Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 09:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
82a1d57941989bbedc6fa19893efbdd0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
82a1d57941989bbedc6fa19893efbdd0_NeikiAnalytics.exe
-
Size
371KB
-
MD5
82a1d57941989bbedc6fa19893efbdd0
-
SHA1
46cae7b2e437de12c706d6b35dc8b54aed92ed60
-
SHA256
193e9fef40e8a1b82c7e5ff63202e6b1d2048d6dacb3dbaedc838850796c7c42
-
SHA512
004e3e2587e473318888f1c90195489f3ea705203b67ae4e5b8b3cba966e666ca85a5f79a0df4861eca9abebd03bcbdf49f12fd61d4b6f3790118c6467337204
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq7mjKPC+gy:n3C9yMo+S0L9xRnoq7mePPT
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4172-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3148-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2868-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4412 lxrfrrx.exe 4796 9pdvj.exe 3188 lxffxxl.exe 2664 3lrflfl.exe 3348 nbbhbh.exe 4428 pdvjd.exe 3508 rxlfrrr.exe 3488 pppjd.exe 3148 lrrfrlf.exe 1852 nbnhbb.exe 3036 lxlfrrf.exe 2640 7hthnh.exe 1460 vvvjd.exe 1292 nhtntn.exe 1588 dvppp.exe 3584 lxfxllf.exe 1796 nhbtnn.exe 3264 vvvpd.exe 4104 frrfrrf.exe 2868 frrlxfr.exe 2336 fxxrlfx.exe 3608 9nthbt.exe 1724 jvvjd.exe 1684 ddjvj.exe 2856 bnnhtn.exe 1772 5ppdd.exe 400 lxxlxrl.exe 2188 jpvpj.exe 4620 7lrfxxr.exe 384 jpdvv.exe 4840 7nbhth.exe 3672 dvpjv.exe 1208 1lrfrlf.exe 1968 htnhbt.exe 3428 pdpjd.exe 2968 pjpjj.exe 688 lffrffx.exe 4068 rxrfxxl.exe 2784 tnnhbb.exe 1280 5pjdv.exe 116 vjpjd.exe 2828 1rlxrlx.exe 3420 nntttt.exe 216 pppjp.exe 2176 rllfllx.exe 2316 3xxxrlf.exe 1476 nntbtt.exe 5032 9llfrlx.exe 2264 nhnntb.exe 412 ppjpj.exe 4392 xxrflfx.exe 4584 ttbthh.exe 1456 3jdvj.exe 2136 vpjvv.exe 1552 xrrfxrl.exe 4796 rfrlffr.exe 1692 bbtbnh.exe 2472 dddjv.exe 1900 pvpdj.exe 2356 5rrfrlf.exe 3728 xxfxrlf.exe 1480 bbtnbt.exe 4640 vjpdj.exe 4680 vvjpv.exe -
resource yara_rule behavioral2/memory/4172-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3148-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2868-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/384-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4172 wrote to memory of 4412 4172 82a1d57941989bbedc6fa19893efbdd0_NeikiAnalytics.exe 81 PID 4172 wrote to memory of 4412 4172 82a1d57941989bbedc6fa19893efbdd0_NeikiAnalytics.exe 81 PID 4172 wrote to memory of 4412 4172 82a1d57941989bbedc6fa19893efbdd0_NeikiAnalytics.exe 81 PID 4412 wrote to memory of 4796 4412 lxrfrrx.exe 82 PID 4412 wrote to memory of 4796 4412 lxrfrrx.exe 82 PID 4412 wrote