Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 01:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
73c91b6ad96ba89d3cec053c74a3eb20_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
73c91b6ad96ba89d3cec053c74a3eb20_NeikiAnalytics.exe
-
Size
56KB
-
MD5
73c91b6ad96ba89d3cec053c74a3eb20
-
SHA1
61223e2901d8f06be29b5afa4aba3b46f2ce2e23
-
SHA256
f5b48a39b32c914af616b0e10bd4c1d8495577c096598257fdca316d157027cb
-
SHA512
8a1c0e43ef114058f9cf017172658ad6d475f402aa1ea7bd1362a211e05cbca7978e6c9afbce3c098b88765e896ffc0ea7f9e33ddab02d644c21312ce0df3db4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chVh:ymb3NkkiQ3mdBjF0crh
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2384-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1728-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1280-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1308-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1396-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1388-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2552-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4888 jjjjj.exe 2956 9xfffrf.exe 4908 tthtbb.exe 1728 jjvpp.exe 2352 7ppjd.exe 4880 frlffff.exe 1260 7btthh.exe 3152 ttnhbb.exe 1464 vjjdd.exe 3628 jvdjj.exe 3100 nnnnhh.exe 3768 jpddd.exe 1280 rxxrfff.exe 212 xxxrlff.exe 4520 hbhbhh.exe 1084 ppvvv.exe 1308 jdjdd.exe 1396 lfrlfff.exe 448 7ttttb.exe 4968 nhnhbb.exe 4728 ppppp.exe 1388 3rllflx.exe 4080 xrrlxxx.exe 1060 bhbtbn.exe 2212 7djdd.exe 2552 rffxrxr.exe 4944 1xxrllf.exe 3244 btbbbb.exe 2384 dpddv.exe 4732 vvdvv.exe 2364 3rrlxxx.exe 928 fxxrlll.exe 2380 dppvp.exe 372 rxxxxxx.exe 1076 btnnnn.exe 1560 bntbnn.exe 1260 ddvvv.exe 1264 ppjpj.exe 2132 nbnnhh.exe 2640 1ntnhb.exe 516 djppp.exe 4620 vjddd.exe 3232 rllfffx.exe 4992 tbhbbt.exe 212 nhhnnb.exe 2792 ppvpj.exe 3240 9ppjd.exe 3696 rxrllll.exe 708 flxxflx.exe 880 flfxrrr.exe 3824 9hnnnn.exe 4968 nhnhtt.exe 2856 pjddj.exe 4824 djddd.exe 2192 rfrfxxx.exe 3460 xxfxffl.exe 2900 bthnbn.exe 4056 ttnhhn.exe 4540 dvvvj.exe 1568 jdpjd.exe 2688 lfxrrrx.exe 2028 xrrrrxx.exe 2420 bbnntt.exe 5044 hthbtt.exe -
resource yara_rule behavioral2/memory/2384-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1308-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1388-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2552-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2384 wrote to memory of 4888 2384 73c91b6ad96ba89d3cec053c74a3eb20_NeikiAnalytics.exe 90 PID 2384 wrote to memory of 4888 2384 73c91b6ad96ba89d3cec053c74a3eb20_NeikiAnalytics.exe 90 PID 2384 wrote to memory of 4888 2384 