Analysis
- max time kernel
150s - max time network
55s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
22/06/2024, 01:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
757edf38c3f3120c1a931ead6ea328c6c95b8a82b46d04be9fc4cdf2551a1ba8_NeikiAnalytics.exe
Resource
win7-20240611-en
5 signatures
150 seconds
General
- Target 757edf38c3f3120c1a931ead6ea328c6c95b8a82b46d04be9fc4cdf2551a1ba8_NeikiAnalytics.exe
- Size 65KB
- Sample240622-bj8d4stfmp
- SHA256 757edf38c3f3120c1a931ead6ea328c6c95b8a82b46d04be9fc4cdf2551a1ba8
- MD5 580c4baa2148d8d6eb24b066632d9e00
- SHA1 660944b60f971d667207cd1a9815d2ea70c2e136
- SHA512 dcb8f5f8f44fa0955f3461c9169506d49af2a04c0923c4bf0b87f4d7d6ddc61b0715570df97316e3bcf176feb425a28f670f09547086fad7d0a0f8aff69f3842
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJULh12VO6:ymb3NkkiQ3mdBjFIFdJmmO6
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/228-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1788-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1788-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/756-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1384 5btbbh.exe 2920 jdjjd.exe 1524 rxfxrrl.exe 2408 bbtbtb.exe 3284 nhbthh.exe 3628 jjppp.exe 1788 xrxxxxr.exe 1688 jpjjj.exe 2008 lrfffxx.exe 1444 nnhhbb.exe 1272 pdjjp.exe 1540 rllllrf.exe 4120 bnttnn.exe 4036 vdddv.exe 2308 xxfflrr.exe 4052 bnnhhh.exe 756 jvvvj.exe 3432 fxxrlll.exe 2980 bhtnhh.exe 3652 lfxrxxf.exe 4956 tnbbtt.exe 4416 pppjd.exe 3172 fxrrrxx.exe 4768 bnhbtt.exe 1188 dddjj.exe 2752 fflfxxx.exe 2612 ttttnt.exe 60 3hnntt.exe 4104 dvddd.exe 4564 hbtnbh.exe 4912 vjvpd.exe 1968 jjppj.exe 2684 1lrrlrl.exe 4664 nnhbbt.exe 1772 3httnh.exe 3904 lfxrfff.exe 528 xffxxxl.exe 4948 tnhtnn.exe 2740 vpvdv.exe 2028 jjjjd.exe 3864 xffxxxr.exe 4352 1hnhbb.exe 4904 jvvvj.exe 1320 vpvpj.exe 1128 xxlxllf.exe 4672 7bbbtt.exe 532 7vpjv.exe 3464 xrfxrxr.exe 4408 xlxrxxr.exe 228 3thhbb.exe 216 dppjp.exe 2072 rrllxxx.exe 2920 rxlfffx.exe 3568 bbbbbb.exe 4648 3bhbhh.exe 3632 vpjdd.exe 4436 vvppj.exe 1336 xfxxrxl.exe 3156 htttnn.exe 3408 jpddp.exe 2480 jpvpd.exe 1688 lrxrlxr.exe 2388 7jjdv.exe 1176 3ddvp.exe -
resource yara_rule behavioral2/memory/228-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/756-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-204-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 228 wrote to memory of 1384 228 757edf38c3f3120c1a931ead6ea328c6c95b8a82b46d04be9fc4cdf2551a1ba8_NeikiAnalytics.exe 81 PID 228 wrote to memory of 1384 228 757edf38c3f3120c1a931ead6ea328c6c95b8a82b46d04be9fc4cdf2551a1ba8_NeikiAnalytics.exe 81 PID 228 wrote to memory of 1384 228 