Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 01:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6b0285e52aed5874b68f0e3f1b6385d0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
6b0285e52aed5874b68f0e3f1b6385d0_NeikiAnalytics.exe
-
Size
54KB
-
MD5
6b0285e52aed5874b68f0e3f1b6385d0
-
SHA1
3f146da5132d476f644518ca0a45380e712e4608
-
SHA256
2fbdf44a3ee3ff8d9c2367e2e09fe797283bc7f5531b40c15467b45615bb9b28
-
SHA512
a219e3d1c7aa81692170556ea5b1f15e61571b6124b1bb29c67a2d03a27d7d64c72ce21f27253df620e21eab7e1847467c76ecd551824157623c1f5592037a41
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI57Bd:ymb3NkkiQ3mdBjFIVBd
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/960-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1340-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1312-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/904-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1788-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/808-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1876-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2804-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1724 rrrffxx.exe 2496 fxffflf.exe 1340 hhnntt.exe 1600 7jjjp.exe 1312 5djjd.exe 904 lffxrlx.exe 1608 thbbtn.exe 3108 nhhhtt.exe 5084 pppjd.exe 2344 1rrxrrf.exe 2080 bnttbh.exe 2516 btbhhh.exe 1788 jvdjj.exe 808 lrrrrll.exe 4904 htnhnn.exe 4760 vpjdv.exe 1876 jjdjd.exe 1032 lflfrrl.exe 3632 nbhbtb.exe 3752 3nnhtb.exe 2376 ddpjj.exe 1860 djdvd.exe 2804 lfffrll.exe 3116 tbhbtn.exe 2260 3hnnhh.exe 1664 nnnnhh.exe 2200 vvdvv.exe 4952 rlrlfxr.exe 4892 3rfxrrl.exe 3684 9bbtnh.exe 2012 5jpdd.exe 4776 thnttt.exe 64 bnttnn.exe 1180 ppjpj.exe 1376 rllfffx.exe 4072 flfflll.exe 1864 httnnb.exe 4064 tntttt.exe 3608 ddvvv.exe 5096 pvvvv.exe 4692 rxlrxff.exe 3308 1hnnhh.exe 960 thbbtt.exe 4304 3jjdp.exe 4360 frflrfx.exe 2180 lxxrlxr.exe 1460 hbbtnn.exe 452 pvpjv.exe 2112 jddpd.exe 3240 fxffxfl.exe 4700 thnnhh.exe 2612 nbhhhn.exe 2344 ppvdj.exe 1604 jjvvd.exe 4732 lxrrlrr.exe 3840 5rfllrx.exe 4564 hbtnnn.exe 4864 tnthht.exe 3620 jjpvp.exe 4568 jjjjj.exe 2500 3lffllx.exe 2272 7hnnhh.exe 1876 lrlxlxl.exe 4724 fxfxfrx.exe -
resource yara_rule behavioral2/memory/960-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1340-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1312-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/904-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/808-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1876-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2804-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-179-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 