Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 10:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
15007bca6d2449388e9898c1626216d0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
15007bca6d2449388e9898c1626216d0_NeikiAnalytics.exe
-
Size
87KB
-
MD5
15007bca6d2449388e9898c1626216d0
-
SHA1
9dbce738c331433febbccb80e045ec0dbd158657
-
SHA256
2a212aff3225e17884ead79dc2236a9d3fe510b91dcfb1e93f9625b6a94602f0
-
SHA512
f83dd73e9e646d9e689e7a22a008796ea18bca4eba70cf8156401b1c7261739c56b41d0370423d13384d4bd5415633f652dc4a9c8ee949fad1e1e63ef48f62a9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73yqKH/KjveD:ymb3NkkiQ3mdBjFo73yX+vQ
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/1068-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5588-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5796-70-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5796-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5432-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1312-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5152-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5692-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5224-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5612-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5800-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/6060-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4576 tnttnh.exe 4556 5ddvv.exe 2928 5fffxll.exe 452 3rxxxxx.exe 1772 7nntnh.exe 5588 tnhbbn.exe 3196 jpvdd.exe 4232 xlrllll.exe 5796 rffxxrl.exe 2164 hhbtbb.exe 1332 pdddv.exe 5432 rrfflrf.exe 1312 xrrllll.exe 2228 hbbbbb.exe 4340 vdddj.exe 5152 3xfrllf.exe 5248 rxrffll.exe 4532 bbnnhh.exe 3536 nhnhhn.exe 3820 dvvjd.exe 2552 jdpjj.exe 5692 llllllf.exe 5224 ntbnnn.exe 5016 9ddjv.exe 3480 vpvdv.exe 3896 rrxrrrr.exe 5612 7tttnn.exe 3740 9tbtnn.exe 5800 jdpjp.exe 5336 5ddjv.exe 6060 xrfffff.exe 808 3flxxrr.exe 2176 5bhbbh.exe 3328 bbttbt.exe 5252 ppppv.exe 6036 jpppp.exe 6088 fxxrlll.exe 2416 1ntnbb.exe 2360 7bbttt.exe 5140 9jjpd.exe 3148 pdppj.exe 2192 xrxxrrr.exe 4816 xrrlffx.exe 3004 3hhbnh.exe 5424 jvdpd.exe 5704 jdvdj.exe 1392 rrxlxrl.exe 3044 9xxrxrr.exe 4128 ntbthh.exe 5728 vjjdv.exe 5096 pjdvj.exe 3380 frxlxlf.exe 2280 bhnbnt.exe 2120 hbbnhb.exe 1288 jpvpj.exe 5324 1ppjv.exe 5876 xrlxxrr.exe 2160 7xrlxrl.exe 3016 bhbthb.exe 6008 hbnnbb.exe 764 vvjvv.exe 512 lfxxlfx.exe 5572 7rlfxxr.exe 4752 1hbtnh.exe -
