Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 14:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
074de6b01aefbaa8d83a92f615f44b40_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
074de6b01aefbaa8d83a92f615f44b40_NeikiAnalytics.exe
-
Size
471KB
-
MD5
074de6b01aefbaa8d83a92f615f44b40
-
SHA1
e6afd542b2a935c418be0c88085cf0e8147280ef
-
SHA256
4425403f4353542e1596e3726eae7eb68475cb9a2ca4089ca7067ac98a0762c3
-
SHA512
e823aeb8a2c33a725b3d8ec557415df080962546de1aeef88337494b11d8fbae1a7ac53ce43fdf3dd9bef91308faa680de951cc357a35acb60ebb8aaf9ee43d5
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq78yoyfx93sY0AJq4mZAx5y:n3C9yMo+S0L9xRnoq7H9pmoq
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4312-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/732-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2804-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4184-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/932-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4664-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4688 llrlxrr.exe 3712 9jdvp.exe 4436 fffxrlf.exe 1080 bnhbtn.exe 2284 1jjdd.exe 4972 jvdvp.exe 3500 9ffxxxr.exe 732 3bthbh.exe 4044 vvjvp.exe 4344 nnhbnn.exe 4208 xlrllrr.exe 644 3dvpj.exe 4224 xrlrlff.exe 616 nhhbtn.exe 1468 htbnhh.exe 2824 9pppd.exe 4800 thnhnh.exe 4920 ddpdj.exe 1764 frrxrlf.exe 2804 3ppdv.exe 4184 vppjj.exe 2768 tbhhhh.exe 1168 3djvp.exe 932 flllllf.exe 4664 3tnbth.exe 5072 frffrlx.exe 3200 nbbnhb.exe 4456 rflfflr.exe 3376 nhtnhb.exe 824 9dvpd.exe 552 xlfrlrr.exe 5088 nttbbt.exe 4312 xfxfrrl.exe 2068 vpdpd.exe 1112 rrrfxxl.exe 1288 5hnhbh.exe 1236 hbhbbt.exe 5100 frlrrff.exe 2384 1tbnhb.exe 548 jppjd.exe 3120 7fxxffl.exe 3500 3nhbnn.exe 1460 jdvvj.exe 4972 fxfxfxf.exe 2984 rfrxxfl.exe 4256 dvpdp.exe 2280 ddpjd.exe 4208 flrlffx.exe 2908 bbtnhb.exe 4916 9dvpd.exe 4224 vvjjd.exe 2776 flxlxfl.exe 384 tbhhth.exe 5076 pvpjd.exe 1616 xrrxlxl.exe 4800 htbnhb.exe 4548 vvpvd.exe 1824 3rxrlfx.exe 4700 fffrlxr.exe 2804 tntnbt.exe 4608 dpjjp.exe 4108 ffrrllf.exe 3156 7lrfrll.exe 1952 1hbnhb.exe -
resource yara_rule behavioral2/memory/4312-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/644-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2804-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/932-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4312 wrote to memory of 4688 4312 074de6b01aefbaa8d83a92f615f44b40_NeikiAnalytics.exe 84 PID 4312 wrote to memory of 4688 4312 074de6b01aefbaa8d83a92f615f44b40_NeikiAnalytics.exe 84 PID 4312 wrote to memory of 4688 4312 074de6b01aefbaa8d83a92f615f44b40_NeikiAnalytics.exe 