Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 10:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e5f84a35e927bed93650998a0f6493b0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e5f84a35e927bed93650998a0f6493b0_NeikiAnalytics.exe
-
Size
367KB
-
MD5
e5f84a35e927bed93650998a0f6493b0
-
SHA1
a0cdcff698e00f3648f386227c2d0dfbd933bcf3
-
SHA256
579f2d15b42b6f08fa0464da4ba705eb1415701fefd83f4ef4ab6eb5bb257d98
-
SHA512
085066558b8b0c5e5c120f8daabd932e29758484d9d2d6a1f49ddd86a9dac05521dacda352dcbe248eeec8a86bf853ce54a10cbb3db8a25fdb65a656e521954b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9FrHSwh/c/hdTWGIaxJ8TN005pWmjVwdSsyL:n3C9BRo7tvnJ9Fywhk/T7xyTpShZ6
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/3024-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1192-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1336-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/336-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/704-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2028 dpjdj.exe 2840 040608.exe 2548 i266828.exe 2664 486800.exe 2556 ttnntt.exe 2688 xrfxlxl.exe 2552 40402.exe 2500 nhtntt.exe 2480 u802840.exe 2408 2602846.exe 2980 k26006.exe 1792 820684.exe 1192 a0406.exe 2692 lxrrflr.exe 2800 q22822.exe 1336 28880.exe 1260 400066.exe 1760 4428402.exe 336 xrlrflf.exe 1968 22600.exe 2216 xxxfxfx.exe 704 6224022.exe 3040 vpdjv.exe 2200 g6286.exe 1080 1vddj.exe 1688 lxrrfll.exe 1944 8068620.exe 1752 6088402.exe 768 hhthnb.exe 2352 ntbnnb.exe 1440 7lfxxxx.exe 696 rrxfxrf.exe 2920 k68640.exe 804 5nbbtn.exe 2044 486802.exe 1572 2844486.exe 2304 hhbnbn.exe 2644 262284.exe 2632 06008.exe 2280 htnhbb.exe 2584 vjjdj.exe 2820 g6680.exe 2652 c802248.exe 2552 dvpvd.exe 2612 xxlffxx.exe 240 628266.exe 2824 vvjjd.exe 2996 826640.exe 2976 o640668.exe 2772 k60684.exe 628 fxlrflf.exe 2716 ntthnb.exe 2808 88248.exe 1952 rrfflrl.exe 1324 80224.exe 1240 fxrxrrr.exe 2056 3rrffrx.exe 1760 5tnhbn.exe 1816 s2626.exe 2092 g8006.exe 576 9htntt.exe 2216 886264.exe 812 480240.exe 1852 7xlfflr.exe -
resource yara_rule behavioral1/memory/3024-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2028-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1192-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1336-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/336-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2216-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/704-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-270-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2028 3024 e5f84a35e927bed93650998a0f6493b0_NeikiAnalytics.exe 28 PID 3024 wrote to memory of 2028 3024 e5f84a35e927bed93650998a0f6493b0_NeikiAnalytics.exe 28 PID 3024 wrote to memory of 2028 3024 e5f84a35e927bed93650998a0f6493b0_NeikiAnalytics.exe 28 PID 3024 wrote to memory of 2028 3024 e5f84a35e927bed93650998a0f6493b0_NeikiAnalytics.exe 28 PID 2028 wrote to memory of 2840 2028 dpjdj.exe 29 PID 2028 wrote to memory of 2840 2028 dpjdj.exe 29 PID 2028 wrote to memory of 2840 2028 dpjdj.exe 29 PID 2028 wrote to memory of 2840 2028 dpjdj.exe 29 PID 2840 wrote to memory of 2548 2840 040608.exe 30 PID 2840 wrote to memory of 2548 2840 040608.exe 30 PID 2840 wrote to memory of 2548 2840 040608.exe 30 PID 2840 wrote to memory of 2548 2840 040608.exe 30 PID 2548 wrote to memory