Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 05:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08783d5f84a3a392e3416a00af815b5a7bbdb54d54c07226cb3fb6b31c19bdfc_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
08783d5f84a3a392e3416a00af815b5a7bbdb54d54c07226cb3fb6b31c19bdfc_NeikiAnalytics.exe
-
Size
56KB
-
MD5
c1fcad39b995c17bbe8909aceecf6e50
-
SHA1
85bffa24322e9480784f229266e61a33d921dc11
-
SHA256
08783d5f84a3a392e3416a00af815b5a7bbdb54d54c07226cb3fb6b31c19bdfc
-
SHA512
ae201fdfbaa0efc600e1395117dd2a3ebaff8d8f971f7a3bf21e5e6327d3b585836b74c8d14a9bdbeace500b01e69f98878e296917b311d2c294535429f81948
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chVnb:ymb3NkkiQ3mdBjF0crb
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/1136-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1740-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/984-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2860-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1392-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2676-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1204-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3396 6646062.exe 4988 dvjpj.exe 456 620600.exe 2248 frxlrxl.exe 4344 6880448.exe 1536 2806662.exe 4004 ppppp.exe 1872 rflxlrr.exe 3252 40640.exe 1740 4464024.exe 2620 nbhntt.exe 3168 084242.exe 2964 hbbttt.exe 5084 2404822.exe 4776 nnnnnh.exe 3468 i688222.exe 3532 42444.exe 4380 84868.exe 3504 20200.exe 3812 1frxxll.exe 1068 dvvpj.exe 984 bhhhtb.exe 1768 rxlfflx.exe 2860 lxxrxxx.exe 1392 rxlxrxx.exe 2676 lrllrrx.exe 5064 2028288.exe 1204 040000.exe 1356 xrxrfll.exe 5016 9rlffrl.exe 452 8022224.exe 1860 266088.exe 3988 602228.exe 3104 ddjjd.exe 1636 fllrxff.exe 1096 48860.exe 4640 00000.exe 244 06820.exe 1844 44602.exe 3188 466224.exe 3240 e82262.exe 4576 bnnnhn.exe 1396 4040664.exe 2356 jjpjj.exe 2644 dvddd.exe 3740 4804206.exe 928 nhbtnn.exe 3828 s8446.exe 5052 u866668.exe 724 bhnttn.exe 3252 nhnthn.exe 4464 00260.exe 4112 nthtnb.exe 2704 httnbh.exe 2964 vvppj.exe 4920 hhnttn.exe 3512 2044282.exe 4776 04228.exe 1240 066068.exe 1688 dvvpd.exe 1100 vvjdd.exe 1808 02044.exe 1608 tbhbbb.exe 848 624880.exe -
resource yara_rule behavioral2/memory/1136-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/984-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2676-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1204-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1136 wrote to memory of 3396 1136 08783d5f84a3a392e3416a00af815b5a7bbdb54d54c07226cb3fb6b31c19bdfc_NeikiAnalytics.exe 83 PID 1136 wrote to memory of 3396 1136 08783d5f84a3a392e3416a00af815b5a7bbdb54d54c07226cb3fb6b31c19bdfc_NeikiAnalytics.exe 83 PID 1136 wrote to memory of 3396 1136 08783d5f84a3a392e3416a00af815b5a7bbdb54d54c07226cb3fb6b31c19bdfc_NeikiAnalytics.exe 83 PID 3396 wrote to memory of 4988 3396 6646062.exe 84 PID 3396 wrote to memory of 4988 3396 6646062.exe 84 PID 3396 wrote to memory of 4988 3396 6646062.exe 84 PID 4988 wrote to memory of 456 4988 dvjpj.exe 85 PID 4988 wrote to memory of 456 4988 dvjpj.exe 85 PID 4988 wrote to memory of 456 4988 dvjpj.exe 85 PID 456 wrote to memory of 2248 456 620600.exe 86 PID 456 wrote to memory of 2248 456 620600.exe 86 PID 456 wrote to memory of 2248 456 620600.exe 86 PID 2248 wrote to memory of 4344 2248 frxlrxl.exe 