Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11/05/2024, 02:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5d8b9f4e41f1eefbdf74ef83370355b0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
5d8b9f4e41f1eefbdf74ef83370355b0_NeikiAnalytics.exe
-
Size
94KB
-
MD5
5d8b9f4e41f1eefbdf74ef83370355b0
-
SHA1
635c45918590920d3b177dd7d2c3b565d3acd0c1
-
SHA256
095f88ef96f2cbf101a30fb3cdd48975ef0828377e9e9d719d85858a4de46049
-
SHA512
ec2da0116c1e1a55f9a90aa2ab3af780c774f9786d1f654ef101c65a96c34374f3c7867f0c4c7df45e3d65d033d24afb187ea7f78143d7ed06934341f797f0d6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JxJAg8dtZ:ymb3NkkiQ3mdBjFIWeFGyAsJAg2Z
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral1/memory/3052-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-60-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1056-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/692-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/352-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1060-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/892-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3052 pjvdp.exe 2384 fxxxflx.exe 2336 fxxxxxl.exe 2764 ddvjd.exe 2892 xrxlxxr.exe 2548 xrrrrxx.exe 2676 jdvdj.exe 2248 fxfrxxf.exe 3024 fxrxllr.exe 1056 nbhbbh.exe 2600 jvdvd.exe 2840 1pdjp.exe 1820 xlfrrrx.exe 2484 1nnbhb.exe 1232 htntbh.exe 692 7pppp.exe 2444 3rflfrr.exe 352 fxrxfxr.exe 2100 bthhnt.exe 2264 1ddvd.exe 2900 dvdjp.exe 2096 3fxlllr.exe 1060 htbhtt.exe 1824 nbnnbh.exe 900 9dpjv.exe 740 rlrxlrx.exe 2316 1ttnth.exe 2192 nbtnnt.exe 784 vvddj.exe 2216 jvjdj.exe 892 5lxrrll.exe 1656 tnbbht.exe 2116 5djpv.exe 1580 dpppv.exe 3048 jvpdd.exe 3044 frlllrx.exe 2652 xlllrlx.exe 2780 nbnntt.exe 2288 tnbbhb.exe 2644 dvvvv.exe 2696 jvjjj.exe 2704 1lxxxrx.exe 2528 1frrxxf.exe 2968 1tnhnh.exe 2228 5bhhnn.exe 1640 vjdjd.exe 2808 jjdjd.exe 2804 1xlllfl.exe 2256 xrfrrxf.exe 1872 1tttbt.exe 1996 3tbbbb.exe 1132 jvdvv.exe 1852 vpdjd.exe 1328 rflffxf.exe 1736 xrfrxrr.exe 344 nbhhhh.exe 1732 nhtthb.exe 1628 jdpdd.exe 2060 jdpjp.exe 2304 dpvpp.exe 2900 5frrlxx.exe 2096 rflfrxx.exe 2240 nbnhhb.exe 2472 thnnnn.exe -
resource yara_rule behavioral1/memory/836-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1056-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/692-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/892-300-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 836 wrote to memory of 3052 836 5d8b9f4e41f1eefbdf74ef83370355b0_NeikiAnalytics.exe 28 PID 836 wrote to memory of 3052 836 5d8b9f4e41f1eefbdf74ef83370355b0_NeikiAnalytics.exe 28 PID 836 wrote to memory of 