of 2664 2548 i266828.exe 31 PID 2548 wrote to memory of 2664 2548 i266828.exe 31 PID 2548 wrote to memory of 2664 2548 i266828.exe 31 PID 2548 wrote to memory of 2664 2548 i266828.exe 31 PID 2664 wrote to memory of 2556 2664 486800.exe 32 PID 2664 wrote to memory of 2556 2664 486800.exe 32 PID 2664 wrote to memory of 2556 2664 486800.exe 32 PID 2664 wrote to memory of 2556 2664 486800.exe 32 PID 2556 wrote to memory of 2688 2556 ttnntt.exe 33 PID 2556 wrote to memory of 2688 2556 ttnntt.exe 33 PID 2556 wrote to memory of 2688 2556 ttnntt.exe 33 PID 2556 wrote to memory of 2688 2556 ttnntt.exe 33 PID 2688 wrote to memory of 2552 2688 xrfxlxl.exe 34 PID 2688 wrote to memory of 2552 2688 xrfxlxl.exe 34 PID 2688 wrote to memory of 2552 2688 xrfxlxl.exe 34 PID 2688 wrote to memory of 2552 2688 xrfxlxl.exe 34 PID 2552 wrote to memory of 2500 2552 40402.exe 35 PID 2552 wrote to memory of 2500 2552 40402.exe 35 PID 2552 wrote to memory of 2500 2552 40402.exe 35 PID 2552 wrote to memory of 2500 2552 40402.exe 35 PID 2500 wrote to memory of 2480 2500 nhtntt.exe 36 PID 2500 wrote to memory of 2480 2500 nhtntt.exe 36 PID 2500 wrote to memory of 2480 2500 nhtntt.exe 36 PID 2500 wrote to memory of 2480 2500 nhtntt.exe 36 PID 2480 wrote to memory of 2408 2480 u802840.exe 37 PID 2480 wrote to memory of 2408 2480 u802840.exe 37 PID 2480 wrote to memory of 2408 2480 u802840.exe 37 PID 2480 wrote to memory of 2408 2480 u802840.exe 37 PID 2408 wrote to memory of 2980 2408 2602846.exe 38 PID 2408 wrote to memory of 2980 2408 2602846.exe 38 PID 2408 wrote to memory of 2980 2408 2602846.exe 38 PID 2408 wrote to memory of 2980 2408 2602846.exe 38 PID 2980 wrote to memory of 1792 2980 k26006.exe 39 PID 2980 wrote to memory of 1792 2980 k26006.exe 39 PID 2980 wrote to memory of 1792 2980 k26006.exe 39 PID 2980 wrote to memory of 1792 2980 k26006.exe 39 PID 1792 wrote to memory of 1192 1792 820684.exe 40 PID 1792 wrote to memory of 1192 1792 820684.exe 40 PID 1792 wrote to memory of 1192 1792 820684.exe 40 PID 1792 wrote to memory of 1192 1792 820684.exe 40 PID 1192 wrote to memory of 2692 1192 a0406.exe 41 PID 1192 wrote to memory of 2692 1192 a0406.exe 41 PID 1192 wrote to memory of 2692 1192 a0406.exe 41 PID 1192 wrote to memory of 2692 1192 a0406.exe 41 PID 2692 wrote to memory of 2800 2692 lxrrflr.exe 42 PID 2692 wrote to memory of 2800 2692 lxrrflr.exe 42 PID 2692 wrote to memory of 2800 2692 lxrrflr.exe 42 PID 2692 wrote to memory of 2800 2692 lxrrflr.exe 42 PID 2800 wrote to memory of 1336 2800 q22822.exe 43 PID 2800 wrote to memory of 1336 2800 q22822.exe 43 PID 2800 wrote to memory of 1336 2800 q22822.exe 43 PID 2800 wrote to memory of 1336 2800 q22822.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5f84a35e927bed93650998a0f6493b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e5f84a35e927bed93650998a0f6493b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\dpjdj.exec:\dpjdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\040608.exec:\040608.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\i266828.exec:\i266828.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\486800.exec:\486800.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\ttnntt.exec:\ttnntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\xrfxlxl.exec:\xrfxlxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\40402.exec:\40402.