Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 01:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ff298c595aff6c51b40ff7e0704b620_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
3ff298c595aff6c51b40ff7e0704b620_NeikiAnalytics.exe
-
Size
414KB
-
MD5
3ff298c595aff6c51b40ff7e0704b620
-
SHA1
194d6dd6ac350cb082e6e9d361e65bc12a7ede7f
-
SHA256
e23d1acf650eb13666a4c98c2a7fbd869e718928672f23e2d5c21ba5993befb9
-
SHA512
eecc2e40295caab0bd690b79980a579097c0ec159c7a688ec13f3670f1f231b12115819f4accec8a9a8f4148062d2e3f60887fb44692dcd54d74e9e01d70896d
-
SSDEEP
12288:n3C9ytvngQj4DtvnV9wLn9UTfC8eieJNBNIsYPU:SgdnJUdnV90
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/2784-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1516-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4804 tnhttt.exe 388 9ddvp.exe 4400 nhnhbh.exe 3008 bhhbnh.exe 2824 jvvvp.exe 1852 lffxxrl.exe 3664 bntnnn.exe 3904 flxrfxr.exe 5080 nbnhhb.exe 2196 9rlxrfr.exe 2692 vppjp.exe 1864 hbbbhh.exe 4064 jjjdv.exe 3488 nbbnbt.exe 4652 3rfxlrr.exe 2104 bnhhhn.exe 1516 lflxxxr.exe 2836 htbhhh.exe 1316 xxlllll.exe 400 pvppj.exe 868 djjvv.exe 4056 rrrrlll.exe 4540 vvjjj.exe 4620 xrrlfff.exe 3764 xxxrllf.exe 3400 ppvvp.exe 3404 xffrrxx.exe 3424 7vjdv.exe 4712 bnbbtt.exe 2280 nhtbhn.exe 2224 jpddj.exe 4988 7pvvp.exe 2064 7tbbbh.exe 4524 pvdvv.exe 3320 jjddd.exe 3972 xrfffff.exe 4916 nnnttt.exe 3592 ntnnnn.exe 3176 djvpp.exe 768 xrxxxxl.exe 3608 nthnnn.exe 3912 jjvvp.exe 3648 xrxrllf.exe 392 thtbbb.exe 2200 pjjjd.exe 1852 3lrrlxx.exe 4480 xlrrrrr.exe 5060 bbhnhh.exe 452 jdddd.exe 2468 rxffffx.exe 1404 rllfffx.exe 4908 bhbthh.exe 4932 vpvjd.exe 2752 llxrllf.exe 1488 7thbht.exe 3388 vdjdd.exe 4652 ddjdv.exe 4384 xlrrfrr.exe 5052 bbtttb.exe 1920 dvdvv.exe 3908 9flllll.exe 816 rlrrlrr.exe 824 5tbtnt.exe 4440 dpjjj.exe -
resource yara_rule behavioral2/memory/2784-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-194-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2784 wrote to memory of 4804 2784 3ff298c595aff6c51b40ff7e0704b620_NeikiAnalytics.exe 82 PID 2784 wrote to memory of 4804 2784 3ff298c595aff6c51b40ff7e0704b620_NeikiAnalytics.exe 82 PID 2784 wrote to memory of 4804 2784 3ff298c595aff6c51b40ff7e0704b620_NeikiAnalytics.exe 82 PID 4804 wrote to memory of 388 4804 tnhttt.exe 83 PID 4804 wrote to memory of 388 4804 tnhttt.exe 83 PID 4804 wrote to memory of 388 4804 tnhttt.exe 83 PID 388 wrote to memory of 4400 388 9ddvp.exe 84 PID 388 wrote to memory of 4400 388 9ddvp.exe 84 PID 388 wrote to memory of 4400 388 