Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 02:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f434b431e89b8ecac1176379a78abd0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
7f434b431e89b8ecac1176379a78abd0_NeikiAnalytics.exe
-
Size
145KB
-
MD5
7f434b431e89b8ecac1176379a78abd0
-
SHA1
1df15181f3de4979f9ac54682d3f88583dc8a078
-
SHA256
6a05593454675174bf1868f1cd715305f47d3ad77af307b6f007240132f73f4a
-
SHA512
ba21a2dd9e6c4b2893631dd113fe5bc73be2d4c0d4c8e7af15ce968e6dac773442731240c3a0d03e63503fbe11d08ed7a219e2fd8a87dbb76b4ea27ca2029634
-
SSDEEP
3072:ymb3NkkiQ3mdBjFosxXGPXbXQMFHLgDWSmklgQI:n3C9BRosxW8MFHLMW7QI
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral2/memory/2028-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2172-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2128-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/836-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3776-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1240-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1260 9lrlrrx.exe 2172 3htnhh.exe 3440 vvpjd.exe 1512 ffrrlll.exe 3160 jjvpv.exe 4788 jddvp.exe 2128 lrrllrr.exe 3112 lxfxxrl.exe 2356 dvdvp.exe 1952 ffxrllx.exe 836 nhtttt.exe 3776 bttttt.exe 1240 rrxrffx.exe 4052 7nhbbh.exe 4748 7dvpd.exe 4724 dpvvv.exe 4020 rxxrffx.exe 1796 pvpjd.exe 1968 rllrrll.exe 972 lffxrrl.exe 3688 7htnnt.exe 5028 ppjjj.exe 5012 xxxrllf.exe 4932 nnttbb.exe 4072 xrfxffx.exe 4480 ttbbtt.exe 2200 fxrlllf.exe 4620 xlrxrrr.exe 996 hnnnnn.exe 3120 vppjv.exe 2160 1fffllf.exe 2024 tnhbnh.exe 3540 3pjjv.exe 516 pjdvp.exe 2860 9llrfxr.exe 4364 7rxxxxx.exe 2992 bthtnb.exe 776 vpjdd.exe 1244 rlrfllr.exe 1340 btnthh.exe 4548 1nhnhh.exe 3088 lxfrrrl.exe 4716 9bnhbb.exe 4972 hbhbbb.exe 2832 vppjd.exe 2828 ffxrfff.exe 3948 tnhhbn.exe 1736 hnbtnh.exe 4416 btnbth.exe 1108 lllllrr.exe 940 bbbbbb.exe 1616 djppd.exe 3536 lfllffx.exe 3944 xrlffxx.exe 2568 1bhbtt.exe 2564 dvvpd.exe 2256 jpppj.exe 2848 rfrlffx.exe 2128 hnnhbt.exe 4688 thnbbh.exe 5044 lrxrrxr.exe 3624 hbttnt.exe 4596 nbbbbb.exe 4600 pddvv.exe -
resource yara_rule behavioral2/memory/2028-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2172-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2172-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2128-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/836-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-185-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1260 2028 7f434b431e89b8ecac1176379a78abd0_NeikiAnalytics.exe 81 PID 2028 wrote to memory of 1260 2028 7f434b431e89b8ecac1176379a78abd0_NeikiAnalytics.exe 81 PID 2028 wrote