Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 22:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1d6fd8a4089a9e08a7b7d16886336cf0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1d6fd8a4089a9e08a7b7d16886336cf0_NeikiAnalytics.exe
-
Size
387KB
-
MD5
1d6fd8a4089a9e08a7b7d16886336cf0
-
SHA1
89f85c831c905b774bbc16b9ad0ba81662c6f213
-
SHA256
8885e8737714d141d4da35e0238d0e4c3ff05e0766af7b39c553ccd7f63fc917
-
SHA512
24ee3df09b2a43209e2c1380c003ad8ed726481be7b616c6fc2ef989cbcc96b2788a2c54f6c953ca5929f2964774f264b4306f096934a4c041266b2b899b940d
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVw0:n3C9uYA7okVqdKwaO5CVt
Malware Config
Signatures
-
Detect Blackmoon payload 35 IoCs
resource yara_rule behavioral2/memory/3836-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1440-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/848-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1964-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/788-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/472-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-83-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2380-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-76-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-69-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/896-61-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/896-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-54-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/848-46-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4696-39-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4696-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 392 flxflxf.exe 2068 fxxxxff.exe 1440 rlrxflr.exe 4696 ppppp.exe 848 pjpvj.exe 368 284820.exe 896 202200.exe 852 u466004.exe 644 xrlrxlr.exe 2380 06404.exe 3844 206048.exe 4064 vjvpj.exe 1580 246222.exe 2400 60266.exe 1964 48806.exe 2748 200482.exe 2032 8288226.exe 2840 tnhnbh.exe 64 nbthnh.exe 4640 4666666.exe 2388 tnbhhn.exe 920 460246.exe 1088 404246.exe 4212 9jjjj.exe 472 ddddv.exe 2768 nhbbtt.exe 2132 62448.exe 1012 04482.exe 4772 00820.exe 788 5rrlllf.exe 3972 3dpjd.exe 4000 6280460.exe 1620 a2826.exe 4296 008280.exe 4928 824044.exe 4768 fflxrrx.exe 4084 468280.exe 2688 lffxxrl.exe 4476 44248.exe 3584 pvvdd.exe 2168 nbttnh.exe 4784 808806.exe 2144 3rxrrrl.exe 1724 222600.exe 208 jdjvd.exe 1220 02464.exe 2428 pvjdd.exe 4020 jjpjp.exe 4312 2682800.exe 5104 hbbttn.exe 848 lffxrrf.exe 2252 088282.exe 4136 bnbbtt.exe 4320 bbbhhh.exe 4132 04882.exe 2780 484826.exe 3472 04004.exe 1580 6486280.exe 2608 464488.exe 3488 vvdvv.exe 2748 840008.exe 2032 8264264.exe 5076 w24848.exe 4588 jjvvp.exe -
resource yara_rule behavioral2/memory/3836-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1440-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/848-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/644-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1964-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/788-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/472-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3844-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/852-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/896-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-38-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3836 wrote to memory of 392 3836 1d6fd8a4089a9e08a7b7d16886336cf0_NeikiAnalytics.exe 83 PID 3836 wrote to memory of 392 3836 