Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 16:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cdc6c67f2a54696c9e6c4b3379bf32a0_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
cdc6c67f2a54696c9e6c4b3379bf32a0_NeikiAnalytics.exe
-
Size
74KB
-
MD5
cdc6c67f2a54696c9e6c4b3379bf32a0
-
SHA1
1c245b8ff35ba7543dc060d8f2e3c92bc632520e
-
SHA256
457c9c1cb696ca7bb5667f34c3536a53c1c4989f05e709c083a6d7cffd76f0e7
-
SHA512
cfc748278243343f453747b1fbf802bc373ff7c44b68ca015a240ad572c4e5c5ab466b70507dfcc05d16c5c7e9623ccefea065e0e35047741aa02204eb21650a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIrmCeRMKeWqNSd:ymb3NkkiQ3mdBjFIjek5A
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/2240-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-26-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3324-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1992-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/700-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2172-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3912 3fffffl.exe 4892 bnhbhh.exe 5068 1dddp.exe 3668 vdjjj.exe 3324 lxrlrlf.exe 1992 htbthb.exe 2636 hntthb.exe 4052 5pjjj.exe 3136 xrlfrrl.exe 952 bthbtn.exe 2816 vjddj.exe 1480 frlxlfx.exe 4636 tnnhhh.exe 1660 hbthnt.exe 1296 dvvdd.exe 4672 flrxflx.exe 4564 btbhbb.exe 2248 thhbtn.exe 4568 vvvpj.exe 2940 7rrlxrl.exe 2520 rfflxll.exe 700 bhttnn.exe 552 bntntn.exe 3208 ddjdj.exe 2172 vddjd.exe 3148 7lrlllf.exe 5008 flrxxfl.exe 3684 bbhtbn.exe 3360 dvjjd.exe 2528 fxlffxr.exe 4752 rxrrxxr.exe 4544 bnbttt.exe 2088 nbbhbb.exe 3508 vpvvp.exe 4976 7djpd.exe 2896 5fllfff.exe 2540 hbnhbb.exe 2924 hbhbtn.exe 4556 jjdvv.exe 3132 frxrxxx.exe 2432 hnhbhb.exe 3988 hntttb.exe 4816 pvdjp.exe 2256 rxrxrxx.exe 3864 fxxrllf.exe 404 hbhntb.exe 2416 jdjjp.exe 3124 pjddj.exe 2608 fffxlfr.exe 512 5fxrllf.exe 1660 tbhhhh.exe 3276 bbhttb.exe 4732 vjvpd.exe 3924 7ffrffr.exe 4520 lfffffx.exe 1384 nnnnnn.exe 4644 jddvp.exe 2820 vjddv.exe 4328 rffxllf.exe 4040 lfflllf.exe 2100 nnhthb.exe 552 3btttb.exe 2456 7vdpd.exe 3220 pppjp.exe -
resource yara_rule behavioral2/memory/2240-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1992-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/700-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2172-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 3912 2240 cdc6c67f2a54696c9e6c4b3379bf32a0_NeikiAnalytics.exe 85 PID 2240 wrote to memory of 3912 2240 cdc6c67f2a54696c9e6c4b3379bf32a0_NeikiAnalytics.exe 85 PID 2240 wrote to memory of 3912 2240 cdc6c67f2a54696c9e6c4b3379bf32a0_NeikiAnalytics.exe 