Analysis
-
max time kernel
149s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 08:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e3000c3bc8bbfcfb55805798941c7740_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e3000c3bc8bbfcfb55805798941c7740_NeikiAnalytics.exe
-
Size
55KB
-
MD5
e3000c3bc8bbfcfb55805798941c7740
-
SHA1
f940b211506f5544ff4596b4d26bc072514a5d2c
-
SHA256
4376142565c00224235cd3b0bb957096e6bd87c393a106f0056d187678f22ced
-
SHA512
23e9f11a69a456f26be6a4831ccf79168558f3e2e45cf8455ae1553f56450ee407baf5b48efb35be27b96f2d1420ac22d5f6da3e1f1a1f31570c1730ed21694c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFt:ymb3NkkiQ3mdBjFIFt
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/3496-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/828-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1256-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3736-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2428 7lrxxfx.exe 828 bhhbtt.exe 4528 pvdpv.exe 4760 1jjdj.exe 4912 5rrlxrr.exe 2692 tthhbt.exe 1256 thnhtt.exe 1384 pvpjp.exe 3320 7xrlxrl.exe 620 bbbnhn.exe 3168 tttbtt.exe 4844 5djdj.exe 5052 fxflllr.exe 5100 bbhbbt.exe 4780 htbtht.exe 1860 flxlfxx.exe 3424 rxxrffx.exe 4248 thhbtt.exe 4664 vvdvd.exe 4184 dvdpv.exe 4564 lrfxllf.exe 968 hbbbtt.exe 1824 bthhtt.exe 3968 jjddp.exe 2264 7lrlxrl.exe 4544 frlfxxr.exe 3612 hnbttt.exe 3736 3vdvj.exe 2540 vdjjv.exe 4408 rfxrfff.exe 3764 ttnbnn.exe 3360 3tnhbt.exe 652 vpjdv.exe 3772 djpjd.exe 2100 1xrlfxx.exe 228 btbbtn.exe 636 5jpdj.exe 3244 ppdvp.exe 3304 xflfrlx.exe 2716 1rllffx.exe 1868 1tttnh.exe 1832 nhhbnn.exe 2988 5ddvd.exe 3136 9jvpv.exe 4948 9ffxrll.exe 3108 frrflfl.exe 4260 bnhbtn.exe 4792 tnnhtn.exe 2712 pdvpd.exe 4048 dpppj.exe 2312 rffxllf.exe 2260 nhbbtt.exe 3168 9bbttn.exe 5052 ppvpj.exe 4500 5pppj.exe 624 fxfxxxf.exe 3224 bhnhbb.exe 1064 7hbhbn.exe 4660 7djdp.exe 1380 vjddj.exe 3424 lxxxrrl.exe 3300 3tttnh.exe 384 3tbttt.exe 5088 vvddp.exe -
resource yara_rule behavioral2/memory/3496-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/828-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1256-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3496 wrote to memory of 2428 3496 e3000c3bc8bbfcfb55805798941c7740_NeikiAnalytics.exe 83 PID 3496 wrote to memory of 2428 3496 e3000c3bc8bbfcfb55805798941c7740_NeikiAnalytics.exe 83 PID 3496 wrote to memory of 2428 3496 e3000c3bc8bbfcfb55805798941c7740_NeikiAnalytics.exe 83 PID 2428 wrote to memory of 828 2428 7lrxxfx.exe 84 PID 2428 wrote to memory of 828 2428 7lrxxfx.exe 84 PID 2428 