Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 11:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eb0d5802013db668be9c89585d10f940_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
eb0d5802013db668be9c89585d10f940_NeikiAnalytics.exe
-
Size
61KB
-
MD5
eb0d5802013db668be9c89585d10f940
-
SHA1
ab80ad62580d795cbfe08bc46158f25f975f83dd
-
SHA256
814fad9d538970814edfab2489098ad61ed10fcec27b3208155226cbf7f6fd58
-
SHA512
19b7952b33fa5da56434838994902948886e0b879547cfd9e3b501a756da7fd580db039501fb81f1f545463f5b1af8551a5d4365991ca4c06143b721e396d5db
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIug6b+:ymb3NkkiQ3mdBjFIugR
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2632-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1224-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1224-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1440-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1628-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1152-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/848-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/776-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/980-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1224 lnttvp.exe 1640 njnnrh.exe 2632 prxxlr.exe 2760 ddbvbbr.exe 2692 bfhpv.exe 2724 nlxrj.exe 2456 vbvvh.exe 2932 fhtlp.exe 776 vnpnl.exe 1628 hjxrpht.exe 2728 rfvpx.exe 2236 phfpphf.exe 1996 lhvppv.exe 2028 njtxp.exe 1152 rbthxdl.exe 764 pnrjxb.exe 1692 hhfln.exe 1616 jjrhtp.exe 2308 nhfvlpt.exe 2656 jrlxbbn.exe 1936 rrttdr.exe 848 xrjxbrv.exe 2056 jpvntx.exe 2040 fpjjj.exe 984 jxbhbhr.exe 1604 drfrfd.exe 1940 tbnrrr.exe 980 pbnxbrx.exe 544 rpnrfph.exe 1608 nvxnf.exe 2956 nbpjpbt.exe 2360 rnxrdvx.exe 2348 nbxttp.exe 2984 hxfhbph.exe 2552 ptdphjh.exe 2916 pjxrjd.exe 2628 ddffv.exe 2564 vnxfxjf.exe 2548 ppxtf.exe 2448 xrdbhr.exe 2720 hvtxjvn.exe 2072 drrjnnx.exe 2680 jfhpj.exe 3016 bvjxpv.exe 2428 lbjhp.exe 2892 rlndpp.exe 836 jxvxpb.exe 1084 rpjrpd.exe 568 xdlnhld.exe 1796 rtxhl.exe 1992 hxrxtt.exe 2224 xjpxb.exe 1044 bpnxtf.exe 1152 blvtff.exe 1696 drjvfl.exe 1756 jxnthdp.exe 1700 tjphbbj.exe 1680 vhdxvl.exe 2108 dnbftht.exe 2904 bfvbjt.exe 304 nxxbvn.exe 276 tjpxxd.exe 1296 fljrvpt.exe 1540 hlrvx.exe -
resource yara_rule behavioral1/memory/1440-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1224-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1628-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1152-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/776-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/980-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1608-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1440 wrote to