Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 04:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a34a36fc7e0a2bd3df136ee6e67c94a0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a34a36fc7e0a2bd3df136ee6e67c94a0_NeikiAnalytics.exe
-
Size
68KB
-
MD5
a34a36fc7e0a2bd3df136ee6e67c94a0
-
SHA1
6c941d9bac0cd3291d64e6f6a5184fa93ab9e541
-
SHA256
c1a82bc7e1e449a93dc2e6837317c9edce4fc54cbb4ee913cf13e3bcdd0e913f
-
SHA512
f2034273173b37ff85371915dd5995be0034a59290165a5734e448724221e03958514320c469ea365dc7245b2ed068fbb10cdd2bb64b131fea756422c6c812b4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUwcsbY/v:ymb3NkkiQ3mdBjF0yjcsM3
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/2696-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/928-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/364-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3696 lflfffl.exe 1232 jjvpj.exe 4764 1dvpj.exe 2368 btnhnn.exe 5040 pvvpv.exe 3588 frrfxxl.exe 2056 pdvpj.exe 3852 vpvvp.exe 2644 xflflxr.exe 3972 9bhhnn.exe 4736 dvjdj.exe 2960 9xxrlrl.exe 2968 bbbbbb.exe 4708 nnnhbn.exe 464 jjvvd.exe 3192 frflfxx.exe 3840 7tttbb.exe 2308 hbbhbt.exe 3660 3pjjd.exe 4616 pjpjj.exe 4768 7xfxffl.exe 4168 bnhbtt.exe 556 vpvvv.exe 2236 jdvvv.exe 4076 xxrrlrr.exe 3860 rxrxrxx.exe 1368 nhbtnn.exe 928 dvddv.exe 364 lrrrxxr.exe 4880 tnnhbb.exe 3504 ttnnbb.exe 2784 1djdv.exe 2296 7pdvj.exe 4068 rlxxrxl.exe 3340 3flrrrl.exe 264 1hhhhh.exe 3692 pjvpd.exe 3636 xrrlllr.exe 3296 fxxxxff.exe 4480 bnnnhh.exe 980 thhhnh.exe 4200 pdjdv.exe 1664 fxxrrrf.exe 5064 btttnn.exe 2876 bnhbtn.exe 4244 3ddpj.exe 5040 vjvvp.exe 3932 lrffxfx.exe 3176 tttthh.exe 2056 1jjjv.exe 4464 jjjdv.exe 2612 rllfrrr.exe 3440 fflxxxr.exe 764 bhtbth.exe 4904 nhhbbb.exe 3100 dddvp.exe 3812 djjdv.exe 4228 9xxrllf.exe 4756 xrlllll.exe 840 bnnnhh.exe 3204 nhbbth.exe 3264 pdjdv.exe 2112 jjjjj.exe 1480 rfrxrfx.exe -
resource yara_rule behavioral2/memory/2696-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/928-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/364-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2696 wrote to memory of 3696 2696 a34a36fc7e0a2bd3df136ee6e67c94a0_NeikiAnalytics.exe 82 PID 2696 wrote to memory of 3696 2696 a34a36fc7e0a2bd3df136ee6e67c94a0_NeikiAnalytics.exe 82 PID 2696 wrote to memory of 3696 2696 a34a36fc7e0a2bd3df136ee6e67c94a0_NeikiAnalytics.exe 82 PID 3696 wrote to memory of 1232 3696 lflfffl.exe 83 PID 3696 wrote to memory of 1232 3696 lflfffl.exe 83 PID 3696 wrote to memory of 1232 3696 lflfffl.exe 83 PID 1232 wrote to memory