757edf38c3f3120c1a931ead6ea328c6c95b8a82b46d04be9fc4cdf2551a1ba8_NeikiAnalytics.exe 81 PID 1384 wrote to memory of 2920 1384 5btbbh.exe 82 PID 1384 wrote to memory of 2920 1384 5btbbh.exe 82 PID 1384 wrote to memory of 2920 1384 5btbbh.exe 82 PID 2920 wrote to memory of 1524 2920 jdjjd.exe 83 PID 2920 wrote to memory of 1524 2920 jdjjd.exe 83 PID 2920 wrote to memory of 1524 2920 jdjjd.exe 83 PID 1524 wrote to memory of 2408 1524 rxfxrrl.exe 84 PID 1524 wrote to memory of 2408 1524 rxfxrrl.exe 84 PID 1524 wrote to memory of 2408 1524 rxfxrrl.exe 84 PID 2408 wrote to memory of 3284 2408 bbtbtb.exe 85 PID 2408 wrote to memory of 3284 2408 bbtbtb.exe 85 PID 2408 wrote to memory of 3284 2408 bbtbtb.exe 85 PID 3284 wrote to memory of 3628 3284 nhbthh.exe 86 PID 3284 wrote to memory of 3628 3284 nhbthh.exe 86 PID 3284 wrote to memory of 3628 3284 nhbthh.exe 86 PID 3628 wrote to memory of 1788 3628 jjppp.exe 87 PID 3628 wrote to memory of 1788 3628 jjppp.exe 87 PID 3628 wrote to memory of 1788 3628 jjppp.exe 87 PID 1788 wrote to memory of 1688 1788 xrxxxxr.exe 88 PID 1788 wrote to memory of 1688 1788 xrxxxxr.exe 88 PID 1788 wrote to memory of 1688 1788 xrxxxxr.exe 88 PID 1688 wrote to memory of 2008 1688 jpjjj.exe 89 PID 1688 wrote to memory of 2008 1688 jpjjj.exe 89 PID 1688 wrote to memory of 2008 1688 jpjjj.exe 89 PID 2008 wrote to memory of 1444 2008 lrfffxx.exe 90 PID 2008 wrote to memory of 1444 2008 lrfffxx.exe 90 PID 2008 wrote to memory of 1444 2008 lrfffxx.exe 90 PID 1444 wrote to memory of 1272 1444 nnhhbb.exe 91 PID 1444 wrote to memory of 1272 1444 nnhhbb.exe 91 PID 1444 wrote to memory of 1272 1444 nnhhbb.exe 91 PID 1272 wrote to memory of 1540 1272 pdjjp.exe 92 PID 1272 wrote to memory of 1540 1272 pdjjp.exe 92 PID 1272 wrote to memory of 1540 1272 pdjjp.exe 92 PID 1540 wrote to memory of 4120 1540 rllllrf.exe 93 PID 1540 wrote to memory of 4120 1540 rllllrf.exe 93 PID 1540 wrote to memory of 4120 1540 rllllrf.exe 93 PID 4120 wrote to memory of 4036 4120 bnttnn.exe 94 PID 4120 wrote to memory of 4036 4120 bnttnn.exe 94 PID 4120 wrote to memory of 4036 4120 bnttnn.exe 94 PID 4036 wrote to memory of 2308 4036 vdddv.exe 95 PID 4036 wrote to memory of 2308 4036 vdddv.exe 95 PID 4036 wrote to memory of 2308 4036 vdddv.exe 95 PID 2308 wrote to memory of 4052 2308 xxfflrr.exe 96 PID 2308 wrote to memory of 4052 2308 xxfflrr.exe 96 PID 2308 wrote to memory of 4052 2308 xxfflrr.exe 96 PID 4052 wrote to memory of 756 4052 bnnhhh.exe 97 PID 4052 wrote to memory of 756 4052 bnnhhh.exe 97 PID 4052 wrote to memory of 756 4052 bnnhhh.exe 97 PID 756 wrote to memory of 3432 756 jvvvj.exe 98 PID 756 wrote