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\nhtntt.exec:\nhtntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\u802840.exec:\u802840.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\2602846.exec:\2602846.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\k26006.exec:\k26006.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\820684.exec:\820684.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\a0406.exec:\a0406.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\lxrrflr.exec:\lxrrflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\q22822.exec:\q22822.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\28880.exec:\28880.exe17⤵
- Executes dropped EXE
PID:1336 -
\??\c:\400066.exec:\400066.exe18⤵
- Executes dropped EXE
PID:1260 -
\??\c:\4428402.exec:\4428402.exe19⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xrlrflf.exec:\xrlrflf.exe20⤵
- Executes dropped EXE
PID:336 -
\??\c:\22600.exec:\22600.exe21⤵
- Executes dropped EXE
PID:1968 -
\??\c:\xxxfxfx.exec:\xxxfxfx.exe22⤵
- Executes dropped EXE
PID:2216 -
\??\c:\6224022.exec:\6224022.exe23⤵
- Executes dropped EXE
PID:704 -
\??\c:\vpdjv.exec:\vpdjv.exe24⤵
- Executes dropped EXE
PID:3040 -
\??\c:\g6286.exec:\g6286.exe25⤵
- Executes dropped EXE
PID:2200 -
\??\c:\1vddj.exec:\1vddj.exe26⤵
- Executes dropped EXE
PID:1080 -
\??\c:\lxrrfll.exec:\lxrrfll.exe27⤵
- Executes dropped EXE
PID:1688 -
\??\c:\8068620.exec:\8068620.exe28⤵
- Executes dropped EXE
PID:1944 -
\??\c:\6088402.exec:\6088402.exe29⤵
- Executes dropped EXE
PID:1752 -
\??\c:\hhthnb.exec:\hhthnb.exe30⤵
- Executes dropped EXE
PID:768 -
\??\c:\ntbnnb.exec:\ntbnnb.exe31⤵
- Executes dropped EXE
PID:2352 -
\??\c:\7lfxxxx.exec:\7lfxxxx.exe32⤵
- Executes dropped EXE
PID:1440 -
\??\c:\rrxfxrf.exec:\rrxfxrf.exe33⤵
- Executes dropped EXE
PID:696 -
\??\c:\k68640.exec:\k68640.exe34⤵
- Executes dropped EXE
PID:2920 -
\??\c:\5nbbtn.exec:\5nbbtn.exe35⤵
- Executes dropped EXE
PID:804 -
\??\c:\nntbhh.exec:\nntbhh.exe36⤵PID:1284
-
\??\c:\486802.exec:\486802.exe37⤵
- Executes dropped EXE
PID:2044 -
\??\c:\2844486.exec:\2844486.exe38⤵
- Executes dropped EXE
PID:1572 -
\??\c:\hhbnbn.exec:\hhbnbn.exe39⤵
- Executes dropped EXE
PID:2304 -
\??\c:\262284.exec:\262284.exe40⤵
- Executes dropped EXE
PID:2644 -
\??\c:\06008.exec:\06008.exe41⤵
- Executes dropped EXE
PID:2632 -
\??\c:\htnhbb.exec:\htnhbb.exe42⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vjjdj.exec:\vjjdj.exe43⤵
- Executes dropped EXE
PID:2584 -
\??\c:\g6680.exec:\g6680.exe44⤵
- Executes dropped EXE
PID:2820 -
\??\c:\c802248.exec:\c802248.exe45⤵
- Executes dropped EXE
PID:2652 -
\??\c:\dvpvd.exec:\dvpvd.exe46⤵
- Executes dropped EXE
PID:2552 -
\??\c:\xxlffxx.exec:\xxlffxx.exe47⤵
- Executes dropped EXE
PID:2612 -
\??\c:\628266.exec:\628266.exe48⤵
- Executes dropped EXE
PID:240 -
\??\c:\vvjjd.exec:\vvjjd.exe49⤵
- Executes dropped EXE
PID:2824 -
\??\c:\826640.exec:\826640.exe50⤵
- Executes dropped EXE
PID:2996 -
\??\c:\o640668.exec:\o640668.exe51⤵
- Executes dropped EXE
PID:2976 -
\??\c:\k60684.exec:\k60684.exe52⤵
- Executes dropped EXE
PID:2772 -
\??\c:\fxlrflf.exec:\fxlrflf.exe53⤵
- Executes dropped EXE
PID:628 -
\??\c:\ntthnb.exec:\ntthnb.exe54⤵
- Executes dropped EXE
PID:2716 -
\??\c:\88248.exec:\88248.exe55⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rrfflrl.exec:\rrfflrl.exe56⤵