memory of 1224 1440 eb0d5802013db668be9c89585d10f940_NeikiAnalytics.exe 28 PID 1440 wrote to memory of 1224 1440 eb0d5802013db668be9c89585d10f940_NeikiAnalytics.exe 28 PID 1440 wrote to memory of 1224 1440 eb0d5802013db668be9c89585d10f940_NeikiAnalytics.exe 28 PID 1440 wrote to memory of 1224 1440 eb0d5802013db668be9c89585d10f940_NeikiAnalytics.exe 28 PID 1224 wrote to memory of 1640 1224 lnttvp.exe 29 PID 1224 wrote to memory of 1640 1224 lnttvp.exe 29 PID 1224 wrote to memory of 1640 1224 lnttvp.exe 29 PID 1224 wrote to memory of 1640 1224 lnttvp.exe 29 PID 1640 wrote to memory of 2632 1640 njnnrh.exe 30 PID 1640 wrote to memory of 2632 1640 njnnrh.exe 30 PID 1640 wrote to memory of 2632 1640 njnnrh.exe 30 PID 1640 wrote to memory of 2632 1640 njnnrh.exe 30 PID 2632 wrote to memory of 2760 2632 prxxlr.exe 31 PID 2632 wrote to memory of 2760 2632 prxxlr.exe 31 PID 2632 wrote to memory of 2760 2632 prxxlr.exe 31 PID 2632 wrote to memory of 2760 2632 prxxlr.exe 31 PID 2760 wrote to memory of 2692 2760 ddbvbbr.exe 32 PID 2760 wrote to memory of 2692 2760 ddbvbbr.exe 32 PID 2760 wrote to memory of 2692 2760 ddbvbbr.exe 32 PID 2760 wrote to memory of 2692 2760 ddbvbbr.exe 32 PID 2692 wrote to memory of 2724 2692 bfhpv.exe 33 PID 2692 wrote to memory of 2724 2692 bfhpv.exe 33 PID 2692 wrote to memory of 2724 2692 bfhpv.exe 33 PID 2692 wrote to memory of 2724 2692 bfhpv.exe 33 PID 2724 wrote to memory of 2456 2724 nlxrj.exe 34 PID 2724 wrote to memory of 2456 2724 nlxrj.exe 34 PID 2724 wrote to memory of 2456 2724 nlxrj.exe 34 PID 2724 wrote to memory of 2456 2724 nlxrj.exe 34 PID 2456 wrote to memory of 2932 2456 vbvvh.exe 35 PID 2456 wrote to memory of 2932 2456 vbvvh.exe 35 PID 2456 wrote to memory of 2932 2456 vbvvh.exe 35 PID 2456 wrote to memory of 2932 2456 vbvvh.exe 35 PID 2932 wrote to memory of 776 2932 fhtlp.exe 36 PID 2932 wrote to memory of 776 2932 fhtlp.exe 36 PID 2932 wrote to memory of 776 2932 fhtlp.exe 36 PID 2932 wrote to memory of 776 2932 fhtlp.exe 36 PID 776 wrote to memory of 1628 776 vnpnl.exe 37 PID 776 wrote to memory of 1628 776 vnpnl.exe 37 PID 776 wrote to memory of 1628 776 vnpnl.exe 37 PID 776 wrote to memory of 1628 776 vnpnl.exe 37 PID 1628 wrote to memory of 2728 1628 hjxrpht.exe 38 PID 1628 wrote to memory of 2728 1628 hjxrpht.exe 38 PID 1628 wrote to memory of 2728 1628 hjxrpht.exe 38 PID 1628 wrote to memory of 2728 1628 hjxrpht.exe 38 PID 2728 wrote to memory of 2236 2728 rfvpx.exe 39 PID 2728 wrote to memory of 2236 2728 rfvpx.exe 39 PID 2728 wrote to memory of 2236 2728 rfvpx.exe 39 PID 2728 wrote to memory of 2236 2728 rfvpx.exe 39 PID 2236 wrote to memory of 1996 2236 phfpphf.exe 40 PID 2236 wrote to memory of 1996 