Analysis
- max time kernel
150s - max time network
57s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 10:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
741bd45f5c3bb43a6731e2c1c752e180_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
- Target 741bd45f5c3bb43a6731e2c1c752e180_NeikiAnalytics.exe
- Size 71KB
- Sample240613-mf2ypsyemr
- SHA256 1b228fe5110b651e3b75de0d5c5f72a70af292363f82e85d81e7b851027986d3
- MD5 741bd45f5c3bb43a6731e2c1c752e180
- SHA1 a4b59d0d6d2815926af09ea7a1ee8519da0f6888
- SHA512 609a17e56ed6fd7e9100002195edb1eeb16c54980087fa1176cef624796b45c582188fe5e98129cc8094290d1d9969b5f1ca4f42c8517a0277efa51797c5cbab
- SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgUVyiAnfVB:ymb3NkkiQ3mdBjFIgUEBr
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/1804-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-13-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-28-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1876-56-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1876-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-70-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4244-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/760-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4876 1nbtnh.exe 4880 vvjdd.exe 1776 dpvvp.exe 3660 frfxrxr.exe 3412 nbnnbb.exe 4052 ppppd.exe 1876 fxffllx.exe 752 hnntnh.exe 3972 vvddd.exe 4244 djdvp.exe 2796 1lffxxx.exe 3372 5btnhh.exe 5076 pjddp.exe 3256 dvvvv.exe 3244 flxrffx.exe 1584 bbntbh.exe 1708 nbhhbt.exe 760 jjjdv.exe 3264 llrlrlr.exe 4856 bntntt.exe 1040 pjppp.exe 1108 dpppj.exe 4044 lrfxrrr.exe 5016 tntnhh.exe 3632 nhnbnb.exe 4824 jdpjp.exe 4592 frrrfff.exe 1524 llxrrrl.exe 4380 nttthh.exe 4076 vpdvj.exe 1960 jvdvv.exe 3804 lflffll.exe 1640 nbbtnh.exe 1312 7btnhh.exe 2412 jpppd.exe 3832 vjvjd.exe 1384 xfxlxrl.exe 4048 btnnhb.exe 4320 nnbtnh.exe 2520 hbbbtn.exe 1624 djppj.exe 2476 jdddp.exe 4828 lrrfrrf.exe 4972 rxfxfll.exe 4364 bhhhtt.exe 1564 tnhbnn.exe 1540 pdjvj.exe 4216 pjjjp.exe 3596 frxrrrr.exe 4208 9xfxrrr.exe 2296 httnbb.exe 5072 1nhbtt.exe 4884 vddjj.exe 4244 jvjjd.exe 3940 rlrfxxr.exe 1972 nhtntn.exe 5088 nbhbhh.exe 4376 7ppdp.exe 4412 vpvvp.exe 4188 rllrxlr.exe 772 5fffxxr.exe 412 tbhbtt.exe 1636 tntthb.exe 4708 bhbtnn.exe -
