Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 20:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f4bb024edda2b324c8c66345dc662c0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
7f4bb024edda2b324c8c66345dc662c0_NeikiAnalytics.exe
-
Size
93KB
-
MD5
7f4bb024edda2b324c8c66345dc662c0
-
SHA1
eac039c2ec1f76194277cea6584b9a92894b17fc
-
SHA256
1cfbc47565f530bcccf69ef02e628d64d1d79fdaf5a3bb007d88ab31c6a14252
-
SHA512
0b1c056fe465a41262b7d43f2e174a893958bc7481a00c26f71adb6f656c2f534fb8c50affab3380aaa2eee284377da87878549edd38952d56ca368cd928587d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7NANTBuQG1np24+2OX6:ymb3NkkiQ3mdBjFo7NguQG1n0US6
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3124-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/412-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2896-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1160-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4904 rlfrrfr.exe 4776 5bhhnn.exe 3120 nhhhbh.exe 3064 ffrlffx.exe 1692 ntnhhh.exe 3380 nntbbb.exe 3464 5dvpj.exe 3712 rfrrrxx.exe 2376 djpjj.exe 2736 xxxxrxf.exe 2212 nbhbbb.exe 2184 3nnnnt.exe 4840 jdjvj.exe 412 7rrlfff.exe 116 hhhbbb.exe 3412 vvddv.exe 4548 xfrrlrr.exe 3956 xrfflrr.exe 3516 hhhbbb.exe 2264 ppppp.exe 2896 rlrfrrl.exe 1952 tbtnhb.exe 2284 rrxlxfr.exe 3652 nhnnhn.exe 3752 vdjjp.exe 1160 ffffrxx.exe 3232 rffrlll.exe 3536 hbnnht.exe 2496 tnnnhh.exe 4956 vpdvd.exe 2904 flfflrf.exe 4864 tbhbtt.exe 2460 dvppv.exe 1960 ddvdj.exe 1120 flrxlrf.exe 4900 hnnhbn.exe 500 btbtnn.exe 3428 pvppd.exe 1324 7frllrl.exe 4244 tbtnnh.exe 1884 7djjj.exe 3316 frrlfff.exe 2056 hhbtnn.exe 4276 nnnhbb.exe 4028 jpvpp.exe 1928 lffxlxr.exe 1712 ththbt.exe 5068 dppjd.exe 952 djjdp.exe 4896 fxrlxxr.exe 2376 httnbb.exe 2384 pvvpp.exe 5020 xflfxxr.exe 1840 nhhthb.exe 3096 ppppj.exe 3004 frffxfx.exe 4164 7bbnht.exe 116 1djdv.exe 4644 pjdvp.exe 2944 lxlrlfx.exe 4024 bhbhth.exe 2456 rrxfxxr.exe 3588 9frllll.exe 3140 bhbtnn.exe -
resource yara_rule behavioral2/memory/3124-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/412-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2896-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3124 wrote to memory of 4904 3124 7f4bb024edda2b324c8c66345dc662c0_NeikiAnalytics.exe 83 PID 3124 wrote to memory of 4904 3124 7f4bb024edda2b324c8c66345dc662c0_NeikiAnalytics.exe 83 PID 3124 wrote to memory of 4904 3124 7f4bb024edda2b324c8c66345dc662c0_NeikiAnalytics.exe 83 PID 4904 wrote to memory of 4776 4904 rlfrrfr.exe 84 PID 4904 wrote to memory of 4776 4904 rlfrrfr.exe 84 PID 4904 wrote to