Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 20:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a81d6de9a73518776e3c141cd3f17e0_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
0a81d6de9a73518776e3c141cd3f17e0_NeikiAnalytics.exe
-
Size
64KB
-
MD5
0a81d6de9a73518776e3c141cd3f17e0
-
SHA1
00583453fc75b583c5dca7a87887fa6f4e1bb345
-
SHA256
f67e3022b39d951607d0f7ad6047d931091f9e1dfb8851ac98bc7142d0e51fcd
-
SHA512
ca528e304bf1e7cb4608ef52064b464acae017baf5fae7d1c2fd8966eba5cd5baadedf355f67bb02a80c7c4bf303b8fad8885d610fc8644c42bc37dfd5aae42f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIhJm/wk:ymb3NkkiQ3mdBjFILmT
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3700-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/924-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1596-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2184 1hbhnn.exe 1828 jppvv.exe 2308 9jpdj.exe 2556 rllfxxr.exe 1708 9ntnnn.exe 924 lflrxxx.exe 3272 hhhbhb.exe 3480 dvjjp.exe 4612 lfxxrxx.exe 3680 5tthtb.exe 4568 vpjdd.exe 4812 3rrlffl.exe 3684 7htbth.exe 1600 5ntnbt.exe 3244 pdjdd.exe 1700 3flfxxl.exe 2892 bttttn.exe 3044 dvdvp.exe 624 rxxxrrl.exe 1152 ffxrlfx.exe 3420 tbbbtn.exe 5028 vvpjj.exe 2588 5rxxrll.exe 1240 fxxllrr.exe 4876 bnnnbh.exe 4276 9dpvp.exe 1524 jvvpv.exe 1596 lfffrrr.exe 1856 nbhbbb.exe 3952 7ttthn.exe 2460 jvdpv.exe 2308 vpppv.exe 3116 5ntbnn.exe 2064 bhttnn.exe 924 jjpjj.exe 4272 xfrfffx.exe 2248 rffxfff.exe 1532 bntbhn.exe 2304 nnhttt.exe 4612 vdpvj.exe 3648 pvvjv.exe 376 rxfrfxl.exe 1248 hhttnn.exe 4812 hnhttb.exe 2604 vddvp.exe 3160 xxffrxx.exe 5000 lfflfrl.exe 516 btbbtb.exe 1700 7vdvv.exe 2892 dvdjv.exe 4620 frrrlll.exe 3224 3httnn.exe 1692 5bhhbb.exe 1152 vpvdv.exe 2204 3dvpj.exe 4640 rrflllx.exe 3540 hnhtnn.exe 4780 pvpjv.exe 2780 5vppj.exe 5052 1fflfff.exe 4172 hbhhbh.exe 2068 tbnnhn.exe 2800 1vjvv.exe 1428 xlrrlrl.exe -
resource yara_rule behavioral2/memory/3700-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1828-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/924-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/924-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/924-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/924-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1596-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1856-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3700 wrote to memory of 2184 3700 0a81d6de9a73518776e3c141cd3f17e0_NeikiAnalytics.exe 88 PID 3700 wrote to memory of 2184 3700 0a81d6de9a73518776e3c141cd3f17e0_NeikiAnalytics.exe 88 PID 3700 wrote to memory of 2184 3700 