to memory of 3432 756 jvvvj.exe 98 PID 756 wrote to memory of 3432 756 jvvvj.exe 98 PID 3432 wrote to memory of 2980 3432 fxxrlll.exe 99 PID 3432 wrote to memory of 2980 3432 fxxrlll.exe 99 PID 3432 wrote to memory of 2980 3432 fxxrlll.exe 99 PID 2980 wrote to memory of 3652 2980 bhtnhh.exe 100 PID 2980 wrote to memory of 3652 2980 bhtnhh.exe 100 PID 2980 wrote to memory of 3652 2980 bhtnhh.exe 100 PID 3652 wrote to memory of 4956 3652 lfxrxxf.exe 101 PID 3652 wrote to memory of 4956 3652 lfxrxxf.exe 101 PID 3652 wrote to memory of 4956 3652 lfxrxxf.exe 101 PID 4956 wrote to memory of 4416 4956 tnbbtt.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\757edf38c3f3120c1a931ead6ea328c6c95b8a82b46d04be9fc4cdf2551a1ba8_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\757edf38c3f3120c1a931ead6ea328c6c95b8a82b46d04be9fc4cdf2551a1ba8_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\5btbbh.exec:\5btbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\jdjjd.exec:\jdjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\rxfxrrl.exec:\rxfxrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\bbtbtb.exec:\bbtbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\nhbthh.exec:\nhbthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\jjppp.exec:\jjppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\xrxxxxr.exec:\xrxxxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\jpjjj.exec:\jpjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\lrfffxx.exec:\lrfffxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\nnhhbb.exec:\nnhhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\pdjjp.exec:\pdjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\rllllrf.exec:\rllllrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\bnttnn.exec:\bnttnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\vdddv.exec:\vdddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\xxfflrr.exec:\xxfflrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\bnnhhh.exec:\bnnhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\jvvvj.exec:\jvvvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\fxxrlll.exec:\fxxrlll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\bhtnhh.exec:\bhtnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\lfxrxxf.exec:\lfxrxxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\tnbbtt.exec:\tnbbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\pppjd.exec:\pppjd.exe23⤵
- Executes dropped EXE
PID:4416 -
\??\c:\fxrrrxx.exec:\fxrrrxx.exe24⤵
- Executes dropped EXE
PID:3172 -
\??\c:\bnhbtt.exec:\bnhbtt.exe25⤵
- Executes dropped EXE
PID:4768 -
\??\c:\dddjj.exec:\dddjj.exe26⤵
