Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 17:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a2e64a738ccb99cd4a1a684bf8d815c4690d03f9d91746886eb9d05a2d39a6b9_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
a2e64a738ccb99cd4a1a684bf8d815c4690d03f9d91746886eb9d05a2d39a6b9_NeikiAnalytics.exe
-
Size
64KB
-
MD5
25b3b471fe7c1d29f0d45f0288e0a830
-
SHA1
d9371469e1b5ef5e7abe739399f0c82c216593c4
-
SHA256
a2e64a738ccb99cd4a1a684bf8d815c4690d03f9d91746886eb9d05a2d39a6b9
-
SHA512
e150eb45a0ebeb1ff5aa403599fa36557c64a848d53fdf9027b8e851994ca7b93169e91652a4f2a92c8f8485af4856960fac030d297b1178f2a6ddb93987f035
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIug6bL6Nl1H:ymb3NkkiQ3mdBjFIugptH
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral2/memory/936-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/936-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-18-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4708-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/672-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-48-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/764-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-38-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-62-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3172 bttttb.exe 936 3pjdj.exe 672 vpdvd.exe 5068 1jpjd.exe 764 dvpjd.exe 4132 lflfllf.exe 1216 5fflxxx.exe 3980 9nhttt.exe 3324 vjpvp.exe 2720 xrrrlll.exe 4616 tntttb.exe 4068 9ddvv.exe 2736 ppvpv.exe 2332 xrlxlxf.exe 2644 nnttnn.exe 868 bttbhh.exe 2620 pjjdv.exe 3560 5frrlrx.exe 3520 hbbbtb.exe 464 dvvdv.exe 4040 1rrfrxf.exe 3592 rllxxfl.exe 2184 vpvvv.exe 4464 lfffxxx.exe 4944 hbttnn.exe 1808 tnnhbb.exe 2392 dpvpj.exe 3984 1xxxlrr.exe 1948 btbhnh.exe 5048 7rrfxxr.exe 5092 jdddv.exe 2280 ddddv.exe 2664 frrrllr.exe 884 xxxlffx.exe 4348 hbtnnn.exe 3972 ppdjv.exe 4708 pvdvj.exe 724 3lxrrll.exe 4524 llfxrrl.exe 116 hhbbtt.exe 3556 dpjjd.exe 3752 rrfxffl.exe 3348 ntbnnn.exe 3580 hhtthh.exe 4672 5jjdv.exe 3256 vvvvj.exe 3328 frxxxfx.exe 3344 hhnhnh.exe 752 pddvp.exe 4756 lrxxrrr.exe 2336 5bhhbn.exe 2736 pjppp.exe 3688 xlxxlll.exe 1600 htnhhh.exe 1428 tntttb.exe 4432 djpjd.exe 2560 9vdvp.exe 3048 flxrrxr.exe 4376 fffffff.exe 4860 dpvpj.exe 1952 vdjjv.exe 4372 xrrllfx.exe 2324 tbnntt.exe 4656 9htnht.exe -
