Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 02:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6a05a2ce027efc00c6481e718628dde0_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
6a05a2ce027efc00c6481e718628dde0_NeikiAnalytics.exe
-
Size
81KB
-
MD5
6a05a2ce027efc00c6481e718628dde0
-
SHA1
99c483e65b72eea9928668e63a15e70b9cff2c8e
-
SHA256
bd4a51c2f2aca70a9ab95a8d93f4f4feedbcb6a8f98e9fd0644286a3ace3b999
-
SHA512
02c38aab8431758a55de0a97c158d2a83adbe8dca8a9760ee712245ded5dd74bfbd1474e2fbd6e790ada1bfb924378445fd9f20653b9c91fec9c238f1726732b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7xCkTsIwtOa2dYS8nj/R:ymb3NkkiQ3mdBjFo7LAIbT6jJ
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/2760-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-32-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-82-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/832-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1168-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/404-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2148 hbtnhn.exe 2532 ddvdp.exe 2588 rlxfllr.exe 2580 nthbhb.exe 2624 pvppv.exe 2576 ffrlxfr.exe 2444 rrxrfrx.exe 1648 5thnbh.exe 2992 jjdjv.exe 2856 5pddj.exe 2860 rxxxxfx.exe 2428 nnhnhn.exe 1788 5nbbhn.exe 1640 pjvdp.exe 832 jvjjp.exe 3028 rlxxrlf.exe 1652 lfrrflx.exe 1604 hbthth.exe 1808 nhbhnn.exe 2912 dvjpj.exe 2672 fxrxxfx.exe 324 xxrrlrf.exe 1168 hbhntn.exe 1828 7hbhhh.exe 2408 vvpvj.exe 292 9xflllr.exe 2316 fxrfrxf.exe 2212 3thntb.exe 404 vvjjp.exe 2264 1pjpd.exe 1792 1ffflrf.exe 328 5tnhtb.exe 2392 nhnnnt.exe 2132 vpjpv.exe 1612 1dvjp.exe 2252 jvjjp.exe 2644 rlfflrf.exe 2660 3hbbbb.exe 2596 hbhtnt.exe 2740 5htnbt.exe 2624 3dppp.exe 2440 jvdvd.exe 2512 9xfxfxr.exe 1736 lffflrr.exe 2320 btntbn.exe 2992 tbnhbb.exe 2852 pvdpd.exe 2968 pdvvd.exe 2700 5xxlrrx.exe 1588 9xlxxfl.exe 1788 hbhntt.exe 2324 bnbhbb.exe 1432 pjvpp.exe 2540 jpdvd.exe 2680 9xrxlfr.exe 1344 hthhnn.exe 1748 jdpvp.exe 2904 ppdvv.exe 2112 rfxfffl.exe 2088 frlxlfl.exe 2672 thhbbt.exe 804 btnhnn.exe 604 7vjdj.exe 1488 vpdjp.exe -
resource yara_rule behavioral1/memory/2760-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/832-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1168-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/404-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2760 wrote to memory of 2148 2760 6a05a2ce027efc00c6481e718628dde0_NeikiAnalytics.exe 28 PID 2760 wrote to memory of 2148 2760 6a05a2ce027efc00c6481e718628dde0_NeikiAnalytics.exe 28 PID 2760 wrote to memory of 2148 2760 6a05a2ce027efc00c6481e718628dde0_NeikiAnalytics.exe 