resource yara_rule behavioral2/memory/1804-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1876-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/760-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-204-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1804 wrote to memory of 4876 1804 741bd45f5c3bb43a6731e2c1c752e180_NeikiAnalytics.exe 82 PID 1804 wrote to memory of 4876 1804 741bd45f5c3bb43a6731e2c1c752e180_NeikiAnalytics.exe 82 PID 1804 wrote to memory of 4876 1804 741bd45f5c3bb43a6731e2c1c752e180_NeikiAnalytics.exe 82 PID 4876 wrote to memory of 4880 4876 1nbtnh.exe 83 PID 4876 wrote to memory of 4880 4876 1nbtnh.exe 83 PID 4876 wrote to memory of 4880 4876 1nbtnh.exe 83 PID 4880 wrote to memory of 1776 4880 vvjdd.exe 84 PID 4880 wrote to memory of 1776 4880 vvjdd.exe 84 PID 4880 wrote to memory of 1776 4880 vvjdd.exe 84 PID 1776 wrote to memory of 3660 1776 dpvvp.exe 85 PID 1776 wrote to memory of 3660 1776 dpvvp.exe 85 PID 1776 wrote to memory of 3660 1776 dpvvp.exe 85 PID 3660 wrote to memory of 3412 3660 frfxrxr.exe 86 PID 3660 wrote to memory of 3412 3660 frfxrxr.exe 86 PID 3660 wrote to memory of 3412 3660 frfxrxr.exe 86 PID 3412 wrote to memory of 4052 3412 nbnnbb.exe 87 PID 3412 wrote to memory of 4052 3412 nbnnbb.exe 87 PID 3412 wrote to memory of 4052 3412 nbnnbb.exe 87 PID 4052 wrote to memory of 1876 4052 ppppd.exe 88 PID 4052 wrote to memory of 1876 4052 ppppd.exe 88 PID 4052 wrote to memory of 1876 4052 ppppd.exe 88 PID 1876 wrote to memory of 752 1876 fxffllx.exe 90 PID 1876 wrote to memory of 752 1876 fxffllx.exe 90 PID 1876 wrote to memory of 752 1876 fxffllx.exe 90 PID 752 wrote to memory of 3972 752 hnntnh.exe 91 PID 752 wrote to memory of 3972 752 hnntnh.exe 91 PID 752 wrote to memory of 3972 752 hnntnh.exe 91 PID 3972 wrote to memory of 4244 3972 vvddd.exe 92 PID 3972 wrote to memory of 4244 3972 vvddd.exe 92 PID 3972 wrote to memory of 4244 3972 vvddd.exe 92 PID 4244 wrote to memory of 2796 4244 djdvp.exe 93 PID 4244 wrote to memory of 2796 4244 djdvp.exe 93 PID 4244 wrote to memory of 2796 4244 djdvp.exe 93 PID 2796 wrote to memory of 3372 2796 1lffxxx.exe 94 PID 2796 wrote to memory of 3372 2796 1lffxxx.exe 94 PID 2796 wrote to memory of 3372 2796 1lffxxx.exe 94 PID 3372 wrote to memory of 5076 3372 5btnhh.exe 96 PID 3372 wrote to memory of 5076 3372 5btnhh.exe 96 PID 3372 wrote to memory of 5076 3372 5btnhh.exe 96 PID 5076 wrote to memory of 3256 5076 pjddp.exe 97 PID 5076 wrote to memory of 3256 5076 pjddp.exe 97 PID 5076 wrote to memory of 3256 5076 pjddp.exe 97 PID 3256 wrote to memory of 3244 3256 dvvvv.exe 98 PID 3256 wrote to memory of 3244 3256 dvvvv.exe 98 PID 3256 wrote to memory of 3244 3256 dvvvv.exe 98 PID 3244 wrote to memory of 1584 3244 flxrffx.exe 99 PID 3244 wrote to memory of 1584 3244 flxrffx.exe 99 PID 3244 wrote to memory of 1584 3244 flxrffx.exe 99 PID 1584 wrote to memory of 1708 1584 bbntbh.exe 100 PID 1584 wrote to memory of 1708 1584 bbntbh.exe 100 PID 1584 wrote to memory of 