87 PID 2248 wrote to memory of 4344 2248 frxlrxl.exe 87 PID 2248 wrote to memory of 4344 2248 frxlrxl.exe 87 PID 4344 wrote to memory of 1536 4344 6880448.exe 88 PID 4344 wrote to memory of 1536 4344 6880448.exe 88 PID 4344 wrote to memory of 1536 4344 6880448.exe 88 PID 1536 wrote to memory of 4004 1536 2806662.exe 89 PID 1536 wrote to memory of 4004 1536 2806662.exe 89 PID 1536 wrote to memory of 4004 1536 2806662.exe 89 PID 4004 wrote to memory of 1872 4004 ppppp.exe 90 PID 4004 wrote to memory of 1872 4004 ppppp.exe 90 PID 4004 wrote to memory of 1872 4004 ppppp.exe 90 PID 1872 wrote to memory of 3252 1872 rflxlrr.exe 91 PID 1872 wrote to memory of 3252 1872 rflxlrr.exe 91 PID 1872 wrote to memory of 3252 1872 rflxlrr.exe 91 PID 3252 wrote to memory of 1740 3252 40640.exe 92 PID 3252 wrote to memory of 1740 3252 40640.exe 92 PID 3252 wrote to memory of 1740 3252 40640.exe 92 PID 1740 wrote to memory of 2620 1740 4464024.exe 93 PID 1740 wrote to memory of 2620 1740 4464024.exe 93 PID 1740 wrote to memory of 2620 1740 4464024.exe 93 PID 2620 wrote to memory of 3168 2620 nbhntt.exe 94 PID 2620 wrote to memory of 3168 2620 nbhntt.exe 94 PID 2620 wrote to memory of 3168 2620 nbhntt.exe 94 PID 3168 wrote to memory of 2964 3168 084242.exe 95 PID 3168 wrote to memory of 2964 3168 084242.exe 95 PID 3168 wrote to memory of 2964 3168 084242.exe 95 PID 2964 wrote to memory of 5084 2964 hbbttt.exe 96 PID 2964 wrote to memory of 5084 2964 hbbttt.exe 96 PID 2964 wrote to memory of 5084 2964 hbbttt.exe 96 PID 5084 wrote to memory of 4776 5084 2404822.exe 97 PID 5084 wrote to memory of 4776 5084 2404822.exe 97 PID 5084 wrote to memory of 4776 5084 2404822.exe 97 PID 4776 wrote to memory of 3468 4776 nnnnnh.exe 99 PID 4776 wrote to memory of 3468 4776 nnnnnh.exe 99 PID 4776 wrote to memory of 3468 4776 nnnnnh.exe 99 PID 3468 wrote to memory of 3532 3468 i688222.exe 100 PID 3468 wrote to memory of 3532 3468 i688222.exe 100 PID 3468 wrote to memory of 3532 3468 i688222.exe 100 PID 3532 wrote to memory of 4380 3532 42444.exe 101 PID 3532 wrote to memory of 4380 3532 42444.exe 101 PID 3532 wrote to memory of 4380 3532 42444.exe 101 PID 4380 wrote to memory of 3504 4380 84868.exe 102 PID 4380 wrote to memory of 3504 4380 84868.exe 102 PID 4380 wrote to memory of 3504 4380 84868.exe 102 PID 3504 wrote to memory of 3812 3504 20200.exe 103 PID 3504 wrote to memory of 3812 3504 20200.exe 103 PID 3504 wrote to memory of 3812 3504 20200.exe 103 PID 3812 wrote to memory of 1068 3812 1frxxll.exe 104 PID 3812 wrote to memory of 1068 3812 1frxxll.exe 104 PID 3812 wrote to memory of 1068 3812 1frxxll.exe 104 PID 1068 wrote to memory of 984 1068 dvvpj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\08783d5f84a3a392e3416a00af815b5a7bbdb54d54c07226cb3fb6b31c19bdfc_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\08783d5f84a3a392e3416a00af815b5a7bbdb54d54c07226cb3fb6b31c19bdfc_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\6646062.exec:\6646062.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\dvjpj.exec:\dvjpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\620600.exec:\620600.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\frxlrxl.exec:\frxlrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\6880448.exec:\6880448.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\2806662.exec:\2806662.