Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 19:27
Behavioral task
behavioral1
Sample
071a998972f802cc838aa2ef9c6b8870_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
071a998972f802cc838aa2ef9c6b8870_NeikiAnalytics.exe
-
Size
190KB
-
MD5
071a998972f802cc838aa2ef9c6b8870
-
SHA1
55c25028dbdf877176b56208be72aeec79dede4d
-
SHA256
d6b571bd3e9b40df1750ab716329eb14b18f07785de8afe5ad89092206eacd3f
-
SHA512
8b72859259eb1d0074ef5989c8553cb2e4853d8415e81dc46f5c82c895fe973d02cba176a2af34a94a39f47ca92f2f7a87faca2f868d7911545e77eb40830bec
-
SSDEEP
3072:YhOmTsF93UYfwC6GIoutLmxHxae5yLpcgDE4JBuItR8pTsgnKbQFe3+9:Ycm4FmowdHoSLEaTBftapTsyFeO9
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/1032-7-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1668-18-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2392-28-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1692-37-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1976-46-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2656-55-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2560-63-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2840-67-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2608-82-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2484-86-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/2504-100-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2792-116-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2740-124-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2488-142-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2320-151-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2932-175-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2100-184-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2252-202-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/720-220-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1772-235-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1940-269-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/844-272-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2044-287-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/3004-300-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1648-326-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2544-346-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2012-359-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2724-366-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2600-373-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1428-424-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1936-469-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/592-509-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1028-597-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/1480-785-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon behavioral1/memory/1852-788-0x00000000003C0000-0x00000000003F0000-memory.dmp family_blackmoon behavioral1/memory/800-806-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1504-881-0x00000000002A0000-0x00000000002D0000-memory.dmp family_blackmoon behavioral1/memory/1508-889-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2992-947-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/672-1052-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/1088-1065-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral1/memory/2164-1114-0x0000000000220000-0x0000000000250000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 33 