960 wrote to memory of 1724 960 6b0285e52aed5874b68f0e3f1b6385d0_NeikiAnalytics.exe 82 PID 960 wrote to memory of 1724 960 6b0285e52aed5874b68f0e3f1b6385d0_NeikiAnalytics.exe 82 PID 960 wrote to memory of 1724 960 6b0285e52aed5874b68f0e3f1b6385d0_NeikiAnalytics.exe 82 PID 1724 wrote to memory of 2496 1724 rrrffxx.exe 83 PID 1724 wrote to memory of 2496 1724 rrrffxx.exe 83 PID 1724 wrote to memory of 2496 1724 rrrffxx.exe 83 PID 2496 wrote to memory of 1340 2496 fxffflf.exe 84 PID 2496 wrote to memory of 1340 2496 fxffflf.exe 84 PID 2496 wrote to memory of 1340 2496 fxffflf.exe 84 PID 1340 wrote to memory of 1600 1340 hhnntt.exe 85 PID 1340 wrote to memory of 1600 1340 hhnntt.exe 85 PID 1340 wrote to memory of 1600 1340 hhnntt.exe 85 PID 1600 wrote to memory of 1312 1600 7jjjp.exe 86 PID 1600 wrote to memory of 1312 1600 7jjjp.exe 86 PID 1600 wrote to memory of 1312 1600 7jjjp.exe 86 PID 1312 wrote to memory of 904 1312 5djjd.exe 87 PID 1312 wrote to memory of 904 1312 5djjd.exe 87 PID 1312 wrote to memory of 904 1312 5djjd.exe 87 PID 904 wrote to memory of 1608 904 lffxrlx.exe 88 PID 904 wrote to memory of 1608 904 lffxrlx.exe 88 PID 904 wrote to memory of 1608 904 lffxrlx.exe 88 PID 1608 wrote to memory of 3108 1608 thbbtn.exe 89 PID 1608 wrote to memory of 3108 1608 thbbtn.exe 89 PID 1608 wrote to memory of 3108 1608 thbbtn.exe 89 PID 3108 wrote to memory of 5084 3108 nhhhtt.exe 90 PID 3108 wrote to memory of 5084 3108 nhhhtt.exe 90 PID 3108 wrote to memory of 5084 3108 nhhhtt.exe 90 PID 5084 wrote to memory of 2344 5084 pppjd.exe 91 PID 5084 wrote to memory of 2344 5084 pppjd.exe 91 PID 5084 wrote to memory of 2344 5084 pppjd.exe 91 PID 2344 wrote to memory of 2080 2344 1rrxrrf.exe 92 PID 2344 wrote to memory of 2080 2344 1rrxrrf.exe 92 PID 2344 wrote to memory of 2080 2344 1rrxrrf.exe 92 PID 2080 wrote to memory of 2516 2080 bnttbh.exe 93 PID 2080 wrote to memory of 2516 2080 bnttbh.exe 93 PID 2080 wrote to memory of 2516 2080 bnttbh.exe 93 PID 2516 wrote to memory of 1788 2516 btbhhh.exe 94 PID 2516 wrote to memory of 1788 2516 btbhhh.exe 94 PID 2516 wrote to memory of 1788 2516 btbhhh.exe 94 PID 1788 wrote to memory of 808 1788 jvdjj.exe 95 PID 1788 wrote to memory of 808 1788 jvdjj.exe 95 PID 1788 wrote to memory of 808 1788 jvdjj.exe 95 PID 808 wrote to memory of 4904 808 lrrrrll.exe 96 PID 808 wrote to memory of 4904 808 lrrrrll.exe 96 PID 808 wrote to memory of 4904 808 lrrrrll.exe 96 PID 4904 wrote to memory of 4760 4904 htnhnn.exe 97 PID 4904 wrote to memory of 4760 4904 htnhnn.exe 97 PID 4904 wrote to memory of 4760 4904 htnhnn.exe 97 PID 4760 wrote to memory of 1876 4760 vpjdv.exe 98 PID 4760 wrote to memory