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\ppppp.exec:\ppppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\rflxlrr.exec:\rflxlrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\40640.exec:\40640.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\4464024.exec:\4464024.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\nbhntt.exec:\nbhntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\084242.exec:\084242.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\hbbttt.exec:\hbbttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\2404822.exec:\2404822.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\nnnnnh.exec:\nnnnnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\i688222.exec:\i688222.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\42444.exec:\42444.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\84868.exec:\84868.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\20200.exec:\20200.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\1frxxll.exec:\1frxxll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\dvvpj.exec:\dvvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\bhhhtb.exec:\bhhhtb.exe23⤵
- Executes dropped EXE
PID:984 -
\??\c:\rxlfflx.exec:\rxlfflx.exe24⤵
- Executes dropped EXE
PID:1768 -
\??\c:\lxxrxxx.exec:\lxxrxxx.exe25⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rxlxrxx.exec:\rxlxrxx.exe26⤵
- Executes dropped EXE
PID:1392 -
\??\c:\lrllrrx.exec:\lrllrrx.exe27⤵
- Executes dropped EXE
PID:2676 -
\??\c:\2028288.exec:\2028288.exe28⤵
- Executes dropped EXE
PID:5064 -
\??\c:\040000.exec:\040000.exe29⤵
- Executes dropped EXE
PID:1204 -
\??\c:\xrxrfll.exec:\xrxrfll.exe30⤵
- Executes dropped EXE
PID:1356 -
\??\c:\9rlffrl.exec:\9rlffrl.exe31⤵
- Executes dropped EXE
PID:5016 -
\??\c:\8022224.exec:\8022224.exe32⤵
- Executes dropped EXE
PID:452 -
\??\c:\266088.exec:\266088.exe33⤵
- Executes dropped EXE
PID:1860 -
\??\c:\602228.exec:\602228.exe34⤵
- Executes dropped EXE
PID:3988 -
\??\c:\ddjjd.exec:\ddjjd.exe35⤵
- Executes dropped EXE
PID:3104 -
\??\c:\fllrxff.exec:\fllrxff.exe36⤵
- Executes dropped EXE
PID:1636 -
\??\c:\48860.exec:\48860.exe37⤵
- Executes dropped EXE
PID:1096 -
\??\c:\00000.exec:\00000.exe38⤵
- Executes dropped EXE
PID:4640 -
\??\c:\06820.exec:\06820.exe39⤵
- Executes dropped EXE
PID:244 -
\??\c:\44602.exec:\44602.exe40⤵
- Executes dropped EXE
PID:1844 -
\??\c:\466224.exec:\466224.exe41⤵
- Executes dropped EXE
PID:3188 -
\??\c:\e82262.exec:\e82262.exe42⤵
- Executes dropped EXE
PID:3240 -
\??\c:\bnnnhn.exec:\bnnnhn.exe43⤵
- Executes dropped EXE
PID:4576 -
\??\c:\4040664.exec:\4040664.exe44⤵
- Executes dropped EXE
PID:1396 -
\??\c:\jjpjj.exec:\jjpjj.exe45⤵
- Executes dropped EXE
PID:2356 -
\??\c:\dvddd.exec:\dvddd.exe46⤵
- Executes dropped EXE
PID:2644 -
\??\c:\4804206.exec:\4804206.exe47⤵
- Executes dropped EXE
PID:3740 -
\??\c:\nhbtnn.exec:\nhbtnn.exe48⤵
- Executes dropped EXE
PID:928 -
\??\c:\s8446.exec:\s8446.exe49⤵
- Executes dropped EXE
PID:3828 -
\??\c:\u866668.exec:\u866668.exe50⤵
- Executes dropped EXE
PID:5052 -
\??\c:\bhnttn.exec:\bhnttn.exe51⤵
- Executes dropped EXE
PID:724 -
\??\c:\nhnthn.exec:\nhnthn.exe52⤵
- Executes dropped EXE
PID:3252 -
\??\c:\00260.exec:\00260.exe53⤵
- Executes dropped EXE
PID:4464 -
\??\c:\nthtnb.exec:\nthtnb.exe54⤵
- Executes dropped EXE