of 4764 1232 jjvpj.exe 84 PID 1232 wrote to memory of 4764 1232 jjvpj.exe 84 PID 1232 wrote to memory of 4764 1232 jjvpj.exe 84 PID 4764 wrote to memory of 2368 4764 1dvpj.exe 85 PID 4764 wrote to memory of 2368 4764 1dvpj.exe 85 PID 4764 wrote to memory of 2368 4764 1dvpj.exe 85 PID 2368 wrote to memory of 5040 2368 btnhnn.exe 86 PID 2368 wrote to memory of 5040 2368 btnhnn.exe 86 PID 2368 wrote to memory of 5040 2368 btnhnn.exe 86 PID 5040 wrote to memory of 3588 5040 pvvpv.exe 87 PID 5040 wrote to memory of 3588 5040 pvvpv.exe 87 PID 5040 wrote to memory of 3588 5040 pvvpv.exe 87 PID 3588 wrote to memory of 2056 3588 frrfxxl.exe 88 PID 3588 wrote to memory of 2056 3588 frrfxxl.exe 88 PID 3588 wrote to memory of 2056 3588 frrfxxl.exe 88 PID 2056 wrote to memory of 3852 2056 pdvpj.exe 89 PID 2056 wrote to memory of 3852 2056 pdvpj.exe 89 PID 2056 wrote to memory of 3852 2056 pdvpj.exe 89 PID 3852 wrote to memory of 2644 3852 vpvvp.exe 90 PID 3852 wrote to memory of 2644 3852 vpvvp.exe 90 PID 3852 wrote to memory of 2644 3852 vpvvp.exe 90 PID 2644 wrote to memory of 3972 2644 xflflxr.exe 91 PID 2644 wrote to memory of 3972 2644 xflflxr.exe 91 PID 2644 wrote to memory of 3972 2644 xflflxr.exe 91 PID 3972 wrote to memory of 4736 3972 9bhhnn.exe 92 PID 3972 wrote to memory of 4736 3972 9bhhnn.exe 92 PID 3972 wrote to memory of 4736 3972 9bhhnn.exe 92 PID 4736 wrote to memory of 2960 4736 dvjdj.exe 93 PID 4736 wrote to memory of 2960 4736 dvjdj.exe 93 PID 4736 wrote to memory of 2960 4736 dvjdj.exe 93 PID 2960 wrote to memory of 2968 2960 9xxrlrl.exe 94 PID 2960 wrote to memory of 2968 2960 9xxrlrl.exe 94 PID 2960 wrote to memory of 2968 2960 9xxrlrl.exe 94 PID 2968 wrote to memory of 4708 2968 bbbbbb.exe 95 PID 2968 wrote to memory of 4708 2968 bbbbbb.exe 95 PID 2968 wrote to memory of 4708 2968 bbbbbb.exe 95 PID 4708 wrote to memory of 464 4708 nnnhbn.exe 97 PID 4708 wrote to memory of 464 4708 nnnhbn.exe 97 PID 4708 wrote to memory of 464 4708 nnnhbn.exe 97 PID 464 wrote to memory of 3192 464 jjvvd.exe 98 PID 464 wrote to memory of 3192 464 jjvvd.exe 98 PID 464 wrote to memory of 3192 464 jjvvd.exe 98 PID 3192 wrote to memory of 3840 3192 frflfxx.exe 99 PID 3192 wrote to memory of 3840 3192 frflfxx.exe 99 PID 3192 wrote to memory of 3840 3192 frflfxx.exe 99 PID 3840 wrote to memory of 2308 3840 7tttbb.exe 100 PID 3840 wrote to memory of 2308 3840 7tttbb.exe 100 PID 3840 wrote to memory of 2308 3840 7tttbb.exe 100 PID 2308 wrote to memory of 3660 2308 hbbhbt.exe 101 PID 2308 wrote to memory of 3660 2308 