to memory of 1260 2028 7f434b431e89b8ecac1176379a78abd0_NeikiAnalytics.exe 81 PID 1260 wrote to memory of 2172 1260 9lrlrrx.exe 82 PID 1260 wrote to memory of 2172 1260 9lrlrrx.exe 82 PID 1260 wrote to memory of 2172 1260 9lrlrrx.exe 82 PID 2172 wrote to memory of 3440 2172 3htnhh.exe 83 PID 2172 wrote to memory of 3440 2172 3htnhh.exe 83 PID 2172 wrote to memory of 3440 2172 3htnhh.exe 83 PID 3440 wrote to memory of 1512 3440 vvpjd.exe 84 PID 3440 wrote to memory of 1512 3440 vvpjd.exe 84 PID 3440 wrote to memory of 1512 3440 vvpjd.exe 84 PID 1512 wrote to memory of 3160 1512 ffrrlll.exe 85 PID 1512 wrote to memory of 3160 1512 ffrrlll.exe 85 PID 1512 wrote to memory of 3160 1512 ffrrlll.exe 85 PID 3160 wrote to memory of 4788 3160 jjvpv.exe 86 PID 3160 wrote to memory of 4788 3160 jjvpv.exe 86 PID 3160 wrote to memory of 4788 3160 jjvpv.exe 86 PID 4788 wrote to memory of 2128 4788 jddvp.exe 87 PID 4788 wrote to memory of 2128 4788 jddvp.exe 87 PID 4788 wrote to memory of 2128 4788 jddvp.exe 87 PID 2128 wrote to memory of 3112 2128 lrrllrr.exe 88 PID 2128 wrote to memory of 3112 2128 lrrllrr.exe 88 PID 2128 wrote to memory of 3112 2128 lrrllrr.exe 88 PID 3112 wrote to memory of 2356 3112 lxfxxrl.exe 89 PID 3112 wrote to memory of 2356 3112 lxfxxrl.exe 89 PID 3112 wrote to memory of 2356 3112 lxfxxrl.exe 89 PID 2356 wrote to memory of 1952 2356 dvdvp.exe 90 PID 2356 wrote to memory of 1952 2356 dvdvp.exe 90 PID 2356 wrote to memory of 1952 2356 dvdvp.exe 90 PID 1952 wrote to memory of 836 1952 ffxrllx.exe 91 PID 1952 wrote to memory of 836 1952 ffxrllx.exe 91 PID 1952 wrote to memory of 836 1952 ffxrllx.exe 91 PID 836 wrote to memory of 3776 836 nhtttt.exe 92 PID 836 wrote to memory of 3776 836 nhtttt.exe 92 PID 836 wrote to memory of 3776 836 nhtttt.exe 92 PID 3776 wrote to memory of 1240 3776 bttttt.exe 93 PID 3776 wrote to memory of 1240 3776 bttttt.exe 93 PID 3776 wrote to memory of 1240 3776 bttttt.exe 93 PID 1240 wrote to memory of 4052 1240 rrxrffx.exe 94 PID 1240 wrote to memory of 4052 1240 rrxrffx.exe 94 PID 1240 wrote to memory of 4052 1240 rrxrffx.exe 94 PID 4052 wrote to memory of 4748 4052 7nhbbh.exe 95 PID 4052 wrote to memory of 4748 4052 7nhbbh.exe 95 PID 4052 wrote to memory of 4748 4052 7nhbbh.exe 95 PID 4748 wrote to memory of 4724 4748 7dvpd.exe 96 PID 4748 wrote to memory of 4724 4748 7dvpd.exe 96 PID 4748 wrote to memory of 4724 4748 7dvpd.exe 96 PID 4724 wrote to memory of 4020 4724 dpvvv.exe 97 PID 4724 wrote to memory of 4020 4724 dpvvv.exe 97 PID 4724 wrote to memory of 4020 4724 dpvvv.exe 97 PID 4020 wrote to memory of 1796 4020 rxxrffx.exe 98 PID 4020 