0a81d6de9a73518776e3c141cd3f17e0_NeikiAnalytics.exe 88 PID 2184 wrote to memory of 1828 2184 1hbhnn.exe 89 PID 2184 wrote to memory of 1828 2184 1hbhnn.exe 89 PID 2184 wrote to memory of 1828 2184 1hbhnn.exe 89 PID 1828 wrote to memory of 2308 1828 jppvv.exe 90 PID 1828 wrote to memory of 2308 1828 jppvv.exe 90 PID 1828 wrote to memory of 2308 1828 jppvv.exe 90 PID 2308 wrote to memory of 2556 2308 9jpdj.exe 92 PID 2308 wrote to memory of 2556 2308 9jpdj.exe 92 PID 2308 wrote to memory of 2556 2308 9jpdj.exe 92 PID 2556 wrote to memory of 1708 2556 rllfxxr.exe 94 PID 2556 wrote to memory of 1708 2556 rllfxxr.exe 94 PID 2556 wrote to memory of 1708 2556 rllfxxr.exe 94 PID 1708 wrote to memory of 924 1708 9ntnnn.exe 95 PID 1708 wrote to memory of 924 1708 9ntnnn.exe 95 PID 1708 wrote to memory of 924 1708 9ntnnn.exe 95 PID 924 wrote to memory of 3272 924 lflrxxx.exe 96 PID 924 wrote to memory of 3272 924 lflrxxx.exe 96 PID 924 wrote to memory of 3272 924 lflrxxx.exe 96 PID 3272 wrote to memory of 3480 3272 hhhbhb.exe 97 PID 3272 wrote to memory of 3480 3272 hhhbhb.exe 97 PID 3272 wrote to memory of 3480 3272 hhhbhb.exe 97 PID 3480 wrote to memory of 4612 3480 dvjjp.exe 98 PID 3480 wrote to memory of 4612 3480 dvjjp.exe 98 PID 3480 wrote to memory of 4612 3480 dvjjp.exe 98 PID 4612 wrote to memory of 3680 4612 lfxxrxx.exe 99 PID 4612 wrote to memory of 3680 4612 lfxxrxx.exe 99 PID 4612 wrote to memory of 3680 4612 lfxxrxx.exe 99 PID 3680 wrote to memory of 4568 3680 5tthtb.exe 100 PID 3680 wrote to memory of 4568 3680 5tthtb.exe 100 PID 3680 wrote to memory of 4568 3680 5tthtb.exe 100 PID 4568 wrote to memory of 4812 4568 vpjdd.exe 101 PID 4568 wrote to memory of 4812 4568 vpjdd.exe 101 PID 4568 wrote to memory of 4812 4568 vpjdd.exe 101 PID 4812 wrote to memory of 3684 4812 3rrlffl.exe 102 PID 4812 wrote to memory of 3684 4812 3rrlffl.exe 102 PID 4812 wrote to memory of 3684 4812 3rrlffl.exe 102 PID 3684 wrote to memory of 1600 3684 7htbth.exe 103 PID 3684 wrote to memory of 1600 3684 7htbth.exe 103 PID 3684 wrote to memory of 1600 3684 7htbth.exe 103 PID 1600 wrote to memory of 3244 1600 5ntnbt.exe 104 PID 1600 wrote to memory of 3244 1600 5ntnbt.exe 104 PID 1600 wrote to memory of 3244 1600 5ntnbt.exe 104 PID 3244 wrote to memory of 1700 3244 pdjdd.exe 105 PID 3244 wrote to memory of 1700 3244 pdjdd.exe 105 PID 3244 wrote to memory of 1700 3244 pdjdd.exe 105 PID 1700 wrote to memory of 2892 1700 3flfxxl.exe 106 PID 1700 wrote to memory of 2892 1700 3flfxxl.exe 106 PID 1700 wrote to memory of 2892 1700 3flfxxl.exe 106 PID 2892 wrote to memory of 3044 2892 bttttn.exe 107 PID 2892 