to memory of 4796 4412 lxrfrrx.exe 82 PID 4796 wrote to memory of 3188 4796 9pdvj.exe 83 PID 4796 wrote to memory of 3188 4796 9pdvj.exe 83 PID 4796 wrote to memory of 3188 4796 9pdvj.exe 83 PID 3188 wrote to memory of 2664 3188 lxffxxl.exe 84 PID 3188 wrote to memory of 2664 3188 lxffxxl.exe 84 PID 3188 wrote to memory of 2664 3188 lxffxxl.exe 84 PID 2664 wrote to memory of 3348 2664 3lrflfl.exe 85 PID 2664 wrote to memory of 3348 2664 3lrflfl.exe 85 PID 2664 wrote to memory of 3348 2664 3lrflfl.exe 85 PID 3348 wrote to memory of 4428 3348 nbbhbh.exe 86 PID 3348 wrote to memory of 4428 3348 nbbhbh.exe 86 PID 3348 wrote to memory of 4428 3348 nbbhbh.exe 86 PID 4428 wrote to memory of 3508 4428 pdvjd.exe 87 PID 4428 wrote to memory of 3508 4428 pdvjd.exe 87 PID 4428 wrote to memory of 3508 4428 pdvjd.exe 87 PID 3508 wrote to memory of 3488 3508 rxlfrrr.exe 88 PID 3508 wrote to memory of 3488 3508 rxlfrrr.exe 88 PID 3508 wrote to memory of 3488 3508 rxlfrrr.exe 88 PID 3488 wrote to memory of 3148 3488 pppjd.exe 89 PID 3488 wrote to memory of 3148 3488 pppjd.exe 89 PID 3488 wrote to memory of 3148 3488 pppjd.exe 89 PID 3148 wrote to memory of 1852 3148 lrrfrlf.exe 90 PID 3148 wrote to memory of 1852 3148 lrrfrlf.exe 90 PID 3148 wrote to memory of 1852 3148 lrrfrlf.exe 90 PID 1852 wrote to memory of 3036 1852 nbnhbb.exe 91 PID 1852 wrote to memory of 3036 1852 nbnhbb.exe 91 PID 1852 wrote to memory of 3036 1852 nbnhbb.exe 91 PID 3036 wrote to memory of 2640 3036 lxlfrrf.exe 92 PID 3036 wrote to memory of 2640 3036 lxlfrrf.exe 92 PID 3036 wrote to memory of 2640 3036 lxlfrrf.exe 92 PID 2640 wrote to memory of 1460 2640 7hthnh.exe 93 PID 2640 wrote to memory of 1460 2640 7hthnh.exe 93 PID 2640 wrote to memory of 1460 2640 7hthnh.exe 93 PID 1460 wrote to memory of 1292 1460 vvvjd.exe 94 PID 1460 wrote to memory of 1292 1460 vvvjd.exe 94 PID 1460 wrote to memory of 1292 1460 vvvjd.exe 94 PID 1292 wrote to memory of 1588 1292 nhtntn.exe 95 PID 1292 wrote to memory of 1588 1292 nhtntn.exe 95 PID 1292 wrote to memory of 1588 1292 nhtntn.exe 95 PID 1588 wrote to memory of 3584 1588 dvppp.exe 96 PID 1588 wrote to memory of 3584 1588 dvppp.exe 96 PID 1588 wrote to memory of 3584 1588 dvppp.exe 96 PID 3584 wrote to memory of 1796 3584 lxfxllf.exe 97 PID 3584 wrote to memory of 1796 3584 lxfxllf.exe 97 PID 3584 wrote to memory of 1796 3584 lxfxllf.exe 97 PID 1796 wrote to memory of 3264 1796 nhbtnn.exe 98 PID 1796 wrote to memory of 3264 1796 nhbtnn.exe 98 PID 1796 wrote to memory of 3264 1796 nhbtnn.exe 98 PID 3264 wrote to memory of 