1708 1584 bbntbh.exe 100 PID 1708 wrote to memory of 760 1708 nbhhbt.exe 101 PID 1708 wrote to memory of 760 1708 nbhhbt.exe 101 PID 1708 wrote to memory of 760 1708 nbhhbt.exe 101 PID 760 wrote to memory of 3264 760 jjjdv.exe 102 PID 760 wrote to memory of 3264 760 jjjdv.exe 102 PID 760 wrote to memory of 3264 760 jjjdv.exe 102 PID 3264 wrote to memory of 4856 3264 llrlrlr.exe 103 PID 3264 wrote to memory of 4856 3264 llrlrlr.exe 103 PID 3264 wrote to memory of 4856 3264 llrlrlr.exe 103 PID 4856 wrote to memory of 1040 4856 bntntt.exe 105 PID 4856 wrote to memory of 1040 4856 bntntt.exe 105 PID 4856 wrote to memory of 1040 4856 bntntt.exe 105 PID 1040 wrote to memory of 1108 1040 pjppp.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\741bd45f5c3bb43a6731e2c1c752e180_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\741bd45f5c3bb43a6731e2c1c752e180_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\1nbtnh.exec:\1nbtnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\vvjdd.exec:\vvjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\dpvvp.exec:\dpvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\frfxrxr.exec:\frfxrxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\nbnnbb.exec:\nbnnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\ppppd.exec:\ppppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\fxffllx.exec:\fxffllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\hnntnh.exec:\hnntnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\vvddd.exec:\vvddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\djdvp.exec:\djdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\1lffxxx.exec:\1lffxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\5btnhh.exec:\5btnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\pjddp.exec:\pjddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\dvvvv.exec:\dvvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\flxrffx.exec:\flxrffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\bbntbh.exec:\bbntbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\nbhhbt.exec:\nbhhbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\jjjdv.exec:\jjjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\llrlrlr.exec:\llrlrlr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\bntntt.exec:\bntntt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\pjppp.exec:\pjppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\dpppj.exec:\dpppj.exe23⤵
- Executes dropped EXE
PID:1108 -
\??\c:\lrfxrrr.exec:\lrfxrrr.exe24⤵
- Executes dropped EXE
PID:4044 -
\??\c:\tntnhh.exec:\tntnhh.exe25⤵
- Executes dropped EXE
PID:5016 -
\??\c:\nhnbnb.exec:\nhnbnb.exe26⤵
