Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 02:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
83e840db3223e5aa7b0089816fc74480_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
83e840db3223e5aa7b0089816fc74480_NeikiAnalytics.exe
-
Size
386KB
-
MD5
83e840db3223e5aa7b0089816fc74480
-
SHA1
edfcb069026a516204028bdc19a914d136ea890c
-
SHA256
9d8e91850acc745386ad1e33f9c341930df95a8102dff1bb93526fc59414c17a
-
SHA512
76e7f44e6b3e7599fb853caca9e2ec129ce94a5184714ff142f0fdfea7a21ad799ca9a06f9e1b5af9b12ce54e8680b5edb55015a8db7fe47a23b9e843b80f76e
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwthmx:n3C9uYA7okVqdKwaO5CVMhmx
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/1924-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1392-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1132-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/376-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2708 nhthnn.exe 2964 1jjvj.exe 2664 vvdjv.exe 2520 jdvvj.exe 2816 fxrxlrf.exe 2440 bbtbnt.exe 2456 jvjvp.exe 2112 ffrrxxf.exe 2656 1htnhn.exe 2744 1dvdj.exe 2632 7htbnn.exe 1840 ddppd.exe 1784 vpddp.exe 1544 lxrxrrf.exe 2788 nhbhtt.exe 2304 jdvvp.exe 2020 flfrxxr.exe 1340 5thnhn.exe 1896 3dpvj.exe 1608 ffxllrf.exe 592 btnhth.exe 1392 1jdjp.exe 2784 fxrrfxl.exe 1132 hbtbbh.exe 1872 vpvvj.exe 376 tthhbt.exe 916 1vjjv.exe 2252 lxrxllr.exe 1908 hbbhnn.exe 3048 pvvjj.exe 1412 9xrllrl.exe 996 7tthnb.exe 1520 dvjpv.exe 1724 9fxlrxf.exe 3024 thttbn.exe 2596 5htbhn.exe 2544 vjvdd.exe 2700 xxllxxl.exe 2416 nhnntt.exe 2816 tnbhnn.exe 2524 vjvvd.exe 2152 dvjvd.exe 2464 7frxrrx.exe 2444 tnbhnt.exe 2660 3bntbb.exe 2740 pdppd.exe 2568 rflrxxl.exe 1548 ffxxlrf.exe 1836 bttbbh.exe 340 1pvvj.exe 856 dvjjv.exe 1544 xrflxxr.exe 2788 hthnbb.exe 1108 dvpvj.exe 2488 1dpdj.exe 2876 xrrfflf.exe 1340 xxxfrxr.exe 2184 tnnnbb.exe 2188 3jppp.exe 1052 pjpvd.exe 1384 5fflfrf.exe 1392 1xfxflx.exe 1904 5tnnbh.exe 2076 vvvjj.exe -
resource yara_rule behavioral1/memory/1924-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1840-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1392-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1132-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/376-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-283-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2708 1924 83e840db3223e5aa7b0089816fc74480_NeikiAnalytics.exe 28 PID 1924 wrote to memory of 2708 1924 83e840db3223e5aa7b0089816fc74480_NeikiAnalytics.exe 28 PID 1924 wrote to memory of 2708 1924 83e840db3223e5aa7b0089816fc74480_NeikiAnalytics.exe 28 PID 1924 wrote to