3052 836 5d8b9f4e41f1eefbdf74ef83370355b0_NeikiAnalytics.exe 28 PID 836 wrote to memory of 3052 836 5d8b9f4e41f1eefbdf74ef83370355b0_NeikiAnalytics.exe 28 PID 3052 wrote to memory of 2384 3052 pjvdp.exe 29 PID 3052 wrote to memory of 2384 3052 pjvdp.exe 29 PID 3052 wrote to memory of 2384 3052 pjvdp.exe 29 PID 3052 wrote to memory of 2384 3052 pjvdp.exe 29 PID 2384 wrote to memory of 2336 2384 fxxxflx.exe 30 PID 2384 wrote to memory of 2336 2384 fxxxflx.exe 30 PID 2384 wrote to memory of 2336 2384 fxxxflx.exe 30 PID 2384 wrote to memory of 2336 2384 fxxxflx.exe 30 PID 2336 wrote to memory of 2764 2336 fxxxxxl.exe 31 PID 2336 wrote to memory of 2764 2336 fxxxxxl.exe 31 PID 2336 wrote to memory of 2764 2336 fxxxxxl.exe 31 PID 2336 wrote to memory of 2764 2336 fxxxxxl.exe 31 PID 2764 wrote to memory of 2892 2764 ddvjd.exe 32 PID 2764 wrote to memory of 2892 2764 ddvjd.exe 32 PID 2764 wrote to memory of 2892 2764 ddvjd.exe 32 PID 2764 wrote to memory of 2892 2764 ddvjd.exe 32 PID 2892 wrote to memory of 2548 2892 xrxlxxr.exe 33 PID 2892 wrote to memory of 2548 2892 xrxlxxr.exe 33 PID 2892 wrote to memory of 2548 2892 xrxlxxr.exe 33 PID 2892 wrote to memory of 2548 2892 xrxlxxr.exe 33 PID 2548 wrote to memory of 2676 2548 xrrrrxx.exe 34 PID 2548 wrote to memory of 2676 2548 xrrrrxx.exe 34 PID 2548 wrote to memory of 2676 2548 xrrrrxx.exe 34 PID 2548 wrote to memory of 2676 2548 xrrrrxx.exe 34 PID 2676 wrote to memory of 2248 2676 jdvdj.exe 35 PID 2676 wrote to memory of 2248 2676 jdvdj.exe 35 PID 2676 wrote to memory of 2248 2676 jdvdj.exe 35 PID 2676 wrote to memory of 2248 2676 jdvdj.exe 35 PID 2248 wrote to memory of 3024 2248 fxfrxxf.exe 36 PID 2248 wrote to memory of 3024 2248 fxfrxxf.exe 36 PID 2248 wrote to memory of 3024 2248 fxfrxxf.exe 36 PID 2248 wrote to memory of 3024 2248 fxfrxxf.exe 36 PID 3024 wrote to memory of 1056 3024 fxrxllr.exe 37 PID 3024 wrote to memory of 1056 3024 fxrxllr.exe 37 PID 3024 wrote to memory of 1056 3024 fxrxllr.exe 37 PID 3024 wrote to memory of 1056 3024 fxrxllr.exe 37 PID 1056 wrote to memory of 2600 1056 nbhbbh.exe 38 PID 1056 wrote to memory of 2600 1056 nbhbbh.exe 38 PID 1056 wrote to memory of 2600 1056 nbhbbh.exe 38 PID 1056 wrote to memory of 2600 1056 nbhbbh.exe 38 PID 2600 wrote to memory of 2840 2600 jvdvd.exe 39 PID 2600 wrote to memory of 2840 2600 jvdvd.exe 39 PID 2600 wrote to memory of 2840 2600 jvdvd.exe 39 PID 2600 wrote to memory of 2840 2600 jvdvd.exe 39 PID 2840 wrote to memory of 1820 2840 1pdjp.exe 40 PID 2840 wrote to memory of 1820 2840 1pdjp.exe 40 PID 2840 wrote to memory of 1820 2840 1pdjp.exe 40 PID 2840 wrote to memory