Analysis
-
max time kernel
135s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 15:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dd9c431fe2b7410fef9f665507e98d50_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
dd9c431fe2b7410fef9f665507e98d50_NeikiAnalytics.exe
-
Size
76KB
-
MD5
dd9c431fe2b7410fef9f665507e98d50
-
SHA1
e0ebb190a7ad5aa55bc57d566dc6b3ed36d2dee2
-
SHA256
827151585e870ca38cc0a2b9a20f8d925d06b5d7a4f424e98aee6ad3d3c29362
-
SHA512
d6550b0b79af8ab742a1f6185586d0ab779c432fca66dd89ffa2a34877e432351cd211e421c2a1586472843ea77b991b5092048f27edff0de65c6da458ed08fb
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2wVEJW:ymb3NkkiQ3mdBjF+3TU2KEJW
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/1744-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2112-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1240-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1792-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3788-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1264-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2496 7lrlrrx.exe 3616 xllxlfl.exe 2112 ppjdv.exe 4612 048062.exe 4980 3jpjd.exe 1544 w44828.exe 1804 8844888.exe 4828 dvjdj.exe 1240 xxxrlxx.exe 8 2648826.exe 1792 fxlfxxr.exe 4972 680622.exe 3896 xlfxxxf.exe 740 bnttnn.exe 628 420488.exe 3788 48220.exe 3256 xrxlxrl.exe 2856 fllxxfl.exe 3184 0084226.exe 1540 48864.exe 1484 2266604.exe 2328 w88822.exe 2964 66264.exe 3192 nthbtt.exe 1264 llfxxxr.exe 3536 6804848.exe 2764 o406044.exe 1092 40402.exe 2396 26680.exe 4416 bhhthb.exe 3180 rlfxrll.exe 3784 lrflrlx.exe 1644 dvjdv.exe 2508 2620004.exe 1580 s8448.exe 2008 bnbbbb.exe 1256 xxrrfxx.exe 3428 llrrllr.exe 1744 264444.exe 4584 xrfxllr.exe 4936 fxrrrrl.exe 2052 02826.exe 4652 k08202.exe 224 428200.exe 1208 rfrrlll.exe 2612 484266.exe 4544 84048.exe 1596 0422222.exe 2452 220462.exe 2016 vvdvv.exe 1084 pvpjp.exe 1240 nbbthh.exe 3856 btnnbn.exe 1792 nhthtt.exe 3280 i826600.exe 3876 dvpjd.exe 4092 2406004.exe 456 3xxxxxx.exe 4636 26660.exe 2608 lffrfxx.exe 3256 40666.exe 2856 22266.exe 2412 pddjj.exe 644 604844.exe -
resource yara_rule behavioral2/memory/1744-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2112-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2112-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1792-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3788-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1264-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-186-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1744 wrote to memory of 2496 1744 dd9c431fe2b7410fef9f665507e98d50_NeikiAnalytics.exe 83 PID 1744 wrote to memory of 2496 1744 dd9c431fe2b7410fef9f665507e98d50_NeikiAnalytics.exe 83 PID 1744 wrote to memory of 2496 1744 dd9c431fe2b7410fef9f665507e98d50_NeikiAnalytics.exe 83 PID 2496 wrote to memory of 3616 2496 7lrlrrx.exe 84 PID 2496 wrote to memory of 3616 2496 7lrlrrx.exe 84 PID 2496 wrote to memory of 3616 2496 7lrlrrx.exe 84 PID 3616 wrote to memory of 2112 3616 xllxlfl.exe 85 PID 3616 wrote to memory of 2112 3616 xllxlfl.exe 85 PID 3616 wrote to memory of 2112 3616 xllxlfl.exe 85 PID 2112 wrote to memory of 4612 2112 ppjdv.exe 86 PID 2112 wrote to memory of 4612 2112 ppjdv.exe 86 PID 2112 wrote to memory of 4612 2112 ppjdv.exe 86 PID 4612 