wrote to memory of 828 2428 7lrxxfx.exe 84 PID 828 wrote to memory of 4528 828 bhhbtt.exe 85 PID 828 wrote to memory of 4528 828 bhhbtt.exe 85 PID 828 wrote to memory of 4528 828 bhhbtt.exe 85 PID 4528 wrote to memory of 4760 4528 pvdpv.exe 86 PID 4528 wrote to memory of 4760 4528 pvdpv.exe 86 PID 4528 wrote to memory of 4760 4528 pvdpv.exe 86 PID 4760 wrote to memory of 4912 4760 1jjdj.exe 87 PID 4760 wrote to memory of 4912 4760 1jjdj.exe 87 PID 4760 wrote to memory of 4912 4760 1jjdj.exe 87 PID 4912 wrote to memory of 2692 4912 5rrlxrr.exe 88 PID 4912 wrote to memory of 2692 4912 5rrlxrr.exe 88 PID 4912 wrote to memory of 2692 4912 5rrlxrr.exe 88 PID 2692 wrote to memory of 1256 2692 tthhbt.exe 89 PID 2692 wrote to memory of 1256 2692 tthhbt.exe 89 PID 2692 wrote to memory of 1256 2692 tthhbt.exe 89 PID 1256 wrote to memory of 1384 1256 thnhtt.exe 90 PID 1256 wrote to memory of 1384 1256 thnhtt.exe 90 PID 1256 wrote to memory of 1384 1256 thnhtt.exe 90 PID 1384 wrote to memory of 3320 1384 pvpjp.exe 91 PID 1384 wrote to memory of 3320 1384 pvpjp.exe 91 PID 1384 wrote to memory of 3320 1384 pvpjp.exe 91 PID 3320 wrote to memory of 620 3320 7xrlxrl.exe 92 PID 3320 wrote to memory of 620 3320 7xrlxrl.exe 92 PID 3320 wrote to memory of 620 3320 7xrlxrl.exe 92 PID 620 wrote to memory of 3168 620 bbbnhn.exe 93 PID 620 wrote to memory of 3168 620 bbbnhn.exe 93 PID 620 wrote to memory of 3168 620 bbbnhn.exe 93 PID 3168 wrote to memory of 4844 3168 tttbtt.exe 94 PID 3168 wrote to memory of 4844 3168 tttbtt.exe 94 PID 3168 wrote to memory of 4844 3168 tttbtt.exe 94 PID 4844 wrote to memory of 5052 4844 5djdj.exe 95 PID 4844 wrote to memory of 5052 4844 5djdj.exe 95 PID 4844 wrote to memory of 5052 4844 5djdj.exe 95 PID 5052 wrote to memory of 5100 5052 fxflllr.exe 96 PID 5052 wrote to memory of 5100 5052 fxflllr.exe 96 PID 5052 wrote to memory of 5100 5052 fxflllr.exe 96 PID 5100 wrote to memory of 4780 5100 bbhbbt.exe 97 PID 5100 wrote to memory of 4780 5100 bbhbbt.exe 97 PID 5100 wrote to memory of 4780 5100 bbhbbt.exe 97 PID 4780 wrote to memory of 1860 4780 htbtht.exe 98 PID 4780 wrote to memory of 1860 4780 htbtht.exe 98 PID 4780 wrote to memory of 1860 4780 htbtht.exe 98 PID 1860 wrote to memory of 3424 1860 flxlfxx.exe 99 PID 1860 wrote to memory of 3424 1860 flxlfxx.exe 99 PID 1860 wrote to memory of 3424 1860 flxlfxx.exe 99 PID 3424 wrote to memory of 4248 3424 rxxrffx.exe 100 PID 3424 wrote to memory of 4248 3424 rxxrffx.exe 100 PID 3424 wrote to memory of 4248 3424 rxxrffx.exe 100 PID 4248 wrote to memory of 4664 4248 