of 1820 2840 1pdjp.exe 40 PID 1820 wrote to memory of 2484 1820 xlfrrrx.exe 41 PID 1820 wrote to memory of 2484 1820 xlfrrrx.exe 41 PID 1820 wrote to memory of 2484 1820 xlfrrrx.exe 41 PID 1820 wrote to memory of 2484 1820 xlfrrrx.exe 41 PID 2484 wrote to memory of 1232 2484 1nnbhb.exe 42 PID 2484 wrote to memory of 1232 2484 1nnbhb.exe 42 PID 2484 wrote to memory of 1232 2484 1nnbhb.exe 42 PID 2484 wrote to memory of 1232 2484 1nnbhb.exe 42 PID 1232 wrote to memory of 692 1232 htntbh.exe 43 PID 1232 wrote to memory of 692 1232 htntbh.exe 43 PID 1232 wrote to memory of 692 1232 htntbh.exe 43 PID 1232 wrote to memory of 692 1232 htntbh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d8b9f4e41f1eefbdf74ef83370355b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5d8b9f4e41f1eefbdf74ef83370355b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\pjvdp.exec:\pjvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\fxxxflx.exec:\fxxxflx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\fxxxxxl.exec:\fxxxxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\ddvjd.exec:\ddvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\xrxlxxr.exec:\xrxlxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\xrrrrxx.exec:\xrrrrxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\jdvdj.exec:\jdvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\fxfrxxf.exec:\fxfrxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\fxrxllr.exec:\fxrxllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\nbhbbh.exec:\nbhbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\jvdvd.exec:\jvdvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\1pdjp.exec:\1pdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\xlfrrrx.exec:\xlfrrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\1nnbhb.exec:\1nnbhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\htntbh.exec:\htntbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\7pppp.exec:\7pppp.exe17⤵
- Executes dropped EXE
PID:692 -
\??\c:\3rflfrr.exec:\3rflfrr.exe18⤵
- Executes dropped EXE
PID:2444 -
\??\c:\fxrxfxr.exec:\fxrxfxr.exe19⤵
- Executes dropped EXE
PID:352 -
\??\c:\bthhnt.exec:\bthhnt.exe20⤵
- Executes dropped EXE
PID:2100 -
\??\c:\1ddvd.exec:\1ddvd.exe21⤵
- Executes dropped EXE
PID:2264 -
\??\c:\dvdjp.exec:\dvdjp.exe22⤵
- Executes dropped EXE
PID:2900 -
\??\c:\3fxlllr.exec:\3fxlllr.exe23⤵
- Executes dropped EXE
PID:2096 -
\??\c:\htbhtt.exec:\htbhtt.exe24⤵
- Executes dropped EXE
PID:1060 -
\??\c:\nbnnbh.exec:\nbnnbh.exe25⤵
- Executes dropped EXE
PID:1824 -
\??\c:\9dpjv.exec:\9dpjv.exe26⤵
- Executes dropped EXE
PID:900 -
\??\c:\rlrxlrx.exec:\rlrxlrx.exe27⤵