wrote to memory of 4980 4612 048062.exe 87 PID 4612 wrote to memory of 4980 4612 048062.exe 87 PID 4612 wrote to memory of 4980 4612 048062.exe 87 PID 4980 wrote to memory of 1544 4980 3jpjd.exe 88 PID 4980 wrote to memory of 1544 4980 3jpjd.exe 88 PID 4980 wrote to memory of 1544 4980 3jpjd.exe 88 PID 1544 wrote to memory of 1804 1544 w44828.exe 89 PID 1544 wrote to memory of 1804 1544 w44828.exe 89 PID 1544 wrote to memory of 1804 1544 w44828.exe 89 PID 1804 wrote to memory of 4828 1804 8844888.exe 90 PID 1804 wrote to memory of 4828 1804 8844888.exe 90 PID 1804 wrote to memory of 4828 1804 8844888.exe 90 PID 4828 wrote to memory of 1240 4828 dvjdj.exe 91 PID 4828 wrote to memory of 1240 4828 dvjdj.exe 91 PID 4828 wrote to memory of 1240 4828 dvjdj.exe 91 PID 1240 wrote to memory of 8 1240 xxxrlxx.exe 92 PID 1240 wrote to memory of 8 1240 xxxrlxx.exe 92 PID 1240 wrote to memory of 8 1240 xxxrlxx.exe 92 PID 8 wrote to memory of 1792 8 2648826.exe 93 PID 8 wrote to memory of 1792 8 2648826.exe 93 PID 8 wrote to memory of 1792 8 2648826.exe 93 PID 1792 wrote to memory of 4972 1792 fxlfxxr.exe 94 PID 1792 wrote to memory of 4972 1792 fxlfxxr.exe 94 PID 1792 wrote to memory of 4972 1792 fxlfxxr.exe 94 PID 4972 wrote to memory of 3896 4972 680622.exe 95 PID 4972 wrote to memory of 3896 4972 680622.exe 95 PID 4972 wrote to memory of 3896 4972 680622.exe 95 PID 3896 wrote to memory of 740 3896 xlfxxxf.exe 96 PID 3896 wrote to memory of 740 3896 xlfxxxf.exe 96 PID 3896 wrote to memory of 740 3896 xlfxxxf.exe 96 PID 740 wrote to memory of 628 740 bnttnn.exe 97 PID 740 wrote to memory of 628 740 bnttnn.exe 97 PID 740 wrote to memory of 628 740 bnttnn.exe 97 PID 628 wrote to memory of 3788 628 420488.exe 98 PID 628 wrote to memory of 3788 628 420488.exe 98 PID 628 wrote to memory of 3788 628 420488.exe 98 PID 3788 wrote to memory of 3256 3788 48220.exe 99 PID 3788 wrote to memory of 3256 3788 48220.exe 99 PID 3788 wrote to memory of 3256 3788 48220.exe 99 PID 3256 wrote to memory of 2856 3256 xrxlxrl.exe 100 PID 3256 wrote to memory of 2856 3256 xrxlxrl.exe 100 PID 3256 wrote to memory of 2856 3256 xrxlxrl.exe 100 PID 2856 wrote to memory of 3184 2856 fllxxfl.exe 102 PID 2856 wrote to memory of 3184 2856 fllxxfl.exe 102 PID 2856 wrote to memory of 3184 2856 fllxxfl.exe 102 PID 3184 wrote to memory of 1540 3184 0084226.exe 103 PID 3184 wrote to memory of 1540 3184 0084226.exe 103 PID 3184 wrote to memory of 1540 3184 0084226.exe 103 PID 1540 wrote to memory of 1484 1540 48864.exe 104 PID 1540 wrote to memory of 1484 1540 48864.exe 104 PID 1540 wrote to memory of 1484 1540 48864.exe 104 PID 1484 wrote to memory of 2328 1484 2266604.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd9c431fe2b7410fef9f665507e98d50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dd9c431fe2b7410fef9f665507e98d50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\7lrlrrx.exec:\7lrlrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\xllxlfl.exec:\xllxlfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\ppjdv.exec:\ppjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\048062.exec:\048062.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\3jpjd.exec:\3jpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\w44828.exec:\w44828.