wrote to memory of 3044 2892 bttttn.exe 107 PID 2892 wrote to memory of 3044 2892 bttttn.exe 107 PID 3044 wrote to memory of 624 3044 dvdvp.exe 108 PID 3044 wrote to memory of 624 3044 dvdvp.exe 108 PID 3044 wrote to memory of 624 3044 dvdvp.exe 108 PID 624 wrote to memory of 1152 624 rxxxrrl.exe 109 PID 624 wrote to memory of 1152 624 rxxxrrl.exe 109 PID 624 wrote to memory of 1152 624 rxxxrrl.exe 109 PID 1152 wrote to memory of 3420 1152 ffxrlfx.exe 110 PID 1152 wrote to memory of 3420 1152 ffxrlfx.exe 110 PID 1152 wrote to memory of 3420 1152 ffxrlfx.exe 110 PID 3420 wrote to memory of 5028 3420 tbbbtn.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a81d6de9a73518776e3c141cd3f17e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0a81d6de9a73518776e3c141cd3f17e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\1hbhnn.exec:\1hbhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\jppvv.exec:\jppvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\9jpdj.exec:\9jpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\rllfxxr.exec:\rllfxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\9ntnnn.exec:\9ntnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\lflrxxx.exec:\lflrxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\hhhbhb.exec:\hhhbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\dvjjp.exec:\dvjjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\lfxxrxx.exec:\lfxxrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\5tthtb.exec:\5tthtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\vpjdd.exec:\vpjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\3rrlffl.exec:\3rrlffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\7htbth.exec:\7htbth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\5ntnbt.exec:\5ntnbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\pdjdd.exec:\pdjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\3flfxxl.exec:\3flfxxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\bttttn.exec:\bttttn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\dvdvp.exec:\dvdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\rxxxrrl.exec:\rxxxrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\ffxrlfx.exec:\ffxrlfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\tbbbtn.exec:\tbbbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\vvpjj.exec:\vvpjj.exe23⤵
- Executes dropped EXE
PID:5028 -
\??\c:\5rxxrll.exec:\5rxxrll.exe24⤵
- Executes dropped EXE
PID:2588 -
\??\c:\fxxllrr.exec:\fxxllrr.exe25⤵
- Executes dropped EXE
PID:1240 -
\??\c:\bnnnbh.exec:\bnnnbh.exe26⤵
- Executes dropped EXE
PID:4876 -