85 PID 3912 wrote to memory of 4892 3912 3fffffl.exe 86 PID 3912 wrote to memory of 4892 3912 3fffffl.exe 86 PID 3912 wrote to memory of 4892 3912 3fffffl.exe 86 PID 4892 wrote to memory of 5068 4892 bnhbhh.exe 87 PID 4892 wrote to memory of 5068 4892 bnhbhh.exe 87 PID 4892 wrote to memory of 5068 4892 bnhbhh.exe 87 PID 5068 wrote to memory of 3668 5068 1dddp.exe 88 PID 5068 wrote to memory of 3668 5068 1dddp.exe 88 PID 5068 wrote to memory of 3668 5068 1dddp.exe 88 PID 3668 wrote to memory of 3324 3668 vdjjj.exe 89 PID 3668 wrote to memory of 3324 3668 vdjjj.exe 89 PID 3668 wrote to memory of 3324 3668 vdjjj.exe 89 PID 3324 wrote to memory of 1992 3324 lxrlrlf.exe 90 PID 3324 wrote to memory of 1992 3324 lxrlrlf.exe 90 PID 3324 wrote to memory of 1992 3324 lxrlrlf.exe 90 PID 1992 wrote to memory of 2636 1992 htbthb.exe 91 PID 1992 wrote to memory of 2636 1992 htbthb.exe 91 PID 1992 wrote to memory of 2636 1992 htbthb.exe 91 PID 2636 wrote to memory of 4052 2636 hntthb.exe 92 PID 2636 wrote to memory of 4052 2636 hntthb.exe 92 PID 2636 wrote to memory of 4052 2636 hntthb.exe 92 PID 4052 wrote to memory of 3136 4052 5pjjj.exe 93 PID 4052 wrote to memory of 3136 4052 5pjjj.exe 93 PID 4052 wrote to memory of 3136 4052 5pjjj.exe 93 PID 3136 wrote to memory of 952 3136 xrlfrrl.exe 94 PID 3136 wrote to memory of 952 3136 xrlfrrl.exe 94 PID 3136 wrote to memory of 952 3136 xrlfrrl.exe 94 PID 952 wrote to memory of 2816 952 bthbtn.exe 95 PID 952 wrote to memory of 2816 952 bthbtn.exe 95 PID 952 wrote to memory of 2816 952 bthbtn.exe 95 PID 2816 wrote to memory of 1480 2816 vjddj.exe 96 PID 2816 wrote to memory of 1480 2816 vjddj.exe 96 PID 2816 wrote to memory of 1480 2816 vjddj.exe 96 PID 1480 wrote to memory of 4636 1480 frlxlfx.exe 97 PID 1480 wrote to memory of 4636 1480 frlxlfx.exe 97 PID 1480 wrote to memory of 4636 1480 frlxlfx.exe 97 PID 4636 wrote to memory of 1660 4636 tnnhhh.exe 98 PID 4636 wrote to memory of 1660 4636 tnnhhh.exe 98 PID 4636 wrote to memory of 1660 4636 tnnhhh.exe 98 PID 1660 wrote to memory of 1296 1660 hbthnt.exe 99 PID 1660 wrote to memory of 1296 1660 hbthnt.exe 99 PID 1660 wrote to memory of 1296 1660 hbthnt.exe 99 PID 1296 wrote to memory of 4672 1296 dvvdd.exe 100 PID 1296 wrote to memory of 4672 1296 dvvdd.exe 100 PID 1296 wrote to memory of 4672 1296 dvvdd.exe 100 PID 4672 wrote to memory of 4564 4672 flrxflx.exe 101 PID 4672 wrote to memory of 4564 4672 flrxflx.exe 101 PID 4672 wrote to memory of 4564 4672 flrxflx.exe 101 PID 4564 wrote to memory of 2248 4564 btbhbb.exe 102 PID 4564 wrote to memory of 2248 4564 