Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 13:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bb1eb27793a7b9628fcfc6c0afef9940_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
bb1eb27793a7b9628fcfc6c0afef9940_NeikiAnalytics.exe
-
Size
90KB
-
MD5
bb1eb27793a7b9628fcfc6c0afef9940
-
SHA1
adc65dac3dca281ab21767e399bf11273a9534e4
-
SHA256
dda1c64b39a8a74a473ecec9e64c402c1cee5b10347ac386a8619fb7ea2865c8
-
SHA512
67fb94df65664821042146bd10f1623ad34e0222152015bec4c0a24384e1b5e3cea7bdc868855c699a6d80c033f1b867984ee8bed846230e9a2e54f26ee2ebe9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZaRBm:ymb3NkkiQ3mdBjFIVLd2hWZGreRCYBK
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2936-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-40-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1436-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1340-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1380-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/900-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3028 rfrrxlr.exe 2816 bnbhbb.exe 3004 1pdvj.exe 2660 3xrrxfl.exe 2724 lxrxllx.exe 2484 9hnhnn.exe 2496 jddjp.exe 2504 jjdjj.exe 2904 frfxfxl.exe 1696 3lffllx.exe 2744 9nbhnb.exe 2700 bthntt.exe 2888 3dpjj.exe 2332 rlxxllr.exe 380 rlxfflf.exe 1436 bnntbn.exe 2232 vpddd.exe 1028 9frlrff.exe 1340 xrflrfl.exe 2692 hhtbnn.exe 2860 3hnnnt.exe 324 9pjdj.exe 2720 frlxlll.exe 1480 5xrxxxf.exe 784 nhthnt.exe 1380 tntbhn.exe 2344 dpjvd.exe 568 9rxrrrr.exe 2960 rrlfxlr.exe 2316 9tnbnb.exe 900 3pddp.exe 2140 1xllrll.exe 1744 rfrlxfx.exe 1608 1nbbnn.exe 1680 bnnhhb.exe 2576 vvjpp.exe 2640 jdvvj.exe 2632 fflrrff.exe 2276 xxlxxxx.exe 2580 thnnbt.exe 2584 btnnhb.exe 2728 nhnnbt.exe 2480 vpjdj.exe 2508 1pddd.exe 1276 rfflllr.exe 2516 rlxlrxf.exe 2536 hbthtb.exe 2808 9bnthh.exe 844 vjjpd.exe 1788 jvdvp.exe 2000 rfrlxxf.exe 276 rllffrf.exe 1940 bbnbnt.exe 2424 bbttbh.exe 1664 7jjvj.exe 1056 jdjjj.exe 2092 frrxlfr.exe 1912 xrrrfxl.exe 2428 1nbnnh.exe 2852 vpvjp.exe 628 lxlrfrr.exe 480 lfrxxfl.exe 1856 nhnbhh.exe 1116 bhhnhb.exe -
resource yara_rule behavioral1/memory/2936-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1436-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1340-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1380-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/900-298-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 3028 2936 bb1eb27793a7b9628fcfc6c0afef9940_NeikiAnalytics.exe 28 PID 2936 wrote to memory of 3028 2936 bb1eb27793a7b9628fcfc6c0afef9940_NeikiAnalytics.exe 28 PID 2936 wrote to memory of 3028 2936 