Analysis
- max time kernel
150s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 01:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1482fa54f1ff2d09b86164bb5c0a6b00_NeikiAnalytics.exe
Resource
win7-20240221-en
4 signatures
150 seconds
General
- Target 1482fa54f1ff2d09b86164bb5c0a6b00_NeikiAnalytics.exe
- Size 260KB
- Sample240612-br5m7axern
- SHA256 4c4493f30c5c01624f5ab0056c8fac8686a77ace6d375d79075d0a7331a060ac
- MD5 1482fa54f1ff2d09b86164bb5c0a6b00
- SHA1 0527e58f0772d44696fd6bf42c50515225cef4f9
- SHA512 4f68bd1ba0f1eb977bb3e3c3b243149ae8582f1984ff5b2f91fd4e9fb9584dfdce02ea8353f2f9b2087deb9adff3c696c45b92125da44890a663a868e6d51c03
- SSDEEP 6144:ecm4FmowdHoSF0NowrhraHcpOFltH4t+IDvSXrhJ5n:A4wFHoSFA1eFp3IDvSbhD
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1180-6-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3908-8-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2992-13-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4436-20-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/960-25-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4228-39-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1664-43-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1212-67-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4792-70-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/736-75-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3576-85-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4712-91-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4784-100-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3552-106-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4528-111-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2000-97-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4284-121-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4952-124-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1216-133-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1432-140-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2548-145-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2940-162-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3732-163-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4156-173-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4272-184-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/400-186-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3884-193-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1188-197-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2776-204-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2984-218-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3288-230-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4788-232-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4912-236-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1660-245-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1340-258-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5048-263-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1784-275-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4716-292-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3944-299-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3608-307-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1740-314-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