\??\c:\9dpvp.exec:\9dpvp.exe27⤵
- Executes dropped EXE
PID:4276 -
\??\c:\jvvpv.exec:\jvvpv.exe28⤵
- Executes dropped EXE
PID:1524 -
\??\c:\lfffrrr.exec:\lfffrrr.exe29⤵
- Executes dropped EXE
PID:1596 -
\??\c:\nbhbbb.exec:\nbhbbb.exe30⤵
- Executes dropped EXE
PID:1856 -
\??\c:\7ttthn.exec:\7ttthn.exe31⤵
- Executes dropped EXE
PID:3952 -
\??\c:\jvdpv.exec:\jvdpv.exe32⤵
- Executes dropped EXE
PID:2460 -
\??\c:\vpppv.exec:\vpppv.exe33⤵
- Executes dropped EXE
PID:2308 -
\??\c:\5ntbnn.exec:\5ntbnn.exe34⤵
- Executes dropped EXE
PID:3116 -
\??\c:\bhttnn.exec:\bhttnn.exe35⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jjpjj.exec:\jjpjj.exe36⤵
- Executes dropped EXE
PID:924 -
\??\c:\xfrfffx.exec:\xfrfffx.exe37⤵
- Executes dropped EXE
PID:4272 -
\??\c:\rffxfff.exec:\rffxfff.exe38⤵
- Executes dropped EXE
PID:2248 -
\??\c:\bntbhn.exec:\bntbhn.exe39⤵
- Executes dropped EXE
PID:1532 -
\??\c:\nnhttt.exec:\nnhttt.exe40⤵
- Executes dropped EXE
PID:2304 -
\??\c:\vdpvj.exec:\vdpvj.exe41⤵
- Executes dropped EXE
PID:4612 -
\??\c:\pvvjv.exec:\pvvjv.exe42⤵
- Executes dropped EXE
PID:3648 -
\??\c:\rxfrfxl.exec:\rxfrfxl.exe43⤵
- Executes dropped EXE
PID:376 -
\??\c:\hhttnn.exec:\hhttnn.exe44⤵
- Executes dropped EXE
PID:1248 -
\??\c:\hnhttb.exec:\hnhttb.exe45⤵
- Executes dropped EXE
PID:4812 -
\??\c:\vddvp.exec:\vddvp.exe46⤵
- Executes dropped EXE
PID:2604 -
\??\c:\xxffrxx.exec:\xxffrxx.exe47⤵
- Executes dropped EXE
PID:3160 -
\??\c:\lfflfrl.exec:\lfflfrl.exe48⤵
- Executes dropped EXE
PID:5000 -
\??\c:\btbbtb.exec:\btbbtb.exe49⤵
- Executes dropped EXE
PID:516 -
\??\c:\7vdvv.exec:\7vdvv.exe50⤵
- Executes dropped EXE
PID:1700 -
\??\c:\dvdjv.exec:\dvdjv.exe51⤵
- Executes dropped EXE
PID:2892 -
\??\c:\frrrlll.exec:\frrrlll.exe52⤵
- Executes dropped EXE
PID:4620 -
\??\c:\3httnn.exec:\3httnn.exe53⤵
- Executes dropped EXE
PID:3224 -
\??\c:\5bhhbb.exec:\5bhhbb.exe54⤵
- Executes dropped EXE
PID:1692 -
\??\c:\vpvdv.exec:\vpvdv.exe55⤵
- Executes dropped EXE
PID:1152 -
\??\c:\3dvpj.exec:\3dvpj.exe56⤵
- Executes dropped EXE
PID:2204 -
\??\c:\rrflllx.exec:\rrflllx.exe57⤵
- Executes dropped EXE
PID:4640 -
\??\c:\hnhtnn.exec:\hnhtnn.exe58⤵
- Executes dropped EXE
PID:3540 -
\??\c:\pvpjv.exec:\pvpjv.exe59⤵
- Executes dropped EXE
PID:4780 -
\??\c:\5vppj.exec:\5vppj.exe60⤵
- Executes dropped EXE
PID:2780 -
\??\c:\1fflfff.exec:\1fflfff.exe61⤵
- Executes dropped EXE
PID:5052 -
\??\c:\hbhhbh.exec:\hbhhbh.exe62⤵
- Executes dropped EXE
PID:4172 -
\??\c:\tbnnhn.exec:\tbnnhn.exe63⤵
- Executes dropped EXE
PID:2068 -
\??\c:\1vjvv.exec:\1vjvv.exe64⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xlrrlrl.exec:\xlrrlrl.exe65⤵