of 1876 4760 vpjdv.exe 98 PID 4760 wrote to memory of 1876 4760 vpjdv.exe 98 PID 1876 wrote to memory of 1032 1876 jjdjd.exe 99 PID 1876 wrote to memory of 1032 1876 jjdjd.exe 99 PID 1876 wrote to memory of 1032 1876 jjdjd.exe 99 PID 1032 wrote to memory of 3632 1032 lflfrrl.exe 100 PID 1032 wrote to memory of 3632 1032 lflfrrl.exe 100 PID 1032 wrote to memory of 3632 1032 lflfrrl.exe 100 PID 3632 wrote to memory of 3752 3632 nbhbtb.exe 101 PID 3632 wrote to memory of 3752 3632 nbhbtb.exe 101 PID 3632 wrote to memory of 3752 3632 nbhbtb.exe 101 PID 3752 wrote to memory of 2376 3752 3nnhtb.exe 102 PID 3752 wrote to memory of 2376 3752 3nnhtb.exe 102 PID 3752 wrote to memory of 2376 3752 3nnhtb.exe 102 PID 2376 wrote to memory of 1860 2376 ddpjj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b0285e52aed5874b68f0e3f1b6385d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6b0285e52aed5874b68f0e3f1b6385d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\rrrffxx.exec:\rrrffxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\fxffflf.exec:\fxffflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\hhnntt.exec:\hhnntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\7jjjp.exec:\7jjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\5djjd.exec:\5djjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\lffxrlx.exec:\lffxrlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
\??\c:\thbbtn.exec:\thbbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\nhhhtt.exec:\nhhhtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\pppjd.exec:\pppjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\1rrxrrf.exec:\1rrxrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\bnttbh.exec:\bnttbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\btbhhh.exec:\btbhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\jvdjj.exec:\jvdjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\lrrrrll.exec:\lrrrrll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\htnhnn.exec:\htnhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\vpjdv.exec:\vpjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\jjdjd.exec:\jjdjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\lflfrrl.exec:\lflfrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\nbhbtb.exec:\nbhbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\3nnhtb.exec:\3nnhtb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\ddpjj.exec:\ddpjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\djdvd.exec:\djdvd.exe23⤵
- Executes dropped EXE
PID:1860 -
\??\c:\lfffrll.exec:\lfffrll.exe24⤵
- Executes dropped EXE
PID:2804 -
\??\c:\tbhbtn.exec:\tbhbtn.exe25⤵
- Executes dropped EXE