resource yara_rule behavioral2/memory/936-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/672-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4708 wrote to memory of 3172 4708 a2e64a738ccb99cd4a1a684bf8d815c4690d03f9d91746886eb9d05a2d39a6b9_NeikiAnalytics.exe 88 PID 4708 wrote to memory of 3172 4708 a2e64a738ccb99cd4a1a684bf8d815c4690d03f9d91746886eb9d05a2d39a6b9_NeikiAnalytics.exe 88 PID 4708 wrote to memory of 3172 4708 a2e64a738ccb99cd4a1a684bf8d815c4690d03f9d91746886eb9d05a2d39a6b9_NeikiAnalytics.exe 88 PID 3172 wrote to memory of 936 3172 bttttb.exe 89 PID 3172 wrote to memory of 936 3172 bttttb.exe 89 PID 3172 wrote to memory of 936 3172 bttttb.exe 89 PID 936 wrote to memory of 672 936 3pjdj.exe 90 PID 936 wrote to memory of 672 936 3pjdj.exe 90 PID 936 wrote to memory of 672 936 3pjdj.exe 90 PID 672 wrote to memory of 5068 672 vpdvd.exe 91 PID 672 wrote to memory of 5068 672 vpdvd.exe 91 PID 672 wrote to memory of 5068 672 vpdvd.exe 91 PID 5068 wrote to memory of 764 5068 1jpjd.exe 92 PID 5068 wrote to memory of 764 5068 1jpjd.exe 92 PID 5068 wrote to memory of 764 5068 1jpjd.exe 92 PID 764 wrote to memory of 4132 764 dvpjd.exe 93 PID 764 wrote to memory of 4132 764 dvpjd.exe 93 PID 764 wrote to memory of 4132 764 dvpjd.exe 93 PID 4132 wrote to memory of 1216 4132 lflfllf.exe 94 PID 4132 wrote to memory of 1216 4132 lflfllf.exe 94 PID 4132 wrote to memory of 1216 4132 lflfllf.exe 94 PID 1216 wrote to memory of 3980 1216 5fflxxx.exe 95 PID 1216 wrote to memory of 3980 1216 5fflxxx.exe 95 PID 1216 wrote to memory of 3980 1216 5fflxxx.exe 95 PID 3980 wrote to memory of 3324 3980 9nhttt.exe 96 PID 3980 wrote to memory of 3324 3980 9nhttt.exe 96 PID 3980 wrote to memory of 3324 3980 9nhttt.exe 96 PID 3324 wrote to memory of 2720 3324 vjpvp.exe 97 PID 3324 wrote to memory of 2720 3324 vjpvp.exe 97 PID 3324 wrote to memory of 2720 3324 vjpvp.exe 97 PID 2720 wrote to memory of 4616 2720 xrrrlll.exe 98 PID 2720 wrote to memory of 4616 2720 xrrrlll.exe 98 PID 2720 wrote to memory of 4616 2720 xrrrlll.exe 98 PID 4616 wrote to memory of 4068 4616 tntttb.exe 99 PID 4616 wrote to memory of 4068 4616 tntttb.exe 99 PID 4616 wrote to memory of 4068 4616 tntttb.exe 99 PID 4068 wrote to memory of 2736 4068 9ddvv.exe 100 PID 4068 wrote to memory of 2736 4068 9ddvv.exe 100 PID 4068 wrote to memory of 2736 4068 9ddvv.exe 100 PID 2736 wrote to memory of 2332 2736 ppvpv.exe 101 PID 2736 wrote to memory of 2332 2736 ppvpv.exe 101 PID 2736 wrote to memory of 2332 2736 ppvpv.exe 101 PID 2332 wrote to memory of 2644 2332 xrlxlxf.exe 102 PID 2332 wrote to memory of 2644 2332 xrlxlxf.exe 102 PID 2332 wrote to memory of 2644 2332 xrlxlxf.exe 102 PID 2644 wrote to memory of 868 2644 nnttnn.exe 103 PID 2644 wrote to memory of 868 2644 nnttnn.exe 103 PID 2644 wrote to memory of 868 2644 nnttnn.exe 103 PID 868 wrote to memory of 2620 868 bttbhh.exe 104 PID 868 wrote to memory of 2620 868 bttbhh.exe 104 PID 868 wrote to memory of 2620 868 bttbhh.exe 104 PID 2620 wrote to