2236 phfpphf.exe 40 PID 2236 wrote to memory of 1996 2236 phfpphf.exe 40 PID 2236 wrote to memory of 1996 2236 phfpphf.exe 40 PID 1996 wrote to memory of 2028 1996 lhvppv.exe 41 PID 1996 wrote to memory of 2028 1996 lhvppv.exe 41 PID 1996 wrote to memory of 2028 1996 lhvppv.exe 41 PID 1996 wrote to memory of 2028 1996 lhvppv.exe 41 PID 2028 wrote to memory of 1152 2028 njtxp.exe 81 PID 2028 wrote to memory of 1152 2028 njtxp.exe 81 PID 2028 wrote to memory of 1152 2028 njtxp.exe 81 PID 2028 wrote to memory of 1152 2028 njtxp.exe 81 PID 1152 wrote to memory of 764 1152 rbthxdl.exe 43 PID 1152 wrote to memory of 764 1152 rbthxdl.exe 43 PID 1152 wrote to memory of 764 1152 rbthxdl.exe 43 PID 1152 wrote to memory of 764 1152 rbthxdl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb0d5802013db668be9c89585d10f940_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\eb0d5802013db668be9c89585d10f940_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\lnttvp.exec:\lnttvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\njnnrh.exec:\njnnrh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\prxxlr.exec:\prxxlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\ddbvbbr.exec:\ddbvbbr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\bfhpv.exec:\bfhpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\nlxrj.exec:\nlxrj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\vbvvh.exec:\vbvvh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\fhtlp.exec:\fhtlp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\vnpnl.exec:\vnpnl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\hjxrpht.exec:\hjxrpht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\rfvpx.exec:\rfvpx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\phfpphf.exec:\phfpphf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\lhvppv.exec:\lhvppv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\njtxp.exec:\njtxp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\rbthxdl.exec:\rbthxdl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\pnrjxb.exec:\pnrjxb.exe17⤵
- Executes dropped EXE
PID:764 -
\??\c:\hhfln.exec:\hhfln.exe18⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jjrhtp.exec:\jjrhtp.exe19⤵
- Executes dropped EXE
PID:1616 -
\??\c:\nhfvlpt.exec:\nhfvlpt.exe20⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jrlxbbn.exec:\jrlxbbn.exe21⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rrttdr.exec:\rrttdr.exe22⤵
- Executes dropped EXE
PID:1936 -
\??\c:\xrjxbrv.exec:\xrjxbrv.exe23⤵
- Executes dropped EXE
PID:848 -
\??\c:\jpvntx.exec:\jpvntx.exe24⤵
- Executes dropped EXE
PID:2056 -
\??\c:\fpjjj.exec:\fpjjj.exe25⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jxbhbhr.exec:\jxbhbhr.exe26⤵