wrote to memory of 1796 4020 rxxrffx.exe 98 PID 4020 wrote to memory of 1796 4020 rxxrffx.exe 98 PID 1796 wrote to memory of 1968 1796 pvpjd.exe 99 PID 1796 wrote to memory of 1968 1796 pvpjd.exe 99 PID 1796 wrote to memory of 1968 1796 pvpjd.exe 99 PID 1968 wrote to memory of 972 1968 rllrrll.exe 100 PID 1968 wrote to memory of 972 1968 rllrrll.exe 100 PID 1968 wrote to memory of 972 1968 rllrrll.exe 100 PID 972 wrote to memory of 3688 972 lffxrrl.exe 101 PID 972 wrote to memory of 3688 972 lffxrrl.exe 101 PID 972 wrote to memory of 3688 972 lffxrrl.exe 101 PID 3688 wrote to memory of 5028 3688 7htnnt.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f434b431e89b8ecac1176379a78abd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7f434b431e89b8ecac1176379a78abd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\9lrlrrx.exec:\9lrlrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\3htnhh.exec:\3htnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\vvpjd.exec:\vvpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\ffrrlll.exec:\ffrrlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\jjvpv.exec:\jjvpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\jddvp.exec:\jddvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\lrrllrr.exec:\lrrllrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\lxfxxrl.exec:\lxfxxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\dvdvp.exec:\dvdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\ffxrllx.exec:\ffxrllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\nhtttt.exec:\nhtttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\bttttt.exec:\bttttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\rrxrffx.exec:\rrxrffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\7nhbbh.exec:\7nhbbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\7dvpd.exec:\7dvpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\dpvvv.exec:\dpvvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\rxxrffx.exec:\rxxrffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\pvpjd.exec:\pvpjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\rllrrll.exec:\rllrrll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\lffxrrl.exec:\lffxrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\7htnnt.exec:\7htnnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\ppjjj.exec:\ppjjj.exe23⤵
- Executes dropped EXE
PID:5028 -
\??\c:\xxxrllf.exec:\xxxrllf.exe24⤵
- Executes dropped EXE
PID:5012 -
\??\c:\nnttbb.exec:\nnttbb.exe25⤵
- Executes dropped EXE
PID:4932 -
\??\c:\xrfxffx.exec:\xrfxffx.exe26⤵
- Executes dropped EXE
PID:4072 -
\??\c:\ttbbtt.exec:\ttbbtt.exe27⤵