- Executes dropped EXE
PID:3632 -
\??\c:\jdpjp.exec:\jdpjp.exe27⤵
- Executes dropped EXE
PID:4824 -
\??\c:\frrrfff.exec:\frrrfff.exe28⤵
- Executes dropped EXE
PID:4592 -
\??\c:\llxrrrl.exec:\llxrrrl.exe29⤵
- Executes dropped EXE
PID:1524 -
\??\c:\nttthh.exec:\nttthh.exe30⤵
- Executes dropped EXE
PID:4380 -
\??\c:\vpdvj.exec:\vpdvj.exe31⤵
- Executes dropped EXE
PID:4076 -
\??\c:\jvdvv.exec:\jvdvv.exe32⤵
- Executes dropped EXE
PID:1960 -
\??\c:\lflffll.exec:\lflffll.exe33⤵
- Executes dropped EXE
PID:3804 -
\??\c:\nbbtnh.exec:\nbbtnh.exe34⤵
- Executes dropped EXE
PID:1640 -
\??\c:\7btnhh.exec:\7btnhh.exe35⤵
- Executes dropped EXE
PID:1312 -
\??\c:\jpppd.exec:\jpppd.exe36⤵
- Executes dropped EXE
PID:2412 -
\??\c:\vjvjd.exec:\vjvjd.exe37⤵
- Executes dropped EXE
PID:3832 -
\??\c:\xfxlxrl.exec:\xfxlxrl.exe38⤵
- Executes dropped EXE
PID:1384 -
\??\c:\btnnhb.exec:\btnnhb.exe39⤵
- Executes dropped EXE
PID:4048 -
\??\c:\nnbtnh.exec:\nnbtnh.exe40⤵
- Executes dropped EXE
PID:4320 -
\??\c:\hbbbtn.exec:\hbbbtn.exe41⤵
- Executes dropped EXE
PID:2520 -
\??\c:\djppj.exec:\djppj.exe42⤵
- Executes dropped EXE
PID:1624 -
\??\c:\jdddp.exec:\jdddp.exe43⤵
- Executes dropped EXE
PID:2476 -
\??\c:\lrrfrrf.exec:\lrrfrrf.exe44⤵
- Executes dropped EXE
PID:4828 -
\??\c:\rxfxfll.exec:\rxfxfll.exe45⤵
- Executes dropped EXE
PID:4972 -
\??\c:\bhhhtt.exec:\bhhhtt.exe46⤵
- Executes dropped EXE
PID:4364 -
\??\c:\tnhbnn.exec:\tnhbnn.exe47⤵
- Executes dropped EXE
PID:1564 -
\??\c:\pdjvj.exec:\pdjvj.exe48⤵
- Executes dropped EXE
PID:1540 -
\??\c:\pjjjp.exec:\pjjjp.exe49⤵
- Executes dropped EXE
PID:4216 -
\??\c:\frxrrrr.exec:\frxrrrr.exe50⤵
- Executes dropped EXE
PID:3596 -
\??\c:\9xfxrrr.exec:\9xfxrrr.exe51⤵
- Executes dropped EXE
PID:4208 -
\??\c:\httnbb.exec:\httnbb.exe52⤵
- Executes dropped EXE
PID:2296 -
\??\c:\1nhbtt.exec:\1nhbtt.exe53⤵
- Executes dropped EXE
PID:5072 -
\??\c:\vddjj.exec:\vddjj.exe54⤵
- Executes dropped EXE
PID:4884 -
\??\c:\jvjjd.exec:\jvjjd.exe55⤵
- Executes dropped EXE
PID:4244 -
\??\c:\rlrfxxr.exec:\rlrfxxr.exe56⤵
- Executes dropped EXE
PID:3940 -
\??\c:\nhtntn.exec:\nhtntn.exe57⤵
- Executes dropped EXE
PID:1972 -
\??\c:\nbhbhh.exec:\nbhbhh.exe58⤵
- Executes dropped EXE
PID:5088 -
\??\c:\7ppdp.exec:\7ppdp.exe59⤵
- Executes dropped EXE
PID:4376 -
\??\c:\vpvvp.exec:\vpvvp.exe60⤵
- Executes dropped EXE
PID:4412 -
\??\c:\rllrxlr.exec:\rllrxlr.exe61⤵
- Executes dropped EXE
PID:4188 -
\??\c:\5fffxxr.exec:\5fffxxr.exe62⤵
- Executes dropped EXE
PID:772 -
\??\c:\tbhbtt.exec:\tbhbtt.exe63⤵
- Executes dropped EXE
PID:412 -
\??\c:\tntthb.exec:\tntthb.exe64⤵
- Executes dropped EXE
PID:1636 -