hbbhbt.exe 101 PID 2308 wrote to memory of 3660 2308 hbbhbt.exe 101 PID 3660 wrote to memory of 4616 3660 3pjjd.exe 102 PID 3660 wrote to memory of 4616 3660 3pjjd.exe 102 PID 3660 wrote to memory of 4616 3660 3pjjd.exe 102 PID 4616 wrote to memory of 4768 4616 pjpjj.exe 103 PID 4616 wrote to memory of 4768 4616 pjpjj.exe 103 PID 4616 wrote to memory of 4768 4616 pjpjj.exe 103 PID 4768 wrote to memory of 4168 4768 7xfxffl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\a34a36fc7e0a2bd3df136ee6e67c94a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a34a36fc7e0a2bd3df136ee6e67c94a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\lflfffl.exec:\lflfffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\jjvpj.exec:\jjvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\1dvpj.exec:\1dvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\btnhnn.exec:\btnhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\pvvpv.exec:\pvvpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\frrfxxl.exec:\frrfxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\pdvpj.exec:\pdvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\vpvvp.exec:\vpvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\xflflxr.exec:\xflflxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\9bhhnn.exec:\9bhhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\dvjdj.exec:\dvjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\9xxrlrl.exec:\9xxrlrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\bbbbbb.exec:\bbbbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\nnnhbn.exec:\nnnhbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\jjvvd.exec:\jjvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\frflfxx.exec:\frflfxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\7tttbb.exec:\7tttbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\hbbhbt.exec:\hbbhbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\3pjjd.exec:\3pjjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\pjpjj.exec:\pjpjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\7xfxffl.exec:\7xfxffl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\bnhbtt.exec:\bnhbtt.exe23⤵
- Executes dropped EXE
PID:4168 -
\??\c:\vpvvv.exec:\vpvvv.exe24⤵
- Executes dropped EXE
PID:556 -
\??\c:\jdvvv.exec:\jdvvv.exe25⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xxrrlrr.exec:\xxrrlrr.exe26⤵
- Executes dropped EXE
PID:4076 -
\??\c:\rxrxrxx.exec:\rxrxrxx.exe27⤵
- Executes dropped EXE
PID:3860 -
\??\c:\nhbtnn.exec:\nhbtnn.exe28⤵
- Executes dropped EXE
PID:1368 -