thhbtt.exe 101 PID 4248 wrote to memory of 4664 4248 thhbtt.exe 101 PID 4248 wrote to memory of 4664 4248 thhbtt.exe 101 PID 4664 wrote to memory of 4184 4664 vvdvd.exe 102 PID 4664 wrote to memory of 4184 4664 vvdvd.exe 102 PID 4664 wrote to memory of 4184 4664 vvdvd.exe 102 PID 4184 wrote to memory of 4564 4184 dvdpv.exe 103 PID 4184 wrote to memory of 4564 4184 dvdpv.exe 103 PID 4184 wrote to memory of 4564 4184 dvdpv.exe 103 PID 4564 wrote to memory of 968 4564 lrfxllf.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3000c3bc8bbfcfb55805798941c7740_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e3000c3bc8bbfcfb55805798941c7740_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\7lrxxfx.exec:\7lrxxfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\bhhbtt.exec:\bhhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\pvdpv.exec:\pvdpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\1jjdj.exec:\1jjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\5rrlxrr.exec:\5rrlxrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\tthhbt.exec:\tthhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\thnhtt.exec:\thnhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\pvpjp.exec:\pvpjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\7xrlxrl.exec:\7xrlxrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\bbbnhn.exec:\bbbnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\tttbtt.exec:\tttbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\5djdj.exec:\5djdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\fxflllr.exec:\fxflllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\bbhbbt.exec:\bbhbbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\htbtht.exec:\htbtht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\flxlfxx.exec:\flxlfxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\rxxrffx.exec:\rxxrffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\thhbtt.exec:\thhbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\vvdvd.exec:\vvdvd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\dvdpv.exec:\dvdpv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\lrfxllf.exec:\lrfxllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\hbbbtt.exec:\hbbbtt.exe23⤵
- Executes dropped EXE
PID:968 -
\??\c:\bthhtt.exec:\bthhtt.exe24⤵
- Executes dropped EXE
PID:1824 -
\??\c:\jjddp.exec:\jjddp.exe25⤵
- Executes dropped EXE
PID:3968 -
\??\c:\7lrlxrl.exec:\7lrlxrl.exe26⤵
- Executes dropped EXE
PID:2264 -
\??\c:\frlfxxr.exec:\frlfxxr.exe27⤵
- Executes dropped EXE
PID:4544 -