\??\c:\bhbtnn.exec:\bhbtnn.exe65⤵
- Executes dropped EXE
PID:4708 -
\??\c:\djppj.exec:\djppj.exe66⤵PID:760
-
\??\c:\1vvpd.exec:\1vvpd.exe67⤵PID:5056
-
\??\c:\flrrflf.exec:\flrrflf.exe68⤵PID:1720
-
\??\c:\ffrxllx.exec:\ffrxllx.exe69⤵PID:3264
-
\??\c:\3httnn.exec:\3httnn.exe70⤵PID:4796
-
\??\c:\hbbhbh.exec:\hbbhbh.exe71⤵PID:4168
-
\??\c:\hbttnt.exec:\hbttnt.exe72⤵PID:1068
-
\??\c:\vppjd.exec:\vppjd.exe73⤵PID:2140
-
\??\c:\ddpjj.exec:\ddpjj.exe74⤵PID:4044
-
\??\c:\3xxflxf.exec:\3xxflxf.exe75⤵PID:4276
-
\??\c:\rlfxlll.exec:\rlfxlll.exe76⤵PID:2604
-
\??\c:\9ttbbb.exec:\9ttbbb.exe77⤵PID:408
-
\??\c:\nbnhtt.exec:\nbnhtt.exe78⤵PID:1092
-
\??\c:\pvpvd.exec:\pvpvd.exe79⤵PID:3684
-
\??\c:\pjjvp.exec:\pjjvp.exe80⤵PID:3352
-
\??\c:\pdjjj.exec:\pdjjj.exe81⤵PID:4080
-
\??\c:\1lrfrrr.exec:\1lrfrrr.exe82⤵PID:4764
-
\??\c:\lxllxff.exec:\lxllxff.exe83⤵PID:4076
-
\??\c:\1tbtnn.exec:\1tbtnn.exe84⤵PID:3648
-
\??\c:\nnbtbb.exec:\nnbtbb.exe85⤵PID:1836
-
\??\c:\jpdpp.exec:\jpdpp.exe86⤵PID:1192
-
\??\c:\3ppjv.exec:\3ppjv.exe87⤵PID:2416
-
\??\c:\fflfrxr.exec:\fflfrxr.exe88⤵PID:116
-
\??\c:\1hbtnh.exec:\1hbtnh.exe89⤵PID:4496
-
\??\c:\hbhnhh.exec:\hbhnhh.exe90⤵PID:2168
-
\??\c:\pdddp.exec:\pdddp.exe91⤵PID:3568
-
\??\c:\vpvvp.exec:\vpvvp.exe92⤵PID:4408
-
\??\c:\ddjjv.exec:\ddjjv.exe93⤵PID:4004
-
\??\c:\5rrlfff.exec:\5rrlfff.exe94⤵PID:2316
-
\??\c:\3ttbtb.exec:\3ttbtb.exe95⤵PID:4880
-
\??\c:\bthhth.exec:\bthhth.exe96⤵PID:3296
-
\??\c:\7rxxxxx.exec:\7rxxxxx.exe97⤵PID:1484
-
\??\c:\lxrrlfx.exec:\lxrrlfx.exe98⤵PID:228
-
\??\c:\xxxxrxx.exec:\xxxxrxx.exe99⤵PID:4484
-
\??\c:\hthbhb.exec:\hthbhb.exe100⤵PID:4704
-
\??\c:\thbbbb.exec:\thbbbb.exe101⤵PID:1648
-
\??\c:\dvvpp.exec:\dvvpp.exe102⤵PID:1148
-
\??\c:\jdpjd.exec:\jdpjd.exe103⤵PID:2704
-
\??\c:\9llfflf.exec:\9llfflf.exe104⤵PID:1120
-
\??\c:\fffrrxf.exec:\fffrrxf.exe105⤵PID:4944
-
\??\c:\hbnnnn.exec:\hbnnnn.exe106⤵PID:4960
-
\??\c:\nhhbnn.exec:\nhhbnn.exe107⤵PID:4896
-
\??\c:\7nnnbb.exec:\7nnnbb.exe108⤵PID:2796
-
\??\c:\dpjdv.exec:\dpjdv.exe109⤵PID:4848
-
\??\c:\dpvjd.exec:\dpvjd.exe110⤵PID:1572
-
\??\c:\xrxxffl.exec:\xrxxffl.exe111⤵PID:5076
-
\??\c:\lxxxrfx.exec:\lxxxrfx.exe112⤵PID:3784
-
\??\c:\ntbtbb.exec:\ntbtbb.exe113⤵PID:2868
-
\??\c:\9nnhth.exec:\9nnhth.exe114⤵PID:2852
-
\??\c:\5jjdp.exec:\5jjdp.exe115⤵PID:4456
-
\??\c:\vpvjd.exec:\vpvjd.exe116⤵PID:1012
-
\??\c:\lfffrrr.exec:\lfffrrr.exe117⤵PID:4336
-
\??\c:\3frrllf.exec:\3frrllf.exe118⤵PID:4788
-
\??\c:\lfffxxr.exec:\lfffxxr.exe119⤵PID:5012
-
\??\c:\9bhbbb.exec:\9bhbbb.exe120⤵PID:4772
-
\??\c:\htthbb.exec:\htthbb.exe121⤵PID:1468
-
\??\c:\5djdv.exec:\5djdv.exe122⤵PID:4328
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-