28 PID 2760 wrote to memory of 2148 2760 6a05a2ce027efc00c6481e718628dde0_NeikiAnalytics.exe 28 PID 2148 wrote to memory of 2532 2148 hbtnhn.exe 29 PID 2148 wrote to memory of 2532 2148 hbtnhn.exe 29 PID 2148 wrote to memory of 2532 2148 hbtnhn.exe 29 PID 2148 wrote to memory of 2532 2148 hbtnhn.exe 29 PID 2532 wrote to memory of 2588 2532 ddvdp.exe 30 PID 2532 wrote to memory of 2588 2532 ddvdp.exe 30 PID 2532 wrote to memory of 2588 2532 ddvdp.exe 30 PID 2532 wrote to memory of 2588 2532 ddvdp.exe 30 PID 2588 wrote to memory of 2580 2588 rlxfllr.exe 31 PID 2588 wrote to memory of 2580 2588 rlxfllr.exe 31 PID 2588 wrote to memory of 2580 2588 rlxfllr.exe 31 PID 2588 wrote to memory of 2580 2588 rlxfllr.exe 31 PID 2580 wrote to memory of 2624 2580 nthbhb.exe 32 PID 2580 wrote to memory of 2624 2580 nthbhb.exe 32 PID 2580 wrote to memory of 2624 2580 nthbhb.exe 32 PID 2580 wrote to memory of 2624 2580 nthbhb.exe 32 PID 2624 wrote to memory of 2576 2624 pvppv.exe 33 PID 2624 wrote to memory of 2576 2624 pvppv.exe 33 PID 2624 wrote to memory of 2576 2624 pvppv.exe 33 PID 2624 wrote to memory of 2576 2624 pvppv.exe 33 PID 2576 wrote to memory of 2444 2576 ffrlxfr.exe 34 PID 2576 wrote to memory of 2444 2576 ffrlxfr.exe 34 PID 2576 wrote to memory of 2444 2576 ffrlxfr.exe 34 PID 2576 wrote to memory of 2444 2576 ffrlxfr.exe 34 PID 2444 wrote to memory of 1648 2444 rrxrfrx.exe 35 PID 2444 wrote to memory of 1648 2444 rrxrfrx.exe 35 PID 2444 wrote to memory of 1648 2444 rrxrfrx.exe 35 PID 2444 wrote to memory of 1648 2444 rrxrfrx.exe 35 PID 1648 wrote to memory of 2992 1648 5thnbh.exe 36 PID 1648 wrote to memory of 2992 1648 5thnbh.exe 36 PID 1648 wrote to memory of 2992 1648 5thnbh.exe 36 PID 1648 wrote to memory of 2992 1648 5thnbh.exe 36 PID 2992 wrote to memory of 2856 2992 jjdjv.exe 37 PID 2992 wrote to memory of 2856 2992 jjdjv.exe 37 PID 2992 wrote to memory of 2856 2992 jjdjv.exe 37 PID 2992 wrote to memory of 2856 2992 jjdjv.exe 37 PID 2856 wrote to memory of 2860 2856 5pddj.exe 38 PID 2856 wrote to memory of 2860 2856 5pddj.exe 38 PID 2856 wrote to memory of 2860 2856 5pddj.exe 38 PID 2856 wrote to memory of 2860 2856 5pddj.exe 38 PID 2860 wrote to memory of 2428 2860 rxxxxfx.exe 39 PID 2860 wrote to memory of 2428 2860 rxxxxfx.exe 39 PID 2860 wrote to memory of 2428 2860 rxxxxfx.exe 39 PID 2860 wrote to memory of 2428 2860 rxxxxfx.exe 39 PID 2428 wrote to memory of 1788 2428 nnhnhn.exe 40 PID 2428 wrote to memory of 1788 2428 nnhnhn.exe 40 PID 2428 wrote to memory of 1788 2428 nnhnhn.exe 40 PID 2428 wrote to memory of 1788 2428 nnhnhn.exe 40 PID 1788 