memory of 2708 1924 83e840db3223e5aa7b0089816fc74480_NeikiAnalytics.exe 28 PID 2708 wrote to memory of 2964 2708 nhthnn.exe 29 PID 2708 wrote to memory of 2964 2708 nhthnn.exe 29 PID 2708 wrote to memory of 2964 2708 nhthnn.exe 29 PID 2708 wrote to memory of 2964 2708 nhthnn.exe 29 PID 2964 wrote to memory of 2664 2964 1jjvj.exe 30 PID 2964 wrote to memory of 2664 2964 1jjvj.exe 30 PID 2964 wrote to memory of 2664 2964 1jjvj.exe 30 PID 2964 wrote to memory of 2664 2964 1jjvj.exe 30 PID 2664 wrote to memory of 2520 2664 vvdjv.exe 31 PID 2664 wrote to memory of 2520 2664 vvdjv.exe 31 PID 2664 wrote to memory of 2520 2664 vvdjv.exe 31 PID 2664 wrote to memory of 2520 2664 vvdjv.exe 31 PID 2520 wrote to memory of 2816 2520 jdvvj.exe 32 PID 2520 wrote to memory of 2816 2520 jdvvj.exe 32 PID 2520 wrote to memory of 2816 2520 jdvvj.exe 32 PID 2520 wrote to memory of 2816 2520 jdvvj.exe 32 PID 2816 wrote to memory of 2440 2816 fxrxlrf.exe 33 PID 2816 wrote to memory of 2440 2816 fxrxlrf.exe 33 PID 2816 wrote to memory of 2440 2816 fxrxlrf.exe 33 PID 2816 wrote to memory of 2440 2816 fxrxlrf.exe 33 PID 2440 wrote to memory of 2456 2440 bbtbnt.exe 34 PID 2440 wrote to memory of 2456 2440 bbtbnt.exe 34 PID 2440 wrote to memory of 2456 2440 bbtbnt.exe 34 PID 2440 wrote to memory of 2456 2440 bbtbnt.exe 34 PID 2456 wrote to memory of 2112 2456 jvjvp.exe 35 PID 2456 wrote to memory of 2112 2456 jvjvp.exe 35 PID 2456 wrote to memory of 2112 2456 jvjvp.exe 35 PID 2456 wrote to memory of 2112 2456 jvjvp.exe 35 PID 2112 wrote to memory of 2656 2112 ffrrxxf.exe 36 PID 2112 wrote to memory of 2656 2112 ffrrxxf.exe 36 PID 2112 wrote to memory of 2656 2112 ffrrxxf.exe 36 PID 2112 wrote to memory of 2656 2112 ffrrxxf.exe 36 PID 2656 wrote to memory of 2744 2656 1htnhn.exe 37 PID 2656 wrote to memory of 2744 2656 1htnhn.exe 37 PID 2656 wrote to memory of 2744 2656 1htnhn.exe 37 PID 2656 wrote to memory of 2744 2656 1htnhn.exe 37 PID 2744 wrote to memory of 2632 2744 1dvdj.exe 38 PID 2744 wrote to memory of 2632 2744 1dvdj.exe 38 PID 2744 wrote to memory of 2632 2744 1dvdj.exe 38 PID 2744 wrote to memory of 2632 2744 1dvdj.exe 38 PID 2632 wrote to memory of 1840 2632 7htbnn.exe 39 PID 2632 wrote to memory of 1840 2632 7htbnn.exe 39 PID 2632 wrote to memory of 1840 2632 7htbnn.exe 39 PID 2632 wrote to memory of 1840 2632 7htbnn.exe 39 PID 1840 wrote to memory of 1784 1840 ddppd.exe 40 PID 1840 wrote to memory of 1784 1840 ddppd.exe 40 PID 1840 wrote to memory of 1784 1840 ddppd.exe 40 PID 1840 wrote to memory of 1784 1840 ddppd.exe 40 PID 1784 wrote to memory of 1544 1784 vpddp.exe 