Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 18:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0985912a3fe60655b2c432cb672fa600_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
0985912a3fe60655b2c432cb672fa600_NeikiAnalytics.exe
-
Size
57KB
-
MD5
0985912a3fe60655b2c432cb672fa600
-
SHA1
3c8caf366fd7d7c971025623157350db8e3aaabc
-
SHA256
c264d70ef9c6996e2d6791de466ae0899da53ebe2218ff8410b53ef70d0dad51
-
SHA512
14f054b86a5ae3047b7ad8a1a0ac25892d690692cdc92af3759691493ecb1af87b54092026d321cedf5d96200a32f35e8bf8c76c6b9616f3116c76f87e11fbd2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuSwF9:ymb3NkkiQ3mdBjFIvIF9
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral1/memory/348-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/344-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/348-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1600-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1464-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/352-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1872-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1356-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-3321-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 344 fxrfflx.exe 1636 xxlflrx.exe 2696 bbnbhn.exe 2616 vpjpd.exe 2608 thnnhn.exe 2656 jdvdj.exe 2504 pjdpp.exe 2924 xlxrrxf.exe 1600 bbbtbb.exe 2552 btntnt.exe 2812 3dvdj.exe 1464 7jvvj.exe 352 xrflxrx.exe 1872 rlxfrrx.exe 2288 9thhtb.exe 1356 dvddd.exe 2044 xxlffrl.exe 1684 lxfxffx.exe 2236 tbnbbt.exe 1948 htbhnt.exe 1200 9dvdp.exe 804 vjdpd.exe 892 fxllrrr.exe 688 1bnthh.exe 1080 7tthtt.exe 792 jdpdv.exe 2088 rlxxfrl.exe 1108 ffxfrrx.exe 2880 tntntn.exe 3012 jjvvj.exe 1968 jdvvj.exe 884 xrlrlrf.exe 1748 frfflfr.exe 1520 nntttt.exe 2976 hhbbhh.exe 2292 dvjjp.exe 2684 xrflllx.exe 2688 fxfffxf.exe 2648 3tntbh.exe 2840 nnbhnt.exe 2516 vvppd.exe 2412 pjpjv.exe 2512 7rllxrx.exe 2392 llxrlrx.exe 2424 1tnbbn.exe 1348 nhnthh.exe 2560 ppjvj.exe 2800 pvjpd.exe 1540 rrlxxfl.exe 268 flrrxrl.exe 1548 5hnbnt.exe 1772 9ttttb.exe 1664 pjddj.exe 844 dpjdj.exe 2364 fxrrfxf.exe 2016 rlrxxxf.exe 2428 nhbbnt.exe 1916 hbnttt.exe 1724 3jvdp.exe 2804 vpjpd.exe 320 7rllxrf.exe 1396 lxflxxf.exe 1048 bbhbhn.exe 892 hbthtt.exe -
resource yara_rule behavioral1/memory/344-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/348-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2924-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1600-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1464-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/352-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1872-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1356-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-3321-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 