wrote to memory of 1640 1788 5nbbhn.exe 41 PID 1788 wrote to memory of 1640 1788 5nbbhn.exe 41 PID 1788 wrote to memory of 1640 1788 5nbbhn.exe 41 PID 1788 wrote to memory of 1640 1788 5nbbhn.exe 41 PID 1640 wrote to memory of 832 1640 pjvdp.exe 42 PID 1640 wrote to memory of 832 1640 pjvdp.exe 42 PID 1640 wrote to memory of 832 1640 pjvdp.exe 42 PID 1640 wrote to memory of 832 1640 pjvdp.exe 42 PID 832 wrote to memory of 3028 832 jvjjp.exe 43 PID 832 wrote to memory of 3028 832 jvjjp.exe 43 PID 832 wrote to memory of 3028 832 jvjjp.exe 43 PID 832 wrote to memory of 3028 832 jvjjp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a05a2ce027efc00c6481e718628dde0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6a05a2ce027efc00c6481e718628dde0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\hbtnhn.exec:\hbtnhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\ddvdp.exec:\ddvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\rlxfllr.exec:\rlxfllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\nthbhb.exec:\nthbhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\pvppv.exec:\pvppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\ffrlxfr.exec:\ffrlxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\rrxrfrx.exec:\rrxrfrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\5thnbh.exec:\5thnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\jjdjv.exec:\jjdjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\5pddj.exec:\5pddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\rxxxxfx.exec:\rxxxxfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\nnhnhn.exec:\nnhnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\5nbbhn.exec:\5nbbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\pjvdp.exec:\pjvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\jvjjp.exec:\jvjjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\rlxxrlf.exec:\rlxxrlf.exe17⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lfrrflx.exec:\lfrrflx.exe18⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hbthth.exec:\hbthth.exe19⤵
- Executes dropped EXE
PID:1604 -
\??\c:\nhbhnn.exec:\nhbhnn.exe20⤵
- Executes dropped EXE
PID:1808 -
\??\c:\dvjpj.exec:\dvjpj.exe21⤵
- Executes dropped EXE
PID:2912 -
\??\c:\fxrxxfx.exec:\fxrxxfx.exe22⤵
- Executes dropped EXE
PID:2672 -
\??\c:\xxrrlrf.exec:\xxrrlrf.exe23⤵
- Executes dropped EXE
PID:324 -
\??\c:\hbhntn.exec:\hbhntn.exe24⤵
- Executes dropped EXE
PID:1168 -
\??\c:\7hbhhh.exec:\7hbhhh.exe25⤵
- Executes dropped EXE
PID:1828 -
\??\c:\vvpvj.exec:\vvpvj.exe26⤵
- Executes dropped EXE
PID:2408 -
\??\c:\9xflllr.exec:\9xflllr.exe27⤵