41 PID 1784 wrote to memory of 1544 1784 vpddp.exe 41 PID 1784 wrote to memory of 1544 1784 vpddp.exe 41 PID 1784 wrote to memory of 1544 1784 vpddp.exe 41 PID 1544 wrote to memory of 2788 1544 lxrxrrf.exe 42 PID 1544 wrote to memory of 2788 1544 lxrxrrf.exe 42 PID 1544 wrote to memory of 2788 1544 lxrxrrf.exe 42 PID 1544 wrote to memory of 2788 1544 lxrxrrf.exe 42 PID 2788 wrote to memory of 2304 2788 nhbhtt.exe 43 PID 2788 wrote to memory of 2304 2788 nhbhtt.exe 43 PID 2788 wrote to memory of 2304 2788 nhbhtt.exe 43 PID 2788 wrote to memory of 2304 2788 nhbhtt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\83e840db3223e5aa7b0089816fc74480_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\83e840db3223e5aa7b0089816fc74480_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\nhthnn.exec:\nhthnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\1jjvj.exec:\1jjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\vvdjv.exec:\vvdjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\jdvvj.exec:\jdvvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\fxrxlrf.exec:\fxrxlrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\bbtbnt.exec:\bbtbnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\jvjvp.exec:\jvjvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\ffrrxxf.exec:\ffrrxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\1htnhn.exec:\1htnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\1dvdj.exec:\1dvdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\7htbnn.exec:\7htbnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\ddppd.exec:\ddppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\vpddp.exec:\vpddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\lxrxrrf.exec:\lxrxrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\nhbhtt.exec:\nhbhtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\jdvvp.exec:\jdvvp.exe17⤵
- Executes dropped EXE
PID:2304 -
\??\c:\flfrxxr.exec:\flfrxxr.exe18⤵
- Executes dropped EXE
PID:2020 -
\??\c:\5thnhn.exec:\5thnhn.exe19⤵
- Executes dropped EXE
PID:1340 -
\??\c:\3dpvj.exec:\3dpvj.exe20⤵
- Executes dropped EXE
PID:1896 -
\??\c:\ffxllrf.exec:\ffxllrf.exe21⤵
- Executes dropped EXE
PID:1608 -
\??\c:\btnhth.exec:\btnhth.exe22⤵
- Executes dropped EXE
PID:592 -
\??\c:\1jdjp.exec:\1jdjp.exe23⤵
- Executes dropped EXE
PID:1392 -
\??\c:\fxrrfxl.exec:\fxrrfxl.exe24⤵
- Executes dropped EXE
PID:2784 -
\??\c:\hbtbbh.exec:\hbtbbh.exe25⤵
- Executes dropped EXE
PID:1132 -
\??\c:\vpvvj.exec:\vpvvj.exe26⤵
- Executes dropped EXE
PID:1872 -
\??\c:\tthhbt.exec:\tthhbt.exe27⤵
- Executes dropped EXE
PID:376 -