\??\c:\hnbttt.exec:\hnbttt.exe28⤵
- Executes dropped EXE
PID:3612 -
\??\c:\3vdvj.exec:\3vdvj.exe29⤵
- Executes dropped EXE
PID:3736 -
\??\c:\vdjjv.exec:\vdjjv.exe30⤵
- Executes dropped EXE
PID:2540 -
\??\c:\rfxrfff.exec:\rfxrfff.exe31⤵
- Executes dropped EXE
PID:4408 -
\??\c:\ttnbnn.exec:\ttnbnn.exe32⤵
- Executes dropped EXE
PID:3764 -
\??\c:\3tnhbt.exec:\3tnhbt.exe33⤵
- Executes dropped EXE
PID:3360 -
\??\c:\vpjdv.exec:\vpjdv.exe34⤵
- Executes dropped EXE
PID:652 -
\??\c:\djpjd.exec:\djpjd.exe35⤵
- Executes dropped EXE
PID:3772 -
\??\c:\1xrlfxx.exec:\1xrlfxx.exe36⤵
- Executes dropped EXE
PID:2100 -
\??\c:\btbbtn.exec:\btbbtn.exe37⤵
- Executes dropped EXE
PID:228 -
\??\c:\5jpdj.exec:\5jpdj.exe38⤵
- Executes dropped EXE
PID:636 -
\??\c:\ppdvp.exec:\ppdvp.exe39⤵
- Executes dropped EXE
PID:3244 -
\??\c:\xflfrlx.exec:\xflfrlx.exe40⤵
- Executes dropped EXE
PID:3304 -
\??\c:\1rllffx.exec:\1rllffx.exe41⤵
- Executes dropped EXE
PID:2716 -
\??\c:\1tttnh.exec:\1tttnh.exe42⤵
- Executes dropped EXE
PID:1868 -
\??\c:\nhhbnn.exec:\nhhbnn.exe43⤵
- Executes dropped EXE
PID:1832 -
\??\c:\5ddvd.exec:\5ddvd.exe44⤵
- Executes dropped EXE
PID:2988 -
\??\c:\9jvpv.exec:\9jvpv.exe45⤵
- Executes dropped EXE
PID:3136 -
\??\c:\9ffxrll.exec:\9ffxrll.exe46⤵
- Executes dropped EXE
PID:4948 -
\??\c:\frrflfl.exec:\frrflfl.exe47⤵
- Executes dropped EXE
PID:3108 -
\??\c:\bnhbtn.exec:\bnhbtn.exe48⤵
- Executes dropped EXE
PID:4260 -
\??\c:\tnnhtn.exec:\tnnhtn.exe49⤵
- Executes dropped EXE
PID:4792 -
\??\c:\pdvpd.exec:\pdvpd.exe50⤵
- Executes dropped EXE
PID:2712 -
\??\c:\dpppj.exec:\dpppj.exe51⤵
- Executes dropped EXE
PID:4048 -
\??\c:\rffxllf.exec:\rffxllf.exe52⤵
- Executes dropped EXE
PID:2312 -
\??\c:\nhbbtt.exec:\nhbbtt.exe53⤵
- Executes dropped EXE
PID:2260 -
\??\c:\9bbttn.exec:\9bbttn.exe54⤵
- Executes dropped EXE
PID:3168 -
\??\c:\ppvpj.exec:\ppvpj.exe55⤵
- Executes dropped EXE
PID:5052 -
\??\c:\5pppj.exec:\5pppj.exe56⤵
- Executes dropped EXE
PID:4500 -
\??\c:\fxfxxxf.exec:\fxfxxxf.exe57⤵
- Executes dropped EXE
PID:624 -
\??\c:\bhnhbb.exec:\bhnhbb.exe58⤵
- Executes dropped EXE
PID:3224 -
\??\c:\7hbhbn.exec:\7hbhbn.exe59⤵
- Executes dropped EXE
PID:1064 -
\??\c:\7djdp.exec:\7djdp.exe60⤵
- Executes dropped EXE
PID:4660 -
\??\c:\vjddj.exec:\vjddj.exe61⤵
- Executes dropped EXE
PID:1380 -
\??\c:\lxxxrrl.exec:\lxxxrrl.exe62⤵
- Executes dropped EXE
PID:3424 -
\??\c:\3tttnh.exec:\3tttnh.exe63⤵
- Executes dropped EXE
PID:3300 -
\??\c:\3tbttt.exec:\3tbttt.exe64⤵
- Executes dropped EXE
PID:384 -
\??\c:\vvddp.exec:\vvddp.exe65⤵
- Executes dropped EXE
PID:5088 -