348 wrote to memory of 344 348 0985912a3fe60655b2c432cb672fa600_NeikiAnalytics.exe 28 PID 348 wrote to memory of 344 348 0985912a3fe60655b2c432cb672fa600_NeikiAnalytics.exe 28 PID 348 wrote to memory of 344 348 0985912a3fe60655b2c432cb672fa600_NeikiAnalytics.exe 28 PID 348 wrote to memory of 344 348 0985912a3fe60655b2c432cb672fa600_NeikiAnalytics.exe 28 PID 344 wrote to memory of 1636 344 fxrfflx.exe 29 PID 344 wrote to memory of 1636 344 fxrfflx.exe 29 PID 344 wrote to memory of 1636 344 fxrfflx.exe 29 PID 344 wrote to memory of 1636 344 fxrfflx.exe 29 PID 1636 wrote to memory of 2696 1636 xxlflrx.exe 30 PID 1636 wrote to memory of 2696 1636 xxlflrx.exe 30 PID 1636 wrote to memory of 2696 1636 xxlflrx.exe 30 PID 1636 wrote to memory of 2696 1636 xxlflrx.exe 30 PID 2696 wrote to memory of 2616 2696 bbnbhn.exe 31 PID 2696 wrote to memory of 2616 2696 bbnbhn.exe 31 PID 2696 wrote to memory of 2616 2696 bbnbhn.exe 31 PID 2696 wrote to memory of 2616 2696 bbnbhn.exe 31 PID 2616 wrote to memory of 2608 2616 vpjpd.exe 32 PID 2616 wrote to memory of 2608 2616 vpjpd.exe 32 PID 2616 wrote to memory of 2608 2616 vpjpd.exe 32 PID 2616 wrote to memory of 2608 2616 vpjpd.exe 32 PID 2608 wrote to memory of 2656 2608 thnnhn.exe 33 PID 2608 wrote to memory of 2656 2608 thnnhn.exe 33 PID 2608 wrote to memory of 2656 2608 thnnhn.exe 33 PID 2608 wrote to memory of 2656 2608 thnnhn.exe 33 PID 2656 wrote to memory of 2504 2656 jdvdj.exe 34 PID 2656 wrote to memory of 2504 2656 jdvdj.exe 34 PID 2656 wrote to memory of 2504 2656 jdvdj.exe 34 PID 2656 wrote to memory of 2504 2656 jdvdj.exe 34 PID 2504 wrote to memory of 2924 2504 pjdpp.exe 35 PID 2504 wrote to memory of 2924 2504 pjdpp.exe 35 PID 2504 wrote to memory of 2924 2504 pjdpp.exe 35 PID 2504 wrote to memory of 2924 2504 pjdpp.exe 35 PID 2924 wrote to memory of 1600 2924 xlxrrxf.exe 36 PID 2924 wrote to memory of 1600 2924 xlxrrxf.exe 36 PID 2924 wrote to memory of 1600 2924 xlxrrxf.exe 36 PID 2924 wrote to memory of 1600 2924 xlxrrxf.exe 36 PID 1600 wrote to memory of 2552 1600 bbbtbb.exe 37 PID 1600 wrote to memory of 2552 1600 bbbtbb.exe 37 PID 1600 wrote to memory of 2552 1600 bbbtbb.exe 37 PID 1600 wrote to memory of 2552 1600 bbbtbb.exe 37 PID 2552 wrote to memory of 2812 2552 btntnt.exe 38 PID 2552 wrote to memory of 2812 2552 btntnt.exe 38 PID 2552 wrote to memory of 2812 2552 btntnt.exe 38 PID 2552 wrote to memory of 2812 2552 btntnt.exe 38 PID 2812 wrote to memory of 1464 2812 3dvdj.exe 39 PID 2812 wrote to memory of 1464 2812 3dvdj.exe 39 PID 2812 wrote to