\??\c:\1vjjv.exec:\1vjjv.exe28⤵
- Executes dropped EXE
PID:916 -
\??\c:\lxrxllr.exec:\lxrxllr.exe29⤵
- Executes dropped EXE
PID:2252 -
\??\c:\hbbhnn.exec:\hbbhnn.exe30⤵
- Executes dropped EXE
PID:1908 -
\??\c:\pvvjj.exec:\pvvjj.exe31⤵
- Executes dropped EXE
PID:3048 -
\??\c:\9xrllrl.exec:\9xrllrl.exe32⤵
- Executes dropped EXE
PID:1412 -
\??\c:\7tthnb.exec:\7tthnb.exe33⤵
- Executes dropped EXE
PID:996 -
\??\c:\dvjpv.exec:\dvjpv.exe34⤵
- Executes dropped EXE
PID:1520 -
\??\c:\9fxlrxf.exec:\9fxlrxf.exe35⤵
- Executes dropped EXE
PID:1724 -
\??\c:\thttbn.exec:\thttbn.exe36⤵
- Executes dropped EXE
PID:3024 -
\??\c:\5htbhn.exec:\5htbhn.exe37⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vjvdd.exec:\vjvdd.exe38⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xxllxxl.exec:\xxllxxl.exe39⤵
- Executes dropped EXE
PID:2700 -
\??\c:\nhnntt.exec:\nhnntt.exe40⤵
- Executes dropped EXE
PID:2416 -
\??\c:\tnbhnn.exec:\tnbhnn.exe41⤵
- Executes dropped EXE
PID:2816 -
\??\c:\vjvvd.exec:\vjvvd.exe42⤵
- Executes dropped EXE
PID:2524 -
\??\c:\dvjvd.exec:\dvjvd.exe43⤵
- Executes dropped EXE
PID:2152 -
\??\c:\7frxrrx.exec:\7frxrrx.exe44⤵
- Executes dropped EXE
PID:2464 -
\??\c:\tnbhnt.exec:\tnbhnt.exe45⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3bntbb.exec:\3bntbb.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pdppd.exec:\pdppd.exe47⤵
- Executes dropped EXE
PID:2740 -
\??\c:\rflrxxl.exec:\rflrxxl.exe48⤵
- Executes dropped EXE
PID:2568 -
\??\c:\ffxxlrf.exec:\ffxxlrf.exe49⤵
- Executes dropped EXE
PID:1548 -
\??\c:\bttbbh.exec:\bttbbh.exe50⤵
- Executes dropped EXE
PID:1836 -
\??\c:\1pvvj.exec:\1pvvj.exe51⤵
- Executes dropped EXE
PID:340 -
\??\c:\dvjjv.exec:\dvjjv.exe52⤵
- Executes dropped EXE
PID:856 -
\??\c:\xrflxxr.exec:\xrflxxr.exe53⤵
- Executes dropped EXE
PID:1544 -
\??\c:\hthnbb.exec:\hthnbb.exe54⤵
- Executes dropped EXE
PID:2788 -
\??\c:\dvpvj.exec:\dvpvj.exe55⤵
- Executes dropped EXE
PID:1108 -
\??\c:\1dpdj.exec:\1dpdj.exe56⤵
- Executes dropped EXE
PID:2488 -
\??\c:\xrrfflf.exec:\xrrfflf.exe57⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xxxfrxr.exec:\xxxfrxr.exe58⤵
- Executes dropped EXE
PID:1340 -
\??\c:\tnnnbb.exec:\tnnnbb.exe59⤵
- Executes dropped EXE
PID:2184 -
\??\c:\3jppp.exec:\3jppp.exe60⤵
- Executes dropped EXE
PID:2188 -
\??\c:\pjpvd.exec:\pjpvd.exe61⤵
- Executes dropped EXE
PID:1052 -
\??\c:\5fflfrf.exec:\5fflfrf.exe62⤵
- Executes dropped EXE
PID:1384 -
\??\c:\1xfxflx.exec:\1xfxflx.exe63⤵
- Executes dropped EXE
PID:1392 -
\??\c:\5tnnbh.exec:\5tnnbh.exe64⤵
- Executes dropped EXE
PID:1904 -
\??\c:\vvvjj.exec:\vvvjj.exe65⤵
- Executes dropped EXE