- Executes dropped EXE
PID:4480 -
\??\c:\fxrlllf.exec:\fxrlllf.exe28⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xlrxrrr.exec:\xlrxrrr.exe29⤵
- Executes dropped EXE
PID:4620 -
\??\c:\hnnnnn.exec:\hnnnnn.exe30⤵
- Executes dropped EXE
PID:996 -
\??\c:\vppjv.exec:\vppjv.exe31⤵
- Executes dropped EXE
PID:3120 -
\??\c:\1fffllf.exec:\1fffllf.exe32⤵
- Executes dropped EXE
PID:2160 -
\??\c:\tnhbnh.exec:\tnhbnh.exe33⤵
- Executes dropped EXE
PID:2024 -
\??\c:\3pjjv.exec:\3pjjv.exe34⤵
- Executes dropped EXE
PID:3540 -
\??\c:\pjdvp.exec:\pjdvp.exe35⤵
- Executes dropped EXE
PID:516 -
\??\c:\9llrfxr.exec:\9llrfxr.exe36⤵
- Executes dropped EXE
PID:2860 -
\??\c:\7rxxxxx.exec:\7rxxxxx.exe37⤵
- Executes dropped EXE
PID:4364 -
\??\c:\bthtnb.exec:\bthtnb.exe38⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vpjdd.exec:\vpjdd.exe39⤵
- Executes dropped EXE
PID:776 -
\??\c:\rlrfllr.exec:\rlrfllr.exe40⤵
- Executes dropped EXE
PID:1244 -
\??\c:\btnthh.exec:\btnthh.exe41⤵
- Executes dropped EXE
PID:1340 -
\??\c:\1nhnhh.exec:\1nhnhh.exe42⤵
- Executes dropped EXE
PID:4548 -
\??\c:\lxfrrrl.exec:\lxfrrrl.exe43⤵
- Executes dropped EXE
PID:3088 -
\??\c:\9bnhbb.exec:\9bnhbb.exe44⤵
- Executes dropped EXE
PID:4716 -
\??\c:\hbhbbb.exec:\hbhbbb.exe45⤵
- Executes dropped EXE
PID:4972 -
\??\c:\vppjd.exec:\vppjd.exe46⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ffxrfff.exec:\ffxrfff.exe47⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tnhhbn.exec:\tnhhbn.exe48⤵
- Executes dropped EXE
PID:3948 -
\??\c:\hnbtnh.exec:\hnbtnh.exe49⤵
- Executes dropped EXE
PID:1736 -
\??\c:\btnbth.exec:\btnbth.exe50⤵
- Executes dropped EXE
PID:4416 -
\??\c:\lllllrr.exec:\lllllrr.exe51⤵
- Executes dropped EXE
PID:1108 -
\??\c:\bbbbbb.exec:\bbbbbb.exe52⤵
- Executes dropped EXE
PID:940 -
\??\c:\djppd.exec:\djppd.exe53⤵
- Executes dropped EXE
PID:1616 -
\??\c:\lfllffx.exec:\lfllffx.exe54⤵
- Executes dropped EXE
PID:3536 -
\??\c:\xrlffxx.exec:\xrlffxx.exe55⤵
- Executes dropped EXE
PID:3944 -
\??\c:\1bhbtt.exec:\1bhbtt.exe56⤵
- Executes dropped EXE
PID:2568 -
\??\c:\dvvpd.exec:\dvvpd.exe57⤵
- Executes dropped EXE
PID:2564 -
\??\c:\jpppj.exec:\jpppj.exe58⤵
- Executes dropped EXE
PID:2256 -
\??\c:\rfrlffx.exec:\rfrlffx.exe59⤵
- Executes dropped EXE
PID:2848 -
\??\c:\hnnhbt.exec:\hnnhbt.exe60⤵
- Executes dropped EXE
PID:2128 -
\??\c:\thnbbh.exec:\thnbbh.exe61⤵
- Executes dropped EXE
PID:4688 -
\??\c:\lrxrrxr.exec:\lrxrrxr.exe62⤵
- Executes dropped EXE
PID:5044 -
\??\c:\hbttnt.exec:\hbttnt.exe63⤵
- Executes dropped EXE
PID:3624 -
\??\c:\nbbbbb.exec:\nbbbbb.exe64⤵
- Executes dropped EXE
PID:4596 -
\??\c:\pddvv.exec:\pddvv.exe65⤵