- Executes dropped EXE
PID:984 -
\??\c:\drfrfd.exec:\drfrfd.exe27⤵
- Executes dropped EXE
PID:1604 -
\??\c:\tbnrrr.exec:\tbnrrr.exe28⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pbnxbrx.exec:\pbnxbrx.exe29⤵
- Executes dropped EXE
PID:980 -
\??\c:\rpnrfph.exec:\rpnrfph.exe30⤵
- Executes dropped EXE
PID:544 -
\??\c:\nvxnf.exec:\nvxnf.exe31⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nbpjpbt.exec:\nbpjpbt.exe32⤵
- Executes dropped EXE
PID:2956 -
\??\c:\rnxrdvx.exec:\rnxrdvx.exe33⤵
- Executes dropped EXE
PID:2360 -
\??\c:\nbxttp.exec:\nbxttp.exe34⤵
- Executes dropped EXE
PID:2348 -
\??\c:\hxfhbph.exec:\hxfhbph.exe35⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ptdphjh.exec:\ptdphjh.exe36⤵
- Executes dropped EXE
PID:2552 -
\??\c:\pjxrjd.exec:\pjxrjd.exe37⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ddffv.exec:\ddffv.exe38⤵
- Executes dropped EXE
PID:2628 -
\??\c:\vnxfxjf.exec:\vnxfxjf.exe39⤵
- Executes dropped EXE
PID:2564 -
\??\c:\ppxtf.exec:\ppxtf.exe40⤵
- Executes dropped EXE
PID:2548 -
\??\c:\xrdbhr.exec:\xrdbhr.exe41⤵
- Executes dropped EXE
PID:2448 -
\??\c:\hvtxjvn.exec:\hvtxjvn.exe42⤵
- Executes dropped EXE
PID:2720 -
\??\c:\drrjnnx.exec:\drrjnnx.exe43⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jfhpj.exec:\jfhpj.exe44⤵
- Executes dropped EXE
PID:2680 -
\??\c:\bvjxpv.exec:\bvjxpv.exe45⤵
- Executes dropped EXE
PID:3016 -
\??\c:\lbjhp.exec:\lbjhp.exe46⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rlndpp.exec:\rlndpp.exe47⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jxvxpb.exec:\jxvxpb.exe48⤵
- Executes dropped EXE
PID:836 -
\??\c:\rpjrpd.exec:\rpjrpd.exe49⤵
- Executes dropped EXE
PID:1084 -
\??\c:\xdlnhld.exec:\xdlnhld.exe50⤵
- Executes dropped EXE
PID:568 -
\??\c:\rtxhl.exec:\rtxhl.exe51⤵
- Executes dropped EXE
PID:1796 -
\??\c:\hxrxtt.exec:\hxrxtt.exe52⤵
- Executes dropped EXE
PID:1992 -
\??\c:\xjpxb.exec:\xjpxb.exe53⤵
- Executes dropped EXE
PID:2224 -
\??\c:\bpnxtf.exec:\bpnxtf.exe54⤵
- Executes dropped EXE
PID:1044 -
\??\c:\blvtff.exec:\blvtff.exe55⤵
- Executes dropped EXE
PID:1152 -
\??\c:\drjvfl.exec:\drjvfl.exe56⤵
- Executes dropped EXE
PID:1696 -
\??\c:\jxnthdp.exec:\jxnthdp.exe57⤵
- Executes dropped EXE
PID:1756 -
\??\c:\tjphbbj.exec:\tjphbbj.exe58⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vhdxvl.exec:\vhdxvl.exe59⤵
- Executes dropped EXE
PID:1680 -
\??\c:\dnbftht.exec:\dnbftht.exe60⤵
- Executes dropped EXE
PID:2108 -
\??\c:\bfvbjt.exec:\bfvbjt.exe61⤵
- Executes dropped EXE
PID:2904 -
\??\c:\nxxbvn.exec:\nxxbvn.exe62⤵
- Executes dropped EXE
PID:304 -
\??\c:\tjpxxd.exec:\tjpxxd.exe63⤵
- Executes dropped EXE
PID:276 -