btbhbb.exe 102 PID 4564 wrote to memory of 2248 4564 btbhbb.exe 102 PID 2248 wrote to memory of 4568 2248 thhbtn.exe 103 PID 2248 wrote to memory of 4568 2248 thhbtn.exe 103 PID 2248 wrote to memory of 4568 2248 thhbtn.exe 103 PID 4568 wrote to memory of 2940 4568 vvvpj.exe 104 PID 4568 wrote to memory of 2940 4568 vvvpj.exe 104 PID 4568 wrote to memory of 2940 4568 vvvpj.exe 104 PID 2940 wrote to memory of 2520 2940 7rrlxrl.exe 105 PID 2940 wrote to memory of 2520 2940 7rrlxrl.exe 105 PID 2940 wrote to memory of 2520 2940 7rrlxrl.exe 105 PID 2520 wrote to memory of 700 2520 rfflxll.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdc6c67f2a54696c9e6c4b3379bf32a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\cdc6c67f2a54696c9e6c4b3379bf32a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\3fffffl.exec:\3fffffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\bnhbhh.exec:\bnhbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\1dddp.exec:\1dddp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\vdjjj.exec:\vdjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\lxrlrlf.exec:\lxrlrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\htbthb.exec:\htbthb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\hntthb.exec:\hntthb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\5pjjj.exec:\5pjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\bthbtn.exec:\bthbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\vjddj.exec:\vjddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\frlxlfx.exec:\frlxlfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\tnnhhh.exec:\tnnhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\hbthnt.exec:\hbthnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\dvvdd.exec:\dvvdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\flrxflx.exec:\flrxflx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\btbhbb.exec:\btbhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\thhbtn.exec:\thhbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\vvvpj.exec:\vvvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\7rrlxrl.exec:\7rrlxrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\rfflxll.exec:\rfflxll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\bhttnn.exec:\bhttnn.exe23⤵
- Executes dropped EXE
PID:700 -
\??\c:\bntntn.exec:\bntntn.exe24⤵
- Executes dropped EXE
PID:552 -
\??\c:\ddjdj.exec:\ddjdj.exe25⤵
- Executes dropped EXE
PID:3208 -
\??\c:\vddjd.exec:\vddjd.exe26⤵
- Executes dropped EXE
PID:2172 -
\??\c:\7lrlllf.exec:\7lrlllf.exe27⤵
- Executes dropped EXE
PID:3148 -