memory of 3560 2620 pjjdv.exe 105 PID 2620 wrote to memory of 3560 2620 pjjdv.exe 105 PID 2620 wrote to memory of 3560 2620 pjjdv.exe 105 PID 3560 wrote to memory of 3520 3560 5frrlrx.exe 106 PID 3560 wrote to memory of 3520 3560 5frrlrx.exe 106 PID 3560 wrote to memory of 3520 3560 5frrlrx.exe 106 PID 3520 wrote to memory of 464 3520 hbbbtb.exe 107 PID 3520 wrote to memory of 464 3520 hbbbtb.exe 107 PID 3520 wrote to memory of 464 3520 hbbbtb.exe 107 PID 464 wrote to memory of 4040 464 dvvdv.exe 108 PID 464 wrote to memory of 4040 464 dvvdv.exe 108 PID 464 wrote to memory of 4040 464 dvvdv.exe 108 PID 4040 wrote to memory of 3592 4040 1rrfrxf.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2e64a738ccb99cd4a1a684bf8d815c4690d03f9d91746886eb9d05a2d39a6b9_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a2e64a738ccb99cd4a1a684bf8d815c4690d03f9d91746886eb9d05a2d39a6b9_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\bttttb.exec:\bttttb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\3pjdj.exec:\3pjdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\vpdvd.exec:\vpdvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\1jpjd.exec:\1jpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\dvpjd.exec:\dvpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\lflfllf.exec:\lflfllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\5fflxxx.exec:\5fflxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\9nhttt.exec:\9nhttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\vjpvp.exec:\vjpvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\xrrrlll.exec:\xrrrlll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\tntttb.exec:\tntttb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\9ddvv.exec:\9ddvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\ppvpv.exec:\ppvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\xrlxlxf.exec:\xrlxlxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\nnttnn.exec:\nnttnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\bttbhh.exec:\bttbhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\pjjdv.exec:\pjjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\5frrlrx.exec:\5frrlrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\hbbbtb.exec:\hbbbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\dvvdv.exec:\dvvdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\1rrfrxf.exec:\1rrfrxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\rllxxfl.exec:\rllxxfl.exe23⤵
- Executes dropped EXE
PID:3592 -
\??\c:\vpvvv.exec:\vpvvv.exe24⤵
- Executes dropped EXE
PID:2184 -
\??\c:\lfffxxx.exec:\lfffxxx.exe25⤵
- Executes dropped EXE
PID:4464 -