\??\c:\vppjv.exec:\vppjv.exe66⤵PID:2184
-
\??\c:\7xfxrrf.exec:\7xfxrrf.exe67⤵PID:748
-
\??\c:\rflffxx.exec:\rflffxx.exe68⤵PID:1188
-
\??\c:\9bhhbt.exec:\9bhhbt.exe69⤵PID:968
-
\??\c:\tttttt.exec:\tttttt.exe70⤵PID:3264
-
\??\c:\dvvvj.exec:\dvvvj.exe71⤵PID:1616
-
\??\c:\pdddp.exec:\pdddp.exe72⤵PID:3288
-
\??\c:\3rrlxxx.exec:\3rrlxxx.exe73⤵PID:4388
-
\??\c:\5rxxrrr.exec:\5rxxrrr.exe74⤵PID:3540
-
\??\c:\3ttbtb.exec:\3ttbtb.exe75⤵PID:2916
-
\??\c:\btbbtt.exec:\btbbtt.exe76⤵PID:2728
-
\??\c:\5dvpd.exec:\5dvpd.exe77⤵PID:3512
-
\??\c:\vdjjv.exec:\vdjjv.exe78⤵PID:2632
-
\??\c:\lxfxllf.exec:\lxfxllf.exe79⤵PID:5096
-
\??\c:\lffxffx.exec:\lffxffx.exe80⤵PID:2404
-
\??\c:\9ntnhb.exec:\9ntnhb.exe81⤵PID:672
-
\??\c:\nhbtht.exec:\nhbtht.exe82⤵PID:448
-
\??\c:\bhnhbt.exec:\bhnhbt.exe83⤵PID:4380
-
\??\c:\ppppj.exec:\ppppj.exe84⤵PID:4716
-
\??\c:\lxxrlxr.exec:\lxxrlxr.exe85⤵PID:212
-
\??\c:\xrrrffr.exec:\xrrrffr.exe86⤵PID:4304
-
\??\c:\tnnnhh.exec:\tnnnhh.exe87⤵PID:3452
-
\??\c:\5nnnhh.exec:\5nnnhh.exe88⤵PID:3096
-
\??\c:\bttnbb.exec:\bttnbb.exe89⤵PID:3308
-
\??\c:\jvvpj.exec:\jvvpj.exe90⤵PID:2428
-
\??\c:\1fxxllf.exec:\1fxxllf.exe91⤵PID:4700
-
\??\c:\lllfxxf.exec:\lllfxxf.exe92⤵PID:3988
-
\??\c:\fflxlfl.exec:\fflxlfl.exe93⤵PID:4836
-
\??\c:\bhhhtt.exec:\bhhhtt.exe94⤵PID:1360
-
\??\c:\pjpjp.exec:\pjpjp.exe95⤵PID:2692
-
\??\c:\rrrrlfr.exec:\rrrrlfr.exe96⤵PID:2192
-
\??\c:\3rfxrrx.exec:\3rfxrrx.exe97⤵PID:1384
-
\??\c:\bnthbb.exec:\bnthbb.exe98⤵PID:4920
-
\??\c:\hhttbb.exec:\hhttbb.exe99⤵PID:3176
-
\??\c:\1vvjd.exec:\1vvjd.exe100⤵PID:1392
-
\??\c:\jvppd.exec:\jvppd.exe101⤵PID:2960
-
\??\c:\pjjjd.exec:\pjjjd.exe102⤵PID:860
-
\??\c:\xrxxlfx.exec:\xrxxlfx.exe103⤵PID:2200
-
\??\c:\rrrlxxl.exec:\rrrlxxl.exe104⤵PID:4556
-
\??\c:\httnhb.exec:\httnhb.exe105⤵PID:4328
-
\??\c:\7dvjv.exec:\7dvjv.exe106⤵PID:2488
-
\??\c:\dvvvp.exec:\dvvvp.exe107⤵PID:4628
-
\??\c:\5lrfxfx.exec:\5lrfxfx.exe108⤵PID:1548
-
\??\c:\xrrlfff.exec:\xrrlfff.exe109⤵PID:2012
-
\??\c:\bnnnhh.exec:\bnnnhh.exe110⤵PID:3700
-
\??\c:\htbttt.exec:\htbttt.exe111⤵PID:4428
-
\??\c:\dvppd.exec:\dvppd.exe112⤵PID:4392
-
\??\c:\jvppp.exec:\jvppp.exe113⤵PID:2980
-
\??\c:\rxfrrrl.exec:\rxfrrrl.exe114⤵PID:4436
-
\??\c:\xllfrrl.exec:\xllfrrl.exe115⤵PID:3152
-
\??\c:\httnhb.exec:\httnhb.exe116⤵PID:4032
-
\??\c:\btntbb.exec:\btntbb.exe117⤵PID:4080
-
\??\c:\dvvvp.exec:\dvvvp.exe118⤵PID:4084
-
\??\c:\jdvvp.exec:\jdvvp.exe119⤵PID:3564
-
\??\c:\dvvpd.exec:\dvvpd.exe120⤵PID:3968
-
\??\c:\9llrlxr.exec:\9llrlxr.exe121⤵PID:3592
-
\??\c:\htttnn.exec:\htttnn.exe122⤵PID:3288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-