- Executes dropped EXE
PID:1188 -
\??\c:\fflfxxx.exec:\fflfxxx.exe27⤵
- Executes dropped EXE
PID:2752 -
\??\c:\ttttnt.exec:\ttttnt.exe28⤵
- Executes dropped EXE
PID:2612 -
\??\c:\3hnntt.exec:\3hnntt.exe29⤵
- Executes dropped EXE
PID:60 -
\??\c:\dvddd.exec:\dvddd.exe30⤵
- Executes dropped EXE
PID:4104 -
\??\c:\hbtnbh.exec:\hbtnbh.exe31⤵
- Executes dropped EXE
PID:4564 -
\??\c:\vjvpd.exec:\vjvpd.exe32⤵
- Executes dropped EXE
PID:4912 -
\??\c:\jjppj.exec:\jjppj.exe33⤵
- Executes dropped EXE
PID:1968 -
\??\c:\1lrrlrl.exec:\1lrrlrl.exe34⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nnhbbt.exec:\nnhbbt.exe35⤵
- Executes dropped EXE
PID:4664 -
\??\c:\3httnh.exec:\3httnh.exe36⤵
- Executes dropped EXE
PID:1772 -
\??\c:\lfxrfff.exec:\lfxrfff.exe37⤵
- Executes dropped EXE
PID:3904 -
\??\c:\xffxxxl.exec:\xffxxxl.exe38⤵
- Executes dropped EXE
PID:528 -
\??\c:\tnhtnn.exec:\tnhtnn.exe39⤵
- Executes dropped EXE
PID:4948 -
\??\c:\vpvdv.exec:\vpvdv.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\jjjjd.exec:\jjjjd.exe41⤵
- Executes dropped EXE
PID:2028 -
\??\c:\xffxxxr.exec:\xffxxxr.exe42⤵
- Executes dropped EXE
PID:3864 -
\??\c:\1hnhbb.exec:\1hnhbb.exe43⤵
- Executes dropped EXE
PID:4352 -
\??\c:\jvvvj.exec:\jvvvj.exe44⤵
- Executes dropped EXE
PID:4904 -
\??\c:\vpvpj.exec:\vpvpj.exe45⤵
- Executes dropped EXE
PID:1320 -
\??\c:\xxlxllf.exec:\xxlxllf.exe46⤵
- Executes dropped EXE
PID:1128 -
\??\c:\7bbbtt.exec:\7bbbtt.exe47⤵
- Executes dropped EXE
PID:4672 -
\??\c:\7vpjv.exec:\7vpjv.exe48⤵
- Executes dropped EXE
PID:532 -
\??\c:\xrfxrxr.exec:\xrfxrxr.exe49⤵
- Executes dropped EXE
PID:3464 -
\??\c:\xlxrxxr.exec:\xlxrxxr.exe50⤵
- Executes dropped EXE
PID:4408 -
\??\c:\3thhbb.exec:\3thhbb.exe51⤵
- Executes dropped EXE
PID:228 -
\??\c:\dppjp.exec:\dppjp.exe52⤵
- Executes dropped EXE
PID:216 -
\??\c:\rrllxxx.exec:\rrllxxx.exe53⤵
- Executes dropped EXE
PID:2072 -
\??\c:\rxlfffx.exec:\rxlfffx.exe54⤵
- Executes dropped EXE
PID:2920 -
\??\c:\bbbbbb.exec:\bbbbbb.exe55⤵
- Executes dropped EXE
PID:3568 -
\??\c:\3bhbhh.exec:\3bhbhh.exe56⤵
- Executes dropped EXE
PID:4648 -
\??\c:\vpjdd.exec:\vpjdd.exe57⤵
- Executes dropped EXE
PID:3632 -
\??\c:\vvppj.exec:\vvppj.exe58⤵
- Executes dropped EXE
PID:4436 -
\??\c:\xfxxrxl.exec:\xfxxrxl.exe59⤵
- Executes dropped EXE
PID:1336 -
\??\c:\htttnn.exec:\htttnn.exe60⤵
- Executes dropped EXE
PID:3156 -
\??\c:\jpddp.exec:\jpddp.exe61⤵
- Executes dropped EXE
PID:3408 -
\??\c:\jpvpd.exec:\jpvpd.exe62⤵
- Executes dropped EXE
PID:2480 -
\??\c:\lrxrlxr.exec:\lrxrlxr.exe63⤵
- Executes dropped EXE
PID:1688 -
\??\c:\7jjdv.exec:\7jjdv.exe64⤵
- Executes dropped EXE
PID:2388 -