resource yara_rule behavioral2/memory/1068-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5588-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5796-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5432-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1312-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5152-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5692-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5224-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5612-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5800-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/6060-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1068 wrote to memory of 4576 1068 15007bca6d2449388e9898c1626216d0_NeikiAnalytics.exe 82 PID 1068 wrote to memory of 4576 1068 15007bca6d2449388e9898c1626216d0_NeikiAnalytics.exe 82 PID 1068 wrote to memory of 4576 1068 15007bca6d2449388e9898c1626216d0_NeikiAnalytics.exe 82 PID 4576 wrote to memory of 4556 4576 tnttnh.exe 83 PID 4576 wrote to memory of 4556 4576 tnttnh.exe 83 PID 4576 wrote to memory of 4556 4576 tnttnh.exe 83 PID 4556 wrote to memory of 2928 4556 5ddvv.exe 84 PID 4556 wrote to memory of 2928 4556 5ddvv.exe 84 PID 4556 wrote to memory of 2928 4556 5ddvv.exe 84 PID 2928 wrote to memory of 452 2928 5fffxll.exe 85 PID 2928 wrote to memory of 452 2928 5fffxll.exe 85 PID 2928 wrote to memory of 452 2928 5fffxll.exe 85 PID 452 wrote to memory of 1772 452 3rxxxxx.exe 86 PID 452 wrote to memory of 1772 452 3rxxxxx.exe 86 PID 452 wrote to memory of 1772 452 3rxxxxx.exe 86 PID 1772 wrote to memory of 5588 1772 7nntnh.exe 87 PID 1772 wrote to memory of 5588 1772 7nntnh.exe 87 PID 1772 wrote to memory of 5588 1772 7nntnh.exe 87 PID 5588 wrote to memory of 3196 5588 tnhbbn.exe 88 PID 5588 wrote to memory of 3196 5588 tnhbbn.exe 88 PID 5588 wrote to memory of 3196 5588 tnhbbn.exe 88 PID 3196 wrote to memory of 4232 3196 jpvdd.exe 89 PID 3196 wrote to memory of 4232 3196 jpvdd.exe 89 PID 3196 wrote to memory of 4232 3196 jpvdd.exe 89 PID 4232 wrote to memory of 5796 4232 xlrllll.exe 90 PID 4232 wrote to memory of 5796 4232 xlrllll.exe 90 PID 4232 wrote to memory of 5796 4232 xlrllll.exe 90 PID 5796 wrote to memory of 2164 5796 rffxxrl.exe 91 PID 5796 wrote to memory of 2164 5796 rffxxrl.exe 91 PID 5796 wrote to memory of 2164 5796 rffxxrl.exe 91 PID 2164 wrote to memory of 1332 2164 hhbtbb.exe 92 PID 2164 wrote to memory of 1332 2164 hhbtbb.exe 92 PID 2164 wrote to memory of 1332 2164 hhbtbb.exe 92 PID 1332 wrote to memory of 5432 1332 pdddv.exe 93 PID 1332 wrote to memory of 5432 1332 pdddv.exe 93 PID 1332 wrote to memory of 5432 1332 pdddv.exe 93 PID 5432 wrote to memory of 1312 5432 rrfflrf.exe 94 PID 5432 wrote to memory of 1312 5432 rrfflrf.exe 94 PID 5432 wrote to memory of 1312 5432 rrfflrf.exe 94 PID 1312 wrote to memory of 2228 1312 xrrllll.exe 95 PID 1312 wrote to memory of 2228 1312 xrrllll.exe 95 PID 1312 wrote to memory of 2228 1312 xrrllll.exe 95 PID 2228 wrote to memory of 4340 2228 hbbbbb.exe 96 PID 2228 wrote to memory of 4340 2228 hbbbbb.exe 96 PID 2228 wrote to memory