4104 3264 vvvpd.exe 99 PID 3264 wrote to memory of 4104 3264 vvvpd.exe 99 PID 3264 wrote to memory of 4104 3264 vvvpd.exe 99 PID 4104 wrote to memory of 2868 4104 frrfrrf.exe 100 PID 4104 wrote to memory of 2868 4104 frrfrrf.exe 100 PID 4104 wrote to memory of 2868 4104 frrfrrf.exe 100 PID 2868 wrote to memory of 2336 2868 frrlxfr.exe 101 PID 2868 wrote to memory of 2336 2868 frrlxfr.exe 101 PID 2868 wrote to memory of 2336 2868 frrlxfr.exe 101 PID 2336 wrote to memory of 3608 2336 fxxrlfx.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\82a1d57941989bbedc6fa19893efbdd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\82a1d57941989bbedc6fa19893efbdd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\lxrfrrx.exec:\lxrfrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\9pdvj.exec:\9pdvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\lxffxxl.exec:\lxffxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\3lrflfl.exec:\3lrflfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\nbbhbh.exec:\nbbhbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\pdvjd.exec:\pdvjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\rxlfrrr.exec:\rxlfrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\pppjd.exec:\pppjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\lrrfrlf.exec:\lrrfrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\nbnhbb.exec:\nbnhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\lxlfrrf.exec:\lxlfrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\7hthnh.exec:\7hthnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\vvvjd.exec:\vvvjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\nhtntn.exec:\nhtntn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\dvppp.exec:\dvppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\lxfxllf.exec:\lxfxllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\nhbtnn.exec:\nhbtnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\vvvpd.exec:\vvvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\frrfrrf.exec:\frrfrrf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\frrlxfr.exec:\frrlxfr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\9nthbt.exec:\9nthbt.exe23⤵
- Executes dropped EXE
PID:3608 -
\??\c:\jvvjd.exec:\jvvjd.exe24⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ddjvj.exec:\ddjvj.exe25⤵
- Executes dropped EXE
PID:1684 -
\??\c:\bnnhtn.exec:\bnnhtn.exe26⤵
- Executes dropped EXE
PID:2856 -
\??\c:\5ppdd.exec:\5ppdd.exe27⤵
- Executes dropped EXE
PID:1772 -
\??\c:\lxxlxrl.exec:\lxxlxrl.exe28⤵
- Executes dropped EXE