bb1eb27793a7b9628fcfc6c0afef9940_NeikiAnalytics.exe 28 PID 2936 wrote to memory of 3028 2936 bb1eb27793a7b9628fcfc6c0afef9940_NeikiAnalytics.exe 28 PID 3028 wrote to memory of 2816 3028 rfrrxlr.exe 29 PID 3028 wrote to memory of 2816 3028 rfrrxlr.exe 29 PID 3028 wrote to memory of 2816 3028 rfrrxlr.exe 29 PID 3028 wrote to memory of 2816 3028 rfrrxlr.exe 29 PID 2816 wrote to memory of 3004 2816 bnbhbb.exe 30 PID 2816 wrote to memory of 3004 2816 bnbhbb.exe 30 PID 2816 wrote to memory of 3004 2816 bnbhbb.exe 30 PID 2816 wrote to memory of 3004 2816 bnbhbb.exe 30 PID 3004 wrote to memory of 2660 3004 1pdvj.exe 31 PID 3004 wrote to memory of 2660 3004 1pdvj.exe 31 PID 3004 wrote to memory of 2660 3004 1pdvj.exe 31 PID 3004 wrote to memory of 2660 3004 1pdvj.exe 31 PID 2660 wrote to memory of 2724 2660 3xrrxfl.exe 32 PID 2660 wrote to memory of 2724 2660 3xrrxfl.exe 32 PID 2660 wrote to memory of 2724 2660 3xrrxfl.exe 32 PID 2660 wrote to memory of 2724 2660 3xrrxfl.exe 32 PID 2724 wrote to memory of 2484 2724 lxrxllx.exe 33 PID 2724 wrote to memory of 2484 2724 lxrxllx.exe 33 PID 2724 wrote to memory of 2484 2724 lxrxllx.exe 33 PID 2724 wrote to memory of 2484 2724 lxrxllx.exe 33 PID 2484 wrote to memory of 2496 2484 9hnhnn.exe 34 PID 2484 wrote to memory of 2496 2484 9hnhnn.exe 34 PID 2484 wrote to memory of 2496 2484 9hnhnn.exe 34 PID 2484 wrote to memory of 2496 2484 9hnhnn.exe 34 PID 2496 wrote to memory of 2504 2496 jddjp.exe 35 PID 2496 wrote to memory of 2504 2496 jddjp.exe 35 PID 2496 wrote to memory of 2504 2496 jddjp.exe 35 PID 2496 wrote to memory of 2504 2496 jddjp.exe 35 PID 2504 wrote to memory of 2904 2504 jjdjj.exe 36 PID 2504 wrote to memory of 2904 2504 jjdjj.exe 36 PID 2504 wrote to memory of 2904 2504 jjdjj.exe 36 PID 2504 wrote to memory of 2904 2504 jjdjj.exe 36 PID 2904 wrote to memory of 1696 2904 frfxfxl.exe 37 PID 2904 wrote to memory of 1696 2904 frfxfxl.exe 37 PID 2904 wrote to memory of 1696 2904 frfxfxl.exe 37 PID 2904 wrote to memory of 1696 2904 frfxfxl.exe 37 PID 1696 wrote to memory of 2744 1696 3lffllx.exe 38 PID 1696 wrote to memory of 2744 1696 3lffllx.exe 38 PID 1696 wrote to memory of 2744 1696 3lffllx.exe 38 PID 1696 wrote to memory of 2744 1696 3lffllx.exe 38 PID 2744 wrote to memory of 2700 2744 9nbhnb.exe 39 PID 2744 wrote to memory of 2700 2744 9nbhnb.exe 39 PID 2744 wrote to memory of 2700 2744 9nbhnb.exe 39 PID 2744 wrote to memory of 2700 2744 9nbhnb.exe 39 PID 2700 wrote to memory of 2888 2700 bthntt.exe 40 PID 2700 wrote to memory of 2888 2700 bthntt.exe 40 PID 2700 wrote to memory of 2888 2700 bthntt.exe 40 PID 2700 wrote to memory of 2888 2700 bthntt.exe 