PID:3116 -
\??\c:\3hnnhh.exec:\3hnnhh.exe26⤵
- Executes dropped EXE
PID:2260 -
\??\c:\nnnnhh.exec:\nnnnhh.exe27⤵
- Executes dropped EXE
PID:1664 -
\??\c:\vvdvv.exec:\vvdvv.exe28⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rlrlfxr.exec:\rlrlfxr.exe29⤵
- Executes dropped EXE
PID:4952 -
\??\c:\3rfxrrl.exec:\3rfxrrl.exe30⤵
- Executes dropped EXE
PID:4892 -
\??\c:\9bbtnh.exec:\9bbtnh.exe31⤵
- Executes dropped EXE
PID:3684 -
\??\c:\5jpdd.exec:\5jpdd.exe32⤵
- Executes dropped EXE
PID:2012 -
\??\c:\thnttt.exec:\thnttt.exe33⤵
- Executes dropped EXE
PID:4776 -
\??\c:\bnttnn.exec:\bnttnn.exe34⤵
- Executes dropped EXE
PID:64 -
\??\c:\ppjpj.exec:\ppjpj.exe35⤵
- Executes dropped EXE
PID:1180 -
\??\c:\rllfffx.exec:\rllfffx.exe36⤵
- Executes dropped EXE
PID:1376 -
\??\c:\flfflll.exec:\flfflll.exe37⤵
- Executes dropped EXE
PID:4072 -
\??\c:\httnnb.exec:\httnnb.exe38⤵
- Executes dropped EXE
PID:1864 -
\??\c:\tntttt.exec:\tntttt.exe39⤵
- Executes dropped EXE
PID:4064 -
\??\c:\ddvvv.exec:\ddvvv.exe40⤵
- Executes dropped EXE
PID:3608 -
\??\c:\pvvvv.exec:\pvvvv.exe41⤵
- Executes dropped EXE
PID:5096 -
\??\c:\rxlrxff.exec:\rxlrxff.exe42⤵
- Executes dropped EXE
PID:4692 -
\??\c:\1hnnhh.exec:\1hnnhh.exe43⤵
- Executes dropped EXE
PID:3308 -
\??\c:\thbbtt.exec:\thbbtt.exe44⤵
- Executes dropped EXE
PID:960 -
\??\c:\3jjdp.exec:\3jjdp.exe45⤵
- Executes dropped EXE
PID:4304 -
\??\c:\frflrfx.exec:\frflrfx.exe46⤵
- Executes dropped EXE
PID:4360 -
\??\c:\lxxrlxr.exec:\lxxrlxr.exe47⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hbbtnn.exec:\hbbtnn.exe48⤵
- Executes dropped EXE
PID:1460 -
\??\c:\pvpjv.exec:\pvpjv.exe49⤵
- Executes dropped EXE
PID:452 -
\??\c:\jddpd.exec:\jddpd.exe50⤵
- Executes dropped EXE
PID:2112 -
\??\c:\fxffxfl.exec:\fxffxfl.exe51⤵
- Executes dropped EXE
PID:3240 -
\??\c:\thnnhh.exec:\thnnhh.exe52⤵
- Executes dropped EXE
PID:4700 -
\??\c:\nbhhhn.exec:\nbhhhn.exe53⤵
- Executes dropped EXE
PID:2612 -
\??\c:\ppvdj.exec:\ppvdj.exe54⤵
- Executes dropped EXE
PID:2344 -
\??\c:\jjvvd.exec:\jjvvd.exe55⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lxrrlrr.exec:\lxrrlrr.exe56⤵
- Executes dropped EXE
PID:4732 -
\??\c:\5rfllrx.exec:\5rfllrx.exe57⤵
- Executes dropped EXE
PID:3840 -
\??\c:\hbtnnn.exec:\hbtnnn.exe58⤵
- Executes dropped EXE
PID:4564 -
\??\c:\tnthht.exec:\tnthht.exe59⤵
- Executes dropped EXE
PID:4864 -
\??\c:\jjpvp.exec:\jjpvp.exe60⤵
- Executes dropped EXE
PID:3620 -
\??\c:\jjjjj.exec:\jjjjj.exe61⤵
- Executes dropped EXE
PID:4568 -
\??\c:\3lffllx.exec:\3lffllx.exe62⤵
- Executes dropped EXE
PID:2500 -
\??\c:\7hnnhh.exec:\7hnnhh.exe63⤵
- Executes dropped EXE
PID:2272 -
\??\c:\lrlxlxl.exec:\lrlxlxl.exe64⤵