- Executes dropped EXE
PID:292 -
\??\c:\fxrfrxf.exec:\fxrfrxf.exe28⤵
- Executes dropped EXE
PID:2316 -
\??\c:\3thntb.exec:\3thntb.exe29⤵
- Executes dropped EXE
PID:2212 -
\??\c:\vvjjp.exec:\vvjjp.exe30⤵
- Executes dropped EXE
PID:404 -
\??\c:\1pjpd.exec:\1pjpd.exe31⤵
- Executes dropped EXE
PID:2264 -
\??\c:\1ffflrf.exec:\1ffflrf.exe32⤵
- Executes dropped EXE
PID:1792 -
\??\c:\5tnhtb.exec:\5tnhtb.exe33⤵
- Executes dropped EXE
PID:328 -
\??\c:\nhnnnt.exec:\nhnnnt.exe34⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vpjpv.exec:\vpjpv.exe35⤵
- Executes dropped EXE
PID:2132 -
\??\c:\1dvjp.exec:\1dvjp.exe36⤵
- Executes dropped EXE
PID:1612 -
\??\c:\jvjjp.exec:\jvjjp.exe37⤵
- Executes dropped EXE
PID:2252 -
\??\c:\rlfflrf.exec:\rlfflrf.exe38⤵
- Executes dropped EXE
PID:2644 -
\??\c:\3hbbbb.exec:\3hbbbb.exe39⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hbhtnt.exec:\hbhtnt.exe40⤵
- Executes dropped EXE
PID:2596 -
\??\c:\5htnbt.exec:\5htnbt.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\3dppp.exec:\3dppp.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\jvdvd.exec:\jvdvd.exe43⤵
- Executes dropped EXE
PID:2440 -
\??\c:\9xfxfxr.exec:\9xfxfxr.exe44⤵
- Executes dropped EXE
PID:2512 -
\??\c:\lffflrr.exec:\lffflrr.exe45⤵
- Executes dropped EXE
PID:1736 -
\??\c:\btntbn.exec:\btntbn.exe46⤵
- Executes dropped EXE
PID:2320 -
\??\c:\tbnhbb.exec:\tbnhbb.exe47⤵
- Executes dropped EXE
PID:2992 -
\??\c:\pvdpd.exec:\pvdpd.exe48⤵
- Executes dropped EXE
PID:2852 -
\??\c:\pdvvd.exec:\pdvvd.exe49⤵
- Executes dropped EXE
PID:2968 -
\??\c:\5xxlrrx.exec:\5xxlrrx.exe50⤵
- Executes dropped EXE
PID:2700 -
\??\c:\9xlxxfl.exec:\9xlxxfl.exe51⤵
- Executes dropped EXE
PID:1588 -
\??\c:\hbhntt.exec:\hbhntt.exe52⤵
- Executes dropped EXE
PID:1788 -
\??\c:\bnbhbb.exec:\bnbhbb.exe53⤵
- Executes dropped EXE
PID:2324 -
\??\c:\pjvpp.exec:\pjvpp.exe54⤵
- Executes dropped EXE
PID:1432 -
\??\c:\jpdvd.exec:\jpdvd.exe55⤵
- Executes dropped EXE
PID:2540 -
\??\c:\9xrxlfr.exec:\9xrxlfr.exe56⤵
- Executes dropped EXE
PID:2680 -
\??\c:\hthhnn.exec:\hthhnn.exe57⤵
- Executes dropped EXE
PID:1344 -
\??\c:\jdpvp.exec:\jdpvp.exe58⤵
- Executes dropped EXE
PID:1748 -
\??\c:\ppdvv.exec:\ppdvv.exe59⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rfxfffl.exec:\rfxfffl.exe60⤵
- Executes dropped EXE
PID:2112 -
\??\c:\frlxlfl.exec:\frlxlfl.exe61⤵
- Executes dropped EXE
PID:2088 -
\??\c:\thhbbt.exec:\thhbbt.exe62⤵
- Executes dropped EXE
PID:2672 -
\??\c:\btnhnn.exec:\btnhnn.exe63⤵
- Executes dropped EXE
PID:804 -
\??\c:\7vjdj.exec:\7vjdj.exe64⤵
- Executes dropped EXE
PID:604 -
\??\c:\vpdjp.exec:\vpdjp.exe65⤵
