Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
08/06/2024, 00:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7b71bbad467988ce458ab77380548fc0_NeikiAnalytics.exe
Resource
win7-20231129-en
4 signatures
150 seconds
General
- Target 7b71bbad467988ce458ab77380548fc0_NeikiAnalytics.exe
- Size 259KB
- Sample240608-aqws8afd73
- SHA256 916677ee332aa3489c2920233969fcc79bffde2b5b681f01f396c1d5f26d316a
- MD5 7b71bbad467988ce458ab77380548fc0
- SHA1 d235498f39af7973451cefa0521ae6ab2d09ff08
- SHA512 7914996089f280bfb45d03af29158d36c0fdaf2e0cf63266622eca22b8d0d341be1c776bfa26d522dce19e6ec1047b1e2e6fbc42fcc484f47ba31b62de63e381
- SSDEEP 6144:ecm4FmowdHoSF0NowrhraHcpOFltH4t+IDvSXrhJq:A4wFHoSFA1eFp3IDvSbhw
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/672-0-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/672-4-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1892-8-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5052-14-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3260-19-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2892-30-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2484-37-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/768-43-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/640-58-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2364-65-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2900-67-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4396-74-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4140-83-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5044-91-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4620-100-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2480-107-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1040-113-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2424-115-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2424-122-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5036-123-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3824-129-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3792-137-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2988-141-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4352-164-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3808-173-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4840-192-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2748-201-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5032-206-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4228-216-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4320-222-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2888-226-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/232-230-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4940-238-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4536-244-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4920-249-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4988-255-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3008-259-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/888-263-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2196-267-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2028-272-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3028-284-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