- Executes dropped EXE
PID:740 -
\??\c:\1ttnth.exec:\1ttnth.exe28⤵
- Executes dropped EXE
PID:2316 -
\??\c:\nbtnnt.exec:\nbtnnt.exe29⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vvddj.exec:\vvddj.exe30⤵
- Executes dropped EXE
PID:784 -
\??\c:\jvjdj.exec:\jvjdj.exe31⤵
- Executes dropped EXE
PID:2216 -
\??\c:\5lxrrll.exec:\5lxrrll.exe32⤵
- Executes dropped EXE
PID:892 -
\??\c:\tnbbht.exec:\tnbbht.exe33⤵
- Executes dropped EXE
PID:1656 -
\??\c:\5djpv.exec:\5djpv.exe34⤵
- Executes dropped EXE
PID:2116 -
\??\c:\dpppv.exec:\dpppv.exe35⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jvpdd.exec:\jvpdd.exe36⤵
- Executes dropped EXE
PID:3048 -
\??\c:\frlllrx.exec:\frlllrx.exe37⤵
- Executes dropped EXE
PID:3044 -
\??\c:\xlllrlx.exec:\xlllrlx.exe38⤵
- Executes dropped EXE
PID:2652 -
\??\c:\nbnntt.exec:\nbnntt.exe39⤵
- Executes dropped EXE
PID:2780 -
\??\c:\tnbbhb.exec:\tnbbhb.exe40⤵
- Executes dropped EXE
PID:2288 -
\??\c:\dvvvv.exec:\dvvvv.exe41⤵
- Executes dropped EXE
PID:2644 -
\??\c:\jvjjj.exec:\jvjjj.exe42⤵
- Executes dropped EXE
PID:2696 -
\??\c:\1lxxxrx.exec:\1lxxxrx.exe43⤵
- Executes dropped EXE
PID:2704 -
\??\c:\1frrxxf.exec:\1frrxxf.exe44⤵
- Executes dropped EXE
PID:2528 -
\??\c:\1tnhnh.exec:\1tnhnh.exe45⤵
- Executes dropped EXE
PID:2968 -
\??\c:\5bhhnn.exec:\5bhhnn.exe46⤵
- Executes dropped EXE
PID:2228 -
\??\c:\vjdjd.exec:\vjdjd.exe47⤵
- Executes dropped EXE
PID:1640 -
\??\c:\jjdjd.exec:\jjdjd.exe48⤵
- Executes dropped EXE
PID:2808 -
\??\c:\1xlllfl.exec:\1xlllfl.exe49⤵
- Executes dropped EXE
PID:2804 -
\??\c:\xrfrrxf.exec:\xrfrrxf.exe50⤵
- Executes dropped EXE
PID:2256 -
\??\c:\1tttbt.exec:\1tttbt.exe51⤵
- Executes dropped EXE
PID:1872 -
\??\c:\3tbbbb.exec:\3tbbbb.exe52⤵
- Executes dropped EXE
PID:1996 -
\??\c:\jvdvv.exec:\jvdvv.exe53⤵
- Executes dropped EXE
PID:1132 -
\??\c:\vpdjd.exec:\vpdjd.exe54⤵
- Executes dropped EXE
PID:1852 -
\??\c:\rflffxf.exec:\rflffxf.exe55⤵
- Executes dropped EXE
PID:1328 -
\??\c:\xrfrxrr.exec:\xrfrxrr.exe56⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nbhhhh.exec:\nbhhhh.exe57⤵
- Executes dropped EXE
PID:344 -
\??\c:\nhtthb.exec:\nhtthb.exe58⤵
- Executes dropped EXE
PID:1732 -
\??\c:\jdpdd.exec:\jdpdd.exe59⤵
- Executes dropped EXE
PID:1628 -
\??\c:\jdpjp.exec:\jdpjp.exe60⤵
- Executes dropped EXE
PID:2060 -
\??\c:\dpvpp.exec:\dpvpp.exe61⤵
- Executes dropped EXE
PID:2304 -
\??\c:\5frrlxx.exec:\5frrlxx.exe62⤵
- Executes dropped EXE
PID:2900 -
\??\c:\rflfrxx.exec:\rflfrxx.exe63⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nbnhhb.exec:\nbnhhb.exe64⤵
- Executes dropped EXE
PID:2240 -
\??\c:\thnnnn.exec:\thnnnn.exe65⤵