memory of 4776 4904 rlfrrfr.exe 84 PID 4776 wrote to memory of 3120 4776 5bhhnn.exe 85 PID 4776 wrote to memory of 3120 4776 5bhhnn.exe 85 PID 4776 wrote to memory of 3120 4776 5bhhnn.exe 85 PID 3120 wrote to memory of 3064 3120 nhhhbh.exe 86 PID 3120 wrote to memory of 3064 3120 nhhhbh.exe 86 PID 3120 wrote to memory of 3064 3120 nhhhbh.exe 86 PID 3064 wrote to memory of 1692 3064 ffrlffx.exe 87 PID 3064 wrote to memory of 1692 3064 ffrlffx.exe 87 PID 3064 wrote to memory of 1692 3064 ffrlffx.exe 87 PID 1692 wrote to memory of 3380 1692 ntnhhh.exe 88 PID 1692 wrote to memory of 3380 1692 ntnhhh.exe 88 PID 1692 wrote to memory of 3380 1692 ntnhhh.exe 88 PID 3380 wrote to memory of 3464 3380 nntbbb.exe 89 PID 3380 wrote to memory of 3464 3380 nntbbb.exe 89 PID 3380 wrote to memory of 3464 3380 nntbbb.exe 89 PID 3464 wrote to memory of 3712 3464 5dvpj.exe 90 PID 3464 wrote to memory of 3712 3464 5dvpj.exe 90 PID 3464 wrote to memory of 3712 3464 5dvpj.exe 90 PID 3712 wrote to memory of 2376 3712 rfrrrxx.exe 91 PID 3712 wrote to memory of 2376 3712 rfrrrxx.exe 91 PID 3712 wrote to memory of 2376 3712 rfrrrxx.exe 91 PID 2376 wrote to memory of 2736 2376 djpjj.exe 92 PID 2376 wrote to memory of 2736 2376 djpjj.exe 92 PID 2376 wrote to memory of 2736 2376 djpjj.exe 92 PID 2736 wrote to memory of 2212 2736 xxxxrxf.exe 93 PID 2736 wrote to memory of 2212 2736 xxxxrxf.exe 93 PID 2736 wrote to memory of 2212 2736 xxxxrxf.exe 93 PID 2212 wrote to memory of 2184 2212 nbhbbb.exe 94 PID 2212 wrote to memory of 2184 2212 nbhbbb.exe 94 PID 2212 wrote to memory of 2184 2212 nbhbbb.exe 94 PID 2184 wrote to memory of 4840 2184 3nnnnt.exe 95 PID 2184 wrote to memory of 4840 2184 3nnnnt.exe 95 PID 2184 wrote to memory of 4840 2184 3nnnnt.exe 95 PID 4840 wrote to memory of 412 4840 jdjvj.exe 96 PID 4840 wrote to memory of 412 4840 jdjvj.exe 96 PID 4840 wrote to memory of 412 4840 jdjvj.exe 96 PID 412 wrote to memory of 116 412 7rrlfff.exe 97 PID 412 wrote to memory of 116 412 7rrlfff.exe 97 PID 412 wrote to memory of 116 412 7rrlfff.exe 97 PID 116 wrote to memory of 3412 116 hhhbbb.exe 98 PID 116 wrote to memory of 3412 116 hhhbbb.exe 98 PID 116 wrote to memory of 3412 116 hhhbbb.exe 98 PID 3412 wrote to memory of 4548 3412 vvddv.exe 99 PID 3412 wrote to memory of 4548 3412 vvddv.exe 99 PID 3412 wrote to memory of 4548 3412 vvddv.exe 99 PID 4548 wrote to memory of 3956 4548 xfrrlrr.exe 100 PID 4548 wrote to memory of 3956 4548 xfrrlrr.exe 100 PID 4548 wrote to memory of 3956 4548 xfrrlrr.exe 100 PID 3956 wrote to memory of 3516 3956 xrfflrr.exe 101 PID 3956 