PID:400 -
\??\c:\jpvpj.exec:\jpvpj.exe29⤵
- Executes dropped EXE
PID:2188 -
\??\c:\7lrfxxr.exec:\7lrfxxr.exe30⤵
- Executes dropped EXE
PID:4620 -
\??\c:\jpdvv.exec:\jpdvv.exe31⤵
- Executes dropped EXE
PID:384 -
\??\c:\7nbhth.exec:\7nbhth.exe32⤵
- Executes dropped EXE
PID:4840 -
\??\c:\dvpjv.exec:\dvpjv.exe33⤵
- Executes dropped EXE
PID:3672 -
\??\c:\1lrfrlf.exec:\1lrfrlf.exe34⤵
- Executes dropped EXE
PID:1208 -
\??\c:\htnhbt.exec:\htnhbt.exe35⤵
- Executes dropped EXE
PID:1968 -
\??\c:\pdpjd.exec:\pdpjd.exe36⤵
- Executes dropped EXE
PID:3428 -
\??\c:\pjpjj.exec:\pjpjj.exe37⤵
- Executes dropped EXE
PID:2968 -
\??\c:\lffrffx.exec:\lffrffx.exe38⤵
- Executes dropped EXE
PID:688 -
\??\c:\rxrfxxl.exec:\rxrfxxl.exe39⤵
- Executes dropped EXE
PID:4068 -
\??\c:\tnnhbb.exec:\tnnhbb.exe40⤵
- Executes dropped EXE
PID:2784 -
\??\c:\5pjdv.exec:\5pjdv.exe41⤵
- Executes dropped EXE
PID:1280 -
\??\c:\vjpjd.exec:\vjpjd.exe42⤵
- Executes dropped EXE
PID:116 -
\??\c:\1rlxrlx.exec:\1rlxrlx.exe43⤵
- Executes dropped EXE
PID:2828 -
\??\c:\nntttt.exec:\nntttt.exe44⤵
- Executes dropped EXE
PID:3420 -
\??\c:\pppjp.exec:\pppjp.exe45⤵
- Executes dropped EXE
PID:216 -
\??\c:\rllfllx.exec:\rllfllx.exe46⤵
- Executes dropped EXE
PID:2176 -
\??\c:\3xxxrlf.exec:\3xxxrlf.exe47⤵
- Executes dropped EXE
PID:2316 -
\??\c:\nntbtt.exec:\nntbtt.exe48⤵
- Executes dropped EXE
PID:1476 -
\??\c:\9llfrlx.exec:\9llfrlx.exe49⤵
- Executes dropped EXE
PID:5032 -
\??\c:\nhnntb.exec:\nhnntb.exe50⤵
- Executes dropped EXE
PID:2264 -
\??\c:\ppjpj.exec:\ppjpj.exe51⤵
- Executes dropped EXE
PID:412 -
\??\c:\xxrflfx.exec:\xxrflfx.exe52⤵
- Executes dropped EXE
PID:4392 -
\??\c:\ttbthh.exec:\ttbthh.exe53⤵
- Executes dropped EXE
PID:4584 -
\??\c:\3jdvj.exec:\3jdvj.exe54⤵
- Executes dropped EXE
PID:1456 -
\??\c:\vpjvv.exec:\vpjvv.exe55⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xrrfxrl.exec:\xrrfxrl.exe56⤵
- Executes dropped EXE
PID:1552 -
\??\c:\rfrlffr.exec:\rfrlffr.exe57⤵
- Executes dropped EXE
PID:4796 -
\??\c:\bbtbnh.exec:\bbtbnh.exe58⤵
- Executes dropped EXE
PID:1692 -
\??\c:\dddjv.exec:\dddjv.exe59⤵
- Executes dropped EXE
PID:2472 -
\??\c:\pvpdj.exec:\pvpdj.exe60⤵
- Executes dropped EXE
PID:1900 -
\??\c:\5rrfrlf.exec:\5rrfrlf.exe61⤵
- Executes dropped EXE
PID:2356 -
\??\c:\xxfxrlf.exec:\xxfxrlf.exe62⤵
- Executes dropped EXE
PID:3728 -
\??\c:\bbtnbt.exec:\bbtnbt.exe63⤵
- Executes dropped EXE
PID:1480 -
\??\c:\vjpdj.exec:\vjpdj.exe64⤵
- Executes dropped EXE
PID:4640 -
\??\c:\vvjpv.exec:\vvjpv.exe65⤵
- Executes dropped EXE
PID:4680 -
\??\c:\9frlffr.exec:\9frlffr.exe66⤵PID:4532