40 PID 2888 wrote to memory of 2332 2888 3dpjj.exe 41 PID 2888 wrote to memory of 2332 2888 3dpjj.exe 41 PID 2888 wrote to memory of 2332 2888 3dpjj.exe 41 PID 2888 wrote to memory of 2332 2888 3dpjj.exe 41 PID 2332 wrote to memory of 380 2332 rlxxllr.exe 42 PID 2332 wrote to memory of 380 2332 rlxxllr.exe 42 PID 2332 wrote to memory of 380 2332 rlxxllr.exe 42 PID 2332 wrote to memory of 380 2332 rlxxllr.exe 42 PID 380 wrote to memory of 1436 380 rlxfflf.exe 43 PID 380 wrote to memory of 1436 380 rlxfflf.exe 43 PID 380 wrote to memory of 1436 380 rlxfflf.exe 43 PID 380 wrote to memory of 1436 380 rlxfflf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb1eb27793a7b9628fcfc6c0afef9940_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bb1eb27793a7b9628fcfc6c0afef9940_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\rfrrxlr.exec:\rfrrxlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\bnbhbb.exec:\bnbhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\1pdvj.exec:\1pdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\3xrrxfl.exec:\3xrrxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\lxrxllx.exec:\lxrxllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\9hnhnn.exec:\9hnhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\jddjp.exec:\jddjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\jjdjj.exec:\jjdjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\frfxfxl.exec:\frfxfxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\3lffllx.exec:\3lffllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\9nbhnb.exec:\9nbhnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\bthntt.exec:\bthntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\3dpjj.exec:\3dpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\rlxxllr.exec:\rlxxllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\rlxfflf.exec:\rlxfflf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\bnntbn.exec:\bnntbn.exe17⤵
- Executes dropped EXE
PID:1436 -
\??\c:\vpddd.exec:\vpddd.exe18⤵
- Executes dropped EXE
PID:2232 -
\??\c:\9frlrff.exec:\9frlrff.exe19⤵
- Executes dropped EXE
PID:1028 -
\??\c:\xrflrfl.exec:\xrflrfl.exe20⤵
- Executes dropped EXE
PID:1340 -
\??\c:\hhtbnn.exec:\hhtbnn.exe21⤵
- Executes dropped EXE
PID:2692 -
\??\c:\3hnnnt.exec:\3hnnnt.exe22⤵
- Executes dropped EXE
PID:2860 -
\??\c:\9pjdj.exec:\9pjdj.exe23⤵
- Executes dropped EXE
PID:324 -
\??\c:\frlxlll.exec:\frlxlll.exe24⤵
- Executes dropped EXE
PID:2720 -
\??\c:\5xrxxxf.exec:\5xrxxxf.exe25⤵
- Executes dropped EXE
PID:1480 -
\??\c:\nhthnt.exec:\nhthnt.exe26⤵
- Executes dropped EXE
PID:784 -
\??\c:\tntbhn.exec:\tntbhn.exe27⤵