84 PID 4688 wrote to memory of 3712 4688 llrlxrr.exe 85 PID 4688 wrote to memory of 3712 4688 llrlxrr.exe 85 PID 4688 wrote to memory of 3712 4688 llrlxrr.exe 85 PID 3712 wrote to memory of 4436 3712 9jdvp.exe 86 PID 3712 wrote to memory of 4436 3712 9jdvp.exe 86 PID 3712 wrote to memory of 4436 3712 9jdvp.exe 86 PID 4436 wrote to memory of 1080 4436 fffxrlf.exe 87 PID 4436 wrote to memory of 1080 4436 fffxrlf.exe 87 PID 4436 wrote to memory of 1080 4436 fffxrlf.exe 87 PID 1080 wrote to memory of 2284 1080 bnhbtn.exe 90 PID 1080 wrote to memory of 2284 1080 bnhbtn.exe 90 PID 1080 wrote to memory of 2284 1080 bnhbtn.exe 90 PID 2284 wrote to memory of 4972 2284 1jjdd.exe 91 PID 2284 wrote to memory of 4972 2284 1jjdd.exe 91 PID 2284 wrote to memory of 4972 2284 1jjdd.exe 91 PID 4972 wrote to memory of 3500 4972 jvdvp.exe 92 PID 4972 wrote to memory of 3500 4972 jvdvp.exe 92 PID 4972 wrote to memory of 3500 4972 jvdvp.exe 92 PID 3500 wrote to memory of 732 3500 9ffxxxr.exe 93 PID 3500 wrote to memory of 732 3500 9ffxxxr.exe 93 PID 3500 wrote to memory of 732 3500 9ffxxxr.exe 93 PID 732 wrote to memory of 4044 732 3bthbh.exe 94 PID 732 wrote to memory of 4044 732 3bthbh.exe 94 PID 732 wrote to memory of 4044 732 3bthbh.exe 94 PID 4044 wrote to memory of 4344 4044 vvjvp.exe 95 PID 4044 wrote to memory of 4344 4044 vvjvp.exe 95 PID 4044 wrote to memory of 4344 4044 vvjvp.exe 95 PID 4344 wrote to memory of 4208 4344 nnhbnn.exe 96 PID 4344 wrote to memory of 4208 4344 nnhbnn.exe 96 PID 4344 wrote to memory of 4208 4344 nnhbnn.exe 96 PID 4208 wrote to memory of 644 4208 xlrllrr.exe 97 PID 4208 wrote to memory of 644 4208 xlrllrr.exe 97 PID 4208 wrote to memory of 644 4208 xlrllrr.exe 97 PID 644 wrote to memory of 4224 644 3dvpj.exe 98 PID 644 wrote to memory of 4224 644 3dvpj.exe 98 PID 644 wrote to memory of 4224 644 3dvpj.exe 98 PID 4224 wrote to memory of 616 4224 xrlrlff.exe 99 PID 4224 wrote to memory of 616 4224 xrlrlff.exe 99 PID 4224 wrote to memory of 616 4224 xrlrlff.exe 99 PID 616 wrote to memory of 1468 616 nhhbtn.exe 100 PID 616 wrote to memory of 1468 616 nhhbtn.exe 100 PID 616 wrote to memory of 1468 616 nhhbtn.exe 100 PID 1468 wrote to memory of 2824 1468 htbnhh.exe 101 PID 1468 wrote to memory of 2824 1468 htbnhh.exe 101 PID 1468 wrote to memory of 2824 1468 htbnhh.exe 101 PID 2824 wrote to memory of 4800 2824 9pppd.exe 102 PID 2824 wrote to memory of 4800 2824 9pppd.exe 102 PID 2824 wrote to memory of 4800 2824 9pppd.exe 102 PID 4800 wrote to memory of 4920 4800 thnhnh.exe 104 PID 4800 wrote to memory of 4920 4800 thnhnh.exe 104 