73c91b6ad96ba89d3cec053c74a3eb20_NeikiAnalytics.exe 90 PID 4888 wrote to memory of 2956 4888 jjjjj.exe 91 PID 4888 wrote to memory of 2956 4888 jjjjj.exe 91 PID 4888 wrote to memory of 2956 4888 jjjjj.exe 91 PID 2956 wrote to memory of 4908 2956 9xfffrf.exe 92 PID 2956 wrote to memory of 4908 2956 9xfffrf.exe 92 PID 2956 wrote to memory of 4908 2956 9xfffrf.exe 92 PID 4908 wrote to memory of 1728 4908 tthtbb.exe 93 PID 4908 wrote to memory of 1728 4908 tthtbb.exe 93 PID 4908 wrote to memory of 1728 4908 tthtbb.exe 93 PID 1728 wrote to memory of 2352 1728 jjvpp.exe 94 PID 1728 wrote to memory of 2352 1728 jjvpp.exe 94 PID 1728 wrote to memory of 2352 1728 jjvpp.exe 94 PID 2352 wrote to memory of 4880 2352 7ppjd.exe 95 PID 2352 wrote to memory of 4880 2352 7ppjd.exe 95 PID 2352 wrote to memory of 4880 2352 7ppjd.exe 95 PID 4880 wrote to memory of 1260 4880 frlffff.exe 96 PID 4880 wrote to memory of 1260 4880 frlffff.exe 96 PID 4880 wrote to memory of 1260 4880 frlffff.exe 96 PID 1260 wrote to memory of 3152 1260 7btthh.exe 97 PID 1260 wrote to memory of 3152 1260 7btthh.exe 97 PID 1260 wrote to memory of 3152 1260 7btthh.exe 97 PID 3152 wrote to memory of 1464 3152 ttnhbb.exe 98 PID 3152 wrote to memory of 1464 3152 ttnhbb.exe 98 PID 3152 wrote to memory of 1464 3152 ttnhbb.exe 98 PID 1464 wrote to memory of 3628 1464 vjjdd.exe 99 PID 1464 wrote to memory of 3628 1464 vjjdd.exe 99 PID 1464 wrote to memory of 3628 1464 vjjdd.exe 99 PID 3628 wrote to memory of 3100 3628 jvdjj.exe 100 PID 3628 wrote to memory of 3100 3628 jvdjj.exe 100 PID 3628 wrote to memory of 3100 3628 jvdjj.exe 100 PID 3100 wrote to memory of 3768 3100 nnnnhh.exe 101 PID 3100 wrote to memory of 3768 3100 nnnnhh.exe 101 PID 3100 wrote to memory of 3768 3100 nnnnhh.exe 101 PID 3768 wrote to memory of 1280 3768 jpddd.exe 102 PID 3768 wrote to memory of 1280 3768 jpddd.exe 102 PID 3768 wrote to memory of 1280 3768 jpddd.exe 102 PID 1280 wrote to memory of 212 1280 rxxrfff.exe 103 PID 1280 wrote to memory of 212 1280 rxxrfff.exe 103 PID 1280 wrote to memory of 212 1280 rxxrfff.exe 103 PID 212 wrote to memory of 4520 212 xxxrlff.exe 104 PID 212 wrote to memory of 4520 212 xxxrlff.exe 104 PID 212 wrote to memory of 4520 212 xxxrlff.exe 104 PID 4520 wrote to memory of 1084 4520 hbhbhh.exe 105 PID 4520 wrote to memory of 1084 4520 hbhbhh.exe 105 PID 4520 wrote to memory of 1084 4520 hbhbhh.exe 105 PID 1084 wrote to memory of 1308 1084 ppvvv.exe 106 PID 1084 wrote to memory of 1308 1084 ppvvv.exe 106 PID 1084 wrote to memory of 1308 1084 ppvvv.exe 106 PID 1308 wrote to memory of 1396 1308 jdjdd.exe 108 PID 1308 wrote