- Executes dropped EXE
PID:1428 -
\??\c:\rfrrrrr.exec:\rfrrrrr.exe66⤵PID:1828
-
\??\c:\htbbtb.exec:\htbbtb.exe67⤵PID:3220
-
\??\c:\ttbnhb.exec:\ttbnhb.exe68⤵PID:3564
-
\??\c:\djjjd.exec:\djjjd.exe69⤵PID:4964
-
\??\c:\dvdvj.exec:\dvdvj.exe70⤵PID:2492
-
\??\c:\3lrfxff.exec:\3lrfxff.exe71⤵PID:924
-
\??\c:\frxfxfl.exec:\frxfxfl.exe72⤵PID:4272
-
\??\c:\5bhhnh.exec:\5bhhnh.exe73⤵PID:2248
-
\??\c:\1jpjj.exec:\1jpjj.exe74⤵PID:1532
-
\??\c:\dppvd.exec:\dppvd.exe75⤵PID:2304
-
\??\c:\lxfflrl.exec:\lxfflrl.exe76⤵PID:3436
-
\??\c:\btbtnn.exec:\btbtnn.exe77⤵PID:2516
-
\??\c:\bbbbhb.exec:\bbbbhb.exe78⤵PID:4428
-
\??\c:\jjdpp.exec:\jjdpp.exe79⤵PID:2740
-
\??\c:\jvvpp.exec:\jvvpp.exe80⤵PID:1072
-
\??\c:\5rrxrfx.exec:\5rrxrfx.exe81⤵PID:3160
-
\??\c:\ffxfrxx.exec:\ffxfrxx.exe82⤵PID:232
-
\??\c:\bbhbtn.exec:\bbhbtn.exe83⤵PID:3024
-
\??\c:\bbthht.exec:\bbthht.exe84⤵PID:2688
-
\??\c:\1djjd.exec:\1djjd.exe85⤵PID:1556
-
\??\c:\jdppj.exec:\jdppj.exe86⤵PID:4524
-
\??\c:\5frxrrr.exec:\5frxrrr.exe87⤵PID:3508
-
\??\c:\rrxxrfx.exec:\rrxxrfx.exe88⤵PID:4252
-
\??\c:\nbnnbh.exec:\nbnnbh.exe89⤵PID:3372
-
\??\c:\7nnbtn.exec:\7nnbtn.exe90⤵PID:4844
-
\??\c:\dvddp.exec:\dvddp.exe91⤵PID:4212
-
\??\c:\7pjdv.exec:\7pjdv.exe92⤵PID:1592
-
\??\c:\fxrlfll.exec:\fxrlfll.exe93⤵PID:1240
-
\??\c:\fflllrr.exec:\fflllrr.exe94⤵PID:4780
-
\??\c:\htbbtt.exec:\htbbtt.exe95⤵PID:3068
-
\??\c:\hbhbhb.exec:\hbhbhb.exe96⤵PID:4472
-
\??\c:\dpdpd.exec:\dpdpd.exe97⤵PID:1076
-
\??\c:\dvpdd.exec:\dvpdd.exe98⤵PID:2068
-
\??\c:\xfxrlff.exec:\xfxrlff.exe99⤵PID:1244
-
\??\c:\tbhbbh.exec:\tbhbbh.exe100⤵PID:1500
-
\??\c:\bnhhhh.exec:\bnhhhh.exe101⤵PID:1648
-
\??\c:\vvdvj.exec:\vvdvj.exe102⤵PID:3220
-
\??\c:\vjvpj.exec:\vjvpj.exe103⤵PID:3564
-
\??\c:\7lrxrxx.exec:\7lrxrxx.exe104⤵PID:4180
-
\??\c:\fxxrrxr.exec:\fxxrrxr.exe105⤵PID:2492
-
\??\c:\tthbbn.exec:\tthbbn.exe106⤵PID:4400
-
\??\c:\tnttbb.exec:\tnttbb.exe107⤵PID:3104
-
\??\c:\dvpjd.exec:\dvpjd.exe108⤵PID:2276
-
\??\c:\dvppp.exec:\dvppp.exe109⤵PID:804
-
\??\c:\lfxfllx.exec:\lfxfllx.exe110⤵PID:376
-
\??\c:\llxxxxx.exec:\llxxxxx.exe111⤵PID:2260
-
\??\c:\ttnhhn.exec:\ttnhhn.exe112⤵PID:3792
-
\??\c:\pdjdd.exec:\pdjdd.exe113⤵PID:2348
-
\??\c:\flxxrrl.exec:\flxxrrl.exe114⤵PID:3904
-
\??\c:\fxrrlrx.exec:\fxrrlrx.exe115⤵PID:516
-
\??\c:\hbnnhn.exec:\hbnnhn.exe116⤵PID:1700
-
\??\c:\tntnnt.exec:\tntnnt.exe117⤵PID:2892
-
\??\c:\vvvvp.exec:\vvvvp.exe118⤵PID:4620
-
\??\c:\9pppj.exec:\9pppj.exe119⤵PID:3224
-
\??\c:\1lfrrxx.exec:\1lfrrxx.exe120⤵PID:1152
-
\??\c:\lrrrrfr.exec:\lrrrrfr.exe121⤵PID:2700
-
\??\c:\hthbbb.exec:\hthbbb.exe122⤵PID:3724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-