- Executes dropped EXE
PID:4600 -
\??\c:\vppvp.exec:\vppvp.exe66⤵PID:4740
-
\??\c:\3lffrrr.exec:\3lffrrr.exe67⤵PID:3796
-
\??\c:\tnnhht.exec:\tnnhht.exe68⤵PID:1292
-
\??\c:\nnhbnn.exec:\nnhbnn.exe69⤵PID:3048
-
\??\c:\jjpjd.exec:\jjpjd.exe70⤵PID:1864
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe71⤵PID:2464
-
\??\c:\tbttth.exec:\tbttth.exe72⤵PID:3408
-
\??\c:\nnhhhn.exec:\nnhhhn.exe73⤵PID:2140
-
\??\c:\7pvvp.exec:\7pvvp.exe74⤵PID:4964
-
\??\c:\rrrlxxx.exec:\rrrlxxx.exe75⤵PID:3396
-
\??\c:\lfxxrxf.exec:\lfxxrxf.exe76⤵PID:2936
-
\??\c:\9bhthb.exec:\9bhthb.exe77⤵PID:840
-
\??\c:\vvvvj.exec:\vvvvj.exe78⤵PID:4132
-
\??\c:\vpddv.exec:\vpddv.exe79⤵PID:2168
-
\??\c:\xfrrxxl.exec:\xfrrxxl.exe80⤵PID:3080
-
\??\c:\hbhhht.exec:\hbhhht.exe81⤵PID:316
-
\??\c:\1thbnn.exec:\1thbnn.exe82⤵PID:1080
-
\??\c:\vjjdd.exec:\vjjdd.exe83⤵PID:4088
-
\??\c:\7xlfxxx.exec:\7xlfxxx.exe84⤵PID:3936
-
\??\c:\fxxxxxr.exec:\fxxxxxr.exe85⤵PID:4960
-
\??\c:\nnhhhh.exec:\nnhhhh.exe86⤵PID:2888
-
\??\c:\dvjdd.exec:\dvjdd.exe87⤵PID:4692
-
\??\c:\vvpjv.exec:\vvpjv.exe88⤵PID:3156
-
\??\c:\lfxrllf.exec:\lfxrllf.exe89⤵PID:3976
-
\??\c:\lxxxrxx.exec:\lxxxrxx.exe90⤵PID:2160
-
\??\c:\9ttthn.exec:\9ttthn.exe91⤵PID:2024
-
\??\c:\pjvpp.exec:\pjvpp.exe92⤵PID:2272
-
\??\c:\7jjdv.exec:\7jjdv.exe93⤵PID:5104
-
\??\c:\rrxxrxr.exec:\rrxxrxr.exe94⤵PID:1576
-
\??\c:\1nnnhb.exec:\1nnnhb.exe95⤵PID:1340
-
\??\c:\9jvpv.exec:\9jvpv.exe96⤵PID:1304
-
\??\c:\jjjdp.exec:\jjjdp.exe97⤵PID:3088
-
\??\c:\lrfxrrr.exec:\lrfxrrr.exe98⤵PID:4672
-
\??\c:\lffxllf.exec:\lffxllf.exe99⤵PID:2704
-
\??\c:\hbbbtt.exec:\hbbbtt.exe100⤵PID:2912
-
\??\c:\9vdvd.exec:\9vdvd.exe101⤵PID:1624
-
\??\c:\flrlrrl.exec:\flrlrrl.exe102⤵PID:4704
-
\??\c:\rxfffff.exec:\rxfffff.exe103⤵PID:1736
-
\??\c:\5tbbbb.exec:\5tbbbb.exe104⤵PID:4452
-
\??\c:\djdpp.exec:\djdpp.exe105⤵PID:1108
-
\??\c:\jvdvj.exec:\jvdvj.exe106⤵PID:1284
-
\??\c:\bhhnhb.exec:\bhhnhb.exe107⤵PID:760
-
\??\c:\pjjdj.exec:\pjjdj.exe108⤵PID:1772
-
\??\c:\vvpjj.exec:\vvpjj.exe109⤵PID:2568
-
\??\c:\hnnbtn.exec:\hnnbtn.exe110⤵PID:4784
-
\??\c:\1dddj.exec:\1dddj.exe111⤵PID:4196
-
\??\c:\pjppv.exec:\pjppv.exe112⤵PID:2424
-
\??\c:\7ffxllf.exec:\7ffxllf.exe113⤵PID:3912
-
\??\c:\tnnhbb.exec:\tnnhbb.exe114⤵PID:2408
-
\??\c:\tnnhnn.exec:\tnnhnn.exe115⤵PID:1252
-
\??\c:\pjdvp.exec:\pjdvp.exe116⤵PID:3592
-
\??\c:\jppvp.exec:\jppvp.exe117⤵PID:4924
-
\??\c:\flxrfxx.exec:\flxrfxx.exe118⤵PID:4568
-
\??\c:\tnnnhb.exec:\tnnnhb.exe119⤵PID:4912
-
\??\c:\tbbthh.exec:\tbbthh.exe120⤵PID:4536
-
\??\c:\5pdvj.exec:\5pdvj.exe121⤵PID:1240
-
\??\c:\rlrlrxl.exec:\rlrlrxl.exe122⤵PID:2012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-