4860-318-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3152-333-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4440-343-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3696-350-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4052-360-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1908-362-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4084-377-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4380-385-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3756-389-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/736-402-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3552-426-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4200-433-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4952-439-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2492-446-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1564-451-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1468-466-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4712-559-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3336-624-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/880-648-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/704-706-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3224-713-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3820-795-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1948-823-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 3908 9rrlfxr.exe 2992 bntnhb.exe 4436 rfxrlll.exe 960 tbhhbt.exe 2856 pddvv.exe 4228 xrxrffx.exe 1664 tbhbtn.exe 2932 nnbtbt.exe 1552 vvdvp.exe 4912 xrffxxr.exe 1212 btbhnn.exe 4792 dppjd.exe 736 fllrffl.exe 3576 ttbbnn.exe 4712 vdpjp.exe 2000 rffxxxr.exe 4784 jjjdd.exe 3552 pdvpd.exe 4528 rlxrllf.exe 4284 tnhbnn.exe 4952 pvdjj.exe 1216 xxxrxrf.exe 1432 jdjdd.exe 2548 9jpjv.exe 2276 rrrflfx.exe 3752 frxrlxx.exe 2940 bbbntn.exe 3732 tbbtbn.exe 4156 pdvjv.exe 1832 7fxfflx.exe 4272 3bthhb.exe 400 htthnn.exe 3884 lxxffll.exe 1188 lxlfrlx.exe 1868 ttthbn.exe 2776 btnbbt.exe 1524 3pjdj.exe 744 xrxrfrf.exe 1520 9nnhnb.exe 4228 3nnbtn.exe 2984 dvvdp.exe 1664 ddvpv.exe 3524 lrfrlfr.exe 3288 9rrlfxr.exe 4788 ttbtnh.exe 4912 5dvpv.exe 4464 djjvd.exe 1660 rxfflfx.exe 1900 nhbthb.exe 2816 vpdpj.exe 2004 dpjjp.exe 1340 frlxrll.exe 1596 bnhbnh.exe 5048 bhbnhb.exe 4524 jvpjv.exe 3552 dpvjj.exe 1784 lfxlrlx.exe 1536 fxrlxlf.exe 1808 hbtnhh.exe 4328 1vvdj.exe 2492 lxxrxxl.exe 4716 xlrflff.exe 1048 fllfrlf.exe 3944 tttnbt.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1180 wrote to memory of 3908 1180 1482fa54f1ff2d09b86164bb5c0a6b00_NeikiAnalytics.exe 87 PID 1180 wrote to memory of 3908 1180 1482fa54f1ff2d09b86164bb5c0a6b00_NeikiAnalytics.exe 87 PID 1180 wrote to memory of 3908 1180 1482fa54f1ff2d09b86164bb5c0a6b00_NeikiAnalytics.exe 87 PID 3908 wrote to memory of 2992 3908 9rrlfxr.exe 88 PID 3908 wrote to memory of 2992 3908 9rrlfxr.exe 88 PID 3908 wrote to memory of 2992 3908 9rrlfxr.exe 88 PID 2992 wrote to memory of 4436 2992 bntnhb.exe 91 PID 2992 wrote to memory of 4436 2992 bntnhb.exe 91 PID 2992 wrote to memory of 4436 2992 bntnhb.exe 91 PID 4436 wrote to memory of 960 4436 rfxrlll.exe 92 PID 4436 wrote to memory of 960 4436 rfxrlll.exe 92 PID 4436 wrote to memory of 960 4436 rfxrlll.exe 92 PID 960 wrote to memory of 2856 960 tbhhbt.exe 