\??\c:\flrxxfl.exec:\flrxxfl.exe28⤵
- Executes dropped EXE
PID:5008 -
\??\c:\bbhtbn.exec:\bbhtbn.exe29⤵
- Executes dropped EXE
PID:3684 -
\??\c:\dvjjd.exec:\dvjjd.exe30⤵
- Executes dropped EXE
PID:3360 -
\??\c:\fxlffxr.exec:\fxlffxr.exe31⤵
- Executes dropped EXE
PID:2528 -
\??\c:\rxrrxxr.exec:\rxrrxxr.exe32⤵
- Executes dropped EXE
PID:4752 -
\??\c:\bnbttt.exec:\bnbttt.exe33⤵
- Executes dropped EXE
PID:4544 -
\??\c:\nbbhbb.exec:\nbbhbb.exe34⤵
- Executes dropped EXE
PID:2088 -
\??\c:\vpvvp.exec:\vpvvp.exe35⤵
- Executes dropped EXE
PID:3508 -
\??\c:\7djpd.exec:\7djpd.exe36⤵
- Executes dropped EXE
PID:4976 -
\??\c:\5fllfff.exec:\5fllfff.exe37⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hbnhbb.exec:\hbnhbb.exe38⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hbhbtn.exec:\hbhbtn.exe39⤵
- Executes dropped EXE
PID:2924 -
\??\c:\jjdvv.exec:\jjdvv.exe40⤵
- Executes dropped EXE
PID:4556 -
\??\c:\frxrxxx.exec:\frxrxxx.exe41⤵
- Executes dropped EXE
PID:3132 -
\??\c:\hnhbhb.exec:\hnhbhb.exe42⤵
- Executes dropped EXE
PID:2432 -
\??\c:\hntttb.exec:\hntttb.exe43⤵
- Executes dropped EXE
PID:3988 -
\??\c:\pvdjp.exec:\pvdjp.exe44⤵
- Executes dropped EXE
PID:4816 -
\??\c:\rxrxrxx.exec:\rxrxrxx.exe45⤵
- Executes dropped EXE
PID:2256 -
\??\c:\fxxrllf.exec:\fxxrllf.exe46⤵
- Executes dropped EXE
PID:3864 -
\??\c:\hbhntb.exec:\hbhntb.exe47⤵
- Executes dropped EXE
PID:404 -
\??\c:\jdjjp.exec:\jdjjp.exe48⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pjddj.exec:\pjddj.exe49⤵
- Executes dropped EXE
PID:3124 -
\??\c:\fffxlfr.exec:\fffxlfr.exe50⤵
- Executes dropped EXE
PID:2608 -
\??\c:\5fxrllf.exec:\5fxrllf.exe51⤵
- Executes dropped EXE
PID:512 -
\??\c:\tbhhhh.exec:\tbhhhh.exe52⤵
- Executes dropped EXE
PID:1660 -
\??\c:\bbhttb.exec:\bbhttb.exe53⤵
- Executes dropped EXE
PID:3276 -
\??\c:\vjvpd.exec:\vjvpd.exe54⤵
- Executes dropped EXE
PID:4732 -
\??\c:\7ffrffr.exec:\7ffrffr.exe55⤵
- Executes dropped EXE
PID:3924 -
\??\c:\lfffffx.exec:\lfffffx.exe56⤵
- Executes dropped EXE
PID:4520 -
\??\c:\nnnnnn.exec:\nnnnnn.exe57⤵
- Executes dropped EXE
PID:1384 -
\??\c:\jddvp.exec:\jddvp.exe58⤵
- Executes dropped EXE
PID:4644 -
\??\c:\vjddv.exec:\vjddv.exe59⤵
- Executes dropped EXE
PID:2820 -
\??\c:\rffxllf.exec:\rffxllf.exe60⤵
- Executes dropped EXE
PID:4328 -
\??\c:\lfflllf.exec:\lfflllf.exe61⤵
- Executes dropped EXE
PID:4040 -
\??\c:\nnhthb.exec:\nnhthb.exe62⤵
- Executes dropped EXE
PID:2100 -
\??\c:\3btttb.exec:\3btttb.exe63⤵
- Executes dropped EXE
PID:552 -
\??\c:\7vdpd.exec:\7vdpd.exe64⤵
- Executes dropped EXE
PID:2456 -
\??\c:\pppjp.exec:\pppjp.exe65⤵
- Executes dropped EXE