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\8844888.exec:\8844888.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\dvjdj.exec:\dvjdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\xxxrlxx.exec:\xxxrlxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\2648826.exec:\2648826.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\680622.exec:\680622.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\xlfxxxf.exec:\xlfxxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\bnttnn.exec:\bnttnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\420488.exec:\420488.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\48220.exec:\48220.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\xrxlxrl.exec:\xrxlxrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\fllxxfl.exec:\fllxxfl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\0084226.exec:\0084226.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\48864.exec:\48864.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\2266604.exec:\2266604.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\w88822.exec:\w88822.exe23⤵
- Executes dropped EXE
PID:2328 -
\??\c:\66264.exec:\66264.exe24⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nthbtt.exec:\nthbtt.exe25⤵
- Executes dropped EXE
PID:3192 -
\??\c:\llfxxxr.exec:\llfxxxr.exe26⤵
- Executes dropped EXE
PID:1264 -
\??\c:\6804848.exec:\6804848.exe27⤵
- Executes dropped EXE
PID:3536 -
\??\c:\o406044.exec:\o406044.exe28⤵
- Executes dropped EXE
PID:2764 -
\??\c:\40402.exec:\40402.exe29⤵
- Executes dropped EXE
PID:1092 -
\??\c:\26680.exec:\26680.exe30⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bhhthb.exec:\bhhthb.exe31⤵
- Executes dropped EXE
PID:4416 -
\??\c:\rlfxrll.exec:\rlfxrll.exe32⤵
- Executes dropped EXE
PID:3180 -
\??\c:\lrflrlx.exec:\lrflrlx.exe33⤵
- Executes dropped EXE
PID:3784 -
\??\c:\dvjdv.exec:\dvjdv.exe34⤵
- Executes dropped EXE
PID:1644 -
\??\c:\2620004.exec:\2620004.exe35⤵
- Executes dropped EXE
PID:2508 -
\??\c:\s8448.exec:\s8448.exe36⤵
- Executes dropped EXE
PID:1580 -
\??\c:\bnbbbb.exec:\bnbbbb.exe37⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xxrrfxx.exec:\xxrrfxx.exe38⤵
- Executes dropped EXE
PID:1256 -
\??\c:\llrrllr.exec:\llrrllr.exe39⤵
- Executes dropped EXE
PID:3428 -
\??\c:\264444.exec:\264444.exe40⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xrfxllr.exec:\xrfxllr.exe41⤵
- Executes dropped EXE
PID:4584 -
\??\c:\fxrrrrl.exec:\fxrrrrl.exe42⤵
- Executes dropped EXE
PID:4936 -
\??\c:\02826.exec:\02826.exe43⤵
- Executes dropped EXE
PID:2052 -
\??\c:\k08202.exec:\k08202.exe44⤵
- Executes dropped EXE
PID:4652 -
\??\c:\428200.exec:\428200.exe45⤵
- Executes dropped EXE
PID:224 -
\??\c:\rfrrlll.exec:\rfrrlll.exe46⤵
- Executes dropped EXE
PID:1208 -
\??\c:\484266.exec:\484266.exe47⤵
- Executes dropped EXE
PID:2612 -
\??\c:\84048.exec:\84048.exe48⤵
- Executes dropped EXE
PID:4544 -
\??\c:\0422222.exec:\0422222.exe49⤵
- Executes dropped EXE
PID:1596 -
\??\c:\220462.exec:\220462.exe50⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vvdvv.exec:\vvdvv.exe51⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pvpjp.exec:\pvpjp.exe52⤵
- Executes dropped EXE
PID:1084 -
\??\c:\nbbthh.exec:\nbbthh.exe53⤵
- Executes dropped EXE
PID:1240 -
\??\c:\btnnbn.exec:\btnnbn.exe54⤵
- Executes dropped EXE
PID:3856 -