4396-288-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1068-289-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3644-294-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5116-298-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1492-340-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3420-344-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5040-348-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/432-367-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1724-389-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/856-393-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3376-412-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4368-434-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/648-436-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3932-442-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2408-450-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1068-459-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3116-463-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1904-465-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4500-471-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3656-508-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4328-552-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3488-564-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1848-584-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1892 5lllffx.exe 5052 thtnhh.exe 3260 dpppj.exe 2896 3rrfxxr.exe 2892 hnbtnn.exe 2484 bnnthb.exe 768 5hhbnh.exe 3156 pjppj.exe 640 ddjjj.exe 2364 htbbtt.exe 2900 rxxrfxr.exe 4396 7bbbtb.exe 4140 dvdvj.exe 536 7vvpd.exe 5044 jdpjj.exe 4620 dpjvv.exe 2480 bnnbnt.exe 1040 btnhtt.exe 2424 dpvjv.exe 5036 tbnhtt.exe 3824 ppdvv.exe 3792 rrrlrfr.exe 2988 3lllflf.exe 1688 nbhhbb.exe 2620 pjvpp.exe 3656 frxrffx.exe 4352 nhtnhh.exe 1368 jvpjv.exe 3808 rllfrlf.exe 2344 bntnhb.exe 4392 pjpjd.exe 3520 fxrlrrx.exe 4840 1rllxxr.exe 3392 7hnbtn.exe 2748 9pvpd.exe 1816 xrlfxxx.exe 5032 lffxrlf.exe 1856 hnnnhb.exe 3136 7jpjv.exe 4228 vpvjd.exe 4320 rrxxlff.exe 2888 tnbttn.exe 232 dpdvd.exe 1892 llxrffr.exe 1416 rrlfrrl.exe 4940 tnbbtt.exe 4536 jvddp.exe 4008 9ddpj.exe 4920 5xfxffl.exe 4988 bnbtbt.exe 3008 djdpj.exe 888 fxfxllf.exe 2196 ntbntt.exe 640 7dpjp.exe 2028 dpddd.exe 3928 xlrlxxr.exe 4308 hnbnhh.exe 3028 nnbttn.exe 4396 vpvjj.exe 1068 1rllfll.exe 3644 hbnnhn.exe 5116 5flllxr.exe 1904 tttnhh.exe 2396 btnhhn.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 672 wrote to memory of 1892 672 7b71bbad467988ce458ab77380548fc0_NeikiAnalytics.exe 82 PID 672 wrote to memory of 1892 672 7b71bbad467988ce458ab77380548fc0_NeikiAnalytics.exe 82 PID 672 wrote to memory of 1892 672 7b71bbad467988ce458ab77380548fc0_NeikiAnalytics.exe 82 PID 1892 wrote to memory of 5052 1892 5lllffx.exe 83 PID 1892 wrote to memory of 5052 1892 5lllffx.exe 83 PID 1892 wrote to memory of 5052 1892 5lllffx.exe 83 PID 5052 wrote to memory of 3260 5052 thtnhh.exe 84 PID 5052 wrote to memory of 3260 5052 thtnhh.exe 84 PID 5052 wrote to memory of 3260 5052 thtnhh.exe 84 PID 3260 wrote to memory of 2896 3260 dpppj.exe 85 PID 3260 wrote to memory of 2896 3260 dpppj.exe 85 PID 3260 wrote to memory of 2896 3260 dpppj.exe 85 PID 2896 wrote to memory of 2892 2896 3rrfxxr.exe 