PID:3220 -
\??\c:\frlfffx.exec:\frlfffx.exe66⤵PID:3552
-
\??\c:\3xfxrrl.exec:\3xfxrrl.exe67⤵PID:888
-
\??\c:\bnbtnt.exec:\bnbtnt.exe68⤵PID:4616
-
\??\c:\1ttnhh.exec:\1ttnhh.exe69⤵PID:3352
-
\??\c:\jdjdj.exec:\jdjdj.exe70⤵PID:1252
-
\??\c:\pjppj.exec:\pjppj.exe71⤵PID:864
-
\??\c:\xrrfxxr.exec:\xrrfxxr.exe72⤵PID:336
-
\??\c:\rfxrlll.exec:\rfxrlll.exe73⤵PID:764
-
\??\c:\1bthbb.exec:\1bthbb.exe74⤵PID:3116
-
\??\c:\hnhbnn.exec:\hnhbnn.exe75⤵PID:4428
-
\??\c:\nbbthh.exec:\nbbthh.exe76⤵PID:3756
-
\??\c:\dpvvv.exec:\dpvvv.exe77⤵PID:4272
-
\??\c:\djpvp.exec:\djpvp.exe78⤵PID:2900
-
\??\c:\rxlfrrl.exec:\rxlfrrl.exe79⤵PID:1484
-
\??\c:\nbtbnn.exec:\nbtbnn.exe80⤵PID:4596
-
\??\c:\thhbth.exec:\thhbth.exe81⤵PID:3668
-
\??\c:\jppjd.exec:\jppjd.exe82⤵PID:2432
-
\??\c:\pvvvp.exec:\pvvvp.exe83⤵PID:3244
-
\??\c:\lfrfxxr.exec:\lfrfxxr.exe84⤵PID:1280
-
\??\c:\frxrlrr.exec:\frxrlrr.exe85⤵PID:2256
-
\??\c:\nnbtnn.exec:\nnbtnn.exe86⤵PID:900
-
\??\c:\jpvpj.exec:\jpvpj.exe87⤵PID:4880
-
\??\c:\pdvjd.exec:\pdvjd.exe88⤵PID:4336
-
\??\c:\lxfxxxf.exec:\lxfxxxf.exe89⤵PID:1332
-
\??\c:\lfxrrll.exec:\lfxrrll.exe90⤵PID:1084
-
\??\c:\llflllx.exec:\llflllx.exe91⤵PID:2600
-
\??\c:\bthhhh.exec:\bthhhh.exe92⤵PID:3980
-
\??\c:\dddpj.exec:\dddpj.exe93⤵PID:5116
-
\??\c:\rfxrrrl.exec:\rfxrrrl.exe94⤵PID:4840
-
\??\c:\httnhh.exec:\httnhh.exe95⤵PID:4960
-
\??\c:\nnbbtb.exec:\nnbbtb.exe96⤵PID:4852
-
\??\c:\jdpvp.exec:\jdpvp.exe97⤵PID:3860
-
\??\c:\jvvpp.exec:\jvvpp.exe98⤵PID:2644
-
\??\c:\xlxlllr.exec:\xlxlllr.exe99⤵PID:2372
-
\??\c:\nbbtnn.exec:\nbbtnn.exe100⤵PID:1940
-
\??\c:\djpvp.exec:\djpvp.exe101⤵PID:2520
-
\??\c:\5jdvv.exec:\5jdvv.exe102⤵PID:5080
-
\??\c:\lrlrrlf.exec:\lrlrrlf.exe103⤵PID:2720
-
\??\c:\1nnnnn.exec:\1nnnnn.exe104⤵PID:552
-
\??\c:\nhbthh.exec:\nhbthh.exe105⤵PID:5060
-
\??\c:\pddvp.exec:\pddvp.exe106⤵PID:3552
-
\??\c:\llffxxx.exec:\llffxxx.exe107⤵PID:1152
-
\??\c:\rffxrrr.exec:\rffxrrr.exe108⤵PID:3944
-
\??\c:\nbhnhh.exec:\nbhnhh.exe109⤵PID:4848
-
\??\c:\btttnt.exec:\btttnt.exe110⤵PID:1252
-
\??\c:\pvpvp.exec:\pvpvp.exe111⤵PID:4316
-
\??\c:\1jvpj.exec:\1jvpj.exe112⤵PID:2096
-
\??\c:\lxfffll.exec:\lxfffll.exe113⤵PID:1896
-
\??\c:\ffrrlll.exec:\ffrrlll.exe114⤵PID:2240
-
\??\c:\vvdvv.exec:\vvdvv.exe115⤵PID:2064
-
\??\c:\ddjjj.exec:\ddjjj.exe116⤵PID:3912
-
\??\c:\xlrlllf.exec:\xlrlllf.exe117⤵PID:4272
-
\??\c:\xlxxlrx.exec:\xlxxlrx.exe118⤵PID:1436
-
\??\c:\hbbtnh.exec:\hbbtnh.exe119⤵PID:3132
-
\??\c:\nhhtnh.exec:\nhhtnh.exe120⤵PID:2476
-
\??\c:\dvppj.exec:\dvppj.exe121⤵PID:4804
-
\??\c:\vppjv.exec:\vppjv.exe122⤵PID:4816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-