PID 4800 wrote to memory of 4920 4800 thnhnh.exe 104 PID 4920 wrote to memory of 1764 4920 ddpdj.exe 105 PID 4920 wrote to memory of 1764 4920 ddpdj.exe 105 PID 4920 wrote to memory of 1764 4920 ddpdj.exe 105 PID 1764 wrote to memory of 2804 1764 frrxrlf.exe 107 PID 1764 wrote to memory of 2804 1764 frrxrlf.exe 107 PID 1764 wrote to memory of 2804 1764 frrxrlf.exe 107 PID 2804 wrote to memory of 4184 2804 3ppdv.exe 108 PID 2804 wrote to memory of 4184 2804 3ppdv.exe 108 PID 2804 wrote to memory of 4184 2804 3ppdv.exe 108 PID 4184 wrote to memory of 2768 4184 vppjj.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\074de6b01aefbaa8d83a92f615f44b40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\074de6b01aefbaa8d83a92f615f44b40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\llrlxrr.exec:\llrlxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\9jdvp.exec:\9jdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\fffxrlf.exec:\fffxrlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\bnhbtn.exec:\bnhbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\1jjdd.exec:\1jjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\jvdvp.exec:\jvdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\9ffxxxr.exec:\9ffxxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\3bthbh.exec:\3bthbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\vvjvp.exec:\vvjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\nnhbnn.exec:\nnhbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\xlrllrr.exec:\xlrllrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\3dvpj.exec:\3dvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\xrlrlff.exec:\xrlrlff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\nhhbtn.exec:\nhhbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
\??\c:\htbnhh.exec:\htbnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\9pppd.exec:\9pppd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\thnhnh.exec:\thnhnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\ddpdj.exec:\ddpdj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\frrxrlf.exec:\frrxrlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\3ppdv.exec:\3ppdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\vppjj.exec:\vppjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\tbhhhh.exec:\tbhhhh.exe23⤵
- Executes dropped EXE
PID:2768 -
\??\c:\3djvp.exec:\3djvp.exe24⤵
- Executes dropped EXE
PID:1168 -
\??\c:\flllllf.exec:\flllllf.exe25⤵
- Executes dropped EXE
PID:932 -
\??\c:\3tnbth.exec:\3tnbth.exe26⤵
- Executes dropped EXE
PID:4664 -
\??\c:\frffrlx.exec:\frffrlx.exe27⤵