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000b0000000144e4-5.dat family_berbew behavioral1/files/0x001500000001471d-17.dat family_berbew behavioral1/files/0x0008000000014aa2-25.dat family_berbew behavioral1/files/0x0007000000014b63-36.dat family_berbew behavioral1/files/0x0007000000014baa-44.dat family_berbew behavioral1/files/0x0007000000014bea-52.dat family_berbew behavioral1/files/0x0008000000014f71-64.dat family_berbew behavioral1/files/0x0007000000015ceb-73.dat family_berbew behavioral1/files/0x0006000000015d07-80.dat family_berbew behavioral1/files/0x0006000000015d28-89.dat family_berbew behavioral1/files/0x0006000000015d4a-97.dat family_berbew behavioral1/files/0x0006000000015d56-108.dat family_berbew behavioral1/files/0x0006000000015d5e-117.dat family_berbew behavioral1/files/0x0006000000015d67-125.dat family_berbew behavioral1/files/0x0006000000015d6f-132.dat family_berbew behavioral1/files/0x0006000000015d79-141.dat family_berbew behavioral1/files/0x0015000000014726-149.dat family_berbew behavioral1/files/0x0006000000015d87-158.dat family_berbew behavioral1/files/0x0006000000015d8f-166.dat family_berbew behavioral1/files/0x0006000000015d9b-176.dat family_berbew behavioral1/files/0x0006000000015e3a-185.dat family_berbew behavioral1/files/0x0006000000015eaf-193.dat family_berbew behavioral1/files/0x0006000000015f6d-200.dat family_berbew behavioral1/files/0x0006000000015fe9-210.dat family_berbew behavioral1/files/0x0006000000016117-218.dat family_berbew behavioral1/files/0x00060000000161e7-227.dat family_berbew behavioral1/files/0x000600000001630b-236.dat family_berbew behavioral1/files/0x00060000000164b2-244.dat family_berbew behavioral1/files/0x0006000000016572-251.dat family_berbew behavioral1/files/0x000600000001661c-260.dat family_berbew behavioral1/files/0x0006000000016843-270.dat family_berbew behavioral1/files/0x0006000000016a9a-280.dat family_berbew behavioral1/memory/1500-705-0x00000000005C0000-0x00000000005F0000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1668 xllxrrr.exe 2392 xrlrfff.exe 1692 9tbnnb.exe 1976 4840662.exe 2656 264644.exe 2560 llflxrx.exe 2840 9vpdp.exe 2608 q20644.exe 2484 dvpvp.exe 2504 882080.exe 2312 flfxffl.exe 2792 jjvjp.exe 2740 204402.exe 1500 g4284.exe 2488 lfxfrxl.exe 2320 hbtbnt.exe 2668 jpvpp.exe 1780 xlxxlrx.exe 2932 dvdjv.exe 2100 vvppv.exe 2956 680460.exe 2252 jddpj.exe 2092 8688402.exe 488 26484.exe 720 o468068.exe 1772 lfrrffr.exe 1340 tnbhtt.exe 812 vjdjv.exe 900 86802.exe 1940 086280.exe 844 28402.exe 1792 rlfxxxf.exe 2044 o022402.exe 3004 lrxrlfr.exe 1572 q08404.exe 2324 jjvjd.exe 2340 flllxxf.exe 1648 btnntt.exe 2288 26408.exe 1692 m8624.exe 2544 jvppp.exe 2108 vpvvv.exe 2012 48024.exe 2724 btbbnt.exe 2600 82466.exe 2452 hhbbtt.exe 1272 6602046.exe 1656 484244.exe 2244 8240224.exe 2912 7rflllr.exe 2792 84868.exe 628 hhbhtb.exe 1428 4422006.exe 1608 4800628.exe 2488 tthntb.exe 2788 442406.exe 2744 u826846.exe 1264 q64068.exe 1284 tnhnbt.exe 2056 u084684.exe 1936 6022840.exe 2332 604468.exe 1948 4862808.exe 2076 5thntt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1032 wrote to memory of 1668 1032 071a998972f802cc838aa2ef9c6b8870_NeikiAnalytics.exe 28 PID 1032 wrote to memory of 1668 1032 071a998972f802cc838aa2ef9c6b8870_NeikiAnalytics.exe 28 PID 1032 wrote to memory of 1668 1032 071a998972f802cc838aa2ef9c6b8870_NeikiAnalytics.exe 28 PID 1032 wrote to memory of 1668 1032 071a998972f802cc838aa2ef9c6b8870_NeikiAnalytics.exe 