93 PID 960 wrote to memory of 2856 960 tbhhbt.exe 93 PID 960 wrote to memory of 2856 960 tbhhbt.exe 93 PID 2856 wrote to memory of 4228 2856 pddvv.exe 94 PID 2856 wrote to memory of 4228 2856 pddvv.exe 94 PID 2856 wrote to memory of 4228 2856 pddvv.exe 94 PID 4228 wrote to memory of 1664 4228 xrxrffx.exe 96 PID 4228 wrote to memory of 1664 4228 xrxrffx.exe 96 PID 4228 wrote to memory of 1664 4228 xrxrffx.exe 96 PID 1664 wrote to memory of 2932 1664 tbhbtn.exe 97 PID 1664 wrote to memory of 2932 1664 tbhbtn.exe 97 PID 1664 wrote to memory of 2932 1664 tbhbtn.exe 97 PID 2932 wrote to memory of 1552 2932 nnbtbt.exe 98 PID 2932 wrote to memory of 1552 2932 nnbtbt.exe 98 PID 2932 wrote to memory of 1552 2932 nnbtbt.exe 98 PID 1552 wrote to memory of 4912 1552 vvdvp.exe 99 PID 1552 wrote to memory of 4912 1552 vvdvp.exe 99 PID 1552 wrote to memory of 4912 1552 vvdvp.exe 99 PID 4912 wrote to memory of 1212 4912 xrffxxr.exe 100 PID 4912 wrote to memory of 1212 4912 xrffxxr.exe 100 PID 4912 wrote to memory of 1212 4912 xrffxxr.exe 100 PID 1212 wrote to memory of 4792 1212 btbhnn.exe 101 PID 1212 wrote to memory of 4792 1212 btbhnn.exe 101 PID 1212 wrote to memory of 4792 1212 btbhnn.exe 101 PID 4792 wrote to memory of 736 4792 dppjd.exe 102 PID 4792 wrote to memory of 736 4792 dppjd.exe 102 PID 4792 wrote to memory of 736 4792 dppjd.exe 102 PID 736 wrote to memory of 3576 736 fllrffl.exe 103 PID 736 wrote to memory of 3576 736 fllrffl.exe 103 PID 736 wrote to memory of 3576 736 fllrffl.exe 103 PID 3576 wrote to memory of 4712 3576 ttbbnn.exe 104 PID 3576 wrote to memory of 4712 3576 ttbbnn.exe 104 PID 3576 wrote to memory of 4712 3576 ttbbnn.exe 104 PID 4712 wrote to memory of 2000 4712 vdpjp.exe 105 PID 4712 wrote to memory of 2000 4712 vdpjp.exe 105 PID 4712 wrote to memory of 2000 4712 vdpjp.exe 105 PID 2000 wrote to memory of 4784 2000 rffxxxr.exe 106 PID 2000 wrote to memory of 4784 2000 rffxxxr.exe 106 PID 2000 wrote to memory of 4784 2000 rffxxxr.exe 106 PID 4784 wrote to memory of 3552 4784 jjjdd.exe 107 PID 4784 wrote to memory of 3552 4784 jjjdd.exe 107 PID 4784 wrote to memory of 3552 4784 jjjdd.exe 107 PID 3552 wrote to memory of 4528 3552 pdvpd.exe 108 PID 3552 wrote to memory of 4528 3552 pdvpd.exe 108 PID 3552 wrote to memory of 4528 3552 pdvpd.exe 108 PID 4528 wrote to memory of 4284 4528 rlxrllf.exe 109 PID 4528 wrote to memory of 4284 4528 rlxrllf.exe 109 PID 4528 wrote to memory of 4284 4528 rlxrllf.exe 109 PID 4284 wrote to memory of 4952 4284 tnhbnn.exe 110 PID 4284 wrote to memory of 4952 4284 tnhbnn.exe 110 PID 4284 wrote to memory of 4952 4284 tnhbnn.exe 110 PID 4952 wrote to memory of 1216 4952 pvdjj.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\1482fa54f1ff2d09b86164bb5c0a6b00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1482fa54f1ff2d09b86164bb5c0a6b00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\9rrlfxr.exec:\9rrlfxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\bntnhb.exec:\bntnhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\rfxrlll.exec:\rfxrlll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\tbhhbt.exec:\tbhhbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\pddvv.exec:\pddvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\xrxrffx.exec:\xrxrffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