9ddvp.exe 84 PID 4400 wrote to memory of 3008 4400 nhnhbh.exe 88 PID 4400 wrote to memory of 3008 4400 nhnhbh.exe 88 PID 4400 wrote to memory of 3008 4400 nhnhbh.exe 88 PID 3008 wrote to memory of 2824 3008 bhhbnh.exe 89 PID 3008 wrote to memory of 2824 3008 bhhbnh.exe 89 PID 3008 wrote to memory of 2824 3008 bhhbnh.exe 89 PID 2824 wrote to memory of 1852 2824 jvvvp.exe 90 PID 2824 wrote to memory of 1852 2824 jvvvp.exe 90 PID 2824 wrote to memory of 1852 2824 jvvvp.exe 90 PID 1852 wrote to memory of 3664 1852 lffxxrl.exe 91 PID 1852 wrote to memory of 3664 1852 lffxxrl.exe 91 PID 1852 wrote to memory of 3664 1852 lffxxrl.exe 91 PID 3664 wrote to memory of 3904 3664 bntnnn.exe 92 PID 3664 wrote to memory of 3904 3664 bntnnn.exe 92 PID 3664 wrote to memory of 3904 3664 bntnnn.exe 92 PID 3904 wrote to memory of 5080 3904 flxrfxr.exe 93 PID 3904 wrote to memory of 5080 3904 flxrfxr.exe 93 PID 3904 wrote to memory of 5080 3904 flxrfxr.exe 93 PID 5080 wrote to memory of 2196 5080 nbnhhb.exe 94 PID 5080 wrote to memory of 2196 5080 nbnhhb.exe 94 PID 5080 wrote to memory of 2196 5080 nbnhhb.exe 94 PID 2196 wrote to memory of 2692 2196 9rlxrfr.exe 95 PID 2196 wrote to memory of 2692 2196 9rlxrfr.exe 95 PID 2196 wrote to memory of 2692 2196 9rlxrfr.exe 95 PID 2692 wrote to memory of 1864 2692 vppjp.exe 96 PID 2692 wrote to memory of 1864 2692 vppjp.exe 96 PID 2692 wrote to memory of 1864 2692 vppjp.exe 96 PID 1864 wrote to memory of 4064 1864 hbbbhh.exe 97 PID 1864 wrote to memory of 4064 1864 hbbbhh.exe 97 PID 1864 wrote to memory of 4064 1864 hbbbhh.exe 97 PID 4064 wrote to memory of 3488 4064 jjjdv.exe 98 PID 4064 wrote to memory of 3488 4064 jjjdv.exe 98 PID 4064 wrote to memory of 3488 4064 jjjdv.exe 98 PID 3488 wrote to memory of 4652 3488 nbbnbt.exe 99 PID 3488 wrote to memory of 4652 3488 nbbnbt.exe 99 PID 3488 wrote to memory of 4652 3488 nbbnbt.exe 99 PID 4652 wrote to memory of 2104 4652 3rfxlrr.exe 100 PID 4652 wrote to memory of 2104 4652 3rfxlrr.exe 100 PID 4652 wrote to memory of 2104 4652 3rfxlrr.exe 100 PID 2104 wrote to memory of 1516 2104 bnhhhn.exe 101 PID 2104 wrote to memory of 1516 2104 bnhhhn.exe 101 PID 2104 wrote to memory of 1516 2104 bnhhhn.exe 101 PID 1516 wrote to memory of 2836 1516 lflxxxr.exe 102 PID 1516 wrote to memory of 2836 1516 lflxxxr.exe 102 PID 1516 wrote to memory of 2836 1516 lflxxxr.exe 102 PID 2836 wrote to memory of 1316 2836 htbhhh.exe 103 PID 2836 wrote to memory of 1316 2836 htbhhh.exe 103 PID 2836 wrote to memory of 1316 2836 htbhhh.exe 103 PID 1316 wrote to memory of 400 1316 xxlllll.exe 104 PID 1316 wrote to memory of 400 1316 xxlllll.exe 104 PID 1316 wrote to memory of 400 1316 xxlllll.exe 104 PID 400 wrote to memory of 868 400 pvppj.exe 105 PID 400 wrote to memory of 868 400 pvppj.exe 105 PID 400 wrote to memory of 868 400 pvppj.exe 105 PID 868 wrote to memory of 4056 868 djjvv.