28 PID 1668 wrote to memory of 2392 1668 xllxrrr.exe 29 PID 1668 wrote to memory of 2392 1668 xllxrrr.exe 29 PID 1668 wrote to memory of 2392 1668 xllxrrr.exe 29 PID 1668 wrote to memory of 2392 1668 xllxrrr.exe 29 PID 2392 wrote to memory of 1692 2392 xrlrfff.exe 30 PID 2392 wrote to memory of 1692 2392 xrlrfff.exe 30 PID 2392 wrote to memory of 1692 2392 xrlrfff.exe 30 PID 2392 wrote to memory of 1692 2392 xrlrfff.exe 30 PID 1692 wrote to memory of 1976 1692 9tbnnb.exe 31 PID 1692 wrote to memory of 1976 1692 9tbnnb.exe 31 PID 1692 wrote to memory of 1976 1692 9tbnnb.exe 31 PID 1692 wrote to memory of 1976 1692 9tbnnb.exe 31 PID 1976 wrote to memory of 2656 1976 4840662.exe 32 PID 1976 wrote to memory of 2656 1976 4840662.exe 32 PID 1976 wrote to memory of 2656 1976 4840662.exe 32 PID 1976 wrote to memory of 2656 1976 4840662.exe 32 PID 2656 wrote to memory of 2560 2656 264644.exe 33 PID 2656 wrote to memory of 2560 2656 264644.exe 33 PID 2656 wrote to memory of 2560 2656 264644.exe 33 PID 2656 wrote to memory of 2560 2656 264644.exe 33 PID 2560 wrote to memory of 2840 2560 llflxrx.exe 34 PID 2560 wrote to memory of 2840 2560 llflxrx.exe 34 PID 2560 wrote to memory of 2840 2560 llflxrx.exe 34 PID 2560 wrote to memory of 2840 2560 llflxrx.exe 34 PID 2840 wrote to memory of 2608 2840 9vpdp.exe 35 PID 2840 wrote to memory of 2608 2840 9vpdp.exe 35 PID 2840 wrote to memory of 2608 2840 9vpdp.exe 35 PID 2840 wrote to memory of 2608 2840 9vpdp.exe 35 PID 2608 wrote to memory of 2484 2608 q20644.exe 36 PID 2608 wrote to memory of 2484 2608 q20644.exe 36 PID 2608 wrote to memory of 2484 2608 q20644.exe 36 PID 2608 wrote to memory of 2484 2608 q20644.exe 36 PID 2484 wrote to memory of 2504 2484 dvpvp.exe 37 PID 2484 wrote to memory of 2504 2484 dvpvp.exe 37 PID 2484 wrote to memory of 2504 2484 dvpvp.exe 37 PID 2484 wrote to memory of 2504 2484 dvpvp.exe 37 PID 2504 wrote to memory of 2312 2504 882080.exe 38 PID 2504 wrote to memory of 2312 2504 882080.exe 38 PID 2504 wrote to memory of 2312 2504 882080.exe 38 PID 2504 wrote to memory of 2312 2504 882080.exe 38 PID 2312 wrote to memory of 2792 2312 flfxffl.exe 39 PID 2312 wrote to memory of 2792 2312 flfxffl.exe 39 PID 2312 wrote to memory of 2792 2312 flfxffl.exe 39 PID 2312 wrote to memory of 2792 2312 flfxffl.exe 39 PID 2792 wrote to memory of 2740 2792 jjvjp.exe 40 PID 2792 wrote to memory of 2740 2792 jjvjp.exe 40 PID 2792 wrote to memory of 2740 2792 jjvjp.exe 40 PID 2792 wrote to memory of 2740 2792 jjvjp.exe 40 PID 2740 wrote to memory of 1500 2740 204402.exe 41 PID 2740 wrote to memory of 1500 2740 204402.exe 41 PID 2740 wrote to memory of 1500 2740 204402.exe 41 PID 2740 wrote to memory of 1500 2740 204402.exe 41 PID 1500 wrote to memory of 2488 1500 g4284.exe 42 PID 1500 wrote to memory of 2488 1500 g4284.exe 42 PID 1500 wrote to memory of 2488 1500 g4284.exe 42 PID 1500 wrote to memory of 2488 1500 g4284.exe 42 PID 2488 wrote to memory of 2320 2488 lfxfrxl.exe 43 PID 2488 wrote to memory of 2320 2488 lfxfrxl.exe 43 PID 2488 wrote to memory of 2320 2488 lfxfrxl.exe 43 PID 2488 wrote to memory of 2320 2488 lfxfrxl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\071a998972f802cc838aa2ef9c6b8870_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\071a998972f802cc838aa2ef9c6b8870_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\xllxrrr.exec:\xllxrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\xrlrfff.exec:\xrlrfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\9tbnnb.exec:\9tbnnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\4840662.exec:\4840662.