1d6fd8a4089a9e08a7b7d16886336cf0_NeikiAnalytics.exe 83 PID 3836 wrote to memory of 392 3836 1d6fd8a4089a9e08a7b7d16886336cf0_NeikiAnalytics.exe 83 PID 392 wrote to memory of 2068 392 flxflxf.exe 84 PID 392 wrote to memory of 2068 392 flxflxf.exe 84 PID 392 wrote to memory of 2068 392 flxflxf.exe 84 PID 2068 wrote to memory of 1440 2068 fxxxxff.exe 85 PID 2068 wrote to memory of 1440 2068 fxxxxff.exe 85 PID 2068 wrote to memory of 1440 2068 fxxxxff.exe 85 PID 1440 wrote to memory of 4696 1440 rlrxflr.exe 86 PID 1440 wrote to memory of 4696 1440 rlrxflr.exe 86 PID 1440 wrote to memory of 4696 1440 rlrxflr.exe 86 PID 4696 wrote to memory of 848 4696 ppppp.exe 87 PID 4696 wrote to memory of 848 4696 ppppp.exe 87 PID 4696 wrote to memory of 848 4696 ppppp.exe 87 PID 848 wrote to memory of 368 848 pjpvj.exe 88 PID 848 wrote to memory of 368 848 pjpvj.exe 88 PID 848 wrote to memory of 368 848 pjpvj.exe 88 PID 368 wrote to memory of 896 368 284820.exe 89 PID 368 wrote to memory of 896 368 284820.exe 89 PID 368 wrote to memory of 896 368 284820.exe 89 PID 896 wrote to memory of 852 896 202200.exe 90 PID 896 wrote to memory of 852 896 202200.exe 90 PID 896 wrote to memory of 852 896 202200.exe 90 PID 852 wrote to memory of 644 852 u466004.exe 91 PID 852 wrote to memory of 644 852 u466004.exe 91 PID 852 wrote to memory of 644 852 u466004.exe 91 PID 644 wrote to memory of 2380 644 xrlrxlr.exe 92 PID 644 wrote to memory of 2380 644 xrlrxlr.exe 92 PID 644 wrote to memory of 2380 644 xrlrxlr.exe 92 PID 2380 wrote to memory of 3844 2380 06404.exe 93 PID 2380 wrote to memory of 3844 2380 06404.exe 93 PID 2380 wrote to memory of 3844 2380 06404.exe 93 PID 3844 wrote to memory of 4064 3844 206048.exe 94 PID 3844 wrote to memory of 4064 3844 206048.exe 94 PID 3844 wrote to memory of 4064 3844 206048.exe 94 PID 4064 wrote to memory of 1580 4064 vjvpj.exe 95 PID 4064 wrote to memory of 1580 4064 vjvpj.exe 95 PID 4064 wrote to memory of 1580 4064 vjvpj.exe 95 PID 1580 wrote to memory of 2400 1580 246222.exe 96 PID 1580 wrote to memory of 2400 1580 246222.exe 96 PID 1580 wrote to memory of 2400 1580 246222.exe 96 PID 2400 wrote to memory of 1964 2400 60266.exe 97 PID 2400 wrote to memory of 1964 2400 60266.exe 97 PID 2400 wrote to memory of 1964 2400 60266.exe 97 PID 1964 wrote to memory of 2748 1964 48806.exe 98 PID 1964 wrote to memory of 2748 1964 48806.exe 98 PID 1964 wrote to memory of 2748 1964 48806.exe 98 PID 2748 wrote to memory of 2032 2748 200482.exe 144 PID 2748 wrote to memory of 2032 2748 200482.exe 144 PID 2748 wrote to memory of 2032 2748 200482.exe 144 PID 2032 wrote to memory of 2840 2032 8288226.exe 100 PID 2032 wrote to memory of 2840 2032 8288226.exe 100 PID 2032 wrote to memory of 2840 2032 8288226.exe 100 PID 2840 wrote to memory of 64 2840 tnhnbh.exe 101 PID 2840 wrote to memory of 64 2840 tnhnbh.exe 101 PID 2840 wrote to memory of 64 2840 tnhnbh.exe 101 PID 64 wrote to memory of 4640 64 nbthnh.exe 102 PID 64 wrote to memory of 4640 64 nbthnh.exe 102 PID 64 wrote to memory of 4640 64 nbthnh.exe 102 PID 4640 wrote to memory of 2388 4640 4666666.exe 103 PID 4640 wrote to memory of 2388 4640 4666666.exe 103 PID 4640 wrote to memory of 2388 4640 4666666.exe 103 PID 2388 wrote to memory of 920 2388 tnbhhn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d6fd8a4089a9e08a7b7d16886336cf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1d6fd8a4089a9e08a7b7d16886336cf0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\flxflxf.exec:\flxflxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\fxxxxff.exec:\fxxxxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\rlrxflr.exec:\rlrxflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\ppppp.exec:\ppppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\pjpvj.exec:\pjpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\284820.exec:\284820.