wrote to memory of 3516 3956 xrfflrr.exe 101 PID 3956 wrote to memory of 3516 3956 xrfflrr.exe 101 PID 3516 wrote to memory of 2264 3516 hhhbbb.exe 102 PID 3516 wrote to memory of 2264 3516 hhhbbb.exe 102 PID 3516 wrote to memory of 2264 3516 hhhbbb.exe 102 PID 2264 wrote to memory of 2896 2264 ppppp.exe 103 PID 2264 wrote to memory of 2896 2264 ppppp.exe 103 PID 2264 wrote to memory of 2896 2264 ppppp.exe 103 PID 2896 wrote to memory of 1952 2896 rlrfrrl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f4bb024edda2b324c8c66345dc662c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7f4bb024edda2b324c8c66345dc662c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\rlfrrfr.exec:\rlfrrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\5bhhnn.exec:\5bhhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\nhhhbh.exec:\nhhhbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\ffrlffx.exec:\ffrlffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\ntnhhh.exec:\ntnhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\nntbbb.exec:\nntbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\5dvpj.exec:\5dvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\rfrrrxx.exec:\rfrrrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\djpjj.exec:\djpjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\xxxxrxf.exec:\xxxxrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\nbhbbb.exec:\nbhbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\3nnnnt.exec:\3nnnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\jdjvj.exec:\jdjvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\7rrlfff.exec:\7rrlfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\hhhbbb.exec:\hhhbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\vvddv.exec:\vvddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\xfrrlrr.exec:\xfrrlrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\xrfflrr.exec:\xrfflrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\hhhbbb.exec:\hhhbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\ppppp.exec:\ppppp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\rlrfrrl.exec:\rlrfrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\tbtnhb.exec:\tbtnhb.exe23⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rrxlxfr.exec:\rrxlxfr.exe24⤵
- Executes dropped EXE
PID:2284 -
\??\c:\nhnnhn.exec:\nhnnhn.exe25⤵
- Executes dropped EXE
PID:3652 -
\??\c:\vdjjp.exec:\vdjjp.exe26⤵
- Executes dropped EXE
PID:3752 -
\??\c:\ffffrxx.exec:\ffffrxx.exe27⤵
- Executes dropped EXE
PID:1160 -
\??\c:\rffrlll.exec:\rffrlll.exe28⤵
- Executes dropped EXE