- Executes dropped EXE
PID:1952 -
\??\c:\80224.exec:\80224.exe57⤵
- Executes dropped EXE
PID:1324 -
\??\c:\fxrxrrr.exec:\fxrxrrr.exe58⤵
- Executes dropped EXE
PID:1240 -
\??\c:\3rrffrx.exec:\3rrffrx.exe59⤵
- Executes dropped EXE
PID:2056 -
\??\c:\5tnhbn.exec:\5tnhbn.exe60⤵
- Executes dropped EXE
PID:1760 -
\??\c:\s2626.exec:\s2626.exe61⤵
- Executes dropped EXE
PID:1816 -
\??\c:\g8006.exec:\g8006.exe62⤵
- Executes dropped EXE
PID:2092 -
\??\c:\9htntt.exec:\9htntt.exe63⤵
- Executes dropped EXE
PID:576 -
\??\c:\886264.exec:\886264.exe64⤵
- Executes dropped EXE
PID:2216 -
\??\c:\480240.exec:\480240.exe65⤵
- Executes dropped EXE
PID:812 -
\??\c:\7xlfflr.exec:\7xlfflr.exe66⤵
- Executes dropped EXE
PID:1852 -
\??\c:\08068.exec:\08068.exe67⤵PID:2016
-
\??\c:\044406.exec:\044406.exe68⤵PID:740
-
\??\c:\1rrfllr.exec:\1rrfllr.exe69⤵PID:1152
-
\??\c:\tbtthh.exec:\tbtthh.exe70⤵PID:784
-
\??\c:\a6424.exec:\a6424.exe71⤵PID:1724
-
\??\c:\2424620.exec:\2424620.exe72⤵PID:764
-
\??\c:\a2242.exec:\a2242.exe73⤵PID:2164
-
\??\c:\frrfrfl.exec:\frrfrfl.exe74⤵PID:2084
-
\??\c:\nhbnbn.exec:\nhbnbn.exe75⤵PID:2896
-
\??\c:\e64684.exec:\e64684.exe76⤵PID:1940
-
\??\c:\602862.exec:\602862.exe77⤵PID:876
-
\??\c:\66666.exec:\66666.exe78⤵PID:2208
-
\??\c:\0044006.exec:\0044006.exe79⤵PID:2104
-
\??\c:\ffxfrrf.exec:\ffxfrrf.exe80⤵PID:1160
-
\??\c:\q82062.exec:\q82062.exe81⤵PID:2528
-
\??\c:\5pdjj.exec:\5pdjj.exe82⤵PID:1572
-
\??\c:\1fxfxxf.exec:\1fxfxxf.exe83⤵PID:2580
-
\??\c:\446424.exec:\446424.exe84⤵PID:2856
-
\??\c:\5pvpp.exec:\5pvpp.exe85⤵PID:2728
-
\??\c:\7xxxffl.exec:\7xxxffl.exe86⤵PID:2668
-
\??\c:\8684662.exec:\8684662.exe87⤵PID:3032
-
\??\c:\4800842.exec:\4800842.exe88⤵PID:2776
-
\??\c:\2040620.exec:\2040620.exe89⤵PID:2652
-
\??\c:\jpjjv.exec:\jpjjv.exe90⤵PID:2512
-
\??\c:\lfrfxlr.exec:\lfrfxlr.exe91⤵PID:2468
-
\??\c:\5ffflrf.exec:\5ffflrf.exe92⤵PID:240
-
\??\c:\dddvp.exec:\dddvp.exe93⤵PID:2912
-
\??\c:\20402.exec:\20402.exe94⤵PID:2996
-
\??\c:\xfrfxfx.exec:\xfrfxfx.exe95⤵PID:1932
-
\??\c:\3vvvp.exec:\3vvvp.exe96⤵PID:1132
-
\??\c:\20286.exec:\20286.exe97⤵PID:628
-
\??\c:\2606284.exec:\2606284.exe98⤵PID:1704
-
\??\c:\tbtbht.exec:\tbtbht.exe99⤵PID:2812
-
\??\c:\66446.exec:\66446.exe100⤵PID:1952
-
\??\c:\tnhntb.exec:\tnhntb.exe101⤵PID:836
-
\??\c:\8880228.exec:\8880228.exe102⤵PID:1240
-
\??\c:\2028446.exec:\2028446.exe103⤵PID:2404
-
\??\c:\hnnbhh.exec:\hnnbhh.exe104⤵PID:1820
-
\??\c:\nnbnth.exec:\nnbnth.exe105⤵PID:1816
-
\??\c:\88868.exec:\88868.exe106⤵PID:1144
-
\??\c:\60280.exec:\60280.exe107⤵PID:1488
-
\??\c:\4804600.exec:\4804600.exe108⤵PID:704
-
\??\c:\4206880.exec:\4206880.exe109⤵PID:2392
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe110⤵PID:452
-
\??\c:\2628000.exec:\2628000.exe111⤵PID:2016
-
\??\c:\866644.exec:\866644.exe112⤵PID:2312
-
\??\c:\lfxfrfl.exec:\lfxfrfl.exe113⤵PID:1152
-
\??\c:\i680662.exec:\i680662.exe114⤵PID:1944
-
\??\c:\08202.exec:\08202.exe115⤵PID:1724
-
\??\c:\6468840.exec:\6468840.exe116⤵PID:764
-
\??\c:\2208220.exec:\2208220.exe117⤵PID:1088
-
\??\c:\5jddd.exec:\5jddd.exe118⤵PID:1664
-
\??\c:\e02802.exec:\e02802.exe119⤵PID:1028
-
\??\c:\028282.exec:\028282.exe120⤵PID:1440
-
\??\c:\hnhnbh.exec:\hnhnbh.exe121⤵PID:548
-
\??\c:\ffrrffr.exec:\ffrrffr.exe122⤵PID:2208
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-