\??\c:\nhthtt.exec:\nhthtt.exe55⤵
- Executes dropped EXE
PID:1792 -
\??\c:\i826600.exec:\i826600.exe56⤵
- Executes dropped EXE
PID:3280 -
\??\c:\dvpjd.exec:\dvpjd.exe57⤵
- Executes dropped EXE
PID:3876 -
\??\c:\2406004.exec:\2406004.exe58⤵
- Executes dropped EXE
PID:4092 -
\??\c:\3xxxxxx.exec:\3xxxxxx.exe59⤵
- Executes dropped EXE
PID:456 -
\??\c:\26660.exec:\26660.exe60⤵
- Executes dropped EXE
PID:4636 -
\??\c:\lffrfxx.exec:\lffrfxx.exe61⤵
- Executes dropped EXE
PID:2608 -
\??\c:\40666.exec:\40666.exe62⤵
- Executes dropped EXE
PID:3256 -
\??\c:\22266.exec:\22266.exe63⤵
- Executes dropped EXE
PID:2856 -
\??\c:\pddjj.exec:\pddjj.exe64⤵
- Executes dropped EXE
PID:2412 -
\??\c:\604844.exec:\604844.exe65⤵
- Executes dropped EXE
PID:644 -
\??\c:\a2620.exec:\a2620.exe66⤵PID:2344
-
\??\c:\frfrrrl.exec:\frfrrrl.exe67⤵PID:2876
-
\??\c:\u008222.exec:\u008222.exe68⤵PID:1316
-
\??\c:\hhnnht.exec:\hhnnht.exe69⤵PID:2420
-
\??\c:\0404226.exec:\0404226.exe70⤵PID:2304
-
\??\c:\26444.exec:\26444.exe71⤵PID:920
-
\??\c:\tbhbnn.exec:\tbhbnn.exe72⤵PID:3588
-
\??\c:\0444882.exec:\0444882.exe73⤵PID:1896
-
\??\c:\6226468.exec:\6226468.exe74⤵PID:4300
-
\??\c:\m4840.exec:\m4840.exe75⤵PID:3948
-
\??\c:\42848.exec:\42848.exe76⤵PID:4948
-
\??\c:\vvdvd.exec:\vvdvd.exe77⤵PID:5028
-
\??\c:\nbtnnn.exec:\nbtnnn.exe78⤵PID:2236
-
\??\c:\vvddj.exec:\vvddj.exe79⤵PID:2116
-
\??\c:\pjdpp.exec:\pjdpp.exe80⤵PID:4692
-
\??\c:\22408.exec:\22408.exe81⤵PID:3180
-
\??\c:\fxfxrlr.exec:\fxfxrlr.exe82⤵PID:728
-
\??\c:\q88260.exec:\q88260.exe83⤵PID:216
-
\??\c:\pddvp.exec:\pddvp.exe84⤵PID:2508
-
\??\c:\4402040.exec:\4402040.exe85⤵PID:4772
-
\??\c:\044828.exec:\044828.exe86⤵PID:4500
-
\??\c:\fffxrrr.exec:\fffxrrr.exe87⤵PID:4404
-
\??\c:\jppjd.exec:\jppjd.exe88⤵PID:4308
-
\??\c:\c480206.exec:\c480206.exe89⤵PID:4576
-
\??\c:\684822.exec:\684822.exe90⤵PID:4584
-
\??\c:\pdpdj.exec:\pdpdj.exe91⤵PID:2108
-
\??\c:\hhnhhb.exec:\hhnhhb.exe92⤵PID:228
-
\??\c:\m4486.exec:\m4486.exe93⤵PID:4612
-
\??\c:\628204.exec:\628204.exe94⤵PID:2800
-
\??\c:\dppjp.exec:\dppjp.exe95⤵PID:1880
-
\??\c:\rrrlffx.exec:\rrrlffx.exe96⤵PID:2716
-
\??\c:\6066666.exec:\6066666.exe97⤵PID:1544
-
\??\c:\frrfxfr.exec:\frrfxfr.exe98⤵PID:2388
-
\??\c:\pdjdp.exec:\pdjdp.exe99⤵PID:5100
-
\??\c:\402282.exec:\402282.exe100⤵PID:2512
-
\??\c:\rflxrlf.exec:\rflxrlf.exe101⤵PID:1824
-
\??\c:\djjjd.exec:\djjjd.exe102⤵PID:3052
-
\??\c:\9rlfrll.exec:\9rlfrll.exe103⤵PID:5040
-
\??\c:\24402.exec:\24402.exe104⤵PID:3620
-
\??\c:\68042.exec:\68042.exe105⤵PID:3896
-
\??\c:\o242668.exec:\o242668.exe106⤵PID:2596
-
\??\c:\5nhnnh.exec:\5nhnnh.exe107⤵PID:1844
-
\??\c:\u008800.exec:\u008800.exe108⤵PID:4048
-
\??\c:\dpvpj.exec:\dpvpj.exe109⤵PID:2320
-
\??\c:\420646.exec:\420646.exe110⤵PID:1416
-
\??\c:\lfllxfx.exec:\lfllxfx.exe111⤵PID:772
-
\??\c:\26604.exec:\26604.exe112⤵PID:3176
-
\??\c:\240048.exec:\240048.exe113⤵PID:3728
-
\??\c:\bthnhh.exec:\bthnhh.exe114⤵PID:848
-
\??\c:\6866444.exec:\6866444.exe115⤵PID:4264
-
\??\c:\4282660.exec:\4282660.exe116⤵PID:1576
-
\??\c:\tnhbth.exec:\tnhbth.exe117⤵PID:920
-
\??\c:\jvdvp.exec:\jvdvp.exe118⤵PID:2940
-
\??\c:\20208.exec:\20208.exe119⤵PID:3764
-
\??\c:\48448.exec:\48448.exe120⤵PID:1384
-
\??\c:\800048.exec:\800048.exe121⤵PID:1768
-
\??\c:\042660.exec:\042660.exe122⤵PID:4152
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-