\??\c:\dvddv.exec:\dvddv.exe29⤵
- Executes dropped EXE
PID:928 -
\??\c:\lrrrxxr.exec:\lrrrxxr.exe30⤵
- Executes dropped EXE
PID:364 -
\??\c:\tnnhbb.exec:\tnnhbb.exe31⤵
- Executes dropped EXE
PID:4880 -
\??\c:\ttnnbb.exec:\ttnnbb.exe32⤵
- Executes dropped EXE
PID:3504 -
\??\c:\1djdv.exec:\1djdv.exe33⤵
- Executes dropped EXE
PID:2784 -
\??\c:\7pdvj.exec:\7pdvj.exe34⤵
- Executes dropped EXE
PID:2296 -
\??\c:\rlxxrxl.exec:\rlxxrxl.exe35⤵
- Executes dropped EXE
PID:4068 -
\??\c:\3flrrrl.exec:\3flrrrl.exe36⤵
- Executes dropped EXE
PID:3340 -
\??\c:\1hhhhh.exec:\1hhhhh.exe37⤵
- Executes dropped EXE
PID:264 -
\??\c:\pjvpd.exec:\pjvpd.exe38⤵
- Executes dropped EXE
PID:3692 -
\??\c:\xrrlllr.exec:\xrrlllr.exe39⤵
- Executes dropped EXE
PID:3636 -
\??\c:\fxxxxff.exec:\fxxxxff.exe40⤵
- Executes dropped EXE
PID:3296 -
\??\c:\bnnnhh.exec:\bnnnhh.exe41⤵
- Executes dropped EXE
PID:4480 -
\??\c:\thhhnh.exec:\thhhnh.exe42⤵
- Executes dropped EXE
PID:980 -
\??\c:\pdjdv.exec:\pdjdv.exe43⤵
- Executes dropped EXE
PID:4200 -
\??\c:\fxxrrrf.exec:\fxxrrrf.exe44⤵
- Executes dropped EXE
PID:1664 -
\??\c:\btttnn.exec:\btttnn.exe45⤵
- Executes dropped EXE
PID:5064 -
\??\c:\bnhbtn.exec:\bnhbtn.exe46⤵
- Executes dropped EXE
PID:2876 -
\??\c:\3ddpj.exec:\3ddpj.exe47⤵
- Executes dropped EXE
PID:4244 -
\??\c:\vjvvp.exec:\vjvvp.exe48⤵
- Executes dropped EXE
PID:5040 -
\??\c:\lrffxfx.exec:\lrffxfx.exe49⤵
- Executes dropped EXE
PID:3932 -
\??\c:\tttthh.exec:\tttthh.exe50⤵
- Executes dropped EXE
PID:3176 -
\??\c:\1jjjv.exec:\1jjjv.exe51⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jjjdv.exec:\jjjdv.exe52⤵
- Executes dropped EXE
PID:4464 -
\??\c:\rllfrrr.exec:\rllfrrr.exe53⤵
- Executes dropped EXE
PID:2612 -
\??\c:\fflxxxr.exec:\fflxxxr.exe54⤵
- Executes dropped EXE
PID:3440 -
\??\c:\bhtbth.exec:\bhtbth.exe55⤵
- Executes dropped EXE
PID:764 -
\??\c:\nhhbbb.exec:\nhhbbb.exe56⤵
- Executes dropped EXE
PID:4904 -
\??\c:\dddvp.exec:\dddvp.exe57⤵
- Executes dropped EXE
PID:3100 -
\??\c:\djjdv.exec:\djjdv.exe58⤵
- Executes dropped EXE
PID:3812 -
\??\c:\9xxrllf.exec:\9xxrllf.exe59⤵
- Executes dropped EXE
PID:4228 -
\??\c:\xrlllll.exec:\xrlllll.exe60⤵
- Executes dropped EXE
PID:4756 -
\??\c:\bnnnhh.exec:\bnnnhh.exe61⤵
- Executes dropped EXE
PID:840 -
\??\c:\nhbbth.exec:\nhbbth.exe62⤵
- Executes dropped EXE
PID:3204 -
\??\c:\pdjdv.exec:\pdjdv.exe63⤵
- Executes dropped EXE
PID:3264 -
\??\c:\jjjjj.exec:\jjjjj.exe64⤵
- Executes dropped EXE
PID:2112 -
\??\c:\rfrxrfx.exec:\rfrxrfx.exe65⤵
- Executes dropped EXE
PID:1480 -
\??\c:\nnttnb.exec:\nnttnb.exe66⤵PID:3096