\??\c:\hbttnn.exec:\hbttnn.exe26⤵
- Executes dropped EXE
PID:4944 -
\??\c:\tnnhbb.exec:\tnnhbb.exe27⤵
- Executes dropped EXE
PID:1808 -
\??\c:\dpvpj.exec:\dpvpj.exe28⤵
- Executes dropped EXE
PID:2392 -
\??\c:\1xxxlrr.exec:\1xxxlrr.exe29⤵
- Executes dropped EXE
PID:3984 -
\??\c:\btbhnh.exec:\btbhnh.exe30⤵
- Executes dropped EXE
PID:1948 -
\??\c:\7rrfxxr.exec:\7rrfxxr.exe31⤵
- Executes dropped EXE
PID:5048 -
\??\c:\jdddv.exec:\jdddv.exe32⤵
- Executes dropped EXE
PID:5092 -
\??\c:\ddddv.exec:\ddddv.exe33⤵
- Executes dropped EXE
PID:2280 -
\??\c:\frrrllr.exec:\frrrllr.exe34⤵
- Executes dropped EXE
PID:2664 -
\??\c:\xxxlffx.exec:\xxxlffx.exe35⤵
- Executes dropped EXE
PID:884 -
\??\c:\hbtnnn.exec:\hbtnnn.exe36⤵
- Executes dropped EXE
PID:4348 -
\??\c:\ppdjv.exec:\ppdjv.exe37⤵
- Executes dropped EXE
PID:3972 -
\??\c:\pvdvj.exec:\pvdvj.exe38⤵
- Executes dropped EXE
PID:4708 -
\??\c:\3lxrrll.exec:\3lxrrll.exe39⤵
- Executes dropped EXE
PID:724 -
\??\c:\llfxrrl.exec:\llfxrrl.exe40⤵
- Executes dropped EXE
PID:4524 -
\??\c:\hhbbtt.exec:\hhbbtt.exe41⤵
- Executes dropped EXE
PID:116 -
\??\c:\dpjjd.exec:\dpjjd.exe42⤵
- Executes dropped EXE
PID:3556 -
\??\c:\rrfxffl.exec:\rrfxffl.exe43⤵
- Executes dropped EXE
PID:3752 -
\??\c:\ntbnnn.exec:\ntbnnn.exe44⤵
- Executes dropped EXE
PID:3348 -
\??\c:\hhtthh.exec:\hhtthh.exe45⤵
- Executes dropped EXE
PID:3580 -
\??\c:\5jjdv.exec:\5jjdv.exe46⤵
- Executes dropped EXE
PID:4672 -
\??\c:\vvvvj.exec:\vvvvj.exe47⤵
- Executes dropped EXE
PID:3256 -
\??\c:\frxxxfx.exec:\frxxxfx.exe48⤵
- Executes dropped EXE
PID:3328 -
\??\c:\hhnhnh.exec:\hhnhnh.exe49⤵
- Executes dropped EXE
PID:3344 -
\??\c:\pddvp.exec:\pddvp.exe50⤵
- Executes dropped EXE
PID:752 -
\??\c:\lrxxrrr.exec:\lrxxrrr.exe51⤵
- Executes dropped EXE
PID:4756 -
\??\c:\5bhhbn.exec:\5bhhbn.exe52⤵
- Executes dropped EXE
PID:2336 -
\??\c:\pjppp.exec:\pjppp.exe53⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xlxxlll.exec:\xlxxlll.exe54⤵
- Executes dropped EXE
PID:3688 -
\??\c:\htnhhh.exec:\htnhhh.exe55⤵
- Executes dropped EXE
PID:1600 -
\??\c:\tntttb.exec:\tntttb.exe56⤵
- Executes dropped EXE
PID:1428 -
\??\c:\djpjd.exec:\djpjd.exe57⤵
- Executes dropped EXE
PID:4432 -
\??\c:\9vdvp.exec:\9vdvp.exe58⤵
- Executes dropped EXE
PID:2560 -
\??\c:\flxrrxr.exec:\flxrrxr.exe59⤵
- Executes dropped EXE
PID:3048 -
\??\c:\fffffff.exec:\fffffff.exe60⤵
- Executes dropped EXE
PID:4376 -
\??\c:\dpvpj.exec:\dpvpj.exe61⤵
- Executes dropped EXE
PID:4860 -
\??\c:\vdjjv.exec:\vdjjv.exe62⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xrrllfx.exec:\xrrllfx.exe63⤵
- Executes dropped EXE
PID:4372 -
\??\c:\tbnntt.exec:\tbnntt.exe64⤵
- Executes dropped EXE
PID:2324 -