- Executes dropped EXE
PID:1380 -
\??\c:\dpjvd.exec:\dpjvd.exe28⤵
- Executes dropped EXE
PID:2344 -
\??\c:\9rxrrrr.exec:\9rxrrrr.exe29⤵
- Executes dropped EXE
PID:568 -
\??\c:\rrlfxlr.exec:\rrlfxlr.exe30⤵
- Executes dropped EXE
PID:2960 -
\??\c:\9tnbnb.exec:\9tnbnb.exe31⤵
- Executes dropped EXE
PID:2316 -
\??\c:\3pddp.exec:\3pddp.exe32⤵
- Executes dropped EXE
PID:900 -
\??\c:\1xllrll.exec:\1xllrll.exe33⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rfrlxfx.exec:\rfrlxfx.exe34⤵
- Executes dropped EXE
PID:1744 -
\??\c:\1nbbnn.exec:\1nbbnn.exe35⤵
- Executes dropped EXE
PID:1608 -
\??\c:\bnnhhb.exec:\bnnhhb.exe36⤵
- Executes dropped EXE
PID:1680 -
\??\c:\vvjpp.exec:\vvjpp.exe37⤵
- Executes dropped EXE
PID:2576 -
\??\c:\jdvvj.exec:\jdvvj.exe38⤵
- Executes dropped EXE
PID:2640 -
\??\c:\fflrrff.exec:\fflrrff.exe39⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xxlxxxx.exec:\xxlxxxx.exe40⤵
- Executes dropped EXE
PID:2276 -
\??\c:\thnnbt.exec:\thnnbt.exe41⤵
- Executes dropped EXE
PID:2580 -
\??\c:\btnnhb.exec:\btnnhb.exe42⤵
- Executes dropped EXE
PID:2584 -
\??\c:\nhnnbt.exec:\nhnnbt.exe43⤵
- Executes dropped EXE
PID:2728 -
\??\c:\vpjdj.exec:\vpjdj.exe44⤵
- Executes dropped EXE
PID:2480 -
\??\c:\1pddd.exec:\1pddd.exe45⤵
- Executes dropped EXE
PID:2508 -
\??\c:\rfflllr.exec:\rfflllr.exe46⤵
- Executes dropped EXE
PID:1276 -
\??\c:\rlxlrxf.exec:\rlxlrxf.exe47⤵
- Executes dropped EXE
PID:2516 -
\??\c:\hbthtb.exec:\hbthtb.exe48⤵
- Executes dropped EXE
PID:2536 -
\??\c:\9bnthh.exec:\9bnthh.exe49⤵
- Executes dropped EXE
PID:2808 -
\??\c:\vjjpd.exec:\vjjpd.exe50⤵
- Executes dropped EXE
PID:844 -
\??\c:\jvdvp.exec:\jvdvp.exe51⤵
- Executes dropped EXE
PID:1788 -
\??\c:\rfrlxxf.exec:\rfrlxxf.exe52⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rllffrf.exec:\rllffrf.exe53⤵
- Executes dropped EXE
PID:276 -
\??\c:\bbnbnt.exec:\bbnbnt.exe54⤵
- Executes dropped EXE
PID:1940 -
\??\c:\bbttbh.exec:\bbttbh.exe55⤵
- Executes dropped EXE
PID:2424 -
\??\c:\7jjvj.exec:\7jjvj.exe56⤵
- Executes dropped EXE
PID:1664 -
\??\c:\jdjjj.exec:\jdjjj.exe57⤵
- Executes dropped EXE
PID:1056 -
\??\c:\frrxlfr.exec:\frrxlfr.exe58⤵
- Executes dropped EXE
PID:2092 -
\??\c:\xrrrfxl.exec:\xrrrfxl.exe59⤵
- Executes dropped EXE
PID:1912 -
\??\c:\1nbnnh.exec:\1nbnnh.exe60⤵
- Executes dropped EXE
PID:2428 -
\??\c:\vpvjp.exec:\vpvjp.exe61⤵
- Executes dropped EXE
PID:2852 -
\??\c:\lxlrfrr.exec:\lxlrfrr.exe62⤵
- Executes dropped EXE
PID:628 -
\??\c:\lfrxxfl.exec:\lfrxxfl.exe63⤵
- Executes dropped EXE
PID:480 -
\??\c:\nhnbhh.exec:\nhnbhh.exe64⤵
- Executes dropped EXE
PID:1856 -
\??\c:\bhhnhb.exec:\bhhnhb.exe65⤵