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\264644.exec:\264644.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\llflxrx.exec:\llflxrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\9vpdp.exec:\9vpdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\q20644.exec:\q20644.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\dvpvp.exec:\dvpvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\882080.exec:\882080.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\flfxffl.exec:\flfxffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\jjvjp.exec:\jjvjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\204402.exec:\204402.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\g4284.exec:\g4284.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\hbtbnt.exec:\hbtbnt.exe17⤵
- Executes dropped EXE
PID:2320 -
\??\c:\jpvpp.exec:\jpvpp.exe18⤵
- Executes dropped EXE
PID:2668 -
\??\c:\xlxxlrx.exec:\xlxxlrx.exe19⤵
- Executes dropped EXE
PID:1780 -
\??\c:\dvdjv.exec:\dvdjv.exe20⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vvppv.exec:\vvppv.exe21⤵
- Executes dropped EXE
PID:2100 -
\??\c:\680460.exec:\680460.exe22⤵
- Executes dropped EXE
PID:2956 -
\??\c:\jddpj.exec:\jddpj.exe23⤵
- Executes dropped EXE
PID:2252 -
\??\c:\8688402.exec:\8688402.exe24⤵
- Executes dropped EXE
PID:2092 -
\??\c:\26484.exec:\26484.exe25⤵
- Executes dropped EXE
PID:488 -
\??\c:\o468068.exec:\o468068.exe26⤵
- Executes dropped EXE
PID:720 -
\??\c:\lfrrffr.exec:\lfrrffr.exe27⤵
- Executes dropped EXE
PID:1772 -
\??\c:\tnbhtt.exec:\tnbhtt.exe28⤵
- Executes dropped EXE
PID:1340 -
\??\c:\vjdjv.exec:\vjdjv.exe29⤵
- Executes dropped EXE
PID:812 -
\??\c:\86802.exec:\86802.exe30⤵
- Executes dropped EXE
PID:900 -
\??\c:\086280.exec:\086280.exe31⤵
- Executes dropped EXE
PID:1940 -
\??\c:\28402.exec:\28402.exe32⤵
- Executes dropped EXE
PID:844 -
\??\c:\rlfxxxf.exec:\rlfxxxf.exe33⤵
- Executes dropped EXE
PID:1792 -
\??\c:\o022402.exec:\o022402.exe34⤵
- Executes dropped EXE
PID:2044 -
\??\c:\lrxrlfr.exec:\lrxrlfr.exe35⤵
- Executes dropped EXE
PID:3004 -
\??\c:\q08404.exec:\q08404.exe36⤵
- Executes dropped EXE
PID:1572 -
\??\c:\jjvjd.exec:\jjvjd.exe37⤵
- Executes dropped EXE
PID:2324 -
\??\c:\flllxxf.exec:\flllxxf.exe38⤵
- Executes dropped EXE
PID:2340 -
\??\c:\btnntt.exec:\btnntt.exe39⤵
- Executes dropped EXE
PID:1648 -
\??\c:\26408.exec:\26408.exe40⤵
- Executes dropped EXE
PID:2288 -
\??\c:\m8624.exec:\m8624.exe41⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jvppp.exec:\jvppp.exe42⤵
- Executes dropped EXE
PID:2544 -
\??\c:\vpvvv.exec:\vpvvv.exe43⤵
- Executes dropped EXE
PID:2108 -
\??\c:\48024.exec:\48024.exe44⤵
- Executes dropped EXE
PID:2012 -
\??\c:\btbbnt.exec:\btbbnt.exe45⤵
- Executes dropped EXE
PID:2724 -
\??\c:\82466.exec:\82466.exe46⤵
- Executes dropped EXE
PID:2600 -
\??\c:\hhbbtt.exec:\hhbbtt.exe47⤵
- Executes dropped EXE
PID:2452 -
\??\c:\6602046.exec:\6602046.exe48⤵
- Executes dropped EXE
PID:1272 -
\??\c:\484244.exec:\484244.exe49⤵
- Executes dropped EXE
PID:1656 -
\??\c:\8240224.exec:\8240224.exe50⤵
- Executes dropped EXE
PID:2244 -
\??\c:\7rflllr.exec:\7rflllr.exe51⤵
- Executes dropped EXE
PID:2912 -
\??\c:\84868.exec:\84868.exe52⤵
- Executes dropped EXE
PID:2792 -
\??\c:\hhbhtb.exec:\hhbhtb.exe53⤵