\??\c:\fljrvpt.exec:\fljrvpt.exe64⤵
- Executes dropped EXE
PID:1296 -
\??\c:\hlrvx.exec:\hlrvx.exe65⤵
- Executes dropped EXE
PID:1540 -
\??\c:\pfxfb.exec:\pfxfb.exe66⤵PID:1120
-
\??\c:\jpphlrp.exec:\jpphlrp.exe67⤵PID:1960
-
\??\c:\brprbp.exec:\brprbp.exe68⤵PID:1824
-
\??\c:\rjtvvvb.exec:\rjtvvvb.exe69⤵PID:1832
-
\??\c:\ltlbp.exec:\ltlbp.exe70⤵PID:2100
-
\??\c:\vthbpbh.exec:\vthbpbh.exe71⤵PID:3024
-
\??\c:\dxnnh.exec:\dxnnh.exe72⤵PID:2988
-
\??\c:\lblbl.exec:\lblbl.exe73⤵PID:3020
-
\??\c:\fdtbppl.exec:\fdtbppl.exe74⤵PID:1784
-
\??\c:\ljbbxr.exec:\ljbbxr.exe75⤵PID:872
-
\??\c:\prhlvh.exec:\prhlvh.exe76⤵PID:2340
-
\??\c:\hvlpdd.exec:\hvlpdd.exe77⤵PID:2272
-
\??\c:\rxfxrj.exec:\rxfxrj.exe78⤵PID:3012
-
\??\c:\btvjr.exec:\btvjr.exe79⤵PID:2700
-
\??\c:\vrlntb.exec:\vrlntb.exe80⤵PID:2660
-
\??\c:\bfrtvd.exec:\bfrtvd.exe81⤵PID:2704
-
\??\c:\nrfpd.exec:\nrfpd.exe82⤵PID:2460
-
\??\c:\vrlrljh.exec:\vrlrljh.exe83⤵PID:2936
-
\??\c:\xnxfr.exec:\xnxfr.exe84⤵PID:2176
-
\??\c:\bvhfl.exec:\bvhfl.exe85⤵PID:2584
-
\??\c:\lvjjp.exec:\lvjjp.exe86⤵PID:2536
-
\??\c:\jfvbtnd.exec:\jfvbtnd.exe87⤵PID:2852
-
\??\c:\dvphlfv.exec:\dvphlfv.exe88⤵PID:2172
-
\??\c:\pjdjfvj.exec:\pjdjfvj.exe89⤵PID:572
-
\??\c:\xlrvd.exec:\xlrvd.exe90⤵PID:1748
-
\??\c:\xvpjrlv.exec:\xvpjrlv.exe91⤵PID:2816
-
\??\c:\rvvxlfn.exec:\rvvxlfn.exe92⤵PID:2728
-
\??\c:\thhnhp.exec:\thhnhp.exe93⤵PID:1512
-
\??\c:\hndfh.exec:\hndfh.exe94⤵PID:1444
-
\??\c:\rbbjjx.exec:\rbbjjx.exe95⤵PID:1676
-
\??\c:\brhbb.exec:\brhbb.exe96⤵PID:2248
-
\??\c:\fdhjjjj.exec:\fdhjjjj.exe97⤵PID:2028
-
\??\c:\btpvrl.exec:\btpvrl.exe98⤵PID:1656
-
\??\c:\rvpdt.exec:\rvpdt.exe99⤵PID:944
-
\??\c:\xtrpb.exec:\xtrpb.exe100⤵PID:2264
-
\??\c:\vprhrp.exec:\vprhrp.exe101⤵PID:1692
-
\??\c:\jvbppj.exec:\jvbppj.exe102⤵PID:596
-
\??\c:\vvvjrvj.exec:\vvvjrvj.exe103⤵PID:2308
-
\??\c:\hppnjl.exec:\hppnjl.exe104⤵PID:2904
-
\??\c:\brjpbbr.exec:\brjpbbr.exe105⤵PID:2948
-
\??\c:\bpdrbn.exec:\bpdrbn.exe106⤵PID:2128
-
\??\c:\pttxvrl.exec:\pttxvrl.exe107⤵PID:3060
-
\??\c:\xtdlv.exec:\xtdlv.exe108⤵PID:1540
-
\??\c:\jfdhddn.exec:\jfdhddn.exe109⤵PID:960
-
\??\c:\ddrdr.exec:\ddrdr.exe110⤵PID:1960
-
\??\c:\prlvdhl.exec:\prlvdhl.exe111⤵PID:1824
-
\??\c:\jlldn.exec:\jlldn.exe112⤵PID:908
-
\??\c:\trvlxr.exec:\trvlxr.exe113⤵PID:1276
-
\??\c:\bxndhp.exec:\bxndhp.exe114⤵PID:2100
-
\??\c:\rxvhnf.exec:\rxvhnf.exe115⤵PID:1708
-
\??\c:\jhrxj.exec:\jhrxj.exe116⤵PID:2988
-
\??\c:\pbbxxth.exec:\pbbxxth.exe117⤵PID:3020
-
\??\c:\fjvlbv.exec:\fjvlbv.exe118⤵PID:1784
-
\??\c:\nptvt.exec:\nptvt.exe119⤵PID:2116
-
\??\c:\tntrpxf.exec:\tntrpxf.exe120⤵PID:2340
-
\??\c:\xlnthr.exec:\xlnthr.exe121⤵PID:2272
-
\??\c:\ddnrv.exec:\ddnrv.exe122⤵PID:3012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-