memory of 1464 2812 3dvdj.exe 39 PID 2812 wrote to memory of 1464 2812 3dvdj.exe 39 PID 1464 wrote to memory of 352 1464 7jvvj.exe 40 PID 1464 wrote to memory of 352 1464 7jvvj.exe 40 PID 1464 wrote to memory of 352 1464 7jvvj.exe 40 PID 1464 wrote to memory of 352 1464 7jvvj.exe 40 PID 352 wrote to memory of 1872 352 xrflxrx.exe 41 PID 352 wrote to memory of 1872 352 xrflxrx.exe 41 PID 352 wrote to memory of 1872 352 xrflxrx.exe 41 PID 352 wrote to memory of 1872 352 xrflxrx.exe 41 PID 1872 wrote to memory of 2288 1872 rlxfrrx.exe 42 PID 1872 wrote to memory of 2288 1872 rlxfrrx.exe 42 PID 1872 wrote to memory of 2288 1872 rlxfrrx.exe 42 PID 1872 wrote to memory of 2288 1872 rlxfrrx.exe 42 PID 2288 wrote to memory of 1356 2288 9thhtb.exe 43 PID 2288 wrote to memory of 1356 2288 9thhtb.exe 43 PID 2288 wrote to memory of 1356 2288 9thhtb.exe 43 PID 2288 wrote to memory of 1356 2288 9thhtb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0985912a3fe60655b2c432cb672fa600_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0985912a3fe60655b2c432cb672fa600_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\fxrfflx.exec:\fxrfflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\xxlflrx.exec:\xxlflrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\bbnbhn.exec:\bbnbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\vpjpd.exec:\vpjpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\thnnhn.exec:\thnnhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\jdvdj.exec:\jdvdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\pjdpp.exec:\pjdpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\xlxrrxf.exec:\xlxrrxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\bbbtbb.exec:\bbbtbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\btntnt.exec:\btntnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\3dvdj.exec:\3dvdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\7jvvj.exec:\7jvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\xrflxrx.exec:\xrflxrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\9thhtb.exec:\9thhtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\dvddd.exec:\dvddd.exe17⤵
- Executes dropped EXE
PID:1356 -
\??\c:\xxlffrl.exec:\xxlffrl.exe18⤵
- Executes dropped EXE
PID:2044 -
\??\c:\lxfxffx.exec:\lxfxffx.exe19⤵
- Executes dropped EXE
PID:1684 -
\??\c:\tbnbbt.exec:\tbnbbt.exe20⤵
- Executes dropped EXE
PID:2236 -
\??\c:\htbhnt.exec:\htbhnt.exe21⤵
- Executes dropped EXE
PID:1948 -
\??\c:\9dvdp.exec:\9dvdp.exe22⤵
- Executes dropped EXE
PID:1200 -
\??\c:\vjdpd.exec:\vjdpd.exe23⤵
- Executes dropped EXE
PID:804 -
\??\c:\fxllrrr.exec:\fxllrrr.exe24⤵
- Executes dropped EXE
PID:892 -