- Executes dropped EXE
PID:1488 -
\??\c:\rxxrxlf.exec:\rxxrxlf.exe66⤵PID:1884
-
\??\c:\rrlxflr.exec:\rrlxflr.exe67⤵PID:1028
-
\??\c:\nhbnnb.exec:\nhbnnb.exe68⤵PID:292
-
\??\c:\hbtbbn.exec:\hbtbbn.exe69⤵PID:600
-
\??\c:\vjdjj.exec:\vjdjj.exe70⤵PID:888
-
\??\c:\lxrxxxf.exec:\lxrxxxf.exe71⤵PID:1668
-
\??\c:\9xllrlr.exec:\9xllrlr.exe72⤵PID:572
-
\??\c:\bthhnh.exec:\bthhnh.exe73⤵PID:2396
-
\??\c:\9tbbnh.exec:\9tbbnh.exe74⤵PID:1792
-
\??\c:\jdjdj.exec:\jdjdj.exe75⤵PID:2760
-
\??\c:\7pddd.exec:\7pddd.exe76⤵PID:1868
-
\??\c:\pjvdd.exec:\pjvdd.exe77⤵PID:1616
-
\??\c:\rlxflrf.exec:\rlxflrf.exe78⤵PID:1720
-
\??\c:\rlfflfl.exec:\rlfflfl.exe79⤵PID:1612
-
\??\c:\hnnhtn.exec:\hnnhtn.exe80⤵PID:2632
-
\??\c:\nbnntb.exec:\nbnntb.exe81⤵PID:2572
-
\??\c:\ddvdd.exec:\ddvdd.exe82⤵PID:2564
-
\??\c:\vpvvd.exec:\vpvvd.exe83⤵PID:2596
-
\??\c:\vdvjj.exec:\vdvjj.exe84⤵PID:2492
-
\??\c:\rlxfffr.exec:\rlxfffr.exe85⤵PID:2576
-
\??\c:\hbnnbb.exec:\hbnnbb.exe86⤵PID:2984
-
\??\c:\nhnntt.exec:\nhnntt.exe87⤵PID:2400
-
\??\c:\dpppd.exec:\dpppd.exe88⤵PID:1648
-
\??\c:\jvpdv.exec:\jvpdv.exe89⤵PID:2796
-
\??\c:\5vjvv.exec:\5vjvv.exe90⤵PID:2992
-
\??\c:\lfrxrrx.exec:\lfrxrrx.exe91⤵PID:1896
-
\??\c:\xlrxxxf.exec:\xlrxxxf.exe92⤵PID:2332
-
\??\c:\btnntb.exec:\btnntb.exe93⤵PID:2508
-
\??\c:\5nbnhb.exec:\5nbnhb.exe94⤵PID:1632
-
\??\c:\5jddj.exec:\5jddj.exe95⤵PID:2616
-
\??\c:\9vppv.exec:\9vppv.exe96⤵PID:2160
-
\??\c:\rlxlxfx.exec:\rlxlxfx.exe97⤵PID:3024
-
\??\c:\lrrllll.exec:\lrrllll.exe98⤵PID:1532
-
\??\c:\nhnhnh.exec:\nhnhnh.exe99⤵PID:2108
-
\??\c:\nhntbt.exec:\nhntbt.exe100⤵PID:3040
-
\??\c:\dvjdv.exec:\dvjdv.exe101⤵PID:2688
-
\??\c:\vpddj.exec:\vpddj.exe102⤵PID:2900
-
\??\c:\pdvpv.exec:\pdvpv.exe103⤵PID:608
-
\??\c:\rfxxffr.exec:\rfxxffr.exe104⤵PID:956
-
\??\c:\xrlfxlx.exec:\xrlfxlx.exe105⤵PID:576
-
\??\c:\7bhnbn.exec:\7bhnbn.exe106⤵PID:1168
-
\??\c:\nbntbb.exec:\nbntbb.exe107⤵PID:452
-
\??\c:\1vppp.exec:\1vppp.exe108⤵PID:2408
-
\??\c:\jdddd.exec:\jdddd.exe109⤵PID:1716
-
\??\c:\pjdvv.exec:\pjdvv.exe110⤵PID:2064
-
\??\c:\frlflff.exec:\frlflff.exe111⤵PID:972
-
\??\c:\xrffxff.exec:\xrffxff.exe112⤵PID:2928
-
\??\c:\7htbhh.exec:\7htbhh.exe113⤵PID:2240
-
\??\c:\nhhntn.exec:\nhhntn.exe114⤵PID:1004
-
\??\c:\jdppv.exec:\jdppv.exe115⤵PID:2012
-
\??\c:\jdvjj.exec:\jdvjj.exe116⤵PID:2144
-
\??\c:\9dpvd.exec:\9dpvd.exe117⤵PID:328
-
\??\c:\3rfxxfl.exec:\3rfxxfl.exe118⤵PID:1336
-
\??\c:\xlxfffx.exec:\xlxfffx.exe119⤵PID:1256
-
\??\c:\bthhhh.exec:\bthhhh.exe120⤵PID:2276
-
\??\c:\bnthbb.exec:\bnthbb.exe121⤵PID:2656
-
\??\c:\dvjdj.exec:\dvjdj.exe122⤵PID:2592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-