\??\c:\9htnht.exec:\9htnht.exe65⤵
- Executes dropped EXE
PID:4656 -
\??\c:\nhnnnt.exec:\nhnnnt.exe66⤵PID:888
-
\??\c:\9vpdd.exec:\9vpdd.exe67⤵PID:2616
-
\??\c:\xrlrrrr.exec:\xrlrrrr.exe68⤵PID:3360
-
\??\c:\fxflrrf.exec:\fxflrrf.exe69⤵PID:956
-
\??\c:\hbhbbb.exec:\hbhbbb.exe70⤵PID:1744
-
\??\c:\bhnnhh.exec:\bhnnhh.exe71⤵PID:4252
-
\??\c:\9pvpd.exec:\9pvpd.exe72⤵PID:2980
-
\??\c:\frrlffx.exec:\frrlffx.exe73⤵PID:4448
-
\??\c:\7rxfrlf.exec:\7rxfrlf.exe74⤵PID:4760
-
\??\c:\tnttth.exec:\tnttth.exe75⤵PID:4844
-
\??\c:\5hthnh.exec:\5hthnh.exe76⤵PID:4556
-
\??\c:\vddpv.exec:\vddpv.exe77⤵PID:4604
-
\??\c:\3djvv.exec:\3djvv.exe78⤵PID:3760
-
\??\c:\frlrlff.exec:\frlrlff.exe79⤵PID:400
-
\??\c:\nhtnbb.exec:\nhtnbb.exe80⤵PID:2664
-
\??\c:\ttnnhh.exec:\ttnnhh.exe81⤵PID:884
-
\??\c:\jvjdv.exec:\jvjdv.exe82⤵PID:4824
-
\??\c:\3pjdp.exec:\3pjdp.exe83⤵PID:3368
-
\??\c:\3rllrxl.exec:\3rllrxl.exe84⤵PID:2668
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe85⤵PID:4600
-
\??\c:\tnnnnt.exec:\tnnnnt.exe86⤵PID:672
-
\??\c:\ppjdv.exec:\ppjdv.exe87⤵PID:3564
-
\??\c:\jdddp.exec:\jdddp.exe88⤵PID:2244
-
\??\c:\rflffff.exec:\rflffff.exe89⤵PID:4808
-
\??\c:\3fllffl.exec:\3fllffl.exe90⤵PID:372
-
\??\c:\ntnhbb.exec:\ntnhbb.exe91⤵PID:3980
-
\??\c:\tbtttt.exec:\tbtttt.exe92⤵PID:388
-
\??\c:\vpjdp.exec:\vpjdp.exe93⤵PID:5104
-
\??\c:\xflfxxf.exec:\xflfxxf.exe94⤵PID:4696
-
\??\c:\fxxxrxr.exec:\fxxxrxr.exe95⤵PID:856
-
\??\c:\hthbbb.exec:\hthbbb.exe96⤵PID:752
-
\??\c:\ttbtbb.exec:\ttbtbb.exe97⤵PID:4804
-
\??\c:\pjvvp.exec:\pjvvp.exe98⤵PID:4444
-
\??\c:\lxflfff.exec:\lxflfff.exe99⤵PID:1784
-
\??\c:\thhbtt.exec:\thhbtt.exe100⤵PID:4240
-
\??\c:\ntbttt.exec:\ntbttt.exe101⤵PID:3616
-
\??\c:\ttbtbb.exec:\ttbtbb.exe102⤵PID:2232
-
\??\c:\5pjvp.exec:\5pjvp.exe103⤵PID:4864
-
\??\c:\ddppd.exec:\ddppd.exe104⤵PID:3560
-
\??\c:\xxxrfff.exec:\xxxrfff.exe105⤵PID:1856
-
\??\c:\nhbnhh.exec:\nhbnhh.exe106⤵PID:1660
-
\??\c:\nntbnn.exec:\nntbnn.exe107⤵PID:2104
-
\??\c:\pdjdp.exec:\pdjdp.exe108⤵PID:1796
-
\??\c:\vpjdd.exec:\vpjdd.exe109⤵PID:3240
-
\??\c:\rrfxlll.exec:\rrfxlll.exe110⤵PID:2372
-
\??\c:\flrrllf.exec:\flrrllf.exe111⤵PID:1200
-
\??\c:\nnnbnb.exec:\nnnbnb.exe112⤵PID:4472
-
\??\c:\jvvvj.exec:\jvvvj.exe113⤵PID:3036
-
\??\c:\rlxrxxr.exec:\rlxrxxr.exe114⤵PID:2960
-
\??\c:\hnnnbb.exec:\hnnnbb.exe115⤵PID:4208
-
\??\c:\1vdvv.exec:\1vdvv.exe116⤵PID:2360
-
\??\c:\lrxrrff.exec:\lrxrrff.exe117⤵PID:2980
-
\??\c:\3lrlfxr.exec:\3lrlfxr.exe118⤵PID:1544
-
\??\c:\tnnhbb.exec:\tnnhbb.exe119⤵PID:1948
-
\??\c:\3bbbtt.exec:\3bbbtt.exe120⤵PID:4844
-
\??\c:\pjdvd.exec:\pjdvd.exe121⤵PID:4556
-
\??\c:\xllxrrx.exec:\xllxrrx.exe122⤵PID:5060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-