86 PID 2896 wrote to memory of 2892 2896 3rrfxxr.exe 86 PID 2896 wrote to memory of 2892 2896 3rrfxxr.exe 86 PID 2892 wrote to memory of 2484 2892 hnbtnn.exe 87 PID 2892 wrote to memory of 2484 2892 hnbtnn.exe 87 PID 2892 wrote to memory of 2484 2892 hnbtnn.exe 87 PID 2484 wrote to memory of 768 2484 bnnthb.exe 88 PID 2484 wrote to memory of 768 2484 bnnthb.exe 88 PID 2484 wrote to memory of 768 2484 bnnthb.exe 88 PID 768 wrote to memory of 3156 768 5hhbnh.exe 89 PID 768 wrote to memory of 3156 768 5hhbnh.exe 89 PID 768 wrote to memory of 3156 768 5hhbnh.exe 89 PID 3156 wrote to memory of 640 3156 pjppj.exe 90 PID 3156 wrote to memory of 640 3156 pjppj.exe 90 PID 3156 wrote to memory of 640 3156 pjppj.exe 90 PID 640 wrote to memory of 2364 640 ddjjj.exe 91 PID 640 wrote to memory of 2364 640 ddjjj.exe 91 PID 640 wrote to memory of 2364 640 ddjjj.exe 91 PID 2364 wrote to memory of 2900 2364 htbbtt.exe 93 PID 2364 wrote to memory of 2900 2364 htbbtt.exe 93 PID 2364 wrote to memory of 2900 2364 htbbtt.exe 93 PID 2900 wrote to memory of 4396 2900 rxxrfxr.exe 94 PID 2900 wrote to memory of 4396 2900 rxxrfxr.exe 94 PID 2900 wrote to memory of 4396 2900 rxxrfxr.exe 94 PID 4396 wrote to memory of 4140 4396 7bbbtb.exe 95 PID 4396 wrote to memory of 4140 4396 7bbbtb.exe 95 PID 4396 wrote to memory of 4140 4396 7bbbtb.exe 95 PID 4140 wrote to memory of 536 4140 dvdvj.exe 96 PID 4140 wrote to memory of 536 4140 dvdvj.exe 96 PID 4140 wrote to memory of 536 4140 dvdvj.exe 96 PID 536 wrote to memory of 5044 536 7vvpd.exe 97 PID 536 wrote to memory of 5044 536 7vvpd.exe 97 PID 536 wrote to memory of 5044 536 7vvpd.exe 97 PID 5044 wrote to memory of 4620 5044 jdpjj.exe 98 PID 5044 wrote to memory of 4620 5044 jdpjj.exe 98 PID 5044 wrote to memory of 4620 5044 jdpjj.exe 98 PID 4620 wrote to memory of 2480 4620 dpjvv.exe 100 PID 4620 wrote to memory of 2480 4620 dpjvv.exe 100 PID 4620 wrote to memory of 2480 4620 dpjvv.exe 100 PID 2480 wrote to memory of 1040 2480 bnnbnt.exe 101 PID 2480 wrote to memory of 1040 2480 bnnbnt.exe 101 PID 2480 wrote to memory of 1040 2480 bnnbnt.exe 101 PID 1040 wrote to memory of 2424 1040 btnhtt.exe 102 PID 1040 wrote to memory of 2424 1040 btnhtt.exe 102 PID 1040 wrote to memory of 2424 1040 btnhtt.exe 102 PID 2424 wrote to memory of 5036 2424 dpvjv.exe 103 PID 2424 wrote to memory of 5036 2424 dpvjv.exe 103 PID 2424 wrote to memory of 5036 2424 dpvjv.exe 103 PID 5036 wrote to memory of 3824 5036 tbnhtt.exe 104 PID 5036 wrote to memory of 3824 5036 tbnhtt.exe 104 PID 5036 wrote to memory of 3824 5036 tbnhtt.exe 104 PID 3824 wrote to memory of 3792 3824 ppdvv.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b71bbad467988ce458ab77380548fc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7b71bbad467988ce458ab77380548fc0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\5lllffx.exec:\5lllffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\thtnhh.exec:\thtnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\dpppj.exec:\dpppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\3rrfxxr.exec:\3rrfxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\hnbtnn.exec:\hnbtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\bnnthb.exec:\bnnthb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\5hhbnh.exec:\5hhbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\pjppj.exec:\pjppj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\ddjjj.exec:\ddjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\htbbtt.exec:\htbbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\rxxrfxr.exec:\rxxrfxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\7bbbtb.exec:\7bbbtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\dvdvj.exec:\dvdvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\7vvpd.exec:\7vvpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\jdpjj.exec:\jdpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\dpjvv.exec:\dpjvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\bnnbnt.exec:\bnnbnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\btnhtt.exec:\btnhtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\dpvjv.exec:\dpvjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\tbnhtt.exec:\tbnhtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\ppdvv.exec:\ppdvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\rrrlrfr.exec:\rrrlrfr.exe23⤵
- Executes dropped EXE
PID:3792 -
\??\c:\3lllflf.exec:\3lllflf.exe24⤵
- Executes dropped EXE
PID:2988 -
\??\c:\nbhhbb.exec:\nbhhbb.exe25⤵
- Executes dropped EXE
PID:1688 -
\??\c:\pjvpp.exec:\pjvpp.exe26⤵
- Executes dropped EXE
PID:2620 -
\??\c:\frxrffx.exec:\frxrffx.exe27⤵
- Executes dropped EXE
PID:3656 -
\??\c:\nhtnhh.exec:\nhtnhh.exe28⤵
- Executes dropped EXE
PID:4352 -
\??\c:\jvpjv.exec:\jvpjv.exe29⤵
- Executes dropped EXE
PID:1368 -
\??\c:\rllfrlf.exec:\rllfrlf.exe30⤵
- Executes dropped EXE
PID:3808 -
\??\c:\bntnhb.exec:\bntnhb.exe31⤵
- Executes dropped EXE
PID:2344 -
\??\c:\pjpjd.exec:\pjpjd.exe32⤵
- Executes dropped EXE
PID:4392 -
\??\c:\fxrlrrx.exec:\fxrlrrx.exe33⤵
- Executes dropped EXE
PID:3520 -
\??\c:\1rllxxr.exec:\1rllxxr.exe34⤵
- Executes dropped EXE
PID:4840 -
\??\c:\7hnbtn.exec:\7hnbtn.exe35⤵
- Executes dropped EXE
PID:3392 -
\??\c:\9pvpd.exec:\9pvpd.exe36⤵
- Executes dropped EXE
PID:2748 -
\??\c:\xrlfxxx.exec:\xrlfxxx.exe37⤵
- Executes dropped EXE
PID:1816 -
\??\c:\lffxrlf.exec:\lffxrlf.exe38⤵
- Executes dropped EXE
PID:5032 -
\??\c:\hnnnhb.exec:\hnnnhb.exe39⤵
- Executes dropped EXE
PID:1856 -
\??\c:\7jpjv.exec:\7jpjv.exe40⤵
- Executes dropped EXE
PID:3136 -
\??\c:\vpvjd.exec:\vpvjd.exe41⤵
- Executes dropped EXE
PID:4228 -
\??\c:\rrxxlff.exec:\rrxxlff.exe42⤵
- Executes dropped EXE
PID:4320 -
\??\c:\tnbttn.exec:\tnbttn.exe43⤵
- Executes dropped EXE
PID:2888 -
\??\c:\dpdvd.exec:\dpdvd.exe44⤵
- Executes dropped EXE
PID:232 -
\??\c:\llxrffr.exec:\llxrffr.exe45⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rrlfrrl.exec:\rrlfrrl.exe46⤵
- Executes dropped EXE
PID:1416 -
\??\c:\tnbbtt.exec:\tnbbtt.exe47⤵
- Executes dropped EXE
PID:4940 -
\??\c:\jvddp.exec:\jvddp.exe48⤵
- Executes dropped EXE
PID:4536 -
\??\c:\9ddpj.exec:\9ddpj.exe49⤵
- Executes dropped EXE
PID:4008 -
\??\c:\5xfxffl.exec:\5xfxffl.exe50⤵
- Executes dropped EXE
PID:4920 -
\??\c:\bnbtbt.exec:\bnbtbt.exe51⤵
- Executes dropped EXE
PID:4988 -
\??\c:\djdpj.exec:\djdpj.exe52⤵
- Executes dropped EXE
PID:3008 -
\??\c:\fxfxllf.exec:\fxfxllf.exe53⤵
- Executes dropped EXE
PID:888 -
\??\c:\ntbntt.exec:\ntbntt.exe54⤵
- Executes dropped EXE
PID:2196 -
\??\c:\7dpjp.exec:\7dpjp.exe55⤵