-
\??\c:\nbbtnh.exec:\nbbtnh.exe67⤵PID:840
-
\??\c:\bnnbnh.exec:\bnnbnh.exe68⤵PID:3440
-
\??\c:\djdvp.exec:\djdvp.exe69⤵PID:1852
-
\??\c:\rlfxlfx.exec:\rlfxlfx.exe70⤵PID:876
-
\??\c:\llxfxlf.exec:\llxfxlf.exe71⤵PID:2640
-
\??\c:\3bbnbt.exec:\3bbnbt.exe72⤵PID:3200
-
\??\c:\7pjdv.exec:\7pjdv.exe73⤵PID:3960
-
\??\c:\xlfxrll.exec:\xlfxrll.exe74⤵PID:3228
-
\??\c:\5lrllrr.exec:\5lrllrr.exe75⤵PID:2892
-
\??\c:\btnbtn.exec:\btnbtn.exe76⤵PID:4540
-
\??\c:\pjvjd.exec:\pjvjd.exe77⤵PID:2544
-
\??\c:\xrlxxxf.exec:\xrlxxxf.exe78⤵PID:3932
-
\??\c:\hnbthb.exec:\hnbthb.exe79⤵PID:2660
-
\??\c:\nnbnhh.exec:\nnbnhh.exe80⤵PID:468
-
\??\c:\pjjdp.exec:\pjjdp.exe81⤵PID:1976
-
\??\c:\fflfrrl.exec:\fflfrrl.exe82⤵PID:3688
-
\??\c:\1xllxrl.exec:\1xllxrl.exe83⤵PID:2116
-
\??\c:\bbnntn.exec:\bbnntn.exe84⤵PID:4944
-
\??\c:\vdpdd.exec:\vdpdd.exe85⤵PID:3948
-
\??\c:\xxlfffl.exec:\xxlfffl.exe86⤵PID:4528
-
\??\c:\9nnntb.exec:\9nnntb.exe87⤵PID:4044
-
\??\c:\nnbhhh.exec:\nnbhhh.exe88⤵PID:4048
-
\??\c:\vpdpj.exec:\vpdpj.exe89⤵PID:3540
-
\??\c:\fxxrfff.exec:\fxxrfff.exe90⤵PID:3548
-
\??\c:\nbhbtt.exec:\nbhbtt.exe91⤵PID:4240
-
\??\c:\bhnnbt.exec:\bhnnbt.exe92⤵PID:4968
-
\??\c:\jdjvj.exec:\jdjvj.exe93⤵PID:4912
-
\??\c:\xrxrfrl.exec:\xrxrfrl.exe94⤵PID:2960
-
\??\c:\hbbbtn.exec:\hbbbtn.exe95⤵PID:2796
-
\??\c:\htbttt.exec:\htbttt.exe96⤵PID:3328
-
\??\c:\pjjdp.exec:\pjjdp.exe97⤵PID:2028
-
\??\c:\xxxxrrl.exec:\xxxxrrl.exe98⤵PID:3944
-
\??\c:\hbbtnh.exec:\hbbtnh.exe99⤵PID:3224
-
\??\c:\ntbttt.exec:\ntbttt.exe100⤵PID:64
-
\??\c:\9jdpj.exec:\9jdpj.exe101⤵PID:2748
-
\??\c:\xxlfrrl.exec:\xxlfrrl.exe102⤵PID:612
-
\??\c:\9nthhb.exec:\9nthhb.exe103⤵PID:2588
-
\??\c:\nhnttb.exec:\nhnttb.exe104⤵PID:1328
-
\??\c:\ppjdv.exec:\ppjdv.exe105⤵PID:2488
-
\??\c:\7ffxllf.exec:\7ffxllf.exe106⤵PID:4916
-
\??\c:\hbtthh.exec:\hbtthh.exe107⤵PID:1020
-
\??\c:\nnhbtt.exec:\nnhbtt.exe108⤵PID:2740
-
\??\c:\djpjv.exec:\djpjv.exe109⤵PID:4576
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe110⤵PID:2052
-
\??\c:\9bhhnt.exec:\9bhhnt.exe111⤵PID:4988
-
\??\c:\hbnhht.exec:\hbnhht.exe112⤵PID:4692
-
\??\c:\djpjv.exec:\djpjv.exe113⤵PID:4324
-
\??\c:\rllfxrl.exec:\rllfxrl.exe114⤵PID:4448
-
\??\c:\7ffxllf.exec:\7ffxllf.exe115⤵PID:4172
-
\??\c:\btbbtt.exec:\btbbtt.exe116⤵PID:452
-
\??\c:\pjjdp.exec:\pjjdp.exe117⤵PID:4900
-
\??\c:\7xfxlfx.exec:\7xfxlfx.exe118⤵PID:4976
-
\??\c:\hnbtnn.exec:\hnbtnn.exe119⤵PID:2280
-
\??\c:\ddjjv.exec:\ddjjv.exe120⤵PID:2148
-
\??\c:\jddvp.exec:\jddvp.exe121⤵PID:3188
-
\??\c:\1rlfrrl.exec:\1rlfrrl.exe122⤵PID:4728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-