-
\??\c:\7nnhbn.exec:\7nnhbn.exe67⤵PID:2100
-
\??\c:\1tttnt.exec:\1tttnt.exe68⤵PID:232
-
\??\c:\dvdvp.exec:\dvdvp.exe69⤵PID:1552
-
\??\c:\1flfrrf.exec:\1flfrrf.exe70⤵PID:3996
-
\??\c:\ffrllxx.exec:\ffrllxx.exe71⤵PID:804
-
\??\c:\ntnntt.exec:\ntnntt.exe72⤵PID:556
-
\??\c:\bttnhh.exec:\bttnhh.exe73⤵PID:4048
-
\??\c:\vvvpj.exec:\vvvpj.exe74⤵PID:1500
-
\??\c:\jdjdv.exec:\jdjdv.exe75⤵PID:4188
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe76⤵PID:3948
-
\??\c:\7bbnnt.exec:\7bbnnt.exe77⤵PID:1368
-
\??\c:\vpvpj.exec:\vpvpj.exe78⤵PID:928
-
\??\c:\xrflfrl.exec:\xrflfrl.exe79⤵PID:2488
-
\??\c:\9hbbtb.exec:\9hbbtb.exe80⤵PID:4252
-
\??\c:\7ppdd.exec:\7ppdd.exe81⤵PID:4104
-
\??\c:\dvjjj.exec:\dvjjj.exe82⤵PID:888
-
\??\c:\1flfxxl.exec:\1flfxxl.exe83⤵PID:2660
-
\??\c:\hnbbtt.exec:\hnbbtt.exe84⤵PID:4068
-
\??\c:\nhhnbb.exec:\nhhnbb.exe85⤵PID:2180
-
\??\c:\5jvvv.exec:\5jvvv.exe86⤵PID:1360
-
\??\c:\fxrlxxx.exec:\fxrlxxx.exe87⤵PID:3464
-
\??\c:\ntntht.exec:\ntntht.exe88⤵PID:4356
-
\??\c:\thhbtn.exec:\thhbtn.exe89⤵PID:1564
-
\??\c:\vjppp.exec:\vjppp.exe90⤵PID:4948
-
\??\c:\7rfxlfl.exec:\7rfxlfl.exe91⤵PID:4200
-
\??\c:\xrllffx.exec:\xrllffx.exe92⤵PID:2752
-
\??\c:\hbhtnn.exec:\hbhtnn.exe93⤵PID:3584
-
\??\c:\9bhhbn.exec:\9bhhbn.exe94⤵PID:4764
-
\??\c:\pjpjj.exec:\pjpjj.exe95⤵PID:1920
-
\??\c:\ppdvp.exec:\ppdvp.exe96⤵PID:1216
-
\??\c:\rflfrrl.exec:\rflfrrl.exe97⤵PID:2396
-
\??\c:\xrffxff.exec:\xrffxff.exe98⤵PID:3988
-
\??\c:\nbbbtt.exec:\nbbbtt.exe99⤵PID:2748
-
\??\c:\vjppd.exec:\vjppd.exe100⤵PID:2092
-
\??\c:\pdppp.exec:\pdppp.exe101⤵PID:1056
-
\??\c:\lfrlxxr.exec:\lfrlxxr.exe102⤵PID:1796
-
\??\c:\nbttht.exec:\nbttht.exe103⤵PID:1988
-
\??\c:\thhbtt.exec:\thhbtt.exe104⤵PID:764
-
\??\c:\tnnhhb.exec:\tnnhhb.exe105⤵PID:1692
-
\??\c:\dppjd.exec:\dppjd.exe106⤵PID:4404
-
\??\c:\jvjjd.exec:\jvjjd.exe107⤵PID:3968
-
\??\c:\xflxfxx.exec:\xflxfxx.exe108⤵PID:3976
-
\??\c:\htnhhh.exec:\htnhhh.exe109⤵PID:3112
-
\??\c:\nnnbnh.exec:\nnnbnh.exe110⤵PID:4472
-
\??\c:\dpdvp.exec:\dpdvp.exe111⤵PID:4192
-
\??\c:\pdjjv.exec:\pdjjv.exe112⤵PID:5084
-
\??\c:\xrllxxx.exec:\xrllxxx.exe113⤵PID:2288
-
\??\c:\rxffflr.exec:\rxffflr.exe114⤵PID:1720
-
\??\c:\1bbtnn.exec:\1bbtnn.exe115⤵PID:3548
-
\??\c:\dpvvj.exec:\dpvvj.exe116⤵PID:1376
-
\??\c:\7jddp.exec:\7jddp.exe117⤵PID:4184
-
\??\c:\llrrrfl.exec:\llrrrfl.exe118⤵PID:3996
-
\??\c:\jdpvd.exec:\jdpvd.exe119⤵PID:4176
-
\??\c:\5vddv.exec:\5vddv.exe120⤵PID:4076
-
\??\c:\fxllfll.exec:\fxllfll.exe121⤵PID:1500
-
\??\c:\3xxxxrl.exec:\3xxxxrl.exe122⤵PID:1612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-