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ff298c595aff6c51b40ff7e0704b620_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3ff298c595aff6c51b40ff7e0704b620_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\tnhttt.exec:\tnhttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\9ddvp.exec:\9ddvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\nhnhbh.exec:\nhnhbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\bhhbnh.exec:\bhhbnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\jvvvp.exec:\jvvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\lffxxrl.exec:\lffxxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\bntnnn.exec:\bntnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\flxrfxr.exec:\flxrfxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\nbnhhb.exec:\nbnhhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\9rlxrfr.exec:\9rlxrfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\vppjp.exec:\vppjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\hbbbhh.exec:\hbbbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\jjjdv.exec:\jjjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\nbbnbt.exec:\nbbnbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\3rfxlrr.exec:\3rfxlrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\bnhhhn.exec:\bnhhhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\lflxxxr.exec:\lflxxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\htbhhh.exec:\htbhhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\xxlllll.exec:\xxlllll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\pvppj.exec:\pvppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\djjvv.exec:\djjvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\rrrrlll.exec:\rrrrlll.exe23⤵
- Executes dropped EXE
PID:4056 -
\??\c:\vvjjj.exec:\vvjjj.exe24⤵
- Executes dropped EXE
PID:4540 -
\??\c:\xrrlfff.exec:\xrrlfff.exe25⤵
- Executes dropped EXE
PID:4620 -
\??\c:\xxxrllf.exec:\xxxrllf.exe26⤵
- Executes dropped EXE
PID:3764 -
\??\c:\ppvvp.exec:\ppvvp.exe27⤵
- Executes dropped EXE
PID:3400 -
\??\c:\xffrrxx.exec:\xffrrxx.exe28⤵
- Executes dropped EXE
PID:3404 -
\??\c:\7vjdv.exec:\7vjdv.exe29⤵
- Executes dropped EXE