PID:2076 -
\??\c:\5vdjv.exec:\5vdjv.exe66⤵PID:1780
-
\??\c:\xrflrrf.exec:\xrflrrf.exe67⤵PID:1540
-
\??\c:\bbbhtb.exec:\bbbhtb.exe68⤵PID:376
-
\??\c:\bttnnb.exec:\bttnnb.exe69⤵PID:2256
-
\??\c:\vvpdp.exec:\vvpdp.exe70⤵PID:2132
-
\??\c:\fxrfrrf.exec:\fxrfrrf.exe71⤵PID:2308
-
\??\c:\lfxfllx.exec:\lfxfllx.exe72⤵PID:3008
-
\??\c:\hbtthh.exec:\hbtthh.exe73⤵PID:276
-
\??\c:\hbhnth.exec:\hbhnth.exe74⤵PID:1920
-
\??\c:\jdpvp.exec:\jdpvp.exe75⤵PID:2124
-
\??\c:\lfxfllx.exec:\lfxfllx.exe76⤵PID:2484
-
\??\c:\xrlfrrx.exec:\xrlfrrx.exe77⤵PID:2592
-
\??\c:\nnhtht.exec:\nnhtht.exe78⤵PID:2828
-
\??\c:\hthbbb.exec:\hthbbb.exe79⤵PID:2492
-
\??\c:\dpdjp.exec:\dpdjp.exe80⤵PID:3000
-
\??\c:\fxflxxl.exec:\fxflxxl.exe81⤵PID:2156
-
\??\c:\fxrflrx.exec:\fxrflrx.exe82⤵PID:2772
-
\??\c:\3ththb.exec:\3ththb.exe83⤵PID:2560
-
\??\c:\hbttbt.exec:\hbttbt.exe84⤵PID:2440
-
\??\c:\dvjjv.exec:\dvjjv.exe85⤵PID:2908
-
\??\c:\1rflxxl.exec:\1rflxxl.exe86⤵PID:2456
-
\??\c:\xlflxll.exec:\xlflxll.exe87⤵PID:2460
-
\??\c:\5nhhnn.exec:\5nhhnn.exe88⤵PID:2732
-
\??\c:\9nnnbh.exec:\9nnnbh.exe89⤵PID:1260
-
\??\c:\dvpvd.exec:\dvpvd.exe90⤵PID:1504
-
\??\c:\1rfxfrl.exec:\1rfxfrl.exe91⤵PID:2800
-
\??\c:\xrrrxxl.exec:\xrrrxxl.exe92⤵PID:1660
-
\??\c:\bhtnhn.exec:\bhtnhn.exe93⤵PID:1592
-
\??\c:\ppddd.exec:\ppddd.exe94⤵PID:852
-
\??\c:\vvpjp.exec:\vvpjp.exe95⤵PID:2452
-
\??\c:\frlrfrf.exec:\frlrfrf.exe96⤵PID:2164
-
\??\c:\3lxxrxl.exec:\3lxxrxl.exe97⤵PID:2032
-
\??\c:\tnbbtt.exec:\tnbbtt.exe98⤵PID:2336
-
\??\c:\pjvdp.exec:\pjvdp.exe99⤵PID:2092
-
\??\c:\rlflrrx.exec:\rlflrrx.exe100⤵PID:2212
-
\??\c:\3xrxffl.exec:\3xrxffl.exe101⤵PID:536
-
\??\c:\thbntt.exec:\thbntt.exe102⤵PID:324
-
\??\c:\dpdjv.exec:\dpdjv.exe103⤵PID:1564
-
\??\c:\vvpdj.exec:\vvpdj.exe104⤵PID:576
-
\??\c:\xlrxllf.exec:\xlrxllf.exe105⤵PID:2784
-
\??\c:\btnbhh.exec:\btnbhh.exe106⤵PID:884
-
\??\c:\htnnhn.exec:\htnnhn.exe107⤵PID:1292
-
\??\c:\9dvdj.exec:\9dvdj.exe108⤵PID:964
-
\??\c:\lxffrlr.exec:\lxffrlr.exe109⤵PID:3060
-
\??\c:\5rfxxfl.exec:\5rfxxfl.exe110⤵PID:916
-
\??\c:\bnbbnn.exec:\bnbbnn.exe111⤵PID:1224
-
\??\c:\5hbbbb.exec:\5hbbbb.exe112⤵PID:2832
-
\??\c:\jdjjp.exec:\jdjjp.exe113⤵PID:1468
-
\??\c:\xlxxffr.exec:\xlxxffr.exe114⤵PID:764
-
\??\c:\bbbhth.exec:\bbbhth.exe115⤵PID:2296
-
\??\c:\nnhtht.exec:\nnhtht.exe116⤵PID:1924
-
\??\c:\9jvvd.exec:\9jvvd.exe117⤵PID:2572
-
\??\c:\xlxrrxf.exec:\xlxrrxf.exe118⤵PID:2516
-
\??\c:\ffrxlrf.exec:\ffrxlrf.exe119⤵PID:2576
-
\??\c:\thbbhn.exec:\thbbhn.exe120⤵PID:2584
-
\??\c:\vpjvd.exec:\vpjvd.exe121⤵PID:1992
-
\??\c:\1jpvj.exec:\1jpvj.exe122⤵PID:2512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-