of 4340 2228 hbbbbb.exe 96 PID 4340 wrote to memory of 5152 4340 vdddj.exe 97 PID 4340 wrote to memory of 5152 4340 vdddj.exe 97 PID 4340 wrote to memory of 5152 4340 vdddj.exe 97 PID 5152 wrote to memory of 5248 5152 3xfrllf.exe 98 PID 5152 wrote to memory of 5248 5152 3xfrllf.exe 98 PID 5152 wrote to memory of 5248 5152 3xfrllf.exe 98 PID 5248 wrote to memory of 4532 5248 rxrffll.exe 99 PID 5248 wrote to memory of 4532 5248 rxrffll.exe 99 PID 5248 wrote to memory of 4532 5248 rxrffll.exe 99 PID 4532 wrote to memory of 3536 4532 bbnnhh.exe 100 PID 4532 wrote to memory of 3536 4532 bbnnhh.exe 100 PID 4532 wrote to memory of 3536 4532 bbnnhh.exe 100 PID 3536 wrote to memory of 3820 3536 nhnhhn.exe 101 PID 3536 wrote to memory of 3820 3536 nhnhhn.exe 101 PID 3536 wrote to memory of 3820 3536 nhnhhn.exe 101 PID 3820 wrote to memory of 2552 3820 dvvjd.exe 102 PID 3820 wrote to memory of 2552 3820 dvvjd.exe 102 PID 3820 wrote to memory of 2552 3820 dvvjd.exe 102 PID 2552 wrote to memory of 5692 2552 jdpjj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\15007bca6d2449388e9898c1626216d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\15007bca6d2449388e9898c1626216d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\tnttnh.exec:\tnttnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\5ddvv.exec:\5ddvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\5fffxll.exec:\5fffxll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\3rxxxxx.exec:\3rxxxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\7nntnh.exec:\7nntnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\tnhbbn.exec:\tnhbbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
\??\c:\jpvdd.exec:\jpvdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\xlrllll.exec:\xlrllll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\rffxxrl.exec:\rffxxrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
\??\c:\hhbtbb.exec:\hhbtbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\pdddv.exec:\pdddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\rrfflrf.exec:\rrfflrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
\??\c:\xrrllll.exec:\xrrllll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\hbbbbb.exec:\hbbbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\vdddj.exec:\vdddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\3xfrllf.exec:\3xfrllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
\??\c:\rxrffll.exec:\rxrffll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5248 -
\??\c:\bbnnhh.exec:\bbnnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\nhnhhn.exec:\nhnhhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\dvvjd.exec:\dvvjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\jdpjj.exec:\jdpjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\llllllf.exec:\llllllf.exe23⤵