PID:3424 -
\??\c:\bnbbtt.exec:\bnbbtt.exe30⤵
- Executes dropped EXE
PID:4712 -
\??\c:\nhtbhn.exec:\nhtbhn.exe31⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jpddj.exec:\jpddj.exe32⤵
- Executes dropped EXE
PID:2224 -
\??\c:\7pvvp.exec:\7pvvp.exe33⤵
- Executes dropped EXE
PID:4988 -
\??\c:\7tbbbh.exec:\7tbbbh.exe34⤵
- Executes dropped EXE
PID:2064 -
\??\c:\pvdvv.exec:\pvdvv.exe35⤵
- Executes dropped EXE
PID:4524 -
\??\c:\jjddd.exec:\jjddd.exe36⤵
- Executes dropped EXE
PID:3320 -
\??\c:\xrfffff.exec:\xrfffff.exe37⤵
- Executes dropped EXE
PID:3972 -
\??\c:\nnnttt.exec:\nnnttt.exe38⤵
- Executes dropped EXE
PID:4916 -
\??\c:\ntnnnn.exec:\ntnnnn.exe39⤵
- Executes dropped EXE
PID:3592 -
\??\c:\djvpp.exec:\djvpp.exe40⤵
- Executes dropped EXE
PID:3176 -
\??\c:\xrxxxxl.exec:\xrxxxxl.exe41⤵
- Executes dropped EXE
PID:768 -
\??\c:\nthnnn.exec:\nthnnn.exe42⤵
- Executes dropped EXE
PID:3608 -
\??\c:\jjvvp.exec:\jjvvp.exe43⤵
- Executes dropped EXE
PID:3912 -
\??\c:\xrxrllf.exec:\xrxrllf.exe44⤵
- Executes dropped EXE
PID:3648 -
\??\c:\thtbbb.exec:\thtbbb.exe45⤵
- Executes dropped EXE
PID:392 -
\??\c:\pjjjd.exec:\pjjjd.exe46⤵
- Executes dropped EXE
PID:2200 -
\??\c:\3lrrlxx.exec:\3lrrlxx.exe47⤵
- Executes dropped EXE
PID:1852 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe48⤵
- Executes dropped EXE
PID:4480 -
\??\c:\bbhnhh.exec:\bbhnhh.exe49⤵
- Executes dropped EXE
PID:5060 -
\??\c:\jdddd.exec:\jdddd.exe50⤵
- Executes dropped EXE
PID:452 -
\??\c:\rxffffx.exec:\rxffffx.exe51⤵
- Executes dropped EXE
PID:2468 -
\??\c:\rllfffx.exec:\rllfffx.exe52⤵
- Executes dropped EXE
PID:1404 -
\??\c:\bhbthh.exec:\bhbthh.exe53⤵
- Executes dropped EXE
PID:4908 -
\??\c:\vpvjd.exec:\vpvjd.exe54⤵
- Executes dropped EXE
PID:4932 -
\??\c:\llxrllf.exec:\llxrllf.exe55⤵
- Executes dropped EXE
PID:2752 -
\??\c:\7thbht.exec:\7thbht.exe56⤵
- Executes dropped EXE
PID:1488 -
\??\c:\vdjdd.exec:\vdjdd.exe57⤵
- Executes dropped EXE
PID:3388 -
\??\c:\ddjdv.exec:\ddjdv.exe58⤵
- Executes dropped EXE
PID:4652 -
\??\c:\xlrrfrr.exec:\xlrrfrr.exe59⤵
- Executes dropped EXE
PID:4384 -
\??\c:\bbtttb.exec:\bbtttb.exe60⤵
- Executes dropped EXE
PID:5052 -
\??\c:\dvdvv.exec:\dvdvv.exe61⤵
- Executes dropped EXE
PID:1920 -
\??\c:\9flllll.exec:\9flllll.exe62⤵
- Executes dropped EXE
PID:3908 -
\??\c:\rlrrlrr.exec:\rlrrlrr.exe63⤵
- Executes dropped EXE
PID:816 -
\??\c:\5tbtnt.exec:\5tbtnt.exe64⤵
- Executes dropped EXE
PID:824 -
\??\c:\dpjjj.exec:\dpjjj.exe65⤵
- Executes dropped EXE
PID:4440 -
\??\c:\jpdvp.exec:\jpdvp.exe66⤵PID:3192
-