- Executes dropped EXE
PID:2472 -
\??\c:\9jvvp.exec:\9jvvp.exe66⤵PID:2348
-
\??\c:\dpjpp.exec:\dpjpp.exe67⤵PID:1920
-
\??\c:\rlxfrlr.exec:\rlxfrlr.exe68⤵PID:1888
-
\??\c:\frfflrx.exec:\frfflrx.exe69⤵PID:3028
-
\??\c:\3bnhnt.exec:\3bnhnt.exe70⤵PID:2420
-
\??\c:\7tbhnt.exec:\7tbhnt.exe71⤵PID:348
-
\??\c:\9pppv.exec:\9pppv.exe72⤵PID:2936
-
\??\c:\jdppv.exec:\jdppv.exe73⤵PID:2216
-
\??\c:\9rxxrll.exec:\9rxxrll.exe74⤵PID:1804
-
\??\c:\9rrlllx.exec:\9rrlllx.exe75⤵PID:2896
-
\??\c:\5hnnnh.exec:\5hnnnh.exe76⤵PID:1692
-
\??\c:\bnnnhh.exec:\bnnnhh.exe77⤵PID:2796
-
\??\c:\hnbhbb.exec:\hnbhbb.exe78⤵PID:2328
-
\??\c:\1jdvp.exec:\1jdvp.exe79⤵PID:2660
-
\??\c:\jvpjp.exec:\jvpjp.exe80⤵PID:2620
-
\??\c:\7xrfffl.exec:\7xrfffl.exe81⤵PID:2636
-
\??\c:\frfrfll.exec:\frfrfll.exe82⤵PID:2672
-
\??\c:\3thbbt.exec:\3thbbt.exe83⤵PID:2540
-
\??\c:\nhhhtt.exec:\nhhhtt.exe84⤵PID:2732
-
\??\c:\5jpjj.exec:\5jpjj.exe85⤵PID:2516
-
\??\c:\pjddp.exec:\pjddp.exe86⤵PID:2588
-
\??\c:\1rllxxx.exec:\1rllxxx.exe87⤵PID:2140
-
\??\c:\rfrrffl.exec:\rfrrffl.exe88⤵PID:1448
-
\??\c:\nbbbhb.exec:\nbbbhb.exe89⤵PID:2716
-
\??\c:\thnnhh.exec:\thnnhh.exe90⤵PID:2832
-
\??\c:\nhhtht.exec:\nhhtht.exe91⤵PID:2864
-
\??\c:\vjvpd.exec:\vjvpd.exe92⤵PID:2840
-
\??\c:\pdpvp.exec:\pdpvp.exe93⤵PID:1820
-
\??\c:\rflxlff.exec:\rflxlff.exe94⤵PID:1816
-
\??\c:\frrrrrr.exec:\frrrrrr.exe95⤵PID:2252
-
\??\c:\nbbbbb.exec:\nbbbbb.exe96⤵PID:1788
-
\??\c:\9httbb.exec:\9httbb.exe97⤵PID:2440
-
\??\c:\vpjpd.exec:\vpjpd.exe98⤵PID:1680
-
\??\c:\jvdjp.exec:\jvdjp.exe99⤵PID:2312
-
\??\c:\pdppv.exec:\pdppv.exe100⤵PID:2340
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe101⤵PID:1712
-
\??\c:\9rflllr.exec:\9rflllr.exe102⤵PID:2492
-
\??\c:\1thnbb.exec:\1thnbb.exe103⤵PID:672
-
\??\c:\7hhtnt.exec:\7hhtnt.exe104⤵PID:1596
-
\??\c:\jdjjp.exec:\jdjjp.exe105⤵PID:2284
-
\??\c:\dpjdj.exec:\dpjdj.exe106⤵PID:1840
-
\??\c:\9pjdd.exec:\9pjdd.exe107⤵PID:1136
-
\??\c:\7xrlfll.exec:\7xrlfll.exe108⤵PID:900
-
\??\c:\lfrllfl.exec:\lfrllfl.exe109⤵PID:1900
-
\??\c:\3ttbhh.exec:\3ttbhh.exe110⤵PID:3012
-
\??\c:\btbtbt.exec:\btbtbt.exe111⤵PID:1028
-
\??\c:\jjpvd.exec:\jjpvd.exe112⤵PID:2016
-
\??\c:\jvdvv.exec:\jvdvv.exe113⤵PID:2184
-
\??\c:\9fffffl.exec:\9fffffl.exe114⤵PID:880
-
\??\c:\xllllfl.exec:\xllllfl.exe115⤵PID:2956
-
\??\c:\thttbh.exec:\thttbh.exe116⤵PID:2876
-
\??\c:\thhhtt.exec:\thhhtt.exe117⤵PID:1548
-
\??\c:\dpvpp.exec:\dpvpp.exe118⤵PID:2044
-
\??\c:\pjddj.exec:\pjddj.exe119⤵PID:2356
-
\??\c:\frfxxrx.exec:\frfxxrx.exe120⤵PID:3040
-
\??\c:\xlfflfl.exec:\xlfflfl.exe121⤵PID:2752
-
\??\c:\btbntn.exec:\btbntn.exe122⤵PID:2668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-