- Executes dropped EXE
PID:5692 -
\??\c:\ntbnnn.exec:\ntbnnn.exe24⤵
- Executes dropped EXE
PID:5224 -
\??\c:\9ddjv.exec:\9ddjv.exe25⤵
- Executes dropped EXE
PID:5016 -
\??\c:\vpvdv.exec:\vpvdv.exe26⤵
- Executes dropped EXE
PID:3480 -
\??\c:\rrxrrrr.exec:\rrxrrrr.exe27⤵
- Executes dropped EXE
PID:3896 -
\??\c:\7tttnn.exec:\7tttnn.exe28⤵
- Executes dropped EXE
PID:5612 -
\??\c:\9tbtnn.exec:\9tbtnn.exe29⤵
- Executes dropped EXE
PID:3740 -
\??\c:\jdpjp.exec:\jdpjp.exe30⤵
- Executes dropped EXE
PID:5800 -
\??\c:\5ddjv.exec:\5ddjv.exe31⤵
- Executes dropped EXE
PID:5336 -
\??\c:\xrfffff.exec:\xrfffff.exe32⤵
- Executes dropped EXE
PID:6060 -
\??\c:\3flxxrr.exec:\3flxxrr.exe33⤵
- Executes dropped EXE
PID:808 -
\??\c:\5bhbbh.exec:\5bhbbh.exe34⤵
- Executes dropped EXE
PID:2176 -
\??\c:\bbttbt.exec:\bbttbt.exe35⤵
- Executes dropped EXE
PID:3328 -
\??\c:\ppppv.exec:\ppppv.exe36⤵
- Executes dropped EXE
PID:5252 -
\??\c:\jpppp.exec:\jpppp.exe37⤵
- Executes dropped EXE
PID:6036 -
\??\c:\fxxrlll.exec:\fxxrlll.exe38⤵
- Executes dropped EXE
PID:6088 -
\??\c:\1ntnbb.exec:\1ntnbb.exe39⤵
- Executes dropped EXE
PID:2416 -
\??\c:\7bbttt.exec:\7bbttt.exe40⤵
- Executes dropped EXE
PID:2360 -
\??\c:\9jjpd.exec:\9jjpd.exe41⤵
- Executes dropped EXE
PID:5140 -
\??\c:\pdppj.exec:\pdppj.exe42⤵
- Executes dropped EXE
PID:3148 -
\??\c:\xrxxrrr.exec:\xrxxrrr.exe43⤵
- Executes dropped EXE
PID:2192 -
\??\c:\xrrlffx.exec:\xrrlffx.exe44⤵
- Executes dropped EXE
PID:4816 -
\??\c:\3hhbnh.exec:\3hhbnh.exe45⤵
- Executes dropped EXE
PID:3004 -
\??\c:\jvdpd.exec:\jvdpd.exe46⤵
- Executes dropped EXE
PID:5424 -
\??\c:\jdvdj.exec:\jdvdj.exe47⤵
- Executes dropped EXE
PID:5704 -
\??\c:\rrxlxrl.exec:\rrxlxrl.exe48⤵
- Executes dropped EXE
PID:1392 -
\??\c:\9xxrxrr.exec:\9xxrxrr.exe49⤵
- Executes dropped EXE
PID:3044 -
\??\c:\ntbthh.exec:\ntbthh.exe50⤵
- Executes dropped EXE
PID:4128 -
\??\c:\vjjdv.exec:\vjjdv.exe51⤵
- Executes dropped EXE
PID:5728 -
\??\c:\pjdvj.exec:\pjdvj.exe52⤵
- Executes dropped EXE
PID:5096 -
\??\c:\frxlxlf.exec:\frxlxlf.exe53⤵
- Executes dropped EXE
PID:3380 -
\??\c:\bhnbnt.exec:\bhnbnt.exe54⤵
- Executes dropped EXE
PID:2280 -
\??\c:\hbbnhb.exec:\hbbnhb.exe55⤵
- Executes dropped EXE
PID:2120 -
\??\c:\jpvpj.exec:\jpvpj.exe56⤵
- Executes dropped EXE
PID:1288 -
\??\c:\1ppjv.exec:\1ppjv.exe57⤵
- Executes dropped EXE
PID:5324 -
\??\c:\xrlxxrr.exec:\xrlxxrr.exe58⤵
- Executes dropped EXE
PID:5876 -
\??\c:\7xrlxrl.exec:\7xrlxrl.exe59⤵
- Executes dropped EXE
PID:2160 -
\??\c:\bhbthb.exec:\bhbthb.exe60⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hbnnbb.exec:\hbnnbb.exe61⤵
- Executes dropped EXE
PID:6008 -
\??\c:\vvjvv.exec:\vvjvv.exe62⤵
- Executes dropped EXE
PID:764 -