- Executes dropped EXE
PID:5072 -
\??\c:\nbbnhb.exec:\nbbnhb.exe28⤵
- Executes dropped EXE
PID:3200 -
\??\c:\rflfflr.exec:\rflfflr.exe29⤵
- Executes dropped EXE
PID:4456 -
\??\c:\nhtnhb.exec:\nhtnhb.exe30⤵
- Executes dropped EXE
PID:3376 -
\??\c:\9dvpd.exec:\9dvpd.exe31⤵
- Executes dropped EXE
PID:824 -
\??\c:\xlfrlrr.exec:\xlfrlrr.exe32⤵
- Executes dropped EXE
PID:552 -
\??\c:\nttbbt.exec:\nttbbt.exe33⤵
- Executes dropped EXE
PID:5088 -
\??\c:\xfxfrrl.exec:\xfxfrrl.exe34⤵
- Executes dropped EXE
PID:4312 -
\??\c:\vpdpd.exec:\vpdpd.exe35⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rrrfxxl.exec:\rrrfxxl.exe36⤵
- Executes dropped EXE
PID:1112 -
\??\c:\5hnhbh.exec:\5hnhbh.exe37⤵
- Executes dropped EXE
PID:1288 -
\??\c:\hbhbbt.exec:\hbhbbt.exe38⤵
- Executes dropped EXE
PID:1236 -
\??\c:\frlrrff.exec:\frlrrff.exe39⤵
- Executes dropped EXE
PID:5100 -
\??\c:\1tbnhb.exec:\1tbnhb.exe40⤵
- Executes dropped EXE
PID:2384 -
\??\c:\jppjd.exec:\jppjd.exe41⤵
- Executes dropped EXE
PID:548 -
\??\c:\7fxxffl.exec:\7fxxffl.exe42⤵
- Executes dropped EXE
PID:3120 -
\??\c:\3nhbnn.exec:\3nhbnn.exe43⤵
- Executes dropped EXE
PID:3500 -
\??\c:\jdvvj.exec:\jdvvj.exe44⤵
- Executes dropped EXE
PID:1460 -
\??\c:\fxfxfxf.exec:\fxfxfxf.exe45⤵
- Executes dropped EXE
PID:4972 -
\??\c:\rfrxxfl.exec:\rfrxxfl.exe46⤵
- Executes dropped EXE
PID:2984 -
\??\c:\dvpdp.exec:\dvpdp.exe47⤵
- Executes dropped EXE
PID:4256 -
\??\c:\ddpjd.exec:\ddpjd.exe48⤵
- Executes dropped EXE
PID:2280 -
\??\c:\flrlffx.exec:\flrlffx.exe49⤵
- Executes dropped EXE
PID:4208 -
\??\c:\bbtnhb.exec:\bbtnhb.exe50⤵
- Executes dropped EXE
PID:2908 -
\??\c:\9dvpd.exec:\9dvpd.exe51⤵
- Executes dropped EXE
PID:4916 -
\??\c:\vvjjd.exec:\vvjjd.exe52⤵
- Executes dropped EXE
PID:4224 -
\??\c:\flxlxfl.exec:\flxlxfl.exe53⤵
- Executes dropped EXE
PID:2776 -
\??\c:\tbhhth.exec:\tbhhth.exe54⤵
- Executes dropped EXE
PID:384 -
\??\c:\pvpjd.exec:\pvpjd.exe55⤵
- Executes dropped EXE
PID:5076 -
\??\c:\xrrxlxl.exec:\xrrxlxl.exe56⤵
- Executes dropped EXE
PID:1616 -
\??\c:\htbnhb.exec:\htbnhb.exe57⤵
- Executes dropped EXE
PID:4800 -
\??\c:\vvpvd.exec:\vvpvd.exe58⤵
- Executes dropped EXE
PID:4548 -
\??\c:\3rxrlfx.exec:\3rxrlfx.exe59⤵
- Executes dropped EXE
PID:1824 -
\??\c:\fffrlxr.exec:\fffrlxr.exe60⤵
- Executes dropped EXE
PID:4700 -
\??\c:\tntnbt.exec:\tntnbt.exe61⤵
- Executes dropped EXE
PID:2804 -
\??\c:\dpjjp.exec:\dpjjp.exe62⤵
- Executes dropped EXE
PID:4608 -
\??\c:\ffrrllf.exec:\ffrrllf.exe63⤵
- Executes dropped EXE
PID:4108 -
\??\c:\7lrfrll.exec:\7lrfrll.exe64⤵
- Executes dropped EXE
PID:3156 -
\??\c:\1hbnhb.exec:\1hbnhb.exe65⤵
- Executes dropped EXE