to memory of 1396 1308 jdjdd.exe 108 PID 1308 wrote to memory of 1396 1308 jdjdd.exe 108 PID 1396 wrote to memory of 448 1396 lfrlfff.exe 109 PID 1396 wrote to memory of 448 1396 lfrlfff.exe 109 PID 1396 wrote to memory of 448 1396 lfrlfff.exe 109 PID 448 wrote to memory of 4968 448 7ttttb.exe 110 PID 448 wrote to memory of 4968 448 7ttttb.exe 110 PID 448 wrote to memory of 4968 448 7ttttb.exe 110 PID 4968 wrote to memory of 4728 4968 nhnhbb.exe 111 PID 4968 wrote to memory of 4728 4968 nhnhbb.exe 111 PID 4968 wrote to memory of 4728 4968 nhnhbb.exe 111 PID 4728 wrote to memory of 1388 4728 ppppp.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\73c91b6ad96ba89d3cec053c74a3eb20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\73c91b6ad96ba89d3cec053c74a3eb20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\jjjjj.exec:\jjjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\9xfffrf.exec:\9xfffrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\tthtbb.exec:\tthtbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\jjvpp.exec:\jjvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\7ppjd.exec:\7ppjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\frlffff.exec:\frlffff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\7btthh.exec:\7btthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\ttnhbb.exec:\ttnhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\vjjdd.exec:\vjjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\jvdjj.exec:\jvdjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\nnnnhh.exec:\nnnnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\jpddd.exec:\jpddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\rxxrfff.exec:\rxxrfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\xxxrlff.exec:\xxxrlff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\hbhbhh.exec:\hbhbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\ppvvv.exec:\ppvvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\jdjdd.exec:\jdjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\lfrlfff.exec:\lfrlfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\7ttttb.exec:\7ttttb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\nhnhbb.exec:\nhnhbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\ppppp.exec:\ppppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\3rllflx.exec:\3rllflx.exe23⤵
- Executes dropped EXE
PID:1388 -
\??\c:\xrrlxxx.exec:\xrrlxxx.exe24⤵
- Executes dropped EXE
PID:4080 -
\??\c:\bhbtbn.exec:\bhbtbn.exe25⤵
- Executes dropped EXE
PID:1060 -
\??\c:\7djdd.exec:\7djdd.exe26⤵
- Executes dropped EXE
PID:2212 -