\??\c:\lfxxlfx.exec:\lfxxlfx.exe63⤵
- Executes dropped EXE
PID:512 -
\??\c:\7rlfxxr.exec:\7rlfxxr.exe64⤵
- Executes dropped EXE
PID:5572 -
\??\c:\1hbtnh.exec:\1hbtnh.exe65⤵
- Executes dropped EXE
PID:4752 -
\??\c:\vpjjd.exec:\vpjjd.exe66⤵PID:2456
-
\??\c:\dvpdv.exec:\dvpdv.exe67⤵PID:3872
-
\??\c:\frrlxxr.exec:\frrlxxr.exe68⤵PID:836
-
\??\c:\3llrllf.exec:\3llrllf.exe69⤵PID:2200
-
\??\c:\bhhbtn.exec:\bhhbtn.exe70⤵PID:4464
-
\??\c:\nbthtt.exec:\nbthtt.exe71⤵PID:5244
-
\??\c:\7bthtn.exec:\7bthtn.exe72⤵PID:1068
-
\??\c:\pppdd.exec:\pppdd.exe73⤵PID:5036
-
\??\c:\9ffrlfx.exec:\9ffrlfx.exe74⤵PID:3232
-
\??\c:\tnbthb.exec:\tnbthb.exe75⤵PID:4160
-
\??\c:\9tnbtb.exec:\9tnbtb.exe76⤵PID:2188
-
\??\c:\dvpjv.exec:\dvpjv.exe77⤵PID:452
-
\??\c:\dpjvp.exec:\dpjvp.exe78⤵PID:4252
-
\??\c:\lllxlfr.exec:\lllxlfr.exe79⤵PID:528
-
\??\c:\5fflfrl.exec:\5fflfrl.exe80⤵PID:5588
-
\??\c:\nhhnnn.exec:\nhhnnn.exe81⤵PID:4292
-
\??\c:\bbbhnn.exec:\bbbhnn.exe82⤵PID:5808
-
\??\c:\1djdd.exec:\1djdd.exe83⤵PID:4044
-
\??\c:\jdvdp.exec:\jdvdp.exe84⤵PID:5796
-
\??\c:\1xrlxxr.exec:\1xrlxxr.exe85⤵PID:2308
-
\??\c:\lrrfrlf.exec:\lrrfrlf.exe86⤵PID:1816
-
\??\c:\nbbthb.exec:\nbbthb.exe87⤵PID:5192
-
\??\c:\bnntbh.exec:\bnntbh.exe88⤵PID:4680
-
\??\c:\vpvpp.exec:\vpvpp.exe89⤵PID:3852
-
\??\c:\djddj.exec:\djddj.exe90⤵PID:1872
-
\??\c:\lfxrfxr.exec:\lfxrfxr.exe91⤵PID:3632
-
\??\c:\fllxrlx.exec:\fllxrlx.exe92⤵PID:5832
-
\??\c:\3tthbb.exec:\3tthbb.exe93⤵PID:4864
-
\??\c:\nnnbtn.exec:\nnnbtn.exe94⤵PID:5248
-
\??\c:\3jjjp.exec:\3jjjp.exe95⤵PID:3388
-
\??\c:\7xrlxlx.exec:\7xrlxlx.exe96⤵PID:3536
-
\??\c:\nthbnn.exec:\nthbnn.exe97⤵PID:3900
-
\??\c:\hnhbtn.exec:\hnhbtn.exe98⤵PID:3636
-
\??\c:\pdpdv.exec:\pdpdv.exe99⤵PID:3520
-
\??\c:\rfrllff.exec:\rfrllff.exe100⤵PID:6128
-
\??\c:\llfxlxl.exec:\llfxlxl.exe101⤵PID:2300
-
\??\c:\tnhnnb.exec:\tnhnnb.exe102⤵PID:5536
-
\??\c:\vpjjv.exec:\vpjjv.exe103⤵PID:3480
-
\??\c:\xrlxlfx.exec:\xrlxlfx.exe104⤵PID:5788
-
\??\c:\frfrlfx.exec:\frfrlfx.exe105⤵PID:3884
-
\??\c:\djddv.exec:\djddv.exe106⤵PID:5052
-
\??\c:\7vddp.exec:\7vddp.exe107⤵PID:5028
-
\??\c:\llffxxl.exec:\llffxxl.exe108⤵PID:4264
-
\??\c:\9xrlxrl.exec:\9xrlxrl.exe109⤵PID:4540
-
\??\c:\9bbbnh.exec:\9bbbnh.exe110⤵PID:1696
-
\??\c:\9vvjv.exec:\9vvjv.exe111⤵PID:5044
-
\??\c:\ppjpp.exec:\ppjpp.exe112⤵PID:808
-
\??\c:\rrxxffl.exec:\rrxxffl.exe113⤵PID:2176
-
\??\c:\nhhbtn.exec:\nhhbtn.exe114⤵PID:2868
-
\??\c:\pvvvj.exec:\pvvvj.exe115⤵PID:1672
-
\??\c:\lfrrfrf.exec:\lfrrfrf.exe116⤵PID:1344
-
\??\c:\xlfxfxr.exec:\xlfxfxr.exe117⤵PID:3356
-
\??\c:\9bhthb.exec:\9bhthb.exe118⤵PID:4736
-
\??\c:\hbbttb.exec:\hbbttb.exe119⤵PID:1660
-
\??\c:\dvjdd.exec:\dvjdd.exe120⤵PID:1280
-
\??\c:\9xlxrfx.exec:\9xlxrfx.exe121⤵PID:3124
-
\??\c:\rfxrlff.exec:\rfxrlff.exe122⤵PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-