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\202200.exec:\202200.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\u466004.exec:\u466004.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\xrlrxlr.exec:\xrlrxlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\06404.exec:\06404.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\206048.exec:\206048.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\vjvpj.exec:\vjvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\246222.exec:\246222.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\60266.exec:\60266.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\48806.exec:\48806.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\200482.exec:\200482.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\8288226.exec:\8288226.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\tnhnbh.exec:\tnhnbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\nbthnh.exec:\nbthnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\4666666.exec:\4666666.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\tnbhhn.exec:\tnbhhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\460246.exec:\460246.exe23⤵
- Executes dropped EXE
PID:920 -
\??\c:\404246.exec:\404246.exe24⤵
- Executes dropped EXE
PID:1088 -
\??\c:\9jjjj.exec:\9jjjj.exe25⤵
- Executes dropped EXE
PID:4212 -
\??\c:\ddddv.exec:\ddddv.exe26⤵
- Executes dropped EXE
PID:472 -
\??\c:\nhbbtt.exec:\nhbbtt.exe27⤵
- Executes dropped EXE
PID:2768 -
\??\c:\62448.exec:\62448.exe28⤵
- Executes dropped EXE
PID:2132 -
\??\c:\04482.exec:\04482.exe29⤵
- Executes dropped EXE
PID:1012 -
\??\c:\00820.exec:\00820.exe30⤵
- Executes dropped EXE
PID:4772 -
\??\c:\5rrlllf.exec:\5rrlllf.exe31⤵
- Executes dropped EXE
PID:788 -
\??\c:\3dpjd.exec:\3dpjd.exe32⤵
- Executes dropped EXE
PID:3972 -
\??\c:\6280460.exec:\6280460.exe33⤵
- Executes dropped EXE
PID:4000 -
\??\c:\a2826.exec:\a2826.exe34⤵
- Executes dropped EXE
PID:1620 -
\??\c:\008280.exec:\008280.exe35⤵
- Executes dropped EXE
PID:4296 -
\??\c:\824044.exec:\824044.exe36⤵
- Executes dropped EXE
PID:4928 -
\??\c:\fflxrrx.exec:\fflxrrx.exe37⤵
- Executes dropped EXE
PID:4768 -
\??\c:\468280.exec:\468280.exe38⤵
- Executes dropped EXE
PID:4084 -
\??\c:\lffxxrl.exec:\lffxxrl.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\44248.exec:\44248.exe40⤵
- Executes dropped EXE
PID:4476 -
\??\c:\pvvdd.exec:\pvvdd.exe41⤵
- Executes dropped EXE
PID:3584 -
\??\c:\nbttnh.exec:\nbttnh.exe42⤵
- Executes dropped EXE
PID:2168 -
\??\c:\808806.exec:\808806.exe43⤵
- Executes dropped EXE
PID:4784 -
\??\c:\3rxrrrl.exec:\3rxrrrl.exe44⤵
- Executes dropped EXE
PID:2144 -
\??\c:\222600.exec:\222600.exe45⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jdjvd.exec:\jdjvd.exe46⤵
- Executes dropped EXE
PID:208 -
\??\c:\02464.exec:\02464.exe47⤵
- Executes dropped EXE
PID:1220 -
\??\c:\pvjdd.exec:\pvjdd.exe48⤵
- Executes dropped EXE
PID:2428 -
\??\c:\jjpjp.exec:\jjpjp.exe49⤵
- Executes dropped EXE
PID:4020 -
\??\c:\2682800.exec:\2682800.exe50⤵
- Executes dropped EXE
PID:4312 -
\??\c:\hbbttn.exec:\hbbttn.exe51⤵
- Executes dropped EXE
PID:5104 -
\??\c:\lffxrrf.exec:\lffxrrf.exe52⤵