- Executes dropped EXE
PID:1876 -
\??\c:\fxfxfrx.exec:\fxfxfrx.exe65⤵
- Executes dropped EXE
PID:4724 -
\??\c:\bbttbh.exec:\bbttbh.exe66⤵PID:4856
-
\??\c:\dpvpj.exec:\dpvpj.exe67⤵PID:4536
-
\??\c:\3vjjp.exec:\3vjjp.exe68⤵PID:2376
-
\??\c:\rlllfff.exec:\rlllfff.exe69⤵PID:2444
-
\??\c:\lrfrffr.exec:\lrfrffr.exe70⤵PID:3360
-
\??\c:\7ntnbt.exec:\7ntnbt.exe71⤵PID:512
-
\??\c:\ppvvp.exec:\ppvvp.exe72⤵PID:2944
-
\??\c:\pjvpj.exec:\pjvpj.exe73⤵PID:2244
-
\??\c:\flrrrlf.exec:\flrrrlf.exe74⤵PID:1152
-
\??\c:\thhbtt.exec:\thhbtt.exe75⤵PID:1236
-
\??\c:\dpvjj.exec:\dpvjj.exe76⤵PID:3184
-
\??\c:\pvddd.exec:\pvddd.exe77⤵PID:4056
-
\??\c:\7xrlffl.exec:\7xrlffl.exe78⤵PID:2892
-
\??\c:\5hbbtt.exec:\5hbbtt.exe79⤵PID:3684
-
\??\c:\hnthbb.exec:\hnthbb.exe80⤵PID:540
-
\??\c:\jjdpp.exec:\jjdpp.exe81⤵PID:2096
-
\??\c:\ffllfxx.exec:\ffllfxx.exe82⤵PID:4088
-
\??\c:\rlfllrr.exec:\rlfllrr.exe83⤵PID:4912
-
\??\c:\nhhbbb.exec:\nhhbbb.exe84⤵PID:4388
-
\??\c:\jdvpj.exec:\jdvpj.exe85⤵PID:3272
-
\??\c:\dvdvj.exec:\dvdvj.exe86⤵PID:2368
-
\??\c:\rlffxrl.exec:\rlffxrl.exe87⤵PID:4632
-
\??\c:\xrxrlrl.exec:\xrxrlrl.exe88⤵PID:4692
-
\??\c:\htbhbb.exec:\htbhbb.exe89⤵PID:3308
-
\??\c:\9bhhtt.exec:\9bhhtt.exe90⤵PID:2360
-
\??\c:\vpppj.exec:\vpppj.exe91⤵PID:3692
-
\??\c:\jvppp.exec:\jvppp.exe92⤵PID:556
-
\??\c:\frrlllf.exec:\frrlllf.exe93⤵PID:3580
-
\??\c:\lxlfrrl.exec:\lxlfrrl.exe94⤵PID:628
-
\??\c:\nhtbbh.exec:\nhtbbh.exe95⤵PID:1620
-
\??\c:\hbhtbb.exec:\hbhtbb.exe96⤵PID:2112
-
\??\c:\jppjd.exec:\jppjd.exe97⤵PID:3240
-
\??\c:\jpddv.exec:\jpddv.exe98⤵PID:2540
-
\??\c:\rrxxllx.exec:\rrxxllx.exe99⤵PID:2584
-
\??\c:\bhhbtt.exec:\bhhbtt.exe100⤵PID:1372
-
\??\c:\nhnbhh.exec:\nhnbhh.exe101⤵PID:5072
-
\??\c:\pvddd.exec:\pvddd.exe102⤵PID:3136
-
\??\c:\1rxrfff.exec:\1rxrfff.exe103⤵PID:1788
-
\??\c:\5rrxrrl.exec:\5rrxrrl.exe104⤵PID:3860
-
\??\c:\ppjjd.exec:\ppjjd.exe105⤵PID:3960
-
\??\c:\lfxrflr.exec:\lfxrflr.exe106⤵PID:3804
-
\??\c:\3xffxrr.exec:\3xffxrr.exe107⤵PID:4760
-
\??\c:\htbntt.exec:\htbntt.exe108⤵PID:3852
-
\??\c:\tbttnn.exec:\tbttnn.exe109⤵PID:3708
-
\??\c:\jvdvv.exec:\jvdvv.exe110⤵PID:4808
-
\??\c:\dddpd.exec:\dddpd.exe111⤵PID:1876
-
\??\c:\rflfxxx.exec:\rflfxxx.exe112⤵PID:440
-
\??\c:\nnhhbt.exec:\nnhhbt.exe113⤵PID:4856
-
\??\c:\7nbbnn.exec:\7nbbnn.exe114⤵PID:4536
-
\??\c:\tnhbth.exec:\tnhbth.exe115⤵PID:2468
-
\??\c:\vvdvj.exec:\vvdvj.exe116⤵PID:2444
-
\??\c:\xrxxfff.exec:\xrxxfff.exe117⤵PID:3360
-
\??\c:\fxrfxxx.exec:\fxrfxxx.exe118⤵PID:512
-
\??\c:\nnttbb.exec:\nnttbb.exe119⤵PID:1628
-
\??\c:\pppdv.exec:\pppdv.exe120⤵PID:2196
-
\??\c:\xlllllr.exec:\xlllllr.exe121⤵PID:2128
-
\??\c:\3fllfff.exec:\3fllfff.exe122⤵PID:4952
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-