PID:1952 -
\??\c:\dvpjd.exec:\dvpjd.exe66⤵PID:3784
-
\??\c:\jddvd.exec:\jddvd.exe67⤵PID:212
-
\??\c:\5hbnhn.exec:\5hbnhn.exe68⤵PID:3676
-
\??\c:\nnnhbb.exec:\nnnhbb.exe69⤵PID:2632
-
\??\c:\pvjdv.exec:\pvjdv.exe70⤵PID:4720
-
\??\c:\3flxrrr.exec:\3flxrrr.exe71⤵PID:2244
-
\??\c:\7btnbb.exec:\7btnbb.exe72⤵PID:3376
-
\??\c:\1nbttn.exec:\1nbttn.exe73⤵PID:824
-
\??\c:\jjdvv.exec:\jjdvv.exe74⤵PID:1548
-
\??\c:\lflfxrl.exec:\lflfxrl.exe75⤵PID:3668
-
\??\c:\hthtnn.exec:\hthtnn.exe76⤵PID:468
-
\??\c:\vjpdj.exec:\vjpdj.exe77⤵PID:2412
-
\??\c:\vvdpj.exec:\vvdpj.exe78⤵PID:3284
-
\??\c:\rrfxrlf.exec:\rrfxrlf.exe79⤵PID:1112
-
\??\c:\tbtnnh.exec:\tbtnnh.exe80⤵PID:1080
-
\??\c:\hntnhb.exec:\hntnhb.exe81⤵PID:4068
-
\??\c:\3dpdd.exec:\3dpdd.exe82⤵PID:4572
-
\??\c:\rfxrlfr.exec:\rfxrlfr.exe83⤵PID:2404
-
\??\c:\btnhbb.exec:\btnhbb.exe84⤵PID:4876
-
\??\c:\1vppj.exec:\1vppj.exe85⤵PID:1460
-
\??\c:\jjdvp.exec:\jjdvp.exe86⤵PID:4972
-
\??\c:\lrrrlll.exec:\lrrrlll.exe87⤵PID:2984
-
\??\c:\bhbtnh.exec:\bhbtnh.exe88⤵PID:660
-
\??\c:\1ntntb.exec:\1ntntb.exe89⤵PID:820
-
\??\c:\jdjvp.exec:\jdjvp.exe90⤵PID:5020
-
\??\c:\fxffxrr.exec:\fxffxrr.exe91⤵PID:2864
-
\??\c:\xrffxll.exec:\xrffxll.exe92⤵PID:1840
-
\??\c:\nthbtn.exec:\nthbtn.exe93⤵PID:4464
-
\??\c:\jpvpj.exec:\jpvpj.exe94⤵PID:4736
-
\??\c:\3ffxxxx.exec:\3ffxxxx.exe95⤵PID:2696
-
\??\c:\3xrlfxr.exec:\3xrlfxr.exe96⤵PID:2136
-
\??\c:\7ttnbb.exec:\7ttnbb.exe97⤵PID:1976
-
\??\c:\ppdpv.exec:\ppdpv.exe98⤵PID:1396
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe99⤵PID:2408
-
\??\c:\ntttnt.exec:\ntttnt.exe100⤵PID:4896
-
\??\c:\pjjdp.exec:\pjjdp.exe101⤵PID:3508
-
\??\c:\3vjdv.exec:\3vjdv.exe102⤵PID:4528
-
\??\c:\xxrlfxx.exec:\xxrlfxx.exe103⤵PID:2580
-
\??\c:\htbtnt.exec:\htbtnt.exe104⤵PID:3112
-
\??\c:\vdvpv.exec:\vdvpv.exe105⤵PID:2540
-
\??\c:\vjpjp.exec:\vjpjp.exe106⤵PID:2848
-
\??\c:\3lllffx.exec:\3lllffx.exe107⤵PID:3784
-
\??\c:\httnbb.exec:\httnbb.exe108⤵PID:3516
-
\??\c:\vvvpj.exec:\vvvpj.exe109⤵PID:3200
-
\??\c:\xrxxlll.exec:\xrxxlll.exe110⤵PID:5040
-
\??\c:\htbbnh.exec:\htbbnh.exe111⤵PID:4428
-
\??\c:\5ppjd.exec:\5ppjd.exe112⤵PID:2712
-
\??\c:\vpjpj.exec:\vpjpj.exe113⤵PID:824
-
\??\c:\lfflfll.exec:\lfflfll.exe114⤵PID:4708
-
\??\c:\1tnhhn.exec:\1tnhhn.exe115⤵PID:1012
-
\??\c:\jddjj.exec:\jddjj.exe116⤵PID:464
-
\??\c:\7xffxll.exec:\7xffxll.exe117⤵PID:3440
-
\??\c:\3lxxffl.exec:\3lxxffl.exe118⤵PID:4176
-
\??\c:\nnnntt.exec:\nnnntt.exe119⤵PID:4400
-
\??\c:\djvvp.exec:\djvvp.exe120⤵PID:4540
-
\??\c:\9pvpd.exec:\9pvpd.exe121⤵PID:4440
-
\??\c:\fflffxx.exec:\fflffxx.exe122⤵PID:1912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-