\??\c:\3ddvp.exec:\3ddvp.exe65⤵
- Executes dropped EXE
PID:1176 -
\??\c:\frfxxxl.exec:\frfxxxl.exe66⤵PID:1444
-
\??\c:\1fffxxr.exec:\1fffxxr.exe67⤵PID:1808
-
\??\c:\bhnnhh.exec:\bhnnhh.exe68⤵PID:4108
-
\??\c:\vvddv.exec:\vvddv.exe69⤵PID:1660
-
\??\c:\dpdpv.exec:\dpdpv.exe70⤵PID:4080
-
\??\c:\lffxrrr.exec:\lffxrrr.exe71⤵PID:2816
-
\??\c:\hhbbht.exec:\hhbbht.exe72⤵PID:4916
-
\??\c:\tnnhbb.exec:\tnnhbb.exe73⤵PID:5104
-
\??\c:\dvjjp.exec:\dvjjp.exe74⤵PID:5096
-
\??\c:\9pvvp.exec:\9pvvp.exe75⤵PID:3152
-
\??\c:\fxfffxf.exec:\fxfffxf.exe76⤵PID:4276
-
\??\c:\tnnttt.exec:\tnnttt.exe77⤵PID:3240
-
\??\c:\dvjdp.exec:\dvjdp.exe78⤵PID:808
-
\??\c:\ddjdd.exec:\ddjdd.exe79⤵PID:4400
-
\??\c:\5lrlxxr.exec:\5lrlxxr.exe80⤵PID:1792
-
\??\c:\7hhhbb.exec:\7hhhbb.exe81⤵PID:1784
-
\??\c:\tntnbb.exec:\tntnbb.exe82⤵PID:4896
-
\??\c:\vppdv.exec:\vppdv.exe83⤵PID:920
-
\??\c:\vpjdd.exec:\vpjdd.exe84⤵PID:3172
-
\??\c:\xxrfffx.exec:\xxrfffx.exe85⤵PID:3196
-
\??\c:\rlffffx.exec:\rlffffx.exe86⤵PID:220
-
\??\c:\nhnntn.exec:\nhnntn.exe87⤵PID:2228
-
\??\c:\vjdjj.exec:\vjdjj.exe88⤵PID:2128
-
\??\c:\xxfxrlf.exec:\xxfxrlf.exe89⤵PID:3300
-
\??\c:\9fxrllx.exec:\9fxrllx.exe90⤵PID:400
-
\??\c:\1tbthh.exec:\1tbthh.exe91⤵PID:1740
-
\??\c:\thhbhh.exec:\thhbhh.exe92⤵PID:3500
-
\??\c:\vvpjp.exec:\vvpjp.exe93⤵PID:2044
-
\??\c:\rxfxxll.exec:\rxfxxll.exe94⤵PID:3908
-
\??\c:\lfllxll.exec:\lfllxll.exe95⤵PID:3788
-
\??\c:\bbttnn.exec:\bbttnn.exe96⤵PID:2684
-
\??\c:\1jpjd.exec:\1jpjd.exe97⤵PID:448
-
\??\c:\dddvp.exec:\dddvp.exe98⤵PID:1772
-
\??\c:\9frlrrl.exec:\9frlrrl.exe99⤵PID:3904
-
\??\c:\rxllffx.exec:\rxllffx.exe100⤵PID:5052
-
\??\c:\nbtbhn.exec:\nbtbhn.exe101⤵PID:3584
-
\??\c:\hbnhnh.exec:\hbnhnh.exe102⤵PID:1096
-
\??\c:\vdjdv.exec:\vdjdv.exe103⤵PID:4032
-
\??\c:\3rxlfrl.exec:\3rxlfrl.exe104⤵PID:3860
-
\??\c:\xlllfxx.exec:\xlllfxx.exe105⤵PID:944
-
\??\c:\hbnntn.exec:\hbnntn.exe106⤵PID:2556
-
\??\c:\nhbtnn.exec:\nhbtnn.exe107⤵PID:2552
-
\??\c:\jvvpj.exec:\jvvpj.exe108⤵PID:4868
-
\??\c:\9rfrffr.exec:\9rfrffr.exe109⤵PID:4576
-
\??\c:\httttt.exec:\httttt.exe110⤵PID:2644
-
\??\c:\ttbtnn.exec:\ttbtnn.exe111⤵PID:4924
-
\??\c:\jvvpd.exec:\jvvpd.exe112⤵PID:4516
-
\??\c:\rflxrlf.exec:\rflxrlf.exe113⤵PID:3084
-
\??\c:\xlrllff.exec:\xlrllff.exe114⤵PID:1384
-
\??\c:\rrxllll.exec:\rrxllll.exe115⤵PID:3260
-
\??\c:\nbhbnn.exec:\nbhbnn.exe116⤵PID:1380
-
\??\c:\htbthh.exec:\htbthh.exe117⤵PID:1284
-
\??\c:\7jpjd.exec:\7jpjd.exe118⤵PID:1612
-
\??\c:\lfffrlf.exec:\lfffrlf.exe119⤵PID:4208
-
\??\c:\tnnhbn.exec:\tnnhbn.exe120⤵PID:2032
-
\??\c:\nbtnnh.exec:\nbtnnh.exe121⤵PID:3608
-
\??\c:\jdjdd.exec:\jdjdd.exe122⤵PID:900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-