- Executes dropped EXE
PID:1116 -
\??\c:\pjdjv.exec:\pjdjv.exe66⤵PID:360
-
\??\c:\dpdpp.exec:\dpdpp.exe67⤵PID:1860
-
\??\c:\rlxxfxl.exec:\rlxxfxl.exe68⤵PID:1192
-
\??\c:\lfllrll.exec:\lfllrll.exe69⤵PID:1036
-
\??\c:\nbttbt.exec:\nbttbt.exe70⤵PID:1568
-
\??\c:\nbhhbb.exec:\nbhhbb.exe71⤵PID:824
-
\??\c:\1pvpd.exec:\1pvpd.exe72⤵PID:904
-
\??\c:\5vpvd.exec:\5vpvd.exe73⤵PID:1284
-
\??\c:\3lrxlrx.exec:\3lrxlrx.exe74⤵PID:2936
-
\??\c:\rfrxxrl.exec:\rfrxxrl.exe75⤵PID:2156
-
\??\c:\nhbhnn.exec:\nhbhnn.exe76⤵PID:1744
-
\??\c:\5tbnhn.exec:\5tbnhn.exe77⤵PID:1804
-
\??\c:\7pjpd.exec:\7pjpd.exe78⤵PID:1580
-
\??\c:\dvpdj.exec:\dvpdj.exe79⤵PID:2588
-
\??\c:\fflllfl.exec:\fflllfl.exe80⤵PID:2652
-
\??\c:\llxfrxl.exec:\llxfrxl.exe81⤵PID:2660
-
\??\c:\hthhnt.exec:\hthhnt.exe82⤵PID:2456
-
\??\c:\thbhnn.exec:\thbhnn.exe83⤵PID:2780
-
\??\c:\pjddv.exec:\pjddv.exe84⤵PID:2796
-
\??\c:\jvvdj.exec:\jvvdj.exe85⤵PID:2380
-
\??\c:\jdvvv.exec:\jdvvv.exe86⤵PID:2520
-
\??\c:\3flxxff.exec:\3flxxff.exe87⤵PID:2900
-
\??\c:\flrfxrr.exec:\flrfxrr.exe88⤵PID:848
-
\??\c:\nnhntt.exec:\nnhntt.exe89⤵PID:2764
-
\??\c:\btnbhn.exec:\btnbhn.exe90⤵PID:2756
-
\??\c:\9vppv.exec:\9vppv.exe91⤵PID:2784
-
\??\c:\ppjdd.exec:\ppjdd.exe92⤵PID:1976
-
\??\c:\rflrrrf.exec:\rflrrrf.exe93⤵PID:1452
-
\??\c:\7fllxrf.exec:\7fllxrf.exe94⤵PID:2328
-
\??\c:\9xrlxrx.exec:\9xrlxrx.exe95⤵PID:1936
-
\??\c:\hbnbnt.exec:\hbnbnt.exe96⤵PID:1920
-
\??\c:\1htbhh.exec:\1htbhh.exe97⤵PID:2232
-
\??\c:\pdpjv.exec:\pdpjv.exe98⤵PID:1984
-
\??\c:\dpvdv.exec:\dpvdv.exe99⤵PID:2088
-
\??\c:\frfxflf.exec:\frfxflf.exe100⤵PID:2544
-
\??\c:\rrxfrrx.exec:\rrxfrrx.exe101⤵PID:1536
-
\??\c:\thtthn.exec:\thtthn.exe102⤵PID:2428
-
\??\c:\bnbhnn.exec:\bnbhnn.exe103⤵PID:2024
-
\??\c:\jdjpv.exec:\jdjpv.exe104⤵PID:704
-
\??\c:\dvvvd.exec:\dvvvd.exe105⤵PID:2916
-
\??\c:\frfxxrf.exec:\frfxxrf.exe106⤵PID:2028
-
\??\c:\xlxffxx.exec:\xlxffxx.exe107⤵PID:972
-
\??\c:\1bhttb.exec:\1bhttb.exe108⤵PID:1084
-
\??\c:\1hnnbb.exec:\1hnnbb.exe109⤵PID:2192
-
\??\c:\nbnnth.exec:\nbnnth.exe110⤵PID:924
-
\??\c:\dvpvv.exec:\dvpvv.exe111⤵PID:2068
-
\??\c:\pjjjv.exec:\pjjjv.exe112⤵PID:2348
-
\??\c:\lrxxfxx.exec:\lrxxfxx.exe113⤵PID:2304
-
\??\c:\lxxfffr.exec:\lxxfffr.exe114⤵PID:1508
-
\??\c:\btntbt.exec:\btntbt.exe115⤵PID:1980
-
\??\c:\jvvpj.exec:\jvvpj.exe116⤵PID:1652
-
\??\c:\dvvdd.exec:\dvvdd.exe117⤵PID:3008
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe118⤵PID:2364
-
\??\c:\xrrffrf.exec:\xrrffrf.exe119⤵PID:2552
-
\??\c:\1rxlrrx.exec:\1rxlrrx.exe120⤵PID:1680
-
\??\c:\5tbhnn.exec:\5tbhnn.exe121⤵PID:2572
-
\??\c:\1ntnnt.exec:\1ntnnt.exe122⤵PID:2640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-