- Executes dropped EXE
PID:640 -
\??\c:\dpddd.exec:\dpddd.exe56⤵
- Executes dropped EXE
PID:2028 -
\??\c:\xlrlxxr.exec:\xlrlxxr.exe57⤵
- Executes dropped EXE
PID:3928 -
\??\c:\hnbnhh.exec:\hnbnhh.exe58⤵
- Executes dropped EXE
PID:4308 -
\??\c:\nnbttn.exec:\nnbttn.exe59⤵
- Executes dropped EXE
PID:3028 -
\??\c:\vpvjj.exec:\vpvjj.exe60⤵
- Executes dropped EXE
PID:4396 -
\??\c:\1rllfll.exec:\1rllfll.exe61⤵
- Executes dropped EXE
PID:1068 -
\??\c:\hbnnhn.exec:\hbnnhn.exe62⤵
- Executes dropped EXE
PID:3644 -
\??\c:\5flllxr.exec:\5flllxr.exe63⤵
- Executes dropped EXE
PID:5116 -
\??\c:\tttnhh.exec:\tttnhh.exe64⤵
- Executes dropped EXE
PID:1904 -
\??\c:\btnhhn.exec:\btnhhn.exe65⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vvvvp.exec:\vvvvp.exe66⤵PID:4800
-
\??\c:\lxlrffr.exec:\lxlrffr.exe67⤵PID:3856
-
\??\c:\ttbthn.exec:\ttbthn.exe68⤵PID:3944
-
\??\c:\pdjjd.exec:\pdjjd.exe69⤵PID:2160
-
\??\c:\1jpdv.exec:\1jpdv.exe70⤵PID:5036
-
\??\c:\lxlxffx.exec:\lxlxffx.exe71⤵PID:684
-
\??\c:\pvdvp.exec:\pvdvp.exe72⤵PID:4468
-
\??\c:\pddvv.exec:\pddvv.exe73⤵PID:948
-
\??\c:\lfffrrl.exec:\lfffrrl.exe74⤵PID:644
-
\??\c:\7rrxllr.exec:\7rrxllr.exe75⤵PID:4420
-
\??\c:\hhtnhh.exec:\hhtnhh.exe76⤵PID:1492
-
\??\c:\jpddv.exec:\jpddv.exe77⤵PID:3420
-
\??\c:\pddvj.exec:\pddvj.exe78⤵PID:5040
-
\??\c:\bbthtn.exec:\bbthtn.exe79⤵PID:3656
-
\??\c:\5bbtnt.exec:\5bbtnt.exe80⤵PID:964
-
\??\c:\3vdvp.exec:\3vdvp.exe81⤵PID:1028
-
\??\c:\3xlxxxl.exec:\3xlxxxl.exe82⤵PID:3660
-
\??\c:\hbbtnn.exec:\hbbtnn.exe83⤵PID:2268
-
\??\c:\ttbtnn.exec:\ttbtnn.exe84⤵PID:432
-
\??\c:\pjjjd.exec:\pjjjd.exe85⤵PID:3172
-
\??\c:\5rlxxxr.exec:\5rlxxxr.exe86⤵PID:3972
-
\??\c:\xfffxxf.exec:\xfffxxf.exe87⤵PID:4424
-
\??\c:\1hhttt.exec:\1hhttt.exe88⤵PID:3692
-
\??\c:\bnbnhh.exec:\bnbnhh.exe89⤵PID:2200
-
\??\c:\pppjv.exec:\pppjv.exe90⤵PID:3076
-
\??\c:\5ddvp.exec:\5ddvp.exe91⤵PID:1724
-
\??\c:\xfxrlxr.exec:\xfxrlxr.exe92⤵PID:856
-
\??\c:\nbhbtt.exec:\nbhbtt.exe93⤵PID:808
-
\??\c:\vpvjv.exec:\vpvjv.exe94⤵PID:4324
-
\??\c:\rllrlxx.exec:\rllrlxx.exe95⤵PID:208
-
\??\c:\nbttnt.exec:\nbttnt.exe96⤵PID:4320
-
\??\c:\httbbt.exec:\httbbt.exe97⤵PID:1404
-
\??\c:\pvvjd.exec:\pvvjd.exe98⤵PID:3376
-
\??\c:\7lrlflf.exec:\7lrlflf.exe99⤵PID:4752
-
\??\c:\hbnhbt.exec:\hbnhbt.exe100⤵PID:3260
-
\??\c:\vddpv.exec:\vddpv.exe101⤵PID:760
-
\??\c:\jvvjd.exec:\jvvjd.exe102⤵PID:2896
-
\??\c:\rrxxrrl.exec:\rrxxrrl.exe103⤵PID:3568
-
\??\c:\3llflrl.exec:\3llflrl.exe104⤵PID:1520
-
\??\c:\tnhbtt.exec:\tnhbtt.exe105⤵PID:4368
-
\??\c:\3pdvv.exec:\3pdvv.exe106⤵PID:648
-
\??\c:\vvvvp.exec:\vvvvp.exe107⤵PID:4532
-
\??\c:\lxrlllf.exec:\lxrlllf.exe108⤵PID:3932
-
\??\c:\bbnhnt.exec:\bbnhnt.exe109⤵PID:5108
-
\??\c:\bnhbtn.exec:\bnhbtn.exe110⤵PID:2408
-
\??\c:\djpjd.exec:\djpjd.exe111⤵PID:4736
-
\??\c:\vdjdv.exec:\vdjdv.exe112⤵PID:1068
-
\??\c:\rffrxxr.exec:\rffrxxr.exe113⤵PID:3116
-
\??\c:\ntbbtt.exec:\ntbbtt.exe114⤵PID:1904
-
\??\c:\3nhnbn.exec:\3nhnbn.exe115⤵PID:4500
-
\??\c:\3ddjv.exec:\3ddjv.exe116⤵PID:3084
-
\??\c:\xxffxxr.exec:\xxffxxr.exe117⤵PID:2424
-
\??\c:\bbbtnn.exec:\bbbtnn.exe118⤵PID:4408
-
\??\c:\jvdvp.exec:\jvdvp.exe119⤵PID:1676
-
\??\c:\pppjv.exec:\pppjv.exe120⤵PID:1080
-
\??\c:\rxlfrxx.exec:\rxlfrxx.exe121⤵PID:4336
-
\??\c:\9rrrllx.exec:\9rrrllx.exe122⤵PID:2140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-