\??\c:\1bnthh.exec:\1bnthh.exe25⤵
- Executes dropped EXE
PID:688 -
\??\c:\7tthtt.exec:\7tthtt.exe26⤵
- Executes dropped EXE
PID:1080 -
\??\c:\jdpdv.exec:\jdpdv.exe27⤵
- Executes dropped EXE
PID:792 -
\??\c:\rlxxfrl.exec:\rlxxfrl.exe28⤵
- Executes dropped EXE
PID:2088 -
\??\c:\ffxfrrx.exec:\ffxfrrx.exe29⤵
- Executes dropped EXE
PID:1108 -
\??\c:\tntntn.exec:\tntntn.exe30⤵
- Executes dropped EXE
PID:2880 -
\??\c:\jjvvj.exec:\jjvvj.exe31⤵
- Executes dropped EXE
PID:3012 -
\??\c:\jdvvj.exec:\jdvvj.exe32⤵
- Executes dropped EXE
PID:1968 -
\??\c:\xrlrlrf.exec:\xrlrlrf.exe33⤵
- Executes dropped EXE
PID:884 -
\??\c:\frfflfr.exec:\frfflfr.exe34⤵
- Executes dropped EXE
PID:1748 -
\??\c:\nntttt.exec:\nntttt.exe35⤵
- Executes dropped EXE
PID:1520 -
\??\c:\hhbbhh.exec:\hhbbhh.exe36⤵
- Executes dropped EXE
PID:2976 -
\??\c:\dvjjp.exec:\dvjjp.exe37⤵
- Executes dropped EXE
PID:2292 -
\??\c:\xrflllx.exec:\xrflllx.exe38⤵
- Executes dropped EXE
PID:2684 -
\??\c:\fxfffxf.exec:\fxfffxf.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\3tntbh.exec:\3tntbh.exe40⤵
- Executes dropped EXE
PID:2648 -
\??\c:\nnbhnt.exec:\nnbhnt.exe41⤵
- Executes dropped EXE
PID:2840 -
\??\c:\vvppd.exec:\vvppd.exe42⤵
- Executes dropped EXE
PID:2516 -
\??\c:\pjpjv.exec:\pjpjv.exe43⤵
- Executes dropped EXE
PID:2412 -
\??\c:\7rllxrx.exec:\7rllxrx.exe44⤵
- Executes dropped EXE
PID:2512 -
\??\c:\llxrlrx.exec:\llxrlrx.exe45⤵
- Executes dropped EXE
PID:2392 -
\??\c:\1tnbbn.exec:\1tnbbn.exe46⤵
- Executes dropped EXE
PID:2424 -
\??\c:\nhnthh.exec:\nhnthh.exe47⤵
- Executes dropped EXE
PID:1348 -
\??\c:\ppjvj.exec:\ppjvj.exe48⤵
- Executes dropped EXE
PID:2560 -
\??\c:\pvjpd.exec:\pvjpd.exe49⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rrlxxfl.exec:\rrlxxfl.exe50⤵
- Executes dropped EXE
PID:1540 -
\??\c:\flrrxrl.exec:\flrrxrl.exe51⤵
- Executes dropped EXE
PID:268 -
\??\c:\5hnbnt.exec:\5hnbnt.exe52⤵
- Executes dropped EXE
PID:1548 -
\??\c:\9ttttb.exec:\9ttttb.exe53⤵
- Executes dropped EXE
PID:1772 -
\??\c:\pjddj.exec:\pjddj.exe54⤵
- Executes dropped EXE
PID:1664 -
\??\c:\dpjdj.exec:\dpjdj.exe55⤵
- Executes dropped EXE
PID:844 -
\??\c:\fxrrfxf.exec:\fxrrfxf.exe56⤵
- Executes dropped EXE
PID:2364 -
\??\c:\rlrxxxf.exec:\rlrxxxf.exe57⤵
- Executes dropped EXE
PID:2016 -
\??\c:\nhbbnt.exec:\nhbbnt.exe58⤵
- Executes dropped EXE
PID:2428 -
\??\c:\hbnttt.exec:\hbnttt.exe59⤵
- Executes dropped EXE
PID:1916 -
\??\c:\3jvdp.exec:\3jvdp.exe60⤵
- Executes dropped EXE
PID:1724 -
\??\c:\vpjpd.exec:\vpjpd.exe61⤵
- Executes dropped EXE
PID:2804 -
\??\c:\7rllxrf.exec:\7rllxrf.exe62⤵
- Executes dropped EXE
PID:320 -
\??\c:\lxflxxf.exec:\lxflxxf.exe63⤵
- Executes dropped EXE
PID:1396 -
\??\c:\bbhbhn.exec:\bbhbhn.exe64⤵