- Executes dropped EXE
PID:628 -
\??\c:\4422006.exec:\4422006.exe54⤵
- Executes dropped EXE
PID:1428 -
\??\c:\4800628.exec:\4800628.exe55⤵
- Executes dropped EXE
PID:1608 -
\??\c:\tthntb.exec:\tthntb.exe56⤵
- Executes dropped EXE
PID:2488 -
\??\c:\442406.exec:\442406.exe57⤵
- Executes dropped EXE
PID:2788 -
\??\c:\u826846.exec:\u826846.exe58⤵
- Executes dropped EXE
PID:2744 -
\??\c:\q64068.exec:\q64068.exe59⤵
- Executes dropped EXE
PID:1264 -
\??\c:\tnhnbt.exec:\tnhnbt.exe60⤵
- Executes dropped EXE
PID:1284 -
\??\c:\u084684.exec:\u084684.exe61⤵
- Executes dropped EXE
PID:2056 -
\??\c:\6022840.exec:\6022840.exe62⤵
- Executes dropped EXE
PID:1936 -
\??\c:\604468.exec:\604468.exe63⤵
- Executes dropped EXE
PID:2332 -
\??\c:\4862808.exec:\4862808.exe64⤵
- Executes dropped EXE
PID:1948 -
\??\c:\5thntt.exec:\5thntt.exe65⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jjdvv.exec:\jjdvv.exe66⤵PID:776
-
\??\c:\002242.exec:\002242.exe67⤵PID:1088
-
\??\c:\226840.exec:\226840.exe68⤵PID:592
-
\??\c:\m8286.exec:\m8286.exe69⤵PID:992
-
\??\c:\hhbhnb.exec:\hhbhnb.exe70⤵PID:960
-
\??\c:\vppvd.exec:\vppvd.exe71⤵PID:356
-
\??\c:\q48802.exec:\q48802.exe72⤵PID:912
-
\??\c:\pppdd.exec:\pppdd.exe73⤵PID:1776
-
\??\c:\4828046.exec:\4828046.exe74⤵PID:2904
-
\??\c:\80002.exec:\80002.exe75⤵PID:2908
-
\??\c:\hhbnth.exec:\hhbnth.exe76⤵PID:2008
-
\??\c:\4862446.exec:\4862446.exe77⤵PID:2240
-
\??\c:\442844.exec:\442844.exe78⤵PID:344
-
\??\c:\c820280.exec:\c820280.exe79⤵PID:2880
-
\??\c:\bbtbht.exec:\bbtbht.exe80⤵PID:880
-
\??\c:\bbthtb.exec:\bbthtb.exe81⤵PID:1028
-
\??\c:\8240600.exec:\8240600.exe82⤵PID:2236
-
\??\c:\442468.exec:\442468.exe83⤵PID:2612
-
\??\c:\8644440.exec:\8644440.exe84⤵PID:3044
-
\??\c:\88622.exec:\88622.exe85⤵PID:2636
-
\??\c:\64628.exec:\64628.exe86⤵PID:2592
-
\??\c:\6002402.exec:\6002402.exe87⤵PID:2568
-
\??\c:\bhtnnb.exec:\bhtnnb.exe88⤵PID:2844
-
\??\c:\48048.exec:\48048.exe89⤵PID:2604
-
\??\c:\9fflxfx.exec:\9fflxfx.exe90⤵PID:2724
-
\??\c:\fxrfxfr.exec:\fxrfxfr.exe91⤵PID:2440
-
\??\c:\1ddvd.exec:\1ddvd.exe92⤵PID:2608
-
\??\c:\w80006.exec:\w80006.exe93⤵PID:2484
-
\??\c:\nnntht.exec:\nnntht.exe94⤵PID:2944
-
\??\c:\9fxrrrx.exec:\9fxrrrx.exe95⤵PID:2244
-
\??\c:\nnhbhn.exec:\nnhbhn.exe96⤵PID:1844
-
\??\c:\6886082.exec:\6886082.exe97⤵PID:1192
-
\??\c:\dvjjd.exec:\dvjjd.exe98⤵PID:1500
-
\??\c:\frxlrfx.exec:\frxlrfx.exe99⤵PID:1288
-
\??\c:\xrxlrll.exec:\xrxlrll.exe100⤵PID:1608
-
\??\c:\60802.exec:\60802.exe101⤵PID:2320
-
\??\c:\82068.exec:\82068.exe102⤵PID:2788
-
\??\c:\284824.exec:\284824.exe103⤵PID:2744
-
\??\c:\4428804.exec:\4428804.exe104⤵PID:1120
-
\??\c:\jjvpj.exec:\jjvpj.exe105⤵PID:1284
-
\??\c:\tnbhtt.exec:\tnbhtt.exe106⤵PID:1188
-
\??\c:\1ffrllx.exec:\1ffrllx.exe107⤵PID:2104
-
\??\c:\nnhbhn.exec:\nnhbhn.exe108⤵PID:1944
-
\??\c:\ddvdp.exec:\ddvdp.exe109⤵PID:2252
-
\??\c:\rfrrxfl.exec:\rfrrxfl.exe110⤵PID:984
-
\??\c:\5thntb.exec:\5thntb.exe111⤵PID:1480
-
\??\c:\22686.exec:\22686.exe112⤵PID:1852
-
\??\c:\hbhntt.exec:\hbhntt.exe113⤵PID:840
-
\??\c:\c068064.exec:\c068064.exe114⤵PID:1920
-
\??\c:\vpjpd.exec:\vpjpd.exe115⤵PID:800
-
\??\c:\3htntb.exec:\3htntb.exe116⤵PID:1916
-
\??\c:\a6062.exec:\a6062.exe117⤵PID:568
-
\??\c:\g6062.exec:\g6062.exe118⤵PID:1776
-
\??\c:\04240.exec:\04240.exe119⤵PID:2904
-
\??\c:\nhnnhh.exec:\nhnnhh.exe120⤵PID:2908
-
\??\c:\pjvjv.exec:\pjvjv.exe121⤵PID:2292
-
\??\c:\q88028.exec:\q88028.exe122⤵PID:2036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-