\??\c:\xrfffff.exec:\xrfffff.exe67⤵PID:1760
-
\??\c:\xrrlflf.exec:\xrrlflf.exe68⤵PID:4048
-
\??\c:\bhnhhh.exec:\bhnhhh.exe69⤵PID:1480
-
\??\c:\3pddv.exec:\3pddv.exe70⤵PID:4408
-
\??\c:\rlxlxrf.exec:\rlxlxrf.exe71⤵PID:3224
-
\??\c:\flxrrrl.exec:\flxrrrl.exe72⤵PID:3588
-
\??\c:\bnbtnn.exec:\bnbtnn.exe73⤵PID:4476
-
\??\c:\jvpjd.exec:\jvpjd.exe74⤵PID:4484
-
\??\c:\dvdvv.exec:\dvdvv.exe75⤵PID:3956
-
\??\c:\rrrxlrx.exec:\rrrxlrx.exe76⤵PID:3104
-
\??\c:\1ntnhh.exec:\1ntnhh.exe77⤵PID:1364
-
\??\c:\nbtbbb.exec:\nbtbbb.exe78⤵PID:2436
-
\??\c:\vpvvd.exec:\vpvvd.exe79⤵PID:2224
-
\??\c:\xrlrrll.exec:\xrlrrll.exe80⤵PID:1300
-
\??\c:\xrxrllf.exec:\xrxrllf.exe81⤵PID:1092
-
\??\c:\9ttnnt.exec:\9ttnnt.exe82⤵PID:4872
-
\??\c:\1lrfxll.exec:\1lrfxll.exe83⤵PID:2440
-
\??\c:\5bthbt.exec:\5bthbt.exe84⤵PID:4836
-
\??\c:\ttthtn.exec:\ttthtn.exe85⤵PID:4804
-
\??\c:\ppjdp.exec:\ppjdp.exe86⤵PID:860
-
\??\c:\pjdpp.exec:\pjdpp.exe87⤵PID:972
-
\??\c:\lflxlfr.exec:\lflxlfr.exe88⤵PID:4348
-
\??\c:\hnnbnh.exec:\hnnbnh.exe89⤵PID:4868
-
\??\c:\1hhthb.exec:\1hhthb.exe90⤵PID:412
-
\??\c:\vvdpv.exec:\vvdpv.exe91⤵PID:2736
-
\??\c:\ffrfrrf.exec:\ffrfrrf.exe92⤵PID:2824
-
\??\c:\fllxrlx.exec:\fllxrlx.exe93⤵PID:5108
-
\??\c:\nthnbt.exec:\nthnbt.exe94⤵PID:5116
-
\??\c:\1dppd.exec:\1dppd.exe95⤵PID:4436
-
\??\c:\vpjdp.exec:\vpjdp.exe96⤵PID:864
-
\??\c:\fflrfxr.exec:\fflrfxr.exe97⤵PID:3820
-
\??\c:\xxfrffr.exec:\xxfrffr.exe98⤵PID:4184
-
\??\c:\bttbnh.exec:\bttbnh.exe99⤵PID:3728
-
\??\c:\dvvpd.exec:\dvvpd.exe100⤵PID:4420
-
\??\c:\jvpjd.exec:\jvpjd.exe101⤵PID:2696
-
\??\c:\ffxrlll.exec:\ffxrlll.exe102⤵PID:4848
-
\??\c:\flfxrlf.exec:\flfxrlf.exe103⤵PID:2752
-
\??\c:\9ntnhh.exec:\9ntnhh.exe104⤵PID:4136
-
\??\c:\jdjdd.exec:\jdjdd.exe105⤵PID:4004
-
\??\c:\pdjjd.exec:\pdjjd.exe106⤵PID:2596
-
\??\c:\lxfxrxl.exec:\lxfxrxl.exe107⤵PID:4912
-
\??\c:\btttnn.exec:\btttnn.exe108⤵PID:5052
-
\??\c:\hhbtnn.exec:\hhbtnn.exe109⤵PID:2832
-
\??\c:\1dppd.exec:\1dppd.exe110⤵PID:3292
-
\??\c:\rlfxxff.exec:\rlfxxff.exe111⤵PID:816
-
\??\c:\7lrxxll.exec:\7lrxxll.exe112⤵PID:824
-
\??\c:\ntnnnn.exec:\ntnnnn.exe113⤵PID:1972
-
\??\c:\jpddd.exec:\jpddd.exe114⤵PID:3192
-
\??\c:\rrrllll.exec:\rrrllll.exe115⤵PID:1760
-
\??\c:\btnbnh.exec:\btnbnh.exe116⤵PID:4048
-
\??\c:\dvdpj.exec:\dvdpj.exe117⤵PID:1480
-
\??\c:\llxxfxf.exec:\llxxfxf.exe118⤵PID:3324
-
\??\c:\llfxfxr.exec:\llfxfxr.exe119⤵PID:3224
-
\??\c:\3thbtt.exec:\3thbtt.exe120⤵PID:3588
-
\??\c:\pjdvp.exec:\pjdvp.exe121⤵PID:1456
-
\??\c:\lfllllr.exec:\lfllllr.exe122⤵PID:4484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-