr.exec:\ffrrr.exe58⤵
- Executes dropped EXE
PID:2208 -
\??\c:\njphxfr.exec:\njphxfr.exe59⤵
- Executes dropped EXE
PID:2132 -
\??\c:\ddhvdrp.exec:\ddhvdrp.exe60⤵
- Executes dropped EXE
PID:2676 -
\??\c:\ldxlp.exec:\ldxlp.exe61⤵
- Executes dropped EXE
PID:336 -
\??\c:\dljbf.exec:\dljbf.exe62⤵
- Executes dropped EXE
PID:3068 -
\??\c:\ntvvrpj.exec:\ntvvrpj.exe63⤵
- Executes dropped EXE
PID:2084 -
\??\c:\tlrfr.exec:\tlrfr.exe64⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lnhdd.exec:\lnhdd.exe65⤵
- Executes dropped EXE
PID:2484 -
\??\c:\tbplpft.exec:\tbplpft.exe66⤵PID:2480
-
\??\c:\fljxvpt.exec:\fljxvpt.exe67⤵PID:2356
-
\??\c:\phrnd.exec:\phrnd.exe68⤵PID:1372
-
\??\c:\ntjrp.exec:\ntjrp.exe69⤵PID:1680
-
\??\c:\hxfvv.exec:\hxfvv.exe70⤵PID:2736
-
\??\c:\vtltd.exec:\vtltd.exe71⤵PID:1748
-
\??\c:\brjvxnp.exec:\brjvxnp.exe72⤵PID:832
-
\??\c:\tjblttt.exec:\tjblttt.exe73⤵PID:2260
-
\??\c:\vdxflvr.exec:\vdxflvr.exe74⤵PID:2108
-
\??\c:\fbfxjj.exec:\fbfxjj.exe75⤵PID:2172
-
\??\c:\txpjx.exec:\txpjx.exe76⤵PID:2212
-
\??\c:\ttvtlb.exec:\ttvtlb.exe77⤵PID:2680
-
\??\c:\plbfrbr.exec:\plbfrbr.exe78⤵PID:2196
-
\??\c:\ffxfndf.exec:\ffxfndf.exe79⤵PID:2308
-
\??\c:\rlflv.exec:\rlflv.exe80⤵PID:2812
-
\??\c:\nxvnj.exec:\nxvnj.exe81⤵PID:1568
-
\??\c:\lrltpjt.exec:\lrltpjt.exe82⤵PID:2872
-
\??\c:\frhnjfp.exec:\frhnjfp.exe83⤵PID:2832
-
\??\c:\dpnrfxp.exec:\dpnrfxp.exe84⤵PID:2940
-
\??\c:\lxhhptt.exec:\lxhhptt.exe85⤵PID:2896
-
\??\c:\nhdfjlr.exec:\nhdfjlr.exe86⤵PID:2960
-
\??\c:\lddffn.exec:\lddffn.exe87⤵PID:1800
-
\??\c:\xntht.exec:\xntht.exe88⤵PID:2584
-
\??\c:\pxjvblj.exec:\pxjvblj.exe89⤵PID:2620
-
\??\c:\tjnxpb.exec:\tjnxpb.exe90⤵PID:2420
-
\??\c:\vfttfj.exec:\vfttfj.exe91⤵PID:2380
-
\??\c:\pxndll.exec:\pxndll.exe92⤵PID:2396
-
\??\c:\tbhrd.exec:\tbhrd.exe93⤵PID:2324
-
\??\c:\tdtrrv.exec:\tdtrrv.exe94⤵PID:3064
-
\??\c:\pvxvvn.exec:\pvxvvn.exe95⤵PID:2856
-
\??\c:\pnjhl.exec:\pnjhl.exe96⤵PID:2032
-
\??\c:\vvtfff.exec:\vvtfff.exe97⤵PID:1696
-
\??\c:\ddrnbl.exec:\ddrnbl.exe98⤵PID:1876
-
\??\c:\hrhhft.exec:\hrhhft.exe99⤵PID:2344
-
\??\c:\fxlfp.exec:\fxlfp.exe100⤵PID:2000
-
\??\c:\rtrvl.exec:\rtrvl.exe101⤵PID:2164
-
\??\c:\fxhhft.exec:\fxhhft.exe102⤵PID:2336
-
\??\c:\dflvf.exec:\dflvf.exe103⤵PID:1684
-
\??\c:\rftvlj.exec:\rftvlj.exe104⤵PID:1788
-
\??\c:\xdxrr.exec:\xdxrr.exe105⤵PID:588
-
\??\c:\hjxhdh.exec:\hjxhdh.exe106⤵PID:2828
-
\??\c:\jpbhhrr.exec:\jpbhhrr.exe107⤵PID:2720
-
\??\c:\dltffnh.exec:\dltffnh.exe108⤵PID:2560
-
\??\c:\ddrndp.exec:\ddrndp.exe109⤵PID:2628
-
\??\c:\vjlnh.exec:\vjlnh.exe110⤵PID:2064
-
\??\c:\xdvpdp.exec:\xdvpdp.exe111⤵PID:852
-
\??\c:\xhthrxx.exec:\xhthrxx.exe112⤵PID:1028
-
\??\c:\phpfp.exec:\phpfp.exe113⤵PID:632
-
\??\c:\dtdfh.exec:\dtdfh.exe114⤵PID:1624
-
\??\c:\lrhbjtv.exec:\lrhbjtv.exe115⤵PID:1056
-
\??\c:\vrfpxlf.exec:\vrfpxlf.exe116⤵PID:880
-
\??\c:\fnnjjt.exec:\fnnjjt.exe117⤵PID:1852
-
\??\c:\dxlxjnn.exec:\dxlxjnn.exe118⤵PID:2224
-
\??\c:\tnxfxh.exec:\tnxfxh.exe119⤵PID:2156
-
\??\c:\pljrf.exec:\pljrf.exe120⤵PID:2976
-
\??\c:\vfrbjp.exec:\vfrbjp.exe121⤵PID:2268
-
\??\c:\fvlrbf.exec:\fvlrbf.exe122⤵PID:2200
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-