PID:3232 -
\??\c:\hbnnht.exec:\hbnnht.exe29⤵
- Executes dropped EXE
PID:3536 -
\??\c:\tnnnhh.exec:\tnnnhh.exe30⤵
- Executes dropped EXE
PID:2496 -
\??\c:\vpdvd.exec:\vpdvd.exe31⤵
- Executes dropped EXE
PID:4956 -
\??\c:\flfflrf.exec:\flfflrf.exe32⤵
- Executes dropped EXE
PID:2904 -
\??\c:\tbhbtt.exec:\tbhbtt.exe33⤵
- Executes dropped EXE
PID:4864 -
\??\c:\dvppv.exec:\dvppv.exe34⤵
- Executes dropped EXE
PID:2460 -
\??\c:\ddvdj.exec:\ddvdj.exe35⤵
- Executes dropped EXE
PID:1960 -
\??\c:\flrxlrf.exec:\flrxlrf.exe36⤵
- Executes dropped EXE
PID:1120 -
\??\c:\hnnhbn.exec:\hnnhbn.exe37⤵
- Executes dropped EXE
PID:4900 -
\??\c:\btbtnn.exec:\btbtnn.exe38⤵
- Executes dropped EXE
PID:500 -
\??\c:\pvppd.exec:\pvppd.exe39⤵
- Executes dropped EXE
PID:3428 -
\??\c:\7frllrl.exec:\7frllrl.exe40⤵
- Executes dropped EXE
PID:1324 -
\??\c:\tbtnnh.exec:\tbtnnh.exe41⤵
- Executes dropped EXE
PID:4244 -
\??\c:\7djjj.exec:\7djjj.exe42⤵
- Executes dropped EXE
PID:1884 -
\??\c:\frrlfff.exec:\frrlfff.exe43⤵
- Executes dropped EXE
PID:3316 -
\??\c:\hhbtnn.exec:\hhbtnn.exe44⤵
- Executes dropped EXE
PID:2056 -
\??\c:\nnnhbb.exec:\nnnhbb.exe45⤵
- Executes dropped EXE
PID:4276 -
\??\c:\jpvpp.exec:\jpvpp.exe46⤵
- Executes dropped EXE
PID:4028 -
\??\c:\lffxlxr.exec:\lffxlxr.exe47⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ththbt.exec:\ththbt.exe48⤵
- Executes dropped EXE
PID:1712 -
\??\c:\dppjd.exec:\dppjd.exe49⤵
- Executes dropped EXE
PID:5068 -
\??\c:\djjdp.exec:\djjdp.exe50⤵
- Executes dropped EXE
PID:952 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe51⤵
- Executes dropped EXE
PID:4896 -
\??\c:\httnbb.exec:\httnbb.exe52⤵
- Executes dropped EXE
PID:2376 -
\??\c:\pvvpp.exec:\pvvpp.exe53⤵
- Executes dropped EXE
PID:2384 -
\??\c:\xflfxxr.exec:\xflfxxr.exe54⤵
- Executes dropped EXE
PID:5020 -
\??\c:\nhhthb.exec:\nhhthb.exe55⤵
- Executes dropped EXE
PID:1840 -
\??\c:\ppppj.exec:\ppppj.exe56⤵
- Executes dropped EXE
PID:3096 -
\??\c:\frffxfx.exec:\frffxfx.exe57⤵
- Executes dropped EXE
PID:3004 -
\??\c:\7bbnht.exec:\7bbnht.exe58⤵
- Executes dropped EXE
PID:4164 -
\??\c:\1djdv.exec:\1djdv.exe59⤵
- Executes dropped EXE
PID:116 -
\??\c:\pjdvp.exec:\pjdvp.exe60⤵
- Executes dropped EXE
PID:4644 -
\??\c:\lxlrlfx.exec:\lxlrlfx.exe61⤵
- Executes dropped EXE
PID:2944 -
\??\c:\bhbhth.exec:\bhbhth.exe62⤵
- Executes dropped EXE
PID:4024 -
\??\c:\rrxfxxr.exec:\rrxfxxr.exe63⤵
- Executes dropped EXE
PID:2456 -
\??\c:\9frllll.exec:\9frllll.exe64⤵
- Executes dropped EXE
PID:3588 -
\??\c:\bhbtnn.exec:\bhbtnn.exe65⤵
- Executes dropped EXE
PID:3140 -