\tbhbtn.exec:\tbhbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\nnbtbt.exec:\nnbtbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\vvdvp.exec:\vvdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\xrffxxr.exec:\xrffxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\btbhnn.exec:\btbhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\dppjd.exec:\dppjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\fllrffl.exec:\fllrffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\ttbbnn.exec:\ttbbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\vdpjp.exec:\vdpjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\rffxxxr.exec:\rffxxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\jjjdd.exec:\jjjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\pdvpd.exec:\pdvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\rlxrllf.exec:\rlxrllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\tnhbnn.exec:\tnhbnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\pvdjj.exec:\pvdjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\xxxrxrf.exec:\xxxrxrf.exe23⤵
- Executes dropped EXE
PID:1216 -
\??\c:\jdjdd.exec:\jdjdd.exe24⤵
- Executes dropped EXE
PID:1432 -
\??\c:\9jpjv.exec:\9jpjv.exe25⤵
- Executes dropped EXE
PID:2548 -
\??\c:\rrrflfx.exec:\rrrflfx.exe26⤵
- Executes dropped EXE
PID:2276 -
\??\c:\frxrlxx.exec:\frxrlxx.exe27⤵
- Executes dropped EXE
PID:3752 -
\??\c:\bbbntn.exec:\bbbntn.exe28⤵
- Executes dropped EXE
PID:2940 -
\??\c:\tbbtbn.exec:\tbbtbn.exe29⤵
- Executes dropped EXE
PID:3732 -
\??\c:\pdvjv.exec:\pdvjv.exe30⤵
- Executes dropped EXE
PID:4156 -
\??\c:\7fxfflx.exec:\7fxfflx.exe31⤵
- Executes dropped EXE
PID:1832 -
\??\c:\3bthhb.exec:\3bthhb.exe32⤵
- Executes dropped EXE
PID:4272 -
\??\c:\htthnn.exec:\htthnn.exe33⤵
- Executes dropped EXE
PID:400 -
\??\c:\lxxffll.exec:\lxxffll.exe34⤵
- Executes dropped EXE
PID:3884 -
\??\c:\lxlfrlx.exec:\lxlfrlx.exe35⤵
- Executes dropped EXE
PID:1188 -
\??\c:\ttthbn.exec:\ttthbn.exe36⤵
- Executes dropped EXE
PID:1868 -
\??\c:\btnbbt.exec:\btnbbt.exe37⤵
- Executes dropped EXE
PID:2776 -
\??\c:\3pjdj.exec:\3pjdj.exe38⤵
- Executes dropped EXE
PID:1524 -
\??\c:\xrxrfrf.exec:\xrxrfrf.exe39⤵
- Executes dropped EXE
PID:744 -
\??\c:\9nnhnb.exec:\9nnhnb.exe40⤵
- Executes dropped EXE
PID:1520 -
\??\c:\3nnbtn.exec:\3nnbtn.exe41⤵
- Executes dropped EXE
PID:4228 -
\??\c:\dvvdp.exec:\dvvdp.exe42⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ddvpv.exec:\ddvpv.exe43⤵
- Executes dropped EXE
PID:1664 -
\??\c:\lrfrlfr.exec:\lrfrlfr.exe44⤵
- Executes dropped EXE
PID:3524 -
\??\c:\9rrlfxr.exec:\9rrlfxr.exe45⤵
- Executes dropped EXE
PID:3288 -
\??\c:\ttbtnh.exec:\ttbtnh.exe46⤵
- Executes dropped EXE
PID:4788 -
\??\c:\5dvpv.exec:\5dvpv.exe47⤵
- Executes dropped EXE
PID:4912 -
\??\c:\djjvd.exec:\djjvd.exe48⤵
- Executes dropped EXE
PID:4464 -
\??\c:\rxfflfx.exec:\rxfflfx.exe49⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nhbthb.exec:\nhbthb.exe50⤵
- Executes dropped EXE
PID:1900 -
\??\c:\vpdpj.exec:\vpdpj.exe51⤵
- Executes dropped EXE
PID:2816 -
\??\c:\dpjjp.exec:\dpjjp.exe52⤵
- Executes dropped EXE
PID:2004 -
\??\c:\frlxrll.exec:\frlxrll.exe53⤵
- Executes dropped EXE
PID:1340 -
\??\c:\bnhbnh.exec:\bnhbnh.exe54⤵
- Executes dropped EXE
PID:1596 -