PID:4112 -
\??\c:\httnbh.exec:\httnbh.exe55⤵
- Executes dropped EXE
PID:2704 -
\??\c:\vvppj.exec:\vvppj.exe56⤵
- Executes dropped EXE
PID:2964 -
\??\c:\hhnttn.exec:\hhnttn.exe57⤵
- Executes dropped EXE
PID:4920 -
\??\c:\2044282.exec:\2044282.exe58⤵
- Executes dropped EXE
PID:3512 -
\??\c:\04228.exec:\04228.exe59⤵
- Executes dropped EXE
PID:4776 -
\??\c:\066068.exec:\066068.exe60⤵
- Executes dropped EXE
PID:1240 -
\??\c:\dvvpd.exec:\dvvpd.exe61⤵
- Executes dropped EXE
PID:1688 -
\??\c:\vvjdd.exec:\vvjdd.exe62⤵
- Executes dropped EXE
PID:1100 -
\??\c:\02044.exec:\02044.exe63⤵
- Executes dropped EXE
PID:1808 -
\??\c:\tbhbbb.exec:\tbhbbb.exe64⤵
- Executes dropped EXE
PID:1608 -
\??\c:\624880.exec:\624880.exe65⤵
- Executes dropped EXE
PID:848 -
\??\c:\xxfrrll.exec:\xxfrrll.exe66⤵PID:4636
-
\??\c:\m6620.exec:\m6620.exe67⤵PID:1796
-
\??\c:\xlxrllr.exec:\xlxrllr.exe68⤵PID:984
-
\??\c:\xfflxlr.exec:\xfflxlr.exe69⤵PID:2260
-
\??\c:\ffflfrx.exec:\ffflfrx.exe70⤵PID:2860
-
\??\c:\fxlrrfl.exec:\fxlrrfl.exe71⤵PID:1664
-
\??\c:\c208282.exec:\c208282.exe72⤵PID:2432
-
\??\c:\flxxxff.exec:\flxxxff.exe73⤵PID:3756
-
\??\c:\pdppd.exec:\pdppd.exe74⤵PID:952
-
\??\c:\680868.exec:\680868.exe75⤵PID:1868
-
\??\c:\pvdjp.exec:\pvdjp.exe76⤵PID:1760
-
\??\c:\444224.exec:\444224.exe77⤵PID:4688
-
\??\c:\2060820.exec:\2060820.exe78⤵PID:1192
-
\??\c:\620822.exec:\620822.exe79⤵PID:464
-
\??\c:\i062660.exec:\i062660.exe80⤵PID:4676
-
\??\c:\5jdpd.exec:\5jdpd.exe81⤵PID:3044
-
\??\c:\bbbthh.exec:\bbbthh.exe82⤵PID:4912
-
\??\c:\220264.exec:\220264.exe83⤵PID:4512
-
\??\c:\bhhtnh.exec:\bhhtnh.exe84⤵PID:2696
-
\??\c:\frxrffl.exec:\frxrffl.exe85⤵PID:2308
-
\??\c:\tnthbh.exec:\tnthbh.exe86⤵PID:3528
-
\??\c:\5djjj.exec:\5djjj.exe87⤵PID:4612
-
\??\c:\4464004.exec:\4464004.exe88⤵PID:532
-
\??\c:\0460624.exec:\0460624.exe89⤵PID:1420
-
\??\c:\68460.exec:\68460.exe90⤵PID:1884
-
\??\c:\s6664.exec:\s6664.exe91⤵PID:2332
-
\??\c:\8448260.exec:\8448260.exe92⤵PID:1520
-
\??\c:\468044.exec:\468044.exe93⤵PID:3224
-
\??\c:\dvpjv.exec:\dvpjv.exe94⤵PID:3740
-
\??\c:\5lxxfrr.exec:\5lxxfrr.exe95⤵PID:964
-
\??\c:\djpjj.exec:\djpjj.exe96⤵PID:3864
-
\??\c:\vddjp.exec:\vddjp.exe97⤵PID:740
-
\??\c:\dvdpj.exec:\dvdpj.exe98⤵PID:852
-
\??\c:\djppv.exec:\djppv.exe99⤵PID:1320
-
\??\c:\lrxlffx.exec:\lrxlffx.exe100⤵PID:1328
-
\??\c:\66886.exec:\66886.exe101⤵PID:3132
-
\??\c:\vjpjd.exec:\vjpjd.exe102⤵PID:3088
-
\??\c:\pddjp.exec:\pddjp.exe103⤵PID:3032
-
\??\c:\860484.exec:\860484.exe104⤵PID:2604
-
\??\c:\00606.exec:\00606.exe105⤵PID:4760
-
\??\c:\bhnnbb.exec:\bhnnbb.exe106⤵PID:1240
-
\??\c:\400440.exec:\400440.exe107⤵PID:4040
-
\??\c:\fxfxrfl.exec:\fxfxrfl.exe108⤵PID:1100
-
\??\c:\bbbttt.exec:\bbbttt.exe109⤵PID:3860
-
\??\c:\vdvpd.exec:\vdvpd.exe110⤵PID:1036
-
\??\c:\2448884.exec:\2448884.exe111⤵PID:3652
-
\??\c:\dvddd.exec:\dvddd.exe112⤵PID:1712
-
\??\c:\0444428.exec:\0444428.exe113⤵PID:4192
-
\??\c:\1jvvj.exec:\1jvvj.exe114⤵PID:1768
-
\??\c:\btntnt.exec:\btntnt.exe115⤵PID:3320
-
\??\c:\fffflrr.exec:\fffflrr.exe116⤵PID:3316
-
\??\c:\9xrxxxr.exec:\9xrxxxr.exe117⤵PID:4712
-
\??\c:\lrfxlll.exec:\lrfxlll.exe118⤵PID:1592
-
\??\c:\0628288.exec:\0628288.exe119⤵PID:1204
-
\??\c:\2244664.exec:\2244664.exe120⤵PID:3568
-
\??\c:\rllrrrl.exec:\rllrrrl.exe121⤵PID:1760
-
\??\c:\e86488.exec:\e86488.exe122⤵PID:4996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-