\??\c:\vvvpj.exec:\vvvpj.exe66⤵PID:2896
-
\??\c:\7rxxrrf.exec:\7rxxrrf.exe67⤵PID:1716
-
\??\c:\nnhhbb.exec:\nnhhbb.exe68⤵PID:940
-
\??\c:\5jvpj.exec:\5jvpj.exe69⤵PID:2576
-
\??\c:\vvpjd.exec:\vvpjd.exe70⤵PID:4872
-
\??\c:\3xfxlrl.exec:\3xfxlrl.exe71⤵PID:3384
-
\??\c:\rlffffx.exec:\rlffffx.exe72⤵PID:3168
-
\??\c:\nhhbtb.exec:\nhhbtb.exe73⤵PID:2064
-
\??\c:\dvvjv.exec:\dvvjv.exe74⤵PID:3620
-
\??\c:\3pvpp.exec:\3pvpp.exe75⤵PID:4580
-
\??\c:\3xxrlll.exec:\3xxrlll.exe76⤵PID:1228
-
\??\c:\nhbbhn.exec:\nhbbhn.exe77⤵PID:4924
-
\??\c:\hhbttt.exec:\hhbttt.exe78⤵PID:4232
-
\??\c:\9vjdd.exec:\9vjdd.exe79⤵PID:1508
-
\??\c:\jvppj.exec:\jvppj.exe80⤵PID:2692
-
\??\c:\xlrrlll.exec:\xlrrlll.exe81⤵PID:1028
-
\??\c:\hhhbtt.exec:\hhhbtt.exe82⤵PID:3436
-
\??\c:\btbbnt.exec:\btbbnt.exe83⤵PID:1488
-
\??\c:\ddvpj.exec:\ddvpj.exe84⤵PID:3036
-
\??\c:\llxrflr.exec:\llxrflr.exe85⤵PID:3444
-
\??\c:\rllrrxf.exec:\rllrrxf.exe86⤵PID:4904
-
\??\c:\nhhhbb.exec:\nhhhbb.exe87⤵PID:1136
-
\??\c:\ttnhhh.exec:\ttnhhh.exe88⤵PID:4816
-
\??\c:\jpdvp.exec:\jpdvp.exe89⤵PID:2984
-
\??\c:\1jjdd.exec:\1jjdd.exe90⤵PID:4092
-
\??\c:\xlrlflf.exec:\xlrlflf.exe91⤵PID:3276
-
\??\c:\ttbbhn.exec:\ttbbhn.exe92⤵PID:1692
-
\??\c:\jdvpj.exec:\jdvpj.exe93⤵PID:3560
-
\??\c:\frrlfff.exec:\frrlfff.exe94⤵PID:3940
-
\??\c:\ffrxxll.exec:\ffrxxll.exe95⤵PID:2252
-
\??\c:\tthhhn.exec:\tthhhn.exe96⤵PID:4560
-
\??\c:\tttthh.exec:\tttthh.exe97⤵PID:4836
-
\??\c:\ddjpd.exec:\ddjpd.exe98⤵PID:3792
-
\??\c:\ddddp.exec:\ddddp.exe99⤵PID:4840
-
\??\c:\fxxlfrl.exec:\fxxlfrl.exe100⤵PID:1600
-
\??\c:\btbhbb.exec:\btbhbb.exe101⤵PID:3568
-
\??\c:\jjddj.exec:\jjddj.exe102⤵PID:116
-
\??\c:\dvjdp.exec:\dvjdp.exe103⤵PID:3280
-
\??\c:\xlrlfff.exec:\xlrlfff.exe104⤵PID:2552
-
\??\c:\httttt.exec:\httttt.exe105⤵PID:2372
-
\??\c:\1hnhbb.exec:\1hnhbb.exe106⤵PID:1216
-
\??\c:\5jdvp.exec:\5jdvp.exe107⤵PID:5040
-
\??\c:\vppjv.exec:\vppjv.exe108⤵PID:1072
-
\??\c:\lfrrlrr.exec:\lfrrlrr.exe109⤵PID:5052
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe110⤵PID:1160
-
\??\c:\rxlxrrl.exec:\rxlxrrl.exe111⤵PID:1116
-
\??\c:\lfrrxlr.exec:\lfrrxlr.exe112⤵PID:2508
-
\??\c:\1hbhhn.exec:\1hbhhn.exe113⤵PID:2756
-
\??\c:\bttnnn.exec:\bttnnn.exe114⤵PID:1280
-
\??\c:\9jddd.exec:\9jddd.exe115⤵PID:2444
-
\??\c:\5rxrxxx.exec:\5rxrxxx.exe116⤵PID:3580
-
\??\c:\rxfxrxr.exec:\rxfxrxr.exe117⤵PID:3320
-
\??\c:\bttnhh.exec:\bttnhh.exe118⤵PID:4564
-
\??\c:\pvjjv.exec:\pvjjv.exe119⤵PID:5032
-
\??\c:\xlrrllr.exec:\xlrrllr.exe120⤵PID:788
-
\??\c:\lrlllll.exec:\lrlllll.exe121⤵PID:4424
-
\??\c:\nnbnhn.exec:\nnbnhn.exe122⤵PID:1616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-