\??\c:\bhbnhb.exec:\bhbnhb.exe55⤵
- Executes dropped EXE
PID:5048 -
\??\c:\jvpjv.exec:\jvpjv.exe56⤵
- Executes dropped EXE
PID:4524 -
\??\c:\dpvjj.exec:\dpvjj.exe57⤵
- Executes dropped EXE
PID:3552 -
\??\c:\lfxlrlx.exec:\lfxlrlx.exe58⤵
- Executes dropped EXE
PID:1784 -
\??\c:\fxrlxlf.exec:\fxrlxlf.exe59⤵
- Executes dropped EXE
PID:1536 -
\??\c:\hbtnhh.exec:\hbtnhh.exe60⤵
- Executes dropped EXE
PID:1808 -
\??\c:\1vvdj.exec:\1vvdj.exe61⤵
- Executes dropped EXE
PID:4328 -
\??\c:\lxxrxxl.exec:\lxxrxxl.exe62⤵
- Executes dropped EXE
PID:2492 -
\??\c:\xlrflff.exec:\xlrflff.exe63⤵
- Executes dropped EXE
PID:4716 -
\??\c:\fllfrlf.exec:\fllfrlf.exe64⤵
- Executes dropped EXE
PID:1048 -
\??\c:\tttnbt.exec:\tttnbt.exe65⤵
- Executes dropped EXE
PID:3944 -
\??\c:\9dpdj.exec:\9dpdj.exe66⤵PID:3668
-
\??\c:\rllflfx.exec:\rllflfx.exe67⤵PID:2300
-
\??\c:\ffflxrf.exec:\ffflxrf.exe68⤵PID:3608
-
\??\c:\nbbthb.exec:\nbbthb.exe69⤵PID:784
-
\??\c:\jvpdp.exec:\jvpdp.exe70⤵PID:1740
-
\??\c:\dppdv.exec:\dppdv.exe71⤵PID:4860
-
\??\c:\jpvvj.exec:\jpvvj.exe72⤵PID:3880
-
\??\c:\rfffrfl.exec:\rfffrfl.exe73⤵PID:4300
-
\??\c:\nbbnbt.exec:\nbbnbt.exe74⤵PID:3868
-
\??\c:\jvvjp.exec:\jvvjp.exe75⤵PID:3152
-
\??\c:\ddjdp.exec:\ddjdp.exe76⤵PID:1452
-
\??\c:\9lxlrlf.exec:\9lxlrlf.exe77⤵PID:2180
-
\??\c:\3tnbnh.exec:\3tnbnh.exe78⤵PID:4440
-
\??\c:\nbhbhb.exec:\nbhbhb.exe79⤵PID:748
-
\??\c:\dpjdj.exec:\dpjdj.exe80⤵PID:3696
-
\??\c:\lrlflfr.exec:\lrlflfr.exe81⤵PID:772
-
\??\c:\nhbthb.exec:\nhbthb.exe82⤵PID:4368
-
\??\c:\hhnhbt.exec:\hhnhbt.exe83⤵PID:4052
-
\??\c:\7pjdd.exec:\7pjdd.exe84⤵PID:1908
-
\??\c:\jvvjd.exec:\jvvjd.exe85⤵PID:1236
-
\??\c:\xxflrlx.exec:\xxflrlx.exe86⤵PID:1664
-
\??\c:\nhbbth.exec:\nhbbth.exe87⤵PID:2148
-
\??\c:\3bbnbt.exec:\3bbnbt.exe88⤵PID:4084
-
\??\c:\dddvp.exec:\dddvp.exe89⤵PID:3968
-
\??\c:\9dpdj.exec:\9dpdj.exe90⤵PID:4380
-
\??\c:\9lfrxrf.exec:\9lfrxrf.exe91⤵PID:2460
-
\??\c:\bnnhhb.exec:\bnnhhb.exe92⤵PID:3756
-
\??\c:\pdvjj.exec:\pdvjj.exe93⤵PID:1212
-
\??\c:\dppdp.exec:\dppdp.exe94⤵PID:4408
-
\??\c:\dpdpd.exec:\dpdpd.exe95⤵PID:736
-
\??\c:\xlxlxlx.exec:\xlxlxlx.exe96⤵PID:2908
-
\??\c:\vjjvp.exec:\vjjvp.exe97⤵PID:3784
-
\??\c:\dvpdj.exec:\dvpdj.exe98⤵PID:2004
-
\??\c:\frlxfxl.exec:\frlxfxl.exe99⤵PID:4732
-
\??\c:\3xrxxlx.exec:\3xrxxlx.exe100⤵PID:2612
-
\??\c:\btnnbt.exec:\btnnbt.exe101⤵PID:2508
-
\??\c:\7jjvj.exec:\7jjvj.exe102⤵PID:940
-
\??\c:\rxffxrx.exec:\rxffxrx.exe103⤵PID:3552
-
\??\c:\xlrlffr.exec:\xlrlffr.exe104⤵PID:3628
-
\??\c:\nhnbnh.exec:\nhnbnh.exe105⤵PID:4200
-
\??\c:\bnnbht.exec:\bnnbht.exe106⤵PID:4952
-
\??\c:\3ppdd.exec:\3ppdd.exe107⤵PID:4328
-
\??\c:\5vpdd.exec:\5vpdd.exe108⤵PID:2492
-
\??\c:\lrxlxrl.exec:\lrxlxrl.exe109⤵PID:1416
-
\??\c:\nbhbhb.exec:\nbhbhb.exe110⤵PID:1564
-
\??\c:\3bbbhn.exec:\3bbbhn.exe111⤵PID:1892
-
\??\c:\nbthnh.exec:\nbthnh.exe112⤵PID:1232
-
\??\c:\1vpjp.exec:\1vpjp.exe113⤵PID:2300
-
\??\c:\xxxlxlx.exec:\xxxlxlx.exe114⤵PID:1468
-
\??\c:\thbthb.exec:\thbthb.exe115⤵PID:784
-
\??\c:\bnbbnh.exec:\bnbbnh.exe116⤵PID:1740
-
\??\c:\vdpdp.exec:\vdpdp.exe117⤵PID:1836
-
\??\c:\flrrxlx.exec:\flrrxlx.exe118⤵PID:2868
-
\??\c:\5fffxxx.exec:\5fffxxx.exe119⤵PID:3688
-
\??\c:\9tthbh.exec:\9tthbh.exe120⤵PID:2648
-
\??\c:\dppjv.exec:\dppjv.exe121⤵PID:3908
-
\??\c:\dpdvp.exec:\dpdvp.exe122⤵PID:2996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-