\??\c:\rffxrxr.exec:\rffxrxr.exe27⤵
- Executes dropped EXE
PID:2552 -
\??\c:\1xxrllf.exec:\1xxrllf.exe28⤵
- Executes dropped EXE
PID:4944 -
\??\c:\btbbbb.exec:\btbbbb.exe29⤵
- Executes dropped EXE
PID:3244 -
\??\c:\dpddv.exec:\dpddv.exe30⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vvdvv.exec:\vvdvv.exe31⤵
- Executes dropped EXE
PID:4732 -
\??\c:\3rrlxxx.exec:\3rrlxxx.exe32⤵
- Executes dropped EXE
PID:2364 -
\??\c:\fxxrlll.exec:\fxxrlll.exe33⤵
- Executes dropped EXE
PID:928 -
\??\c:\dppvp.exec:\dppvp.exe34⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rxxxxxx.exec:\rxxxxxx.exe35⤵
- Executes dropped EXE
PID:372 -
\??\c:\btnnnn.exec:\btnnnn.exe36⤵
- Executes dropped EXE
PID:1076 -
\??\c:\bntbnn.exec:\bntbnn.exe37⤵
- Executes dropped EXE
PID:1560 -
\??\c:\ddvvv.exec:\ddvvv.exe38⤵
- Executes dropped EXE
PID:1260 -
\??\c:\ppjpj.exec:\ppjpj.exe39⤵
- Executes dropped EXE
PID:1264 -
\??\c:\nbnnhh.exec:\nbnnhh.exe40⤵
- Executes dropped EXE
PID:2132 -
\??\c:\1ntnhb.exec:\1ntnhb.exe41⤵
- Executes dropped EXE
PID:2640 -
\??\c:\djppp.exec:\djppp.exe42⤵
- Executes dropped EXE
PID:516 -
\??\c:\vjddd.exec:\vjddd.exe43⤵
- Executes dropped EXE
PID:4620 -
\??\c:\rllfffx.exec:\rllfffx.exe44⤵
- Executes dropped EXE
PID:3232 -
\??\c:\tbhbbt.exec:\tbhbbt.exe45⤵
- Executes dropped EXE
PID:4992 -
\??\c:\nhhnnb.exec:\nhhnnb.exe46⤵
- Executes dropped EXE
PID:212 -
\??\c:\ppvpj.exec:\ppvpj.exe47⤵
- Executes dropped EXE
PID:2792 -
\??\c:\9ppjd.exec:\9ppjd.exe48⤵
- Executes dropped EXE
PID:3240 -
\??\c:\rxrllll.exec:\rxrllll.exe49⤵
- Executes dropped EXE
PID:3696 -
\??\c:\flxxflx.exec:\flxxflx.exe50⤵
- Executes dropped EXE
PID:708 -
\??\c:\flfxrrr.exec:\flfxrrr.exe51⤵
- Executes dropped EXE
PID:880 -
\??\c:\9hnnnn.exec:\9hnnnn.exe52⤵
- Executes dropped EXE
PID:3824 -
\??\c:\nhnhtt.exec:\nhnhtt.exe53⤵
- Executes dropped EXE
PID:4968 -
\??\c:\pjddj.exec:\pjddj.exe54⤵
- Executes dropped EXE
PID:2856 -
\??\c:\djddd.exec:\djddd.exe55⤵
- Executes dropped EXE
PID:4824 -
\??\c:\rfrfxxx.exec:\rfrfxxx.exe56⤵
- Executes dropped EXE
PID:2192 -
\??\c:\xxfxffl.exec:\xxfxffl.exe57⤵
- Executes dropped EXE
PID:3460 -
\??\c:\bthnbn.exec:\bthnbn.exe58⤵
- Executes dropped EXE
PID:2900 -
\??\c:\ttnhhn.exec:\ttnhhn.exe59⤵
- Executes dropped EXE
PID:4056 -
\??\c:\dvvvj.exec:\dvvvj.exe60⤵
- Executes dropped EXE
PID:4540 -
\??\c:\jdpjd.exec:\jdpjd.exe61⤵
- Executes dropped EXE
PID:1568 -
\??\c:\lfxrrrx.exec:\lfxrrrx.exe62⤵
- Executes dropped EXE
PID:2688 -
\??\c:\xrrrrxx.exec:\xrrrrxx.exe63⤵
- Executes dropped EXE
PID:2028 -
\??\c:\bbnntt.exec:\bbnntt.exe64⤵
- Executes dropped EXE
PID:2420 -
\??\c:\hthbtt.exec:\hthbtt.exe65⤵