- Executes dropped EXE
PID:1048 -
\??\c:\hbthtt.exec:\hbthtt.exe65⤵
- Executes dropped EXE
PID:892 -
\??\c:\jjdpv.exec:\jjdpv.exe66⤵PID:2272
-
\??\c:\pjvpd.exec:\pjvpd.exe67⤵PID:1112
-
\??\c:\rrllrrr.exec:\rrllrrr.exe68⤵PID:924
-
\??\c:\lxffrrf.exec:\lxffrrf.exe69⤵PID:328
-
\??\c:\tnnbnt.exec:\tnnbnt.exe70⤵PID:840
-
\??\c:\hbbbhn.exec:\hbbbhn.exe71⤵PID:2852
-
\??\c:\pjjpp.exec:\pjjpp.exe72⤵PID:776
-
\??\c:\5vjjp.exec:\5vjjp.exe73⤵PID:324
-
\??\c:\fxrrxfr.exec:\fxrrxfr.exe74⤵PID:3012
-
\??\c:\7rfrrxr.exec:\7rfrrxr.exe75⤵PID:1968
-
\??\c:\bthnnn.exec:\bthnnn.exe76⤵PID:884
-
\??\c:\bththh.exec:\bththh.exe77⤵PID:1512
-
\??\c:\3dvvd.exec:\3dvvd.exe78⤵PID:2348
-
\??\c:\9vpdj.exec:\9vpdj.exe79⤵PID:2780
-
\??\c:\fxfxxfx.exec:\fxfxxfx.exe80⤵PID:2584
-
\??\c:\rlffllr.exec:\rlffllr.exe81⤵PID:2716
-
\??\c:\nbntbb.exec:\nbntbb.exe82⤵PID:2744
-
\??\c:\hhtntt.exec:\hhtntt.exe83⤵PID:2760
-
\??\c:\pjpdp.exec:\pjpdp.exe84⤵PID:2616
-
\??\c:\jddpd.exec:\jddpd.exe85⤵PID:2608
-
\??\c:\lffllrx.exec:\lffllrx.exe86⤵PID:2488
-
\??\c:\7frflrx.exec:\7frflrx.exe87⤵PID:2612
-
\??\c:\hhtthb.exec:\hhtthb.exe88⤵PID:2384
-
\??\c:\5tntnb.exec:\5tntnb.exe89⤵PID:1504
-
\??\c:\dpdpd.exec:\dpdpd.exe90⤵PID:1236
-
\??\c:\9dppp.exec:\9dppp.exe91⤵PID:2736
-
\??\c:\rrlxxfl.exec:\rrlxxfl.exe92⤵PID:1020
-
\??\c:\rllxxfx.exec:\rllxxfx.exe93⤵PID:752
-
\??\c:\tnbhnt.exec:\tnbhnt.exe94⤵PID:1008
-
\??\c:\nhhhnn.exec:\nhhhnn.exe95⤵PID:1224
-
\??\c:\9vvvj.exec:\9vvvj.exe96⤵PID:1004
-
\??\c:\vvjpv.exec:\vvjpv.exe97⤵PID:2444
-
\??\c:\rlxfflx.exec:\rlxfflx.exe98⤵PID:2036
-
\??\c:\5frfllx.exec:\5frfllx.exe99⤵PID:1196
-
\??\c:\ttnbht.exec:\ttnbht.exe100⤵PID:2216
-
\??\c:\bhhtth.exec:\bhhtth.exe101⤵PID:1684
-
\??\c:\pjvvd.exec:\pjvvd.exe102⤵PID:2244
-
\??\c:\jvjjj.exec:\jvjjj.exe103⤵PID:1972
-
\??\c:\5lllffr.exec:\5lllffr.exe104⤵PID:1992
-
\??\c:\frfflrx.exec:\frfflrx.exe105⤵PID:1028
-
\??\c:\tttnbb.exec:\tttnbb.exe106⤵PID:804
-
\??\c:\5tnntt.exec:\5tnntt.exe107⤵PID:952
-
\??\c:\5dvvv.exec:\5dvvv.exe108⤵PID:1152
-
\??\c:\5pjvj.exec:\5pjvj.exe109⤵PID:2456
-
\??\c:\xxffrlx.exec:\xxffrlx.exe110⤵PID:760
-
\??\c:\3rffrrf.exec:\3rffrrf.exe111⤵PID:1256
-
\??\c:\tnhnth.exec:\tnhnth.exe112⤵PID:2088
-
\??\c:\7ttbhn.exec:\7ttbhn.exe113⤵PID:2180
-
\??\c:\1vvjd.exec:\1vvjd.exe114⤵PID:1556
-
\??\c:\djpdd.exec:\djpdd.exe115⤵PID:2140
-
\??\c:\1lxffrf.exec:\1lxffrf.exe116⤵PID:872
-
\??\c:\xrxlxfl.exec:\xrxlxfl.exe117⤵PID:2876
-
\??\c:\nhhtbh.exec:\nhhtbh.exe118⤵PID:880
-
\??\c:\7bnntt.exec:\7bnntt.exe119⤵PID:2160
-
\??\c:\tntbhn.exec:\tntbhn.exe120⤵PID:2912
-
\??\c:\dpddj.exec:\dpddj.exe121⤵PID:2304
-
\??\c:\5dvdd.exec:\5dvdd.exe122⤵PID:2692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-