- Executes dropped EXE
PID:848 -
\??\c:\088282.exec:\088282.exe53⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bnbbtt.exec:\bnbbtt.exe54⤵
- Executes dropped EXE
PID:4136 -
\??\c:\bbbhhh.exec:\bbbhhh.exe55⤵
- Executes dropped EXE
PID:4320 -
\??\c:\04882.exec:\04882.exe56⤵
- Executes dropped EXE
PID:4132 -
\??\c:\484826.exec:\484826.exe57⤵
- Executes dropped EXE
PID:2780 -
\??\c:\04004.exec:\04004.exe58⤵
- Executes dropped EXE
PID:3472 -
\??\c:\6486280.exec:\6486280.exe59⤵
- Executes dropped EXE
PID:1580 -
\??\c:\464488.exec:\464488.exe60⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vvdvv.exec:\vvdvv.exe61⤵
- Executes dropped EXE
PID:3488 -
\??\c:\840008.exec:\840008.exe62⤵
- Executes dropped EXE
PID:2748 -
\??\c:\8264264.exec:\8264264.exe63⤵
- Executes dropped EXE
PID:2032 -
\??\c:\w24848.exec:\w24848.exe64⤵
- Executes dropped EXE
PID:5076 -
\??\c:\jjvvp.exec:\jjvvp.exe65⤵
- Executes dropped EXE
PID:4588 -
\??\c:\882404.exec:\882404.exe66⤵PID:3364
-
\??\c:\nnttnt.exec:\nnttnt.exe67⤵PID:856
-
\??\c:\vvvvv.exec:\vvvvv.exe68⤵PID:4648
-
\??\c:\jvpjd.exec:\jvpjd.exe69⤵PID:3020
-
\??\c:\24666.exec:\24666.exe70⤵PID:1952
-
\??\c:\826282.exec:\826282.exe71⤵PID:1632
-
\??\c:\7rfxlll.exec:\7rfxlll.exe72⤵PID:2304
-
\??\c:\04262.exec:\04262.exe73⤵PID:1552
-
\??\c:\6426284.exec:\6426284.exe74⤵PID:4812
-
\??\c:\vvjdv.exec:\vvjdv.exe75⤵PID:3688
-
\??\c:\2460482.exec:\2460482.exe76⤵PID:2752
-
\??\c:\dvvvp.exec:\dvvvp.exe77⤵PID:3752
-
\??\c:\vvddv.exec:\vvddv.exe78⤵PID:4928
-
\??\c:\0404882.exec:\0404882.exe79⤵PID:4768
-
\??\c:\ppjdv.exec:\ppjdv.exe80⤵PID:4972
-
\??\c:\tthbbb.exec:\tthbbb.exe81⤵PID:4168
-
\??\c:\dvdvd.exec:\dvdvd.exe82⤵PID:2688
-
\??\c:\42628.exec:\42628.exe83⤵PID:4516
-
\??\c:\02400.exec:\02400.exe84⤵PID:2168
-
\??\c:\7dpjd.exec:\7dpjd.exe85⤵PID:2144
-
\??\c:\8400000.exec:\8400000.exe86⤵PID:5064
-
\??\c:\806066.exec:\806066.exe87⤵PID:956
-
\??\c:\a4088.exec:\a4088.exe88⤵PID:2648
-
\??\c:\84044.exec:\84044.exe89⤵PID:1472
-
\??\c:\04862.exec:\04862.exe90⤵PID:3120
-
\??\c:\pdpdv.exec:\pdpdv.exe91⤵PID:4312
-
\??\c:\bbbtnh.exec:\bbbtnh.exe92⤵PID:5104
-
\??\c:\nbhbtt.exec:\nbhbtt.exe93⤵PID:800
-
\??\c:\pjpjj.exec:\pjpjj.exe94⤵PID:4348
-
\??\c:\7fffxrf.exec:\7fffxrf.exe95⤵PID:212
-
\??\c:\2042462.exec:\2042462.exe96⤵PID:220
-
\??\c:\7pjjv.exec:\7pjjv.exe97⤵PID:4428
-
\??\c:\42660.exec:\42660.exe98⤵PID:3844
-
\??\c:\604484.exec:\604484.exe99⤵PID:4144
-
\??\c:\jdjvv.exec:\jdjvv.exe100⤵PID:3508
-
\??\c:\hbnntt.exec:\hbnntt.exe101⤵PID:368
-
\??\c:\406606.exec:\406606.exe102⤵PID:4288
-
\??\c:\nttttt.exec:\nttttt.exe103⤵PID:2608
-
\??\c:\nbhbbh.exec:\nbhbbh.exe104⤵PID:3488
-
\??\c:\hthhhn.exec:\hthhhn.exe105⤵PID:2748
-
\??\c:\rfrlffx.exec:\rfrlffx.exe106⤵PID:3580
-
\??\c:\pdvdp.exec:\pdvdp.exe107⤵PID:2128
-
\??\c:\60046.exec:\60046.exe108⤵PID:1416
-
\??\c:\c686666.exec:\c686666.exe109⤵PID:4588
-
\??\c:\2000448.exec:\2000448.exe110⤵PID:4024
-
\??\c:\280666.exec:\280666.exe111⤵PID:3096
-
\??\c:\264400.exec:\264400.exe112⤵PID:2508
-
\??\c:\jpdpp.exec:\jpdpp.exe113⤵PID:2944
-
\??\c:\40288.exec:\40288.exe114⤵PID:4648
-
\??\c:\8022688.exec:\8022688.exe115⤵PID:924
-
\??\c:\dpvpp.exec:\dpvpp.exe116⤵PID:4212
-
\??\c:\dvddv.exec:\dvddv.exe117⤵PID:452
-
\??\c:\0802646.exec:\0802646.exe118⤵PID:5012
-
\??\c:\02826.exec:\02826.exe119⤵PID:3804
-
\??\c:\0424444.exec:\0424444.exe120⤵PID:4016
-
\??\c:\0804668.exec:\0804668.exe121⤵PID:2468
-
\??\c:\6686666.exec:\6686666.exe122⤵PID:4244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-