- Executes dropped EXE
PID:5044 -
\??\c:\5pvpj.exec:\5pvpj.exe66⤵PID:3784
-
\??\c:\pjjdv.exec:\pjjdv.exe67⤵PID:2916
-
\??\c:\lflfflf.exec:\lflfflf.exe68⤵PID:3960
-
\??\c:\thhbtt.exec:\thhbtt.exe69⤵PID:3704
-
\??\c:\dvvpp.exec:\dvvpp.exe70⤵PID:1976
-
\??\c:\1vpvp.exec:\1vpvp.exe71⤵PID:1740
-
\??\c:\fxxrllx.exec:\fxxrllx.exe72⤵PID:3024
-
\??\c:\nbhhbb.exec:\nbhhbb.exe73⤵PID:1412
-
\??\c:\jvjdd.exec:\jvjdd.exe74⤵PID:2680
-
\??\c:\7pppj.exec:\7pppj.exe75⤵PID:3708
-
\??\c:\frrlllf.exec:\frrlllf.exe76⤵PID:4008
-
\??\c:\hhbbtb.exec:\hhbbtb.exe77⤵PID:2612
-
\??\c:\vpppv.exec:\vpppv.exe78⤵PID:1572
-
\??\c:\vpvpd.exec:\vpvpd.exe79⤵PID:5108
-
\??\c:\3rxrlll.exec:\3rxrlll.exe80⤵PID:4936
-
\??\c:\nhhtbb.exec:\nhhtbb.exe81⤵PID:3136
-
\??\c:\btbbbn.exec:\btbbbn.exe82⤵PID:4692
-
\??\c:\vpppd.exec:\vpppd.exe83⤵PID:4016
-
\??\c:\dvdvv.exec:\dvdvv.exe84⤵PID:1512
-
\??\c:\5lllxrf.exec:\5lllxrf.exe85⤵PID:1408
-
\??\c:\tnnnhh.exec:\tnnnhh.exe86⤵PID:1384
-
\??\c:\jdvvj.exec:\jdvvj.exe87⤵PID:4004
-
\??\c:\xrxfxlf.exec:\xrxfxlf.exe88⤵PID:4968
-
\??\c:\tbhhtn.exec:\tbhhtn.exe89⤵PID:1664
-
\??\c:\thnntt.exec:\thnntt.exe90⤵PID:4080
-
\??\c:\1vvpj.exec:\1vvpj.exe91⤵PID:1668
-
\??\c:\vpdvj.exec:\vpdvj.exe92⤵PID:1620
-
\??\c:\rlfxllf.exec:\rlfxllf.exe93⤵PID:2552
-
\??\c:\hbhbnn.exec:\hbhbnn.exe94⤵PID:4292
-
\??\c:\pjppv.exec:\pjppv.exe95⤵PID:1392
-
\??\c:\9lrrffl.exec:\9lrrffl.exe96⤵PID:2228
-
\??\c:\ffrrxfl.exec:\ffrrxfl.exe97⤵PID:4820
-
\??\c:\tntbnb.exec:\tntbnb.exe98⤵PID:4804
-
\??\c:\hthbnn.exec:\hthbnn.exe99⤵PID:2364
-
\??\c:\1vvvj.exec:\1vvvj.exe100⤵PID:2128
-
\??\c:\jjdpd.exec:\jjdpd.exe101⤵PID:3332
-
\??\c:\rllllxx.exec:\rllllxx.exe102⤵PID:4020
-
\??\c:\lllllll.exec:\lllllll.exe103⤵PID:1076
-
\??\c:\tbhhhb.exec:\tbhhhb.exe104⤵PID:3256
-
\??\c:\ttttht.exec:\ttttht.exe105⤵PID:1108
-
\??\c:\5jjjv.exec:\5jjjv.exe106⤵PID:1860
-
\??\c:\lflflfl.exec:\lflflfl.exe107⤵PID:3268
-
\??\c:\xfllfrr.exec:\xfllfrr.exe108⤵PID:1952
-
\??\c:\bhthnn.exec:\bhthnn.exe109⤵PID:940
-
\??\c:\ntbtnh.exec:\ntbtnh.exe110⤵PID:4444
-
\??\c:\djddv.exec:\djddv.exe111⤵PID:1280
-
\??\c:\lfflxfr.exec:\lfflxfr.exe112⤵PID:3560
-
\??\c:\thnbnh.exec:\thnbnh.exe113⤵PID:2532
-
\??\c:\htthtt.exec:\htthtt.exe114⤵PID:1928
-
\??\c:\jvjdd.exec:\jvjdd.exe115⤵PID:3736
-
\??\c:\jjjjj.exec:\jjjjj.exe116⤵PID:4648
-
\??\c:\pppvj.exec:\pppvj.exe117⤵PID:4528
-
\??\c:\rrfrfrf.exec:\rrfrfrf.exe118⤵PID:3824
-
\??\c:\rffxxrl.exec:\rffxxrl.exe119⤵PID:4004
-
\??\c:\bbnnnt.exec:\bbnnnt.exe120⤵PID:332
-
\??\c:\ttnhbb.exec:\ttnhbb.exe121⤵PID:4824
-
\??\c:\jjvdv.exec:\jjvdv.exe122⤵PID:3460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-